This week’s theme is the trusted path: a service provider with access to a bank, the websites your phone visits, and a convenience setting in an AI coding assistant. Each one turned into a way in. Here’s what working and aspiring security pros need to know.

Critical Threats

Hackers Pull Off a $133 Million Heist at a French Bank via a Service Provider

Crédit Mutuel Arkéa, a French cooperative bank, was hit by a cyberattack that resulted in fraudulent transactions totaling up to $133 million. BleepingComputer reports the attackers went through a service provider. The bank suspended certain systems while it dealt with the incident.

Why it matters: your vendors’ access is your attack surface. When a provider can touch payment flows, its security is effectively part of yours, so treat that access like privileged access: scope it tightly, log it, and alert on unusual transaction patterns. Have a plan for shutting systems down quickly, too. Arkéa had to suspend systems, and that’s a decision you want rehearsed, not improvised. If you’re aiming for a GRC or third-party risk role, this story is a ready-made interview example.

Read more at BleepingComputer →

N-Day Exploits Power Zero-Click Attacks on iOS and Android

Hackers are using n-day exploits, meaning flaws that are already publicly known, in zero-click attacks against iOS and Android devices. The campaign is a large-scale watering hole operation attributed to Russian hackers: they compromise legitimate websites or stand up fake ones, then wait for mobile users to visit.

Why it matters: “n-day” means patches exist for the vulnerabilities being exploited. The phones at risk are the ones that haven’t been updated. Zero-click means user training won’t save you here, so the defense is patch speed. If you manage mobile devices, set and enforce a minimum OS version, and know how many of your devices are below it today. For aspiring pros, mobile device management is an underrated skill that shows up in a lot of job postings.

Read more at BleepingComputer →

Philippine Migrant Worker Data Exposed in 69GB Government Breach

An unknown operator stole SQL Server backups from the Philippine Overseas Employment Administration in less than 30 minutes. Dark Reading reports that personal information of Philippine migrant workers may have been exposed in the 69GB breach.

Why it matters: backups are a copy of everything, and they’re often protected less carefully than the production database. Encrypt them, restrict who and what can read them, and alert on unusual access to backup locations. Thirty minutes is a short window. Ask yourself whether your monitoring would even notice a large backup file leaving the network in that time.

Read more at Dark Reading →

Vulnerabilities & Patches

Claude Code’s “Don’t Ask Again” Setting Leaked Secrets Into 1,122 Public Repos

When a developer approves a command in Anthropic’s Claude Code with “Yes, and don’t ask again,” the assistant saves that command verbatim in a project settings file. If the command included a password or API key, the secret went into the file too. Once that file was pushed to a public GitHub repository, the secret was exposed. Software security company Apiiro reported finding this in 1,122 public repositories.

Why it matters: AI coding tools write files into your projects, and those files get committed like anything else. Check what your assistant stores, add its local settings files to .gitignore, and run secret scanning on every push. Never paste secrets directly into commands; use environment variables or a secrets manager. If you’ve used this setting, search your repos and rotate anything you find.

Read more at The Hacker News →

Tools & Strategy

Germany Launches a Formal IT Security Apprenticeship

Cisco Talos shares lessons from it-sa, the IT security expo, including Germany’s introduction of a formal IT Security apprenticeship program. The program aims to give young hackers structured training and a clear path into cybersecurity work.

Why it matters: apprenticeships are a real alternative to the degree-plus-certs route, and they put hands-on work first. If you’re breaking in, the lesson travels: show what you can do, not just what you’ve studied. Document your labs, write up what you learn, and make that work easy for a hiring manager to find.

Read more at Cisco Talos →

Tools I use: Speaking of making your work easy to find, I use Canva to turn lab write-ups into clean diagrams and one-page visuals for a portfolio. That’s my own recommendation, not part of this story or its source. (Affiliate link: it supports CybersecurityOS at no cost to you.)

Industry News

Google and Partners Dismantle a Botnet of 1.3 Million TV Boxes

Google and industry partners disrupted a botnet made up of more than 1.3 million Android TV set-top boxes that came preloaded with malware. The malware secretly rented out owners’ internet connections as proxies and committed ad fraud. The takedown is expected to cut the botnet off from more than 10 million additional compromised IoT devices, including Android-based healthcare devices and karaoke machines.

Why it matters: these devices were compromised before anyone took them out of the box, which makes this a supply chain problem. Cheap, unbranded IoT gear doesn’t belong on the same network as anything you care about. Segment it, and watch for devices generating traffic that looks like proxy activity. For aspiring pros, this kind of takedown shows how much defense depends on cooperation between companies.

Read more at KrebsOnSecurity →

Tools I use: If you run a local meetup, CTF team, or study group, a little swag goes a long way for building community. I order stickers through Sticker Mule. That’s my own recommendation, unrelated to any story here. (Affiliate link: it supports CybersecurityOS at no cost to you.)

Also This Week

• KrebsOnSecurity: White House staff devices reportedly running residential proxy services, including one tied to a Russian company
• Russian police arrest 3 suspected members of the VasyGrek (Fluffy Wolf) group and dismantle its infrastructure
• Reuters: report says the UK must expect an AI-powered attack on critical infrastructure within two years
• Dark Reading: the UK invests in domestic AI and cybersecurity, but some security leaders say the funding is too scattered and too late
• Video: Alex Stamos on whether we’re entering a cybersecurity dark age

That’s the week. Review what your vendors can reach, get your phones patched, and check what your AI tools are writing into your repos. We’ll see you next Sunday. Follow along for daily updates in between.