The InjectEave attack is a novel electromagnetic side-channel technique where external RF signals induce hardware nonlinearities in commercial devices, leaking low-frequency analog information such as private audio or appliance states without physical device access or modification. The report also covers a SIM swapping case resulting in prison time for an insider threat who facilitated bank fraud. Additionally, a review of Anthropic’s Project Glasswing vulnerability ledger revealed that only a small fraction of reported findings have been fixed months after disclosure, with notable differences between AI-generated severity ratings and maintainer assessments. Other news includes phishing evasion via invisible Unicode characters, a US $10 million bounty on an Iranian cyber official linked to critical infrastructure attacks, and analysis of Chinese hacking group QTFY’s military connections.

The InjectEave attack demonstrates a new vector for eavesdropping and device state inference without physical access, potentially compromising privacy and security of affected devices. The SIM swapping insider threat case highlights risks from privileged employee access leading to significant financial losses. The Glasswing findings review indicates challenges in vulnerability remediation and severity assessment accuracy, which may affect risk prioritization. Phishing evasion techniques using invisible Unicode could reduce effectiveness of email filters, increasing phishing risks. The US bounty and Chinese hacking group analysis underscore ongoing nation-state cyber threats targeting critical infrastructure and military sectors.

No specific vendor advisories or patches are provided for the InjectEave attack; mitigation would require further research and potentially hardware or firmware changes to prevent electromagnetic leakage. For SIM swapping risks, organizations should enforce strict access controls and monitoring of employee activities. Users should update WordPress Super Forms plugin to version 6.3.314 to address the critical arbitrary file upload vulnerability mentioned in the report. Organizations should remain vigilant against phishing campaigns using invisible Unicode and OAuth consent phishing by educating users and employing advanced detection techniques. The Glasswing findings highlight the importance of timely vulnerability remediation and accurate severity assessments. No immediate patch status is confirmed for InjectEave or other novel threats mentioned; check vendor advisories for updates.