NewsPublished 11 Sep 2026

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

Source SecurityWeek

phishing

Description

This report summarizes multiple cybersecurity news items including a new InjectEave electromagnetic side-channel attack, a SIM swapping conviction, and findings on the Glasswing vulnerability ledger. The InjectEave attack allows attackers to recover audio or appliance states remotely by inducing hardware nonlinearities with RF signals. A former AT&T employee was sentenced for SIM swapping that enabled bank account takeovers. The Glasswing review found a low remediation rate of reported vulnerabilities and discrepancies in severity assessments. Other highlights include phishing evasion using invisible Unicode, a US bounty on an Iranian cyber official, and ties between a Chinese hacking group and military contractors.

Impact

The InjectEave attack demonstrates a new vector for eavesdropping and device state inference without physical access, potentially compromising privacy and security of affected devices. The SIM swapping insider threat case highlights risks from privileged employee access leading to significant financial losses. The Glasswing findings review indicates challenges in vulnerability remediation and severity assessment accuracy, which may affect risk prioritization. Phishing evasion techniques using invisible Unicode could reduce effectiveness of email filters, increasing phishing risks. The US bounty and Chinese hacking group analysis underscore ongoing nation-state cyber threats targeting critical infrastructure and military sectors.

Defensive guidance

No specific vendor advisories or patches are provided for the InjectEave attack; mitigation would require further research and potentially hardware or firmware changes to prevent electromagnetic leakage. For SIM swapping risks, organizations should enforce strict access controls and monitoring of employee activities. Users should update WordPress Super Forms plugin to version 6.3.314 to address the critical arbitrary file upload vulnerability mentioned in the report. Organizations should remain vigilant against phishing campaigns using invisible Unicode and OAuth consent phishing by educating users and employing advanced detection techniques. The Glasswing findings highlight the importance of timely vulnerability remediation and accurate severity assessments.

Summary

The InjectEave attack is a novel electromagnetic side-channel technique where external RF signals induce hardware nonlinearities in commercial devices, leaking low-frequency analog information such as private audio or appliance states without physical device access or modification. The report also covers a SIM swapping case resulting in prison time for an insider threat who facilitated bank fraud. Additionally, a review of Anthropic’s Project Glasswing vulnerability ledger revealed that only a small fraction of reported findings have been fixed months after disclosure, with notable differences between AI-generated severity ratings and maintainer assessments. Other news includes phishing evasion via invisible Unicode characters, a US $10 million bounty on an Iranian cyber official linked to critical infrastructure attacks, and analysis of Chinese hacking group QTFY’s military connections.

References

securityweek.com/in-other-news-injecteave-attack-sim-swapper-sentenced-glasswing-findings-review/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Sep 2026, 14:32 UTC

References

Community reviews

Related threats