NetSec News Articles of Interest From the Week of August 18, 2025
Read more cybersecurity news in this edition of NetSec News.
Google Gemini AI bot hijacks smart homes, turns off the lights
In a real-life demonstration, three security researchers illustrated how they could hijack Google’s artificial intelligence bot, Gemini, and use it to take over smart home functions. (Dark Reading)
 |
|
“Smart home devices have always been vulnerable and AI integration makes them even more so. The risks of AI security are no longer limited to data breaches, they now extend into real world safety. Yet LLMs are being rapidly integrated into almost every service without sufficient consideration for security, the attack surface expands while security lags behind. We’ve already seen instances of direct manipulation, such as with Amazon’s shopping AI, Rufus, where users tricked it into bypassing restrictions and essentially turning into a free version of ChatGPT. While funny as that may be, the real elephant in the room is prompt injection, where hidden instructions are embedded in the content an AI later processes acting as a time bomb. These “time bombs” are difficult to fully sanitize at scale, especially as AI systems interact across apps. As soon as LLMs control actuators in the real world securing against prompt injections becomes as critical as patching vulnerabilities in industrial control systems.” –Alex Malooley, Tier 2 SOC Analyst at C3 Integrated Solutions |
WinRAR zero-day exploited to plant malware on archive extraction
A recently fixed WinRAR vulnerability tracked as CVE-2025-8088 was exploited as a zero-day in phishing attacks to install the RomCom malware. (Bleeping Computer)
AI tools fuel Brazilian phishing scam while Efimer trojan steals crypto from 5,000 victims
Cybersecurity researchers are drawing attention to a new campaign that’s using legitimate generative artificial intelligence (AI)-powered website building tools like DeepSite AI and BlackBox AI to create replica phishing pages mimicking Brazilian government agencies as part of a financially motivated campaign. (The Hacker News)
Dissecting the CastleBot Malware-as-a-Service operation
IBM X-Force has been investigating a newly emerging malware framework named CastleBot. The malware is believed to be part of a Malware-as-a-Service (MaaS) operation and is specifically designed for flexible malware deployment. CastleBot is currently used by cyber criminals to deliver everything from infostealers to backdoors like NetSupport and WarmCookie, which have been linked to ransomware attacks. (IBM)
German phone repair and insurance firm goes bankrupt after paying €200,000 to ransomware hackers despite reported revenue of 70 million
Einhaus Group, a German phone repair and insurance company with €70 million in revenue, went bankrupt after paying a €200,000 ransom to the Royal hacking group. The ransomware attack encrypted all systems, leaked 11% of the company’s data, and caused mid-seven-figure damages, leading to a reduction from 170 employees to eight. Despite seized hacker cryptocurrencies, unrecovered funds halted recovery, highlighting cybersecurity risks for businesses. (PC Gamer)
SentinelOne to acquire Prompt Security to advance GenAI security and agent security strategy
SentinelOne will acquire Prompt Security, a leader in AI runtime security, to enhance its AI-native Singularity™ Platform. The acquisition aims to secure generative and agentic AI in workplaces by providing real-time visibility, preventing data leaks, and blocking prompt injection and misuse, while fostering innovation. This move strengthens SentinelOne’s platform, offering CISOs and IT leaders robust control for safe AI adoption and driving growth for SentinelOne and its partners. (SentinelOne)
Meet the Author
