Kategorie

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]

Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. [...]

** Zapnuté lokátory v odbavených kufrech nepředstavují žádné bezpečnostní riziko ** Knoflíková baterie bezpečně splňuje mezinárodní limity leteckých organizací ** Desítky aerolinek dnes tato data oficiálně využívají k dohledání ztracených kufrů

N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers. [...]

Anthropic has launched an investigation into what went wrong during a recent test of three models that left a trio of companies accidentally hacked.

The company was testing how well Claude Opus 4.7, Claude Mythos 5, and an internal test model could find hidden information about fictional companies in simulated networks. But because of a misunderstanding by one of Anthropic’s partners, the AI models gained access to the internet — and managed to find real companies with the same or similar names as the fictional ones.

As a result, three companies were actually hacked. Anthropic said it halted the tests on July 23, and the affected companies were notified four days later. So far, the company has received responses from two of the three companies, according to Reuters.

Anthropic is not alone when it comes to renegade models. An OpenAI agent recently went rogue and breached AI platform Hugging Bear and a customer of the cloud platform Modal Labs.

Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator, which it calls Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key; the strongest targets the master keySwati Khandelwalhttp://www.blogger.com/profile/[email protected]

The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site. Per Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. [...]

Flare researchers analyzed thousands of underground posts to examine how the BTMOB Android malware operation evolved into a fragmented ecosystem of resellers, source-code vendors, custom versions, and competing sales channels. [...]

Your website isn’t acting normally. Users report errors. Monitoring detects unexpected outbound connections. You discover a recently modified PHP file in your web root. Nobody can explain why. What do you do first?

If you spend time reading Linux kernel bug reports or security patches, that line is everywhere. It sits quietly at the bottom of code fixes across the entire operating system, from network drivers to file systems.

This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more than intended. Some of it was clever. Most of it was just access left lying around: old bugs, exposed gear, poisoned dependencies, weak defaults, and tooling that moved from Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Introduction

Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information (PII) that is often insecure or insufficiently tested against known vulnerabilities. In addition, machines used by multiple people without accountability can be vulnerable to insider threats.

The complexity of academic environments amplifies this risk. Unlike corporate networks, educational institutions have to provide a network that supports students, professors, researchers, administrative staff, third-party contractors, and visitors. Each of these groups has different security requirements and access control levels, making it difficult to enforce consistent security policies. A security breach can have severe consequences since it may expose vast amounts of sensitive information, such as social security numbers (CPF in Brazil), addresses, phone numbers, and even parents’ names. Armed with this information, attackers can attempt phishing attacks and impersonate the victims in SIM swapping attacks, a common practice in Brazil.

In this article, we provide details about attacks on educational institutions in Brazil observed by our Global Emergency Response Team (GERT) since 2025. We share general statistics, common threats, initial access vectors, and the impact of such violations. Additionally, we present some interesting cases encountered by our team and the identified TTPs. Finally, we offer recommendations to help institutions protect themselves against future attacks.

Key findings and statistics

Our dataset encompasses incident response cases from January 2025 to June 2026. As the chart below shows, the majority of attacks targeted institutions in São Paulo state, Brazil’s most populous state and a significant center of economic and financial activity. We also had cases in Rio de Janeiro and Pernambuco.

Geographical distribution of incident response requests at educational institutions (download)

Of the customers who requested incident response, 60% were private institutions and 40% were public institutions.

Private and public institutions (download)

The most frequent reasons for requesting IR services were related to suspicious endpoint activities, encrypted files, and the presence of suspicious files.

Incident response request reasons (download)

High-severity incidents accounted for 40% of the total cases, while the remaining 60% were medium severity.

Distribution of incidents by severity (download)

The high-severity incidents were mainly related to ransomware attacks. Interestingly, private institutions were the most targeted by ransomware, while incidents in public institutions were mostly related to suspicious endpoint activity and privilege escalation attempts. The most common ransomware families found in our dataset were DragonForce and LockBit 3, whose builder was leaked back in 2022. By using the leaked LockBit builder with a valid privileged account, attackers can build variants capable of disabling defenses and erasing logs.

The most common initial access vectors included the use of valid accounts, exploitation of public-facing applications, and insiders.

Initial access vectors (download)

For privilege escalation, the attackers often relied on Potato variants (GodPotato, SweetPotato, and BadPotato).

We also observed attackers using tools like AnyDesk for remote access, PsExec for lateral movement within compromised infrastructures, and AV-killer malware to terminate the system’s defenses. The latter was mainly used in ransomware-related incidents.

These data reveal an interesting pattern in the threat landscape affecting educational institutions in the region. Many incidents were not caused by highly sophisticated techniques but rather by the abuse of common weaknesses such as valid accounts, exposed applications, and inadequate patch management, as well as the use of publicly available tools that are well-known to the adversaries. The prevalence of ransomware in private institutions suggests a stronger financial motivation, likely because attackers assume these organizations are more capable of paying for data recovery than public schools and universities.

Most attacks were discovered promptly and lasted from a few minutes to a couple of hours. However, technical incident response activities averaged 9.6 hours. This indicates that the impact caused by an incident often extends beyond the timeframe of the active attack, requiring extensive triage and analysis by the forensic investigators to fully restore operations.

One interesting fact is that we are still observing the use of Windows 10 in the infrastructures of educational institutions, even after Microsoft’s official end-of-support date of October 2025. In addition, we found that some customer organizations were using Windows Server 2016 without security patches and fixes. Using outdated and unsupported operating systems increases the attack surface of an infrastructure because attackers can exploit publicly available vulnerabilities to access vulnerable systems and expand their presence in the network. In addition, legacy operating systems may be incompatible with modern evidence collection tools, necessitating extra time and alternative procedures for forensic acquisition.

Obsolete systems in organizations (download)

Interesting cases Case 01 – Leaked LockBit builder

In one case, we identified the use of a custom version of LockBit that was generated using the leaked builder. The ransomware was delivered to the organization’s infrastructure via a valid account that had been leaked. It encrypted the organization’s internal systems, including file servers and databases that stored student profiles and other data. There was no evidence of data exfiltration from the affected machines.

During our analysis of the LockBit sample, we were able to extract its configuration. Interestingly, it was configured without the impersonation and spreading options. This meant the attacker had to perform manual lateral movement to deploy the malware across the network.

"config": { "settings": { "impersonation": false, "local_disks": true, "network_shares": true, "kill_processes": true, "kill_services": true, "set_wallpaper": true, "self_destruct": true, "kill_defender": true, "wipe_freespace": true, "psexec_netspread": false, "gpo_netspread": false, …

Further analysis revealed that the attacker used PsExec for lateral movement. By analyzing the Update Sequence Number (USN) Journal, we were able to identify .KEY files associated with PsExec that showed us the previously compromised machines used by the attacker.

After gaining access to the target machines, the adversaries deployed a batch script to disable the system’s defenses. Our analysis of this artifact showed that they had the administrative credentials to disable the EDR in place. In addition, the script enabled RDP, which gave the attackers remote access to the target. The listing below shows an excerpt of the script:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f netsh advfirewall firewall add rule name="allow RemoteDesktop" dir=in protocol=TCP localport=3389 action=allow reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnRealTimeProtection /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /t REG_SZ /d "" /f reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{UUID}" /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f sc stop WinDefend sc config WinDefend start= disabled

Finally, by cross-checking the Prefetch files, we were able to identify the precise dates of PsExecSvc.exe and LBB.exe (LockBit) execution. This revealed that the attacker established the initial connection to the analyzed machine around 5:30am UTC and ran LBB.exe for the last time at 10am UTC on the same day, resulting in an activity window of approximately four hours and thirty minutes. We were able to identify the extent of the compromise and the additional machines that required network isolation for further forensic analysis, containment, and remediation.

Case 02 – DragonForce deployed via AnyDesk

In another incident, we identified a compromised user account that the adversaries used to install the AnyDesk software to enable remote access. Although the attacker erased the system logs after encrypting the victim’s files, we were able to identify the ransomware execution event via the Prefetch and Amcache.hve files, which provided us with the SHA-1 hash of the sample.

Once we obtained the SHA-1 of the malicious artifact (named by the attacker as 1.EXE), we were able to confirm that it was a DragonForce variant. Even though the lack of evidence made the analysis more difficult, this case shows that forensic investigators must be prepared to identify information that the attackers missed or left untouched.

Case 03 – Python keylogger used by an insider

The third incident illustrates how a series of bad practices enabled an insider to collect passwords from other users inside the infrastructure. First, the customer contacted us stating that a machine was exhibiting strange behavior: files containing passwords were being created. We started with triage collection on one of the affected machines.

Evidence from the Program Compatibility Assistant (PCA) showed the execution of two suspicious files, Windows Host Widgets.exe and Windows Host Widgets_.exe, both located in the C:\Users\<user>\.vscode\dlo directory, where <user> represents a user account shared by everyone who uses the machine. The same artifacts were identified within the Amcache.hve file, and multiple executions were also confirmed by analyzing the Prefetch files. Another interesting source of evidence, UserAssist, confirmed that the threat actor also executed both EXE files by double-clicking on them.

MFT analysis showed that multiple log files named cacheX.txt were created in the previously mentioned directory, where X was a number that increased with each malware execution. We then analyzed the EXE files to confirm their behavior. Luckily, both proved to be the same Python script, which we could easily decompile.

As shown in the listing below, the script contains methods and strings with Portuguese names. It is capable of hiding the log files from view in Explorer. The developer also set a procedure to identify when the Caps Lock key was pressed, in order to record the correct passwords.

def get_base_path(): ... def encontrar_proximo_nome(base='cache'): ... def set_file_hidden(filepath): ... ctypes.windll.kernel32.SetFileAttributesW(str(filepath), FILE_ATTRIBUTE_HIDDEN) ... with open(log_file, 'a', encoding='utf-8') as f: f.write(f'\n\n--- Registro iniciado em {datetime.datetime.now()} ---\n') set_file_hidden(log_file) ... def is_capslock_on(): return bool(ctypes.windll.user32.GetKeyState(20) & 1) ... def on_press(key): ... def on_release(key): ... def main(): with keyboard.Listener(on_press=on_press, on_release=on_release) as listener: listener.join() if __name__ == '__main__': main()

This simple script did not implement any persistence or automated data exfiltration mechanisms. Therefore, the insider likely had to manually retrieve the generated log files containing the text typed by the victims. By revisiting the previously collected evidence, we identified USB connections around the same time as the script’s executions. This suggests that removable media was probably used to collect the generated keylogging logs from the environment. As a result of the investigation, the customer changed the passwords of all affected accounts. However, without additional evidence or footage, it was not possible to conclusively attribute the activities to a specific individual and take the appropriate disciplinary and legal measures.

Conclusions and recommendations

The incidents highlighted in this article demonstrate that Brazilian educational institutions face a diverse set of threats, ranging from ransomware operations to insider activity. In many cases, the attackers relied on valid credentials, exposed services, remote access tools, poor patch management, and insufficient endpoint hardening rather than advanced malware or new techniques. Based on these findings, educational institutions should prioritize controls that reduce the likelihood of account compromise and the impact of ransomware deployment. They should also improve forensic visibility after an incident.

Institutions should enforce the use of multi-factor authentication (MFA) for all publicly accessible services, especially VPNs, remote access portals, and email accounts. Since valid accounts were one of the most common initial access vectors observed in our dataset, MFA can significantly reduce the likelihood that stolen or reused credentials alone will compromise the entire environment. We also recommend periodically reviewing privileged accounts, removing unnecessary administrative permissions, and avoiding shared accounts, especially on machines accessed by multiple users, since this makes accountability extremely difficult.

Each user should have their own account, following the principle of least privilege to prevent unauthorized software execution. Additionally, it is advisable to restrict and monitor the use of remote access tools such as AnyDesk or TeamViewer. Unexpected installations or executions of these tools should be treated as high-priority alerts.

To minimize the impact of ransomware, educational institutions should improve their backup and recovery strategy. Backups should be isolated from the primary environment (preferably in more than one location) and tested regularly. Centralized logging, extended EDR telemetry retention, and proper time synchronization across hosts can also improve the ability to reconstruct an attack timeline and implement the necessary response measures.

The use of outdated systems increases the attack surface, so we recommend that organizations adopt an effective update and patch management policy. It is also important to raise security awareness, since users must understand the risks associated with credential sharing, unknown executables, and unauthorized software.

From a digital forensics and incident response (DFIR) perspective, the reviewed incidents demonstrate that effective incident response activities require correlating multiple forensic artifacts in order to reconstruct the attacker’s actions. Investigators should be aware of how to find information even when logs are missing. Many other artifacts are preserved and can be used for this purpose, such as Amcache, PCA, Prefetch, UserAssist, MFT, and USN Journal. The attackers may fail to erase all traces of their activity, so taking a broad forensic approach is of the utmost importance for determining the scope of the compromise and supporting containment and remediation actions.

Observed TTPs

The table below shows the observed TTPs in our dataset, including cases not detailed in this post.

Tactic Technique ID Resource Development Compromise Accounts T1586 Collection Input Capture: Keylogging T1056.001 Execution System Services: Service Execution T1569.002 Execution Hijack Execution Flow: DLL T1574.001 Privilege Escalation Exploitation for Privilege Escalation T1068 Lateral Movement Remote Services: Remote Desktop Protocol T1021.001 Command and Control Remote Access Tools T1219 Exfiltration Exfiltration over Physical Medium: Exfiltration over USB T1052.001 Impact Data Encrypted for Impact T1486

Apple has had to introduce a quota on security researcher reports because its systems are being overwhelmed by low-quality warnings generated by AI. 

It’s a classic illustration of the rule of unintended consequences: a technology meant to help us has become a barrier to getting things done. After all, not only has AI driven the cost of consumer electronics higher, but it is also being used to identify and exploit security vulnerabilities — while also overwhelming security teams with low-grade reports, thus eroding their attention span.

The cost of good intentions

This is what’s happened at Apple, as security researchers use AI as a tool to identify new bugs. Perhaps the reports are well-intended. Hopefully, the researchers aren’t just motivated by the promise of easy bug bounties. Or maybe this is a cynical attempt to overwhelm platform security teams with low-grade bug reports — while holding back larger attacks for actual use by well-resourced state-backed actors.

We can’t know whether attackers really are trying to overwhelm active platform defenses before going in for the kill. But given that it’s an actively used military strategy, it’s pretty hard to ignore the possibility.

Apple’s response

So, what’s happening at Apple? The company has put some limits in place to bug reporting as things got out of hand. It introduced a quota cap and a 30-day cool-off period for submitted reports, though researchers who exceed the cap can request an extension.

This follows Apple’s recent decision to increase its top security bounty payout to $5 million for the most severe exploits. Apple has paid out more than $35 million to around 800 researchers since launching its bug bounty program.

A Financial Times report tells us the many of the reports were about identical bugs, some already resolved, some trivial, but in combination comprising a fog of war that made it harder and more time-consuming to identify the really big flaws. The situation became so febrile the company made the decision to put limits in place in June.

There is a little wriggle room to the approach: Apple has worked with the security community long enough to recognize some research teams. Those it trusts most can have their quota extended. Apple also deployed its own AI systems to triage incoming reports in an attempt to identify and remove AI-generated slop.

The company also uses internal systems from Anthropic and OpenAI to help identify and fix vulnerabilities; that led to an extensive collection of fixes in its most recent software patch.

The Times details an Italian company called Bynario, which identified a fairly nasty-sounding privilege escalation chain that lets attackers take complete control of a Mac. The company also reported a second bug, CVE-2026-43760, a macOS Screen Sharing flaw that allowed an authenticated VNC viewer to access protected data and create files with root privileges.

Unfortunately, the hard-working research team was unable to report the first bug, as it had filed more than 50 reports in just three weeks thanks to AI. In other words, it’s possible some security researchers right now are unable to file warnings of critical vulnerabilities to Apple because the system is overwhelmed by slop.

This is not just an Apple problem

What makes this far more problematic is that it isn’t just Apple that is affected – security teams on multiple platforms are grappling with the same problem. Rafe Pilling, a security expert at Sophos, told the FT that bug bounty programs across the industry have had to shift from finding vulnerabilities to validating reports of them “at machine speed.”

That follows comments from Jamf security expert Adam Boynton, who last week characterized AI use in security as, “an arms race between defenders and attackers who are both, increasingly, running the same kind of tools.”

When it comes to platform security, it is possible that AI has added a new dimension of complexity to an already complex environment. Hopefully, the real threats will continue to be swiftly identified as they emerge, rather than being wrongly characterized as AI slop.

When no one comes running

To understand how this works, try reading Aesop’s fable about a shepherd boy who raised the alarm so often that when the real wolf arrived, no one came to help and the young shepherd? He was eaten.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

Alibaba on Monday introduced Qwen3.8-Max, its largest artificial intelligence model to date, expanding its enterprise AI portfolio with an open-weight model designed for software engineering, multimodal reasoning, and other knowledge-intensive business workloads.

In a blog post announcing the launch, Alibaba described Qwen3.8-Max as a 2.4-trillion-parameter mixture-of-experts (MoE) model that activates only about 95 billion parameters during inference.

The company said the architecture is intended to improve inference efficiency while supporting coding, reasoning and multimodal tasks, with open-weight versions scheduled for release next week through Alibaba Cloud’s Model Studio.

“We believe it’s one of the most powerful model available today, compatible to leading frontier AI models, second only to Fable 5,” Alibaba said in an X post.

Benchmarks target Anthropic and OpenAI’s coding models

Alibaba published internal test results comparing Qwen3.8-Max against Claude Opus 4.8, Claude Fable 5, and OpenAI’s GPT-5.6 Sol on coding benchmarks, including SWE-bench Pro and a proprietary evaluation the company calls NL2Repo-Bench.

The company said it evaluated competing models using each vendor’s own coding harness, Claude Code for Anthropic’s models and Codex for GPT-5.6 Sol, and reported the highest published score across available configurations for each rival.

Charlie Dai, vice president and principal analyst at Forrester, said the launch signals Alibaba is closing ground on proprietary leaders, though that isn’t the full picture.

“Alibaba is narrowing the gap, but the larger story is the rapid maturation of open-weight models,” Dai said. “Enterprises increasingly have credible alternatives to proprietary frontier models, particularly for software engineering, domain customization, sovereignty, and cost-sensitive deployments, where openness often matters as much as absolute model performance.”

Company touts a 16-day autonomous coding run

Alibaba said it tested the model on three unsupervised, multi-day coding projects requiring it to take a task from an empty project folder to completion without human assistance, including one project the company said took 16 days to complete on its own.

Alibaba also highlighted enterprise applications across legal compliance, financial analysis, engineering design, quantitative research and multimodal content creation, saying the model is intended to complete entire business workflows rather than individual AI-assisted tasks.

Amit Jena, development manager for AI at Kanerika, said that the claim deserves more scrutiny than it has received.

“The claim worth examining is not the parameter count. Alibaba says the model completed a software engineering project in 16 days. That sentence has been reprinted everywhere and interrogated nowhere,” Jena said. “Sixteen days of what? How many times did a human step in? Did the output survive code review?”

Jena said the open-weight commitment itself should also be read carefully. “Publishing weights is a separate act from opening an API endpoint,” he said. “Until there is a repository, a licence and a model card, open-weight describes an intention.”

Analysts say inference efficiency isn’t the real constraint

Alibaba’s mixture-of-experts architecture activates roughly 95 billion of the model’s 2.4 trillion parameters per request, a design the company says lowers inference costs.

Dai said that tradeoff now matters more to enterprise buyers than raw model size. “Inference efficiency now matters more than raw model size for most enterprises,” he said. “Activating only a fraction of total parameters can significantly reduce serving costs and infrastructure requirements, making frontier-class performance more accessible for production deployments where scalability, latency, and economics are often bigger concerns than benchmark leadership.”

Jena said efficiency gains matter less than an organization’s ability to actually test the model. “Efficiency stopped being the interesting question. The constraint that actually binds is evaluation throughput,” he said.

Nitish Tyagi, senior principal analyst at Gartner, said the significance of the release lies less in the parameter count than in what it signals about competitive pressure on AI deployment costs.

“Gartner has previously predicted that, without stronger cost controls, AI coding expenses could exceed the average developer’s salary,” Tyagi said. “The combination of open weights, a mixture-of-experts architecture, and a one-million-token context window represents a meaningful step toward making AI-augmented software development more economically viable.”

Tyagi cautioned that enterprises need to look beyond inference costs when weighing the model for production use.

“Many organizations outside China may be hesitant to rely on models hosted within China, leading them to deploy through hyperscalers or on-premises infrastructure, both of which introduce additional costs,” he said.

Open-weight models also typically lack the indemnification protections that come with commercial AI vendors, he said, meaning enterprises need their own security, governance, and code-scanning controls to catch copyright and intellectual property risks before production deployment.

What CIOs should look out for

Jena said the flagship model announced Monday may not be the one enterprises end up running.

“Qwen3.8-27B, announced alongside the flagship and almost entirely ignored in coverage,” is the more deployable option for most organizations, he said, since it can run on infrastructure they own and fine-tune on their own data.

Dai said enterprise leaders evaluating the release should prioritize transparency and total cost of ownership over headline figures. “The key question is whether Qwen3.8 delivers measurable business outcomes, enterprise-grade reliability, lower total cost of ownership, and options for digital sovereignty compared with competing models,” he said.

The article originally appeared on InfoWorld.

AI is moving incredibly fast, and every security leader is feeling the pressure to keep up. AI platforms like Claude, Codex and Cursor are already helping security teams write detections, investigate alerts, summarize incidents, and automate repetitive work. The conversation has evolved from whether AI belongs in the SOC, to where each type of AI delivers the most value. With so many new AI [email protected]

Business owners can effectively manage Linux security by shifting their focus from technical commands to strategic risk management and operational oversight.

Chinese smartphone makers have been followers in the global market, embracing the concepts and paradigms set in the past 20 years by Apple and Google. But AI may be giving the Chinese an opportunity to break away and set their own path forward. 

Specifically, Chinese companies are integrating AI more fully into smartphones, and also using AI for limited robotics in phones. Here’s what you need to know about these emerging trends. 

China’s ZTE recently showed its Nubia NaviX Ultra. The phone runs ByteDance’s Doubao AI agent, which users can access with voice commands or by pressing a button on the phone. The phone has no home screen and no conventional app store.

Another Chinese company, called StepFun — it was founded in 2023 by Jiang Daxin, a former Microsoft vice president and chief scientist at Microsoft’s Software Technology Center Asia — sells a phone called the StepX Neo. It runs a proprietary operating system called Step AOS based on Android, Linux, and an RTOS containing a built-in AI agent called Step Amoo. The StepX Neo splits phone functions into four primitives (communication, apps, files, system tools) that the agent recombines based on the stated goals of the user. 

Honor, a phone maker spun off from Huawei, has an AI agent the company built with input from Alibaba called the YOYO Intelligent Agent. It ships on Honor’s entire MagicOS 10-eligible lineup.

Note: an American company is enabling this. All three phones use Anthropic’s Model Context Protocol (MCP) to give system-level access to the agents. 

None of these phones will become available in the United States. ZTE is banned from the US by the FCC over national-security concerns, while the StepFun and Honor phones are built for the Chinese market with no US version planned. 

All modern smartphones can run AI. By simply visiting the Apple App Store or the Google Play Store, anyone can download dozens of AI apps, including those offered by the frontier model companies. Or they can use the AI services and tools built in to phones by Apple and Google. 

How agentic AI phones are different

What’s different about the new agentic AI phones in China is that the operating system itself has an agentic AI layer that enables it to function across apps and instead of apps. 

While agentic AI phones represent a minority of the current market, they feel like the future. And that future is consequential. First, it’s a another step toward independence from Android. Google’s services layer is already gone from China. Now the Android app layer is being replaced by vertically integrated agent stacks owned by Chinese super-app companies. 

Despite building agentic features that cross app boundaries to a limited degree, Apple and Google are unlikely to allow third-party agents to replace the app layer of their mobile OSs anytime soon. 

Apple takes 15% to 30% of app revenue. And (according to an estimate introduced during the Epic v. Apple/Google litigation but not confirmed by Google), the Play Store has historically accounted for somewhere between 17% and 26% of Google’s operating income. The entire economic logic of iOS and Android depends on apps. An agentic layer that dissolves those apps into tasks isn’t something either company wants to think about. The Chinese OEMs can blow up the app model because they had no stake in it. 

Meanwhile, the AI trend is suffocating mobile app in-app purchases, which dropped by roughly 40% by early 2026, even as people pay more for those purchases compared to a few years ago (because they’re dominated by subscriptions to AI and vibe-coded apps). In other words, even inside the app stores, there’s a shift from the old app model to AI replacements. 

AI is not only changing the software model, but the hardware model, too. 

Robot phones

Another categorical way China is splitting off from the global smartphone concept is the nascent market of robot phones. A robot phone is one that uses AI to control physical robotic components on an actual phone. 

The leading contender in this field is a device called the Honor Robot Phone, which I wrote  about in March. A leaked unboxing video of the Honor Robot Phone appeared this week on the Chinese social network Weibo.

The robotic element is a gimbal with a 200-megapixel camera on it. One basic use is that the phone can remain stationary while propped up on a table or clamped to a tripod, while the camera tracks a moving subject using AI. Another use is to walk while using it and let the gimbal smooth out the jiggling and movement. Software on the phone also enables automated cinematic special effects. 

But the real leap forward is in “self expression” for the phone. The Honor Robot Phone exhibits subtle Attachment Economy features. It shakes its “head” no and nods yes. And it can do a “backflip” to “cheer you up.” The phone gets a personality. 

Honor plans to launch the phone on Aug. 12 in China. 

So-called “robot phones” are even more rare in China than agentic AI phones. Still, the Honor Robot Phone represents another Chinese departure from the Silicon Valley smartphone hardware model of a static pane of glass. The Honor Robot Phone has a body. It feels like the future, too, as it’s one of the rare products in the emerging Attachment Economy, where humanlike attributes (in this case, gestures and body language) are deployed to make the consumer more “attached” to devices that seem like they have thoughts and feelings. 

The AI future of phones

As the Chinese smartphone market splits off from the American one, it presents an alternative for the world. Because if the agentic AI phones succeed in China, they’ll almost certainly be offered internationally. 

That represents not only hardware sales, but the penetration of Chinese super-apps, Chinese financial services, Chinese AI-based information (and along with it, the Chinese government’s world view, we can expect). 

The only question is: Will the world prefer the Chinese agentic AI approach or the US AI app model? 

Adding to the complexity is the coming wave of AI wearables, most of which will likely be wirelessly “tethered” to smartphones that provide intelligence and connectivity. Soon, we’ll be conversing with our glasses and watches. Our glasses and watches will be “conversing” with our phones. And our phones will be conversing with AI models that represent the values, beliefs and biases of their creators. 

The Chinese agentic AI movement represents a split in how phones work and how the people worldwide interact with information, technology and each other. 

AI disclosures: This article is 100% human-written by the author, Mike Elgan. Some research, ideation, and fact- and grammar-checking was performed using AI tools.

An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. The incident, identified on July 26, also exposed some names Swati Khandelwalhttp://www.blogger.com/profile/[email protected]