Daily · 2026-08-01
🎯 CaptiveCrunch Traveler Wi-Fi Attacks, 🚰 Minnesota Water Fallout, 🤖 DeepSeek Autonomous Attacks, 📦 AUR Malware Wave, 🏥 Amgen Cloud Breach, 🇬🇧 UK DfE Breach
Midnight Blizzard sub-cluster Storm-2945 is running AI-augmented captive-portal attacks on corporate travelers (CornFlake/ChocoShell malware); Minnesota water-system fallout continues with new exposure data and political wrangling; Unit 42 documents a fully autonomous DeepSeek-driven attack campaign; a fresh AUR malware wave forces Arch Linux to disable package adoption; Amgen and the UK Department for Education disclose breaches.
CaptiveCrunch is the day's defining story because it turns a routine travel annoyance into a corporate compromise. Storm-2945, assessed as a Midnight Blizzard sub-cluster, hijacks hotel and conference Wi-Fi to redirect browsers' connectivity checks toward fake update prompts that install the CornFlake RAT and the ChocoShell infostealer. The payloads target Microsoft 365 SSO tokens, browser cookies, and Wi-Fi credentials, and the campaign has been running since May. Traveling employees are the new perimeter. CaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi
Unit 42's writeup of a DeepSeek-driven agent running unattended attacks shows the same automation pressure on the offensive side. The agent selected its own targets, chained CVEs against exposed Langflow and n8n instances, and compressed hundreds of hours of targeting analysis into minutes. No autonomous compromise succeeded, but the capability is now documented, which means it will be repeated. Censys quantifying more than 10,000 internet-exposed PLCs, nearly half of the Rockwell devices reachable over cellular networks, closes the loop on the Minnesota attacks: the exposure is measurable and largely self-inflicted.
Watchlist: device-code flow and SSO token theft on guest networks, internet-exposed orchestration platforms, and cellular-reachable PLCs still running default credentials.