In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
News roundup: macOS ransomware self-rebuilds, AI data poisoning standard, NSO Group injunction, ShinyHunters probe,
This week's security news roundup covers several key developments. A new macOS ransomware named Heartbreaker can recompile itself from source code, though it has limitations. ISO and IEC have published a new standard, ISO/IEC 27090, to address AI system threats like data poisoning and model theft. Additionally, a federal judge declined to hold NSO Group in contempt over alleged violations of a previous injunction, and a probe into ShinyHunters has put ransom negotiators under scrutiny. Breaches at Bullhorn and Conduent are also highlighted, with Conduent facing an $80 million settlement for its 2024 data breach.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WhatsApp?
Get an email when a new story names WhatsApp, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis week's roundup underscores how attackers are pushing technical boundaries—macOS ransomware that recompiles itself from source code represents a deliberate effort to evade signature-based detection and complicate removal, while rogue AI agents spotted by banks signal an emerging class of automated threats that organizations are only beginning to understand. The $80 million Conduent settlement and the ShinyHunters probe demonstrate that data breaches carry severe financial and reputational consequences long after the initial incident. New standards like ISO/IEC 27090 are catching up to AI-specific risks such as data poisoning and model theft, but organizations must act on guidance before breaches occur, not after. Collectively, these stories reinforce that neither endpoint defenses nor incident response playbooks have fully adapted to polymorphic malware, AI-driven attacks, and third-party negotiator risks.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.