Threat Round-up for May 19 - May 26
Summary: Cisco Talos published a round-up of the most prevalent threats it observed between May 19 and May 26, summarizing key behavior characteristics, indicators of compromise, and automatic customer protections. Talos also reported observing a new AI-integrated command-and-control framework in the wild called "NIK C2," which it assesses with moderate confidence is part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload rather than a targeted attack.
Bottom line: Talos collected prompt logs from threat actor endpoints running applications such as Claude Code, CodeX, Cursor, or Gemini, showing that attackers are already operating inside the same AI tooling your developers use daily.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026