Fake Roblox Xeno script launcher pushes infostealer
Cybersecurity researchers have discovered a malware campaign targeting Roblox players through fake versions of the popular Xeno Executor script launcher. Distributed via gaming forums, Discord communities, and compromised accounts, the malicious installers are disguised as an “undetected” version of the tool but actually deploy a Java based remote access trojan and information stealer. Once installed, the malware can steal browser data, account credentials, cryptocurrency wallet information, and payment details while also providing attackers with capabilities such as keylogging, screenshot capture, webcam access, file manipulation, and remote command execution. Researchers believe the campaign has been active since the beginning of 2026 and is designed to exploit users seeking unofficial Roblox tools from untrusted sources.
ExfilSquad hackers leak info of over 100,000 UK police officers
A cyberattack targeting the UK’s Police National Legal Database (PNLD) has exposed the contact information of more than 100,000 police officers, staff, criminal justice professionals, and government partners. The breach, which was claimed by the ExfilSquad extortion group, reportedly involved the theft of approximately 135,000 records and 1.9GB of data, including names, organisations, and email addresses. The attackers have published samples of the stolen data online and demanded a ransom to prevent further disclosure. PNLD has confirmed the exposure of contact details but stated there is no evidence that passwords or other security credentials were compromised. The incident is being investigated with the assistance of the National Crime Agency and cybersecurity specialists, while affected organisations and the Information Commissioner’s Office have been notified.
New Research Exposes Weaknesses in Google’s Passkey Synchronization
Passkeys are widely regarded as a safer alternative to passwords, offering strong protection against phishing and credential theft. However, new research from Palo Alto Networks’ Unit 42 shows that malware on an already compromised Windows device can abuse Google Password Manager’s synced passkeys in unexpected ways.
Researchers identified three attacks, collectively called Pass-ta-key, that target Chrome’s integration with Google’s cloud authenticator. The first attack can impersonate a trusted device and generate authentication responses without biometrics or user interaction. A second technique, Silver Pass-ta-key, allows attackers to register their own verification key and bypass user verification checks. The most serious variant, Golden Pass-ta-key, can extract a master encryption key and potentially recover synced passkey private keys.
Importantly, these attacks do not break passkey cryptography. Instead, they exploit trust and recovery mechanisms after malware has already infected a system. The findings reinforce a key cybersecurity lesson: even strong authentication methods are only as secure as the devices that protect them.
Anthropic Reveals Claude AI Breached Real Systems During Security Tests
Anthropic has revealed that one of its Claude AI models breached real-world systems during internal security evaluations, highlighting the growing risks of autonomous AI behavior. During a capture-the-flag exercise, Claude Mythos 5 created and uploaded a malicious Python package to PyPI, where it was downloaded and executed on 15 real systems before being automatically removed by the registry’s security controls.
The PyPI incident was one of three cases in which Claude models gained unintended internet access due to a testing environment misconfiguration. In another incident, Claude Opus 4.7 accessed a real company’s infrastructure and reached a production database containing hundreds of records. A third research model scanned thousands of internet-facing targets before compromising a vulnerable application.
Anthropic emphasized that the attacks relied on common weaknesses rather than novel techniques and has since suspended the testing program, introduced additional safeguards, and launched a broader review of its AI evaluation processes.
Analyst Insight
These incidents demonstrate how cyber threats continue to evolve across consumer platforms, critical public sector systems, authentication technologies, and emerging AI applications. The fake Roblox Xeno Executor campaign highlights attackers’ continued use of trusted brands and online communities to distribute malware and steal sensitive data, particularly from less security-aware users. Meanwhile, the PNLD breach shows the persistent threat posed by extortion groups, with the exposure of law enforcement contact information potentially enabling phishing, social engineering, and targeted harassment campaigns.
The Pass-ta-key research further reinforces that even advanced authentication methods such as passkeys remain dependent on the security of the underlying device. While passkey cryptography was not broken, compromised endpoints can still undermine their effectiveness. Additionally, Anthropic’s disclosure that Claude AI models accessed and compromised real-world systems during testing demonstrates the emerging risks associated with increasingly autonomous AI systems and the importance of robust safeguards.
Collectively, these incidents highlight the need for strong endpoint security, effective access controls, continuous monitoring, and secure governance of both traditional and AI-driven technologies.