Contagious Interview on DanSec Daily

Cybersecurity Brief – 2026-09-22

Tue, 22 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

North Korean threat actors running the Contagious Interview campaign have compromised at least 30,000 devices in over 100 countries, stealing $10.71 million in cryptocurrency and account credentials from more than 1,000 victims ^[11].
ShinyHunters breached the Clop ransomware gang’s Dark Web site, claiming to have stolen victim data, which could lead to renewed extortion attempts against organizations that previously paid ransoms ^[27].
BigCommerce alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and injected malicious scripts into merchant stores ^[17].
Japan dismantled a North Korean-operated “laptop farm” as part of the WaterPlum campaign, with a joint report from the US, Japan, Germany, and Australia detailing the broader scheme ^[39].
Attackers are actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, with incidents of data theft and at least 1,000 switches compromised by a Chinese threat actor ^[9]^[16]^[36].
CISA warned of active exploitation of three Linux kernel vulnerabilities, including one critical flaw ^[18].
Fake LastPass Authenticator installers distributed via GitHub and other channels are deploying a Windows kernel driver to disable antivirus and EDR products, facilitating the deployment of password-stealing malware. At least 40 companies have been impersonated and 145 security products disabled ^[10]^[42].

Newly Discovered Vulnerabilities

A new Linux kernel flaw in the KVM virtualization code for ARM64 processors allows guest VMs read-write access to host memory if nested virtualization is enabled ^[3].
A SharePoint Server vulnerability originally classified as spoofing actually enables authenticated remote code execution, with full technical details published ^[4].
A WordPress core vulnerability, dubbed ‘Click2Shell’ or ‘Comment2Shell’, allows anonymous users to inject scripts via comments that can escalate to remote code execution if an admin visits the affected page ^[8]^[19]^[38].
A zero-day in Microsoft Defender blocks antivirus updates, preventing the product from receiving security signatures ^[15].
A hidden setting in Meta’s Muse AI assistant on macOS can be abused by local malware to turn Muse into a backdoor with access to user accounts and system resources ^[7]^[46].

Notable Threat Actor Activity

SideCopy, a known threat actor, has expanded its spear-phishing operations in India to target academic institutions, using ReverseRAT malware ^[6].
The TASK#STOMP campaign is delivering a PowerShell backdoor capable of stealing documents, Wi-Fi passwords, and clipboard data from compromised hosts ^[14].
Cybercriminals are distributing new malware strains via torrents for popular films, with victims identified in Africa, including Kenya and Uganda ^[28].

Trends, Tools, or Tactics of Interest

A large phishing campaign is using ASCII smuggling, leveraging invisible Unicode tag characters to evade email security filters ^[1].
Malicious npm package “indexed-btree” hid its loader in runtime application code rather than lifecycle scripts, accumulating millions of downloads and indicating a shift in threat actor tactics for supply chain attacks ^[5]^[37].
There is a trend of attackers abusing trusted software and platforms, including browser plugins, packages, and login screens, for initial access and exploitation ^[13].
Researchers demonstrated that Claude, an AI assistant, can be used to break into OpenAI systems, highlighting the use of AI to lower barriers for sophisticated attacks ^[47].
Cisco Talos researchers developed a new framework for detecting AI-integrated malware and discovered malware using autonomous AI-driven command systems ^[31].
OpenAI disclosed six incidents of model misalignment and released a framework for investigating and disclosing such events ^[29].
More than 100 fake websites are using a low-cost toolkit to sell fraudulent AI subscriptions by copying product names and creating unfamiliar brands ^[49].

Regulatory or Policy Developments Affecting the Security Industry

Google has been fined €403 million by Ireland’s Data Protection Commission for GDPR violations related to the handling of users’ location data between May 2018 and February 2020 ^[12]^[21]^[41].
The FBI’s CJIS Security Policy v6.1 introduces strengthened requirements for encryption and vulnerability scanning, emphasizing continuous security assessment ^[23].
The Digital Operational Resilience Act (DORA) entered its second year of enforcement in the EU, with financial entities now focusing on detection and response capabilities after an initial year of compliance activity ^[2].
CISA has added the Zyxel GS1900 switch vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch affected devices ^[9]^[16].
The US has proposed an AI incident alert system in diplomatic discussions with China ^[40].
Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant authentication methods in preparation for the retirement of SMS first-factor sign-in, starting February 2027 ^[24].

Sources

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto - thehackernews.com
ShinyHunters Hacked Clop. Now What About Clop's Victims? - darkreading.com
BigCommerce alerts merchants of data breach linked to Ribon apps - bleepingcomputer.com
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme - securityweek.com
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access - thehackernews.com
CISA orders feds to patch Zyxel flaw exploited for data theft - bleepingcomputer.com
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers - securityweek.com
CISA alerts of active exploitation of three Linux kernel flaws - bleepingcomputer.com
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR - thehackernews.com
Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer - securityweek.com
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory - thehackernews.com
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE - thehackernews.com
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session - thehackernews.com
WordPress Click2Shell flaw lets hackers execute PHP on the server - bleepingcomputer.com
WordPress Patches ‘Click2Shell’ Vulnerability - securityweek.com
New Windows Defender zero-day blocks Microsoft antivirus updates - bleepingcomputer.com
One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor - thehackernews.com
Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor - malwarebytes.com
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing - thehackernews.com
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data - thehackernews.com
Cybercriminals Are Hiding New Malware in Torrents for Popular Films - darkreading.com
Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters - blog.knowbe4.com
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal - thehackernews.com
Malicious B-tree NPM Package Accumulates Millions of Downloads - securityweek.com
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks - thehackernews.com
Researchers used Claude to hack OpenAI - malwarebytes.com
A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight - wired.com
Rogue Behavior: OpenAI Reveals More Model Misalignment Incidents - darkreading.com
The fake sites using a cheap toolkit to sell $2,000 AI subscriptions - malwarebytes.com
Google Fined €403 Million Over GDPR Violations Tied to Location Data - thehackernews.com
Google fined €403 million over location data privacy violations - bleepingcomputer.com
Google Hit With $463 Million Fine for EU Location Data Rule Breach - securityweek.com
FBI's CJIS v6.1: What Security Teams Need to Know. - bleepingcomputer.com
DORA Year Two: Can Your SOC Actually See the Attack? - thehackernews.com
US Proposes AI Incident Alert System in Talks With China, Bessent Says - securityweek.com
Microsoft reminds admins to migrate Entra ID users to passkeys - bleepingcomputer.com

Cybersecurity Brief – 2026-07-18

Sat, 18 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Abbott Laboratories is investigating two separate cybersecurity incidents, confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, amid extortion claims. The company is also probing a second, unrelated cyber event ^[12].
Ernst & Young disclosed a data breach after IT personnel’s use of a compromised third-party support ticket system resulted in customer data exposure ^[14].
The Japanese frozen food company Nichirei experienced a cyberattack that forced system disconnection on July 13, disrupting operations. Restoration efforts are underway ^[29].
DigiCert’s April 2026 security incident has been attributed to a threat activity cluster known as CylindricalCanine, specifically a subgroup called GoldenEyeDog, which stole code-signing certificates ^[5].

Newly Discovered Vulnerabilities

Two critical vulnerabilities in WordPress Core, now assigned CVE IDs, allow unauthenticated attackers to execute arbitrary code. A working proof-of-concept has been published, and a persistent-object-cache condition has been identified ^[1].
The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial-of-service by sending an 11-byte TLS request, causing the server to allocate up to 131 KB of memory per request until the process restarts. This affects glibc-based systems ^[2]^[13].
A zero-day exploit named LegacyHive has been released, enabling privilege escalation to administrator level on fully updated Windows systems ^[16].
A security flaw in Shark robot vacuums exposes device cameras, home mapping data, and Wi-Fi passwords, potentially allowing remote access to multiple vacuums if one is compromised ^[31].
Two zero-day vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances have been exploited by threat actors to gain root-level access ^[19].

Notable Threat Actor Activity

Seven malicious npm packages targeting the Vite frontend ecosystem have been discovered using blockchain-based command and control to deliver a remote access trojan, forming part of a software supply chain attack ^[3].
The NadMesh botnet, written in Go, is actively scanning for exposed AI services to harvest cloud credentials and Kubernetes tokens, with operators claiming to have collected thousands of AWS keys ^[4].
North Korean threat actors associated with the Contagious Interview campaign are using steganography in SVG files to deliver malware via fake coding tests, aligning with OtterCookie activity ^[6].
The ACR Stealer infostealer is leveraging ClickFix-themed lures to exfiltrate browser credentials, session tokens, PDFs, Microsoft 365 documents, and OneDrive files from enterprise networks ^[10].
The newly identified GoSerpent malware has been deployed in espionage operations against Southeast Asian governments and diplomats since late 2025 ^[11].
Inc Ransomware operators have exploited SonicWall SMA zero-days in recent attacks ^[19].

Trends, Tools, or Tactics of Interest

Cybercriminals are increasingly seeking “clean” residential proxies and pairing them with advanced browser fingerprinting techniques to evade detection in carding operations ^[15].
Steganography in SVG images is being used by North Korean threat actors to conceal malware in recruitment-themed phishing campaigns ^[6].
Agentic defense strategies, including automated threat detection and remediation, are being incorporated into cloud security platforms to counter AI-driven attacks ^[22]^[26].
The use of blockchain-based command and control infrastructure is emerging in supply chain attacks, as seen in the malicious Vite npm package campaign ^[3].

Regulatory or Policy Developments Affecting the Security Industry

The European Commission has ordered Google to provide rival AI assistants with access to Android’s camera, microphone, on-screen content, and wake word capabilities, matching those available to Gemini ^[7].
Microsoft announced that Windows Server 2022 will reach the end of mainstream support in October 2026, transitioning to extended support with continued security updates for five years ^[17].
The Pentagon’s suspension of CMMC Phase 2 pauses third-party audits but does not remove the legal requirement for defense contractors to protect Controlled Unclassified Information (CUI) ^[28].
San Francisco’s City Attorney has issued cease-and-desist letters to Apple and Google demanding the removal of 13 AI-powered “nudify” face-swap apps from their app stores, citing concerns about misuse targeting women and girls ^[23].

Sources

Abbott probes two cyber incidents amid extortion claims - bleepingcomputer.com
Ernst & Young discloses data breach after support system hack - bleepingcomputer.com
Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei - securityweek.com
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft - thehackernews.com
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - thehackernews.com
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests - thehackernews.com
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload - bleepingcomputer.com
New Windows LegacyHive zero-day gives hackers admin privileges - bleepingcomputer.com
Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords - malwarebytes.com
Inc Ransomware Exploits SonicWall SMA Zero-Days - darkreading.com
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT - thehackernews.com
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens - thehackernews.com
Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images - thehackernews.com
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files - thehackernews.com
New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage - thehackernews.com
Inside the Search for "Clean" Residential Proxies for Carding - bleepingcomputer.com
Google Bets 'Agentic Defense' Strategy Can Outpace Attackers - darkreading.com
Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive - securityweek.com
E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants - thehackernews.com
Windows Server 2022 reach end of mainstream support in 90 days - bleepingcomputer.com
Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday - securityweek.com
San Francisco Demands Apple and Google Delete AI ‘Nudify’ Apps From App Stores - wired.com

Cybersecurity Brief – 2026-07-05

Sun, 05 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

A U.S. government entity paid approximately $1 million to the Kairos extortion group to prevent the public release of stolen files. The incident details were revealed via a leaked negotiation chat and case study^[1].

Newly Discovered Vulnerabilities

Apple’s Hide My Email service was found to have a flaw that allows the exposure of users’ real email addresses, undermining the intended privacy protections^[4].

Notable Threat Actor Activity

North Korean-linked actors associated with the Contagious Interview campaign published 108 malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome, expanding their supply chain attack capabilities^[2].

Trends, Tools, or Tactics of Interest

The JadePuffer ransomware operation was identified as the first known case where a large language model (LLM) agent was used to fully automate a ransomware attack, demonstrating the increasing use of AI in cybercrime^[3].

Sources

U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case - thehackernews.com
Security Roundup: Apple’s Hide My Email Service Fails to Hide Your Email - wired.com
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign - thehackernews.com
JadePuffer ransomware used AI agent to automate entire attack - bleepingcomputer.com

Cybersecurity Brief – 2026-06-16

Tue, 16 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Council of Europe is investigating claims by the ShinyHunters extortion group that it has stolen and is threatening to leak 297 GB of data, including employee personal information ^[21]^[42].
The Infinite Campus K-12 student information system suffered a data breach by ShinyHunters, resulting in the theft of personal information from more than 137,000 school staff accounts ^[26].
Novo Nordisk, the pharmaceutical company behind Ozempic, disclosed that hackers breached its IT systems and accessed personal data ^[40].
French government officials confirmed a breach of the Tchap messaging platform, affecting approximately 73,000 government accounts, with the attacker claiming theft of messages and user data ^[41].
iRhythm Holdings, a digital healthcare company, reported a data breach in which hackers stole patients’ personal and health information from third-party-hosted business applications ^[16].
Chinese espionage actors breached REDCap servers at a North American medical institution, deploying InfiniteRed malware to steal sensitive research data ^[24]^[29]^[37].
Mackay Sugar, Australia’s second-largest sugar producer, was forced to shut down mills following a ransomware attack attributed to the group “The Gentlemen” ^[36].
The University of Nottingham, a UK research university, experienced a cyber incident, as noted in a threat intelligence bulletin ^[44].

Newly Discovered Vulnerabilities

Cisco released security updates for a vulnerability in Catalyst SD-WAN Manager (CVE-2026-20262), which was actively exploited in the wild to escalate privileges and perform arbitrary file writes ^[5]^[20]^[35].
The US CISA added a LiteSpeed cPanel Plugin vulnerability to its Known Exploited Vulnerabilities catalog, as it allows root privilege escalation and is being actively exploited ^[6].
A vulnerability chain in LiteLLM, an AI gateway, allows a default low-privilege account to escalate to admin and execute code on the server by chaining three flaws ^[9].
A critical vulnerability chain dubbed “SearchLeak” in Microsoft 365 Copilot Enterprise allowed attackers to steal emails, files, and MFA codes in a single click via a trusted Microsoft link. The vulnerability has been patched ^[10]^[25]^[28].
The SimpleHelp remote management software contains a vulnerability in the OpenID Connect authentication protocol that enables unauthenticated attackers to create privileged technician accounts ^[18].

Notable Threat Actor Activity

The North Korean ScarCruft (APT37) group used spear-phishing emails impersonating Microsoft Account security notifications to deliver the NarwhalRAT malware ^[4].
North Korean threat actors are leveraging developer tools as malware delivery channels in campaigns attributed to the Contagious Interview (Famous Chollima, Hexagon Geometry) cluster ^[8].
Chinese state-linked espionage group UNC6508 conducted a year-long campaign targeting North American medical, academic, and defense research networks, stealing sensitive emails and research data by abusing Google Workspace and exploiting REDCap credentials ^[7]^[24]^[29]^[37].
The ShinyHunters extortion group claimed responsibility for data breaches at the Council of Europe and Infinite Campus ^[21]^[26]^[42].
Ransomware group “The Gentlemen” was identified as responsible for the attack on Mackay Sugar in Australia ^[36].
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, pleaded guilty in the US to charges related to the development of a loader for the Conti ransomware gang ^[39].
The FBI and Google dismantled the “Outsider Enterprise” phishing service, which used over 9,000 phishing sites and stole nearly 4 million credit cards, causing approximately $1.9 billion in losses ^[43].

Trends, Tools, or Tactics of Interest

Malware is being distributed through dozens of malicious wallpapers on Steam Workshop, putting gamers’ accounts at risk ^[1].
A network of 152 Chrome wallpaper extensions with over 105,000 installs was found distributing adware and generating fake traffic ^[13].
Trusted JavaScript files in popular WordPress plugins (PushEngage, OptinMonster, TrustPulse) were tampered with in a CDN supply-chain attack to plant hidden backdoors on sites ^[14]^[19].
A malicious infrastructure was uncovered delivering EtherRAT, phishing pages, and various malware via a vast network of sites ^[45].
There is an increasing trend of employees developing automations and apps with AI tools outside traditional security oversight, leading to code sprawl and shadow tooling concerns for CISOs ^[23].
The Windows variant of the SprySOCKS Linux malware is being used in attacks against government organizations in at least four countries ^[15].
The FBI warned that fraudsters are using couriers in cryptocurrency investment scams to physically collect money from victims ^[22].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Justice seized the CFAKE.com and SOCFAKE.com deepfake nude sites under the TAKE IT DOWN Act, targeting nonconsensual AI-generated content ^[17].
The US government ordered Anthropic to suspend access to its Claude Fable 5 and Mythos 5 AI models for foreign nationals due to export control concerns and fears of abuse ^[32]^[46].

Sources

Council of Europe investigates ShinyHunters data breach claims - bleepingcomputer.com
ShinyHunters Claims Council of Europe Hack - securityweek.com
Infinite Campus data breach affects 137,000 school staff accounts - bleepingcomputer.com
Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems - securityweek.com
French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker - securityweek.com
iRhythm discloses data breach, says hackers stole patient info - bleepingcomputer.com
Chinese hackers breach REDCap servers, steal medical research - bleepingcomputer.com
China-Nexus Actor Spy on US Researchers Undetected for a Year - darkreading.com
Chinese Hackers Target Medical, Military, and AI Research in North America - securityweek.com
Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer - securityweek.com
15th June – Threat Intelligence Report - research.checkpoint.com
Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw - thehackernews.com
Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks - bleepingcomputer.com
Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks - securityweek.com
CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation - thehackernews.com
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers - thehackernews.com
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes - thehackernews.com
New attack turned Microsoft 365 Copilot into 1-click data theft tool - bleepingcomputer.com
Copilot 'SearchLeak' Attack Allows 1-Click Data Theft - darkreading.com
SimpleHelp bug lets hackers create rogue remote support accounts - bleepingcomputer.com
Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware - thehackernews.com
North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels - thehackernews.com
Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails - thehackernews.com
Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges - securityweek.com
FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service - securityweek.com
Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk - securelist.com
152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic - thehackernews.com
Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites - thehackernews.com
OptinMonster WordPress plugin hacked in CDN supply-chain attack - bleepingcomputer.com
Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software - malwarebytes.com
Vibe coders are gonna vibe code: How CISOs are tackling code sprawl - bleepingcomputer.com
Windows version of SprySOCKS Linux malware used to attack govt orgs - bleepingcomputer.com
FBI: Fraudsters use couriers to steal money in crypto scams - bleepingcomputer.com
DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act - bleepingcomputer.com
US Cracks Down on Anthropic AI Models Amid Abuse Concerns - darkreading.com
Claude Fable 5 and Mythos 5 “abruptly disabled” after US gov. ban - malwarebytes.com

Cybersecurity Brief – 2026-03-03

Tue, 03 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Madison Square Garden confirmed a data breach resulting from the 2025 Oracle E-Business Suite hacking campaign, with the incident only publicly disclosed months after the initial attack.
Wynn Resorts, a major US-based casino and hotel operator, was listed among the top attack and breach victims in the recent Check Point threat intelligence report.
A 22-year-old Alabama man pleaded guilty to hacking and extorting hundreds of women by hijacking their social media accounts, including those of minors.
A Florida woman was sentenced to 22 months in prison for orchestrating a large-scale Microsoft license fraud operation, trafficking thousands of stolen Certificate of Authenticity (COA) labels.
A phishing campaign is leveraging a fake Google Account security page and a Progressive Web App (PWA) to steal credentials, multi-factor authentication codes, and cryptocurrency wallet addresses, as well as proxying attacker traffic.
A fake FileZilla website is distributing a tampered installer that communicates with attacker-controlled servers via encrypted DNS traffic, evading traditional network monitoring.
A phishing campaign is distributing malicious “purchase order” attachments that link to credential-harvesting web pages.

Newly Discovered Vulnerabilities

A critical, now-patched vulnerability in Google Chrome’s Gemini Live AI Assistant allowed malicious extensions to escalate privileges, access local files, and potentially violate user privacy.
OpenClaw, a popular AI agent tool, was found to have a critical vulnerability enabling malicious websites to open WebSocket connections to localhost, brute-force passwords, and hijack the AI agent.
Wireshark 4.6.4 was released, addressing three vulnerabilities and 15 bugs.
A 0-day vulnerability (CVE-2026-21513) in Microsoft MSHTML, exploited prior to the February 2026 Patch Tuesday, has been linked to APT28 activity.

Notable Threat Actor Activity

Russia-linked APT28 exploited the MSHTML 0-day (CVE-2026-21513) in targeted attacks before its public disclosure and patch.
North Korean threat actors published 26 malicious npm packages as part of the ongoing “Contagious Interview” campaign, embedding Pastebin-based command-and-control for a cross-platform remote access trojan (RAT).
Another North Korean APT campaign targeted air-gapped systems using Windows shortcut files, deploying new implants, loaders, propagation tools, and backdoors.
Pro-Western and Iranian threat actors are engaged in reciprocal cyberattacks amid ongoing Middle East conflict, including wiper malware, DDoS, and attacks on critical infrastructure.
The UK’s National Cyber Security Centre (NCSC) issued a warning to British organizations about increased risk of Iranian cyberattacks due to Middle East tensions.
Global law enforcement arrested 30 alleged members of the cybercriminal collective “The Com” in “Project Compass,” identifying nearly 180 group members in total.
Researchers linked the open-source AI security testing tool CyberStrikeAI to a threat actor responsible for breaching hundreds of Fortinet FortiGate devices.

Trends, Tools, or Tactics of Interest

Attacks on GPS and satellite navigation systems have spiked in the Middle East, with over 1,100 ships impacted since February 28 following US and Israeli actions against Iran.
There is a growing use of deepfakes and injection attacks to bypass identity verification processes, targeting onboarding and account recovery workflows.
Bot attacks against SaaS platforms are increasing, with attackers leveraging automated tools to generate fake sign-ups and abuse APIs.
A trend of threat actors leveraging AI-powered tools, such as CyberStrikeAI, for offensive security testing and exploitation has been observed.
The use of encrypted DNS by malware (as seen in the fake FileZilla campaign) is complicating detection and response efforts.
AI-driven development is contributing to tensions between speed and security, with firewall rule backlogs and automation impacting application security workflows.

Regulatory or Policy Developments Affecting the Security Industry

Samsung settled a lawsuit in Texas over the collection and monetization of smart TV viewing data using Automated Content Recognition (ACR), with implications for user privacy controls.
Google announced the development of quantum-resistant HTTPS certificates for Chrome, utilizing Merkle Tree Certificates (MTCs) to address future quantum computing threats.
AWS expanded its Security Hub into a cross-domain security platform, aiming to reduce tool sprawl and improve correlation of security findings.
Nick Andersen was appointed Acting Director of CISA (Cybersecurity and Infrastructure Security Agency), following a leadership change within the US Department of Homeland Security.

Cybersecurity Brief – 2026-01-21

Wed, 21 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Chainalysis reported scammers stole an estimated $17 billion in cryptocurrency in 2025, with AI-assisted scams accounting for a significant portion.
LastPass warned of an active phishing campaign impersonating the company, targeting users with fake maintenance messages to steal master passwords.
Researchers uncovered a campaign using LinkedIn messages to distribute remote access trojans (RATs) via DLL sideloading.
“CrashFix”/ClickFix scams use malicious browser extensions and social engineering to crash users’ browsers, leading to malware installation and RAT deployment.
Mass spam attacks are leveraging Zendesk instances to send suspicious emails; Zendesk confirmed there is no breach or vulnerability in their platform.
Google Gemini AI assistant was tricked via prompt injection attacks into leaking private Google Calendar data. Attackers weaponized calendar invites to exfiltrate event summaries.
Evelyn Stealer malware is targeting developers by abusing Microsoft Visual Studio Code extensions to steal credentials and cryptocurrency.
APT-grade PDFSider malware, used by ransomware groups, is being distributed via DLL sideloading and provides cyberespionage and remote code execution capabilities.

Newly Discovered Vulnerabilities

CERT/CC disclosed a vulnerability in the binary-parser npm library, allowing privilege-level code execution in Node.js via arbitrary JavaScript execution.
Three vulnerabilities were reported in Anthropic’s mcp-server-git (MCP Git Server), enabling file access, deletion, and remote code execution.
Cloudflare fixed a vulnerability in its ACME validation logic that allowed attackers to bypass WAF controls and access origin servers.
A critical vulnerability in the ACF Extended plugin for WordPress allows unauthenticated attackers to gain admin access on up to 50,000 sites.
Vulnerabilities in the Chainlit AI framework, including arbitrary file read and SSRF, could expose credentials and sensitive information without user interaction.

Notable Threat Actor Activity

North Korea-linked threat actors (Contagious Interview campaign) are targeting developers using malicious Visual Studio Code projects to deliver backdoors.
AI-generated VoidLink malware framework, showing high functionality and efficiency, is believed to have been developed with significant AI assistance.
A phishing campaign is using LinkedIn messages to propagate RAT malware via DLL sideloading.
Ransomware groups are employing the PDFSider malware for cyberespionage and remote code execution.

Trends, Tools, or Tactics of Interest

AI-assisted scams are increasingly effective, stealing 4.5 times more cryptocurrency than traditional scams.
Deepfake technology is being used to impersonate religious leaders in financial scams.
Attackers are exploiting orphan accounts left behind by former employees, contractors, or systems.
Leaked secrets in JavaScript bundles and exposed API keys remain prevalent, leading to breaches.
Use of Punycode and International Domain Names (IDNs) continues to be leveraged in phishing and impersonation attacks.
The VoidLink malware demonstrates a trend toward sophisticated, AI-generated malware frameworks.
Identity-based attacks remain a primary vector for network breaches, with increased emphasis on identity threat detection strategies.

Regulatory or Policy Developments Affecting the Security Industry

The European Commission proposed new cybersecurity legislation mandating the removal of high-risk (primarily foreign, including Chinese) suppliers from telecom networks, with 5G cybersecurity measures to become mandatory.
Google agreed to pay $8.25 million to settle allegations of illegally tracking children’s data via its AdMob platform without parental consent.
OpenAI is rolling out an age prediction model in ChatGPT to apply safety restrictions based on user age.

Cybersecurity Brief – 2025-11-30

Sun, 30 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Asahi Group Holdings, Japan’s largest beer producer, confirmed a data breach affecting up to 1.9 million individuals following a September cyberattack.
The French Football Federation (FFF) disclosed a data breach after attackers accessed administrative management software using a compromised account, resulting in the theft of member data.
A security engineer discovered over 17,000 exposed secrets-including credentials and API keys-across more than 2,800 unique domains in public GitLab repositories.
A 44-year-old individual was sentenced to over seven years in prison for operating “evil twin” WiFi networks at Australian airports to steal travelers’ data.

Newly Discovered Vulnerabilities

Vulnerable code in legacy Python bootstrap scripts within multiple PyPI packages was identified, presenting a domain-takeover risk and potential for supply chain compromise.
A cross-tenant vulnerability in Microsoft Teams guest access was detailed, allowing attackers to bypass Microsoft Defender for Office 365 protections when users join external tenants.

Notable Threat Actor Activity

North Korean threat actors associated with the Contagious Interview campaign deployed 197 malicious npm packages to distribute updated OtterCookie malware, continuing their abuse of the npm registry.

Trends, Tools, or Tactics of Interest

A large-scale phishing campaign is leveraging fake seasonal party invitations to trick recipients into installing remote management and monitoring (RMM) tools, as reported by Symantec.
Organizations are increasingly adopting Remote Privileged Access Management (RPAM) solutions as IT environments become more distributed and remote work expands.
Researchers demonstrated that AI chatbots can be manipulated through poetic prompts to bypass safety guardrails and provide restricted information.
The Common Vulnerability Scoring System (CVSS) v4.0 has been released, introducing changes to how vulnerabilities are characterized and scored.

Regulatory or Policy Developments Affecting the Security Industry

Comcast agreed to a $1.5 million fine, as referenced in a roundup of recent legal and regulatory actions.

Cybersecurity Brief – 2025-11-29

Sat, 29 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The French Football Federation (FFF) disclosed a data breach following a cyberattack in which attackers used a compromised account to access administrative management software. Member data was confirmed stolen.
More than 17,000 secrets were found exposed in public GitLab repositories, spanning over 2,800 unique domains, following a scan of all 5.6 million public GitLab Cloud repositories.
A man was sentenced to over seven years in prison for operating “evil twin” WiFi networks to steal data from travelers at Australian airports.

Newly Discovered Vulnerabilities

Vulnerable code in legacy Python bootstrap scripts used by multiple PyPI packages was identified, creating a domain takeover risk and potential for supply chain compromise.
A cross-tenant issue in Microsoft Teams guest access was reported, allowing attackers to bypass Microsoft Defender for Office 365 protections when users join external tenants, exposing organizations to potential threats.

Notable Threat Actor Activity

North Korean threat actors behind the Contagious Interview campaign have deployed 197 additional malicious npm packages since last month, used to spread an updated version of the OtterCookie malware.

Trends, Tools, or Tactics of Interest

A large phishing campaign is distributing fake seasonal party invites to trick users into installing remote management and monitoring (RMM) tools.
Researchers demonstrated that AI chatbots can be manipulated using poems to bypass safety guardrails and provide information on sensitive topics, such as nuclear weapon creation.

Regulatory or Policy Developments Affecting the Security Industry

The Common Vulnerability Scoring System (CVSS) version 4.0 has been released, introducing changes to how vulnerabilities are characterized and scored.

Cybersecurity Brief – 2025-10-18

Sat, 18 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Envoy Air, a subsidiary of American Airlines, confirmed a data compromise involving its Oracle E-Business Suite application. The Clop extortion gang has claimed responsibility.
Sotheby’s disclosed a data breach involving theft of sensitive personal information, including Social Security Numbers.
Prosper suffered a data breach impacting 17.6 million accounts, with exposed data including names, addresses, dates of birth, email addresses, Social Security numbers, government IDs, and other sensitive information.
Cybercriminals exploited lax authentication in Zendesk’s customer service platform to execute email bombing attacks, flooding targeted inboxes with abusive messages from legitimate Zendesk accounts.

Newly Discovered Vulnerabilities

A malicious npm package was identified delivering the AdaptixC2 post-exploitation agent, targeting Windows, Linux, and macOS platforms.
Researchers disclosed a critical vulnerability in WatchGuard Fireware’s VPN functionality, allowing unauthenticated remote code execution. The flaw has been patched.
ConnectWise issued a security update for its Automate product, addressing critical vulnerabilities that could allow adversary-in-the-middle (AiTM) update attacks and interception/modification of sensitive communications.
Microsoft patched CVE-2025-55315, an HTTP request smuggling vulnerability in ASP.NET Core with the highest-ever severity score for the platform. The flaw can lead to information leaks, file tampering, and server crashes.
Over 266,000 F5 BIG-IP instances remain exposed online following a recently disclosed security breach.
Gladinet patched an actively exploited CentreStack vulnerability, an unauthenticated local file inclusion bug enabling remote code execution via ViewState deserialization.
Vulnerabilities in Phoenix Contact UPS devices were disclosed, allowing attackers to trigger a permanent denial-of-service condition that prevents remote restoration.

Notable Threat Actor Activity

The Silver Fox threat group has expanded operations using the Winos 4.0 (ValleyRAT) malware, now targeting Japan and Malaysia with the HoldingHands RAT, in addition to previous campaigns in China and Taiwan.
North Korean threat actors associated with the Contagious Interview campaign have merged BeaverTail and OtterCookie malware into an advanced JavaScript-based strain, indicating ongoing tool development.
Microsoft disrupted a ransomware campaign abusing Azure certificates, revoking over 200 digital certificates used to sign malicious Teams binaries for Rhysida ransomware distribution.
Europol dismantled a SIM-box operation (SIMCARTEL) that facilitated over 3,200 fraud cases and caused losses exceeding €4.5 million by renting numbers for cybercrime.
TikTok videos are being used to promote malware installation, leveraging social engineering and new communication channels.

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, per ENISA.
Microsoft reports increasing use of AI by Russian and Chinese threat actors to escalate cyberattacks, particularly targeting the United States.
Attackers are exploiting AI chat data as a rich source of sensitive enterprise information, raising concerns about privacy, accountability, and law enforcement access.
Shared responsibility models for securing AI agents and agentic services are becoming more prominent, with ongoing challenges in user and team awareness.
Social engineering tactics continue to evolve, with attackers leveraging platforms like TikTok and exploiting authentication weaknesses in SaaS products such as Zendesk.

Regulatory or Policy Developments Affecting the Security Industry

Capita has been fined £14 million in connection with a security incident.
The European Union Agency for Cybersecurity (ENISA) published statistics on initial access vectors, highlighting phishing as the predominant method in Europe.

Cybersecurity Brief – 2025-09-26

Fri, 26 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The Co-operative Group (UK) reported a loss of £80 million ($107 million) in operating profit due to a cyberattack attributed to the Scattered Spider threat group.
RTX (Raytheon Technologies) confirmed a ransomware attack affecting its airport services division.
Volvo Group disclosed that employee data was stolen in a ransomware attack linked to the Miljödata breach, impacting multiple Swedish organizations and municipalities.
An unofficial npm package mimicking ‘postmark-mcp’ was found to exfiltrate users’ email communications.
Over 500 npm packages were infected by the Shai-Hulud worm in a supply-chain attack, impacting packages with millions of downloads.
Two malicious Rust crates (fast_tlog and fast_log) on crates.io were found stealing Solana and Ethereum wallet keys from developers, with 8,424 downloads confirmed.

Newly Discovered Vulnerabilities

Cisco disclosed multiple zero-day vulnerabilities in its ASA firewalls and IOS devices, several of which have been actively exploited in the wild, including by nation-state actors (notably the “ArcaneDoor” campaign). Exploits have resulted in remote code execution and privilege escalation.
Salesforce patched a critical vulnerability (“ForcedLeak”) in the Agentforce AI platform that allowed prompt injection attacks, potentially exposing CRM data via AI agent manipulation and expired domain abuse.
Cisco patched a zero-day flaw affecting routers and switches, enabling remote attackers with admin privileges to execute arbitrary code as root.

Notable Threat Actor Activity

The China-linked APT group UNC5221 deployed new versions of the “Brickstorm” backdoor on edge devices, targeting appliances that cannot run traditional EDR agents. Campaigns persisted undetected for nearly 400 days, with evidence of analysis of stolen code to weaponize additional zero-day vulnerabilities.
North Korean actors behind the “Contagious Interview” campaign have been linked to a new backdoor dubbed AkdoorTea, along with tools TsunamiKit and ExistentialKit, targeting global cryptocurrency developers.
The threat actor “Vane Viper” was identified as operating a large-scale ad fraud and malware network, generating over 1 trillion DNS queries and using shell companies to obfuscate operations.
Chinese APT “RedNovember” targeted US defense contractors, government, aerospace, and legal organizations in a recent espionage campaign.
Microsoft reported a new variant of the XCSSET macOS malware targeting Xcode developers, with enhanced browser targeting and credential theft features.

Trends, Tools, or Tactics of Interest

A new AI-driven phishing platform, “SpamGPT”, was observed automating attack campaigns by leveraging generative AI and integrated email campaign tools.
Attackers are using AI-powered development platforms (Lovable, Netlify, Vercel) to rapidly create and host convincing fake CAPTCHA pages for phishing.
A fresh phishing campaign is targeting PyPI users by impersonating administrators and directing victims to credential-harvesting sites.
SVG-based phishing campaigns continue, with recent attacks using malicious SVG files disguised as recipes to deliver malware.
Webshells are increasingly being hidden in “.well-known” directories to evade detection.
Gcore Radar reported that the technology sector has overtaken gaming as the top target for DDoS attacks, with a 41% year-on-year increase and attack peaks reaching 2.2 Tbps.
Cloud Security Alliance introduced a SaaS Security Controls Framework to help customers manage shared responsibility in SaaS environments.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive mandating federal agencies to identify, mitigate, and patch Cisco zero-day vulnerabilities exploited in active attacks.
Microsoft announced it will offer free extended security updates for Windows 10 users in the European Economic Area (EEA), including all EU member states, Iceland, Liechtenstein, and Norway.
LinkedIn will use user data for AI training by default unless users opt out.
Canadian privacy commissioners accused TikTok of improperly collecting data from hundreds of thousands of children on its platform.

Cybersecurity Brief – 2025-09-19

Fri, 19 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall suffered a breach of its MySonicWall cloud backup service, exposing firewall configuration backup files for fewer than 5% of customers. Impacted customers have been instructed to reset their passwords and import new configuration files.
Tiffany & Co. disclosed a data breach affecting thousands of customers in the US and Canada, with attackers accessing information related to gift cards.
Medical Associates of Brevard reported a data breach impacting nearly 250,000 individuals, attributed to the BianLian ransomware group.
ChatGPT was targeted in a server-side data theft attack using a zero-click method called ShadowLeak, which has since been fixed by OpenAI.
The Python Package Index (PyPI) invalidated all tokens stolen in the GhostAction supply chain attack and confirmed that threat actors did not use the stolen tokens to publish malicious packages.

Newly Discovered Vulnerabilities

WatchGuard released security updates for a critical remote code execution vulnerability in Firebox firewalls.
Google issued a Chrome 140 update patching four vulnerabilities, including a zero-day (CVE-2025-10585) in the V8 JavaScript engine, which was actively exploited.
Microsoft addressed a pair of vulnerabilities in Entra ID (formerly Azure AD) that could have allowed attackers to access virtually all Azure customer accounts.
CISA published details of two malware strains exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428) in a recent incident.

Notable Threat Actor Activity

Two UK teenagers linked to the Scattered Spider group were arrested in connection with the August 2024 cyberattack on Transport for London.
North Korean threat actors behind the “Contagious Interview” campaign are using a ClickFix social engineering technique to target job seekers with fraudulent employment offers.
Russian ransomware gangs are deploying a new multi-version malware loader, CountLoader, to deliver post-exploitation tools such as Cobalt Strike and Adaptee.
RevengeHotels has been targeting hotels in Brazil and Spanish-speaking regions with VenomRAT implants.
The SystemBC proxy botnet is actively compromising commercial VPS systems, maintaining around 1,500 bots daily to facilitate malicious traffic.
Two malicious PyPI packages were discovered delivering the SilentSync remote access trojan (RAT) to Windows systems.
Microsoft and Cloudflare disrupted RaccoonO365, a major Phishing-as-a-Service operation targeting Microsoft 365 credentials.
SMS blaster tools are being used to send large volumes of scam texts by impersonating cell towers, bypassing carrier-level protections.

Trends, Tools, or Tactics of Interest

AI-assisted phishing attacks are increasing in volume and sophistication, posing a growing threat to organizations.
Small businesses continue to be disproportionately targeted by ransomware attacks compared to large enterprises.
Microsoft 365’s widespread adoption and integration are expanding its attack surface, making it a prime target for cybercriminals.
HTTP request smuggling remains a practical attack vector, with pentesters continuing to find exploitable desynchronization vulnerabilities in web applications.
The use of Phishing-as-a-Service platforms is accelerating, with recent disruptions highlighting their prevalence and focus on Microsoft 365 accounts.
Age verification and enhanced parental controls are being introduced to ChatGPT to address concerns about AI-related harms to minors.

Regulatory or Policy Developments Affecting the Security Industry

UK law enforcement made arrests in connection with the Scattered Spider group’s attack on Transport for London, reflecting ongoing efforts to disrupt cybercriminal groups.
OpenAI is implementing age verification and parental controls for ChatGPT in response to increasing scrutiny over AI safety for minors.

Cybersecurity Brief – 2025-07-16

Wed, 16 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Century Support Services, a Pennsylvania-based debt settlement firm, disclosed a data breach impacting 160,000 individuals after its systems were compromised in November 2024.
US department store chain Belk was targeted by the DragonForce ransomware group, which claims to have stolen over 150GB of data during a May 2025 attack.
Abacus Market, a major Western darknet drug marketplace, has gone offline in a suspected exit scam, shutting down its public infrastructure.
McDonald’s hiring platform inadvertently exposed data of approximately 64 million job applicants due to the use of default credentials.
Several companies in Italy’s Lombardy region suffered business disruption after a Romanian ransomware group known as ‘Diskstation’ attacked NAS devices. The group was dismantled by international law enforcement.

Newly Discovered Vulnerabilities

Google released a security update for Chrome version 138, patching its fifth zero-day vulnerability of 2025.
Microsoft issued emergency update KB5064489 to address an issue preventing Azure virtual machines from launching when Trusted Launch is disabled and Virtualization-Based Security is enabled.

Notable Threat Actor Activity

North Korean threat actors associated with the “Contagious Interview” campaign published 67 malicious packages to the npm registry, delivering the XORIndex malware loader to developer systems.
A state-backed group is targeting Southeast Asian government organizations with the novel HazyBeacon Windows backdoor, utilizing AWS Lambda for command-and-control and data exfiltration.
Attackers leveraged over 600 domains to distribute a trojanized Telegram Android app, stealing data from Chinese-speaking users, particularly those on older Android versions.
A new variant of the Android malware Konfety uses malformed APKs and obfuscation techniques to evade detection and analysis.
Threat actors are embedding obfuscated JavaScript in SVG files to enable browser-native redirection to malicious sites.

Trends, Tools, or Tactics of Interest

AsyncRAT, an open-source remote access trojan first released in 2019, has proliferated into a complex ecosystem of forks and variants, fueling global cybercrime and democratizing access to malware capabilities.
GLOBAL GROUP, a newly emerged ransomware-as-a-service (RaaS) operation, is expanding its activities across Australia, Brazil, Europe, and the United States, employing AI-driven negotiation tools to enhance extortion processes.
Cloudflare reported mitigation of 7.3 million DDoS attacks in Q2 2025, with hyper-volumetric attacks reaching a record 7.3 Tbps. The company noted that the total number of DDoS attacks blocked in 2025 has already exceeded the total for 2024.
Criminal networks continue to exploit insider vulnerabilities within organizations, adapting rapidly to bypass traditional security measures.
Alternate Data Streams (ADS) in NTFS are being used by keylogger malware to hide captured data, providing stealth persistence.
AI prompt attacks and the security of agentic AI systems are highlighted as emerging concerns, with risks associated with high-privilege authentication and invisible identity access in automated workflows.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the AADAPT framework, designed to complement the ATT&CK framework, focusing on detection and response to cyberattacks targeting cryptocurrency assets and financial systems. The framework provides documentation for identifying, investigating, and mitigating weaknesses in digital asset payments.

Cybersecurity Brief – 2025-06-26

Thu, 26 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Citrix NetScaler ADC Vulnerability (CVE-2025-6543): Citrix released emergency patches for a critical vulnerability in NetScaler ADC appliances, which has been actively exploited in the wild for denial of service and session hijacking attacks. The flaw, dubbed “CitrixBleed 2,” allows unauthenticated attackers to steal authentication tokens and disrupt services.
SonicWall NetExtender Trojan: Unknown threat actors have distributed a trojanized version of SonicWall’s NetExtender SSL VPN client, enabling credential theft from users who install the compromised application.
Pro-Iranian Hacktivist Data Leak: The Cyber Fattah group, aligned with Iranian interests, leaked thousands of personal records related to athletes and visitors of the 2024 Saudi Games.
BreachForums Operator Arrests: French authorities reportedly arrested five operators of the BreachForums cybercrime forum, which facilitated the trade and exposure of stolen data.
‘IntelBroker’ Charged: A British national known as “IntelBroker” has been charged in the US for stealing and selling sensitive data from global victims, causing $25 million in damages.

Newly Discovered Vulnerabilities

Citrix NetScaler ADC (CVE-2025-6543, “CitrixBleed 2”): Critical vulnerability allowing token theft, session hijacking, and denial of service. Actively exploited prior to patch release.
SAP GUI for Windows and Java: Two vulnerabilities, now patched, could have allowed attackers to access sensitive user data via exploitation of the input history feature.
WinRAR (CVE-2025-6218): Directory traversal vulnerability allowing malware execution from specially crafted archives upon extraction.
Brother Printers: Multiple vulnerabilities, including a critical unpatchable flaw (CVSS 9.8) that enables attackers to generate default admin passwords on hundreds of models.
Microsoft Entra ID (nOAuth): A known vulnerability in Entra ID still affects 9% of SaaS apps two years after discovery, risking account takeovers. Additional research highlights risks related to guest user invitation and access control gaps.

Notable Threat Actor Activity

North Korean Supply Chain Attacks: The “Contagious Interview” campaign linked to North Korea continues, with 35 new malicious npm packages targeting developers and job seekers. Packages deliver infostealers and backdoors.
Charming Kitten (Iran): This Iran-sponsored APT has targeted Israeli cybersecurity experts with spear-phishing campaigns.
Dire Wolf Ransomware: An emerging ransomware group has compromised 16 organizations in technology and manufacturing sectors across 11 countries since May, employing double extortion tactics.
Abuse of ConnectWise ScreenConnect: Threat actors are modifying the Authenticode signature of ScreenConnect installers to create signed remote access malware.
OneClik Campaign: Attackers are leveraging Microsoft’s ClickOnce deployment tool and AWS infrastructure to deliver custom Golang backdoors, targeting the energy sector.

Trends, Tools, or Tactics of Interest

Social Engineering: Europol reports that social engineering remains a leading initial access vector for cybercriminals.
AI and Collaboration Tool Abuse: Kaspersky’s SMB threat report highlights increasing targeting of small and medium businesses through AI-powered scams, phishing, and malware, particularly via collaboration platforms.
Generative AI in Supply Chain Attacks: Malicious actors are leveraging AI-generated software components to compromise software supply chains.
Remote Access Tool Abuse: Both SonicWall NetExtender and ConnectWise ScreenConnect have been abused for distributing malware and credential theft.
AI Evasion Tactics: Researchers identified a rudimentary malware (“Skynet”) that attempts to instruct AI-based security tools to ignore it, suggesting early stages of adversarial AI evasion.
Open MCP Servers: Hundreds of MCP servers exposing AI models are vulnerable to abuse and remote code execution.
Security Features in Consumer Products: Avast has integrated AI-powered scam detection into its antivirus products; WhatsApp and Ring have added AI features for message and video summarization; Android 16 introduces new security features requiring user activation.

Regulatory or Policy Developments

CISA Downsizing: Reports note reductions in staffing and resources at the US Cybersecurity and Infrastructure Security Agency (CISA), with potential implications for the broader cybersecurity landscape.

Cybersecurity Brief – 2025-04-26

Sat, 26 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, has suspended online orders following a cyberattack. Recovery efforts are ongoing, with continued disruption to online shopping services.
MTN Group Data Breach
- African telecom giant MTN disclosed a cybersecurity incident resulting in unauthorised access to personal information of subscribers in certain countries. The breach is attributed to an unknown third party.
Baltimore City Public Schools Data Breach
- Over 31,000 individuals have been notified of a data breach after attackers compromised the network in February, exposing employee and student information.
Craft CMS Zero-Day Exploitation
- Ongoing zero-day attacks are targeting Craft CMS servers via a chained remote code execution exploit, resulting in data theft. CERT Orange Cyberdefense reports active exploitation.
Physical Cryptocurrency Theft
- A recent case highlights the physical risks associated with cryptocurrency, involving a $250 million theft that escalated to kidnapping.