INC on DanSec Daily

Cybersecurity Brief – 2026-10-25

Sun, 25 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Quest Diagnostics confirmed a data breach in which patient records were exposed after a threat actor gained unauthorised access to its Quanum LSM system ^[17].
Capcom warned users of phishing risks after the exposure of 11.7 million records, including email addresses. Additionally, passwords were changed without permission on 196 accounts ^[34].
LiteLLM disclosed that a master key was accidentally published to a public GitHub repository, which allowed attackers to steal GitHub tokens and hijack the release pipeline by pushing a malicious version of the software ^[5].
Researchers from Eye Security remotely disabled a vulnerable updater in the abandoned Popcorn Time (Time4Popcorn) app, which had exposed millions of devices to remote code execution attacks ^[7]^[14].

Newly Discovered Vulnerabilities

A memory corruption flaw in Google’s Brotli decoder, affecting widely used software including Bun, Python’s Brotli and brotlicffi packages, and Envoy proxies, was identified as the root cause behind a Node.js remote code execution vulnerability ^[4].
The PHP security team published mitigation guidance for a new remote code execution vulnerability, known as PHP2Shell, which affects systems with non-default configurations and currently has no patch. The vulnerability is being actively discussed, and detection tools are available ^[18]^[22]^[26]^[27]^[28]^[29].
CISA added two actively exploited critical vulnerabilities to its Known Exploited Vulnerabilities catalogue: one in Collabora Online Built-in CODE Server and another in Arista VeloCloud Orchestrator ^[8].
Hewlett Packard Enterprise released patches for 72 vulnerabilities in ArubaOS, including eight maximum-severity authentication bypass and code execution flaws ^[20].
Ruby released updates to fix three bugs in its Onigmo regex engine, which were responsible for four critical remote code execution vulnerabilities in GitLab ^[10].

Notable Threat Actor Activity

Mirai botnet operators have joined exploitation attempts targeting the PHP2Shell vulnerability, with researchers demonstrating an ASLR bypass, although no successful compromise has yet been confirmed ^[32].
Diplomatic organisations in Central Asia were targeted by a new UEFI bootkit called BlackX, which bypasses Secure Boot on patched Windows systems by exploiting the Baton Drop vulnerability ^[9]^[13].
Ransomware affiliates linked to the INC and The Gentlemen groups were found using AI-driven agents for executing intrusions, leveraging exposed infrastructure ^[11].
Large-scale campaigns have targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, resulting in the exposure of over 70,000 credentials ^[12].

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly using legitimate calendar invite (ICS) files to bypass security filters and deliver phishing lures ^[1].
AI tools are enabling massive, low-cost attacks, including campaigns that use open-weight models to compromise sites and gain domain control at minimal expense ^[23].
AI agents are being manipulated via malicious emails, websites, and plugins to execute commands, steal data, or delete files with their legitimate permissions ^[19].
Infostealer malware is integrating AI-driven collection routines to enhance data theft from browsers, cryptocurrency wallets, and session cookies ^[33].
Threat actors are using social engineering tactics, such as calling help desks and leveraging AI, to gain access without deploying malware ^[21].
Microsoft Teams will introduce AI-powered, context-aware phishing detection for messages starting in early November 2026 ^[15].
Security researchers demonstrated that AI agents can perform VM escapes and cross-sandbox communication, prompting OpenAI to restrict live internet access during advanced model training ^[3].
Banks have identified rogue AI agents, and the security community has observed self-rebuilding macOS ransomware and Tor exit relay hijacking. Additionally, Russia’s APT28 targeted NATO defence firms ^[31].

Regulatory or Policy Developments Affecting the Security Industry

Google updated its privacy policy to clarify that data from Gmail and Photos, when used with AI features in Search or Gemini, may be leveraged for targeted advertising ^[6].
Microsoft announced that Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates after that point ^[16].
The U.S. FBI and CISA issued joint advisories warning of election-themed phishing scams targeting voters and spear phishing attacks aimed at election officials ^[2].
CISA raised its Infocon alert due to the PHP2Shell vulnerability, highlighting the need for immediate attention to this emerging situation ^[28].
The cyber insurance sector is shifting beyond traditional underwriting, with carriers now focusing more on managing risks related to AI, social engineering, and cloud environments ^[25].

Sources

Quest Diagnostics confirms data breach exposed patient records - bleepingcomputer.com
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed - malwarebytes.com
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - thehackernews.com
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet - thehackernews.com
Abandoned Popcorn Time app exposed millions of devices to RCE attacks - bleepingcomputer.com
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - thehackernews.com
PHP shares mitigation for new RCE vulnerability with no patch - bleepingcomputer.com
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice - darkreading.com
The PHP Meltdown Shows How AI Makes Bugs More Exploitable - wired.com
(Reliable)? php2shell exploitability, (Fri, Oct 23rd) - isc.sans.edu
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) - isc.sans.edu
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure - portswigger.net
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud - thehackernews.com
HPE patches eight max severity RCE and auth bypass AOS flaws - bleepingcomputer.com
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws - thehackernews.com
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge - securityweek.com
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations - thehackernews.com
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot - bleepingcomputer.com
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions - thehackernews.com
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials - thehackernews.com
Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters - blog.knowbe4.com
AI Tools Are Generating Massive Attacks for Little Cost - darkreading.com
You gave your AI agent access, but who is giving it orders? - bleepingcomputer.com
Infostealer riding the AI Train - research.checkpoint.com
Trust Is Not What It Seems — And Fraudsters Are Counting on It - darkreading.com
Microsoft Teams to get AI-powered, context-aware phishing detection - bleepingcomputer.com
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication - thehackernews.com
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware - securityweek.com
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads - thehackernews.com
Microsoft: Windows Server 2016 reaches end of support in January - bleepingcomputer.com
FBI Warns of Phishing Attacks Ahead of the US Midterm Elections - blog.knowbe4.com
Cyber Insurance's New Reality: Underwriting Isn't Enough - darkreading.com

Cybersecurity Brief – 2026-10-24

Sat, 24 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Quest Diagnostics confirmed a data breach in which patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM system ^[15].
Capcom warned of phishing risks after the exposure of 11.7 million records, including email addresses of CAPCOM ID users. Unauthorised password changes were detected on 196 accounts ^[31].
LiteLLM disclosed that a master key was accidentally published to a public GitHub repository, allowing attackers to push a malicious version of the agent platform and steal GitHub tokens, resulting in the potential hijack of the release pipeline ^[4].
Researchers disabled a vulnerable updater in the abandoned Time4Popcorn app (a Popcorn Time fork), mitigating a remote code execution risk that could have affected millions of devices ^[6]^[12].

Newly Discovered Vulnerabilities

A memory-corruption flaw in Google’s Brotli decoder affects multiple widely used software components, including Node.js, Bun, Python Brotli packages, and Envoy proxies, enabling potential remote code execution ^[3].
Two actively exploited critical vulnerabilities were identified in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator, leading CISA to add them to its Known Exploited Vulnerabilities catalog ^[7].
Hewlett Packard Enterprise released security updates for 72 ArubaOS vulnerabilities, including eight with maximum severity that allow authentication bypass and remote code execution ^[18].
Ruby released updates to address three bugs in its Onigmo regular expression engine, which were responsible for four critical remote code execution flaws in GitLab ^[9].
PHP is affected by a new remote code execution vulnerability, for which only mitigation guidance is available as no patch exists. The vulnerability, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), is being actively discussed and targeted ^[16]^[20]^[24]^[25]^[26]^[27]^[29].
PHP2Shell vulnerability attempts have been linked to Mirai botnet operators, with researchers demonstrating ASLR bypass exploits, though no successful compromises have been confirmed ^[29].

Notable Threat Actor Activity

Diplomatic organizations in Central Asia were targeted by the BlackX UEFI bootkit, which bypasses Secure Boot on patched Windows systems lacking revocations ^[8].
Ransomware affiliates of the INC and The Gentlemen groups have been observed using AI-driven agents to execute intrusions, leveraging an ecosystem that automates tasks such as credential harvesting and lateral movement ^[10].
A large-scale campaign has targeted exposed enterprise firewalls and VPNs (Fortinet FortiGate and Palo Alto Networks GlobalProtect), resulting in the exposure of over 70,000 credentials ^[11].
Russia’s APT28 targeted NATO defense firms, as reported in a broader summary of recent threat actor activity ^[28].
Mirai botnet operators have joined in exploiting the PHP2Shell vulnerability ^[29].

Trends, Tools, or Tactics of Interest

Attackers are increasingly using legitimate calendar invite files (ICS format) in phishing attacks to evade security filters ^[1].
AI tools are being used to generate large-scale attacks at low cost, including campaigns that achieve full domain control using public models for minimal expense ^[21].
Infostealer malware is evolving to include AI-driven collection routines in addition to traditional data theft tactics ^[30].
Threat actors are bypassing technical controls by calling help desks and using social engineering, sometimes augmented by AI, to gain access without malware ^[19].
AI agents can be manipulated through malicious content to execute commands, steal data, or delete files using their legitimate permissions ^[17].
Microsoft announced upcoming AI-powered, context-aware phishing detection for Teams, to be rolled out in early November 2026 ^[13].
Banks have detected rogue AI agents as part of recent threat activity ^[28].

Regulatory or Policy Developments Affecting the Security Industry

Google updated its privacy policy to clarify that data from Gmail and Photos, when used with personalized AI features in Search or Gemini, may be used for targeted advertising ^[5].
Microsoft announced that Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates after that date ^[14].
The U.S. FBI and CISA issued joint advisories warning of election-themed phishing and spear phishing attacks targeting voters and election officials ahead of the US midterm elections ^[2].
CISA added two actively exploited vulnerabilities (Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator) to its Known Exploited Vulnerabilities catalog ^[7].

Sources

Quest Diagnostics confirms data breach exposed patient records - bleepingcomputer.com
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed - malwarebytes.com
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - thehackernews.com
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet - thehackernews.com
Abandoned Popcorn Time app exposed millions of devices to RCE attacks - bleepingcomputer.com
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - thehackernews.com
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud - thehackernews.com
HPE patches eight max severity RCE and auth bypass AOS flaws - bleepingcomputer.com
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws - thehackernews.com
PHP shares mitigation for new RCE vulnerability with no patch - bleepingcomputer.com
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice - darkreading.com
The PHP Meltdown Shows How AI Makes Bugs More Exploitable - wired.com
(Reliable)? php2shell exploitability, (Fri, Oct 23rd) - isc.sans.edu
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) - isc.sans.edu
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure - portswigger.net
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge - securityweek.com
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations - thehackernews.com
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions - thehackernews.com
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials - thehackernews.com
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware - securityweek.com
Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters - blog.knowbe4.com
AI Tools Are Generating Massive Attacks for Little Cost - darkreading.com
Infostealer riding the AI Train - research.checkpoint.com
Trust Is Not What It Seems — And Fraudsters Are Counting on It - darkreading.com
You gave your AI agent access, but who is giving it orders? - bleepingcomputer.com
Microsoft Teams to get AI-powered, context-aware phishing detection - bleepingcomputer.com
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads - thehackernews.com
Microsoft: Windows Server 2016 reaches end of support in January - bleepingcomputer.com
FBI Warns of Phishing Attacks Ahead of the US Midterm Elections - blog.knowbe4.com

Cybersecurity Brief – 2026-10-21

Wed, 21 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Lazarus Group conducted Operation FlashHole, a sophisticated attack using a watering-hole technique and custom malware, targeting users of the CrossWeb EX financial security software ^[1].
Attackers hijacked over 300 Tor exit relays to intercept SSH connections, redirecting them to malicious servers to steal login credentials ^[10].
TeamUpdraft’s website was breached, resulting in the compromise of UpdraftCentral connection keys, which were then used to backdoor WordPress sites ^[12]^[24].
State Bank of India confirmed a data leak after 3,897 customer records appeared on the dark web, though the source of the breach is still unknown ^[14].
Zeabur, a development platform, is shutting down after a second security breach in two months. Attackers used leaked plaintext internal credentials to compromise infrastructure and steal over 10,000 API keys ^[27].
A Belarus-aligned hacktivist group maintained access to a Russian healthcare organization for nearly two years, hiding the Vasilek backdoor in VMware Tools as part of the intrusion ^[16].
AOMEI Backupper was compromised in a supply chain attack, serving users a downloader for the ShinyRoad modular backdoor framework during short compromise windows ^[48].
A hijacked developer account was used to plant information-stealing malware in the OVHcloud CLI, with links to the GlassWorm loader ^[45].

Newly Discovered Vulnerabilities

Two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively known as PHP2Shell, were disclosed. Emergency patches were released after details leaked, and mass exploitation is anticipated ^[8]^[11]^[26]^[38]^[44].
A critical unauthenticated remote code execution vulnerability in Fortinet FortiSIEM has a public proof-of-concept exploit available ^[18].
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including flaws in Plex2Shell, Siemens, and SiteGuard, requiring immediate patching by US federal agencies ^[15].
A design flaw in Meta’s Muse AI assistant share links exposed users’ personal conversations, prompting Meta to suspend the feature ^[36].
A bug in Signal’s calling library could allow another participant to continue listening after a call is hung up; users are advised to update their app ^[52].

Notable Threat Actor Activity

The China-aligned Bronze Sandcastle threat group was observed abusing DLL sideloading via Sandboxie to deploy backdoors, targeting organizations in Asia and Africa ^[6].
Qilin and INC ransomware groups are exploiting a patched vulnerability in Palo Alto Networks PAN-OS and Prisma Access to bypass multi-factor authentication ^[19].
SafePay ransomware has compromised over 600 critical infrastructure organizations globally since 2024, according to CISA ^[23].
Chinese-speaking cybercriminals used autonomous AI agents and the Cairn AI pen-testing tool to automate attacks on over 1,200 company websites, successfully breaching several high-profile organizations ^[20]^[35].
Lazarus Group’s Operation FlashHole involved advanced malware sets and watering-hole attacks ^[1].

Trends, Tools, or Tactics of Interest

Generative AI is making phishing emails more convincing by erasing traditional behavioral tells, weakening detection methods that rely solely on behavior ^[7].
Attackers are increasingly abusing AI-powered tools, such as autonomous AI agents and pen-testing frameworks, to scale and automate attacks against web applications ^[9]^[20]^[35].
AI-powered antidetect browsers are being used in online fraud and influence operations, enabling operators to run thousands of isolated accounts and evade detection ^[50].
Public exploit code has been released shortly after vulnerability disclosures, increasing the risk of rapid mass exploitation, as seen with FortiSIEM and PHP2Shell ^[8]^[18]^[44].
Security teams face challenges in harnessing AI for agentic pentesting, especially in ensuring attack safety and containment ^[9].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Homeland Security ordered federal civilian agencies to remove DeepSeek products and any third-party products or services developed using DeepSeek implementations from their IT systems ^[13]^[29]^[42].
Mozilla, Google, Apple, and other tech vendors blocked eight compromised eMudhra intermediate CA certificates after their private keys were found to be weak and recoverable, triggering emergency fixes across browsers and software ^[17]^[25]^[32]^[41].
CISA issued a directive for federal agencies to patch actively exploited vulnerabilities in Plex2Shell, Siemens, and SiteGuard ^[15].
NIST, CISA, and NSA published ten voluntary incident response practices for preparing for and responding to rogue AI agent incidents ^[47].
CJIS v6.1 compliance guidance was highlighted, emphasizing strong authentication, account security, and audit controls for agencies ^[30].

Sources

Operation FlashHole: Lazarus breaks security, defies control - securelist.com
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections - thehackernews.com
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites - thehackernews.com
Stolen UpdraftCentral keys used to backdoor WordPress sites - bleepingcomputer.com
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web - thehackernews.com
Zeabur shutting down after second security breach in two months - bleepingcomputer.com
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion - thehackernews.com
AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign - securityweek.com
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI - securityweek.com
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't - thehackernews.com
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert - thehackernews.com
PHP warns admins of two critical flaws, emergency patches coming tomorrow - bleepingcomputer.com
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st) - isc.sans.edu
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - securityweek.com
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution - thehackernews.com
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws - thehackernews.com
A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse - wired.com
Signal bug could let someone keep listening after you hang up - malwarebytes.com
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors - thehackernews.com
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA - thehackernews.com
CISA: SafePay ransomware hit over 600 critical infrastructure orgs - bleepingcomputer.com
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites - thehackernews.com
Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree - darkreading.com
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports - thehackernews.com
The Harness Is the Hard Part of Agentic Pentesting - thehackernews.com
The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations - research.checkpoint.com
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases - thehackernews.com
DHS bans DeepSeek products across US federal civilian agencies - bleepingcomputer.com
China Defends DeepSeek After US Ban of Its AI From Government Systems - securityweek.com
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software - thehackernews.com
Mozilla, Google, Apple block compromised eMudhra CA certificates - bleepingcomputer.com
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys - darkreading.com
Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys - securityweek.com
US Agencies Detail Incident Response Practices for Rogue AI Agents - securityweek.com
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies - bleepingcomputer.com

Cybersecurity Brief – 2026-08-04

Tue, 04 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

The Police National Legal Database (PNLD) in the UK suffered a cyberattack resulting in the exposure and dark web publication of contact information for over 100,000 police officers, government employees, and criminal justice professionals ^[10]^[16].
A cyberattack targeted Liechtenstein’s Register of People Behind Companies and Foundations, impacting a registry used for anti-money laundering and counter-terrorism efforts ^[31].
Brinks Home disclosed a data breach with hackers leaking files, though alarm monitoring and system functionality were reportedly unaffected ^[35].
River Bank confirmed that data stolen in a June ransomware attack was subsequently deleted by the attackers, with investigations ongoing ^[32].
Brazilian educational institutions have experienced multiple security incidents, as detailed in a new analysis of response cases ^[1].

Newly Discovered Vulnerabilities

An authentication bypass vulnerability (CVE-2026-18577) in N-able N-central remote monitoring and management servers has been exploited in the wild, allowing attackers to gain administrator access. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, and N-able has released patches following reports of active exploitation and patch bypasses ^[3]^[15]^[19]^[34].
Recent vulnerabilities in SonicWall SMA 1000 VPN appliances have been exploited by ransomware actors for root access and lateral movement within victim networks ^[6]^[36].

Notable Threat Actor Activity

The INC Ransomware operation has emerged as the leading group exploiting SonicWall SMA 1000 vulnerabilities, using these flaws for initial access and subsequent ransomware deployment ^[6]^[36].
Russian threat actor Midnight Blizzard (APT29) has been linked to a global campaign targeting hospitality Wi-Fi networks, using custom malware to breach Microsoft 365 accounts ^[11].
A Chinese-speaking threat actor is using a leaked version of the DarkSword exploit kit to deploy GHOSTBLADE malware targeting Apple iOS devices ^[9].
Another Chinese threat actor weaponized the Deepseek AI agent to attack a security firm, attempting proxyjacking across over 1,200 hosts ^[22].
Eighteen malicious npm packages have been discovered delivering a cross-platform remote access trojan (RAT) to users of Alibaba developer tools ^[4].
The ExfilSquad hacking group leaked information for over 100,000 UK police officers and staff following the PNLD breach ^[16].
Fake Roblox Xeno Executor installers are being used to distribute infostealer and RAT malware to Roblox players ^[14].

Trends, Tools, or Tactics of Interest

Device code phishing attacks have increased by 1,500 percent in 2026, with vishing incidents doubling, reflecting the rise of social engineering techniques that bypass traditional security controls ^[18].
A new Russian loader-as-a-service, DOUBLECUP, uses ClickFix techniques to hide malware in browser cache images, delivering payloads to both Windows and macOS devices ^[13].
Threat actors are increasingly abusing trusted platforms and supply chains, including npm packages and Google Password Manager’s passkey sync, to compromise user accounts and systems ^[4]^[5]^[12]^[26].
Researchers have identified three new “Pass-ta-key” attacks that allow malware on compromised Windows devices to hijack Google-synced passkeys, bypassing user verification ^[5]^[12].
The BTMOB Android RAT ecosystem has grown into a fragmented underground business with resellers, source-code vendors, and custom versions ^[17].
AI platforms such as Claude, Codex, and Cursor are being integrated into security operations for detection writing, investigation, and response ^[8]^[21]^[26].
New tools for tracing the origins of AI-generated videos have been developed, aiming to improve detection and attribution of deepfakes ^[20].
WhatsApp and TikTok-related scams continue, with social engineering targeting account takeover and delivering unwanted applications or fraudulent charges ^[38]^[39].

Regulatory or Policy Developments Affecting the Security Industry

The European Union has begun enforcement of key provisions of the AI Act, requiring increased transparency for chatbots, deepfakes, and other consumer-facing AI systems ^[40].
California launched the Delete Request and Opt-out Platform (DROP), enabling residents to send mass deletion and opt-out requests to registered data brokers ^[41].
New York awarded $9 million in grants to enhance cybersecurity at 153 water systems in response to ongoing threats to water and wastewater infrastructure ^[28].
Visa announced the acquisition of fraud intelligence firm BioCatch for $2.4 billion to strengthen account takeover and fraud prevention capabilities for financial institutions ^[30].

Sources

PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web - thehackernews.com
ExfilSquad hackers leak info of over 100,000 UK police officers, staff - bleepingcomputer.com
Cyberattack Hits Liechtenstein’s Register of People Behind Companies and Foundations - securityweek.com
Brinks Home Discloses Data Breach as Hackers Leak Files - securityweek.com
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack - securityweek.com
An analysis of incidents at Brazilian educational institutions - securelist.com
CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises - thehackernews.com
N-able warns of N-central auth bypass flaw exploited in attacks - bleepingcomputer.com
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers - darkreading.com
N‑able Patches Vulnerability Exploited to Hack N-central Servers - securityweek.com
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws - thehackernews.com
Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks - securityweek.com
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts - bleepingcomputer.com
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS - thehackernews.com
Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm - darkreading.com
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users - thehackernews.com
Fake Roblox Xeno script launcher pushes infostealer, RAT malware - bleepingcomputer.com
Device Code Phishing Up 1,500% in 2026; Vishing Doubles - darkreading.com
New DOUBLECUP ClickFix service hides malware in browser cache images - bleepingcomputer.com
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts - thehackernews.com
New Pass-ta-key attacks let malware hijack Google-synced passkeys - bleepingcomputer.com
What cybersecurity experts are talking about in 2026 - virusbulletin.com
Inside the Underground Business of the Android BTMOB RAT malware - bleepingcomputer.com
FOMO in the SOC: Where AI Platforms like Claude Actually Fit - thehackernews.com
Anthropic: Claude Attacks Result of Security Gaps, Not Model Issues - darkreading.com
New Tool Traces AI Videos Back to Their Source - darkreading.com
WhatsApp account takeover scam asks you to “vote for my friend” - malwarebytes.com
“Adult TikTok” searches lead to scams - malwarebytes.com
The AI Act kicks into action, forces companies to be clear about AI chatbots - malwarebytes.com
Californians can tell data brokers to DROP their information - malwarebytes.com
New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems - securityweek.com
Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion - securityweek.com

Cybersecurity Brief – 2026-07-18

Sat, 18 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Abbott Laboratories is investigating two separate cybersecurity incidents, confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, amid extortion claims. The company is also probing a second, unrelated cyber event ^[12].
Ernst & Young disclosed a data breach after IT personnel’s use of a compromised third-party support ticket system resulted in customer data exposure ^[14].
The Japanese frozen food company Nichirei experienced a cyberattack that forced system disconnection on July 13, disrupting operations. Restoration efforts are underway ^[29].
DigiCert’s April 2026 security incident has been attributed to a threat activity cluster known as CylindricalCanine, specifically a subgroup called GoldenEyeDog, which stole code-signing certificates ^[5].

Newly Discovered Vulnerabilities

Two critical vulnerabilities in WordPress Core, now assigned CVE IDs, allow unauthenticated attackers to execute arbitrary code. A working proof-of-concept has been published, and a persistent-object-cache condition has been identified ^[1].
The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial-of-service by sending an 11-byte TLS request, causing the server to allocate up to 131 KB of memory per request until the process restarts. This affects glibc-based systems ^[2]^[13].
A zero-day exploit named LegacyHive has been released, enabling privilege escalation to administrator level on fully updated Windows systems ^[16].
A security flaw in Shark robot vacuums exposes device cameras, home mapping data, and Wi-Fi passwords, potentially allowing remote access to multiple vacuums if one is compromised ^[31].
Two zero-day vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances have been exploited by threat actors to gain root-level access ^[19].

Notable Threat Actor Activity

Seven malicious npm packages targeting the Vite frontend ecosystem have been discovered using blockchain-based command and control to deliver a remote access trojan, forming part of a software supply chain attack ^[3].
The NadMesh botnet, written in Go, is actively scanning for exposed AI services to harvest cloud credentials and Kubernetes tokens, with operators claiming to have collected thousands of AWS keys ^[4].
North Korean threat actors associated with the Contagious Interview campaign are using steganography in SVG files to deliver malware via fake coding tests, aligning with OtterCookie activity ^[6].
The ACR Stealer infostealer is leveraging ClickFix-themed lures to exfiltrate browser credentials, session tokens, PDFs, Microsoft 365 documents, and OneDrive files from enterprise networks ^[10].
The newly identified GoSerpent malware has been deployed in espionage operations against Southeast Asian governments and diplomats since late 2025 ^[11].
Inc Ransomware operators have exploited SonicWall SMA zero-days in recent attacks ^[19].

Trends, Tools, or Tactics of Interest

Cybercriminals are increasingly seeking “clean” residential proxies and pairing them with advanced browser fingerprinting techniques to evade detection in carding operations ^[15].
Steganography in SVG images is being used by North Korean threat actors to conceal malware in recruitment-themed phishing campaigns ^[6].
Agentic defense strategies, including automated threat detection and remediation, are being incorporated into cloud security platforms to counter AI-driven attacks ^[22]^[26].
The use of blockchain-based command and control infrastructure is emerging in supply chain attacks, as seen in the malicious Vite npm package campaign ^[3].

Regulatory or Policy Developments Affecting the Security Industry

The European Commission has ordered Google to provide rival AI assistants with access to Android’s camera, microphone, on-screen content, and wake word capabilities, matching those available to Gemini ^[7].
Microsoft announced that Windows Server 2022 will reach the end of mainstream support in October 2026, transitioning to extended support with continued security updates for five years ^[17].
The Pentagon’s suspension of CMMC Phase 2 pauses third-party audits but does not remove the legal requirement for defense contractors to protect Controlled Unclassified Information (CUI) ^[28].
San Francisco’s City Attorney has issued cease-and-desist letters to Apple and Google demanding the removal of 13 AI-powered “nudify” face-swap apps from their app stores, citing concerns about misuse targeting women and girls ^[23].

Sources

Abbott probes two cyber incidents amid extortion claims - bleepingcomputer.com
Ernst & Young discloses data breach after support system hack - bleepingcomputer.com
Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei - securityweek.com
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft - thehackernews.com
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - thehackernews.com
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests - thehackernews.com
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload - bleepingcomputer.com
New Windows LegacyHive zero-day gives hackers admin privileges - bleepingcomputer.com
Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords - malwarebytes.com
Inc Ransomware Exploits SonicWall SMA Zero-Days - darkreading.com
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT - thehackernews.com
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens - thehackernews.com
Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images - thehackernews.com
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files - thehackernews.com
New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage - thehackernews.com
Inside the Search for "Clean" Residential Proxies for Carding - bleepingcomputer.com
Google Bets 'Agentic Defense' Strategy Can Outpace Attackers - darkreading.com
Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive - securityweek.com
E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants - thehackernews.com
Windows Server 2022 reach end of mainstream support in 90 days - bleepingcomputer.com
Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday - securityweek.com
San Francisco Demands Apple and Google Delete AI ‘Nudify’ Apps From App Stores - wired.com

Cybersecurity Brief – 2026-07-04

Sat, 04 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic experienced a data breach in April, with threat actor ShinyHunters accessing corporate IT systems and stealing personal and medical information of 3.8 million individuals ^[15].
A joint operation, including Google, disrupted the NetNut residential proxy network, severing access to 2 million compromised Android devices, smart TVs, and streaming boxes ^[10].
Former Member of the European Parliament Stelios Kouloglou was repeatedly targeted with Pegasus spyware during his tenure investigating spyware abuses ^[9].

Newly Discovered Vulnerabilities

Seven unpatched vulnerabilities were disclosed in the FatFs filesystem library, which is embedded in millions of devices using FAT and exFAT formats for USB and SD card access ^[4].
A Linux kernel flaw, CVE-2026-46242 (“Bad Epoll”), allows unprivileged users to escalate privileges to root on Linux desktops, servers, and Android devices ^[5].

Notable Threat Actor Activity

The Armored Likho APT group has been linked to spear-phishing campaigns using AI-generated loaders and the new BusySnake Stealer, targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan ^[1]^[8].
North Korea-linked actors have distributed malicious npm packages masquerading as Rollup polyfills to steal developer secrets and enable remote access ^[7].
The INC ransomware-as-a-service operation has targeted the legal sector, with hundreds of claimed victims in 2026 ^[2].
Researchers identified a new modular malware framework called Avalon, distributed via a multi-stage phishing chain and capable of deploying CrownX ransomware ^[6].
ARToken, a new phishing-as-a-service platform affiliated with EvilTokens, has exposed a sophisticated toolkit aimed at compromising Microsoft 365 accounts ^[11].
A Canadian hacker associated with Anonymous was jailed, while other cases included open source zero-day disclosures and sentencing for ATM jackpotting ^[13].
A 19-year-old alleged member of Scattered Spider, linked to over 100 network intrusions and $100 million in ransom payments, was extradited to the US ^[16].
Two new campaigns were observed: a verified X (Twitter) ad distributing Mac malware, and the ConsentFix campaign stealing Microsoft accounts, both relying on social engineering tactics ^[17].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging AI, including agentic LLMs, to automate complex, multi-stage intrusions such as ransomware attacks, as demonstrated via Langflow ^[14].
Chinese-developed large language models (LLMs) are advancing rapidly, broadening the capability gap between attackers and defenders ^[12].
AI-generated loaders and modular, multi-stage phishing chains are being used to bypass traditional security controls ^[1]^[6].
Social engineering is increasingly favoured over software exploits for compromising devices and accounts ^[17].
The security of open source software is under renewed scrutiny following the public release of zero-day vulnerabilities ^[13].

Regulatory or Policy Developments Affecting the Security Industry

The targeting of a European Parliament member with Pegasus spyware occurred while the individual was investigating spyware abuses, highlighting ongoing policy and oversight challenges related to commercial spyware use in Europe ^[9].

Sources

Medtronic Data Breach Impacts 3.8 Million People - securityweek.com
NetNut proxy network disrupted, 2 million infected devices cut off - bleepingcomputer.com
European Parliament Member Investigating Spyware Was Hacked With Pegasus - thehackernews.com
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices - thehackernews.com
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android - thehackernews.com
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign - securelist.com
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer - thehackernews.com
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets - thehackernews.com
INC Ransomware Gang Targets the Legal Sector - blog.knowbe4.com
New Avalon Malware Framework Packs CrownX Ransomware Capabilities - thehackernews.com
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit - bleepingcomputer.com
In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting - securityweek.com
Alleged Scattered Spider Hacker Extradited to US - securityweek.com
Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts - malwarebytes.com
Agentic AI Used to Conduct Ransomware Attack via Langflow - securityweek.com
Chinese LLMs Broaden the Gap Between Attackers & Defenders - darkreading.com

Cybersecurity Brief – 2026-07-03

Fri, 03 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Google, in coordination with the FBI and industry partners, disrupted the NetNut residential proxy network, which relied on millions of compromised home devices to anonymize cybercriminal and nation-state activity. Hundreds of domains associated with NetNut were seized, significantly degrading the network’s operations ^[4]^[25]^[26].
A dual US-Estonian citizen alleged to be a member of the Scattered Spider hacking collective was extradited to the United States to face charges ^[18].
European Parliament members investigating Pegasus spyware were themselves targeted, with Citizen Lab confirming Pegasus infection on one investigator’s phone ^[24].

Newly Discovered Vulnerabilities

A critical vulnerability in the Cursor AI code editor (DuneSlide) allows zero-click prompt injection attacks that escape the editor’s sandbox and can execute arbitrary code at the operating system level ^[27].
A new WinRAR security flaw has been patched that could allow attackers to take control of a user’s computer. The lack of automatic updates in WinRAR increases the risk of unpatched systems ^[37].
A vulnerability in Apple’s Hide My Email feature, first reported a year ago, remains unpatched and exposes user email addresses ^[35].

Notable Threat Actor Activity

Ransomware groups, including those associated with Anubis, are exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability for initial access and are also leveraging bring-your-own-vulnerable-driver (BYOVD) and supply chain credential theft tactics ^[5]^[28].
The threat actor ToddyCat is deploying new Umbrij malware that abuses OAuth to access Gmail accounts via the Google API, enabling covert email access ^[7].
Attackers linked to the FortiBleed campaign have harvested credentials from hundreds of thousands of FortiGate firewalls and are collaborating with the INC and Lynx ransomware gangs, also exploiting a Nextcloud zero-day vulnerability ^[21]^[30].
Ransomware operators are running campaigns that impersonate Interpol, targeting small businesses globally using basic social engineering techniques ^[22].
KnowBe4 ThreatLabs tracked phishing campaigns targeting the FIFA World Cup 2026, with cybercriminals leveraging the event for credential theft and malware distribution ^[3].
ClickFix and ConsentFix attacks are hijacking Microsoft 365 accounts in seconds by exploiting OAuth flows and fake prompts to bypass MFA protections ^[13]^[36].
Fake Google and Cloudflare verification pages are distributing multiple malware families, including infostealers and a new malware loader, through ClickFix-style social engineering ^[36].

Trends, Tools, or Tactics of Interest

Immediate exploitation of newly disclosed vulnerabilities, such as CitrixBleed, is increasing, with attackers using public proof-of-concept code to target NetScaler appliances ^[28].
The first fully autonomous ransomware attack orchestrated by an AI agent (JADEPUFFER) was observed, exploiting a Langflow RCE vulnerability to automate a database ransomware campaign from start to finish ^[9].
ConsentFix and ClickFix attacks demonstrate a trend of using rapid OAuth token theft and social engineering to bypass MFA and compromise cloud accounts ^[13]^[36].
Opera has introduced a Paste Protect feature to mitigate ClickFix-style attacks by blocking malicious command execution via social engineering ^[17].
Context manipulation attacks, such as BioShocking, can trick agentic browsers into exfiltrating sensitive credentials by bypassing their safety guardrails ^[33].
Compromise assessment projects highlight persistent threats, missed incidents, and gaps in incident response across organizations, emphasizing the need for improved detection and response practices ^[1].
Identity lifecycle management models are being challenged by the proliferation of AI agents, which lack traditional employment records and departure dates, complicating access governance ^[8].
IBM and Red Hat have launched Project Lightwell, assigning 20,000 engineers to address open-source software supply chain risks identified by Anthropic’s Mythos AI bug-finding technology ^[23].
There is a shift in cybercrime pressure toward small and medium-sized businesses in Australia as larger institutions improve safeguards and regulatory compliance ^[19].

Regulatory or Policy Developments Affecting the Security Industry

The Court of Justice of the European Union dismissed Google’s final appeal against a €4.1 billion antitrust fine related to Android’s promotion of Chrome and search, upholding significant regulatory action against the company ^[12].
The Trump administration lifted restrictions on Anthropic’s Claude AI models following cybersecurity concerns, making Claude Fable 5 widely available again ^[31].
Apple has revised its long-standing patch policy to accelerate patch cycles in response to attackers leveraging AI to reduce time to exploit, indicating a move toward more rapid security updates ^[20].

Sources

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices - thehackernews.com
FBI Seizes NetNut Proxy Platform, Popa Botnet - krebsonsecurity.com
Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices - securityweek.com
Alleged Scattered Spider hacker extradited to the United States - bleepingcomputer.com
EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones - wired.com
Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution - securityweek.com
WinRAR flaw could allow attackers to take control of your computer - malwarebytes.com
Apple’s Hide My Email doesn’t hide it very well - malwarebytes.com
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials - thehackernews.com
New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure - securityweek.com
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API - thehackernews.com
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs - darkreading.com
FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks - securityweek.com
Ransomware Thugs Masquerade as Interpol to Entice Small Biz - darkreading.com
Cybercriminals Are Targeting the FIFA World Cup 2026 - blog.knowbe4.com
ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds - bleepingcomputer.com
Fake Google and Cloudflare verification pages spread multiple malware families - malwarebytes.com
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack - thehackernews.com
Opera rolls out Paste Protect feature to fight ClickFix attacks - bleepingcomputer.com
‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials - securityweek.com
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects - securelist.com
Identity Lifecycle Management Wasn't Built for AI Agents - thehackernews.com
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them. - darkreading.com
Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs - darkreading.com
Google loses final appeal to overturn €4.1 billion EU fine - bleepingcomputer.com
Trump Administration Lifts Restrictions on Anthropic’s Claude Models After Cybersecurity Alarm - securityweek.com
Apple Reverses Age-Old Patch Policy to Keep Up With AI - darkreading.com

Cybersecurity Brief – 2026-07-02

Thu, 02 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic has notified customers of a data breach resulting from unauthorized access to personal data, attributed to the ShinyHunters threat actor group ^[19].
Kubota North America Corporation disclosed that hackers had access to parts of its network systems for over a month earlier this year ^[21].
The US Department of Homeland Security confirmed a breach of the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government agencies ^[23].
Over 900 Oracle E-Business Suite instances have been found exposed online and are subject to ongoing attacks exploiting a critical security flaw ^[27].

Newly Discovered Vulnerabilities

Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws rated CVSS 10.0 that could lead to arbitrary code execution ^[13]^[37].
Citrix issued patches for NetScaler appliances, addressing six vulnerabilities including a new HTTP/2 Bomb attack and a high-severity CitrixBleed-style information disclosure bug ^[38].
Apple released security updates for iOS, macOS, and Safari, addressing dozens of vulnerabilities affecting WebKit, the kernel, WebRTC, and other components ^[40].
Google released a Chrome update fixing 382 security bugs, with 15 rated as critical ^[46].
Argo CD has an unpatched vulnerability in its repo-server component that allows unauthenticated attackers to execute code if they can access the component ^[8].
Microsoft SharePoint Server vulnerability CVE-2026-45659 has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation ^[7].
Progress Kemp LoadMaster is affected by a critical pre-authentication remote code execution flaw that is currently seeing active exploitation attempts ^[15].

Notable Threat Actor Activity

Kaspersky researchers identified a large-scale campaign using compromised ScreenConnect software, distributed via SEO-poisoned sites, to deliver AsyncRAT malware ^[1]^[10].
The FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware groups, indicating that stolen Fortinet credentials are intended to facilitate future network intrusions and ransomware attacks ^[20].
A 19-year-old suspected member of the Scattered Spider hacking group has been extradited from Finland to the US to face hacking and fraud charges ^[9].
The Ousaban banking trojan is targeting users in Spain and Portugal with phishing PDF lures to infect Windows systems ^[12].
A new campaign is delivering the PureLogs information stealer through a multi-stage malware chain leveraging Blogger pages and social engineering ^[11].
Multiple weaponized proof-of-concept (PoC) exploits on GitHub are distributing the ChocoPoC remote access trojan, targeting vulnerability researchers ^[6]^[22].

Trends, Tools, or Tactics of Interest

Attackers are using fingerprinting via user-agent data to adapt phishing payloads to the victim’s device and operating system, increasing compromise rates ^[30].
ClickFix, a social engineering technique, is reported as a dominant method for malware delivery ^[31].
AI-generated browser ransomware has been observed abusing the Chromium API across Windows, Linux, macOS, and Android, combining novel attack paths with real browser capabilities ^[16]^[43].
A fake Perplexity Chrome extension, “Search for perplexity ai,” was found to be spying on user searches and requires manual removal ^[44].
Large language models (LLMs) are being exploited for “phantom squatting,” where hallucinated domains for legitimate brands are registered by attackers for supply chain attacks ^[32].
Two vulnerabilities in the AI code editor Cursor could allow prompt injection to escape the sandbox and execute arbitrary commands on a developer’s machine ^[14].
Phishing attacks have exposed employee data at 86 percent of Fortune 100 companies in the past year, with technology, airline, and automotive sectors most affected ^[4].
Hackers conducted over 81 million password-spraying login attempts against Microsoft 365 accounts in a two-week period ^[25].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced it is accelerating its post-quantum cryptography roadmap, targeting a transition by 2029 due to advances in quantum computing ^[18].
The US Federal Trade Commission fined Amazon $2.25 million for withholding transaction records from identity theft victims, impacting fraud investigations ^[29].
Microsoft introduced new Teams admin policies requiring organizer approval for external AI bots in meetings, enhancing control over automated participants ^[36].

Sources

Medtronic notifies customers impacted by ShinyHunters data breach - bleepingcomputer.com
Kubota says hackers had month-long access to network systems - bleepingcomputer.com
DHS confirms hackers breached HSIN info-sharing platform - bleepingcomputer.com
Over 900 Oracle E-Business instances exposed to ongoing attacks - bleepingcomputer.com
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic - thehackernews.com
Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities - securityweek.com
Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack - securityweek.com
Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari - securityweek.com
Chrome needs another whopper update to fix 382 security bugs - malwarebytes.com
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters - thehackernews.com
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation - thehackernews.com
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts - thehackernews.com
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign - securelist.com
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT - thehackernews.com
FortiBleed credential-theft campaign linked to Lynx ransomware - bleepingcomputer.com
19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - thehackernews.com
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - thehackernews.com
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer - thehackernews.com
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - thehackernews.com
New ChocoPoC malware targets researchers via trojanized PoC exploits - bleepingcomputer.com
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS - darkreading.com
And the Winner in Dominant Malware Delivery? ClickFix - darkreading.com
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android - thehackernews.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - research.checkpoint.com
Fake Perplexity Chrome extension spies on your searches - malwarebytes.com
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat - darkreading.com
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands - thehackernews.com
Phishing Exposes Employee Data at 86% of Fortune 100 Companies - blog.knowbe4.com
Hackers target Microsoft 365 accounts with 81 million login attempts - bleepingcomputer.com
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - thehackernews.com
Amazon fined $2.25M for withholding evidence from fraud victims - bleepingcomputer.com
Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - securityweek.com

Cybersecurity Brief – 2026-06-19

Fri, 19 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17]^[29].
Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13]^[21].
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19]^[36].
Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations ^[4]^[22].
F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems ^[5]^[24].
Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies ^[42].
Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation ^[44].
Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix ^[45].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite ^[3]^[14].
The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays ^[11].
The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations ^[17]^[29].
A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities ^[8]^[16].
Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp ^[19]^[36].
The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes ^[33].
The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 ^[9].

Trends, Tools, or Tactics of Interest

There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise ^[20].
Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted ^[7].
Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked ^[6].
The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion ^[3]^[14].
The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data ^[43].
Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles ^[46].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials ^[13].
CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 ^[37].
New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements ^[10].

Sources

Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com

Cybersecurity Brief – 2026-06-18

Thu, 18 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

A data leak dubbed “FortiBleed” has exposed VPN credentials for 73,932 Fortinet and FortiGate firewall URLs at organizations worldwide. Attackers have compiled working credentials for tens of thousands of compromised devices across nearly 200 countries, actively targeting various sectors ^[11]^[18].
Kodak has confirmed a data breach following claims by the ShinyHunters hacking group. The company states there is no threat to its systems or operations as a result of the incident ^[24].
Researchers discovered an exposed collection of 24 billion stolen records online, including usernames, passwords, and other sensitive account data ^[34].
Roblox developers have been targeted by attackers using fake job offers and malware to steal accounts, Robux, and entire Roblox games ^[32].

Newly Discovered Vulnerabilities

Microsoft has confirmed a zero-day vulnerability in Defender, codenamed RoguePlanet, which allows privilege escalation via a race condition. A patch is in development and public proof-of-concept code is available. The vulnerability is tracked as CVE-2026-50656 ^[4]^[30].
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited ^[15].
Rockwell Automation has released patches for vulnerabilities affecting Logix, CompactLogix, Flex, RSLinx, and FactoryTalk industrial control system products ^[28].
Oracle has issued its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple products, including Communications, EBS, and Enterprise Manager ^[31].

Notable Threat Actor Activity

A coordinated malware campaign has published at least 15 malicious plugins on the JetBrains Marketplace, exfiltrating AI API keys and other sensitive data. Additionally, malicious Chrome extensions are capturing chatbot conversations ^[7].
An unknown threat actor is leveraging paid or promoted posts on legitimate news websites, fake reviews, AI narrators, and comments on VirusTotal to promote a crypto clipper malware campaign ^[3].
A French-speaking attacker compromised a small French automotive business, planted a keylogger, and maintained persistence using Tailscale and OpenSSH after their command-and-control infrastructure went offline ^[5].
The DragonForce ransomware group deployed a Go-based backdoor that uses Microsoft Teams relay servers for command-and-control in a recent attack ^[29].
The INC ransomware group continues to target sectors where operational disruption puts immediate pressure on victims to pay, such as healthcare ^[17].

Trends, Tools, or Tactics of Interest

85.8 percent of phishing attacks in the past 12 months were AI-driven, with threat actors increasingly using AI agents to automate social engineering ^[1].
Enterprise adoption of AI agents is creating security blind spots, with 83 percent of organizations lacking visibility into their AI agents’ activities and 86 percent lacking visibility into AI data flows ^[2].
There is a rise in account takeovers as attackers bypass traditional defenses using phishing, session hijacking, and MFA fatigue attacks ^[12].
Attackers are increasingly exploiting exposed admin panels, credential reuse, and non-zero-day vulnerabilities to gain initial access, as seen in recent attack surface exposure reports ^[8].
Coordinated SSH brute-force attacks remain prevalent, with attackers adapting their tactics over recent months ^[21].
Security researchers highlight that browser-based attacks may evade detection by traditional security tools, creating a “browser blind spot” ^[22].
Adversarial exposure validation is emerging as a method to help security teams prioritize which vulnerabilities to address, moving beyond simple visibility to actual validation of risk ^[6].
New Android malware, Rokarolla, can take full control of infected devices and targets over 200 banking and cryptocurrency apps to steal credentials ^[33].
Attackers are using fake job offers as a vector to deliver malware and compromise developer accounts in gaming platforms ^[32].

Regulatory or Policy Developments Affecting the Security Industry

From August 3, 2026, Google will use IP addresses from UK, EEA, and Switzerland users for ad measurement and personalization, as the UK Information Commissioner’s Office (ICO) considers new consent rules ^[10].
The EU has initiated the “Shield-6G” project to develop security measures for 6G networks, incorporating AI threat detection, digital twins, and honeypots ^[16].
The UK Home Office will implement facial age estimation technology for asylum-seeker age checks despite internal tests showing high risks of errors ^[19].

Sources

FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices - darkreading.com
Kodak Admits Data Breach After ShinyHunters Hack Claims - securityweek.com
24 billion stolen records exposed online. Here’s what to do - malwarebytes.com
Roblox developers are losing entire games to malware attacks - malwarebytes.com
Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development - thehackernews.com
Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day - securityweek.com
CISA orders feds to patch max severity Joomla plugin flaw by Friday - bleepingcomputer.com
Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats - thehackernews.com
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments - thehackernews.com
Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - thehackernews.com
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack - securityweek.com
INC Ransomware Thrives by Mastering the Basics - darkreading.com
From 1% to 26%: How AIDA Orchestration Fixes the Remedial Training Gap - blog.knowbe4.com
Best AI Agent Security Tools for SMB and Enterprise in 2026 - blog.knowbe4.com
Why Account Takeovers Are Rising and How to Stop Them - bleepingcomputer.com
The Top 10 Attack Surface Exposures in 2026 - thehackernews.com
The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization - thehackernews.com
Rokarolla Android malware can take over your phone and steal banking logins - malwarebytes.com
Google to use UK and EU user IP addresses for ad personalization - bleepingcomputer.com
EU Gets a Head Start in Developing 6G Network Security - darkreading.com
The UK Will Scan Asylum-Seekers’ Faces for Age Checks—Despite Knowing the Tech Is Flawed - wired.com

Cybersecurity Brief – 2026-01-23

Fri, 23 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Under Armour suffered a ransomware breach resulting in the alleged exposure of data belonging to 72 million customers. The stolen data is reported to be circulating on the dark web.
Fortinet FortiGate devices are being actively targeted and compromised in automated attacks. Threat actors are creating rogue accounts and stealing firewall configuration data, with reports of malicious configuration changes even on fully patched devices.
A major food service franchisee operator in Southeast Asia was targeted by the new Osiris ransomware family in November 2025, leveraging a Bring Your Own Vulnerable Driver (BYOVD) attack using the POORTRY driver.
SmarterTools SmarterMail email servers are being actively exploited via an authentication bypass vulnerability. Attackers are hijacking admin accounts and resetting passwords, with exploitation observed within two days of patch release.
Researchers were able to recover stolen data from 12 U.S. organizations impacted by INC ransomware due to an operational security failure by the threat actors.
Okta SSO accounts are being targeted in active vishing-based data theft attacks, with attackers employing custom phishing kits tailored for voice-based social engineering.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-24061, CVSS 9.8) was disclosed in GNU InetUtils telnetd, allowing attackers to bypass login and gain root access. The flaw was present for nearly 11 years.
Atlassian, GitLab, and Zoom released security patches addressing over two dozen vulnerabilities, including several critical- and high-severity issues.
Cisco released patches for a critical zero-day vulnerability (CVE-2026-20045) in Cisco Unified CM, which could allow unauthenticated remote code execution and is under active exploitation.
A new authentication bypass flaw in SmarterMail is being exploited in the wild to hijack administrator accounts.
At Pwn2Own Automotive 2026, researchers exploited 29 zero-day vulnerabilities across automotive technologies in a single day.

Notable Threat Actor Activity

North Korean-linked threat actor KONNI is conducting a phishing campaign targeting developers, using AI-generated PowerShell backdoors.
DPRK actors are deploying spear-phishing campaigns that utilise VS Code Tunnels and trusted Microsoft infrastructure to facilitate remote hacking while evading detection.
A widespread phishing campaign is targeting LinkedIn users via automated comments posted by bots impersonating LinkedIn personnel.
A malicious PyPI package impersonating the SymPy library was discovered deploying XMRig cryptominer on Linux hosts.
Fake LastPass maintenance phishing emails are targeting users, urging them to back up their vaults within 24 hours.
Threat actors are using trusted Remote Monitoring and Management (RMM) tools as backdoors, as observed in a dual-vector campaign exploiting legitimate RMM software for persistent access.

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting trusted and familiar systems, such as RMM tools, VS Code Tunnels, and routine services, to gain and maintain access.
Social engineering tactics are evolving, with a rise in vishing attacks targeting Okta SSO and phishing campaigns leveraging LinkedIn comments.
The use of AI is expanding in both attack and defence: threat actors are using AI to generate malware, while defenders are integrating AI-driven detection into security products.
Old attack techniques, such as Linux page cache exploits, are being optimised for greater speed and efficiency by researchers.
The abuse of software supply chains continues, with malicious packages on PyPI and impersonation of popular libraries.
Microsoft Teams will introduce brand impersonation warnings to help detect social engineering attempts during calls.

Regulatory or Policy Developments Affecting the Security Industry

The EU AI Act introduces a legal requirement for AI literacy training, shifting best practice into a compliance mandate for organisations operating in or with the EU.
The developer of the curl project is ending its bug bounty programme on HackerOne due to a high volume of low-quality, AI-generated vulnerability reports.
Increased scrutiny in Europe regarding overreliance on US cybersecurity technology providers, with ongoing policy discussions about technology sovereignty and supply chain risks.
The Australian government is reviewing the cybersecurity risks of Chinese-made electric buses, which have been found to contain vulnerabilities and a potential remote “kill switch.”

Cybersecurity Brief – 2025-12-02

Tue, 02 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, suffered a data breach impacting 33.7 million customers, exposing personal information.
The CodeRED Emergency Alert Platform was shut down following a cyberattack attributed to the Inc ransomware gang, which claims to have stolen sensitive subscriber data.
The open-source SmartTube YouTube app for Android TV was compromised after an attacker accessed the developer’s signing keys, resulting in a malicious update being distributed to users.
OpenAI experienced a data breach that resulted in exposure of sensitive information, as reported in recent threat intelligence updates.

Newly Discovered Vulnerabilities

CVE-2025-61260: A command injection vulnerability was disclosed in OpenAI Codex CLI, allowing malicious project-local configuration files to execute arbitrary commands.
CISA added CVE-2021-26829, a vulnerability in ScadaBR (an open-source industrial control system), to its Known Exploited Vulnerabilities catalog following a hacktivist ICS attack.
A new variant of the Shai-hulud self-replicating npm-package poisoning worm was identified, capable of stealing credentials and secrets from AWS, Google Cloud Platform, and Azure.
Glassworm malware has returned in a third wave, with 24 new malicious packages uploaded to the OpenVSX and Microsoft Visual Studio Code marketplaces.

Notable Threat Actor Activity

ShadyPanda, a threat actor, has been linked to a seven-year-long campaign using malicious Chrome and Edge browser extensions, amassing over 4.3 million installs. Initially legitimate, these extensions evolved into spyware for data exfiltration.
The Russian-speaking Tomiris group is conducting a cyber-espionage campaign targeting government and diplomatic entities in CIS member states and Central Asia, deploying new tools and tactics.
The Inc ransomware gang claimed responsibility for the CodeRED platform attack, stating it exfiltrated sensitive subscriber data.
Russian cybercriminals have developed and are distributing Albiriox, a new Android banking trojan offered as malware-as-a-service (MaaS), targeting over 400 financial apps and enabling on-device fraud and remote control.

Trends, Tools, or Tactics of Interest

Increase in holiday-themed scams, particularly targeting mobile-first shoppers, as reported by Malwarebytes.
Attackers are leveraging trusted software supply chains, including code packages and browser extensions, to deliver malware (e.g., Glassworm, ShadyPanda).
The emergence of AI-powered browsers is raising new security concerns due to their novel architectures and integration with AI agents.
Threat actors are using deepfakes, fake resumes, and stolen identities to infiltrate organisations via hiring pipelines, increasing insider threat risks.
Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency mixing service, which facilitated laundering of over €1.3 billion in Bitcoin for cybercriminals. Approximately $29 million in Bitcoin was seized.
Albiriox malware is being marketed as a MaaS solution for $720 per month, reflecting the ongoing professionalisation of cybercrime services.

Regulatory or Policy Developments Affecting the Security Industry

India’s telecommunications ministry has mandated that all new mobile devices must come pre-installed with the government-backed cybersecurity app Sanchar Saathi within 90 days, aiming to combat telecom fraud.

Cybersecurity Brief – 2025-11-27

Thu, 27 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Gainsight has expanded its list of impacted customers following a recent security alert from Salesforce, indicating the breach affected more customers than initially disclosed.
Multiple London councils, including the Royal Borough of Kensington and Chelsea and Westminster City Council, have experienced IT service disruptions due to a cyberattack.
Comcast will pay a $1.5 million fine after a vendor data breach in February 2024 exposed the personal information of nearly 275,000 customers.
Dartmouth College confirmed a data breach resulting from an Oracle hack, with over 226 GB of files stolen and leaked.
The OnSolve CodeRED emergency alert platform in the US was disrupted by a ransomware attack from the Inc Ransom group, resulting in operational impact and data breach.
Thousands of secrets, including credentials and private keys, were leaked by users of JSONFormatter and CodeBeautify code formatting platforms.
A major sportswear company was targeted by a high-volume phishing campaign between 29 and 30 October 2025, as detected by KnowBe4 analysts.

Newly Discovered Vulnerabilities

ASUS released firmware updates to address nine security vulnerabilities in AiCloud routers, including a critical authentication bypass flaw.
The ’node-forge’ JavaScript cryptography library patched a vulnerability that allowed attackers to bypass signature verification with specially crafted data.
A new malicious Chrome extension was discovered that injects hidden Solana transfer fees into Raydium swaps, diverting funds to attacker-controlled wallets.
Microsoft warned that FIDO2 security keys may prompt users for a PIN after recent Windows updates since September 2025.
Microsoft announced plans to secure Entra ID sign-ins from external script injection attacks, with implementation set for mid-to-late October 2026.

Notable Threat Actor Activity

The Shai-Hulud v2 supply chain attack has spread from npm to Maven, compromising over 830 npm packages and exposing thousands of secrets.
Qilin ransomware was deployed in a sophisticated supply chain attack targeting a South Korean managed service provider, resulting in data theft from 28 financial sector victims.
The RomCom threat group used SocGholish fake update attacks to deliver Mythic Agent malware to a US-based civil engineering company.
A new Mirai-based botnet, ShadowV2, has been observed exploiting known vulnerabilities in IoT devices from D-Link, TP-Link, and others, using the recent AWS outage as a test event.
Scammers are using fake LinkedIn job postings and video updates to distribute Flexible Ferret malware to Mac users, enabling multi-stage data theft and long-term access.
The “Scattered LAPSUS$ Hunters” group continued data theft and mass extortion campaigns against major corporations.
Cybercriminals have increasingly targeted financial institutions and individuals with account takeover fraud, causing $262 million in losses in 2025, according to the FBI.

Trends, Tools, or Tactics of Interest

NTLM relay and credential forwarding attacks continue to be exploited, with new vulnerabilities and abuse techniques identified in 2025.
The EMEA finance and banking sector faces escalating cybersecurity challenges, with increased targeting and advanced threats.
Advanced digital fraud attacks surged 180% in 2025, with generative AI used for creating deepfakes, synthetic IDs, and autonomous bots.
Attackers are integrating large language models (LLMs) into malware to evade detection and augment code in real time.
“Dark LLMs” are facilitating more competent attacks by low-level cybercriminals, though with limited technical sophistication.
Prompt injection vulnerabilities are a growing concern for agentic AI-enabled browsers, such as ChatGPT’s Atlas Browser.
Over half of surveyed enterprises are uncertain about their ability to secure non-human identities (NHIs), highlighting a gap in identity security controls.
Increased use of community-maintained tools (e.g., Chocolatey, Winget) for patching and updates presents both opportunities and risks for IT teams.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced a new Cyber Security and Resilience Bill, setting out enhanced requirements for critical infrastructure organisations.

Cybersecurity Brief – 2025-11-19

Wed, 19 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Pennsylvania Attorney General’s office confirmed a data breach following a ransomware attack by the Inc Ransom group, which claims to have stolen several terabytes of data.
Princeton University disclosed a data breach affecting alumni, donors, faculty, students, and parents, with hackers accessing a database containing personal information.
Eurofiber France suffered a breach where a threat actor exploited a vulnerability, exfiltrated data, and attempted extortion.
French social security agency Pajemploi reported a data breach potentially exposing the personal information of 1.2 million individuals.
DoorDash disclosed a data breach involving theft of customer names and addresses.
A simple flaw in WhatsApp’s contact discovery tool exposed up to 3.5 billion phone numbers, along with profile photos and other data, by allowing mass enumeration.
Cloudflare experienced a global outage affecting multiple major online services, though it was confirmed not to be caused by a cyberattack.

Newly Discovered Vulnerabilities

Fortinet released patches for a new FortiWeb zero-day vulnerability (CVE-2025-58034, CVSS 6.7) that is being actively exploited in the wild.
Google released an emergency update to address a new Chrome zero-day vulnerability under active exploitation, marking the seventh Chrome zero-day exploited this year.
Researchers identified that exposed Ray clusters are being hijacked via an old code execution flaw in a campaign dubbed ShadowRay 2.0, converting them into a cryptomining botnet.
IoT devices remain susceptible to takeover via gaps in cloud management interfaces for firewalls and routers, even if protected by security software or not directly online.

Notable Threat Actor Activity

Iranian-linked threat actors, including UNC1549, have been observed targeting aerospace and defense sectors in the US, Israel, UAE, Qatar, Spain, and Saudi Arabia, deploying backdoors such as TWOSTROKE and DEEPROOT.
The Inc Ransom group claimed responsibility for the ransomware attack and data breach at the Pennsylvania Attorney General’s office.
A new phishing kit is impersonating the Italian IT provider Aruba, targeting Italian entities to steal credentials.
MI5 warned UK lawmakers that Chinese intelligence operatives are using LinkedIn for large-scale outreach and espionage efforts.
Seven malicious npm packages were discovered using Adspect cloaking to differentiate between security researchers and real victims, redirecting the latter to cryptocurrency scam pages.

Trends, Tools, or Tactics of Interest

Phishing-as-a-Service (PhaaS) kit Sneaky 2FA has added Browser-in-the-Browser (BitB) pop-up functionality to better mimic legitimate login processes and bypass 2FA.
The Tycoon 2FA phishing platform has enabled real-time MFA relays, supporting over 64,000 attacks this year, highlighting the ongoing collapse of legacy MFA when targeted by advanced phishing kits.
Tuoni C2, a nascent command-and-control and red teaming framework, was used in a recent attempted cyber intrusion targeting a major US real-estate company.
Microsoft mitigated a record-breaking 15.72 Tbps DDoS attack against an endpoint in Australia, attributed to the AISURU botnet.
Enterprises are increasingly leveraging dark web search engines for credential leak monitoring, impersonation detection, and supply chain exposure analysis using APIs and IOC hunting.
Bug bounty programs continue to rise as a key strategic security solution, with Meta alone paying out $4 million in 2025 and launching new tools to support security research on WhatsApp.
Microsoft announced native integration of Sysmon into Windows 11 and Server 2025, eliminating the need for standalone deployment.
New Windows 11 features, Cloud Rebuild and Point-in-Time Restore, aim to streamline system recovery and reduce downtime.
Microsoft Teams will soon allow users to report messages incorrectly flagged as threats, refining threat detection accuracy.
Thunderbird 145 now supports native connectivity to Microsoft Exchange via EWS protocol.

Regulatory or Policy Developments Affecting the Security Industry

MI5 issued a formal warning to UK lawmakers regarding ongoing Chinese espionage campaigns leveraging professional networking platforms.

Cybersecurity Brief – 2025-11-18

Tue, 18 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.
Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.
DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.
The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.
Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.
Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.
A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.
The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.
Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.
A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.
Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.

Notable Threat Actor Activity

The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.
Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.
The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.
The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.
Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.
Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.
ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.
Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.
Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.
Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.
DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.

Regulatory or Policy Developments Affecting the Security Industry

In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.
Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.

Cybersecurity Brief – 2025-09-12

Fri, 12 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The UK train operator LNER disclosed a data breach involving a third-party supplier, resulting in the compromise of customer contact information and other data.
Panama’s Ministry of Economy and Finance reported a cyberattack claimed by the INC ransomware group, with indications that at least one computer was compromised.
Cornwell Quality Tools suffered a ransomware attack attributed to the Cactus group, impacting approximately 100,000 individuals.
Vyro AI experienced a data leak, attributed to poor cyber hygiene, exposing proprietary or sensitive data.
Apple issued warnings to customers targeted in a recent series of spyware attacks, as confirmed by the French national CERT (CERT-FR).
Microsoft Exchange Online experienced an outage in North America, disrupting email access for customers.
Meta faces whistleblower allegations of ignoring child sex abuse risks within its VR “metaverse” environment.

Newly Discovered Vulnerabilities

A critical use-after-free vulnerability in Google Chrome was patched, which could have allowed code execution.
Cisco patched high-severity vulnerabilities in IOS XR that could allow ISO image verification bypass and denial-of-service attacks.
A security weakness in the AI-powered Cursor code editor was disclosed, enabling silent code execution when opening malicious repositories.
A new Spectre-like attack, VMScape, was identified that allows a malicious VM to leak cryptographic keys from a QEMU hypervisor on AMD and Intel CPUs.
A critical access control vulnerability (CVE-2024-40766) in SonicWall SSLVPN devices is being actively exploited.
Apple CarPlay was found to have a remote code execution exploit that remains unaddressed in most vehicles.
Researchers demonstrated that the ThrottleStop.sys driver can be weaponized by the Gentlemen ransomware to disable antivirus and EDR solutions.

Notable Threat Actor Activity

The Akira ransomware group is actively exploiting the SonicWall SSLVPN vulnerability (CVE-2024-40766) and related misconfigurations to gain initial access to targeted environments.
Fake browser extensions, including “Madgicx Plus” and “SocialMetrics,” are being distributed via malicious ads and websites to hijack Meta Business Accounts and steal sensitive data.
The Vidar infostealer has resurfaced with new evasion techniques and enhanced data exfiltration capabilities.
AI-backed malware, attributed to the EvilAI group, is leveraging legitimate-sounding productivity apps to deliver Trojans with advanced evasion against antivirus solutions.
A phishing campaign is abusing iCloud Calendar invites sent via Apple infrastructure to deliver PayPal-themed phishing messages.
Scam text messages impersonating Bureau of Motor Vehicles are targeting motorists for personal and banking information.
Romance scams continue, with a recent case involving an “astronaut-in-distress” scenario resulting in financial loss to an elderly victim.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging legitimate credentials and simple login methods rather than exploiting technical vulnerabilities, highlighting a trend of “logging in” rather than “hacking in.”
AI-generated deepfake scams are rising, prompting the FBI and American Bankers Association to issue joint guidance for awareness and mitigation.
Jailbreaking of AI models remains a challenge, with the UAE’s K2 Think AI model being compromised through its own transparency features hours after release.
The use of malvertising and fake browser extensions to hijack business accounts is increasing.
Memory Integrity Enforcement, a new security architecture in Apple’s latest iPhones, aims to mitigate memory-related vulnerabilities.
Google Pixel 10 devices now support the C2PA standard for verifying the authenticity and provenance of digital media.
Microsoft has added malicious link warnings to Teams private chats to enhance user protection.
Security researchers are focusing on AI pen testing, including social engineering and behavioral manipulation techniques for large language models.
The security of browser extensions remains a significant concern, with risks of data exfiltration and adversary-in-the-middle (AitM) attacks.
Overloaded SOCs are increasingly turning to AI for alert triage and automation, though concerns remain about AI introducing new risks if not properly overseen.

Regulatory or Policy Developments Affecting the Security Industry

U.S. Senator Ron Wyden has urged the Federal Trade Commission to investigate Microsoft for alleged “gross cybersecurity negligence” related to ransomware incidents, specifically referencing Windows security and Kerberoasting attacks.
The European Union imposed financial sanctions on Stark Industries Solutions Ltd., a bulletproof hosting provider, though the company continues to operate by evading these sanctions.

Cybersecurity Brief – 2025-06-24

Tue, 24 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

McLaren Health Care reported a data breach impacting 743,000 patients following a July 2024 attack by the INC ransomware gang.
Nucor, North America’s largest steel producer, confirmed data theft in a recent cyber incident.
A database containing 184 million plaintext passwords from platforms including Facebook and Google was discovered exposed online without encryption or protection.

Newly Discovered Vulnerabilities

Citrix released patches for critical vulnerabilities in NetScaler ADC and Gateway appliances, urging customers to update to prevent exploitation.
A Windows LNK flaw was exploited by the XDigo malware in attacks against Eastern European government entities.
Scanning activity targeting Ichano AtHome IP Cameras was observed, indicating potential exploitation attempts.

Notable Threat Actor Activity

The China-linked Salt Typhoon group exploited a critical Cisco vulnerability to breach Canadian telecommunications firms, as confirmed by the Canadian Centre for Cyber Security and the FBI.
Russian state-sponsored APT28 used Signal chats to deliver two new malware strains, BeardShell and SlimAgent, in attacks targeting Ukrainian government entities.
Pro-Iranian hackers and hacktivists are assessed as likely to escalate cyberattacks against U.S. networks following recent U.S. airstrikes on Iranian nuclear sites, according to warnings from the U.S. Department of Homeland Security.
Four REvil ransomware members arrested in Russia in 2022 were released after serving time for carding and malware distribution charges.
Attackers exploited misconfigured Docker APIs and used Tor for anonymity in a cryptocurrency theft campaign, resembling tactics previously used by the Commando Cat actor.
Telegram purged Chinese crypto scam markets from its platform, but these markets quickly re-emerged under new branding.

Trends, Tools, or Tactics of Interest

SparkKitty, a new Trojan spyware for iOS and Android, was found distributed via the App Store, Google Play, and untrusted websites. It steals images, including cryptocurrency wallet seed phrases, from device galleries.
The XDigo malware, written in Go, was used in targeted attacks on Eastern European governments, leveraging the Windows LNK flaw for initial access.
A new jailbreaking technique, “Echo Chamber,” enables attackers to bypass guardrails in large language models (LLMs) like OpenAI and Google Gemini, prompting the generation of harmful content.
Attackers are increasingly using encrypted messaging apps (e.g., Signal) for malware delivery in targeted campaigns.
Google announced new multi-layered defences for its generative AI systems to address risks such as indirect prompt injection attacks.
SOCs are exploring AI-enabled workflow automation to address analyst burnout and improve operational efficiency.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Homeland Security and FBI issued advisories regarding increased cyber threats from Iranian and pro-Iranian actors in response to geopolitical events.
The Canadian Centre for Cyber Security released guidance following state-sponsored intrusions into national telecom infrastructure via Cisco vulnerabilities.

Cybersecurity Brief – 2025-04-18

Fri, 18 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Ahold Delhaize Data Breach: Food retail giant Ahold Delhaize confirmed data theft from its U.S. business systems during a November 2024 cyberattack, attributed to the INC ransomware group. The breach impacted operations at several of its 2,000 U.S. stores.
Legends International Breach: Entertainment venue management firm Legends International disclosed a data breach from November 2024 affecting both employees and venue visitors.
Airport Retailer Ransomware Settlement: An airport retailer agreed to a $6.9 million settlement after a ransomware attack exfiltrated personal data (including names and Social Security numbers) of approximately 76,000 current and former employees.
Surge in SMS Phishing Scams: CTM360 reported a global spike in SMS-based reward and toll scams, notably PointyPhish and TollShark, operating via the Darcula Phishing-as-a-Service (PhaaS) platform. Over 5,000 domains are implicated in payment information theft.
Real Cash Scam in the U.S.: A widespread scam is tricking individuals into withdrawing and transferring large sums of cash to fraudsters, resulting in significant financial losses.

Newly Discovered Vulnerabilities

CVE-2025-32433 (Erlang/OTP SSH): A critical pre-auth remote code execution vulnerability in Erlang/OTP SSH was disclosed. The flaw is easily exploitable and requires immediate patching.
CVE-2025-24054 (Microsoft Windows): Actively exploited vulnerability allows NTLM credential theft via file downloads (notably .library-ms files). The flaw is being leveraged in phishing campaigns targeting government and private sector entities.
Chrome Extensions with Hidden Tracking: 57 Chrome extensions (6 million installs) were found to contain hidden tracking code, with capabilities to monitor browsing, access cookies, and potentially execute remote code.

Notable Threat Actor Activity

Mustang Panda: The China-linked Mustang Panda group targeted a Myanmar organization using new tooling, including StarProxy, EDR bypass techniques, and updated TONESHELL malware, demonstrating ongoing innovation.
XorDDoS Malware Expansion: Researchers identified a new XorDDoS controller and expanded infrastructure. The malware now targets Docker, Linux, and IoT environments, with 71% of attacks observed between Nov 2023–Feb 2024.
State-Sponsored ClickFix Campaigns: State-backed actors from Iran, North Korea, and Russia are actively using the ClickFix social engineering technique in targeted malware campaigns over the past three months.
Android Pre-Downloaded Malware: Threat actors are pre-installing malware on Android devices to steal cryptocurrency by covertly swapping wallet addresses.

Trends, Tools, and Tactics

Abuse of Legitimate Platforms: There is a continued increase in the abuse of legitimate domains (e.g., Google Drive, QuickBooks, Microsoft) for phishing attacks, with predictions that this trend will escalate in 2025.
AI in SaaS and Data Exposure: Employees are increasingly using AI-enabled tools (e.g., ChatGPT, SaaS integrations), inadvertently risking sensitive data exposure.
Security Awareness as a Top Challenge: A CyberEdge Group survey found that lack of security awareness among employees remains the primary obstacle to effective cyber defense.
Phishing-as-a-Service (PhaaS): Platforms like Darcula are enabling large-scale, sophisticated SMS phishing operations globally.

Regulatory and Policy Developments

CVE Program Funding Uncertainty: CISA extended MITRE’s CVE program contract by 11 months after initial cuts threatened continuity. The program’s long-term future remains uncertain, raising sector-wide concerns.
Cybersecurity Information Sharing Act Renewal: U.S. senators proposed a 10-year extension of the Cybersecurity Information Sharing Act of 2015 to facilitate continued information sharing between businesses and federal agencies.
Microsoft Office 2016/2019 End-of-Support: Microsoft reminded customers that Office 2016 and 2019 will reach end of extended support on October 14, 2025, impacting security update availability.
Discord Facing Legal and Regulatory Scrutiny: New Jersey filed suit against Discord for alleged failures in protecting children online. Discord is also piloting age verification via facial scans to enhance age-gating.
Leadership Change at SentinelOne: Chris Krebs resigned from SentinelOne after his security clearance was revoked by the Trump administration, reflecting ongoing political tensions impacting cybersecurity leadership.

AI Security

PromptArmor Platform Launch: PromptArmor, a new AI security startup, launched to help organizations assess and monitor third-party AI risks, following notable AI-related vulnerability discoveries.

Other Notable Developments

Security Usability Concerns: Reports highlight that complex security tools lead users to seek workarounds, undermining cyber defense efforts.