Cybersecurity Brief – 2026-06-28

Sun, 28 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Security Service of Ukraine (SSU) and the US FBI uncovered a long-running campaign by Russian intelligence services that used fake support text messages to steal messaging app credentials from Ukrainian citizens ^[1].
LastPass confirmed another incident where users had their data stolen, marking a repeat compromise for the password manager service ^[5].

Threat actors are leveraging a Chinese-developed framework, DCloud Uni-App, to power over 200,000 scam and investment fraud websites. The toolkit is being sold and widely adopted in the cybercrime underground ^[7].
Russian intelligence services have been attributed to a credential theft campaign targeting messaging platforms in Ukraine, utilising social engineering via fraudulent support messages ^[1].

A new attack method has emerged where agentic AI coding tools, when tasked with cloning and setting up seemingly clean GitHub repositories, can be tricked into executing malware that evades detection by security scanners, AI agents, and human reviewers ^[3].
The education sector is experiencing increased risk from third-party breaches, highlighting the sector’s challenges in defending against ransomware and vendor-related attacks ^[4].
YARA-X released versions 1.18.0 and 1.19.0, introducing three improvements and two bug fixes to the malware detection and analysis tool ^[6].
OpenAI has released GPT-5.6 (Sol, Terra, Luna) in a restricted preview, with stronger cybersecurity safeguards, as part of a limited rollout to select companies and in collaboration with the US government ^[2].

Sun, 22 Mar 2026 00:00:00 +0000

The Trivy vulnerability scanner was compromised in a supply chain attack attributed to the threat group TeamPCP. The attackers distributed credential-stealing malware via official Trivy releases and GitHub Actions, leading to the compromise of at least 47 npm packages with a self-spreading worm dubbed “CanisterWorm.”
A cyberattack on a car breathalyzer firm resulted in operational disruption, leaving drivers unable to start their vehicles due to system outages.
Iranian hackers conducted cyberattacks that disrupted medical care at hospitals in Maryland.

Oracle released patches addressing CVE-2026-21992, a critical unauthenticated remote code execution vulnerability in Oracle Identity Manager and Web Services Manager.
CISA added five vulnerabilities affecting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalogue, mandating patching by April 3, 2026.
A critical vulnerability in Quest KACE, tracked as CVE-2025-32975, has been identified and may have been exploited in attacks targeting the education sector.

Russian Intelligence Services-affiliated threat actors are conducting mass phishing campaigns targeting commercial messaging applications such as WhatsApp and Signal to compromise user accounts.
TeamPCP, the group behind the Trivy supply chain attack, is suspected of orchestrating follow-on attacks involving the deployment of infostealers and self-propagating malware across npm packages.
Iranian threat actors were responsible for cyberattacks that disrupted healthcare services in Maryland.

Microsoft Azure Monitor alerts are being abused in callback phishing campaigns, with attackers impersonating Microsoft Security Team notifications about unauthorized account charges to lure recipients.
The Trivy supply chain attack leveraged GitHub Actions to distribute infostealer malware, demonstrating continued threat actor interest in exploiting CI/CD pipelines and open-source distribution channels.
Google introduced “Advanced Flow” for Android, a new mechanism enabling more secure sideloading of APKs from unverified developers, aimed at enhancing security for power users.

The U.S. CISA has mandated the patching of vulnerabilities affecting Apple, Craft CMS, and Laravel Livewire by April 3, 2026, following their addition to the KEV catalogue.