Cybersecurity Brief – 2026-03-26

Thu, 26 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Russian law enforcement arrested the alleged administrator of LeakBase, a major stolen credential marketplace.
Personal data of hundreds of HackerOne employees was compromised in a large-scale breach targeting Navia.
A hacktivist group claims to have accessed sensitive data on millions of crime tipsters and those reported, with records dating back to 1987.
Device code phishing campaigns have targeted over 340 Microsoft 365 organizations across five countries, abusing OAuth for initial access.
Threat actors are leveraging the Bubble no-code app builder to create and host phishing sites targeting Microsoft account credentials.
Ongoing phishing campaigns have impersonated Palo Alto Networks recruiters since August, using LinkedIn-scraped data to defraud job candidates.

Citrix released patches for two NetScaler ADC and Gateway vulnerabilities, including one similar to previously exploited CitrixBleed flaws.
TP-Link patched critical authentication bypass and firmware upload vulnerabilities affecting Archer NX routers.
Attacks exploiting the ‘PolyShell’ vulnerability are targeting 56% of all vulnerable Magento Open Source and Adobe Commerce installations.
Apple released security updates addressing 85 vulnerabilities across iOS, macOS, and related products; none are currently exploited in the wild.

The GlassWorm malware campaign has evolved to use Solana blockchain “dead drops” for multi-stage delivery of a RAT and theft of browser and cryptocurrency data.
The new Torg Grabber infostealer targets 728 cryptocurrency wallets and over 850 browser extensions.
The SmartApeSG campaign is distributing multiple RATs, including Remcos, NetSupport, StealC, and Sectop RAT.
TeamPCP, in collaboration with Lapsus$, compromised open-source software ecosystems (Docker Hub, VS Code, PyPI, NPM) by targeting GitHub Action tags.
Paid AI service accounts are now being traded at scale on underground markets, bundled with other access commodities.
US courts sentenced Ilya Angelov (TA-551/Gold Cabin) to two years in prison for operating a botnet used in ransomware attacks. Aleksei Volkov received 81 months for facilitating Yanluowang ransomware intrusions.

AI is a central enabler in both attack and defense, with SANS listing all top five new attack techniques as AI-driven.
Anthropic reported a state-sponsored group used an AI agent to autonomously conduct cyber espionage against 30 global targets, with the AI performing 80-90% of the intrusion lifecycle.
AI-powered bug detection has been integrated into GitHub’s Code Security tool, expanding coverage beyond CodeQL.
Cloud virtual machines are increasingly presenting unmanaged security gaps as their adoption accelerates.
Cybercriminals are increasingly targeting identity systems, with AI amplifying both attack speed and the evolution of identity theft into a supply chain.
Kali Linux 2026.1 was released, adding eight new tools and a BackTrack mode for undercover operations.
The use of no-code/low-code platforms (e.g., Bubble) is being abused for phishing and evasion of traditional detection.
The Kaspersky Security Services report highlights increased sophistication in attack chains and the use of MDR/IR data to reveal evolving TTPs.

The US FCC has banned the sale of new consumer routers manufactured outside the US, citing national security risks.
At RSAC 2026, EU officials are leading discussions on cybersecurity challenges, while US officials are notably absent.
Apple extended security updates to older device generations, indicating ongoing regulatory and industry pressure for longer-term device support.