Major Incidents or Breaches

• The Windows version of Hola Browser was compromised in a supply chain attack, resulting in the delivery of an undeclared cryptocurrency miner to users ^[15].
• DentaQuest, a dental benefits administrator, suffered a data breach exposing sensitive information of 2.6 million accounts ^[17].
• The United Nations World Food Programme disclosed a breach of its self-registration application for Palestine, affecting 600,000 Gaza households ^[18].
• Nightclub operator RCI reported a data breach after detecting a network intrusion in March, with files containing information on 40,000 individuals stolen ^[32].
• Unknown attackers maintained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange for at least five months, exfiltrating inbox data in small batches ^[12].
• Meta’s AI support bot was manipulated by attackers to hand over control of Instagram accounts by changing recovery email addresses ^[42].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• IMA Diligence Services suffered a data breach impacting 525,000 individuals, with personal information stolen from a legacy server managed by a third party ^[43].
• A global stock exchange was compromised through a months-long email campaign, granting attackers access to a senior executive’s inbox for 150 days and enabling prolonged data exfiltration ^[31][42].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A large-scale malware campaign named WeedHack has infected over 116,000 Minecraft systems since January, targeting users via YouTube links to malware capable of system takeover. The campaign leverages malware-as-a-service infrastructure and has also facilitated the spread of cryptocurrency miners and other payloads through pirated content^[3][14].
• Multiple Instagram accounts were hijacked after attackers exploited Meta’s AI-powered support tools, convincing them to reassign account ownership by linking accounts to attacker-controlled email addresses^[17][33].
• 23andMe is facing a lawsuit alleging that the genetic information of nearly seven million users was exposed following the compromise of user credentials^[36].
• A supply chain attack targeted 32 Red Hat NPM packages, with 96 malicious package versions published. The packages were injected with a credential-stealing worm similar to Mini Shai-Hulud^[34].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Dashlane, a password manager, disclosed a brute-force attack resulting in the download of encrypted vaults for fewer than 20 personal users. Affected accounts were automatically locked to prevent further compromise. Users also reported account lockouts due to login attempts from unfamiliar locations and devices ^[3][12][30].
• Over 30 npm packages under Red Hat’s @redhat-cloud-services namespace were compromised in a supply chain attack dubbed “Miasma,” distributing a variant of the Shai-Hulud malware to steal developer credentials and secrets ^[4][10].
• A malicious supply chain campaign targeted developers using OpenAI Codex via a fraudulent npm package, codexui-android, which was designed to steal authentication tokens ^[8].
• Dutch police dismantled a botnet comprising 17 million devices that was used as a residential proxy network and facilitated various cybercrimes ^[33].
• Nearly 2,000 WordPress websites were infected with malware that uses Steam Community profile comments to hide command-and-control data ^[13].
• A fake BlueWallet application targeting Mac users was observed stealing passwords, crypto wallet information, and clipboard data ^[40].
• Threat actor DriveSurge hijacked thousands of websites to distribute malware via ClickFix and FakeUpdate campaigns ^[9].
• The Spanish National Police arrested an individual responsible for leaking sensitive data of government employees, including those from the National Cybersecurity Institute (INCIBE) ^[11].
• The Instagram accounts of high-profile individuals and organisations were compromised via Meta’s AI support bot, allowing attackers to seize and deface accounts with pro-Iranian content ^[27].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Dutch authorities dismantled a botnet comprising approximately 17 million infected devices, including computers, tablets, smartphones, and IoT devices, which had been used to conduct malicious attacks ^[1].
• Attackers are actively exploiting a vulnerability in the WP Maps Pro plugin for WordPress, enabling unauthenticated creation of rogue administrator accounts on affected websites ^[2].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Palo Alto Networks confirmed that threat actors are actively exploiting a PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2024-3400), targeting corporate networks to gain unauthorised access ^[1].
• A cybercrime group has claimed responsibility for hacking Mike Lindell’s MyPillow, though further details on the breach are limited ^[5].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Charter Communications suffered a data breach affecting 4.9 million accounts, with the ShinyHunters extortion group responsible for stealing and leaking personal information from the US telecom giant in early April ^[16][25].
• Dutch authorities disrupted a malware botnet comprising 17 million infected devices and seized over 200 servers supporting the operation ^[12].
• 23andMe, now Chrome Holding Co., is facing a lawsuit from the California Attorney General over a 2023 breach that exposed sensitive customer genetic and personal information ^[10][28].
• Trump Mobile reportedly exposed customer data in a recent breach ^[24].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Charter Communications suffered a data breach impacting 4.9 million accounts, with the ShinyHunters extortion group claiming responsibility for stealing personal information in early April ^[10].
• Carnival Corporation confirmed a data breach affecting nearly 6 million people, also attributed to the ShinyHunters group, with exposed data including personal details of customers ^[20][34][42].
• Customer data from more than 350 hotels worldwide was accessed as part of reservation-hijacking spear-phishing scams, enabling realistic phishing attacks against hotel guests ^[29].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The GlassWorm malware botnet, which targeted developers via software supply-chain attacks and relied on resilient command-and-control infrastructure using the Solana blockchain, has been disrupted through a coordinated takedown by CrowdStrike, Google, and the Shadowserver Foundation. All C2 channels associated with GlassWorm were taken down^[11][16][37].
• The FBI has issued a warning that the Silent Ransom Group (SRG) extortion gang is targeting US-based law firms with in-person data theft attacks, involving physical intrusion and social engineering to gain access to sensitive data^[17][21].
• A 35-year-old suspect was arrested by Dutch police in connection with the hacking of the professional football club Ajax Amsterdam earlier this year^[19].
• A data breach in Uruguay has reportedly exposed 5.8 million records of citizens, attributed to cybercriminals targeting government agencies to monetize citizen data^[22].
• The LA Metro cyberattack has been linked to Iranian state-sponsored hackers, despite claims of responsibility by a hacktivist group. Forensic analysis showed the use of infrastructure tied to the Iranian government^[38].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Charter Communications confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid ^[13].
• Information allegedly stolen from 7-Eleven has been leaked, impacting approximately 185,000 individuals and exposing email addresses, names, addresses, and dates of birth ^[33].
• Over 5,500 GitHub repositories were compromised in a campaign using Megalodon malware, resulting in theft of credentials and developer secrets ^[18].
• More than 700 education and tech websites were hijacked in a large-scale ClickFix malware campaign, exploiting a Ghost CMS flaw to serve malicious Cloudflare verification pages ^[40].

Newly Discovered Vulnerabilities