Major Incidents or Breaches

• Ukrainian government and healthcare organisations have been targeted in a data-theft malware campaign attributed to threat actor UAC-0247. The campaign utilised a new malware family, ‘AgingFly’, which steals authentication data from Chromium-based browsers and WhatsApp messenger.
• Over 30 WordPress plugins within the EssentialPlugin package have been compromised, allowing unauthorized access and malware deployment on thousands of websites.
• Digitally signed adware tools have been abused to deploy payloads with SYSTEM privileges, disabling antivirus protections on thousands of endpoints, including those in education, utilities, government, and healthcare sectors.
• A coordinated campaign involving 100 malicious Chrome extensions has been identified, stealing user data and establishing backdoors via shared command and control infrastructure.
• Sweden publicly attributed last year’s cyberattack on its energy infrastructure, specifically a heating plant, to a pro-Russian group.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Kraken Cryptocurrency Exchange Breach: Kraken confirmed a cybercrime group is attempting to extort the company by threatening to release videos showing internal systems hosting client data, following an insider breach.
• McGraw-Hill Data Breach: McGraw-Hill disclosed that hackers exploited a Salesforce misconfiguration to access internal data, following an extortion threat.
• Basic-Fit Data Breach: Europe’s largest gym chain, Basic-Fit, reported a breach affecting 1 million members, with stolen data including names, dates of birth, and bank account details.
• RCI Hospitality Data Breach: RCI Hospitality disclosed a breach due to an IDOR vulnerability in RCI Internet Services, exposing contractor data.
• Fake Ledger Live App on Apple’s App Store: A malicious Ledger Live app for macOS, distributed via Apple’s App Store, stole approximately $9.5 million in cryptocurrency from at least 50 victims.
• Malicious Chrome Extensions Campaign: Researchers identified over 100 malicious Chrome extensions in the official Chrome Web Store, stealing Google OAuth2 tokens, deploying backdoors, and carrying out ad fraud. The campaign affected at least 20,000 users, with data also exfiltrated from Google and Telegram accounts.

Newly Discovered Vulnerabilities

• Microsoft Patch Tuesday (April 2026): Microsoft released patches for 167 vulnerabilities, including two zero-days-one affecting SharePoint Server and another publicly disclosed flaw. Over half of the vulnerabilities were privilege escalation bugs.
• PHP Composer Vulnerabilities: Two high-severity flaws in PHP Composer could allow arbitrary command execution. Patches have been released.
• Adobe Vulnerabilities: Adobe issued patches for 55 vulnerabilities across 11 products, with critical ColdFusion vulnerabilities noted as especially at risk for exploitation.
• SAP Critical ABAP Vulnerability: SAP released 19 new security notes addressing flaws in over a dozen products, including a critical ABAP vulnerability.
• ICS Patch Tuesday: Eight major industrial vendors (Siemens, Schneider Electric, Aveva, Rockwell Automation, ABB, Phoenix Contact, Mitsubishi Electric, Moxa) published advisories and patches for newly identified vulnerabilities.
• Windows and Adobe Acrobat Exploited Vulnerabilities: Organizations were warned about actively exploited vulnerabilities in Windows and Adobe Acrobat that enable privilege escalation and remote code execution.
• Windows 10 and 11 Security Updates: Microsoft released cumulative and extended security updates (KB5082200, KB5083769, KB5082052) addressing vulnerabilities, including two zero-days.
• Google Pixel Rust-Based DNS Parser: Google integrated a Rust-based DNS parser into Pixel 10 modem firmware to mitigate memory safety vulnerabilities.

Notable Threat Actor Activity

• Mirax Android RAT: The Mirax remote access trojan has infected over 220,000 devices, primarily targeting Spanish-speaking countries via Meta platform ads. Compromised devices are being converted into SOCKS5 proxies.
• AI-Driven Pushpaganda Scam: A novel ad fraud scheme leverages AI-generated content and SEO poisoning to distribute scareware and perpetrate ad fraud via Google Discover.
• Triad Nexus Cybercrime Operation: Triad Nexus continues to evade international sanctions by abusing major infrastructure providers, complicating takedown efforts.
• Telegram Hosting Sanctioned Crypto Scam Market: Telegram is hosting Xinbi Guarantee, a sanctioned $21 billion crypto scam operation, despite UK government designations.
• Omnistealer Malware: Omnistealer is targeting password managers, saved logins, cloud storage, and crypto wallets, using blockchain-based techniques for data exfiltration.

Trends, Tools, or Tactics of Interest

• AI in Cybersecurity:
  • OpenAI launched GPT-5.4-Cyber, a model optimized for defensive cybersecurity applications, following Anthropic’s release of Mythos. Both models are driving increased focus on AI-powered cyber defense and accelerating the pace of vulnerability discovery and exploitation.
  • The Cloud Security Alliance (CSA) is urging CISOs to prepare for high-velocity cyberattacks enabled by advanced AI models.
  • KnowBe4 released Agent Risk Manager to address risks from autonomous AI agents.
  • Increased scanning activity targeting AI models (e.g., Claude, OpenClaw, HuggingFace) has been observed since March 2026.
• EDR-Killer Ecosystem Expansion: Threat actors are increasingly using bring-your-own-vulnerable-driver (BYOVD) techniques to bypass endpoint detection and response (EDR) solutions, necessitating stronger defensive measures.
• Zero Trust Adoption: Stolen credentials remain a primary breach vector, with identity-first Zero Trust approaches being highlighted for their effectiveness in limiting privilege escalation and lateral movement.
• Social Media Manipulation: Simulated wargame exercises are demonstrating the effectiveness of bot-driven influence campaigns in manipulating public opinion and elections.
• Memory-Safe Programming: Google’s adoption of Rust for DNS parsing in Pixel devices reflects a growing industry trend toward memory-safe programming languages for security-critical components.

Regulatory or Policy Developments

• UK Sanctions on Crypto Scammers: The UK government designated Xinbi Guarantee as a sanctioned enabler of crypto scams and human trafficking, but enforcement is hindered by continued operation on Telegram.
• Microsoft’s Investment in Japan: Microsoft announced a $10 billion investment to accelerate AI adoption, workforce training, and cybersecurity partnerships in Japan.
• CSA Guidance on AI Threats: The Cloud Security Alliance is advising CISOs to prepare for the accelerated threat landscape resulting from advanced AI models like Mythos.
• Microsoft Hardware Developer Account Policy: Microsoft introduced a fast-track reinstatement process for Windows Hardware Program developer accounts following widespread suspensions.

Major Incidents or Breaches

• Basic-Fit, a major European gym chain, disclosed a data breach affecting one million customers, with hackers accessing personal information.
• Booking.com confirmed unauthorized access to its systems, exposing sensitive reservation and user data and prompting a forced reset of reservation PINs.
• Rockstar Games suffered a data breach involving analytics data, attributed to the ShinyHunters extortion gang, following a security incident at analytics provider Anodot.
• CPUID, developer of CPU-Z and HWMonitor, was compromised, leading to the distribution of trojanized installers (STX RAT) via modified download links.
• OpenAI rotated macOS code-signing certificates following a supply chain attack involving a malicious Axios package executed in a GitHub Actions workflow; the incident is linked to North Korea.
• The Los Angeles Police Department reported a data breach, as highlighted in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• OpenAI revoked its macOS app certificate after discovering that a GitHub Actions workflow used to sign its macOS apps had downloaded a malicious version of the Axios library on March 31. OpenAI stated that no user data or internal systems were compromised as a result of this supply chain incident.

Newly Discovered Vulnerabilities

• A critical pre-authentication remote code execution (RCE) vulnerability in Marimo is now under active exploitation. Attackers are leveraging this flaw to steal credentials.

Major Incidents or Breaches

• CPUID, the official distributor of CPU-Z, HWMonitor, and related hardware monitoring tools, was compromised for less than 24 hours. During the breach, unknown threat actors trojanized legitimate software downloads with the STX Remote Access Trojan (RAT).
• An international law enforcement operation led by the UK National Crime Agency identified over 20,000 victims of cryptocurrency fraud across the UK, United States, and Canada.

Newly Discovered Vulnerabilities

• Adobe released emergency security updates for Acrobat Reader to address CVE-2026-34621, a critical vulnerability that has been under active exploitation for months. The flaw allows for arbitrary code execution.

Notable Threat Actor Activity

Major Incidents or Breaches

• CPUID suffered a supply chain attack where hackers altered download links for CPU-Z and HWMonitor, serving malicious executables via the official website.
• Telehealth company Hims experienced a breach, exposing highly sensitive personal health information (PHI) of users.
• Medical technology firm Stryker was impacted by a cyberattack.
• Microsoft reported that the financially motivated threat actor Storm-2755 targeted Canadian employees in payroll hijacking attacks.
• Nearly 4,000 US industrial devices, including PLCs, have been identified as exposed to Iranian-linked cyberattacks targeting critical infrastructure.
• Fake websites impersonating Claude AI were found distributing PlugX malware, providing attackers remote access to victim systems.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Eurail Data Breach: Eurail B.V. confirmed a December 2025 breach affecting over 300,000 individuals. Attackers accessed names, passport numbers, and other personal information from the European travel operator’s systems.
• ChipSoft Ransomware Attack: Dutch healthcare IT provider ChipSoft suffered a ransomware attack, leading to the shutdown of its website and digital services used by patients and healthcare providers.
• Smart Slider 3 Pro Supply Chain Attack: Unknown threat actors compromised Nextend’s update servers to distribute a backdoored version of the Smart Slider 3 Pro plugin for WordPress and Joomla, impacting users who downloaded updates during the attack window.
• MyLovely.AI Data Leak: The NSFW app MyLovely.AI exposed over 70,000 user prompts and explicit images, affecting more than 100,000 users and increasing risks of sextortion and doxxing.
• Meta Employee Data Misuse: A Meta employee allegedly downloaded 30,000 private Facebook images using a custom script designed to evade internal detection, raising concerns about insider threats.

Newly Discovered Vulnerabilities

• Adobe Reader Zero-Day: A zero-day vulnerability in Adobe Reader has been actively exploited via malicious PDF documents since at least December 2025. The flaw remains unpatched and is being leveraged in the wild.
• EngageLab SDK Flaw (Android): A now-patched vulnerability in the EngageLab SDK, used by over 50 million Android users (including 30 million crypto wallet app installs), exposed users to potential data theft. The flaw was reported by Microsoft and has since been addressed.
• ‘BlueHammer’ Windows Zero-Day: A researcher under the alias ‘Chaotic Eclipse’ released a proof-of-concept exploit for a Windows zero-day (dubbed ‘BlueHammer’) that enables local privilege escalation and system takeover. The researcher cited dissatisfaction with Microsoft’s bug disclosure handling.
• Palo Alto Networks and SonicWall Vulnerabilities: Both vendors patched high-severity vulnerabilities that could allow attackers to modify protected resources or escalate privileges to administrator level.
• Google API Key Exposure in Android Apps: Researchers found that dozens of Android apps exposed hardcoded Google API keys, allowing unauthorised access to Gemini endpoints.

Notable Threat Actor Activity

• ClipBanker Malware Campaign: Threat actors are distributing a trojanised version of Proxifier software, initiating a multi-stage infection chain leading to ClipBanker malware deployment. ClipBanker replaces copied cryptocurrency wallet addresses to steal funds.
• VENOM Phishing-as-a-Service Platform: A newly identified PhaaS platform, VENOM, is being used to target C-suite executives across industries, aiming to steal Microsoft credentials via sophisticated phishing campaigns.
• Palo Alto Networks Recruitment Phishing: Attackers are impersonating Palo Alto Networks recruiters in spear-phishing campaigns targeting senior job seekers, as reported by the company’s Unit 42 team.
• UAT-10362 and LucidRook Malware: A previously undocumented threat cluster, UAT-10362, has been attributed to spear-phishing campaigns against Taiwanese NGOs and universities, deploying a new Lua-based malware named LucidRook.
• Bitter-Linked Hack-for-Hire Campaign: A hack-for-hire group with suspected links to India targeted journalists, activists, and government officials across the Middle East and North Africa.
• Google Warns of BPO-Targeted Campaigns: Google has identified campaigns by threat actor UNC6783 (linked to “Mr. Raccoon”) targeting business process outsourcing (BPO) firms to steal corporate data.
• Fancy Bear (APT28) Ongoing Activity: Russia-linked APT28 (Fancy Bear) continues global operations, targeting organisations with a focus on exploiting unpatched systems.
• Fake Windows Support Site: Attackers are using convincing Microsoft lookalike websites to deliver password-stealing malware to unsuspecting users.
• Amazon Support Scams: A new wave of phishing campaigns is impersonating Amazon support to steal user account credentials via email and SMS.

Trends, Tools, or Tactics of Interest

• AI-Driven Phishing: Attackers are leveraging AI to automate and personalise phishing campaigns, increasing their scale and effectiveness.
• Shadow AI Risks in Enterprises: The unsanctioned adoption of AI tools by employees without IT oversight is introducing new security risks, including data leakage and unauthorised access.
• Session Cookie Theft Mitigations: Google Chrome 146 for Windows introduces Device Bound Session Credentials (DBSC), cryptographically binding session cookies to devices to prevent infostealer malware from reusing stolen cookies.
• MFA Bypass Techniques: Attackers are increasingly targeting authentication systems by leveraging stolen credentials and session tokens, highlighting limitations of traditional MFA and the need for session-aware authentication.
• Obfuscated JavaScript in Phishing: Recent campaigns have used highly obfuscated JavaScript payloads delivered via phishing emails and compressed archives to evade detection.
• Supply Chain Attacks on Plugin Updates: The Smart Slider 3 Pro incident underscores ongoing risks to software supply chains, particularly through compromised update mechanisms.

Regulatory or Policy Developments Affecting the Security Industry

• Increased Political Campaign Security Spend: Political candidates are investing more heavily in personal and campaign security measures in response to heightened threats and targeted attacks.

Major Incidents or Breaches

• Bitcoin Depot Hack

  • Bitcoin Depot, a major Bitcoin ATM operator, reported a breach in which attackers stole approximately $3.665 million from its crypto wallets. Attackers gained access to credentials and transferred over 50 bitcoins out of company wallets.

• Massachusetts Hospital Cyberattack

  • Signature Healthcare in Massachusetts experienced a cyberattack that forced ambulance diversions, cancellation of some services, and disruption of pharmacy operations.

• Zendesk Ticket Theft by UNC6783

  • Threat actor UNC6783 compromised business process outsourcing (BPO) providers to steal corporate Zendesk support tickets from high-value companies across multiple sectors.

• Magento E-commerce Card Skimming Campaign

  • Nearly 100 online stores running the Magento platform were impacted by a campaign embedding credit card-stealing code within a pixel-sized SVG image.

• TeamPCP Supply Chain Attack Update

  • TeamPCP supply chain campaign update reveals Cisco source code was stolen via a breach linked to the Trivy security scanner. Google GTIG tracks the group as UNC6780.

Major Incidents or Breaches

• Massachusetts Hospital Cyberattack

  • Signature Healthcare in Massachusetts experienced a cyberattack resulting in ambulance diversions, cancellation of some services, and pharmacy disruptions.

• Snowflake SaaS Integrator Breach

  • Over a dozen companies suffered data theft attacks after a SaaS integration provider was breached, with attackers stealing authentication tokens.

• Router Hijacking and Espionage by APT28

  • The Russia-linked APT28 (Forest Blizzard) compromised MikroTik and TP-Link routers globally, hijacking DNS settings to steal Microsoft 365 and Office authentication tokens.
  • An international law enforcement operation disrupted the “FrostArmada” APT28 campaign.

• Critical Infrastructure Attacks by Iran-Linked Actors

  • Iran-affiliated threat actors targeted internet-exposed programmable logic controllers (PLCs) and SCADA systems in US critical infrastructure sectors, causing operational disruptions.

• Doxing, Spyware, and Nonconsensual Abuse

  • Widespread abuse in Telegram groups, where individuals are purchasing hacking tools, sharing nonconsensual images, and engaging in doxing and spyware deployment.

Major Incidents or Breaches

• Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
• Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
• Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
• Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
• The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Newly Discovered Vulnerabilities