Major Incidents or Breaches

• Stryker, a medical technology company, suffered a cyberattack affecting its internal Microsoft environment. The attack remotely wiped tens of thousands of employee devices without deploying malware.
• Companies House, the UK’s company registry, confirmed a security flaw in its WebFiling service that exposed business data. The service was temporarily taken offline to address the issue.
• Hundreds of Python repositories were compromised in the GlassWorm campaign using stolen GitHub tokens, allowing attackers to inject malware into projects. The attack leveraged access to developer accounts obtained via previous campaigns.
• Hacked WordPress sites are delivering Vidar infostealer to Windows users via fake “verify you are human” prompts.
• A hacking attempt was reported at Poland’s nuclear research center, with initial evidence suggesting possible Iranian involvement, though attribution is unconfirmed.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Loblaw, a major Canadian retailer, suffered a data breach resulting in unauthorised access to customer personal information, including names, email addresses, and phone numbers.

Newly Discovered Vulnerabilities

• Google is testing a new security feature in Android 17 as part of Android Advanced Protection Mode (AAPM) that blocks non-accessibility apps from accessing the Accessibility API, aiming to prevent malware abuse of this functionality.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• The AppsFlyer Web SDK was hijacked in a supply-chain attack, with malicious JavaScript code injected to steal cryptocurrency from users. The attack was temporary but impacted the integrity of the SDK, potentially affecting numerous websites and their users.
• A hacker reportedly gained unauthorised access to FBI files related to the Epstein investigation. The breach was accidental but highlights the exposure of sensitive law enforcement data.
• A porn-quitting app exposed the personal habits of hundreds of thousands of users due to a data leak, revealing sensitive behavioural information.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Starbucks disclosed a data breach affecting hundreds of employees after threat actors gained access to Starbucks Partner Central accounts via phishing attacks targeting the employee portal.
• Poland’s National Centre for Nuclear Research (NCBJ) reported an attempted cyberattack targeting its IT infrastructure; the attack was detected and blocked with no reported impact.
• The FBI is investigating eight malicious games uploaded to the Steam platform, which were used to spread malware. The agency is seeking information from affected users.
• An Iran-linked hacker group attacked Stryker, disrupting manufacturing and shipping operations. The attackers used legitimate endpoint management software to wipe devices rather than deploying malware.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• England Hockey is investigating a potential data breach after the AiLock ransomware group listed the organisation as a victim on its leak site.
• Canadian retail giant Loblaw notified customers of a data breach, logging out all users from accounts as a precaution.
• Telus Digital confirmed a security incident following claims by threat actors of the theft of nearly 1 petabyte of data.
• The SocksEscort proxy botnet, which compromised over 369,000 IPs globally using AVRecon Linux malware, was dismantled in a coordinated law enforcement operation.
• Kroll was impersonated in a crypto wallet scam, with attackers leveraging the firm’s reputation to target victims.
• The US Department of Justice charged another ransomware negotiator for colluding with the BlackCat/ALPHV ransomware group.
• Meta disabled more than 150,000 accounts used to power scam centres in Asia and launched new protection tools across its platforms.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Stryker, a global medical technology company, was impacted by a wiper malware attack attributed to the Iran-linked Handala hacktivist group. The attackers claim to have wiped more than 200,000 devices, severely disrupting operations.
• Michelin confirmed a data breach linked to an Oracle EBS attack, with cybercriminals leaking over 300GB of allegedly stolen files.
• Bell Ambulance reported a data breach affecting 238,000 individuals, with stolen personal information including names, Social Security numbers, and driver’s license numbers.
• Meta disabled over 150,000 accounts associated with scam centers in Southeast Asia as part of a coordinated global crackdown, and reported the removal of 10.9 million Facebook and Instagram accounts linked to criminal scam centers in the past year.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Ericsson disclosed a data breach impacting thousands, attributed to a third-party vendor.
• A suspected breach of the FBI’s wiretap network is under investigation, with concerns about possible nation-state involvement via supply chain compromise.
• Salesforce confirmed that hundreds of customers have been targeted in a data theft campaign exploiting misconfigured instances.
• Signal and WhatsApp accounts have been targeted in a phishing campaign, with attackers tricking users into sharing verification codes or linking malicious devices.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Ericsson US Data Breach: Ericsson Inc. disclosed a data breach following a service provider hack, resulting in the theft of employee and customer data. The number of affected individuals has not been specified.

• UNC4899 Crypto Firm Compromise: The North Korean threat actor UNC4899 breached a cryptocurrency organization in 2025, leveraging an AirDropped, trojanized file to a developer’s work device, resulting in the theft of millions of dollars.

• Salesforce Experience Cloud Data Exposure: Salesforce warned customers of attacks exploiting misconfigured Experience Cloud platforms, allowing guest users to access sensitive data. The ShinyHunters group claims ongoing data theft attacks against Salesforce Aura.

• AkzoNobel Compromise: AkzoNobel, a Netherlands-based paint manufacturer, was listed among top attacks and breaches in Check Point’s latest threat intelligence report.

Major Incidents or Breaches

• Chinese threat actors have conducted a years-long campaign targeting critical infrastructure in South, Southeast, and East Asia. The campaign, which includes sectors such as aviation and energy, leveraged web server exploits and post-exploitation tools like Mimikatz for credential theft.

Newly Discovered Vulnerabilities

• The Cisco Catalyst SD-WAN vulnerability (CVE-2026-20127) is now being widely exploited in the wild, with WatchTowr observing exploitation attempts from numerous unique IP addresses.
• DumpBrowserSecrets, a new tool, can harvest browser credentials, cookies, OAuth tokens, and autofill data from multiple browsers (Chrome, Edge, Firefox, Opera, Vivaldi) by bypassing App-Bound Encryption through Early Bird APC injection.

Notable Threat Actor Activity

Major Incidents or Breaches

• Ransomware threat actors tracked as Velvet Tempest have been linked to breaches involving the Termite ransomware. They are utilising the ClickFix technique and legitimate Windows utilities to deploy DonutLoader malware and the CastleRAT backdoor.
• Over 100 GitHub repositories have been identified distributing the BoryptGrab stealer, which targets browser data, cryptocurrency wallets, system information, and user files.
• Leakbase, a cybercrime forum, was dismantled in an international law enforcement operation.

Notable Threat Actor Activity