Major Incidents or Breaches

• Multiple popular npm JavaScript packages, collectively exceeding two billion weekly downloads, were compromised in a supply chain attack after a maintainer’s account was accessed via phishing. At least 18–20 high-profile packages were affected, with attackers injecting malicious code to steal cryptocurrency and other sensitive data.
• Salesloft experienced a breach beginning with the compromise of its GitHub account in March. Attackers stole Drift OAuth tokens, which were later used in widespread attacks targeting Salesforce instances in August, impacting at least 22 companies, including major cybersecurity firms such as BeyondTrust, Bugcrowd, CyberArk, Cato Networks, JFrog, and Rubrik.
• A new supply chain attack, dubbed ‘GhostAction’, targeted GitHub workflows, leading to the theft of 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys. Hundreds of repositories were affected.
• Plex, a media streaming platform, suffered a data breach in which a hacker accessed customer authentication data. Customers have been advised to reset their passwords.
• Lovesac, a US-based furniture company, confirmed a data breach following ransomware attack claims, with exposure of personal data for an undisclosed number of individuals.
• Wealthsimple, a Canadian fintech firm, reported a data breach resulting from a supply chain attack, impacting some customer information but not compromising accounts or funds.
• In the second phase of the Nx supply chain attack, over 6,700 private repositories from hundreds of organizations were made public.
• iCloud Calendar infrastructure was abused in a phishing campaign targeting PayPal users, leveraging Apple and Microsoft services to send legitimate-seeming call-back phishing emails.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• iCloud Calendar invites are being abused to deliver callback phishing emails that appear as purchase notifications. These emails are sent directly from Apple’s own servers, increasing the likelihood of bypassing spam filters and being delivered to users’ inboxes.

Notable Threat Actor Activity

• Threat actors are leveraging Apple’s legitimate iCloud Calendar infrastructure to distribute phishing messages, exploiting the trust and deliverability associated with Apple’s email servers.

Regulatory or Policy Developments Affecting the Security Industry

Major Incidents or Breaches

• The “s1ngularity” NPM supply chain attack has compromised 2,180 GitHub accounts, resulting in the leakage of account tokens and repository secrets. The attack leveraged AI-powered malware to automate the compromise and exfiltration process.
• VirusTotal has identified a phishing campaign leveraging SVG files to impersonate Colombia’s judicial system. The campaign delivers hidden malware through convincing portal interfaces embedded within the SVG files.

Notable Threat Actor Activity

• A threat actor, potentially of Russian origin and tracked as “Noisy Bear,” has been linked to Operation BarrelFire, a phishing campaign targeting the energy sector in Kazakhstan. The activity involves tailored phishing lures and custom malware payloads.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Wealthsimple, a Canadian online investment management service, disclosed a data breach involving the theft of personal data from an undisclosed number of customers.
• Multiple cybersecurity firms, including Proofpoint, SpyCloud, Tanium, and Tenable, were affected by a breach involving their Salesforce instances, with attackers accessing stored information.
• Nexar’s dashcam video database was compromised, exposing video recordings from vehicle-mounted cameras.
• The City of Baltimore was reported to have sent $1.5 million to a scammer in a cyber fraud incident.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• PowerSchool Data Breach: Texas Attorney General filed a lawsuit against PowerSchool following a December breach that exposed the personal information of 62 million students, including 880,000 Texans.
• Chess.com Data Breach: Chess.com disclosed a breach after threat actors accessed a third-party file transfer application, compromising user data.
• Bridgestone Cyberattack: Bridgestone confirmed a cyberattack affecting manufacturing operations in North America; details of the attack vector remain under investigation.
• Wytec Website Hack: Wytec’s website was defaced twice by unknown actors and remains offline, with the company anticipating significant financial losses.
• Salesloft Drift Supply Chain Attack: Multiple high-profile customers reported data breaches linked to a recent supply chain attack involving Salesloft Drift, though the full impact is still unclear.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Jaguar Land Rover experienced a severe cyberattack, forcing the disconnection of systems and causing significant disruption to both retail and manufacturing operations.
• Workiva, a major SaaS provider, disclosed a data breach after attackers accessed customer data via a compromised third-party Salesforce CRM system.
• Multiple security firms, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a breach involving Salesforce, Salesloft, and Drift, resulting in the exposure of customer contact information and case data.
• The Pennsylvania Attorney General’s office confirmed a ransomware attack that caused weeks-long outages of email, phone, and web services. No ransom was paid.
• Wiz Research reported a data leak at Chinese AI company DeepSeek, exposing over 1 million sensitive log streams.
• The US Department of Justice filed a lawsuit against Apitor Technology for exposing children’s geolocation data to a Chinese third party without consent.
• Disney agreed to pay $10 million to settle US FTC claims regarding the improper collection of children’s data on YouTube.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Salesloft Drift Supply Chain Attack: Multiple organizations, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a supply chain attack stemming from the compromise of OAuth tokens via Salesloft Drift, a marketing SaaS application. Attackers leveraged the compromised tokens to access Salesforce instances, exposing customer data and support cases.
• Jaguar Land Rover Cyberattack: Jaguar Land Rover reported a cyberattack that severely disrupted production and required the shutdown of certain systems.
• Evertec/Sinqia Attempted Bank Heist: Hackers breached Sinqia S.A., the Brazilian subsidiary of fintech firm Evertec, and attempted to steal $130 million via unauthorized access to the central bank’s Pix real-time payment system.
• Pennsylvania Attorney General’s Office Ransomware Attack: The Pennsylvania AG’s office confirmed a ransomware attack responsible for a two-week service outage.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Zscaler experienced a data breach after threat actors accessed its Salesforce instance via compromised third-party platforms (Salesloft and Drift), resulting in the exposure of customer information, including support case contents.
• The breach at AI chatbot maker Salesloft continues to have repercussions, with mass theft of authentication tokens affecting numerous organisations that integrate Salesloft with Salesforce.
• Amazon researchers disrupted an operation by Russian state-sponsored threat group Midnight Blizzard (APT29), who were targeting Microsoft 365 accounts and data.
• American consumer credit reporting agency TransUnion was listed among the week’s top attacks and breaches.

Newly Discovered Vulnerabilities

Newly Discovered Vulnerabilities

• Wireshark 4.4.9 has been released, addressing five bugs. No CVEs or critical vulnerabilities were specified in the release notes.
• A bug was reported in the pdf-parser tool causing errors when dumping all filtered streams. This issue could impact the reliability of forensic or malware analysis workflows relying on the tool.

Trends, Tools, or Tactics of Interest

• OpenAI is testing a “Thinking effort” picker for ChatGPT, allowing users to select the level of reasoning or computational effort applied to responses. This may have future implications for AI-driven security automation and analysis tools.

Major Incidents or Breaches

• TransUnion Data Breach: TransUnion disclosed a data breach affecting 4.4 million US consumers. The incident stemmed from a compromise of a third-party application used for consumer support operations.
• Nevada Ransomware Attack: The State of Nevada confirmed a ransomware incident that led to widespread service disruptions, office closures, and data theft. The state is collaborating with CISA and law enforcement to restore services.
• Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise involved in the Salesforce–Salesloft Drift data theft campaign also allowed unauthorized access to a small number of Google Workspace accounts.
• VerifTools Fake ID Marketplace Seized: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents enabling bypass of KYC checks and access to online accounts. Operators relaunched the service on a new domain shortly after the seizure.
• Iranian Ships Hacked: Communications of dozens of Iranian ships were disrupted in a targeted cyberattack.
• TamperedChef Infostealer Campaign: Threat actors distributed the TamperedChef infostealer via fraudulent PDF editor websites promoted through Google ads.
• Sogou Zhuyin Update Server Hijacked: An abandoned update server for the Sogou Zhuyin IME was hijacked and used to deliver multiple malware families in an espionage campaign targeting Taiwan.

Newly Discovered Vulnerabilities