Major Incidents or Breaches

  • The U.S. FBI seized the ‘web3adspanels.org’ domain and its database, which were used by cybercriminals to host and distribute stolen bank login credentials obtained in account takeover attacks targeting U.S. victims.
  • The French national postal service, La Poste, experienced a Distributed Denial-of-Service (DDoS) attack that knocked central computer systems offline. Pro-Russian hacker groups have claimed responsibility.
  • The U.S. Securities and Exchange Commission (SEC) filed charges against multiple companies involved in a cryptocurrency scam that used fake AI-themed investment tips to defraud victims of over $14 million.
  • ESET reported a 62% surge in the Nomani investment scam, which now leverages AI-generated deepfake advertisements and has expanded distribution beyond Facebook to other social media platforms.

Newly Discovered Vulnerabilities

  • MongoDB issued an urgent advisory for IT administrators to patch a high-severity remote code execution (RCE) vulnerability affecting its servers.

Notable Threat Actor Activity

  • Researchers identified a new variant of the macOS information stealer “MacSync,” which is distributed via a digitally signed and notarized Swift application designed to bypass Apple Gatekeeper protections.
  • A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was found distributing malicious PowerShell scripts, leading to Windows infections with the ‘Cosmali Loader’ malware.

Trends, Tools, or Tactics of Interest

  • The Nomani investment scam’s increased use of AI-generated deepfake content and expanded social media targeting reflects a trend toward more sophisticated and widespread social engineering campaigns.
  • Attackers are leveraging digitally signed and notarized applications on macOS to circumvent built-in security controls, as demonstrated by the new MacSync stealer variant.
  • The use of typosquatted domains to distribute malware via widely recognized tools continues to be a prevalent tactic.

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft announced that Teams administrators will soon have the ability to block external users from sending messages, calls, or meeting invitations via the Microsoft Defender portal, enhancing organizational control over external communications.