Major Incidents or Breaches

  • WhatsApp accounts are being targeted by a phishing campaign attempting to trick users into linking malicious devices, potentially resulting in account compromise.
  • A WhatsApp worm is distributing the Astaroth banking trojan in Brazil via auto-messaging to contacts, facilitating rapid malware propagation and credential theft.
  • Fake AI-powered Chrome extensions, mimicking legitimate tools, have stolen data from approximately 900,000 users, harvesting ChatGPT and DeepSeek credentials.
  • The Kimwolf botnet has rapidly infected over two million devices, primarily by compromising unofficial Android TV streaming boxes.
  • Microsoft Exchange Online experienced an outage affecting mailbox access via IMAP4.
  • Researchers demonstrated remote hacking risks in WHILL wheelchairs due to unauthenticated Bluetooth access, enabling unauthorized device movement.

Newly Discovered Vulnerabilities

  • HPE OneView: A maximum-severity, unauthenticated remote code execution vulnerability (CVE-2025-37164) is being actively exploited in the wild.
  • n8n: A critical vulnerability (CVE-2026-21858, CVSS 10) allows unauthenticated remote code execution, exposing self-hosted automation instances to takeover.
  • jsPDF: A critical vulnerability has been patched that allowed attackers to read arbitrary files from the system, risking credential and configuration exposure.
  • Coolify: Eleven critical security flaws have been disclosed in this open-source self-hosting platform, including authentication bypass and remote code execution.
  • Cisco Identity Services Engine (ISE): A medium-severity flaw with public proof-of-concept exploit code has been patched; exploitation requires administrative access.
  • VMware ESXi: Zero-day vulnerabilities were reportedly exploited by Chinese-speaking threat actors up to a year before public disclosure, with initial access via a compromised SonicWall VPN.
  • Cisco Switches: Multiple models are experiencing reboot loops due to a DNS client bug, causing operational disruptions.

Notable Threat Actor Activity

  • North Korean state-sponsored group Kimsuky is leveraging malicious QR codes in spear-phishing campaigns targeting US organizations.
  • China-linked UAT-7290 has been attributed to espionage intrusions targeting telecommunications providers in South Asia and Southeastern Europe, using Linux malware and edge device exploits.
  • Threat actors distributed the NodeCordRAT malware via three malicious npm Bitcoin-themed packages, targeting developers and users in the cryptocurrency space.
  • Fake WinRAR installers are distributing Winzipper malware, using a legitimate installer to mask malicious activity.

Trends, Tools, or Tactics of Interest

  • Increased use of QR codes in phishing, as seen in North Korean campaigns, indicating evolving social engineering tactics.
  • Credential stuffing remains a prevalent threat, driven by widespread password reuse.
  • Attackers are leveraging open-source supply chains, as evidenced by malicious npm packages and vulnerabilities in platforms like Coolify and n8n.
  • Rapid propagation of malware via messaging platforms (e.g., WhatsApp worm spreading Astaroth).
  • AI and automation are driving new attack trends, including prompt injection exploits targeting ChatGPT’s memory feature (“ZombieAgent” exploit).
  • Cloud and SaaS security remain under pressure, with attackers exploiting misconfigurations and vulnerabilities in widely used platforms.

Regulatory or Policy Developments Affecting the Security Industry

  • The UK government has unveiled a new cyber action plan focused solely on governmental operations, with no guidance for the private sector or critical national infrastructure.
  • The US Cybersecurity and Infrastructure Security Agency (CISA) retired 10 emergency directives, citing completion or incorporation of required actions into standard practice.
  • Microsoft will enforce multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center starting next month.