Major Incidents or Breaches

  • Chainalysis reported scammers stole an estimated $17 billion in cryptocurrency in 2025, with AI-assisted scams accounting for a significant portion.
  • LastPass warned of an active phishing campaign impersonating the company, targeting users with fake maintenance messages to steal master passwords.
  • Researchers uncovered a campaign using LinkedIn messages to distribute remote access trojans (RATs) via DLL sideloading.
  • “CrashFix”/ClickFix scams use malicious browser extensions and social engineering to crash users’ browsers, leading to malware installation and RAT deployment.
  • Mass spam attacks are leveraging Zendesk instances to send suspicious emails; Zendesk confirmed there is no breach or vulnerability in their platform.
  • Google Gemini AI assistant was tricked via prompt injection attacks into leaking private Google Calendar data. Attackers weaponized calendar invites to exfiltrate event summaries.
  • Evelyn Stealer malware is targeting developers by abusing Microsoft Visual Studio Code extensions to steal credentials and cryptocurrency.
  • APT-grade PDFSider malware, used by ransomware groups, is being distributed via DLL sideloading and provides cyberespionage and remote code execution capabilities.

Newly Discovered Vulnerabilities

  • CERT/CC disclosed a vulnerability in the binary-parser npm library, allowing privilege-level code execution in Node.js via arbitrary JavaScript execution.
  • Three vulnerabilities were reported in Anthropic’s mcp-server-git (MCP Git Server), enabling file access, deletion, and remote code execution.
  • Cloudflare fixed a vulnerability in its ACME validation logic that allowed attackers to bypass WAF controls and access origin servers.
  • A critical vulnerability in the ACF Extended plugin for WordPress allows unauthenticated attackers to gain admin access on up to 50,000 sites.
  • Vulnerabilities in the Chainlit AI framework, including arbitrary file read and SSRF, could expose credentials and sensitive information without user interaction.

Notable Threat Actor Activity

  • North Korea-linked threat actors (Contagious Interview campaign) are targeting developers using malicious Visual Studio Code projects to deliver backdoors.
  • AI-generated VoidLink malware framework, showing high functionality and efficiency, is believed to have been developed with significant AI assistance.
  • A phishing campaign is using LinkedIn messages to propagate RAT malware via DLL sideloading.
  • Ransomware groups are employing the PDFSider malware for cyberespionage and remote code execution.

Trends, Tools, or Tactics of Interest

  • AI-assisted scams are increasingly effective, stealing 4.5 times more cryptocurrency than traditional scams.
  • Deepfake technology is being used to impersonate religious leaders in financial scams.
  • Attackers are exploiting orphan accounts left behind by former employees, contractors, or systems.
  • Leaked secrets in JavaScript bundles and exposed API keys remain prevalent, leading to breaches.
  • Use of Punycode and International Domain Names (IDNs) continues to be leveraged in phishing and impersonation attacks.
  • The VoidLink malware demonstrates a trend toward sophisticated, AI-generated malware frameworks.
  • Identity-based attacks remain a primary vector for network breaches, with increased emphasis on identity threat detection strategies.

Regulatory or Policy Developments Affecting the Security Industry

  • The European Commission proposed new cybersecurity legislation mandating the removal of high-risk (primarily foreign, including Chinese) suppliers from telecom networks, with 5G cybersecurity measures to become mandatory.
  • Google agreed to pay $8.25 million to settle allegations of illegally tracking children’s data via its AdMob platform without parental consent.
  • OpenAI is rolling out an age prediction model in ChatGPT to apply safety restrictions based on user age.