Major Incidents or Breaches

  • Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
  • SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
  • Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
  • Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
  • Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
  • Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Newly Discovered Vulnerabilities

  • Microsoft released emergency out-of-band patches for Office zero-day vulnerability CVE-2026-21509, which is actively exploited to bypass security features through malicious Office files.
  • Fortinet patched a critical authentication bypass vulnerability in FortiOS/FortiCloud SSO (CVE-2026-24858) after reports of active exploitation in the wild.
  • A critical remote code execution vulnerability has been disclosed in Grist-Core, an open-source spreadsheet-database platform, exploitable via spreadsheet formulas.
  • A critical sandbox escape flaw (CVE-2026-22709) was found in the vm2 Node.js library, allowing arbitrary code execution on host systems.
  • OpenSSL patched 12 vulnerabilities, including a high-severity remote code execution flaw.
  • ‘PackageGate’ vulnerabilities in the JavaScript ecosystem allow bypassing NPM supply chain attack protections, leading to arbitrary code execution.
  • A critical Telnet server flaw exposes legacy and IoT systems to unauthenticated remote access and shell control.
  • Linux vulnerabilities are being actively exploited, enabling attackers to obtain root privileges or bypass authentication via Telnet.

Notable Threat Actor Activity

  • The HoneyMyte (aka Mustang Panda/Bronze President) APT group has updated its CoolClient backdoor and is deploying multiple infostealers, including three browser data stealer variants and clipboard monitoring tools, in recent campaigns.
  • China-aligned APT actors have been using a JScript-based command-and-control (C2) framework called PeckBirdy since 2023 to target multiple environments.
  • Pakistan-linked threat actors have conducted two cyber campaigns against Indian government entities using previously undocumented techniques.
  • The ShinyHunters group is running a large-scale phishing campaign targeting over 100 organizations with credential harvesting domains.
  • The World Leaks ransomware/extortion group claims responsibility for the Nike data breach and has published stolen data to pressure the victim.
  • Multiple threat actors continue to exploit the WinRAR CVE-2025-8088 vulnerability for initial access and malware deployment.
  • The ‘Stanley’ malware-as-a-service toolkit enables malicious Chrome extensions to overlay phishing content on legitimate websites without altering the visible URL.
  • A new ransomware strain, ‘Sicarii’, has emerged, featuring poor code quality and a possible false-flag Hebrew identity, and currently cannot be decrypted.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly weaponizing trusted Remote Monitoring and Management (RMM) tools to establish persistent backdoor access in victim networks.
  • Recent phishing campaigns are leveraging fake CAPTCHAs, Microsoft App-V scripts, and trusted web services to distribute infostealers (ClickFix-style attacks).
  • Modern ransomware operations are shifting from pure encryption to psychological extortion, leveraging stolen data and exposure threats to increase pressure on victims.
  • AI-generated data degradation (“model collapse”) is raising concerns about accuracy, malicious activity propagation, and PII protection in zero-trust environments.
  • Browser extensions are being used as undetectable phishing vectors, with malicious overlays on legitimate sites while maintaining the original URL.
  • Supply chain vulnerabilities in JavaScript/NPM environments remain a critical risk, with new bypass techniques emerging.
  • The exposure and exploitation of legacy protocols such as Telnet continue to present significant attack surfaces, especially in IoT and OT environments.

Regulatory or Policy Developments Affecting the Security Industry

  • Meta (WhatsApp) has introduced a ‘Strict Account Settings’ security mode to protect high-risk users from spyware and advanced cyber attacks, similar to Apple’s Lockdown Mode.
  • Criticism has been raised regarding MITRE’s management of the CVE vulnerability database, with calls to transfer oversight to the private sector for improved efficiency.
  • TikTok has narrowly avoided a US ban by forming a new American joint venture, impacting data governance and regulatory oversight for the platform in the US.