Major Incidents or Breaches

  • The Conduent data breach has impacted at least 25 million individuals, including nearly 17,000 Volvo Group employees whose data was exposed.
  • The AgreeTo Outlook add-in was hijacked and used as a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials.
  • A surge in LummaStealer infections has been reported, linked to campaigns using the CastleLoader malware and the ClickFix social engineering technique.

Newly Discovered Vulnerabilities

  • Apple released updates for all platforms (iOS, iPadOS, macOS, tvOS, watchOS, visionOS), addressing 71 vulnerabilities, including a zero-day exploited in sophisticated attacks against targeted individuals.
  • Microsoft issued security updates for 59 vulnerabilities, including six zero-days that are actively exploited. Notable fixes include a remote code execution flaw in Windows 11 Notepad and vulnerabilities affecting Windows Secure Boot and other core components.
  • Intel and AMD collectively addressed over 80 vulnerabilities across their chipsets in recent advisories.
  • Ivanti patched vulnerabilities in Endpoint Manager, including a high-severity authentication bypass that could be exploited remotely without authentication.

Notable Threat Actor Activity

  • APT36 and SideCopy have launched campaigns targeting Indian defense and government-aligned organizations, deploying cross-platform remote access trojans (RATs) affecting both Windows and Linux environments.
  • North Korea’s UNC1069 is increasingly targeting Web3 and cryptocurrency firms, employing large language models (LLMs), deepfakes, legitimate platforms, and ClickFix techniques.
  • The SSHStalker botnet is leveraging IRC-based command-and-control channels and legacy Linux kernel exploits to control compromised systems.
  • The Crazy ransomware gang is abusing legitimate employee monitoring tools and the SimpleHelp remote support tool to maintain persistence, evade detection, and facilitate ransomware deployment in corporate environments.

Trends, Tools, or Tactics of Interest

  • Campaigns involving RenEngine and HijackLoader have distributed LummaStealer via complex infection chains since March 2025.
  • There is increased abuse of AI models, with Google reporting that attackers are using Gemini AI for all stages of cyberattacks. Model extraction and distillation attacks are being observed using legitimate API access.
  • Spam and phishing trends for 2025 include increased use of scam QR codes, ClickFix attacks, and lures involving ChatGPT subscriptions.
  • Intentionally vulnerable training applications (e.g., OWASP Juice Shop, DVWA, Hackazon, bWAPP) are being targeted in cloud environments, exposing organizations to crypto-mining attacks.
  • The first known malicious Microsoft Outlook add-in supply chain attack has been observed in the wild.
  • WSL (Windows Subsystem for Linux) continues to be exploited within the malware ecosystem to facilitate cross-platform attacks.
  • Arrests have been made in the Netherlands related to the sale of JokerOTP, a phishing automation tool capable of intercepting multi-factor authentication (MFA) one-time passcodes.

Regulatory or Policy Developments Affecting the Security Industry

  • Nevada has introduced a new statewide data classification policy, categorizing data as “public,” “sensitive,” “confidential,” or “restricted,” following a recent cyberattack.
  • Microsoft announced plans to refresh Windows Secure Boot certificates in June 2026, replacing certificates that have been in use for over 15 years.