Major Incidents or Breaches

  • Dutch telecommunications provider Odido suffered a cyberattack resulting in exposure of personal data belonging to 6.2 million customers.
  • Romania’s national oil pipeline operator Conpet S.A. confirmed data theft by the Qilin ransomware gang.
  • ApolloMD disclosed a data breach impacting 626,000 individuals, with patient information from affiliated physicians and practices stolen.
  • Hackers breached Senegal’s national biometric database, compromising personal and biometric data of nearly 20 million residents.
  • The Outlook add-in AgreeTo, after being abandoned by its developer, was repurposed into a phishing kit that stole 4,000 credentials and payment data.

Newly Discovered Vulnerabilities

  • Apple patched a zero-day vulnerability (CVE-2026-20700) in the ‘dyld’ component, which allowed arbitrary code execution and was exploited in the wild.
  • A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access appliances is being actively exploited following the public release of a proof-of-concept.
  • The WPvivid Backup & Migration plugin for WordPress (900,000+ installs) is vulnerable to a critical RCE flaw allowing attackers to upload arbitrary files.
  • Multiple vulnerabilities in Windows LNK shortcut files were disclosed, enabling attackers to deploy malicious payloads, though Microsoft does not classify them as vulnerabilities.
  • Ivanti EPMM zero-day bugs continue to be exploited in active attacks.

Notable Threat Actor Activity

  • Google reported North Korea-linked UNC2970 using the Gemini AI model for reconnaissance and attack support.
  • The Lazarus Group launched a campaign targeting npm and PyPI repositories with malicious packages under the guise of fake recruitment, aiming to compromise developers.
  • Google observed state-backed actors from Russia, China, North Korea, and Iran, as well as cybercriminals and hacktivists, targeting the global defense sector.
  • The Qilin ransomware gang was identified as responsible for the Conpet S.A. breach.
  • 30 malicious Chrome extensions, posing as AI tools and installed by over 300,000 users, were used to steal credentials, emails, and browsing data.
  • The AMOS infostealer is targeting macOS users via popular AI apps and extension marketplaces to harvest credentials.
  • AI website builders are being leveraged by criminals to clone and impersonate major brands for phishing and fraud campaigns.

Trends, Tools, or Tactics of Interest

  • Voice phishing (vishing) kits with real-time control capabilities have emerged, enabling threat actors to bypass multifactor authentication.
  • Sophisticated phishing campaigns are bypassing Microsoft 365 MFA, targeting North American organizations.
  • Ransomware groups are increasingly using “naming and shaming” tactics, exposing corporate data on leak sites to pressure victims.
  • Attackers are increasingly abusing trusted tools and established methods, rather than relying on novel exploits.
  • AI prompt-based RCE and “Claude 0-click” vulnerabilities are being discussed in the context of new attack vectors.
  • AI recommendation poisoning was uncovered in 31 companies across 14 industries, facilitated by turnkey tools.
  • Criminals are using AI-assisted website builders to rapidly clone legitimate brand websites for phishing.
  • Abandoned software projects, such as the AgreeTo Outlook add-in, are being hijacked and weaponised for credential theft.
  • Booz Allen released Vellox Reverser, an AI-powered tool for automated malware analysis and reverse engineering.
  • SpecterOps launched BloodHound Scentry, a platform for identity attack path management and analysis.

Regulatory or Policy Developments Affecting the Security Industry

  • Russia is attempting to block WhatsApp and Telegram as part of a broader crackdown on non-government-controlled communication platforms.
  • Microsoft announced forthcoming “Windows Baseline Security” measures, enabling runtime integrity safeguards by default to ensure only properly signed software runs.
  • China has revived the Tianfu Cup hacking contest with increased secrecy and reduced rewards.
  • Meta is facing landmark trials alleging failure to protect children from sexual exploitation, grooming, and addiction-related harms on its platforms.