Major Incidents or Breaches

  • Over 300 malicious Chrome extensions, with a combined total of more than 37 million downloads, have been identified leaking or stealing user data, exposing users to tracking and personal information theft.
  • Threat actors are conducting physical mail-based attacks targeting users of Trezor and Ledger cryptocurrency hardware wallets. The letters impersonate the companies and attempt to trick recipients into disclosing their wallet recovery phrases, enabling cryptocurrency theft.

Newly Discovered Vulnerabilities

  • Two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited. A single threat actor is responsible for 83% of recent remote code execution (RCE) attacks targeting these vulnerabilities.

Notable Threat Actor Activity

  • A single threat actor is attributed to the majority of recent exploitation activity against Ivanti EPMM, leveraging critical RCE vulnerabilities for likely malicious purposes.

Trends, Tools, or Tactics of Interest

  • Threat actors are using unconventional attack vectors, such as physical mail, to target cryptocurrency users, indicating a diversification of social engineering tactics beyond digital communication channels.
  • The deployment of over 300 malicious Chrome extensions demonstrates continued abuse of browser extension ecosystems for large-scale data exfiltration and user tracking.