Major Incidents or Breaches

  • ShinyHunters, a known data extortion group, claims to have stolen over 600,000 Canada Goose customer records containing personal and payment-related information. Canada Goose is investigating the incident.

Newly Discovered Vulnerabilities

  • Google released an emergency security update for Chrome to address CVE-2026-2441, a high-severity zero-day vulnerability that is being actively exploited in the wild.

Notable Threat Actor Activity

  • ShinyHunters are responsible for the reported breach at Canada Goose, involving the leak of a large volume of customer records.
  • CTM360 identified a campaign leveraging over 4,000 malicious Google Groups and 3,500+ Google-hosted URLs to distribute Lumma Stealer infostealer malware and a trojanized “Ninja Browser.”
  • Multiple reports detail the ongoing use of ClickFix social engineering attacks. Recent variants abuse DNS (via nslookup) to retrieve PowerShell payloads and leverage Pastebin comments to distribute JavaScript targeting cryptocurrency users. These tactics are used for malware staging and to hijack crypto swaps.

Trends, Tools, or Tactics of Interest

  • ClickFix attacks are evolving, now incorporating DNS-based delivery mechanisms and leveraging legitimate services such as Pastebin and Google Groups to distribute malicious payloads.
  • The use of nslookup in ClickFix attacks to retrieve malware via DNS is reported as a first for this campaign type.
  • Attackers are increasingly abusing trusted cloud-based platforms (Google Groups, Google-hosted URLs, Pastebin) for malware distribution and command and control.

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft released update KB5077181 to resolve Windows 11 boot failures linked to previous failed security updates, addressing an “UNMOUNTABLE_BOOT_VOLUME” error on commercial systems.