Major Incidents or Breaches

  • Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
  • Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
  • Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
  • Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

  • Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
  • CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
  • A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

Notable Threat Actor Activity

  • The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
  • A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
  • Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
  • Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
  • A phishing campaign has been observed using fake incident reports as lures.

Trends, Tools, or Tactics of Interest

  • Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
  • The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
  • Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
  • There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
  • Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
  • Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Regulatory or Policy Developments

  • Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
  • CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
  • Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
  • Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.