Major Incidents or Breaches

  • Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.
  • Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.
  • Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.
  • Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.

Newly Discovered Vulnerabilities

  • A critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint has been exploited since mid-2024 by a Chinese state-backed group (UNC6201).
  • CISA added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
  • Multiple high- and critical-severity vulnerabilities were discovered in popular Visual Studio Code (VSCode) extensions, exposing over 128 million downloads to potential credential and file theft.
  • Google released an emergency update for Chrome to patch an actively exploited zero-day allowing code execution via malicious webpages.
  • Password managers including Bitwarden, LastPass, Dashlane, and 1Password were found vulnerable to vault compromise if a malicious server is present.
  • Notepad++ enhanced its update security with a new “double-lock” mechanism following a supply-chain compromise.
  • Research identified widespread exposure of secrets such as API keys in JavaScript front-end code, after scanning 5 million applications.

Notable Threat Actor Activity

  • Kaspersky uncovered the Keenadu Android backdoor, embedded in device firmware and Google Play apps, with links to major Android botnets. Keenadu enables data exfiltration, remote control, ad fraud, and browser hijacking via supply chain compromise.
  • Chinese state-backed hackers exploited a Dell zero-day (CVE-2026-22769) for espionage purposes.
  • A 47-year-old suspect linked to the Phobos ransomware group was arrested in Poland; authorities seized evidence including stolen credentials and server access data.
  • ClickFix campaigns are abusing DNS lookup commands to deliver ModeloRAT malware, adapting to bypass recent security defenses.
  • SmartLoader attacks are distributing a trojanized Oura MCP server to deploy StealC infostealer malware.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly abusing legitimate DKIM-signed emails (DKIM replay attacks) to bypass security filters and deliver scams, leveraging trusted invoice and notification templates.
  • Sophisticated phishing campaigns are bypassing Microsoft 365 multi-factor authentication (MFA) protections.
  • Remote Monitoring and Management (RMM) software is being widely abused by threat actors for stealth, persistence, and operational efficiency, often replacing traditional malware.
  • AI-powered assistants (including Copilot and Grok) with web access are being demonstrated as potential command-and-control (C2) proxies for malware operations.
  • Attackers are exploiting API vulnerabilities at greater scale and speed, with AI-driven systems amplifying potential impact.
  • The use of AI and context-aware tools is accelerating security operations, especially in cloud breach investigations and SOC workflows.
  • Three new threat groups began targeting industrial control systems (ICS/OT) in 2025, according to Dragos.
  • Hobbyist coding error led to the exposure of live camera feeds, microphones, and floor plans from thousands of vacuum robots, highlighting risks in IoT device security.

Regulatory or Policy Developments

  • Spain’s courts ordered NordVPN and ProtonVPN to block access to 16 websites facilitating illegal LaLiga football match streaming.
  • Ireland’s Data Protection Commission opened a formal investigation into X (formerly Twitter) over the use of its Grok AI tool to generate sexual images, focusing on data protection and regulatory compliance.