Major Incidents and Breaches

  • The French Ministry of Economy reported unauthorized access to the national bank account registry (FICOBA), exposing 1.2 million bank accounts.
  • Blockchain-based lender Figure confirmed a data breach after threat actor ShinyHunters leaked over 2GB of data, compromising nearly 1 million user records.
  • German rail operator Deutsche Bahn experienced a large-scale DDoS attack that disrupted information and booking systems for several hours.
  • Abu Dhabi Finance Week inadvertently exposed VIP passport details due to unprotected cloud storage.
  • Intimate products company Tenga suffered a phishing attack, potentially exposing US customer data.
  • A Nigerian national was sentenced to eight years in prison for hacking tax preparation firms in Massachusetts and filing fraudulent tax returns worth over $8.1 million.

Newly Discovered Vulnerabilities

  • Microsoft patched CVE-2026-26119, a privilege escalation vulnerability in Windows Admin Center.
  • A critical vulnerability in Grandstream GXP1600 series VoIP phones allows unauthenticated remote attackers to gain root privileges and eavesdrop on communications.
  • The US Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch a maximum-severity, actively exploited Dell vulnerability within three days.
  • OpenClaw, following a supply chain attack via a malicious npm package (Cline v2.3.0), continues to face security and misconfiguration issues despite recent patches.
  • Ivanti zero-day vulnerabilities have seen a surge in exploitation, with attacks traced back to July 2025, including shell access, reconnaissance, and malware delivery.
  • Foxit PDF software and OpenSSL both reported new remote code execution vulnerabilities, with active exploitation noted in the wild.

Notable Threat Actor Activity

  • The CRESCENTHARVEST campaign is targeting supporters of Iran’s protests with remote access trojan (RAT) malware for information theft and espionage.
  • ShinyHunters leaked user data stolen from Figure, a blockchain lender.
  • A supply chain attack injected the OpenClaw backdoor into Cline npm package, downloaded over 4,000 times.
  • Threat actors are targeting Microsoft Entra accounts in technology, manufacturing, and financial sectors using combined device code phishing and vishing to abuse OAuth 2.0 Device Authorization Grant.
  • INTERPOL’s Operation Red Card 2.0 resulted in 651 arrests and the recovery of $4.3 million, targeting online scams, investment fraud, mobile money scams, and fake loan applications across 16 African countries.

Trends, Tools, and Tactics of Interest

  • AI-assisted social engineering attacks remain the top initial access vector, with reports of a 1200% surge in AI-driven fraud during December 2025. Threat actors are leveraging AI for bot deployment, phishing, and identity fraud.
  • The PromptSpy Android malware is the first known mobile malware to leverage generative AI (Google Gemini) at runtime for persistence and adaptation across devices.
  • The Massiv Android banking trojan, disguised as IPTV apps, is actively targeting users in southern Europe with device takeover and financial theft capabilities.
  • The Arkanix Stealer, written in C++ and Python, has been distributed as malware-as-a-service (MaaS) with a referral program, targeting a wide range of user data.
  • Infostealer dumps are increasingly linking stolen credentials to real-world identities, correlating usernames, cookies, and behavioural data across personal and enterprise accounts.
  • The Starkiller phishing kit, available as phishing-as-a-service (PhaaS), bypasses multi-factor authentication (MFA) by live-proxying legitimate login sites.
  • AI-generated passwords have been found to be highly predictable and less secure compared to traditional random password generation methods.
  • IoT security risks continue due to reused passwords, lack of network segmentation, and poor sanitisation processes, increasing the attack surface.
  • Google blocked over 1.75 million Play Store app submissions in 2025 and prevented more than 255,000 apps from obtaining excessive access to sensitive user data.

Regulatory or Policy Developments

  • Texas filed a lawsuit against TP-Link, alleging deceptive marketing of its routers as secure while allowing exploitation of firmware vulnerabilities by Chinese state-backed hackers.
  • CISA issued an emergency directive for federal agencies to patch an actively exploited Dell vulnerability within three days.
  • Three former Google engineers were indicted in the US for allegedly stealing trade secrets and transferring them to Iran.