Major Incidents or Breaches

  • Over 900 Sangoma FreePBX instances remain compromised with web shells following exploitation of a command injection vulnerability in the endpoint manager’s interface, ongoing since December 2025.
  • ManoMano, an online marketplace, suffered a data breach allegedly impacting 38 million individuals, with stolen data including names, email addresses, phone numbers, and other personal information.
  • The U.S. Department of Justice seized $61 million in Tether cryptocurrency linked to “pig butchering” crypto scams.
  • Data broker breaches have contributed to nearly $21 billion in identity-theft losses, according to a new report.
  • A Ukrainian national pleaded guilty to operating OnlyFake, an AI-powered fake ID website that generated and sold over 10,000 fraudulent identification documents globally.

Newly Discovered Vulnerabilities

  • Juniper Networks PTX routers are affected by a critical remote code execution vulnerability (CVE-2026-21902) in Junos OS Evolved, addressed via an out-of-band security update.
  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released details on the RESURGE malware, which can remain dormant on Ivanti Connect Secure devices after exploitation of CVE-2025-0282.
  • Researchers discovered that public Google API keys, previously considered non-sensitive, can be used to access Gemini AI data, exposing potentially sensitive information.

Notable Threat Actor Activity

  • The North Korean APT group ScarCruft (APT37) has been observed using new malware to breach air-gapped networks, leveraging Zoho WorkDrive for command-and-control and spreading via USB drives.
  • A malicious Go module has been identified stealing passwords, establishing SSH persistence, and deploying the Rekoobe Linux backdoor.
  • Threat actors are distributing trojanized gaming utilities via browsers and chat platforms to install Java-based remote access trojans (RATs).
  • Aeternum botnet loader is using Polygon blockchain-based smart contracts for resilient command-and-control infrastructure.
  • ShinyHunters has claimed responsibility for the Odido breach, as reported in industry news roundups.

Trends, Tools, or Tactics of Interest

  • The Kratos Phishing-as-a-Service (PhaaS) kit is industrializing credential compromise attacks, with projections that over 90% of such attacks will use modular PhaaS by 2026.
  • Fake Google security checks are being used as lures to trick users into granting browser permissions, enabling threat actors to harvest contacts, location data, and other sensitive information.
  • Malicious actors continue to exploit social engineering on Facebook, using compromised accounts to propagate scams.
  • Third-party software, including PDF readers and email clients, remains a significant attack surface due to inconsistent patching and update practices.
  • Cities hosting major events are being advised to enhance defenses against wireless and drone-based threats, beyond traditional cyber and physical security measures.
  • Microsoft is testing security improvements for batch file and CMD script execution in Windows 11 Insider Preview builds.
  • Meta has filed lawsuits against advertisers in Brazil, China, and Vietnam for running celebrity-bait scams on its platforms.

Regulatory or Policy Developments

  • The Pentagon has designated Anthropic as a supply chain risk, amid a dispute over the use of its AI technologies for military applications. Anthropic is resisting Pentagon demands for broader AI safeguards, seeking assurances against use for mass surveillance or autonomous weapons.
  • U.S. President Trump has ordered all federal agencies to phase out the use of Anthropic technology.
  • Europol-led “Project Compass” resulted in 30 arrests and 179 suspects being linked to “The Com,” a cybercrime group targeting children and teenagers.
  • Congressional scrutiny is increasing on data brokers following revelations about identity theft losses tied to industry breaches.