Major Incidents or Breaches

  • Madison Square Garden confirmed a data breach resulting from the 2025 Oracle E-Business Suite hacking campaign, with the incident only publicly disclosed months after the initial attack.
  • Wynn Resorts, a major US-based casino and hotel operator, was listed among the top attack and breach victims in the recent Check Point threat intelligence report.
  • A 22-year-old Alabama man pleaded guilty to hacking and extorting hundreds of women by hijacking their social media accounts, including those of minors.
  • A Florida woman was sentenced to 22 months in prison for orchestrating a large-scale Microsoft license fraud operation, trafficking thousands of stolen Certificate of Authenticity (COA) labels.
  • A phishing campaign is leveraging a fake Google Account security page and a Progressive Web App (PWA) to steal credentials, multi-factor authentication codes, and cryptocurrency wallet addresses, as well as proxying attacker traffic.
  • A fake FileZilla website is distributing a tampered installer that communicates with attacker-controlled servers via encrypted DNS traffic, evading traditional network monitoring.
  • A phishing campaign is distributing malicious “purchase order” attachments that link to credential-harvesting web pages.

Newly Discovered Vulnerabilities

  • A critical, now-patched vulnerability in Google Chrome’s Gemini Live AI Assistant allowed malicious extensions to escalate privileges, access local files, and potentially violate user privacy.
  • OpenClaw, a popular AI agent tool, was found to have a critical vulnerability enabling malicious websites to open WebSocket connections to localhost, brute-force passwords, and hijack the AI agent.
  • Wireshark 4.6.4 was released, addressing three vulnerabilities and 15 bugs.
  • A 0-day vulnerability (CVE-2026-21513) in Microsoft MSHTML, exploited prior to the February 2026 Patch Tuesday, has been linked to APT28 activity.

Notable Threat Actor Activity

  • Russia-linked APT28 exploited the MSHTML 0-day (CVE-2026-21513) in targeted attacks before its public disclosure and patch.
  • North Korean threat actors published 26 malicious npm packages as part of the ongoing “Contagious Interview” campaign, embedding Pastebin-based command-and-control for a cross-platform remote access trojan (RAT).
  • Another North Korean APT campaign targeted air-gapped systems using Windows shortcut files, deploying new implants, loaders, propagation tools, and backdoors.
  • Pro-Western and Iranian threat actors are engaged in reciprocal cyberattacks amid ongoing Middle East conflict, including wiper malware, DDoS, and attacks on critical infrastructure.
  • The UK’s National Cyber Security Centre (NCSC) issued a warning to British organizations about increased risk of Iranian cyberattacks due to Middle East tensions.
  • Global law enforcement arrested 30 alleged members of the cybercriminal collective “The Com” in “Project Compass,” identifying nearly 180 group members in total.
  • Researchers linked the open-source AI security testing tool CyberStrikeAI to a threat actor responsible for breaching hundreds of Fortinet FortiGate devices.

Trends, Tools, or Tactics of Interest

  • Attacks on GPS and satellite navigation systems have spiked in the Middle East, with over 1,100 ships impacted since February 28 following US and Israeli actions against Iran.
  • There is a growing use of deepfakes and injection attacks to bypass identity verification processes, targeting onboarding and account recovery workflows.
  • Bot attacks against SaaS platforms are increasing, with attackers leveraging automated tools to generate fake sign-ups and abuse APIs.
  • A trend of threat actors leveraging AI-powered tools, such as CyberStrikeAI, for offensive security testing and exploitation has been observed.
  • The use of encrypted DNS by malware (as seen in the fake FileZilla campaign) is complicating detection and response efforts.
  • AI-driven development is contributing to tensions between speed and security, with firewall rule backlogs and automation impacting application security workflows.

Regulatory or Policy Developments Affecting the Security Industry

  • Samsung settled a lawsuit in Texas over the collection and monetization of smart TV viewing data using Automated Content Recognition (ACR), with implications for user privacy controls.
  • Google announced the development of quantum-resistant HTTPS certificates for Chrome, utilizing Merkle Tree Certificates (MTCs) to address future quantum computing threats.
  • AWS expanded its Security Hub into a cross-domain security platform, aiming to reduce tool sprawl and improve correlation of security findings.
  • Nick Andersen was appointed Acting Director of CISA (Cybersecurity and Infrastructure Security Agency), following a leadership change within the US Department of Homeland Security.