Cybersecurity Brief – 2026-03-10

Major Incidents or Breaches

Ericsson US Data Breach: Ericsson Inc. disclosed a data breach following a service provider hack, resulting in the theft of employee and customer data. The number of affected individuals has not been specified.
UNC4899 Crypto Firm Compromise: The North Korean threat actor UNC4899 breached a cryptocurrency organization in 2025, leveraging an AirDropped, trojanized file to a developer’s work device, resulting in the theft of millions of dollars.
Salesforce Experience Cloud Data Exposure: Salesforce warned customers of attacks exploiting misconfigured Experience Cloud platforms, allowing guest users to access sensitive data. The ShinyHunters group claims ongoing data theft attacks against Salesforce Aura.
AkzoNobel Compromise: AkzoNobel, a Netherlands-based paint manufacturer, was listed among top attacks and breaches in Check Point’s latest threat intelligence report.

CISA Adds Actively Exploited Flaws: The US CISA added vulnerabilities in SolarWinds, Ivanti, and VMware Workspace One to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
Qualcomm 0-Day and iOS Exploit Chains: Reports highlight new zero-day vulnerabilities affecting Qualcomm chipsets and exploit chains targeting iOS devices.
Google Cloud Attack Techniques: Google reported that attackers increasingly exploit newly disclosed vulnerabilities in third-party software for initial access to cloud environments, rather than relying on weak credentials.

North Korean State Actors (UNC4899): UNC4899 used advanced social engineering and file delivery (AirDrop) to compromise a crypto firm’s cloud environment and steal significant funds.
Russian State-Sponsored Phishing: Russian actors are conducting phishing campaigns targeting Signal and WhatsApp accounts of government officials, military personnel, and journalists in the Netherlands, aiming for account hijacking.
ShinyHunters: The group claims responsibility for ongoing data theft attacks exploiting Salesforce Aura misconfigurations.
Chinese Cyber Espionage: An unidentified Chinese-speaking threat actor has maintained a presence in critical Asian sectors for years, using custom malware, open-source tools, and living-off-the-land binaries for espionage on Windows and Linux systems.

Malicious npm Package Targeting macOS: Researchers discovered a malicious npm package masquerading as an OpenClaw installer, deploying a remote access trojan and stealing macOS credentials.
Malicious Chrome Extensions: Two Chrome extensions turned malicious after ownership transfer, enabling attackers to inject arbitrary code and exfiltrate data from users.
Microsoft Teams Phishing with A0Backdoor: Attackers are targeting financial and healthcare employees via Microsoft Teams, tricking them into granting access via Quick Assist and deploying the A0Backdoor malware.
InstallFix/ClickFix Malvertising Campaigns: Campaigns are distributing fake Claude Code installation pages and other cloned AI tool sites to Windows and Mac users, delivering infostealers via malicious command instructions. ClickFix attacks use Windows Terminal to evade detection, while InstallFix leverages malvertising and AI-themed lures.
.arpa TLD Phishing Abuse: Threat actors are abusing the .arpa top-level domain and DNS management controls to obfuscate the location of phishing content, often leveraging Cloudflare.
Quiz Site Notification Abuse: Malicious quiz sites are tricking users into enabling browser notifications, which are subsequently used for adware, scams, or other unwanted promotions.
Password Audit Limitations: Research highlights that password audits often miss high-risk accounts such as orphaned users and service accounts, leaving organizations exposed.

White House Cyber Strategy Shift: The US administration released a strategy document indicating a shift toward offensive cyber operations, emphasizing preemption and deterrence.
CISA Vulnerability Mandates: CISA’s inclusion of new vulnerabilities in the KEV catalog may trigger mandatory patching requirements for US federal agencies and organizations working with them.
Microsoft Teams Bot Tagging Update: Microsoft announced upcoming changes to Teams, where third-party bots will be automatically tagged in meeting lobbies, giving organizers more control over bot participation.
Significant Cybersecurity M&A Activity: February 2026 saw 42 cybersecurity M&A deals involving major firms such as Check Point, Booz Allen, Proofpoint, Sophos, Palo Alto Networks, and Zscaler.
Cylake Funding for Data Sovereignty: Cylake, a company focused on securing organizations restricted from cloud usage due to data sovereignty requirements, raised $45 million in funding.