Saturday 14 March 2026

Major Incidents or Breaches

• Starbucks disclosed a data breach affecting hundreds of employees after threat actors gained access to Starbucks Partner Central accounts via phishing attacks targeting the employee portal.
• Poland’s National Centre for Nuclear Research (NCBJ) reported an attempted cyberattack targeting its IT infrastructure; the attack was detected and blocked with no reported impact.
• The FBI is investigating eight malicious games uploaded to the Steam platform, which were used to spread malware. The agency is seeking information from affected users.
• An Iran-linked hacker group attacked Stryker, disrupting manufacturing and shipping operations. The attackers used legitimate endpoint management software to wipe devices rather than deploying malware.

Newly Discovered Vulnerabilities

• Google released security updates for Chrome to address two high-severity zero-day vulnerabilities (CVE-2026-1234 and CVE-2026-2345) affecting Skia and V8 components, both exploited in the wild to potentially allow code execution and security bypass.
• Nine vulnerabilities (“CrackArmor” flaws) were disclosed in the Linux kernel’s AppArmor module. These flaws can be exploited by unprivileged users to escalate privileges to root and bypass container isolation.
• A flaw in the n8n automation platform was reported as being actively exploited.
• Issues have been reported with some Samsung laptops running Windows 11 after the February 2026 security update, resulting in users losing access to the C:\ drive.

Notable Threat Actor Activity

• Storm-2561, a tracked threat actor, is distributing trojanized VPN clients masquerading as legitimate enterprise VPN software (Ivanti, Cisco, Fortinet) via SEO poisoning. These fake downloads are used to steal company VPN credentials.
• A suspected China-based cyber espionage group has been targeting Southeast Asian military organizations since at least 2020, deploying custom malware families “AppleChris” and “MemFun.”
• Pro-Iranian hackers have increased cyber operations against sites in the Middle East and are expanding attacks to US targets, including defense contractors and critical infrastructure. Recent activity includes the Stryker attack and threats to power and water facilities.
• Authorities in the US and Europe disrupted the SocksEscort proxy service, powered by the AVrecon botnet, which had impacted approximately 360,000 devices since 2020.
• INTERPOL, as part of Operation Synergia III, sinkholed 45,000 malicious IP addresses and seized servers linked to phishing, malware, and ransomware campaigns. The operation resulted in 94 arrests globally.

Trends, Tools, or Tactics of Interest

• Threat actors are increasingly leveraging SEO poisoning to distribute malware, as seen in the Storm-2561 campaign targeting VPN users.
• Use of fake enterprise software download sites is on the rise for credential theft.
• ClickFix variants are being used in scams, such as a fake $TEMU crypto airdrop, to trick victims into executing malware that installs remote-access backdoors.
• Scammers are sending fake calendar renewal notices impersonating Malwarebytes to lure victims into calling fraudulent billing numbers.
• Real-time banking trojans in Brazil are combining malware with human operators to target Pix users at opportune moments.
• Nonprofit organizations remain attractive targets due to security gaps, with underreporting of incidents making risk assessment difficult.
• AI is being increasingly leveraged for both cyber defense and attack, with new startups focusing on autonomous agent oversight and real-time device protection.
• Research demonstrates that widely-used facial recognition systems can be bypassed using smart glasses, deepfakes, and face swaps.
• Most attacks on Google Cloud begin with exploitation of vulnerabilities rather than credential theft or misconfiguration.

Regulatory or Policy Developments Affecting the Security Industry

• Meta announced it will discontinue support for end-to-end encrypted (E2EE) chats on Instagram as of May 8, 2026.
• Google reported paying out $17 million in bug bounty rewards in 2025, including $3.7 million for Chrome vulnerabilities and $3.5 million for cloud security issues, reflecting ongoing industry investment in vulnerability discovery and disclosure.