Major Incidents or Breaches

  • The AppsFlyer Web SDK was hijacked in a supply-chain attack, with malicious JavaScript code injected to steal cryptocurrency from users. The attack was temporary but impacted the integrity of the SDK, potentially affecting numerous websites and their users.
  • A hacker reportedly gained unauthorised access to FBI files related to the Epstein investigation. The breach was accidental but highlights the exposure of sensitive law enforcement data.
  • A porn-quitting app exposed the personal habits of hundreds of thousands of users due to a data leak, revealing sensitive behavioural information.

Newly Discovered Vulnerabilities

  • Multiple flaws have been identified in OpenClaw (formerly Clawdbot and Moltbot), an open-source AI agent. These vulnerabilities enable prompt injection and data exfiltration, raising concerns about the security of AI agent platforms, as highlighted by a warning from China’s CNCERT.
  • A critical vulnerability in HPE AOS-CX networking devices allows remote, unauthenticated attackers to reset admin passwords, bypassing authentication controls.
  • Microsoft released an out-of-band (OOB) update for Windows 11 Enterprise to address a remote code execution (RCE) flaw in the Routing and Remote Access Service (RRAS) component. The update targets devices that receive hotpatch updates outside the regular Patch Tuesday cycle.

Notable Threat Actor Activity

  • The GlassWorm campaign has escalated its tactics, now abusing 72 extensions in the Open VSX registry in a supply-chain attack targeting software developers. This represents a significant expansion in the campaign’s reach and impact.
  • Russian threat actors are attempting to compromise Signal accounts belonging to individuals, as reported in the context of broader cyber operations.

Trends, Tools, or Tactics of Interest

  • The GlassWorm campaign’s use of supply-chain attacks via popular developer tool registries demonstrates ongoing targeting of development environments to propagate malware.
  • Increased targeting of AI agent platforms (e.g., OpenClaw) via prompt injection and data exfiltration underscores emerging risks associated with the adoption of generative AI tools.
  • The hijacking of widely-used SDKs, such as AppsFlyer’s, for cryptocurrency theft reflects continued exploitation of trusted software supply chains.

Regulatory or Policy Developments Affecting the Security Industry

  • China’s National Computer Network Emergency Response Technical Team (CNCERT) has issued a formal warning regarding the security risks of AI agent platforms, specifically referencing OpenClaw, highlighting increased regulatory attention to AI-related vulnerabilities.