Wednesday 18 March 2026

Major Incidents or Breaches

• UK Companies House disclosed a vulnerability that exposed details of millions of firms, which could have been exploited to obtain sensitive company information and alter official records.
• Robotic surgery manufacturer Intuitive confirmed a cyberattack after an employee fell victim to a phishing scheme, resulting in unauthorised access to internal business applications.
• GlassWorm malware resurfaced in a supply-chain attack targeting over 400 code repositories and packages on GitHub, npm, VSCode, and OpenVSX, impacting the software supply chain.
• Sears exposed AI chatbot phone calls and text chats to the public web, allowing access to customer conversations containing contact information and personal details.
• LeakNet ransomware adopted the ClickFix technique via compromised websites for initial access and deployed a Deno-based in-memory loader, increasing stealth in attacks.
• The RondoDox botnet escalated its activity, targeting 174 vulnerabilities with up to 15,000 exploitation attempts per day.
• A phishing attack targeted cybersecurity firm Outpost24, using trusted brands and domains in an attempt to compromise C-suite credentials; the attack was unsuccessful.

Newly Discovered Vulnerabilities

• Apple released its first Background Security Improvements update to patch a WebKit vulnerability (CVE-2026-20643) affecting iOS, iPadOS, and macOS, which enabled same-origin policy bypass.
• A critical unpatched vulnerability (CVE-2026-32746) in the GNU InetUtils telnet daemon (telnetd) allows unauthenticated remote code execution as root via port 23.
• Multiple AI platforms, including Amazon Bedrock, LangSmith, and SGLang, were found vulnerable to data exfiltration and remote code execution attacks using DNS queries.
• CISA flagged the year-old Wing FTP vulnerability (CVE-2025-47813) as actively exploited, which can disclose the full local installation path of the application.
• A new font-rendering attack was identified that hides malicious commands from AI tools by embedding them in HTML, evading detection by AI-based security solutions.

Notable Threat Actor Activity

• North Korean threat actor group Konni was observed deploying EndRAT through phishing campaigns and leveraging the KakaoTalk desktop app to propagate malware to victims’ contacts.
• LeakNet ransomware group is now using ClickFix for social engineering and Deno runtime for in-memory malware loading, enhancing stealth and evasion.
• The Warlock ransomware group demonstrated augmented post-exploitation activities, including a new Bring Your Own Vulnerable Driver (BYOVD) technique and advanced cross-network movement.
• Attackers are increasingly using IPv4-mapped IPv6 addresses to obfuscate attack origins, as noted in recent web scanning activity.

Trends, Tools, or Tactics of Interest

• Attackers are shifting from traditional intrusion methods to credential theft, with increased use of infostealer malware and AI-enabled social engineering, leading to more incidents of attackers “logging in, not breaking in.”
• Ransomware actors are moving away from Cobalt Strike in favour of native Windows tools due to declining ransom payment rates and a surge in data theft.
• Akamai reported a convergence of Layer 7 DDoS, API abuse, and AI-powered attacks into highly coordinated, multi-vector campaigns that are more challenging to detect and mitigate.
• Integrated Cloud Email Security (ICES) is highlighted as a recommended solution for modern email threats, as attackers continue to evolve phishing techniques.
• SEO poisoning is being used to lure users searching for VPNs into downloading malicious software that steals corporate login credentials.
• AI security remains a concern: studies indicate most CISOs are relying on outdated tools and skills to secure AI systems, and 90% of surveyed users do not trust AI with their data.
• Use of in-memory loaders and open-source runtimes (such as Deno) is increasing in ransomware deployment for stealthier attacks.
• Supply chain threats continue to target open-source repositories and extensions, as evidenced by the GlassWorm campaign.
• Google is implementing stricter controls on Android apps abusing accessibility features to combat mobile malware.
• A new tactic was observed where malicious commands are hidden from AI-based detection tools using font-rendering tricks in HTML.

Regulatory or Policy Developments

• The European Union Council imposed sanctions on three entities and two individuals from China and Iran for involvement in cyberattacks targeting critical infrastructure.
• Major tech companies including Anthropic, AWS, Google, Microsoft, and OpenAI have collectively invested $12.5 million in the Linux Foundation for open source security initiatives.
• Google, Meta, and Microsoft are among the signatories of a new industry pact to combat online scams and fraud.