Major Incidents or Breaches

  • Russian law enforcement arrested the alleged administrator of LeakBase, a major stolen credential marketplace.
  • Personal data of hundreds of HackerOne employees was compromised in a large-scale breach targeting Navia.
  • A hacktivist group claims to have accessed sensitive data on millions of crime tipsters and those reported, with records dating back to 1987.
  • Device code phishing campaigns have targeted over 340 Microsoft 365 organizations across five countries, abusing OAuth for initial access.
  • Threat actors are leveraging the Bubble no-code app builder to create and host phishing sites targeting Microsoft account credentials.
  • Ongoing phishing campaigns have impersonated Palo Alto Networks recruiters since August, using LinkedIn-scraped data to defraud job candidates.

Newly Discovered Vulnerabilities

  • Citrix released patches for two NetScaler ADC and Gateway vulnerabilities, including one similar to previously exploited CitrixBleed flaws.
  • TP-Link patched critical authentication bypass and firmware upload vulnerabilities affecting Archer NX routers.
  • Attacks exploiting the ‘PolyShell’ vulnerability are targeting 56% of all vulnerable Magento Open Source and Adobe Commerce installations.
  • Apple released security updates addressing 85 vulnerabilities across iOS, macOS, and related products; none are currently exploited in the wild.

Notable Threat Actor Activity

  • The GlassWorm malware campaign has evolved to use Solana blockchain “dead drops” for multi-stage delivery of a RAT and theft of browser and cryptocurrency data.
  • The new Torg Grabber infostealer targets 728 cryptocurrency wallets and over 850 browser extensions.
  • The SmartApeSG campaign is distributing multiple RATs, including Remcos, NetSupport, StealC, and Sectop RAT.
  • TeamPCP, in collaboration with Lapsus$, compromised open-source software ecosystems (Docker Hub, VS Code, PyPI, NPM) by targeting GitHub Action tags.
  • Paid AI service accounts are now being traded at scale on underground markets, bundled with other access commodities.
  • US courts sentenced Ilya Angelov (TA-551/Gold Cabin) to two years in prison for operating a botnet used in ransomware attacks. Aleksei Volkov received 81 months for facilitating Yanluowang ransomware intrusions.

Trends, Tools, or Tactics of Interest

  • AI is a central enabler in both attack and defense, with SANS listing all top five new attack techniques as AI-driven.
  • Anthropic reported a state-sponsored group used an AI agent to autonomously conduct cyber espionage against 30 global targets, with the AI performing 80-90% of the intrusion lifecycle.
  • AI-powered bug detection has been integrated into GitHub’s Code Security tool, expanding coverage beyond CodeQL.
  • Cloud virtual machines are increasingly presenting unmanaged security gaps as their adoption accelerates.
  • Cybercriminals are increasingly targeting identity systems, with AI amplifying both attack speed and the evolution of identity theft into a supply chain.
  • Kali Linux 2026.1 was released, adding eight new tools and a BackTrack mode for undercover operations.
  • The use of no-code/low-code platforms (e.g., Bubble) is being abused for phishing and evasion of traditional detection.
  • The Kaspersky Security Services report highlights increased sophistication in attack chains and the use of MDR/IR data to reveal evolving TTPs.

Regulatory or Policy Developments Affecting the Security Industry

  • The US FCC has banned the sale of new consumer routers manufactured outside the US, citing national security risks.
  • At RSAC 2026, EU officials are leading discussions on cybersecurity challenges, while US officials are notably absent.
  • Apple extended security updates to older device generations, indicating ongoing regulatory and industry pressure for longer-term device support.