Major Incidents or Breaches

  • Hightower Holding Data Breach: Hightower Holding disclosed a data breach impacting 130,000 individuals. Attackers stole names, Social Security numbers, and driver’s license numbers.
  • Ajax Football Club Hack: Ajax Amsterdam reported a breach in which a hacker exploited IT system vulnerabilities, accessing data of several hundred fans and enabling ticket hijacking.
  • TeamPCP Supply Chain Attack: The TeamPCP supply chain campaign has expanded in scope, now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Detection tools are available.
  • LiteLLM Supply Chain Attack: A supply-chain attack on LiteLLM, a gateway used in AI agents, was dissected, highlighting the presence of malicious code designed to steal data.
  • GlassWorm Attack: The GlassWorm attack campaign installs a fake browser extension for surveillance, hiding inside developer tools and enabling data theft and potential supply chain spread.

Newly Discovered Vulnerabilities

  • Langflow (CVE-2026-33017): CISA warned of active exploitation of a critical code injection vulnerability in the Langflow AI framework, allowing attackers to hijack AI workflows.
  • Claude Chrome Extension: Researchers disclosed a vulnerability in Anthropic’s Claude Chrome extension, enabling zero-click XSS prompt injection via any website visited by the user.
  • BIND: High-severity vulnerabilities in BIND resolvers were patched, addressing out-of-memory conditions and memory leaks triggered by specially crafted domains.
  • Cisco IOS Software: Multiple high- and medium-severity vulnerabilities patched, including issues leading to denial-of-service, secure boot bypass, information disclosure, and privilege escalation.

Notable Threat Actor Activity

  • Coruna iOS Exploit Kit: The Coruna exploit kit, an evolution of the framework used in the Operation Triangulation espionage campaign, reuses and updates kernel exploits (CVE-2023-32434, CVE-2023-38606) to target iPhones via zero-click iMessage attacks.
  • Red Menshen (China-linked): This state-sponsored group has conducted a long-term espionage campaign against telecom and government networks, deploying stealthy BPFDoor implants for persistent access and surveillance within backbone infrastructure.
  • LeakBase Forum: Russian authorities arrested an individual suspected of owning/administering LeakBase, a major cybercrime forum for trading stolen data and hacking tools.
  • RedLine Infostealer: An Armenian suspect, alleged administrator of the RedLine infostealer malware operation, was extradited to the US to face charges related to managing the malware.
  • Infiniti Stealer (macOS): A new macOS infostealer, Infiniti Stealer (formerly NukeChain), uses fake CAPTCHA pages to trick users into running malicious Python/Nuitka-based commands.
  • TikTok for Business Phishing: Threat actors are targeting TikTok for Business accounts in a phishing campaign that evades security bots and attempts credential theft.

Trends, Tools, or Tactics of Interest

  • AI-Related Threats:
    • Attackers are exploiting vulnerabilities in AI-related platforms (Langflow, LiteLLM, Claude extension).
    • Researchers demonstrated that AI assistants (e.g., Copilot) can be manipulated to display phishing messages and leak internal information.
    • AI-powered dependency management tools have been found to introduce or overlook security bugs due to model hallucinations or errors in recommending software versions.
  • Phishing and Social Engineering:
    • Scammers are abusing Google Calendar invites to deliver phishing subscription renewal notices, using embedded phone numbers for social engineering.
    • Multi-stage fraud attacks are increasingly chaining bots, proxies, and stolen credentials to escalate from signup to account takeover.
  • Supply Chain Risks:
    • Attacks like TeamPCP and GlassWorm highlight ongoing concerns about the integrity of software supply chains and dependencies.
  • Automotive Cybersecurity:
    • Reports indicate a growing threat landscape for connected and autonomous vehicles, with persistent vulnerabilities since the 2015 Jeep hack.
  • Global Spyware Market:
    • Third-party intermediaries are facilitating the expansion of the spyware market worldwide, circumventing government restrictions and transparency efforts.

Regulatory or Policy Developments

  • UK Sanctions on Xinbi Marketplace: The UK Foreign, Commonwealth and Development Office sanctioned Xinbi, a Chinese-language cryptocurrency-based marketplace linked to Asian scam centers and the sale of stolen data and illicit services.
  • Dell and HP Quantum-Resistant Security: Dell and HP announced the rollout of quantum-resistant security capabilities for PCs and printers, enhancing device resilience against future quantum computing threats.
  • FCC Router Ban: The US Federal Communications Commission added certain foreign-made consumer routers to its list of prohibited communications devices, aiming to mitigate supply chain risks.
  • Meta Platform Litigation: Courts are issuing landmark verdicts scrutinising the design and addictive nature of Meta’s social media platforms, not just user-generated content.