Major Incidents or Breaches

  • Iran-linked threat actors breached the personal email account of Kash Patel, director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents.
  • The same Iranian group conducted a wiper attack against Stryker, a medical technology company.

Newly Discovered Vulnerabilities

  • A critical memory overread vulnerability (CVE-2026-3055, CVSS 9.3) affecting Citrix NetScaler ADC and NetScaler Gateway is under active reconnaissance by threat actors.

Notable Threat Actor Activity

  • Iranian-affiliated hackers are responsible for both the breach of the FBI director’s personal email and the wiper attack on Stryker.
  • The TeamPCP supply chain campaign has shifted to a monetization phase, with no new compromises reported in the last 48 hours.

Trends, Tools, or Tactics of Interest

  • A new info-stealing malware, Infinity Stealer, is targeting macOS systems. The malware is distributed via ClickFix-themed lures, including fake Cloudflare CAPTCHA pages, and is delivered as a Python payload packaged using the Nuitka compiler.
  • The Infinity Stealer infection chain involves a Bash script and Nuitka loader, indicating increased sophistication in macOS malware delivery methods.