Major Incidents or Breaches

  • Hasbro, the global toy manufacturer, has disclosed a cyberattack and is investigating the extent of potential data compromise.
  • The Axios NPM package was breached in a North Korean supply chain attack. Attackers used a stolen NPM access token to bypass GitHub Actions OIDC-based CI/CD controls and publish backdoored package versions.
  • CERT-UA reported a phishing campaign impersonating the agency to distribute AGEWHEEZE malware to approximately 1 million email addresses.
  • TrueConf conference servers were targeted via a zero-day vulnerability, allowing attackers to execute arbitrary files on connected endpoints through malicious software updates.
  • Over 2.3 million Android devices were infected with the NoVoice malware, which was distributed through more than 50 apps on Google Play.
  • A new service, EvilTokens, is enabling device code phishing attacks against Microsoft accounts, facilitating advanced business email compromise (BEC) campaigns.
  • The TeamPCP supply chain campaign update confirmed its first victim and documented post-compromise cloud enumeration activities, with attribution narrowing towards specific threat actors.
  • A new phishing campaign is targeting Spanish-speaking users in Latin America and Europe with dynamic PDF lures to deliver Casbaneiro (Metamorfo) banking trojans.
  • Cyberattacks against Latin American governments have intensified, with disruptive incidents in Puerto Rico and a surge in attacks on Colombia’s health sector.
  • The US Department of Justice has charged an individual for exploiting smart contract vulnerabilities to steal $55 million from the Uranium crypto exchange, leading to its shutdown.

Newly Discovered Vulnerabilities

  • Google released patches for 21 vulnerabilities in Chrome, including the actively exploited zero-day CVE-2026-5281 affecting the Dawn component. This is the fourth Chrome zero-day exploited in 2026.
  • Apple expanded the iOS 18.7.7 and iPadOS 18.7.7 security updates to more devices to address the DarkSword exploit kit, which is being actively exploited.
  • A zero-day vulnerability in TrueConf conferencing software was exploited in the wild to deliver malicious updates and execute arbitrary files on endpoints.

Notable Threat Actor Activity

  • North Korean threat actors are attributed to the Axios NPM supply chain attack, leveraging a compromised token to distribute malicious packages.
  • Microsoft and Malwarebytes warn of an ongoing campaign distributing VBS malware via WhatsApp messages on Windows. The campaign uses UAC bypass techniques to hijack systems and has been active since late February 2026.
  • The Casbaneiro group continues to target Spanish-speaking users in Latin America and Europe with phishing campaigns delivering banking trojans.
  • The Venom Stealer malware-as-a-service (MaaS) platform is automating persistent information-stealing attacks, specifically commoditising ClickFix social engineering techniques.
  • The new CrystalRAT malware, promoted via Telegram, combines remote access, credential theft, keylogging, and clipboard hijacking, and is available as malware-as-a-service.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly leveraging legitimate tools and valid credentials for initial access, with a decline in traditional malware use. Common vectors include VPN abuse, remote monitoring and management (RMM) tools, and social engineering.
  • Fileless malware and malicious scripts are being used to minimise filesystem footprint while maintaining persistence.
  • Device code phishing and business email compromise are being facilitated by new toolkits like EvilTokens.
  • ClickFix attacks are being commoditised via MaaS platforms, with new malware such as DeepLoad deployed to steal credentials, install malicious browser extensions, and propagate via USB drives.
  • The public sector and education face persistent threats, with resource constraints and human risk remaining key vulnerabilities.
  • Fraudsters are increasingly targeting the digital assets of deceased individuals and their families for account takeover and scams.

Regulatory or Policy Developments Affecting the Security Industry

  • The FBI issued a warning regarding privacy and data security risks associated with Chinese-developed mobile applications, though no specific apps were named.
  • The US Department of Justice continues to pursue prosecution of cybercriminals, as evidenced by the Uranium crypto exchange case.

Other Notable Industry Developments

  • Linx Security raised $50 million to advance identity security and governance solutions.
  • Depthfirst secured $80 million in Series B funding to expand AI research and security model development.