Eurail Data Breach: Eurail B.V. confirmed a December 2025 breach affecting over 300,000 individuals. Attackers accessed names, passport numbers, and other personal information from the European travel operator’s systems.
ChipSoft Ransomware Attack: Dutch healthcare IT provider ChipSoft suffered a ransomware attack, leading to the shutdown of its website and digital services used by patients and healthcare providers.
Smart Slider 3 Pro Supply Chain Attack: Unknown threat actors compromised Nextend’s update servers to distribute a backdoored version of the Smart Slider 3 Pro plugin for WordPress and Joomla, impacting users who downloaded updates during the attack window.
MyLovely.AI Data Leak: The NSFW app MyLovely.AI exposed over 70,000 user prompts and explicit images, affecting more than 100,000 users and increasing risks of sextortion and doxxing.
Meta Employee Data Misuse: A Meta employee allegedly downloaded 30,000 private Facebook images using a custom script designed to evade internal detection, raising concerns about insider threats.
Adobe Reader Zero-Day: A zero-day vulnerability in Adobe Reader has been actively exploited via malicious PDF documents since at least December 2025. The flaw remains unpatched and is being leveraged in the wild.
EngageLab SDK Flaw (Android): A now-patched vulnerability in the EngageLab SDK, used by over 50 million Android users (including 30 million crypto wallet app installs), exposed users to potential data theft. The flaw was reported by Microsoft and has since been addressed.
‘BlueHammer’ Windows Zero-Day: A researcher under the alias ‘Chaotic Eclipse’ released a proof-of-concept exploit for a Windows zero-day (dubbed ‘BlueHammer’) that enables local privilege escalation and system takeover. The researcher cited dissatisfaction with Microsoft’s bug disclosure handling.
Palo Alto Networks and SonicWall Vulnerabilities: Both vendors patched high-severity vulnerabilities that could allow attackers to modify protected resources or escalate privileges to administrator level.
Google API Key Exposure in Android Apps: Researchers found that dozens of Android apps exposed hardcoded Google API keys, allowing unauthorised access to Gemini endpoints.
ClipBanker Malware Campaign: Threat actors are distributing a trojanised version of Proxifier software, initiating a multi-stage infection chain leading to ClipBanker malware deployment. ClipBanker replaces copied cryptocurrency wallet addresses to steal funds.
VENOM Phishing-as-a-Service Platform: A newly identified PhaaS platform, VENOM, is being used to target C-suite executives across industries, aiming to steal Microsoft credentials via sophisticated phishing campaigns.
Palo Alto Networks Recruitment Phishing: Attackers are impersonating Palo Alto Networks recruiters in spear-phishing campaigns targeting senior job seekers, as reported by the company’s Unit 42 team.
UAT-10362 and LucidRook Malware: A previously undocumented threat cluster, UAT-10362, has been attributed to spear-phishing campaigns against Taiwanese NGOs and universities, deploying a new Lua-based malware named LucidRook.
Bitter-Linked Hack-for-Hire Campaign: A hack-for-hire group with suspected links to India targeted journalists, activists, and government officials across the Middle East and North Africa.
Google Warns of BPO-Targeted Campaigns: Google has identified campaigns by threat actor UNC6783 (linked to “Mr. Raccoon”) targeting business process outsourcing (BPO) firms to steal corporate data.
Fancy Bear (APT28) Ongoing Activity: Russia-linked APT28 (Fancy Bear) continues global operations, targeting organisations with a focus on exploiting unpatched systems.
Fake Windows Support Site: Attackers are using convincing Microsoft lookalike websites to deliver password-stealing malware to unsuspecting users.
Amazon Support Scams: A new wave of phishing campaigns is impersonating Amazon support to steal user account credentials via email and SMS.
AI-Driven Phishing: Attackers are leveraging AI to automate and personalise phishing campaigns, increasing their scale and effectiveness.
Shadow AI Risks in Enterprises: The unsanctioned adoption of AI tools by employees without IT oversight is introducing new security risks, including data leakage and unauthorised access.
Session Cookie Theft Mitigations: Google Chrome 146 for Windows introduces Device Bound Session Credentials (DBSC), cryptographically binding session cookies to devices to prevent infostealer malware from reusing stolen cookies.
MFA Bypass Techniques: Attackers are increasingly targeting authentication systems by leveraging stolen credentials and session tokens, highlighting limitations of traditional MFA and the need for session-aware authentication.
Obfuscated JavaScript in Phishing: Recent campaigns have used highly obfuscated JavaScript payloads delivered via phishing emails and compressed archives to evade detection.
Supply Chain Attacks on Plugin Updates: The Smart Slider 3 Pro incident underscores ongoing risks to software supply chains, particularly through compromised update mechanisms.
Regulatory or Policy Developments Affecting the Security Industry#
Increased Political Campaign Security Spend: Political candidates are investing more heavily in personal and campaign security measures in response to heightened threats and targeted attacks.