Major Incidents or Breaches

  • CPUID suffered a supply chain attack where hackers altered download links for CPU-Z and HWMonitor, serving malicious executables via the official website.
  • Telehealth company Hims experienced a breach, exposing highly sensitive personal health information (PHI) of users.
  • Medical technology firm Stryker was impacted by a cyberattack.
  • Microsoft reported that the financially motivated threat actor Storm-2755 targeted Canadian employees in payroll hijacking attacks.
  • Nearly 4,000 US industrial devices, including PLCs, have been identified as exposed to Iranian-linked cyberattacks targeting critical infrastructure.
  • Fake websites impersonating Claude AI were found distributing PlugX malware, providing attackers remote access to victim systems.

Newly Discovered Vulnerabilities

  • Juniper Networks patched multiple vulnerabilities in Junos OS, including a critical flaw that allows remote, unauthenticated takeover of affected devices.
  • Chrome 147 addressed 60 vulnerabilities, including two critical bugs in the WebML component.
  • Orthanc DICOM software vulnerabilities were disclosed, leading to potential denial-of-service, information disclosure, and remote code execution.
  • A critical vulnerability in Marimo was exploited in the wild within nine hours of public disclosure.
  • ClickFix campaigns exploited a new method to infect Macs by bypassing macOS Tahoe’s Terminal warnings, using Script Editor instead.

Notable Threat Actor Activity

  • The “Silver Fox” threat actor is conducting tax-themed phishing campaigns targeting Japanese firms during tax season.
  • Ongoing GlassWorm campaign now uses a Zig dropper to infect developer integrated development environments (IDEs).
  • Iranian-linked hackers are actively targeting US critical infrastructure by manipulating PLCs and SCADA systems.
  • Storm-2755 continues payroll hijacking attacks, focusing on Canadian employees.
  • Recovery scammers are targeting individuals who have already been victims of fraud, leveraging so-called “sucker lists.”

Trends, Tools, or Tactics of Interest

  • Analysis of one billion CISA KEV remediation records indicates that most critical vulnerabilities are exploited before defenders can patch, highlighting the limitations of human-scale security operations.
  • Device Bound Session Credentials (DBSC) have been rolled out in Chrome 146 and above to prevent session theft by cryptographically binding authentication to devices.
  • Google introduced end-to-end encryption (E2EE) for Gmail on Android and iOS, now available for enterprise users.
  • AI browser extensions are emerging as an unmonitored channel for AI consumption, raising new security concerns.
  • Anthropic’s Mythos Preview AI model, capable of finding and exploiting zero-days, is drawing attention to the risks of advanced exploit-writing AI tools.
  • MITRE released the Fight Fraud Framework, providing a behavior-based model of fraud tactics and techniques.
  • ClickFix demonstrates a new macOS infection vector by using Script Editor to bypass standard paste warnings.
  • LayerX and other security vendors highlight the risk of browser extensions as attack vectors, particularly in the context of AI and GenAI usage.

Regulatory or Policy Developments

  • FINRA launched a Financial Intelligence Fusion Center to enhance response to cybersecurity and fraud threats in the financial sector.
  • Increased compliance oversight pressure is reported across public sector cybersecurity, with leaders now required to prove security effectiveness, not just prevent attacks.