Major Incidents or Breaches

  • CPUID, the official distributor of CPU-Z, HWMonitor, and related hardware monitoring tools, was compromised for less than 24 hours. During the breach, unknown threat actors trojanized legitimate software downloads with the STX Remote Access Trojan (RAT).
  • An international law enforcement operation led by the UK National Crime Agency identified over 20,000 victims of cryptocurrency fraud across the UK, United States, and Canada.

Newly Discovered Vulnerabilities

  • Adobe released emergency security updates for Acrobat Reader to address CVE-2026-34621, a critical vulnerability that has been under active exploitation for months. The flaw allows for arbitrary code execution.

Notable Threat Actor Activity

  • Threat actors behind the CPUID breach used the compromised website to distribute the STX RAT via trojanized installers of CPU-Z and HWMonitor, targeting users seeking legitimate system monitoring utilities.

Trends, Tools, or Tactics of Interest

  • Law enforcement is increasingly targeting large-scale cryptocurrency fraud schemes, as evidenced by the recent international crackdown identifying tens of thousands of victims.
  • There is ongoing exploitation of push notification data by law enforcement agencies such as the FBI, raising concerns over user privacy and the security of notification ecosystems.