Major Incidents or Breaches

  • Basic-Fit, a major European gym chain, disclosed a data breach affecting one million customers, with hackers accessing personal information.
  • Booking.com confirmed unauthorized access to its systems, exposing sensitive reservation and user data and prompting a forced reset of reservation PINs.
  • Rockstar Games suffered a data breach involving analytics data, attributed to the ShinyHunters extortion gang, following a security incident at analytics provider Anodot.
  • CPUID, developer of CPU-Z and HWMonitor, was compromised, leading to the distribution of trojanized installers (STX RAT) via modified download links.
  • OpenAI rotated macOS code-signing certificates following a supply chain attack involving a malicious Axios package executed in a GitHub Actions workflow; the incident is linked to North Korea.
  • The Los Angeles Police Department reported a data breach, as highlighted in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

  • Adobe released an emergency fix for a zero-day vulnerability (CVE-2026-34621) in Acrobat and Reader, which has been exploited in the wild since at least December 2025. The flaw allowed remote code execution via malicious PDF files.
  • ShowDoc, a document management platform, is affected by a critical remote code execution vulnerability (CVE-2025-0520) that is actively exploited on unpatched servers.
  • A critical vulnerability in the wolfSSL library allows attackers to bypass certificate verification by exploiting improper handling of the hash algorithm or size in ECDSA signature checks.
  • CISA added six actively exploited vulnerabilities affecting Fortinet, Microsoft, and Adobe products to its Known Exploited Vulnerabilities (KEV) catalog, indicating ongoing exploitation.

Notable Threat Actor Activity

  • JanelaRAT, a financial malware derived from BX RAT, has been observed in an ongoing campaign targeting banks and financial institutions in Latin America, with over 14,700 attacks in Brazil in 2025. The latest variants show updates to infection chains and malware capabilities.
  • North Korea-linked APT37 (ScarCruft) is conducting a multi-stage social engineering campaign via Facebook, delivering the RokRAT malware to targets.
  • APT41, a Chinese state-backed group, is deploying a “zero-detection” backdoor to harvest cloud credentials from AWS, Google, Azure, and Alibaba environments, using typosquatting to obscure command-and-control communications.
  • The W3LL phishing network, responsible for global phishing campaigns and $20 million in fraud attempts, was dismantled in a joint operation by the FBI and Indonesian police, resulting in the arrest of the alleged developer.
  • A new commodity phishing kit, “Venom Stealer,” is enabling automation of ClickFix attacks, a social engineering technique used to bypass multi-factor authentication.
  • A new infostealer dubbed “Storm” leverages server-side decryption to hijack browser sessions, enabling attackers to bypass passwords and multi-factor authentication protections.
  • Fake Claude (Anthropic) websites are distributing PlugX RAT via DLL sideloading, using legitimate branding to lure victims and employing clean-up routines post-infection.
  • Russian-speaking threat actors compromised CPUID’s download infrastructure to distribute the STX RAT.
  • International law enforcement operations in the US, UK, and Canada targeted multimillion-dollar cryptocurrency theft schemes, identifying over $45 million in stolen assets and freezing $12 million.

Trends, Tools, or Tactics of Interest

  • Anthropic’s Claude Mythos AI model was temporarily restricted after autonomously discovering and exploiting zero-day vulnerabilities across major operating systems and browsers, prompting warnings of a potential “AI vulnerability storm.”
  • Attackers are increasingly scanning for webshells, including EncystPHP, with a focus on those lacking authentication or secured with default credentials.
  • There is a trend toward server-side decryption in infostealer malware, as demonstrated by the “Storm” infostealer, which enables session hijacking and circumvents MFA.
  • Social engineering via social media platforms (e.g., Facebook) continues to be leveraged by state actors for initial access and malware delivery.
  • Gmail has introduced end-to-end encryption for enterprise users on Android and iOS, allowing secure message composition and reading on mobile devices.

Regulatory or Policy Developments Affecting the Security Industry

  • Operational Technology (OT) asset owners are being required by regulators to attest to their post-quantum cryptographic readiness, despite lacking adequate tooling to provide genuine security assurances.
  • Civil society organizations have issued warnings to Meta regarding potential risks associated with facial recognition features in smart glasses, citing privacy and safety concerns for vulnerable populations.