Major Incidents or Breaches

  • Ukrainian government and healthcare organisations have been targeted in a data-theft malware campaign attributed to threat actor UAC-0247. The campaign utilised a new malware family, ‘AgingFly’, which steals authentication data from Chromium-based browsers and WhatsApp messenger.
  • Over 30 WordPress plugins within the EssentialPlugin package have been compromised, allowing unauthorized access and malware deployment on thousands of websites.
  • Digitally signed adware tools have been abused to deploy payloads with SYSTEM privileges, disabling antivirus protections on thousands of endpoints, including those in education, utilities, government, and healthcare sectors.
  • A coordinated campaign involving 100 malicious Chrome extensions has been identified, stealing user data and establishing backdoors via shared command and control infrastructure.
  • Sweden publicly attributed last year’s cyberattack on its energy infrastructure, specifically a heating plant, to a pro-Russian group.

Newly Discovered Vulnerabilities

  • A critical authentication bypass vulnerability in nginx-ui (CVE-2026-33032) is being actively exploited in the wild, enabling attackers to fully compromise Nginx servers, including restarting, creating, modifying, and deleting configuration files.
  • April Patch Tuesday updates addressed numerous critical vulnerabilities across Microsoft, Adobe, SAP, and Fortinet products. Notably, Microsoft patched a SharePoint zero-day and a Windows Task Host privilege escalation vulnerability, both of which have been actively exploited.
  • Two vulnerabilities in Ivanti Neurons for ITSM were patched, addressing risks of persistent access after account disablement and exposure of session information.
  • Microsoft and Salesforce patched prompt injection vulnerabilities in their AI agents (Copilot and Agentforce), which could have allowed attackers to leak sensitive data.
  • Researchers highlighted a ‘by design’ flaw in Anthropic’s Model Context Protocol (MCP), enabling unsanitized command execution and potential full system compromise in AI supply chains.

Notable Threat Actor Activity

  • UAC-0247 has been identified as responsible for recent attacks on Ukrainian clinics and government entities, deploying the ‘AgingFly’ malware for credential theft.
  • Pro-Russian threat actors were named by Swedish authorities as responsible for a cyberattack targeting critical energy infrastructure in Sweden.
  • Threat actors have weaponised n8n, an AI workflow automation platform, since October 2025 to conduct phishing campaigns and deliver malware via abused webhooks.
  • Mirax RAT, offered as malware-as-a-service primarily to Russian-speaking affiliates, is targeting Android users in Europe, converting devices into proxy nodes.
  • A Windows infostealer is being distributed through fake Proton VPN sites, malicious gaming mods, and GitHub/YouTube links, aiming to hijack accounts and drain cryptocurrency wallets.

Trends, Tools, or Tactics of Interest

  • Abuse of legitimate automation and workflow platforms (e.g., n8n) and signed software to bypass security controls and deliver malware is increasing.
  • Attackers are exploiting prompt injection vulnerabilities in AI-powered tools to exfiltrate sensitive data, highlighting the growing risks in AI agent ecosystems.
  • The emergence of malware campaigns using browser extensions and phishing emails (such as fake YouTube copyright notices) to compromise accounts and steal credentials.
  • AI-driven clickbait campaigns (e.g., Pushpaganda) are turning browser notifications into persistent scam delivery channels.
  • Long-running ransomware campaigns are targeting small businesses and homes, particularly in Turkey, often remaining undetected due to under-reporting.
  • Industrial automation systems continue to face a diverse range of infection vectors and malware types, with region- and industry-specific targeting noted in recent threat landscape reports.

Regulatory or Policy Developments Affecting the Security Industry

  • The US Congress is considering reauthorisation of a foreign surveillance program, with ongoing debate over privacy protections.
  • Regulatory complexity and differences in Asia’s digital supply chain are increasing security challenges, particularly with the integration of AI technologies.
  • An audit found that major technology companies, including Google, Meta, and Microsoft, often fail to comply with California privacy law opt-out requests for online tracking.