Major Incidents or Breaches

  • Malicious Docker images were uploaded to the official “checkmarx/kics” repository on Docker Hub, impacting the software supply chain.
  • A self-propagating worm compromised npm packages, stealing developer tokens and spreading via compromised npm accounts.
  • The Lotus Wiper malware was deployed in destructive attacks against the Venezuelan energy sector, targeting recovery mechanisms and systematically deleting files.
  • Moltbook, a social network for AI agents, exposed 35,000 email addresses and 1.5 million agent API tokens due to an unsecured database.
  • A malicious trading website impersonating TradingView AI agents was used to deliver malware capable of hijacking browsers and stealing financial data.
  • A researcher claims the Claude Desktop application for macOS installs spyware, raising privacy and security concerns.

Newly Discovered Vulnerabilities

  • Microsoft released an out-of-band patch for CVE-2026-40372, a critical privilege escalation vulnerability in ASP.NET Core.
  • Apple issued out-of-band security updates for iOS to fix a Notification Services bug that retained deleted notification data on devices.
  • A recent Microsoft Defender vulnerability was exploited as a zero-day, allowing attackers to access the SAM database, extract NTLM hashes, and gain SYSTEM privileges.
  • A high-severity command-injection vulnerability (CVE-2025-29635) in D-Link DIR-823X routers, which are end-of-life, is being actively exploited by Mirai botnet operators.
  • Researchers identified a remote code execution vulnerability in Google Antigravity, with evidence of cybercriminal abuse.
  • Oracle’s April 2026 Critical Patch Update addressed 481 security issues, including over 300 remotely exploitable, unauthenticated vulnerabilities across 28 product families.
  • Claude Mythos, an AI tool, identified 271 vulnerabilities in Mozilla Firefox, all confirmed by Mozilla as discoverable by skilled human researchers.

Notable Threat Actor Activity

  • Threat actors are abusing agentic AI workflow automation platforms, such as n8n, to deliver malware and conduct phishing campaigns.
  • North Korean (DPRK) actors are using AI tools to enhance malware development, create fake company websites, and conduct large-scale financial theft, reportedly stealing up to $12 million in three months.
  • DPRK-linked campaigns are self-propagating via compromised developer repositories, spreading RATs and other malware through “contagious interviews.”
  • North Korean hackers are using AppleScript and ClickFix in new macOS attacks, targeting cryptocurrency, venture capital, and blockchain organizations.
  • The Kyber ransomware group is targeting Windows and VMware ESXi systems, with one variant implementing Kyber1024 post-quantum encryption.
  • The Harvester threat actor deployed a Linux variant of the GoGra backdoor in South Asia, using Microsoft Graph API and Outlook inboxes for stealthy command and control.
  • The Gentlemen ransomware group has rapidly scaled operations, demonstrating increasing sophistication and operational speed.
  • Mirai-based botnets are leveraging publicly disclosed exploits to target discontinued D-Link routers.

Trends, Tools, or Tactics of Interest

  • Supply chain attacks are increasing, with attackers exploiting npm and Docker ecosystems to propagate malware and steal credentials.
  • Fraud operations are adopting “Caller-as-a-Service” models, mimicking legitimate call centers with structured hiring, training, and performance tracking.
  • Threat actors are increasingly leveraging AI workflow automation platforms for phishing and malware delivery.
  • There is a rise in attacks exploiting cross-application permission combinations, as highlighted by the Moltbook incident.
  • Post-quantum encryption is being tested in ransomware operations, as seen with the Kyber group.
  • Use of legitimate cloud APIs (e.g., Microsoft Graph API) for malware command and control is becoming more prevalent.
  • Security teams are struggling to operationalize SBOM (Software Bill of Materials) data, raising concerns about supply chain attack mitigation.
  • DDoS attacks continue to target decentralized social media platforms, with Mastodon experiencing a major outage that was mitigated within hours.

Regulatory or Policy Developments Affecting the Security Industry

  • The UK’s National Cyber Security Centre (NCSC) chief stated that the most serious cyber threats to the UK now originate from Russia, Iran, and China, warning businesses to prepare for potential large-scale attacks in the event of international conflict.