Saturday 2 May 2026

Major Incidents or Breaches

• Trellix confirmed a breach involving unauthorized access to a portion of its source code.
• Instructure, the company behind the Canvas learning platform, disclosed a cybersecurity incident and is investigating its impact.
• 30,000 Facebook accounts were compromised in a phishing campaign leveraging Google AppSheet as a phishing relay, attributed to a Vietnamese-linked operation.
• French authorities detained a 15-year-old suspected of selling data stolen in a cyberattack on the French government agency France Titres (ANTS).
• The FBI issued a warning about a surge in hacker-enabled cargo theft, with criminal groups hacking brokers and carriers to facilitate the theft and resale of cargo.
• Hugging Face and ClawHub platforms are being abused by threat actors for malware distribution, using social engineering to trick users into downloading malicious files.

Newly Discovered Vulnerabilities

• A critical Linux vulnerability, CVE-2026-31431 (“CopyFail”), allows attackers to gain root access on affected systems. Although patches are available, many systems remain unpatched.
• An actively exploited vulnerability in the cPanel/WHM admin interface allows attackers to access websites without authentication, putting millions of sites at risk.
• Poisoned Ruby gems and Go modules have been observed in a supply chain attack campaign, targeting CI pipelines for credential theft, GitHub Actions tampering, and further malware deployment.

Notable Threat Actor Activity

• A new criminal group, “Storm-2755,” is targeting Canadian employees with payroll hijacking attacks, using social engineering to compromise accounts and redirect payroll funds.
• China-aligned threat actors are conducting espionage campaigns against government and defense sectors across South, East, and Southeast Asia, as well as a NATO state, journalists, and activists.
• North Korean threat actors are responsible for 76% of all cryptocurrency stolen in 2026, with evidence suggesting increasing frequency and possible use of AI in their operations.
• Two cybercrime groups have been identified using vishing and SSO abuse to conduct rapid SaaS extortion attacks that leave minimal forensic traces.
• A phishing campaign is targeting senior executives through Microsoft Teams, using social engineering tactics to compromise high-value accounts.
• A member of the Scattered Spider group has been arrested, as reported in security news roundups.

Trends, Tools, or Tactics of Interest

• Cybercrime groups are increasingly abusing SaaS platforms, employing vishing and SSO abuse for rapid, high-impact extortion attacks.
• The use of Google AppSheet as a phishing relay represents a novel tactic for distributing phishing campaigns at scale.
• Supply chain attacks via poisoned open-source packages (Ruby gems, Go modules) remain a persistent threat, especially targeting CI/CD environments.
• The Deep#Door backdoor, a Python-based framework, is being deployed as a persistent Windows implant for espionage and disruption.
• AI agent integrations are being rapidly deployed into production environments without adequate security testing, leading to incidents such as unintended database deletions.
• Cisco has released an open-source tool for AI model provenance, aimed at addressing risks related to poisoned models and supply chain integrity.
• Microsoft has addressed issues with Remote Desktop security warnings and updated Windows 11 policies to allow IT admins greater control over pre-installed Store apps.
• Criminal IP has partnered with Securonix to integrate exposure-based intelligence into ThreatQ, automating threat analysis and investigation.

Regulatory or Policy Developments Affecting the Security Industry

• CISA, in collaboration with US and international partners, has released a guide for the secure adoption of agentic AI systems.
• Google has adjusted its bug bounty programme, increasing maximum rewards for certain Android exploits while reducing payouts for Chrome vulnerabilities, reflecting shifting priorities amid increased AI-related activity.
• The US Department of Justice sentenced two cybersecurity professionals to four-year prison terms for facilitating BlackCat ransomware attacks.
• OFAC has taken action against Iranian central bank crypto reserves as part of broader sanctions enforcement.