Major Incidents or Breaches

  • Charter Communications confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid [13].
  • Information allegedly stolen from 7-Eleven has been leaked, impacting approximately 185,000 individuals and exposing email addresses, names, addresses, and dates of birth [33].
  • Over 5,500 GitHub repositories were compromised in a campaign using Megalodon malware, resulting in theft of credentials and developer secrets [18].
  • More than 700 education and tech websites were hijacked in a large-scale ClickFix malware campaign, exploiting a Ghost CMS flaw to serve malicious Cloudflare verification pages [40].

Newly Discovered Vulnerabilities

  • Microsoft released patches for a critical remote code execution vulnerability in SharePoint (CVE-2026-45659), which could be exploited without specialized conditions [8][20].
  • A critical zero-day vulnerability in the KnowledgeDeliver learning management system was exploited to deploy the Godzilla web shell; the flaw involved hardcoded machineKey values that enabled ViewState deserialization attacks [12][35].
  • CISA ordered immediate patching of an actively exploited SQL injection vulnerability in Drupal CMS for US government agencies [17].
  • CISA urged urgent patching of a zero-day vulnerability in the LiteSpeed cPanel plugin that was exploited in the wild to execute scripts with root privileges [29].

Notable Threat Actor Activity

  • The ShinyHunters extortion group was responsible for threats and data leaks targeting Charter Communications and 7-Eleven [13][33].
  • The Iranian APT group MuddyWater conducted a new espionage campaign targeting organizations across nine countries, employing DLL side-loading techniques [6].
  • The Iranian APT known as Nimbus Manticore continued targeting aviation and software companies using updated tools [32].
  • The FBI warned that the Silent Ransom Group is sending operatives in person to law firms to physically insert USB drives and steal data [28].
  • Fake installers and plugins for popular software such as ChatGPT and Claude, distributed via GitHub and SourceForge, were found to deliver Deno RAT, granting attackers full device control [39].

Trends, Tools, or Tactics of Interest

  • Threat actors are increasingly augmenting attacks with AI tools, including real-time operational deployment of AI in offensive operations, smarter AI-driven DDoS attacks, and use of AI to generate plain-English remediation guidance for vulnerabilities [2][7][38][37].
  • AI chatbot recommendations are being abused to redirect users to cryptojacking malware sites in active campaigns [5].
  • Multi-factor authentication (MFA) prompt bombing remains a prevalent tactic to bypass second-factor protections [9].
  • Remote access trojans such as BTMOB are leveraging ready-made campaign tools to lower barriers for full device compromise on Android devices [4].
  • Microsoft Defender is testing automatic endpoint isolation to prevent lateral movement after compromise [15].
  • AppOmni’s Marlin AI and Varonis Atlas are leveraging AI for autonomous SaaS security investigation and AI governance, respectively [31][14].
  • Anthropic released a Claude Sandbox security plugin to assist developers in identifying vulnerabilities during coding and expanded Claude’s enterprise security governance with 28 new integrations, including major security vendors [30][34].

Regulatory or Policy Developments Affecting the Security Industry

  • The Indian Computer Emergency Response Team (CERT-In) issued guidelines mandating that critical vulnerabilities in internet-facing systems be patched within 12 hours of detection amid increased AI-assisted attacks [10].
  • CISA announced a revised schedule for town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure [27].

[2]: Report: Adversarial Use of AI is Evolving
[4]: BTMOB: A stealthy RAT burrowing deep into Android devices
[5]: AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
[6]: MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries
[7]: [THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back
[8]: Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions
[9]: MFA Prompt Bombing: Why Your Second Factor Isn’t Saving You
[10]: CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks
[12]: KnowledgeDeliver flaw exploited as a zero-day to install web shells
[13]: Charter confirms data breach after ShinyHunters extortion threat
[14]: How Varonis Atlas integrates Claude Compliance API for AI governance
[15]: Microsoft Defender can now automatically isolate hacked endpoints
[17]: CISA orders feds to patch actively exploited Drupal vulnerability
[18]: Feeding Frenzy: ‘Megalodon’ Malware Infects Thousands of GitHub Repos
[20]: Microsoft Issues Out-of-Band SharePoint Patch
[27]: CISA Announces Revised Town Hall Schedule to Engage with Stakeholders on Cyber Incident Reporting for Critical Infrastructure
[29]: CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day
[30]: Anthropic Releases New Claude Sandbox, Security Guidance Plugin
[31]: AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security
[32]: Iranian APT Targets Aviation, Software Companies With Updated Tools
[33]: 185,000 Likely Impacted by 7-Eleven Data Breach
[34]: Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations
[35]: Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment
[37]: Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images
[38]: AI Threat Landscape Digest March-April 2026
[39]: Fake software on GitHub and SourceForge distribute Deno RAT
[40]: 700+ education and tech websites hijacked in huge ClickFix malware campaign
[28]: FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data

Sources#

  1. Charter confirms data breach after ShinyHunters extortion threat - bleepingcomputer.com
  2. 185,000 Likely Impacted by 7-Eleven Data Breach - securityweek.com
  3. Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos - darkreading.com
  4. 700+ education and tech websites hijacked in huge ClickFix malware campaign - malwarebytes.com
  5. Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions - thehackernews.com
  6. Microsoft Issues Out-of-Band SharePoint Patch - darkreading.com
  7. KnowledgeDeliver flaw exploited as a zero-day to install web shells - bleepingcomputer.com
  8. Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment - securityweek.com
  9. CISA orders feds to patch actively exploited Drupal vulnerability - bleepingcomputer.com
  10. CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day - securityweek.com
  11. MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries - thehackernews.com
  12. Iranian APT Targets Aviation, Software Companies With Updated Tools - securityweek.com
  13. FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data - securityweek.com
  14. Fake software on GitHub and SourceForge distribute Deno RAT - malwarebytes.com
  15. Report: Adversarial Use of AI is Evolving - blog.knowbe4.com
  16. [THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back - thehackernews.com
  17. AI Threat Landscape Digest March-April 2026 - research.checkpoint.com
  18. Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images - securityweek.com
  19. AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites - thehackernews.com
  20. MFA Prompt Bombing: Why Your Second Factor Isn't Saving You - thehackernews.com
  21. BTMOB: A stealthy RAT burrowing deep into Android devices - welivesecurity.com
  22. Microsoft Defender can now automatically isolate hacked endpoints - bleepingcomputer.com
  23. AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security - securityweek.com
  24. How Varonis Atlas integrates Claude Compliance API for AI governance - bleepingcomputer.com
  25. Anthropic Releases New Claude Sandbox, Security Guidance Plugin - securityweek.com
  26. Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations - securityweek.com
  27. CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks - thehackernews.com
  28. CISA Announces Revised Town Hall Schedule to Engage with Stakeholders on Cyber Incident Reporting for Critical Infrastructure - cisa.gov