Major Incidents or Breaches

  • Charter Communications suffered a data breach impacting 4.9 million accounts, with the ShinyHunters extortion group claiming responsibility for stealing personal information in early April [10].
  • Carnival Corporation confirmed a data breach affecting nearly 6 million people, also attributed to the ShinyHunters group, with exposed data including personal details of customers [20][34][42].
  • Customer data from more than 350 hotels worldwide was accessed as part of reservation-hijacking spear-phishing scams, enabling realistic phishing attacks against hotel guests [29].

Newly Discovered Vulnerabilities

  • A critical, unpatched zero-day vulnerability in Gogs, a self-hosted Git service, allows authenticated users to execute arbitrary code on affected instances. This vulnerability is accessible on Internet-facing deployments [5][16].
  • A critical authentication bypass vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) has been actively exploited by threat actors to deploy credential-stealing malware. Fortinet released hotfixes in April after zero-day exploitation was detected [6][15][36].
  • A security flaw in Gitea exposed 30,000 deployments to attacks, allowing attackers to pull private container images and potentially access source code, credentials, and infrastructure [39].

Notable Threat Actor Activity

  • The North Korean state-sponsored group Kimsuky deployed new tools, including HTTPSpy, HelloDoor, and VS Code Tunnels, in attacks targeting South Korean military and corporate entities [4].
  • The Russian-linked threat cluster GreyVibe has been targeting Ukrainian organizations using AI-generated lures and custom malware, leveraging tools such as ChatGPT and Gemini to enhance their operations [12][32].
  • The ShinyHunters extortion gang claimed responsibility for large-scale breaches at Charter Communications and Carnival Corporation, stealing millions of customer records [10][20][34][42].

Trends, Tools, or Tactics of Interest

  • The BTMOB Android remote access trojan is being distributed via a malware-as-a-service model, offering a builder interface for custom phishing payloads and enabling full device takeover, financial theft, data exfiltration, and remote access. It is spreading across Brazil and Latin America [13][26][35].
  • AI is increasingly being used by both defenders and attackers. GreyVibe uses ChatGPT and Gemini for attack lures, while new security tools such as Google’s AI Threat Defense platform and Edamame’s AI agent monitoring platform are being launched to counter AI-powered threats and monitor AI coding agents for intent drift and secret theft [12][32][38][41].
  • Fake ChatGPT download sites are distributing malware to both Windows and Mac users, with payloads tailored to each platform [44].
  • The FBI issued a warning about fake FIFA websites ahead of the 2026 World Cup, which are being used for fraud schemes including stealing personal and financial information and selling fake tickets [14].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft publicly advocated for Coordinated Vulnerability Disclosure (CVD), urging security researchers to work with vendors before publicizing zero-day vulnerabilities [7].
  • IBM and Red Hat announced a $5 billion investment in Project Lightwell, aiming to secure open source software supply chains and address vulnerabilities without disrupting production systems [37].

Sources#

  1. Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
  2. Carnival Cruise confirms data breach affecting nearly 6 million people - bleepingcomputer.com
  3. Carnival Data Breach Exposed 6 Million People - securityweek.com
  4. Carnival confirms data breach impacting nearly 6 million - malwarebytes.com
  5. Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks - wired.com
  6. Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code - thehackernews.com
  7. New Gogs zero-day flaw lets hackers get remote code execution - bleepingcomputer.com
  8. Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer - thehackernews.com
  9. Hackers exploit FortiClient EMS flaw to push infostealer malware - bleepingcomputer.com
  10. Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks - securityweek.com
  11. Gitea Vulnerability Exposed 30,000 Deployments to Attacks - securityweek.com
  12. Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels - thehackernews.com
  13. GreyVibe hackers use ChatGPT, Gemini to power cyberattacks - bleepingcomputer.com
  14. Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks - securityweek.com
  15. BTMOB Android malware service generates custom phishing payloads - bleepingcomputer.com
  16. BTMOB RAT Spreads Across Brazil, LatAm via MaaS Model - darkreading.com
  17. New BTMOB Android Malware Enables Full Device Takeover - securityweek.com
  18. New Edamame Platform Aims to Catch AI Coding Agents Going Off the Rails - securityweek.com
  19. Google Unveils AI Threat Defense Platform to Fight AI-Powered Cyberattacks - securityweek.com
  20. Fake ChatGPT download site infects Windows and Mac users with malware - malwarebytes.com
  21. FBI warns of fake FIFA websites running World Cup fraud schemes - bleepingcomputer.com
  22. Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal - thehackernews.com
  23. IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell” - securityweek.com