Major Incidents or Breaches

  • IMA Diligence Services suffered a data breach impacting 525,000 individuals, with personal information stolen from a legacy server managed by a third party [43].
  • A global stock exchange was compromised through a months-long email campaign, granting attackers access to a senior executive’s inbox for 150 days and enabling prolonged data exfiltration [31][42].

Newly Discovered Vulnerabilities

  • Two maximum-severity zero-day vulnerabilities affecting Acer Wave 7 mesh routers have been disclosed and are pending patches [22].
  • A critical remote code execution flaw (CVE-2026-45247) in the Mirasvit Cache Warmer extension for Magento has been added to CISA’s Known Exploited Vulnerabilities catalog [6].
  • A vulnerability in Microsoft 365 Android apps, caused by a leftover debug flag, allowed any app on the same device to steal account tokens, bypassing authentication restrictions [11][29].
  • A prompt injection vulnerability in Google Gemini’s voice assistant on Android enabled malicious notifications from apps such as WhatsApp or Slack to hijack the assistant and execute commands [8][30].
  • A one-click attack in Microsoft Visual Studio Code allowed attackers to steal users’ GitHub OAuth tokens simply by tricking them into clicking a link [13][38].
  • An unpatched Windows Search URI issue could allow attackers to steal users’ NTLMv2 hashes, similar to the previously reported CVE-2026-33829 [15].
  • Redis patched a two-year-old use-after-free vulnerability (CVE-2026-23479) that allowed authenticated users to execute arbitrary OS commands, discovered by an autonomous AI tool [12].
  • A new denial-of-service attack, dubbed the HTTP/2 Bomb, can crash web servers within seconds by exploiting the default configuration of major HTTP/2 servers [19][45].
  • CISA and other agencies warned of active exploitation of vulnerabilities in the Linux kernel and Android operating system, including a Linux kernel bug that allows privilege escalation and container escape [20][44].
  • Cisco warned about the availability of a proof-of-concept exploit for a critical Unified Communications Manager (Unified CM) vulnerability that allows unauthenticated remote server-side request forgery [37].

Notable Threat Actor Activity

  • Chinese-speaking cybercriminals have expanded operations into Europe, deploying the previously undocumented Atlas RAT malware in targeted attacks [16].
  • China-linked espionage groups have conducted cyber operations against at least a dozen Latin American nations, targeting sectors such as maritime shipping and oil production [27].
  • Pakistani threat actors used the Xeno RAT in espionage operations against Afghanistan’s Finance Ministry [25].
  • A new campaign abuses Google DoubleClick in malspam to deliver the DesckVB RAT, leveraging trusted domains to bypass detection [9].
  • Kaspersky researchers identified the Argamal RAT being distributed via infected hentai games, providing remote access to compromised machines [1].
  • Threat actors are actively exploiting vulnerabilities in WordPress plugins Kirki and Burst Statistics to escalate privileges and take over websites [40].
  • A malware distribution ecosystem was detailed involving impersonation, click hijacking, and traffic distribution systems (TDS) to deliver malicious payloads, often leveraging search engine results [47].
  • Infostealers are increasingly used as phishing payloads due to their scalability and availability, becoming a preferred method for cybercriminals [50].
  • Scammers are using legitimate hotel reservation information to craft highly targeted phishing attacks against travelers [2].
  • Scammers are exploiting geopolitical unrest, such as conflicts in the Middle East and Ukraine, to run charity scams [3].
  • Athletes and sports teams are increasingly targeted by advanced social engineering attacks [4].
  • A fake-invoice campaign was observed in its early stages, using social engineering and fear tactics to extract money and devices from victims [48].

Trends, Tools, or Tactics of Interest

  • Attackers are using Python scripts and AI to automate testing of malware against endpoint detection and response (EDR) solutions, improving evasion capabilities [26].
  • Continuous security testing is highlighted as essential, as traditional periodic penetration tests leave organizations exposed for long periods between assessments [21].
  • Enterprise identity and access management (IAM) is becoming increasingly fragmented, raising the need for identity visibility and intelligence platforms to reduce attack surfaces [14].
  • The AI Risk Quadrant has been introduced as a framework to evaluate the security of AI agents based on compromise vulnerability, impact, and defense strength [41].
  • Google is adding Android protections against AI deepfake scam calls, aiming to detect and flag calls using AI-generated voices for impersonation [24].
  • Social engineering attacks, such as those leveraging infostealers and fake invoices, remain prevalent and are being adapted to new vectors and payloads [48][50].
  • Scam Number Check tools are emerging to help users verify if a phone number is associated with scams before responding [49].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Nobitex, Iran’s largest cryptocurrency exchange, for facilitating ransomware-related and terrorist payments [17].
  • The US Department of Justice disrupted Southeast Asia-based cryptocurrency fraud networks, freezing 3.8 million dollars in assets [7].
  • European and international law enforcement agencies dismantled nine organized crime groups and arrested 29 suspects in a coordinated crackdown on illegal streaming operations [23].
  • CISA, the FBI, NSA, and Department of Energy issued a joint alert on cyberattacks targeting internet-exposed automatic tank gauge systems used in fuel and logistics sectors [18].
  • Microsoft responded to criticism regarding legal threats against security researchers who publicly disclose zero-day vulnerabilities, seeking to address concerns over responsible disclosure practices [46].
  • Cyber insurance rates are reportedly dropping, but policy exclusions are widening, particularly regarding coverage for social engineering attacks [28].

Sources#

  1. IMA Diligence Services Data Breach Impacts 525,000 People - securityweek.com
  2. Global Stock Exchange Hit by Monthslong Email Campaign - darkreading.com
  3. Hackers Target Global Stock Exchange in Espionage Operation - securityweek.com
  4. Acer working to patch max severity zero-days in Wave 7 routers - bleepingcomputer.com
  5. CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog - thehackernews.com
  6. Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag - thehackernews.com
  7. Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover - darkreading.com
  8. WhatsApp, Slack Notifications Could Hijack Google Gemini on Android - thehackernews.com
  9. Malicious Notifications Could Trick Google Gemini Users - darkreading.com
  10. One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens - thehackernews.com
  11. VS Code Vulnerability Allows One-Click GitHub Token Theft - securityweek.com
  12. Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes - thehackernews.com
  13. Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) - thehackernews.com
  14. New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute - bleepingcomputer.com
  15. ‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds - securityweek.com
  16. CISA warns of active attacks exploiting Android, Linux bugs - bleepingcomputer.com
  17. Organizations Warned of Exploited Linux Kernel Vulnerability - securityweek.com
  18. Cisco Warns of Available PoC for Critical Unified CM Vulnerability - securityweek.com
  19. Chinese hackers use new Atlas RAT malware in European cyberattacks - bleepingcomputer.com
  20. Tropical Blend: Cyber & Politics Ramp Up Across Latin America - darkreading.com
  21. Pakistan Spies on Afghan Finance Ministry With Xeno RAT - darkreading.com
  22. Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT - thehackernews.com
  23. Argamal: Malware hidden in hentai games - securelist.com
  24. Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs - securityweek.com
  25. Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - research.checkpoint.com
  26. Infostealers are becoming the go-to phishing payload - malwarebytes.com
  27. Phishing Attacks Are Using Real Hotel Reservation Info to Target Travelers - blog.knowbe4.com
  28. Warning: Scammers are Exploiting Geopolitical Unrest - blog.knowbe4.com
  29. Athletes Are Increasingly Targeted by Social Engineering Attacks - blog.knowbe4.com
  30. We found this fake-invoice campaign while scammers were still building it - malwarebytes.com
  31. Attackers Use AI to Automate EDR Evasion Testing - darkreading.com
  32. What 345 Days of Untested Exposure Looks Like at a Bank - bleepingcomputer.com
  33. Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP) - thehackernews.com
  34. Security of 100 AI Agents Tested and Ranked – What You Need to Know - securityweek.com
  35. Google adds Android protection against AI deepfake scam calls - bleepingcomputer.com
  36. Keep getting calls from questionable numbers? Meet Scam Number Check - malwarebytes.com
  37. U.S. sanctions Nobitex crypto exchange used by Iranian ransomware actors - bleepingcomputer.com
  38. DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets - thehackernews.com
  39. Police dismantles 9 crime groups in illegal streaming crackdown - bleepingcomputer.com
  40. CISA warns of cyberattacks targeting fuel tank monitoring systems - bleepingcomputer.com
  41. Microsoft Tries to Calm Legal Threat Fears After Zero-Day Disclosure Backlash - securityweek.com
  42. Cyber Insurance Rates Are Dropping, but Exclusions Widen - darkreading.com