Major Incidents or Breaches

  • Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack [15].
  • Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign [17][29].
  • Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them [47].
  • Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management [26].
  • Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide [13][21].
  • Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system [20].
  • International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet [19][36].
  • Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days [37].
  • A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping [33].

Newly Discovered Vulnerabilities

  • Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations [4][22].
  • F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems [5][24].
  • Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies [42].
  • Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation [44].
  • Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix [45].

Notable Threat Actor Activity

  • The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite [3][14].
  • The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays [11].
  • The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations [17][29].
  • A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities [8][16].
  • Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp [19][36].
  • The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes [33].
  • The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 [9].

Trends, Tools, or Tactics of Interest

  • There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise [20].
  • Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted [7].
  • Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked [6].
  • The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion [3][14].
  • The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data [43].
  • Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles [46].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials [13].
  • CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 [37].
  • New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements [10].

Sources#

  1. Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
  2. Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
  3. Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
  4. Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
  5. Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
  6. CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
  7. FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
  8. ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
  9. Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
  10. 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
  11. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
  12. ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
  13. Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
  14. Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
  15. F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
  16. F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
  17. Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
  18. Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
  19. Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
  20. Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
  21. Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
  22. DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
  23. Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
  24. USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
  25. INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
  26. ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
  27. Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
  28. Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
  29. Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
  30. The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com