Major Incidents or Breaches

  • Google, in coordination with the FBI and industry partners, disrupted the NetNut residential proxy network, which relied on millions of compromised home devices to anonymize cybercriminal and nation-state activity. Hundreds of domains associated with NetNut were seized, significantly degrading the network’s operations [4][25][26].
  • A dual US-Estonian citizen alleged to be a member of the Scattered Spider hacking collective was extradited to the United States to face charges [18].
  • European Parliament members investigating Pegasus spyware were themselves targeted, with Citizen Lab confirming Pegasus infection on one investigator’s phone [24].

Newly Discovered Vulnerabilities

  • A critical vulnerability in the Cursor AI code editor (DuneSlide) allows zero-click prompt injection attacks that escape the editor’s sandbox and can execute arbitrary code at the operating system level [27].
  • A new WinRAR security flaw has been patched that could allow attackers to take control of a user’s computer. The lack of automatic updates in WinRAR increases the risk of unpatched systems [37].
  • A vulnerability in Apple’s Hide My Email feature, first reported a year ago, remains unpatched and exposes user email addresses [35].

Notable Threat Actor Activity

  • Ransomware groups, including those associated with Anubis, are exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability for initial access and are also leveraging bring-your-own-vulnerable-driver (BYOVD) and supply chain credential theft tactics [5][28].
  • The threat actor ToddyCat is deploying new Umbrij malware that abuses OAuth to access Gmail accounts via the Google API, enabling covert email access [7].
  • Attackers linked to the FortiBleed campaign have harvested credentials from hundreds of thousands of FortiGate firewalls and are collaborating with the INC and Lynx ransomware gangs, also exploiting a Nextcloud zero-day vulnerability [21][30].
  • Ransomware operators are running campaigns that impersonate Interpol, targeting small businesses globally using basic social engineering techniques [22].
  • KnowBe4 ThreatLabs tracked phishing campaigns targeting the FIFA World Cup 2026, with cybercriminals leveraging the event for credential theft and malware distribution [3].
  • ClickFix and ConsentFix attacks are hijacking Microsoft 365 accounts in seconds by exploiting OAuth flows and fake prompts to bypass MFA protections [13][36].
  • Fake Google and Cloudflare verification pages are distributing multiple malware families, including infostealers and a new malware loader, through ClickFix-style social engineering [36].

Trends, Tools, or Tactics of Interest

  • Immediate exploitation of newly disclosed vulnerabilities, such as CitrixBleed, is increasing, with attackers using public proof-of-concept code to target NetScaler appliances [28].
  • The first fully autonomous ransomware attack orchestrated by an AI agent (JADEPUFFER) was observed, exploiting a Langflow RCE vulnerability to automate a database ransomware campaign from start to finish [9].
  • ConsentFix and ClickFix attacks demonstrate a trend of using rapid OAuth token theft and social engineering to bypass MFA and compromise cloud accounts [13][36].
  • Opera has introduced a Paste Protect feature to mitigate ClickFix-style attacks by blocking malicious command execution via social engineering [17].
  • Context manipulation attacks, such as BioShocking, can trick agentic browsers into exfiltrating sensitive credentials by bypassing their safety guardrails [33].
  • Compromise assessment projects highlight persistent threats, missed incidents, and gaps in incident response across organizations, emphasizing the need for improved detection and response practices [1].
  • Identity lifecycle management models are being challenged by the proliferation of AI agents, which lack traditional employment records and departure dates, complicating access governance [8].
  • IBM and Red Hat have launched Project Lightwell, assigning 20,000 engineers to address open-source software supply chain risks identified by Anthropic’s Mythos AI bug-finding technology [23].
  • There is a shift in cybercrime pressure toward small and medium-sized businesses in Australia as larger institutions improve safeguards and regulatory compliance [19].

Regulatory or Policy Developments Affecting the Security Industry

  • The Court of Justice of the European Union dismissed Google’s final appeal against a €4.1 billion antitrust fine related to Android’s promotion of Chrome and search, upholding significant regulatory action against the company [12].
  • The Trump administration lifted restrictions on Anthropic’s Claude AI models following cybersecurity concerns, making Claude Fable 5 widely available again [31].
  • Apple has revised its long-standing patch policy to accelerate patch cycles in response to attackers leveraging AI to reduce time to exploit, indicating a move toward more rapid security updates [20].

Sources#

  1. Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices - thehackernews.com
  2. FBI Seizes NetNut Proxy Platform, Popa Botnet - krebsonsecurity.com
  3. Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices - securityweek.com
  4. Alleged Scattered Spider hacker extradited to the United States - bleepingcomputer.com
  5. EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones - wired.com
  6. Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution - securityweek.com
  7. WinRAR flaw could allow attackers to take control of your computer - malwarebytes.com
  8. Apple’s Hide My Email doesn’t hide it very well - malwarebytes.com
  9. Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials - thehackernews.com
  10. New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure - securityweek.com
  11. ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API - thehackernews.com
  12. FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs - darkreading.com
  13. FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks - securityweek.com
  14. Ransomware Thugs Masquerade as Interpol to Entice Small Biz - darkreading.com
  15. Cybercriminals Are Targeting the FIFA World Cup 2026 - blog.knowbe4.com
  16. ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds - bleepingcomputer.com
  17. Fake Google and Cloudflare verification pages spread multiple malware families - malwarebytes.com
  18. AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack - thehackernews.com
  19. Opera rolls out Paste Protect feature to fight ClickFix attacks - bleepingcomputer.com
  20. ‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials - securityweek.com
  21. Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects - securelist.com
  22. Identity Lifecycle Management Wasn't Built for AI Agents - thehackernews.com
  23. Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them. - darkreading.com
  24. Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs - darkreading.com
  25. Google loses final appeal to overturn €4.1 billion EU fine - bleepingcomputer.com
  26. Trump Administration Lifts Restrictions on Anthropic’s Claude Models After Cybersecurity Alarm - securityweek.com
  27. Apple Reverses Age-Old Patch Policy to Keep Up With AI - darkreading.com