Major Incidents or Breaches

  • Microsoft attributed a year-long series of intrusions into corporate Salesforce environments to threat actors linked to the ShinyHunters data-extortion group, who gained access without exploiting technical vulnerabilities in the Salesforce platform [3].
  • Japan’s largest taxi operator, Nihon Kotsu, shut down parts of its infrastructure following a cyberattack that compromised its systems [12].
  • Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands, resulting from a compromise at a third-party service provider [16].
  • The Jscrambler npm package was backdoored with infostealer malware and downloaded nearly 1,500 times before being taken down [13].
  • Google and Microsoft removed the ModHeader browser extension, used by 1.6 million users, after researchers discovered a hidden component collecting browsing history [5].
  • The Cybersecurity and Infrastructure Security Agency (CISA) published details of a data leak caused by a contractor uploading internal credentials, including AWS Govcloud keys, to GitHub [26].
  • Progress Software instructed customers to shut down ShareFile Storage Zone Controllers due to a credible security threat under investigation [35].

Newly Discovered Vulnerabilities

  • Critical remote code execution vulnerabilities in the iCagenda and Balbooa Forms Joomla extensions are being actively exploited by threat actors [15][34].
  • Zimbra patched a critical code execution vulnerability that allowed malicious code embedded in crafted emails to execute when the emails were opened [32].
  • A vulnerability in RabbitMQ enables unauthenticated attackers to obtain the broker’s OAuth client secret, potentially allowing full control over the broker [31].

Notable Threat Actor Activity

  • Russian state-backed hackers were jointly sanctioned by the EU and UK for coordinating cyberattacks and disinformation campaigns across Europe, with specific targeting of critical infrastructure and government entities [19][21][33].
  • US and allied cybersecurity agencies warned that Russian state actors are targeting vulnerable and misconfigured routers to gain access to critical infrastructure networks [20].
  • A new phishing-as-a-service operation, Forg365, is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle session theft, antibot evasion, and AI-assisted phishing page generation [8].
  • An unknown threat actor used an AI-generated PowerShell script to enumerate Active Directory environments during an intrusion [11].
  • The GigaWiper modular implant was identified, combining backdoor and wiper functionalities, allowing threat actors to select their preferred destructive attack method [23].
  • A new macOS infostealer, CrashStealer, poses as Apple’s crash reporting tool to harvest credentials, keychain data, and cryptocurrency wallets, using a notarized dropper to bypass Gatekeeper [4][14].

Trends, Tools, or Tactics of Interest

  • AI tools are increasingly used by threat actors to automate social engineering, phishing, and attack flows, making attacks more efficient and scalable [1][6][8][36].
  • The MemGhost attack demonstrates how a single malicious email can implant persistent false memories in AI agents with inbox access, affecting their operational decision-making [7].
  • Proof-of-concept “Ghostcommit” attack shows how malicious prompt injections can be hidden inside image files, potentially compromising AI systems during code reviews [39].
  • Open source tool “ScamBuster” leverages AI-driven victim personas to engage with email scammers, enabling data collection on phishing operations for organizations and law enforcement [24].
  • Organizations are forming “Yellow Teams” to both attack and defend AI systems, developing tools to test AI’s potential in cybersecurity from both perspectives [22].
  • The security industry is seeing a trend towards combining autonomous AI with analyst copilots in security operations centers to enhance detection and response [10].
  • Fake cryptocurrency gift card sites are becoming increasingly sophisticated and harder to distinguish from legitimate sites [40].

Regulatory or Policy Developments Affecting the Security Industry

  • The Pentagon suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program to conduct a comprehensive review and reform of contractor cybersecurity requirements [28].
  • The EU and UK jointly issued their first coordinated cyber sanctions package, targeting Russian individuals and entities for cyberattacks and disinformation campaigns [19][21][33].

Sources#

  1. Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths - thehackernews.com
  2. Japan's largest taxi operator shuts systems after cyberattack - bleepingcomputer.com
  3. Lidl discloses online shop breach after service provider hack - bleepingcomputer.com
  4. Hackers backdoor Jscrambler npm package with infostealer malware - bleepingcomputer.com
  5. Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found - thehackernews.com
  6. Lessons Learned from CISA’s Recent GitHub Leak - krebsonsecurity.com
  7. Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns - securityweek.com
  8. CISA warns of actively exploited RCE flaws in Joomla extensions - bleepingcomputer.com
  9. Organizations Warned of Exploited Joomla Extension Vulnerabilities - securityweek.com
  10. Zimbra Patches Critical Code Execution Vulnerability - securityweek.com
  11. RabbitMQ Vulnerability Threatens Enterprise Systems - securityweek.com
  12. EU sanctions Russian GRU military hackers over cyberattacks - bleepingcomputer.com
  13. Weak Security Continues to Fuel Russian Cyberattacks - darkreading.com
  14. EU Targets Russian Intelligence Officers Accused of Running a Yearslong Cyber Spying Campaign - securityweek.com
  15. US and allies warn of Russian critical infrastructure attacks - bleepingcomputer.com
  16. Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft - thehackernews.com
  17. Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory - thehackernews.com
  18. GigaWiper Lets Threat Actors Choose Their Own Destructive Attack - darkreading.com
  19. CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks - thehackernews.com
  20. New CrashStealer malware poses as Apple crash reporting tool - bleepingcomputer.com
  21. Report: Attackers Are Using AI to Automate Social Engineering - blog.knowbe4.com
  22. ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More - thehackernews.com
  23. AI Security Report 2026 - research.checkpoint.com
  24. New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email - thehackernews.com
  25. Ghostcommit attack hides malicious AI instructions in images - malwarebytes.com
  26. Turning the Tables on Email Scammers With 'ScamBuster' - darkreading.com
  27. 'Yellow Teams' Are Defining the Future of AI Security - darkreading.com
  28. Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots - thehackernews.com
  29. Fake crypto gift card sites are getting harder to spot - malwarebytes.com
  30. Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules - securityweek.com