Major Incidents or Breaches

  • The Police National Legal Database (PNLD) in the UK suffered a cyberattack resulting in the exposure and dark web publication of contact information for over 100,000 police officers, government employees, and criminal justice professionals [10][16].
  • A cyberattack targeted Liechtenstein’s Register of People Behind Companies and Foundations, impacting a registry used for anti-money laundering and counter-terrorism efforts [31].
  • Brinks Home disclosed a data breach with hackers leaking files, though alarm monitoring and system functionality were reportedly unaffected [35].
  • River Bank confirmed that data stolen in a June ransomware attack was subsequently deleted by the attackers, with investigations ongoing [32].
  • Brazilian educational institutions have experienced multiple security incidents, as detailed in a new analysis of response cases [1].

Newly Discovered Vulnerabilities

  • An authentication bypass vulnerability (CVE-2026-18577) in N-able N-central remote monitoring and management servers has been exploited in the wild, allowing attackers to gain administrator access. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, and N-able has released patches following reports of active exploitation and patch bypasses [3][15][19][34].
  • Recent vulnerabilities in SonicWall SMA 1000 VPN appliances have been exploited by ransomware actors for root access and lateral movement within victim networks [6][36].

Notable Threat Actor Activity

  • The INC Ransomware operation has emerged as the leading group exploiting SonicWall SMA 1000 vulnerabilities, using these flaws for initial access and subsequent ransomware deployment [6][36].
  • Russian threat actor Midnight Blizzard (APT29) has been linked to a global campaign targeting hospitality Wi-Fi networks, using custom malware to breach Microsoft 365 accounts [11].
  • A Chinese-speaking threat actor is using a leaked version of the DarkSword exploit kit to deploy GHOSTBLADE malware targeting Apple iOS devices [9].
  • Another Chinese threat actor weaponized the Deepseek AI agent to attack a security firm, attempting proxyjacking across over 1,200 hosts [22].
  • Eighteen malicious npm packages have been discovered delivering a cross-platform remote access trojan (RAT) to users of Alibaba developer tools [4].
  • The ExfilSquad hacking group leaked information for over 100,000 UK police officers and staff following the PNLD breach [16].
  • Fake Roblox Xeno Executor installers are being used to distribute infostealer and RAT malware to Roblox players [14].

Trends, Tools, or Tactics of Interest

  • Device code phishing attacks have increased by 1,500 percent in 2026, with vishing incidents doubling, reflecting the rise of social engineering techniques that bypass traditional security controls [18].
  • A new Russian loader-as-a-service, DOUBLECUP, uses ClickFix techniques to hide malware in browser cache images, delivering payloads to both Windows and macOS devices [13].
  • Threat actors are increasingly abusing trusted platforms and supply chains, including npm packages and Google Password Manager’s passkey sync, to compromise user accounts and systems [4][5][12][26].
  • Researchers have identified three new “Pass-ta-key” attacks that allow malware on compromised Windows devices to hijack Google-synced passkeys, bypassing user verification [5][12].
  • The BTMOB Android RAT ecosystem has grown into a fragmented underground business with resellers, source-code vendors, and custom versions [17].
  • AI platforms such as Claude, Codex, and Cursor are being integrated into security operations for detection writing, investigation, and response [8][21][26].
  • New tools for tracing the origins of AI-generated videos have been developed, aiming to improve detection and attribution of deepfakes [20].
  • WhatsApp and TikTok-related scams continue, with social engineering targeting account takeover and delivering unwanted applications or fraudulent charges [38][39].

Regulatory or Policy Developments Affecting the Security Industry

  • The European Union has begun enforcement of key provisions of the AI Act, requiring increased transparency for chatbots, deepfakes, and other consumer-facing AI systems [40].
  • California launched the Delete Request and Opt-out Platform (DROP), enabling residents to send mass deletion and opt-out requests to registered data brokers [41].
  • New York awarded $9 million in grants to enhance cybersecurity at 153 water systems in response to ongoing threats to water and wastewater infrastructure [28].
  • Visa announced the acquisition of fraud intelligence firm BioCatch for $2.4 billion to strengthen account takeover and fraud prevention capabilities for financial institutions [30].

Sources#

  1. PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web - thehackernews.com
  2. ExfilSquad hackers leak info of over 100,000 UK police officers, staff - bleepingcomputer.com
  3. Cyberattack Hits Liechtenstein’s Register of People Behind Companies and Foundations - securityweek.com
  4. Brinks Home Discloses Data Breach as Hackers Leak Files - securityweek.com
  5. River Bank Says Hackers Deleted Data Stolen in Ransomware Attack - securityweek.com
  6. An analysis of incidents at Brazilian educational institutions - securelist.com
  7. CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises - thehackernews.com
  8. N-able warns of N-central auth bypass flaw exploited in attacks - bleepingcomputer.com
  9. Attackers Exploit N-able Patch Bypass Flaw on RMM Servers - darkreading.com
  10. N‑able Patches Vulnerability Exploited to Hack N-central Servers - securityweek.com
  11. INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws - thehackernews.com
  12. Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks - securityweek.com
  13. Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts - bleepingcomputer.com
  14. Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS - thehackernews.com
  15. Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm - darkreading.com
  16. 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users - thehackernews.com
  17. Fake Roblox Xeno script launcher pushes infostealer, RAT malware - bleepingcomputer.com
  18. Device Code Phishing Up 1,500% in 2026; Vishing Doubles - darkreading.com
  19. New DOUBLECUP ClickFix service hides malware in browser cache images - bleepingcomputer.com
  20. Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts - thehackernews.com
  21. New Pass-ta-key attacks let malware hijack Google-synced passkeys - bleepingcomputer.com
  22. What cybersecurity experts are talking about in 2026 - virusbulletin.com
  23. Inside the Underground Business of the Android BTMOB RAT malware - bleepingcomputer.com
  24. FOMO in the SOC: Where AI Platforms like Claude Actually Fit - thehackernews.com
  25. Anthropic: Claude Attacks Result of Security Gaps, Not Model Issues - darkreading.com
  26. New Tool Traces AI Videos Back to Their Source - darkreading.com
  27. WhatsApp account takeover scam asks you to “vote for my friend” - malwarebytes.com
  28. “Adult TikTok” searches lead to scams - malwarebytes.com
  29. The AI Act kicks into action, forces companies to be clear about AI chatbots - malwarebytes.com
  30. Californians can tell data brokers to DROP their information - malwarebytes.com
  31. New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems - securityweek.com
  32. Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion - securityweek.com