Saturday 12 September 2026

Major Incidents or Breaches

• The Florida Department of Highway Safety and Motor Vehicles confirmed a data breach of its DAVID driver database, with attackers accessing the system using stolen police credentials ^[11].
• Hackers compromised the Brevo email marketing platform, resulting in phishing emails being sent to at least 347,000 users of Trezor, BitBox, and CoinTracking. Other customers of Brevo may also be at risk ^[30][31].

Newly Discovered Vulnerabilities

• GitLab disclosed and patched a critical CVSS 10 vulnerability (path traversal) that allows unauthenticated attackers to read arbitrary files from GitLab servers. The flaw was exploited in the wild within hours of public disclosure ^[6][28].
• Critical and high-severity vulnerabilities in JFrog Artifactory are being exploited in chained attacks, enabling threat actors to bypass authentication, gain administrative privileges, and deploy Rust-based backdoor malware on vulnerable self-hosted servers ^[13].
• The BlueMoon exploit kit is chaining recent Chrome and Windows zero-day vulnerabilities in attacks attributed to multiple espionage-motivated threat actors ^[25].

Notable Threat Actor Activity

• Multiple threat groups, including financially motivated and state-sponsored actors from Russia and China, have abused Anthropic’s Claude AI model for a range of malicious purposes, including malware development, data theft, and attempts to extract secrets from 1.8 million Android apps ^{[8][9][10][14][22]}.
• Anthropic identified and disrupted industrial-scale illicit distillation attacks against its Claude AI model by seven China-based AI labs, including entities linked to Alibaba, Moonshot, DeepSeek, and Z.ai ^[7].
• Russian state-sponsored hackers used Claude to develop workflows for rebuilding malware after detection ^[9].
• Threat actors linked to ShinyHunters, Helix, and other extortion groups are using passkey and single sign-on-themed phishing attacks to compromise corporate Microsoft 365 accounts and steal data ^[12].
• An attacker used a semi-autonomous coding agent to harvest and resell LLM API access by exploiting poorly secured resale gateways and web flaws ^[24].
• The Gigabud Android banking Trojan creates a hidden copy of a victim’s banking app in a separate work profile to conceal fraudulent transactions ^[32].

Trends, Tools, or Tactics of Interest

• OAuth consent phishing attacks are targeting users of messaging apps, with the FBI issuing an advisory about campaigns focused on prominent individuals and their associates ^[1].
• Phishing campaigns are increasingly using SVG image files to deliver malicious JavaScript payloads to employees ^[3].
• There is a surge in AI-enabled phishing and fraud, with 60 percent of companies reporting increased losses and AI-generated phishing being the top concern ^[2][15][17].
• Threat actors are leveraging trusted AI platforms to host malicious content, poison search results, and distribute malware, increasing the attack surface for AI users ^[14].
• The use of AI agents and swarm attacks is altering the cyber kill chain, with attackers employing AI for staging, reconnaissance, lateral movement, and exfiltration ^[19].
• Invisible Unicode characters are being used to bypass phishing filters in email attacks ^[29].
• A major phishing campaign generated 1 million personalized fraud emails in three days using AI ^[15].
• Passkey and single sign-on-themed phishing attacks are being used to target Microsoft 365 users ^[12].
• Analysis of simulated phishing attacks suggests organizations should focus on measuring credential leaks and reporting rates, not just click rates, for security awareness ^[27].

Regulatory or Policy Developments Affecting the Security Industry

• A new joint government advisory from CISA signals a regulatory shift, calling for more transparent breach notification and incident response protocols ^[16].
• Meta is facing a proposed class action lawsuit alleging illegal harvesting of Facebook and Instagram photos to train AI image-generation and face recognition models ^[23].

Sources

1. Florida confirms DMV database breached via stolen police account - bleepingcomputer.com
2. Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack - securityweek.com
3. Crypto customers targeted by scammers after email marketing provider breach - malwarebytes.com
4. GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure - thehackernews.com
5. GitLab Vulnerability Exploited One Day After Disclosure - securityweek.com
6. Artifactory flaws chained in attacks deploying backdoor malware - bleepingcomputer.com
7. BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days - securityweek.com
8. Claude Used to Automate Exploitation and Data Theft Across Multiple Victims - thehackernews.com
9. Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection - thehackernews.com
10. Hackers abused Claude to extract secrets from 1.8M Android apps - bleepingcomputer.com
11. How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface - bleepingcomputer.com
12. From Hacks to Bioweapons, Claude Misuse Is Now Everywhere - wired.com
13. Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks - thehackernews.com
14. Passkey-themed phishing attacks lead to Microsoft 365 data theft - bleepingcomputer.com
15. The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th) - isc.sans.edu
16. Android malware creates a hidden copy of your banking app - malwarebytes.com
17. FBI Alert: OAuth Consent Phishing is Targeting Users of Messaging Apps - blog.knowbe4.com
18. Phishing Campaign Targets Employees with Malicious SVG Files - blog.knowbe4.com
19. Survey: Companies Cite Phishing as their Top AI-Enabled Fraud Concern - blog.knowbe4.com
20. Threat Actor Generates 1M Personalized Fraud Emails in 3 Days - darkreading.com
21. Why AI Is So Good at Scamming Humans - darkreading.com
22. Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain - darkreading.com
23. In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review - securityweek.com
24. Phishing Research Challenges Conventional Security Awareness Testing - securityweek.com
25. CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate - darkreading.com
26. Meta Sued Over Training Data for Its AI and Face-Recognition Systems - wired.com