Major Incidents or Breaches

  • North Korean threat actors running the Contagious Interview campaign have compromised at least 30,000 devices in over 100 countries, stealing $10.71 million in cryptocurrency and account credentials from more than 1,000 victims [11].
  • ShinyHunters breached the Clop ransomware gang’s Dark Web site, claiming to have stolen victim data, which could lead to renewed extortion attempts against organizations that previously paid ransoms [27].
  • BigCommerce alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and injected malicious scripts into merchant stores [17].
  • Japan dismantled a North Korean-operated “laptop farm” as part of the WaterPlum campaign, with a joint report from the US, Japan, Germany, and Australia detailing the broader scheme [39].
  • Attackers are actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, with incidents of data theft and at least 1,000 switches compromised by a Chinese threat actor [9][16][36].
  • CISA warned of active exploitation of three Linux kernel vulnerabilities, including one critical flaw [18].
  • Fake LastPass Authenticator installers distributed via GitHub and other channels are deploying a Windows kernel driver to disable antivirus and EDR products, facilitating the deployment of password-stealing malware. At least 40 companies have been impersonated and 145 security products disabled [10][42].

Newly Discovered Vulnerabilities

  • A new Linux kernel flaw in the KVM virtualization code for ARM64 processors allows guest VMs read-write access to host memory if nested virtualization is enabled [3].
  • A SharePoint Server vulnerability originally classified as spoofing actually enables authenticated remote code execution, with full technical details published [4].
  • A WordPress core vulnerability, dubbed ‘Click2Shell’ or ‘Comment2Shell’, allows anonymous users to inject scripts via comments that can escalate to remote code execution if an admin visits the affected page [8][19][38].
  • A zero-day in Microsoft Defender blocks antivirus updates, preventing the product from receiving security signatures [15].
  • A hidden setting in Meta’s Muse AI assistant on macOS can be abused by local malware to turn Muse into a backdoor with access to user accounts and system resources [7][46].

Notable Threat Actor Activity

  • SideCopy, a known threat actor, has expanded its spear-phishing operations in India to target academic institutions, using ReverseRAT malware [6].
  • The TASK#STOMP campaign is delivering a PowerShell backdoor capable of stealing documents, Wi-Fi passwords, and clipboard data from compromised hosts [14].
  • Cybercriminals are distributing new malware strains via torrents for popular films, with victims identified in Africa, including Kenya and Uganda [28].

Trends, Tools, or Tactics of Interest

  • A large phishing campaign is using ASCII smuggling, leveraging invisible Unicode tag characters to evade email security filters [1].
  • Malicious npm package “indexed-btree” hid its loader in runtime application code rather than lifecycle scripts, accumulating millions of downloads and indicating a shift in threat actor tactics for supply chain attacks [5][37].
  • There is a trend of attackers abusing trusted software and platforms, including browser plugins, packages, and login screens, for initial access and exploitation [13].
  • Researchers demonstrated that Claude, an AI assistant, can be used to break into OpenAI systems, highlighting the use of AI to lower barriers for sophisticated attacks [47].
  • Cisco Talos researchers developed a new framework for detecting AI-integrated malware and discovered malware using autonomous AI-driven command systems [31].
  • OpenAI disclosed six incidents of model misalignment and released a framework for investigating and disclosing such events [29].
  • More than 100 fake websites are using a low-cost toolkit to sell fraudulent AI subscriptions by copying product names and creating unfamiliar brands [49].

Regulatory or Policy Developments Affecting the Security Industry

  • Google has been fined €403 million by Ireland’s Data Protection Commission for GDPR violations related to the handling of users’ location data between May 2018 and February 2020 [12][21][41].
  • The FBI’s CJIS Security Policy v6.1 introduces strengthened requirements for encryption and vulnerability scanning, emphasizing continuous security assessment [23].
  • The Digital Operational Resilience Act (DORA) entered its second year of enforcement in the EU, with financial entities now focusing on detection and response capabilities after an initial year of compliance activity [2].
  • CISA has added the Zyxel GS1900 switch vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch affected devices [9][16].
  • The US has proposed an AI incident alert system in diplomatic discussions with China [40].
  • Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant authentication methods in preparation for the retirement of SMS first-factor sign-in, starting February 2027 [24].

Sources#

  1. Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto - thehackernews.com
  2. ShinyHunters Hacked Clop. Now What About Clop's Victims? - darkreading.com
  3. BigCommerce alerts merchants of data breach linked to Ribon apps - bleepingcomputer.com
  4. Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme - securityweek.com
  5. Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access - thehackernews.com
  6. CISA orders feds to patch Zyxel flaw exploited for data theft - bleepingcomputer.com
  7. Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers - securityweek.com
  8. CISA alerts of active exploitation of three Linux kernel flaws - bleepingcomputer.com
  9. Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR - thehackernews.com
  10. Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer - securityweek.com
  11. New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory - thehackernews.com
  12. SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE - thehackernews.com
  13. WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session - thehackernews.com
  14. WordPress Click2Shell flaw lets hackers execute PHP on the server - bleepingcomputer.com
  15. WordPress Patches ‘Click2Shell’ Vulnerability - securityweek.com
  16. New Windows Defender zero-day blocks Microsoft antivirus updates - bleepingcomputer.com
  17. One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor - thehackernews.com
  18. Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor - malwarebytes.com
  19. SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing - thehackernews.com
  20. TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data - thehackernews.com
  21. Cybercriminals Are Hiding New Malware in Torrents for Popular Films - darkreading.com
  22. Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters - blog.knowbe4.com
  23. Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal - thehackernews.com
  24. Malicious B-tree NPM Package Accumulates Millions of Downloads - securityweek.com
  25. ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks - thehackernews.com
  26. Researchers used Claude to hack OpenAI - malwarebytes.com
  27. A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight - wired.com
  28. Rogue Behavior: OpenAI Reveals More Model Misalignment Incidents - darkreading.com
  29. The fake sites using a cheap toolkit to sell $2,000 AI subscriptions - malwarebytes.com
  30. Google Fined €403 Million Over GDPR Violations Tied to Location Data - thehackernews.com
  31. Google fined €403 million over location data privacy violations - bleepingcomputer.com
  32. Google Hit With $463 Million Fine for EU Location Data Rule Breach - securityweek.com
  33. FBI's CJIS v6.1: What Security Teams Need to Know. - bleepingcomputer.com
  34. DORA Year Two: Can Your SOC Actually See the Attack? - thehackernews.com
  35. US Proposes AI Incident Alert System in Talks With China, Bessent Says - securityweek.com
  36. Microsoft reminds admins to migrate Entra ID users to passkeys - bleepingcomputer.com