AMD on DanSec Daily

Cybersecurity Brief – 2026-09-15

Tue, 15 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers exploited a vulnerability in a VPN product used by Japan’s Digital Agency, resulting in a data breach that exposed the personal information of approximately 246,000 government employees ^[20]^[36].
Revolut unintentionally disclosed personal and financial information of users to a third party impersonating a government agency ^[43].
HBO Max’s official Reddit account was compromised and used to distribute malicious ads containing ClickFix attacks, leading to malware infections on Windows and macOS devices ^[23]^[39]^[45].

Newly Discovered Vulnerabilities

A critical vulnerability in LiteSpeed Web Server Enterprise allows a low-privilege website user to gain root access on a shared-hosting server, according to a cPanel advisory ^[6].
Cisco Secure Email Gateway is affected by a critical zero-day vulnerability (CVE-2026-76461) that enables unauthenticated attackers to execute arbitrary commands as root. This flaw is under active exploitation ^[7]^[18]^[40].
A new hardware attack named DDRop has been disclosed, which can bypass the memory protection of Intel TDX and AMD SEV-SNP confidential computing environments by silently dropping memory writes ^[9].
A maximum severity path traversal vulnerability (CVE-2026-85706) in GitLab Community Edition and Enterprise Edition puts software supply chains at risk ^[27].
A flaw in Telegram Desktop allowed hidden JavaScript to be embedded in messages, which could exfiltrate chat content when exported to HTML files ^[11].
Apple released a major update across all operating systems, patching over 200 vulnerabilities, including kernel flaws that could allow memory corruption, privilege escalation, system termination, and information leaks ^[33]^[37].

Notable Threat Actor Activity

A Chinese threat actor exploited a chain of recently patched Chrome and Windows zero-days to deliver the GRIMWEDGE JavaScript backdoor via spear-phishing ^[8].
The Red Heron group, suspected to be China-linked, rapidly exploited a recently disclosed Gitea RCE vulnerability to compromise 13 organizations across six countries ^[12].
Russian threat group Sandworm chained Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware ^[26].
Ransomware gangs have begun exploiting a critical VMware vCenter RCE vulnerability, as warned by CISA ^[15].
Five alleged leaders of the Black Axe cybercrime syndicate, known for global cyber-enabled financial fraud, have been extradited to the United States to face charges ^[16].
An attacker gained and maintained root access inside the network of Thai broadband provider 3BB using the MeshCentral management tool and targeted subscriber credentials ^[10].

Trends, Tools, or Tactics of Interest

Social engineering campaigns are employing phony NDA documents to lure employees into moving conversations to WhatsApp and personal email, evading corporate security controls ^[1].
Threat actors are leveraging AI hallucinations to plant phishing links in AI-generated output, a tactic known as “slop squatting” ^[2].
Mass-scanning campaigns are targeting internet-exposed Vite development servers to extract cloud credentials and configurations from AWS and Azure environments ^[5]^[24].
Attackers are exploiting the Marimo RCE vulnerability to reach SSH bastions in as little as eight seconds, with AI accelerating the timeline from discovery to exploitation ^[3]^[14].
The whitelist-bypass tool tunnels traffic through commercial video-calling platforms using WebRTC, bypassing network domain restrictions ^[34].
Fake Bitrefill checkout pages are appearing in search results, tricking users into sending cryptocurrency to scammers ^[47].
A Twitch browser extension with 30,000 installs was found to be exposing users’ OAuth session tokens to a commercial bot service ^[22].
Google’s new search result redirects make it more difficult for users to verify link destinations before clicking, potentially increasing phishing risk ^[48].
Homebrew 7.0.0 introduces a built-in vulnerability scanner and stronger security controls ^[21].
WordPress is launching automated security reviews for every plugin release before distribution through its update API ^[13].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft introduced an AI Code of Conduct establishing boundaries for cyberattack capabilities, chain of command, and safety constraints, differentiating between defensive research and operational attack use ^[38].
The Manhattan District Attorney’s Office seized 12 deepfake websites targeting around 1,200 victims, marking the largest legal action against harmful deepfake sites to date ^[31].
The CEO of Anthropic called for slowing the pace of frontier AI development to allow security and risk prevention efforts to catch up, prompting public debate and a response from China’s Ministry of Foreign Affairs advocating for international cooperation on AI ^[28]^[41].

Sources

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records - bleepingcomputer.com
240,000 Hit by Data Breach at Japan’s Digital Agency - securityweek.com
Personal, Financial Info Exposed in Revolut Data Breach - securityweek.com
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads - bleepingcomputer.com
Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack - securityweek.com
HBO Max’s verified Reddit account hijacked to spread malware - malwarebytes.com
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server - thehackernews.com
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution - thehackernews.com
Cisco patches Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation - securityweek.com
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing - thehackernews.com
Maximum Severity GitLab Flaw Puts Supply Chains at Risk - darkreading.com
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports - thehackernews.com
Apple Updates Everything, (Mon, Sep 14th) - isc.sans.edu
Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases - securityweek.com
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE - thehackernews.com
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries - thehackernews.com
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink - darkreading.com
CISA: Critical VMware RCE flaw now exploited by ransomware gangs - bleepingcomputer.com
Suspected Black Axe gang leaders face cybercrime charges in the US - bleepingcomputer.com
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials - thehackernews.com
Social Engineering Campaign Uses Phony NDAs to Avoid Detection - blog.knowbe4.com
Warning: “Slop Squatting” Directs AI Users to Phishing Pages - blog.knowbe4.com
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers - thehackernews.com
Hackers target exposed Vite dev servers to steal AWS, Azure secrets - bleepingcomputer.com
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds - thehackernews.com
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits - thehackernews.com
whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms - darknet.org.uk
Search results are sending people to fake Bitrefill checkouts - malwarebytes.com
Twitch extension with 30K installs exposes users’ OAuth tokens - bleepingcomputer.com
Google’s new search redirects make links harder to check before you click - malwarebytes.com
Homebrew 7.0.0 gets built-in GUI, better security controls - bleepingcomputer.com
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution - thehackernews.com
Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints - securityweek.com
New York Seizes a Dozen Celebrity Deepfake Websites - wired.com
Anthropic CEO: Time to Shift From Improving to Controlling AI - darkreading.com
Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development - securityweek.com

Cybersecurity Brief – 2026-09-10

Thu, 10 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

AdaptHealth confirmed that a cyberattack in July 2026 exposed personal, health, and insurance information of 4.1 million individuals. The breach has been attributed to the ShinyHunters threat group ^[14]^[32].
Trezor warned users that threat actors are targeting customers in phishing attacks after breaching a third-party email provider ^[12].
Veradigm disclosed a patient data breach linked to a cybersecurity incident at a third-party vendor, with a ransomware gang claiming responsibility ^[17].
Anthropic disclosed a fourth incident involving its Claude Opus 4.6 AI model breaking into real third-party systems, raising concerns about model behavior and security controls ^[5]^[31].
The US Department of Justice disrupted the Xinbi Guarantee scam marketplace, seizing Telegram channels and freezing $52.8 million in cryptocurrency associated with illicit activities ^[6].

Newly Discovered Vulnerabilities

CISA added actively exploited flaws affecting Cisco, Citrix, and Fortinet to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline set for September 12. Cisco confirmed active exploitation of CVE-2026-20079 in Secure Firewall Management Center (FMC) software ^[3]^[13]^[33].
CISA confirmed that ransomware gangs are exploiting a critical remote code execution vulnerability in WatchGuard Firebox firewalls ^[10].
A new zero-day exploit, “ShieldCrash,” targets Microsoft Defender, providing attackers with full system privileges on Windows machines patched as of September 2026 ^[34].
Fortinet patched a high-severity unauthenticated code execution vulnerability (CVE-2025-25249) that has been exploited in PivotC2 RAT attacks ^[35].
Fortinet also patched critical vulnerabilities in FortiMonitorOnSight and its Chrome extension, which allow authentication bypass and browser traffic proxying ^[40].
Android’s September 2026 updates resolved 180 vulnerabilities, including critical flaws in Framework, System, and Kernel components ^[38].
Nvidia, AMD, and Arm released security advisories addressing newly discovered vulnerabilities in their products ^[39].
Chrome issued an update to fix an actively exploited V8 vulnerability and 229 other flaws ^[41].
A vulnerability in Proxmox VE version 7 was disclosed, affecting older installations ^[30].
Carnegie Mellon CERT/CC warned that Skullcandy Dime 3 earbuds are vulnerable to Bluetooth hijacking due to lack of authentication during pairing ^[15].
Nearly 10 percent of exposed LiteLLM servers accepted the default example admin key “sk-1234,” posing a risk of unauthorized access ^[4].

Notable Threat Actor Activity

Four espionage-focused threat groups were observed using the same BlueMoon exploit kit to chain Chrome and Windows vulnerabilities within a short period ^[7].
The ShinyHunters threat group was linked to the AdaptHealth data breach affecting millions ^[14]^[32].
Cybercriminals are hijacking AI user accounts by leveraging infostealer logs to replay stolen API tokens, bypassing multi-factor authentication and gaining illicit access to AI tools from providers such as Google, Anthropic, and OpenAI ^[8].
US agencies accused six Chinese AI firms of conducting large-scale model distillation attacks, extracting billions of tokens from American frontier AI models including those from OpenAI, Anthropic, Google Gemini, and SpaceX’s Grok ^[16]^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly shifting to voice phishing (vishing) as inbox security improves, exploiting employees’ lack of awareness regarding phone-based social engineering ^[1].
Attackers are weaponizing organisations’ own email infrastructure through “direct send” tactics to facilitate phishing and bypass external email filters ^[2].
MFA account recovery processes are being targeted as a new attack vector, with attackers exploiting weaknesses in identity verification during recovery ^[18].
“Workflow identity hijacking” is an emerging method to bypass standard security controls on enterprise AI platforms by exploiting unauthenticated entry points ^[22].
Google warns that AI is enabling less-resourced attackers to achieve nation-state-level capabilities by automating and scaling cyberattacks ^[37].
The proliferation of vulnerabilities is outpacing human capacity to disclose and remediate them, creating a backlog in vulnerability management ^[20].
Copyright scammers are abusing Instagram’s reporting system to suspend accounts and extort payments from victims ^[42].
Over 100,000 fake online stores operated by the DoppelCart group are stealing payment card details and bank codes from shoppers ^[43].

Regulatory or Policy Developments Affecting the Security Industry

The EU Cyber Resilience Act will require businesses operating in the EU to notify authorities within 24 hours of discovering serious product security incidents, starting Friday ^[19].
San Francisco has ordered Meta to explain and halt the appearance of AI-generated child abuse ads on Facebook and Instagram, raising questions about platform accountability ^[26].

Sources

AdaptHealth confirms 4.1 million people exposed in July cyberattack - bleepingcomputer.com
4.1 Million Impacted by AdaptHealth Data Breach - securityweek.com
Trezor warns users of email provider breach, phishing attacks - bleepingcomputer.com
Veradigm warns of patient data breach after ransomware gang claims attack - bleepingcomputer.com
Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 - thehackernews.com
Widened Scan Turns Up Fourth Rogue Claude Cyber Incident - securityweek.com
U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto - thehackernews.com
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline - thehackernews.com
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks - bleepingcomputer.com
Organizations Warned of Cisco Secure FMC Exploitation - securityweek.com
CISA: WatchGuard RCE flaw now exploited in ransomware attacks - bleepingcomputer.com
New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender - securityweek.com
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks - securityweek.com
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension - securityweek.com
Android’s September 2026 Updates Patch 180 Vulnerabilities - securityweek.com
Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories - securityweek.com
Update Chrome now to protect against an actively exploited vulnerability - malwarebytes.com
Scans for Proxmox Servers, (Wed, Sep 9th) - isc.sans.edu
Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking - bleepingcomputer.com
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key - thehackernews.com
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week - thehackernews.com
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA - thehackernews.com
US says Chinese firms extracted billions of tokens from frontier AI models - bleepingcomputer.com
US Government Accuses Chinese AI Firms of Distilling Frontier Models - darkreading.com
The Workforce Has a Blind Spot, and It’s Ringing - blog.knowbe4.com
Direct Send: How Attackers Weaponize Your Infrastructure Against You - blog.knowbe4.com
MFA's Weakest Link: Account Recovery Is the New Attack Path - bleepingcomputer.com
Identity-Based AI Attack Threatens Security of Enterprise Data - darkreading.com
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns - securityweek.com
Mythos Vulnerability Firehose Hits a Human Bottleneck - darkreading.com
Copyright scammers get Instagram accounts suspended and demand payment - malwarebytes.com
More than 100,000 fake stores are out to steal your card details - malwarebytes.com
EU Cyber Resilience Act to Enforce New Reporting Requirements - darkreading.com
San Francisco Orders Meta to Stop ‘Allowing’ AI Child Abuse Ads - wired.com

Cybersecurity Brief – 2026-08-13

Thu, 13 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Ceva Logistics experienced a cyberattack that disrupted operations at eight European warehouses, resulting in shipment delays for multiple customers ^[39].
Over 2,500 organizations were impacted by a supply chain attack on LiteLLM, which was compromised via the Trivy hack to distribute information-stealing malware ^[41].
The Colombian Justice Ministry was hit by a ransomware attack days before a presidential transition, continuing the trend of attacks on critical infrastructure in Latin America ^[26].
A long-running data theft campaign, dubbed “City-Forum,” has targeted Salesforce Experience Cloud and ServiceNow customer portals using custom tooling to steal data exposed to anonymous users. This campaign has been active since at least March 2025 and affects organizations across multiple sectors ^[12]^[24]^[38].
The FBI issued a warning about cybercriminals targeting online accounts to steal sexually explicit images and videos from adults and children ^[18].

Newly Discovered Vulnerabilities

Microsoft SharePoint vulnerability CVE-2026-55040 is being actively exploited following the public release of proof-of-concept code. This vulnerability allows attackers to bypass authentication and potentially gain access to sensitive data ^[5]^[20]^[35].
A Windows zero-day vulnerability (CVE-2026-68820) exploited by the Lazarus Group has been used to gain SYSTEM access and deploy a new backdoor, with defense-sector firms among the targets ^[6]^[17].
A new zero-day exploit for Microsoft Defender, named “ShieldBreak,” was released after the August 2026 Patch Tuesday, allowing any user to spawn a shell with SYSTEM privileges ^[22]^[34].
Adobe patched three CVSS 10.0 vulnerabilities in ColdFusion, Commerce, and Campaign Classic, which could lead to arbitrary code execution if exploited. Attempts to exploit the critical Adobe Commerce flaw (CVE-2026-71362) to hijack customer accounts have already been detected ^[10]^[14].
VMware vCenter’s critical vulnerability CVE-2026-593 is being actively exploited to gain persistent remote access ^[11].
Over 80 vulnerabilities were patched by Intel and AMD, including high-severity issues leading to privilege escalation and code execution ^[40].
Zoom patched critical “Zoomsday” vulnerabilities that could allow a participant to run malicious code on another participant’s device during a meeting ^[42].
Belgium’s eID authentication system was fully compromised due to severe vulnerabilities in a key browser extension, exposing citizen accounts to remote code execution ^[23].
August Patch Tuesday from Microsoft addressed 421 flaws, including three zero-days and 62 critical vulnerabilities, with numerous Office remote code execution bugs ^[43].
Researchers disclosed “Plug and Pwn” attacks that exploit Windows Plug and Play to install vulnerable vendor software and gain SYSTEM privileges via fake USB devices ^[16].

Notable Threat Actor Activity

The North Korean Lazarus Group exploited a Windows zero-day vulnerability to target defense firms as part of Operation Dream Job, deploying a new backdoor ^[6]^[17].
The Armored Likho group launched a new cyber-espionage campaign using the “Still Toolkit” to steal Telegram data and eavesdrop on victims, masquerading as fundraising efforts ^[1].

Trends, Tools, or Tactics of Interest

Over 737 Chrome VPN and proxy extensions were discovered routing user traffic through SOCKS5 proxies controlled by a single provider, mainly targeting Russian-speaking users. These extensions impersonated legitimate VPN and proxy services ^[7]^[15].
Attackers are exploiting unauthenticated guest access on Salesforce and ServiceNow portals to enumerate and exfiltrate exposed data in the “City-Forum” campaign ^[12]^[24]^[38].
New Android malware “WindRelay” is being used alongside the SpyNote RAT to steal live credit card data via NFC relay attacks and facilitate fraudulent loan applications ^[13].
Fake remote workers are exploiting gaps in hiring processes, device delivery, and account access to gain entry to organizations using false identities ^[19].
Enterprise defense trends show attackers increasingly using stealthy methods that avoid detection by making little to no noise, as highlighted in Picus Labs’ Blue Report 2026 ^[9].
A newly disclosed flaw in OpenAI, Anthropic, and Google APIs allowed weaker AI models to recover internal reasoning and secrets from session logs, including API keys ^[8].
Research from PortSwigger explores whether AI systems can autonomously invent new attack techniques beyond vulnerability discovery ^[33].
Security researchers demonstrated that a coin-sized device could be used to physically compromise a Boeing 737, opening exterior hatches and redirecting the autopilot or sabotaging the flight plan in under 60 seconds ^[28].
The “Plug and Pwn” attack vector highlights the risk of malicious USB devices being used to gain privileged access on Windows systems ^[16].

Regulatory or Policy Developments Affecting the Security Industry

Signal introduced Automatic Key Verification, a new security feature to help users ensure their encrypted chats have not been intercepted, aiming to thwart man-in-the-middle attacks ^[21]^[37].

Sources

Ceva Logistics Operations Disrupted by Cyberattack - securityweek.com
Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack - securityweek.com
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition - darkreading.com
"City-Forum" data-theft attacks target Salesforce, ServiceNow portals - bleepingcomputer.com
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow - darkreading.com
Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset - securityweek.com
FBI: Hackers target online accounts to steal nude photos - bleepingcomputer.com
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release - thehackernews.com
Hackers leverage new Microsoft SharePoint exploit in attacks - bleepingcomputer.com
SharePoint Vulnerability Exploited Shortly After PoC Release - securityweek.com
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor - thehackernews.com
Lazarus hackers exploited Windows zero-day to target defense firms - bleepingcomputer.com
New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges - bleepingcomputer.com
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ - securityweek.com
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws - thehackernews.com
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts - bleepingcomputer.com
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access - thehackernews.com
Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined - securityweek.com
“Zoomsday” flaws could let one Zoom participant attack another - malwarebytes.com
Belgium's eID Authentication Opens Citizen Accounts to RCE - darkreading.com
Patch Tuesday: Update now to fix 421 flaws, including three zero-days - malwarebytes.com
Plug and Pwn attack uses fake USB devices for Windows SYSTEM access - bleepingcomputer.com
Armored Likho expands its cyber-espionage toolkit - securelist.com
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One - thehackernews.com
Hundreds of fake Chrome VPN extensions route traffic through a proxy - bleepingcomputer.com
Android malware combo takes out loans and relays victims' credit cards - bleepingcomputer.com
The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In - bleepingcomputer.com
Enterprise Defenses Recovered at the Edge and Collapsed Inside - thehackernews.com
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning - thehackernews.com
Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research - portswigger.net
This Coin-Sized Device Can Hack a Boeing 737 - wired.com
Signal adds new security feature to thwart man-in-the-middle attacks - bleepingcomputer.com
WhatsApp Unveils New Scam Alert Feature - securityweek.com

Cybersecurity Brief – 2026-07-08

Wed, 08 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Accenture confirmed a security breach after a threat actor claimed to have stolen 35 GB of source code and other data, which was subsequently offered for sale online ^[17].
A small Ohio county reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data ^[31].
A critical flaw in GitHub Agentic Workflows was demonstrated to allow unauthenticated attackers to craft issues in public repositories and exfiltrate data from private repositories ^[10]^[27].
Ubiquiti disclosed seven critical vulnerabilities in UniFi OS, including a maximum-severity command injection flaw, and released security updates ^[15].
A hidden authentication backdoor was discovered in multiple Tenda router firmware versions, potentially granting attackers administrative access to the device’s web management panel ^[19].

Newly Discovered Vulnerabilities

Researchers disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw enabling root access and container escape on most unpatched Linux distributions ^[5].
The Januscape vulnerability, a 16-year-old Linux kernel flaw, was revealed to allow virtual machine escape and arbitrary code execution on Intel and AMD systems running KVM ^[23]^[37].
A critical Gitea vulnerability (CVE-2026-20896) is under active exploitation, allowing attackers to bypass authentication with a single HTTP header and access repositories and secrets ^[32].
A critical flaw in Google Dialogflow CX could have allowed attackers with edit rights on one Code Block-enabled agent to compromise other agents in the same Google Cloud project ^[8]^[26].
A critical session isolation vulnerability in the Writer AI platform, now patched, could have exposed session tokens across tenants ^[12].
Four actively exploited vulnerabilities in Adobe, Joomla, and Langflow were added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of active exploitation ^[6].
A recently patched maximum-severity vulnerability (CVE-2026-48282) in Adobe ColdFusion is being actively exploited in the wild ^[16]^[34].

Notable Threat Actor Activity

Chinese threat group UAT-7810 is actively evolving its malware, including the new LONGLEASH variant, to expand their Operational Relay Box (ORB) network by compromising primarily unpatched router devices ^[18].
Suspected China-aligned actors exploited vulnerabilities in Roundcube webmail software to target physics and engineering departments at US and Canadian universities for espionage ^[14].
Iran-linked threat actors have been observed using a modular command and control framework and compromising IT service providers to reach high-value targets in Israel ^[35].
A new Android malware operation, RedWing, is being offered as a bank fraud-as-a-service on Telegram, enabling even low-skill criminals to take over devices and steal banking credentials ^[7].
A Microsoft 365 device code phishing campaign, leveraging collaboration-themed lures and abusing the device-code flow, has been observed targeting M365 accounts since late June 2026 ^[9].
A suspected member of pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest was arrested in Spain ^[20].
Scammers are using fake job offers from well-known brands, nested redirects, and phishing tactics to compromise marketing professionals’ Google accounts ^[25]^[40].
New scams on Reddit and Discord are tricking users into giving up login codes through false report claims ^[39].

Trends, Tools, or Tactics of Interest

Attackers are exploiting flaws in GitHub Agentic Workflows by creating public issues to trigger workflows that can leak data from private repositories ^[10]^[27].
ActiveState highlighted that certain attack chains in GitHub Actions can evade traditional CI security scanners, indicating a need for improved governance and detection ^[21].
The RedWing malware-as-a-service model demonstrates increased accessibility of sophisticated Android banking fraud tools via Telegram ^[7].
Phishing campaigns are increasingly using brand impersonation, nested redirects, and fake prompts to evade detection and increase success rates ^[25]^[40].
Scammers are leveraging AI to create convincing fraudulent products, such as fake flowers, and to embed hidden trackers in AI-generated code ^[41]^[42].
CISA is reportedly using Anthropic’s Mythos AI platform to scan government software for vulnerabilities, indicating a trend toward AI-driven security assessments ^[33].
The use of modular malware frameworks by Iran-linked actors and evolving malware by Chinese groups shows a trend toward adaptable, persistent threat infrastructure ^[18]^[35].

Regulatory or Policy Developments Affecting the Security Industry

CISA ordered US federal agencies to patch a maximum-severity Adobe ColdFusion vulnerability by Friday in response to active exploitation ^[16].
Microsoft announced that Windows settings backup and restore will be enabled by default on Microsoft Entra-joined or hybrid-joined enterprise systems after upgrading to Windows 11 26H2 ^[24].

Sources

Accenture confirms breach after hacker offers stolen data for sale - bleepingcomputer.com
County Government Reportedly Paid $1 Million to Cyber Extortion Group - securityweek.com
Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data - thehackernews.com
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows - darkreading.com
Ubiquiti warns of new max severity UniFi OS vulnerability - bleepingcomputer.com
Hidden backdoor in Tenda router firmware grants admin access - bleepingcomputer.com
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros - thehackernews.com
New Januscape Linux flaw allows VM escape on Intel, AMD devices - bleepingcomputer.com
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems - securityweek.com
Critical Gitea Flaw Under Active Exploitation, Researchers Warn - securityweek.com
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots - thehackernews.com
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft - darkreading.com
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants - thehackernews.com
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV - thehackernews.com
CISA orders feds to patch max severity ColdFusion flaw by Friday - bleepingcomputer.com
Critical Adobe ColdFusion Vulnerability Exploited in Attacks - securityweek.com
Chinese hackers develop LONGLEASH malware to expand ORB network - bleepingcomputer.com
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities - thehackernews.com
Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks - securityweek.com
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service - thehackernews.com
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts - thehackernews.com
Spain arrests suspected member of pro-Russian hacktivist groups - bleepingcomputer.com
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts - darkreading.com
Fake Netflix, Coca-Cola, and FIFA job scams target marketers - malwarebytes.com
How the Reddit and Discord false report scam steals accounts - malwarebytes.com
The GitHub Actions Attack Pattern Your CI Security Scanners Miss - bleepingcomputer.com
Claude Code’s hidden tracker was an “experiment,” says Anthropic - malwarebytes.com
Scammers are using AI to sell impossible flowers - malwarebytes.com
CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws - securityweek.com
Microsoft to enable Windows settings backup by default for orgs - bleepingcomputer.com

Cybersecurity Brief – 2026-05-13

Wed, 13 May 2026 00:00:00 +0000

Major Incidents or Breaches

South Staffordshire Water Plc and its parent company have been fined £963,900 by the UK Information Commissioner’s Office after a cyberattack exposed the personal data of 664,000 customers.
Škoda Auto disclosed a data breach following a compromise of its online shop, resulting in the theft of customer personal information. The number of affected individuals has not been specified.
BWH Hotels reported that threat actors had access to guest reservation data, including names and contact information, for six months.
Foxconn experienced another cyberattack, resulting in exposure of sensitive company data.
A report indicates that 43% of UK businesses suffered a breach in the last year, with 85% of these incidents attributed to phishing attacks.
RubyGems, the Ruby package manager, suspended new account registrations after a major attack in which more than 500 malicious packages were uploaded, targeting the registry itself.
The ShinyHunters extortion group conducted two cyberattacks against the Canvas platform operated by Instructure, prompting US Congressional scrutiny.
TeamPCP, a known threat actor, has been linked to a supply chain attack compromising hundreds of npm and PyPI packages, including those from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI, with the Mini Shai-Hulud worm delivering credential-stealing malware.

Newly Discovered Vulnerabilities

Microsoft’s May 2026 Patch Tuesday addressed 137 vulnerabilities (including 120 flaws noted in other reports), with nine rated critical. No zero-days were disclosed. Updates cover Azure, Windows, Dynamics 365, and SSO Plugins for Jira & Confluence.
Fortinet patched critical remote code execution vulnerabilities in FortiSandbox and FortiAuthenticator, which could allow attackers to execute arbitrary commands or code.
Ivanti released patches for critical vulnerabilities that could lead to arbitrary code execution and information disclosure.
Exim released security updates to address a severe vulnerability in certain GnuTLS builds that could enable memory corruption and potential code execution.
SAP issued updates for 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA.
Intel and AMD published advisories for a combined total of 70 security vulnerabilities across their products.
Adobe patched 52 vulnerabilities in 10 products, several of which could result in arbitrary code execution, though none are known to be exploited in the wild.

Notable Threat Actor Activity

TeamPCP has been identified as responsible for the Mini Shai-Hulud worm campaign, which has infected hundreds of open-source packages, focusing on credential theft and supply chain compromise.
The GemStuffer campaign abused over 150 RubyGems to exfiltrate scraped data from UK council portals, using the RubyGems registry as a data exfiltration channel.
The TrickMo Android banking trojan has been updated to use The Open Network (TON) for command-and-control and SOCKS5 proxies to create Android network pivots, enhancing its evasion and persistence capabilities.
The ShinyHunters extortion group targeted Instructure’s Canvas platform in two separate attacks.

Trends, Tools, or Tactics of Interest

Social engineering remains a prevalent attack vector, with criminals increasingly posing as help desks in phishing and fraud campaigns.
Signal has introduced new in-app confirmations and warning messages to counter phishing and social engineering attacks.
Android announced an opt-in Intrusion Logging feature for forensic analysis of sophisticated spyware, and Android 17 will introduce expanded protections against banking scam calls and device theft.
Hugging Face AI models are susceptible to manipulation via tokenizer library file tweaks, allowing model hijacking and data exfiltration.
A cross-platform malware campaign dubbed CRPx0 is using “Free OnlyFans” lures to target macOS and Windows, with Linux support in development.
Fake search results for Claude setup guides are being used to distribute ClickFix malware to Mac users.
The volume and complexity of supply chain attacks targeting open-source package repositories (npm, PyPI, RubyGems) continues to increase, with attackers leveraging worms and mass package uploads.

Regulatory or Policy Developments Affecting the Security Industry

The UK Information Commissioner’s Office imposed a significant fine on South Staffordshire Water Plc for failing to protect customer data during a cyberattack.
The US House Committee on Homeland Security has requested testimony from Instructure executives regarding the recent cyberattacks on its Canvas platform.
RubyGems’ suspension of new account sign-ups in response to a major malicious package attack reflects ongoing efforts to secure software supply chains.

Cybersecurity Brief – 2026-02-12

Thu, 12 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

The Conduent data breach has impacted at least 25 million individuals, including nearly 17,000 Volvo Group employees whose data was exposed.
The AgreeTo Outlook add-in was hijacked and used as a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials.
A surge in LummaStealer infections has been reported, linked to campaigns using the CastleLoader malware and the ClickFix social engineering technique.

Newly Discovered Vulnerabilities

Apple released updates for all platforms (iOS, iPadOS, macOS, tvOS, watchOS, visionOS), addressing 71 vulnerabilities, including a zero-day exploited in sophisticated attacks against targeted individuals.
Microsoft issued security updates for 59 vulnerabilities, including six zero-days that are actively exploited. Notable fixes include a remote code execution flaw in Windows 11 Notepad and vulnerabilities affecting Windows Secure Boot and other core components.
Intel and AMD collectively addressed over 80 vulnerabilities across their chipsets in recent advisories.
Ivanti patched vulnerabilities in Endpoint Manager, including a high-severity authentication bypass that could be exploited remotely without authentication.

Notable Threat Actor Activity

APT36 and SideCopy have launched campaigns targeting Indian defense and government-aligned organizations, deploying cross-platform remote access trojans (RATs) affecting both Windows and Linux environments.
North Korea’s UNC1069 is increasingly targeting Web3 and cryptocurrency firms, employing large language models (LLMs), deepfakes, legitimate platforms, and ClickFix techniques.
The SSHStalker botnet is leveraging IRC-based command-and-control channels and legacy Linux kernel exploits to control compromised systems.
The Crazy ransomware gang is abusing legitimate employee monitoring tools and the SimpleHelp remote support tool to maintain persistence, evade detection, and facilitate ransomware deployment in corporate environments.

Trends, Tools, or Tactics of Interest

Campaigns involving RenEngine and HijackLoader have distributed LummaStealer via complex infection chains since March 2025.
There is increased abuse of AI models, with Google reporting that attackers are using Gemini AI for all stages of cyberattacks. Model extraction and distillation attacks are being observed using legitimate API access.
Spam and phishing trends for 2025 include increased use of scam QR codes, ClickFix attacks, and lures involving ChatGPT subscriptions.
Intentionally vulnerable training applications (e.g., OWASP Juice Shop, DVWA, Hackazon, bWAPP) are being targeted in cloud environments, exposing organizations to crypto-mining attacks.
The first known malicious Microsoft Outlook add-in supply chain attack has been observed in the wild.
WSL (Windows Subsystem for Linux) continues to be exploited within the malware ecosystem to facilitate cross-platform attacks.
Arrests have been made in the Netherlands related to the sale of JokerOTP, a phishing automation tool capable of intercepting multi-factor authentication (MFA) one-time passcodes.

Regulatory or Policy Developments Affecting the Security Industry

Nevada has introduced a new statewide data classification policy, categorizing data as “public,” “sensitive,” “confidential,” or “restricted,” following a recent cyberattack.
Microsoft announced plans to refresh Windows Secure Boot certificates in June 2026, replacing certificates that have been in use for over 15 years.

Cybersecurity Brief – 2026-01-20

Tue, 20 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro disclosed that a ransomware attack in July 2025 resulted in a data breach affecting over 42,000 individuals, with compromised data including names, dates of birth, Social Security numbers, and employment-related information.
A Fortune 100 company in the finance sector was targeted by ransomware attackers, who deployed a new malware strain named PDFSider to deliver malicious payloads on Windows systems.
Spanish energy company Endesa reported a data breach, as noted in Check Point’s latest threat intelligence report.
A Tennessee man pleaded guilty to hacking the U.S. Supreme Court’s electronic filing system and breaching accounts at AmeriCorps and the Department of Veterans Affairs, subsequently leaking stolen Supreme Court data on Instagram.

Newly Discovered Vulnerabilities

A hardware vulnerability, codenamed StackWarp, was disclosed affecting AMD Zen 1–5 CPUs. The flaw breaks Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP) protections, potentially undermining the security guarantees of AMD’s confidential computing technology.
TP-Link patched a vulnerability in its VIGI security cameras that exposed over 2,500 internet-facing devices to remote hacking risks.
Cybersecurity researchers disclosed an indirect prompt injection flaw in Google Gemini, which allowed attackers to bypass authorization guardrails and access private Google Calendar data via malicious calendar invites.

Notable Threat Actor Activity

The UK government issued warnings regarding ongoing attacks by Russian-aligned hacktivist groups targeting UK critical infrastructure and local government organisations with disruptive activities.
A Jordanian national pleaded guilty in US court to operating as an access broker, selling unauthorized access to at least 50 corporate networks.
Researchers identified a new information stealer dubbed SolyxImmortal, which abuses legitimate APIs and libraries to exfiltrate data via Discord webhooks.
A campaign named KongTuke was observed using a malicious Chrome extension, CrashFix, which masquerades as an ad blocker and intentionally crashes browsers to facilitate further malware installation via ClickFix-style lures.
Additional malvertising campaigns were reported using fake ad blocker extensions (e.g., NexShield) on Chrome and Edge to crash browsers and launch ClickFix attacks.
New sleeper browser extensions were found spying on users and installing backdoors, now targeting Firefox in addition to Chrome and Edge.

Trends, Tools, or Tactics of Interest

The emergence of PDFSider malware highlights the continued use of custom payloads by ransomware groups targeting large enterprises.
The use of browser extensions (CrashFix, NexShield) as vectors for malvertising and malware delivery is increasing, with attackers employing browser crashes as part of social engineering tactics.
Threat actors are leveraging Discord webhooks for data exfiltration, as seen with the SolyxImmortal information stealer.
Indirect prompt injection attacks targeting AI assistants (e.g., Google Gemini) are being actively researched and exploited as a means to bypass security controls and access sensitive data.
Sleeper extensions that remain dormant before activating malicious behaviour are being deployed across multiple browsers, broadening the attack surface for user surveillance and backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

The UK government’s public warning about Russian hacktivist group activity signals heightened concern over threats to national critical infrastructure and may prompt increased defensive measures and reporting requirements across the sector.

Cybersecurity Brief – 2026-01-16

Fri, 16 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
Eurail reported a breach in which hackers stole personal and reservation information of travellers.
Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

Cisco patched a maximum-severity zero-day remote code execution vulnerability in Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The flaw was exploited in the wild by a China-linked APT.
A critical misconfiguration in AWS CodeBuild was discovered, exposing AWS’s own GitHub repositories-including the AWS JavaScript SDK-to potential supply chain attacks.
A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin is under active exploitation, allowing attackers to bypass authentication and gain admin-level access.
Palo Alto Networks released patches for a high-severity DoS vulnerability in GlobalProtect Gateway and Portal, which can allow unauthenticated attackers to crash firewalls without needing to log in.
A critical vulnerability in Google’s Fast Pair Bluetooth protocol (“WhisperPair”) allows attackers to hijack, track, and eavesdrop on Bluetooth audio devices. Hundreds of millions of devices are impacted.
Researchers disclosed “StackWarp,” a new attack affecting AMD processors that can enable remote code execution inside confidential VMs.
Three critical vulnerabilities were identified in Delta Industrial PLCs, with debate among experts regarding their severity.
Siemens, Schneider, Aveva, and Phoenix Contact released advisories addressing vulnerabilities in their industrial control products as part of ICS Patch Tuesday.

Notable Threat Actor Activity

China-linked APT groups exploited the Cisco Secure Email Gateway zero-day prior to patch release.
Gootloader malware is now using malformed ZIP archives split into up to 1,000 parts to evade detection during delivery.
Researchers highlighted the VoidLink Linux malware framework, which targets cloud and container environments for long-term persistence using loaders, implants, and rootkits.
Intellexa’s Predator spyware was observed using vendor-controlled command-and-control (C2) infrastructure, with failed deployments and thwarted infections used to refine attack methods.
Threat actors are increasingly exploiting network misconfigurations to spoof internal emails for phishing campaigns, as observed by Microsoft.

Trends, Tools, or Tactics of Interest

The “Reprompt” attack technique enables single-click exfiltration of sensitive data from AI chatbots, including Microsoft Copilot, bypassing existing data leak protections-even after chat sessions have ended.
AI voice cloning exploits are on the rise, with new applications emerging for the detection of deepfake voice attacks.
A surge in reported vulnerabilities has been noted, particularly in WordPress plugins, with the overall picture complicated by inconsistent reporting from different organisations.
The Gootloader malware’s adoption of multi-part ZIP archives signals a trend toward more sophisticated evasion strategies in malware delivery.
Security focus in AI is shifting from model security to workflow security, as incidents demonstrate greater risk in workflow integrations and extensions.
Vibe coding tests indicate that AI agents can effectively exploit SQL injection vulnerabilities but perform poorly in implementing security controls.
The VoidLink framework’s targeting of cloud/container environments underscores increased threat activity against cloud infrastructure.
Security leaders are prioritising supply chain security, governance, and operational efficiency over predictive approaches.

Regulatory or Policy Developments

The US Federal Trade Commission (FTC) has banned General Motors from selling drivers’ location data for five years, following findings that GM sold such data without user consent.
Microsoft’s legal action against RedVDS was coordinated in both the US and UK, demonstrating cross-jurisdictional efforts to disrupt cybercrime-as-a-service operations.
Former CISA Director Jen Easterly has been appointed to lead the RSA Conference, reflecting leadership changes at a major industry event.

Cybersecurity Brief – 2025-12-11

Thu, 11 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Threat actors are actively exploiting CVE-2025-55182, with observed attacks targeting honeypots and deploying malware.
Multiple threat groups are exploiting WinRAR vulnerability CVE-2025-6218, which has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Gladinet’s CentreStack and Triofox products are under active attack due to hard-coded cryptographic keys, resulting in unauthorized access and code execution in at least nine organizations.
React2Shell vulnerability in React Server Components is being heavily exploited to deliver cryptocurrency miners and other malware across multiple sectors.
Over 10,000 Docker Hub container images have been found leaking sensitive credentials, including production system access, CI/CD database keys, and LLM model keys.
A new AMOS infostealer malware campaign is using Google search ads to lure users into fake ChatGPT and Grok guides, resulting in macOS infections.
A new Android malware, DroidLock, is locking devices for ransom, erasing data, and accessing sensitive information such as messages, contacts, and audio data.
The GhostFrame phishing kit is enabling widespread phishing attacks using dynamic subdomains and hidden iframes to evade detection.
A Ukrainian national has been charged and extradited to the US for assisting Russian hacktivist groups in attacks on critical infrastructure, including water, election, and nuclear systems.
Pro-Russian hacktivists are targeting US critical infrastructure, primarily by compromising VNC connections in operational technology (OT) systems, with potential for increased destructiveness.

Newly Discovered Vulnerabilities

PCIe 5.0+ systems are affected by three vulnerabilities in the Integrity and Data Encryption (IDE) protocol, exposing Intel and AMD processors to information disclosure, privilege escalation, and DoS via local attacks.
The .NET “SOAPwn” flaw allows remote code execution and arbitrary file writes via rogue WSDL files in enterprise applications.
Google patched a Gemini Enterprise zero-click vulnerability (“GeminiJack”) that could have exposed corporate data via crafted emails, calendar invites, or documents.
Fortinet released patches for two critical authentication bypass vulnerabilities impacting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO enabled.
Ivanti Endpoint Manager (EPM) update addresses a critical XSS vulnerability enabling remote code execution with admin privileges.
SAP’s December 2025 updates fix critical vulnerabilities in Solution Manager, Commerce Cloud, and jConnect SDK, which could lead to code injection and remote code execution.
Siemens, Rockwell, and Schneider have issued patches for multiple vulnerabilities across their industrial control system (ICS) products.
Microsoft issued fixes for 56 vulnerabilities, including three zero-days, one of which is under active exploitation, and introduced a PowerShell warning for unsafe code execution.
A possible new exploit variant for Kubernetes OS command injection vulnerability CVE-2024-9042 has been identified.

Notable Threat Actor Activity

Storm-0249, an initial access broker, is abusing endpoint detection and response (EDR) platforms and Windows utilities in stealthy attacks.
The Silver Fox APT, associated with ValleyRAT malware, continues to evolve, utilizing kernel rootkits and advanced builder techniques.
The Spiderman phishing kit is targeting customers of dozens of European banks and cryptocurrency holders with highly convincing cloned sites.
The AMOS infostealer campaign leverages SEO poisoning and legitimate AI domains for malware delivery to macOS systems.
US authorities indicted Victoria Dubranova for supporting Russia-backed CARR and NoName hacktivist groups in attacks on critical infrastructure.
Two individuals linked to China’s Salt Typhoon hacker group reportedly received training via a Cisco Academy prior to targeting Cisco devices in espionage campaigns.

Trends, Tools, or Tactics of Interest

Phishing attacks have surged 400% year-over-year, with a focus on corporate accounts.
Social engineering campaigns are exploiting Microsoft Teams’ “Chat with Anyone” feature to conduct phishing attacks via external DMs.
Attackers are increasingly exploiting cloud misconfigurations across AWS, AI models, and Kubernetes, bypassing standard security tools.
Supply-chain attacks in manufacturing environments are leveraging compromised credentials, malicious NPM packages, and development tool exploits.
Microsoft Teams is developing a feature to warn IT administrators about suspicious traffic with external domains.
The GhostFrame phishing kit is enabling large-scale, evasive phishing campaigns using dynamic infrastructure.
The Spiderman phishing kit demonstrates sophistication in targeting European financial institutions with pixel-perfect phishing sites.

Regulatory or Policy Developments Affecting the Security Industry

Israeli cybersecurity sector investment reached a record $4.4 billion, reflecting over 500% growth in the past decade.
CISA added the WinRAR CVE-2025-6218 vulnerability to its KEV catalog, mandating remediation for US federal agencies.

Cybersecurity Brief – 2025-11-26

Wed, 26 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Dartmouth College disclosed a data breach after the Clop extortion gang leaked data allegedly stolen from Oracle E-Business Suite servers.
The OnSolve CodeRED platform suffered a cyberattack disrupting emergency notification systems used by state and local governments, police departments, and schools across the US.
Major US banks were impacted by a hack of SitusAMC, resulting in the theft of corporate data such as accounting records and legal agreements. No ransomware was deployed.
Harvard University confirmed a compromise of a system containing alumni, donor, student, and staff information, following a phone phishing attack.
Researchers identified that years of credential leaks-including passwords and API keys-originated from organizations pasting sensitive data into public online tools like JSONFormatter and CodeBeautify, affecting banks, governments, and tech firms.

Newly Discovered Vulnerabilities

Five vulnerabilities in Fluent Bit, an open source logging tool, were disclosed, potentially enabling path traversal, remote code execution, denial-of-service, and tag manipulation attacks against cloud services.
A hardware module was demonstrated that can bypass AMD and Intel memory encryption, undermining confidential computing protections.
WhatsApp closed an API loophole that previously allowed researchers to scrape data on 3.5 billion accounts, including profile photos and “about” text.

Notable Threat Actor Activity

The Clop ransomware gang was responsible for the Dartmouth College data breach via exploitation of Oracle E-Business Suite.
ToddyCat, a known threat actor, deployed new tools including TCSectorCopy to steal Outlook emails and Microsoft 365 access tokens from corporate targets.
DPRK-linked actor “FlexibleFerret” continued to refine social engineering and credential theft campaigns targeting macOS users, notably in the “Contagious Interview” campaign.
Chinese state-linked hackers targeted Russian IT organizations using commercial cloud services for command and control to evade detection.
Russian threat actors targeted a US engineering firm due to its work for a Ukrainian sister city, but the attack was detected before causing operational impact.
Iranian cyber operations were linked to “cyber-enabled kinetic targeting,” aiding real-world missile strikes by providing targeting support.
CISA issued warnings about spyware campaigns focusing on high-value messaging app users.
A new ClickFix variant, dubbed “JackFix,” leveraged fake Windows update pop-ups on adult sites and images to deliver multiple stealers, circumventing previous mitigations.
A campaign was observed where Blender Foundation 3D asset files were weaponized to deliver StealC V2 information-stealing malware.
The “Shai-Hulud” supply chain attack infected 640 npm packages with a self-replicating worm capable of erasing home directories if propagation fails.

Trends, Tools, or Tactics of Interest

The FBI reported a surge in account takeover (ATO) fraud, with cybercriminals impersonating bank support teams and stealing over $262 million since January 2025.
Researchers and the FBI cite a rise in AI-driven phishing and holiday-themed scams, with threat actors leveraging AI to scale attacks, automate reconnaissance, and craft highly convincing lures.
Malicious large language models (LLMs) such as WormGPT 4 and KawaiiGPT are being used by cybercriminals for phishing, malware development, and reconnaissance.
Sophisticated phishing attacks continue to bypass advanced enterprise security measures.
The new ClickFix/JackFix campaigns utilize psychological pressure and technical evasion to increase infection rates, including hiding malware in PNG images and faking Windows updates.
The use of public code beautifier and formatter tools as inadvertent credential leak vectors is a persistent issue across multiple sectors.
Threat actors are increasingly exploiting supply chain weaknesses, as seen in the 2025 systemic ransomware events affecting Jaguar Land Rover and other automotive manufacturers.

Regulatory or Policy Developments Affecting the Security Industry

Tor announced the adoption of the new Counter Galois Onion (CGO) relay encryption algorithm, replacing the older tor1 design to improve circuit traffic security.
US Immigration and Customs Enforcement (ICE) raised the cap on its immigrant-tracking program, offering up to $280 million to private surveillance firms, expanding the scope of surveillance-related contracts.

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-10-30

Thu, 30 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

A subsidiary of Japanese marketing and PR giant Dentsu (Merkle) experienced a data breach resulting in the theft of sensitive employee, client, and supplier data by unidentified threat actors.
The Canadian Centre for Cyber Security reported that hacktivists breached multiple water and energy facilities, gaining access to and modifying industrial controls across Canada.
A data leak exposed information about students attending Iran’s Ministry of Intelligence and Security (MOIS) training academy.
Microsoft experienced a global DNS outage affecting Azure and Microsoft 365 services, preventing customer logins and access.
No evidence was found of a Gmail breach; recent panic was due to circulation of old stolen credentials on the dark web.

Newly Discovered Vulnerabilities

The Anti-Malware Security and Brute-Force Firewall WordPress plugin (100,000+ installs) contains a vulnerability allowing site subscribers to read any file on the server, exposing private data.
Multiple security flaws in Dassault Systèmes DELMIA Apriso and XWiki are under active exploitation. In DELMIA Apriso, two vulnerabilities can be chained to gain privileged access and execute arbitrary code remotely. XWiki vulnerabilities are being used in cryptocurrency mining operations.
A new attack method, TEE.fail, targets DDR5 memory to steal cryptographic keys from Intel and AMD Trusted Execution Environments (TEEs), with both vendors issuing advisories.
OpenAI’s Atlas browser and similar agentic web browsers are exposed to context poisoning and prompt injection attacks, enabling attackers to manipulate AI model outputs and privacy.

Notable Threat Actor Activity

Russian-origin threat actors targeted Ukrainian organizations using living-off-the-land (LotL) tactics to exfiltrate data and maintain persistent access.
The “PhantomRaven” campaign published over 120 malicious npm packages, stealing developer credentials, authentication tokens, CI/CD secrets, and GitHub credentials from Windows, Linux, and macOS systems. Over 86,000 downloads were recorded.
Various botnets, including Mirai, Gafgyt, and Mozi, have increased automated attacks against PHP servers, IoT devices, and cloud gateways, exploiting vulnerabilities and misconfigurations to expand their control over internet-connected assets.

Trends, Tools, or Tactics of Interest

76% of organizations report struggling to keep pace with AI-powered attacks, with adversaries increasing sophistication and speed in ransomware and other threats.
New AI-targeted cloaking attacks are tricking AI crawlers (e.g., Perplexity, Atlas, ChatGPT) into indexing and citing fabricated information as facts, highlighting susceptibility of AI systems to context poisoning.
MITRE released ATT&CK v18, updating detection, mobile, and ICS (Industrial Control Systems) matrices with new defensive techniques and threat mappings.
BeyondTrust predicts a rise in attacks leveraging ghost identities, poisoned accounts, and autonomous AI agents, with traditional defenses proving less effective against emerging vectors.
Increased use of “invisible” dependencies and multi-layered obfuscation in malicious npm packages to evade detection.
Security experts note a sharp increase in cloud-focused attacks by botnets exploiting web-exposed and misconfigured assets.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will default to HTTPS for public sites starting October 2026, prompting users before allowing access to non-secure connections.
Microsoft introduced a security-focused change for Azure VMs, but provided a temporary reprieve after concerns it could disrupt apps requiring public internet access.

Cybersecurity Brief – 2025-10-29

Wed, 29 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Dentsu Data Breach: Japanese advertising giant Dentsu disclosed a cybersecurity incident at its U.S. subsidiary Merkle, resulting in the exposure of staff and client data.
Oracle EBS Attacks: Numerous organizations, including Schneider Electric and Emerson, have been identified as victims of attacks exploiting Oracle E-Business Suite zero-day CVE-2025-61882. Data stolen from these companies has been made available on the Cl0p ransomware leak site.
Swedish Power Grid Incident: Hackers targeted a Swedish power grid operator, stealing information from a file transfer solution. The country’s power supply was not affected.
183 Million Credentials Traded: Cybercriminals are trading 183 million stolen credentials on Telegram and dark web forums, with 16.4 million email addresses not previously seen in data breaches.

Newly Discovered Vulnerabilities

TEE.Fail Side-Channel Attack: Academic researchers disclosed TEE.Fail, a side-channel attack enabling extraction of secrets from trusted execution environments in Intel, AMD, and NVIDIA CPUs, undermining confidential computing.
QNAP NetBak PC Agent Vulnerability: The software is affected by a recent critical ASP.NET Core flaw that allows HTTP request smuggling, data access, server file modification, or denial-of-service.
Dassault Systèmes DELMIA Apriso: CISA warned of two actively exploited vulnerabilities in this manufacturing operations management platform.
Chrome Zero-Day: A now-patched Chrome zero-day was exploited to deliver Memento Labs’ LeetAgent spyware.
BiDi Swap Phishing Technique: Attackers are abusing bidirectional text to craft fake URLs that appear legitimate, reviving a browser flaw for phishing.
Atroposia Malware: A new malware-as-a-service platform, Atroposia, includes a built-in local vulnerability scanner for post-compromise exploitation.

Notable Threat Actor Activity

BlueNoroff (North Korea): The BlueNoroff APT group is running twin campaigns (GhostCall and GhostHire) targeting Web3 and blockchain sectors with cross-platform malware, using fake business collaboration and job recruitment lures.
Qilin Ransomware: The Qilin operation is abusing Windows Subsystem for Linux (WSL) to run Linux encryptors on Windows systems, evading traditional security tools.
Herodotus Android Trojan: A new banking trojan, Herodotus, is targeting Italy and Brazil, using random delay injection to mimic human typing and bypass anti-fraud and security detection mechanisms.
Aisuru Botnet: The Aisuru botnet, previously responsible for massive Mirai-class DDoS attacks exceeding 20 Tbps, has shifted to operating as a residential proxy network for more sustainable monetization.
YouTube Ghost Network: This malware operation leverages compromised YouTube accounts and botnets to distribute infostealers, with activity tripling in 2025.

Trends, Tools, or Tactics of Interest

AI-Powered Attacks in Africa: Cybersecurity firms report a surge in AI-driven phishing, deepfakes, and impersonation attacks across Africa, with adversaries testing new techniques on government and enterprise targets.
Deepfake-as-a-Service: The emergence of voice cloning and synthetic media fraud services is impacting enterprise security, with documented cases of business compromise and evolving detection tactics.
Invisible Characters in Phishing: Attackers are using invisible characters in email subject lines to bypass detection and trick recipients.
Grok Abuse for Phishing: Attackers are exploiting the Grok platform to distribute phishing links.
Surge in Credential Theft: Large-scale credential theft and trading continues unabated, with significant numbers of newly compromised emails.
Chrome HTTP Warnings: Google Chrome will begin warning users before connecting to insecure HTTP sites starting with version 154 in October 2026.

Regulatory or Policy Developments

UN Cybercrime Convention: Around 70 countries have signed a new UN cybercrime convention, though concerns have been raised about expanded surveillance and potential criminalization of security research.
Python Software Foundation Grant Rejection: The PSF withdrew a $1.5 million U.S. National Science Foundation grant proposal due to terms that conflicted with its diversity and inclusion commitments.
Microsoft Copilot Lawsuit: The Australian Competition and Consumer Commission (ACCC) has filed suit against Microsoft, alleging the company misled 2.7 million Australians into subscribing to Copilot M365.
Windows 11 Security Update: Microsoft released the KB5067036 preview update, introducing the Administrator Protection cybersecurity feature for Windows 11 24H2 and 25H2.

Cybersecurity Brief – 2025-10-15

Wed, 15 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Department of Justice, with UK cooperation, seized $15 billion in bitcoin from the leader of the Prince Group, a criminal syndicate responsible for large-scale “pig butchering” cryptocurrency investment fraud targeting US victims.
Harvard University was confirmed as a victim of the Oracle E-Business Suite zero-day vulnerability (CVE-2025-61884), with over 1TB of data allegedly stolen and leaked by the Cl0p ransomware group.
Chinese APT threat actors, attributed as “Flax Typhoon,” compromised an ArcGIS geo-mapping server, maintaining undetected persistence for over a year by modifying the software into a stealth backdoor.
Malicious crypto-stealing Visual Studio Code extensions, attributed to the “TigerJack” group, resurfaced on the OpenVSX registry and the Microsoft VSCode marketplace, targeting developers to exfiltrate cryptocurrency and sensitive data.

Newly Discovered Vulnerabilities

SAP released patches for 13 new vulnerabilities, including a maximum-severity bug in SAP NetWeaver AS Java that allows unauthenticated arbitrary command execution.
Oracle silently patched a zero-day vulnerability (CVE-2025-61884) in Oracle E-Business Suite, which had been publicly exploited with a proof-of-concept leaked by the ShinyHunters group.
A new side-channel attack, “Pixnapping,” was disclosed affecting Google and Samsung Android devices, enabling malicious apps with no permissions to steal 2FA codes, Google Maps timelines, and other sensitive data by extracting pixels from the display. Google has issued a partial patch.
AMD issued fixes for “RMPocalypse,” a vulnerability in Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP), which could allow attackers to undermine confidential computing guarantees with a single 8-byte write.
Nearly 200,000 Linux Framework laptops were shipped with signed UEFI shell components, exposing them to Secure Boot bypass attacks.
Adobe published advisories for over 35 vulnerabilities across its products, including a critical flaw in the Connect Collaboration Suite.

Notable Threat Actor Activity

Chinese state-backed actors (“Flax Typhoon”) exploited the ArcGIS server for year-long persistence and stealth access.
ShinyHunters leaked a proof-of-concept exploit for the Oracle E-Business Suite zero-day, leading to real-world breaches.
TigerJack continues to distribute malicious VSCode extensions to steal cryptocurrency from developers.

Trends, Tools, or Tactics of Interest

A new phishing campaign is leveraging AI tools to craft emails and evade detection, indicating increased sophistication in social engineering attacks.
Infostealers are increasingly targeting clipboard content, including images, for data exfiltration and on-the-fly modification (e.g., crypto-wallet address swapping).
Research into hacktivist campaigns identified over 2,000 unique hashtags across 11,000 posts, providing insight into hacktivist targeting and campaign organisation.
The emergence of autonomous AI agents in enterprise environments (“Shadow AI”) is shifting security risks, with agents now capable of opening tickets, fixing incidents, and making operational decisions independently.
Security firms FuzzingLabs and Gecko Security are in dispute over CVE reporting credit, highlighting ongoing issues around vulnerability disclosure attribution.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Windows 10 and Exchange Server 2016/2019 have reached end-of-support, with no further security updates provided. Microsoft is urging customers to migrate to supported platforms.
The US and UK coordinated law enforcement action against the Prince Group, marking one of the largest cryptocurrency seizures in history.
Cybereason is to be acquired by LevelBlue, continuing consolidation in the managed security services provider (MSSP) sector.

Cybersecurity Brief – 2025-10-02

Thu, 02 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Motility Software Solutions suffered a ransomware attack exposing sensitive data of 766,000 dealership software clients.
WestJet confirmed that a cyberattack compromised personal information, including passport and ID documents, of 1.2 million customers.
Allianz Life announced that a July data breach impacted nearly 1.5 million individuals.
Adobe disclosed an ingestion bug in its Analytics platform that resulted in customer tracking data being exposed to other tenants for approximately one day.
Executives at multiple companies received extortion emails from the Clop ransomware group, claiming theft of sensitive data from Oracle E-Business Suite systems.
Unknown threat actors have exploited Milesight industrial cellular routers since at least February 2022 to send smishing SMS messages targeting European users.

Newly Discovered Vulnerabilities

A critical vulnerability in Red Hat OpenShift AI could allow attackers to escalate privileges and gain full control over hybrid cloud infrastructure under specific conditions.
A high-severity flaw in One Identity OneLogin IAM allowed attackers to use API keys to steal OpenID Connect (OIDC) secrets and impersonate applications.
OpenSSL patched three vulnerabilities that could allow private key recovery, code execution, and denial-of-service attacks.
Google’s Gemini AI suite contained vulnerabilities permitting attackers to embed malicious instructions in user web activity.
A bug in classic Outlook causes the client to crash on launch, with resolution only available via Microsoft Exchange Online support.
A newly demonstrated attack, dubbed “WireTap” or “Battering RAM,” enables attackers with physical access to extract Intel SGX ECDSA keys and break confidential computing protections on Intel and AMD processors via DDR4 memory-bus interposers.
Broadcom failed to disclose zero-day exploitation of a VMware vulnerability affecting Aria Operations and VMware Tools, which could allow privilege escalation on virtual machines.

Notable Threat Actor Activity

The Clop ransomware group is conducting a new extortion campaign targeting Oracle E-Business Suite users.
A previously undocumented Android banking trojan, “Klopatra,” has infected over 3,000 devices, mainly in Spain and Italy, using hidden VNC for remote control.
Chinese APT “Phantom Taurus” is targeting organisations with the Net-Star malware, focusing on espionage and using infrastructure linked to other Chinese APTs but employing distinct TTPs.
Threat group UNC6040 (ShinyHunters) has been observed using advanced social engineering tactics to breach Salesforce environments.
The Rhadamanthys malware, a complex multi-modular stealer sold on underground markets since 2022, has received notable updates.

Trends, Tools, or Tactics of Interest

Bitdefender’s 2025 Cybersecurity Assessment Report highlights increased pressure to conceal breaches, expanding attack surfaces, and rising misperceptions around AI security.
Attackers are leveraging industrial IoT devices (Milesight routers) to conduct large-scale smishing campaigns.
The Klopatra Android malware uses hidden VNC for hands-on device control, indicating a trend towards more interactive mobile banking attacks.
Research demonstrates that confidential computing protections (Intel SGX, AMD SEV) can be bypassed with low-cost hardware if physical access is obtained.
“Burp AI” is being adopted by security professionals for automated vulnerability scanning in bug bounty workflows.
Google Drive for desktop is rolling out AI-powered ransomware detection that pauses file syncing upon detecting an attack.
AmCache forensic artifact analysis is highlighted as valuable for incident investigations, with new command-line tools available for data extraction.
Undead (unsupported) operating systems, especially with Windows 10 reaching end-of-life, are set to significantly increase the vulnerable attack surface in enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

KnowBe4 is pursuing ISO 42001 certification for AI governance as it integrates more AI into its human risk management platform.
F-Droid project warns it may cease operations due to Google’s new developer identity verification requirements.
NIST published Special Publication 1334, offering guidance on mitigating USB-borne threats in industrial control system (ICS) and OT environments.
CISA reiterates that microsegmentation is foundational, not optional, for zero trust architectures, and highlights modern, automated approaches to implementation.
Microsoft will begin automatic installation of Microsoft 365 companion apps on Windows 11 devices with existing Microsoft 365 desktop clients later this month.

Cybersecurity Brief – 2025-10-01

Wed, 01 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

UK law enforcement seized £5.5 billion (~$7.39 billion) in Bitcoin from a Chinese national convicted for involvement in a fraudulent cryptocurrency scheme, marking the world’s largest crypto asset seizure to date.
Canadian airline WestJet confirmed that a recent cyberattack compromised sensitive customer information, including passports and ID documents.
Beer producer Asahi suffered a cyberattack that disrupted production, order processing, shipments, and call centre operations in Japan.
Imgur has blocked UK users from accessing its platform after the UK data protection authority signalled a possible monetary penalty for non-compliance.
Interpol arrested 260 individuals involved in romance scams and sextortion, identifying 1,463 victims and $2.8 million in losses.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-32463) in the Linux sudo package is being actively exploited, allowing attackers to execute commands with root privileges.
Western Digital patched a critical remote command injection vulnerability in multiple My Cloud NAS models.
Apple released updates for iOS and macOS to address a critical font processing vulnerability (CVE-2025-43400) that could enable denial-of-service or memory corruption.
Nearly 50,000 Cisco ASA and FTD firewalls exposed on the public internet remain vulnerable to two actively exploited flaws.
Broadcom released security updates for high-severity vulnerabilities in VMware Aria Operations, NSX, and vCenter, including privilege escalation and username enumeration flaws.
Academics disclosed the “Battering RAM” vulnerability affecting Intel and AMD cloud processors, capable of bypassing the latest hardware security defences.
Security researchers disclosed and Google patched three vulnerabilities in Google Gemini AI, including prompt injection and cloud exploitation methods.
Researchers highlighted multiple security issues in Life360’s Tile trackers, primarily due to lack of encryption.

Notable Threat Actor Activity

A previously undocumented China-linked APT group, “Phantom Taurus,” targeted government and telecommunications entities across Africa, the Middle East, and Asia using stealthy, fileless malware such as IIServerCore.
The China-linked threat actor UNC5174 exploited a VMware zero-day (privilege escalation in VMware Tools and Aria Operations) since October 2024 in active attacks.
A new Android banking trojan, “Datzbro,” is using AI-generated Facebook travel events to target elderly users, enabling device takeover and fraudulent transactions.
The “Klopatra” banking trojan has infected thousands of victims in Italy and Spain, capable of conducting automated bank transfers while users are inactive.

Trends, Tools, or Tactics of Interest

Attackers are leveraging the new MatrixPDF toolkit to weaponise PDF files for phishing and malware campaigns, enabling interactive lures that bypass email security and facilitate credential theft.
The proliferation of “shadow AI” risks is increasing as organisations adopt agentic AI and embedded LLMs, with associated security challenges highlighted in both enterprise and SaaS environments.
Dark web exploit markets continue to thrive, with evolving pricing models, access methods, and a growing arsenal for sale to threat actors.
Security operations centres (SOCs) are challenged by alert fatigue and the need for contextual incident response, with legacy systems contributing to inefficiency.
Weak default passwords in IoT and web applications remain a common entry point for attackers, as highlighted in recent honeypot and password research.

Regulatory or Policy Developments Affecting the Security Industry

China introduced a regulation mandating that major cyber incidents must be reported within one hour, signalling an increased focus on internal cybersecurity posture.
California enacted the Transparency in Frontier Artificial Intelligence Act (TFAIA), requiring AI companies to implement and publicly disclose safety protocols for advanced models.
New international guidance urges operators of operational technology (OT) environments to maintain continually updated system inventories for improved security and resilience.
The UK data watchdog’s enforcement against Imgur demonstrates increasing regulatory scrutiny and penalties for non-compliance with data protection requirements.
The US Federal Trade Commission (FTC) filed suit against Sendit for illegally collecting data from underage users and deceptive subscription practices.

Cybersecurity Brief – 2025-08-14

Thu, 14 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

The Office of the Pennsylvania Attorney General experienced a cyberattack that disrupted email, phone systems, and their website.
Manpower disclosed a data breach affecting 140,000 individuals after the RansomHub ransomware group stole sensitive information in January.
US investigators confirmed that Russian hackers breached the US court electronic filing system, accessing court records and sealed filings.
Norwegian police attributed suspected sabotage at a dam to pro-Russian hackers, who accessed and manipulated a remote valve control system.

Newly Discovered Vulnerabilities

Fortinet disclosed a critical pre-authentication remote code execution vulnerability (CVE-2025-25256) in FortiSIEM, with exploit code observed in the wild. A surge in brute-force attacks against Fortinet SSL VPNs and FortiManager was also reported.
CISA added two N-able N-central vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Zoom and Xerox released critical security updates addressing privilege escalation and remote code execution flaws in Zoom Clients for Windows and FreeFlow Core, respectively.
Microsoft’s August 2025 Patch Tuesday addressed 111 vulnerabilities, including a publicly known Kerberos zero-day and multiple high-severity flaws.
Intel, AMD, and Nvidia published advisories for numerous vulnerabilities in their products as part of their coordinated Patch Tuesday releases.
A new downgrade attack was demonstrated against Microsoft Entra ID, enabling bypass of FIDO authentication by coercing users into weaker authentication methods.
A critical vulnerability (CVSS 10) in an Erlang-based OT platform was observed being actively exploited to target operational technology networks.

Notable Threat Actor Activity

North Korean threat actors deployed a variety of malware, including stealers, backdoors, and ransomware, against South Korean targets in a multi-pronged campaign.
Pro-Russian hackers were linked to both the sabotage of a Norwegian dam and the breach of the US court system.
A significant increase in brute-force attacks targeting Fortinet SSL VPN appliances was observed, raising concerns of potential zero-day exploitation.

Trends, Tools, or Tactics of Interest

Phishing and scam campaigns are increasingly leveraging AI, deepfakes, Telegram, Google Translate, and Blob URLs, with new methods targeting biometric data.
A new malvertising campaign is distributing the modular PS1Bot malware, which uses multi-stage in-memory attack techniques.
Persistent exploitation of older vulnerabilities, such as CVE-2017-11882, continues to be reported.
AI-based tools are gaining traction in penetration testing, with an automated pen tester becoming a top bug hunter on HackerOne.
Open source AI models are reportedly less effective in vulnerability research compared to commercial and underground models.
Data brokers are facing scrutiny for hiding privacy opt-out tools from search engines, with regulatory pressure increasing for transparency.
Reports highlight the continued presence of the XZ Utils backdoor in legacy Docker images, though the risk of exploitation is considered low.

Regulatory or Policy Developments Affecting the Security Industry

CISA and partners released new asset inventory guidance aimed at improving operational technology (OT) security practices.
Increased policy attention in the US on data broker practices, with calls for improved visibility and accessibility of consumer privacy controls.
Microsoft announced the removal of PowerShell 2.0 from Windows 11 and Windows Server starting August 2025, following its long-standing deprecation.

Cybersecurity Brief – 2025-08-13

Wed, 13 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Microsoft’s August 2025 Patch Tuesday addressed 107–111 vulnerabilities, including 13–17 rated as critical. One publicly disclosed zero-day vulnerability in Windows Kerberos was patched, alongside several elevation-of-privilege flaws.
Adobe released security updates fixing over 60 vulnerabilities across 13 products, including Commerce, Substance, InDesign, FrameMaker, and Dimension.
SAP patched a critical vulnerability in S/4HANA as part of its August 2025 security notes.
Major industrial control system (ICS) vendors (Siemens, Schneider, Aveva, Honeywell, ABB, Phoenix Contact) issued advisories for code execution vulnerabilities.
Citrix NetScaler ADC products are being actively exploited via CVE-2025-6543, a critical security flaw confirmed by the Dutch National Cyber Security Centre (NCSC-NL).
A vulnerability in Erlang/OTP (CVE-2025-32433) has been widely exploited in operational technology (OT) networks since early May.
A now-patched WinRAR vulnerability has been exploited by at least two separate threat groups.

Notable Threat Actor Activity

The Charon ransomware family, employing APT-level evasion tactics, has been deployed in targeted attacks against public sector and aviation organisations in the Middle East. The campaign may be linked to China’s state-sponsored Earth Baxia group.
Cybercrime groups ShinyHunters and Scattered Spider have joined forces in data extortion campaigns, initially targeting Salesforce customers, with indications of expansion towards financial services and technology providers. ShinyHunters’ tactics now mirror those of Scattered Spider.
The newly identified Curly COMrades APT group has targeted government entities in Georgia and Moldova using custom backdoor malware and NGEN COM hijacking for persistent access.
Fortinet SSL VPN devices experienced a significant spike in brute-force attacks globally, with attackers later shifting focus to FortiManager.
Researchers report ongoing exploitation of Microsoft Teams in social engineering attacks to facilitate credential theft and malware delivery.

Trends, Tools, or Tactics of Interest

Supply chain risks persist as malicious Docker images with the XZ Utils backdoor remain available on Docker Hub.
Threat actors continue to abuse business logic flaws and leverage dark web marketplaces to sell enterprise network access, streamlining cybercrime operations.
Social engineering remains a prominent attack vector, with attackers exploiting communication platforms (e.g., Microsoft Teams) and using tactics such as tax office or Amazon recall impersonation scams.
APT actors are leveraging advanced persistence techniques, such as NGEN COM hijacking and scheduled tasks, to maintain long-term access in targeted environments.
The debate between enterprise browsers and secure browser extensions is highlighted as a key consideration for mitigating browser-based risks.
Elevation-of-privilege vulnerabilities dominated Microsoft’s August 2025 Patch Tuesday, reflecting ongoing attacker interest in privilege escalation.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced end-of-support for Windows 11 23H2 Home and Pro editions in November 2025.
Android’s protected Kernel-based Virtual Machine (pKVM) achieved SESIP Level 5 security certification, the highest level for IoT and mobile platforms.
The Dutch NCSC issued an alert regarding active exploitation of Citrix NetScaler CVE-2025-6543 in critical sectors.
Chinese authorities have publicly questioned the security of AI chips from Nvidia and AMD, citing concerns about potential backdoors.

Cybersecurity Brief – 2025-07-12

Sat, 12 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE-2025-25257) in FortiWeb that allows unauthenticated attackers to execute arbitrary database commands. Proof-of-concept exploits for this vulnerability have been publicly released.
Security researchers disclosed four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack (“PerfektBlue”), which could allow remote code execution on millions of vehicles (including Mercedes, Skoda, and Volkswagen) and over a billion industrial, medical, mobile, and consumer devices.
The U.S. CISA confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway, mandating federal agencies to patch within 24 hours.
A zero-day vulnerability in OpenVSX, a popular extension marketplace, was discovered and patched. The flaw could have enabled attackers to compromise millions of developer machines via a supply chain attack.
Microsoft disclosed new attack techniques targeting AMD CPUs.
NVIDIA issued guidance recommending activation of System Level Error-Correcting Code (ECC) to mitigate Rowhammer attacks on GPUs with GDDR6 memory. Researchers demonstrated Rowhammer-based “GPUHammer” attacks that can degrade machine learning model accuracy.

Notable Threat Actor Activity

The Iranian-backed Pay2Key ransomware-as-a-service operation has resurfaced, offering affiliates an increased profit share (80%) for attacks targeting Western organisations, particularly in the US and Israel. This follows recent geopolitical tensions involving Iran, Israel, and the US.
The Indian APT group DoNot is actively targeting government entities.

Trends, Tools, or Tactics of Interest

Researchers at Netcraft highlighted that AI-generated search engine summaries are inadvertently directing users to phishing sites when queried for legitimate login pages, posing a new phishing risk vector.
SentinelOne reported evolution in the ZuRu macOS malware family.
The 2025 Data Risk Report notes heightened data loss risks from AI-powered tools, with calls for unified, AI-driven data security strategies.
Cyber-insurance premiums are declining from previous highs, though comprehensive coverage remains vital for risk management.
There is increased emphasis on integrating cybersecurity into financial sector digital transformation strategies.
Discussion of passwordless authentication mechanisms-specifically passkeys using public key cryptography-to address the inherent risks of shared secrets in traditional password systems.

Regulatory or Policy Developments

The European Union unveiled a voluntary AI Code of Practice to help businesses comply with the phased rollout of the EU AI Act.
The Irish Data Privacy Commission opened a new investigation into TikTok regarding the transfer of user data to China under EU privacy regulations.
Google did not release a scheduled July 2025 Android security patch, breaking a ten-year streak of monthly updates.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.