Axios on DanSec Daily

Cybersecurity Brief – 2026-04-14

Tue, 14 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Basic-Fit, a major European gym chain, disclosed a data breach affecting one million customers, with hackers accessing personal information.
Booking.com confirmed unauthorized access to its systems, exposing sensitive reservation and user data and prompting a forced reset of reservation PINs.
Rockstar Games suffered a data breach involving analytics data, attributed to the ShinyHunters extortion gang, following a security incident at analytics provider Anodot.
CPUID, developer of CPU-Z and HWMonitor, was compromised, leading to the distribution of trojanized installers (STX RAT) via modified download links.
OpenAI rotated macOS code-signing certificates following a supply chain attack involving a malicious Axios package executed in a GitHub Actions workflow; the incident is linked to North Korea.
The Los Angeles Police Department reported a data breach, as highlighted in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

Adobe released an emergency fix for a zero-day vulnerability (CVE-2026-34621) in Acrobat and Reader, which has been exploited in the wild since at least December 2025. The flaw allowed remote code execution via malicious PDF files.
ShowDoc, a document management platform, is affected by a critical remote code execution vulnerability (CVE-2025-0520) that is actively exploited on unpatched servers.
A critical vulnerability in the wolfSSL library allows attackers to bypass certificate verification by exploiting improper handling of the hash algorithm or size in ECDSA signature checks.
CISA added six actively exploited vulnerabilities affecting Fortinet, Microsoft, and Adobe products to its Known Exploited Vulnerabilities (KEV) catalog, indicating ongoing exploitation.

Notable Threat Actor Activity

JanelaRAT, a financial malware derived from BX RAT, has been observed in an ongoing campaign targeting banks and financial institutions in Latin America, with over 14,700 attacks in Brazil in 2025. The latest variants show updates to infection chains and malware capabilities.
North Korea-linked APT37 (ScarCruft) is conducting a multi-stage social engineering campaign via Facebook, delivering the RokRAT malware to targets.
APT41, a Chinese state-backed group, is deploying a “zero-detection” backdoor to harvest cloud credentials from AWS, Google, Azure, and Alibaba environments, using typosquatting to obscure command-and-control communications.
The W3LL phishing network, responsible for global phishing campaigns and $20 million in fraud attempts, was dismantled in a joint operation by the FBI and Indonesian police, resulting in the arrest of the alleged developer.
A new commodity phishing kit, “Venom Stealer,” is enabling automation of ClickFix attacks, a social engineering technique used to bypass multi-factor authentication.
A new infostealer dubbed “Storm” leverages server-side decryption to hijack browser sessions, enabling attackers to bypass passwords and multi-factor authentication protections.
Fake Claude (Anthropic) websites are distributing PlugX RAT via DLL sideloading, using legitimate branding to lure victims and employing clean-up routines post-infection.
Russian-speaking threat actors compromised CPUID’s download infrastructure to distribute the STX RAT.
International law enforcement operations in the US, UK, and Canada targeted multimillion-dollar cryptocurrency theft schemes, identifying over $45 million in stolen assets and freezing $12 million.

Trends, Tools, or Tactics of Interest

Anthropic’s Claude Mythos AI model was temporarily restricted after autonomously discovering and exploiting zero-day vulnerabilities across major operating systems and browsers, prompting warnings of a potential “AI vulnerability storm.”
Attackers are increasingly scanning for webshells, including EncystPHP, with a focus on those lacking authentication or secured with default credentials.
There is a trend toward server-side decryption in infostealer malware, as demonstrated by the “Storm” infostealer, which enables session hijacking and circumvents MFA.
Social engineering via social media platforms (e.g., Facebook) continues to be leveraged by state actors for initial access and malware delivery.
Gmail has introduced end-to-end encryption for enterprise users on Android and iOS, allowing secure message composition and reading on mobile devices.

Regulatory or Policy Developments Affecting the Security Industry

Operational Technology (OT) asset owners are being required by regulators to attest to their post-quantum cryptographic readiness, despite lacking adequate tooling to provide genuine security assurances.
Civil society organizations have issued warnings to Meta regarding potential risks associated with facial recognition features in smart glasses, citing privacy and safety concerns for vulnerable populations.

Cybersecurity Brief – 2026-04-13

Mon, 13 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

OpenAI revoked its macOS app certificate after discovering that a GitHub Actions workflow used to sign its macOS apps had downloaded a malicious version of the Axios library on March 31. OpenAI stated that no user data or internal systems were compromised as a result of this supply chain incident.

Newly Discovered Vulnerabilities

A critical pre-authentication remote code execution (RCE) vulnerability in Marimo is now under active exploitation. Attackers are leveraging this flaw to steal credentials.

Cybersecurity Brief – 2026-04-07

Tue, 07 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Newly Discovered Vulnerabilities

Flowise AI Agent Builder is under active exploitation for a CVSS 10.0 remote code execution vulnerability. Over 12,000 instances are exposed.
Fortinet issued an emergency patch for a zero-day authentication bypass flaw (CVE-2026-35616) in FortiClient EMS, which allows unauthenticated remote code execution. CISA has mandated federal agencies patch this vulnerability.
A new GPUBreach attack technique enables privilege escalation and system takeover through Rowhammer-induced bit-flips on GPU GDDR6 memory.
Exploit code for an unpatched Windows privilege escalation zero-day (“BlueHammer”) was leaked, allowing local attackers to gain SYSTEM or administrator privileges.
Automated credential harvesting campaigns are exploiting the React2Shell flaw in vulnerable Next.js applications.
Google DeepMind researchers identified “AI Agent Traps,” a vulnerability that allows attackers to manipulate and exploit AI agents via malicious web content.

Notable Threat Actor Activity

China-linked Storm-1175 has been observed exploiting zero-day and n-day vulnerabilities to rapidly deploy Medusa ransomware in high-velocity attacks.
Qilin and Warlock ransomware groups are using the bring-your-own-vulnerable-driver (BYOVD) tactic to disable over 300 endpoint detection and response (EDR) tools during ransomware deployment.
An Iran-linked threat actor is conducting password-spraying attacks against over 300 Israeli and UAE Microsoft 365 organisations.
DPRK-linked actors are using GitHub as command-and-control infrastructure in multi-stage attacks targeting South Korean entities.
North Korean threat actors are targeting Node.js maintainers with social engineering as part of supply chain attacks.
A threat cluster tracked as UAT-10608 is automating credential harvesting by exploiting web-exposed Next.js applications.

Trends, Tools, or Tactics of Interest

There is increased use of AI-assisted tools by threat actors in supply chain attacks, as seen in the PRT-scan campaign targeting GitHub misconfigurations.
Social engineering targeting open-source maintainers is becoming industrialised, with attackers leveraging complex, scalable tactics.
The BYOVD technique remains prevalent among ransomware operators for bypassing security controls.
Open redirects continue to be widely abused in phishing campaigns.
Infostealers are harvesting credentials and session cookies at scale, outpacing traditional breach monitoring capabilities.
Developer workstations are being increasingly targeted as entry points for credential theft and lateral movement.
Shadow AI use in healthcare persists, with medical professionals adopting unsanctioned AI tools.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Fortinet EMS vulnerability by Friday.
The OWASP GenAI Security Project has updated its risk matrix, now recognising 21 generative AI risks and recommending tailored security approaches for GenAI and agentic AI systems.
German authorities have formally identified two Russian nationals as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021.
Microsoft has deprecated and removed the Support and Recovery Assistant (SaRA) tool from all supported Windows versions as of March 10.

Cybersecurity Brief – 2026-04-05

Sun, 05 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The European Commission confirmed a data breach resulting from the Trivy supply chain attack, with attackers exfiltrating over 300GB of data from the Commission’s AWS environment, including personal information.
Hackers reportedly stole Cisco source code as part of an ongoing supply chain hacking campaign.
The FBI disclosed that a recent hack of its wiretap tools poses a national security risk.

Newly Discovered Vulnerabilities

Fortinet released out-of-band patches for a critical vulnerability in FortiClient EMS, tracked as CVE-2026-35616. The flaw has a high CVSS score and has been actively exploited in the wild.

Notable Threat Actor Activity

Researchers identified 36 malicious npm packages disguised as Strapi CMS plugins. These packages delivered various payloads to exploit Redis and PostgreSQL databases, enabling persistent implants.
Axios maintainers detailed a targeted social engineering campaign where a developer was tricked by a fake Microsoft Teams error fix, leading to the hijacking of a maintainer account. The campaign is believed to be linked to a sophisticated threat actor.

Trends, Tools, or Tactics of Interest

Device code phishing attacks leveraging the OAuth 2.0 Device Authorization Grant flow have surged 37-fold this year, driven by the proliferation of new phishing kits available online.
Malicious actors are distributing the leaked Claude AI code online, bundling it with additional malware.

Cybersecurity Brief – 2026-04-04

Sat, 04 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Solana-based decentralized exchange Drift confirmed a security incident on 1 April 2026, resulting in a loss of approximately $285 million. The attack, attributed to North Korean threat actors, exploited durable nonces and social engineering to compromise an admin key and drain five vaults.
Hims & Hers Health disclosed a data breach involving the theft of support tickets from a third-party customer service platform (Zendesk).
The German political party Die Linke suffered an IT systems outage and data theft, with the Qilin ransomware group claiming responsibility and threatening to leak sensitive data.
Meta paused work with data vendor Mercor after a data breach potentially exposed sensitive AI industry secrets, affecting major AI labs.
T-Mobile clarified that a recent insider-driven cybersecurity incident had a limited impact.
European Commission cloud infrastructure was breached as part of the ongoing TeamPCP supply chain campaign, with over 1,000 SaaS environments reportedly affected. Sportradar was also named among impacted organizations.
Sensitive Customs and Border Protection (CBP) facility codes leaked via publicly accessible online flashcards.
Axios npm package was compromised in a supply chain attack following a targeted social engineering campaign by North Korean threat actors (UNC1069).
ChatGPT experienced a data leak, and a water facility was hit by ransomware, according to SecurityWeek’s round-up.

Newly Discovered Vulnerabilities

Critical vulnerabilities in Citrix ShareFile could be chained to bypass authentication and achieve unauthenticated remote code execution (RCE) via arbitrary file uploads.
A zero-day vulnerability in the TrueConf video conferencing platform was exploited by a Chinese threat actor for reconnaissance, privilege escalation, and payload execution in attacks on Asian government entities.
Microsoft detailed the use of cookie-controlled PHP web shells on Linux servers, enabling persistent remote code execution via cron jobs.
A new variant of the SparkCat malware was found in iOS and Android apps on official app stores, stealing images of crypto wallet recovery phrases.
React2Shell vulnerability was exploited in a large-scale credential harvesting campaign, compromising over 750 systems.
Apple released an iOS 18 patch for the DarkSword mobile OS-cracking tool, extending protection to devices unable to upgrade to iOS 26.
Symantec vulnerability and anti-ClickFix mechanisms for macOS were also noted in recent security news.

Notable Threat Actor Activity

North Korean threat actors (UNC1069) conducted a targeted social engineering campaign against the Axios npm maintainer, resulting in a supply chain compromise.
North Korean actors were attributed to the $285 million Drift DEX heist, leveraging nonce-based transactions and admin key compromise.
China-linked TA416 resumed targeting European government and diplomatic organizations since mid-2025, using PlugX malware and OAuth-based phishing.
Chinese threat actors exploited a TrueConf zero-day in attacks against Asian governments.
TeamPCP’s supply chain campaign continues to expand, with additional attribution disputes involving ShinyHunters and Lapsus$.
Criminal threat actors increased phishing attacks by 130% by exploiting the conflict in Iran, according to Bitdefender.
Job scam campaigns impersonating Coca-Cola and Ferrari were discovered, targeting user credentials for Google and Facebook accounts.
Qilin ransomware group was responsible for the Die Linke breach and extortion.

Trends, Tools, or Tactics of Interest

Multi-extortion ransomware attacks are increasingly leveraging stolen data for public leaks, intensifying pressure on victims.
Third-party and supply chain risks remain a significant security gap, as highlighted by recent breaches and campaigns.
Mobile attack surfaces are expanding due to shadow AI in apps, outdated devices, and zero-click exploits.
Threat actors are using HTTP cookies as control channels for PHP web shells on Linux, with persistence achieved via cron jobs.
Automated credential harvesting campaigns are utilizing frameworks like Nexus Listener and large-scale scanning.
Unmanaged Windows 11 24H2 devices are being force-upgraded by Microsoft to 25H2.
LinkedIn was reported to be secretly scanning for over 6,000 Chrome extensions and collecting device data via hidden JavaScript.
Emerging research suggests “skull vibration harmonics” could be used for authentication in XR headsets.
Chainguard released Factory 2.0, a platform to automate and harden the software supply chain.
CrowdStrike’s next-gen SIEM now ingests Microsoft Defender telemetry, reflecting increased integration between major security vendors.
Outbound email security and the need for IT staff security awareness training were emphasized in recent industry commentary.
Inconsistent privacy labels for mobile apps were highlighted as inadequate for informing users of data practices.

Regulatory or Policy Developments Affecting the Security Industry

Governments are implementing varied age-based bans on social media access for children, though execution and effectiveness remain debated.
The FBI classified a recent hack as a “major incident,” indicating increased regulatory scrutiny on federal cybersecurity events.

Cybersecurity Brief – 2026-04-02

Thu, 02 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Hasbro, the global toy manufacturer, has disclosed a cyberattack and is investigating the extent of potential data compromise.
The Axios NPM package was breached in a North Korean supply chain attack. Attackers used a stolen NPM access token to bypass GitHub Actions OIDC-based CI/CD controls and publish backdoored package versions.
CERT-UA reported a phishing campaign impersonating the agency to distribute AGEWHEEZE malware to approximately 1 million email addresses.
TrueConf conference servers were targeted via a zero-day vulnerability, allowing attackers to execute arbitrary files on connected endpoints through malicious software updates.
Over 2.3 million Android devices were infected with the NoVoice malware, which was distributed through more than 50 apps on Google Play.
A new service, EvilTokens, is enabling device code phishing attacks against Microsoft accounts, facilitating advanced business email compromise (BEC) campaigns.
The TeamPCP supply chain campaign update confirmed its first victim and documented post-compromise cloud enumeration activities, with attribution narrowing towards specific threat actors.
A new phishing campaign is targeting Spanish-speaking users in Latin America and Europe with dynamic PDF lures to deliver Casbaneiro (Metamorfo) banking trojans.
Cyberattacks against Latin American governments have intensified, with disruptive incidents in Puerto Rico and a surge in attacks on Colombia’s health sector.
The US Department of Justice has charged an individual for exploiting smart contract vulnerabilities to steal $55 million from the Uranium crypto exchange, leading to its shutdown.

Newly Discovered Vulnerabilities

Google released patches for 21 vulnerabilities in Chrome, including the actively exploited zero-day CVE-2026-5281 affecting the Dawn component. This is the fourth Chrome zero-day exploited in 2026.
Apple expanded the iOS 18.7.7 and iPadOS 18.7.7 security updates to more devices to address the DarkSword exploit kit, which is being actively exploited.
A zero-day vulnerability in TrueConf conferencing software was exploited in the wild to deliver malicious updates and execute arbitrary files on endpoints.

Notable Threat Actor Activity

North Korean threat actors are attributed to the Axios NPM supply chain attack, leveraging a compromised token to distribute malicious packages.
Microsoft and Malwarebytes warn of an ongoing campaign distributing VBS malware via WhatsApp messages on Windows. The campaign uses UAC bypass techniques to hijack systems and has been active since late February 2026.
The Casbaneiro group continues to target Spanish-speaking users in Latin America and Europe with phishing campaigns delivering banking trojans.
The Venom Stealer malware-as-a-service (MaaS) platform is automating persistent information-stealing attacks, specifically commoditising ClickFix social engineering techniques.
The new CrystalRAT malware, promoted via Telegram, combines remote access, credential theft, keylogging, and clipboard hijacking, and is available as malware-as-a-service.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging legitimate tools and valid credentials for initial access, with a decline in traditional malware use. Common vectors include VPN abuse, remote monitoring and management (RMM) tools, and social engineering.
Fileless malware and malicious scripts are being used to minimise filesystem footprint while maintaining persistence.
Device code phishing and business email compromise are being facilitated by new toolkits like EvilTokens.
ClickFix attacks are being commoditised via MaaS platforms, with new malware such as DeepLoad deployed to steal credentials, install malicious browser extensions, and propagate via USB drives.
The public sector and education face persistent threats, with resource constraints and human risk remaining key vulnerabilities.
Fraudsters are increasingly targeting the digital assets of deceased individuals and their families for account takeover and scams.

Regulatory or Policy Developments Affecting the Security Industry

The FBI issued a warning regarding privacy and data security risks associated with Chinese-developed mobile applications, though no specific apps were named.
The US Department of Justice continues to pursue prosecution of cybercriminals, as evidenced by the Uranium crypto exchange case.

Other Notable Industry Developments

Linx Security raised $50 million to advance identity security and governance solutions.
Depthfirst secured $80 million in Series B funding to expand AI research and security model development.

Cybersecurity Brief – 2026-04-01

Wed, 01 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Cisco Source Code Breach: Cisco confirmed a cyberattack resulting in the theft of internal source code. Attackers leveraged credentials stolen in the recent Trivy supply chain incident to breach Cisco’s development environment.
Axios NPM Package Compromise: The npm account for Axios, a widely-used JavaScript HTTP client, was hijacked to distribute remote access trojans targeting Linux, Windows, and macOS. The attack is suspected to have North Korean threat actor involvement.
Claude Code Source Leak: Anthropic disclosed that internal source code for its Claude Code AI assistant was inadvertently published via an npm packaging error. No customer data or credentials were exposed.
TrueConf Zero-Day Exploitation: Government networks in Southeast Asia were targeted using a zero-day vulnerability in TrueConf video conferencing software, in a campaign dubbed “Operation TrueChaos.”
Uranium Finance Crypto Exchange Theft: A Maryland individual was charged with stealing $53 million from Uranium Finance through two hacks, subsequently laundering the proceeds via a cryptocurrency mixer.

Newly Discovered Vulnerabilities

Vertex AI Over-Privilege Flaw: Researchers identified a security issue in Google Cloud’s Vertex AI platform where attackers could weaponize AI agents to access sensitive data and private artifacts due to excessive permissions.
Vim and Emacs RCE Bugs: Remote code execution vulnerabilities were discovered in Vim and GNU Emacs editors, triggered by simply opening a malicious file. These were identified using Anthropic’s Claude AI.
GIGABYTE Control Center Arbitrary File Write: The GIGABYTE Control Center utility is vulnerable to an arbitrary file-write flaw, allowing unauthenticated remote attackers to access files on affected systems.
CrewAI Prompt Injection Vulnerabilities: Security flaws in CrewAI allow attackers to exploit prompt injection, chain vulnerabilities to escape sandboxes, and execute arbitrary code on target devices.
Critical Fortinet FortiClient EMS Flaw: Active exploitation of a critical SQL injection vulnerability in FortiClient EMS enables unauthenticated remote code execution via crafted HTTP requests.
StrongSwan VPN Integer Underflow: An integer underflow vulnerability in StrongSwan, present for 15 years, allows unauthenticated remote attackers to crash VPN services.

Notable Threat Actor Activity

CrystalX RAT: Researchers analyzed CrystalX, a new multi-functional RAT offered as Malware-as-a-Service (MaaS), combining spyware, credential stealing, and prankware features.
Silver Fox Campaign: The Silver Fox threat actor is targeting Chinese-speaking users with a campaign leveraging typosquatted domains and a new RAT, AtlasCross, to deliver malware via fake software brands.
Iranian APTs – Pay2Key and Pseudo-Ransomware: Iranian state-linked groups have revived Pay2Key operations and are deploying pseudo-ransomware tactics, targeting high-impact US organizations and threatening major US tech firms with attacks beginning April 1.
Venom Stealer: The Venom Stealer malware is being actively distributed, with features for persistent, automated credential, session, and cryptocurrency theft.
TeamPCP Cloud Intrusions: The TeamPCP group is conducting rapid attacks on AWS, Azure, and SaaS environments using stolen credentials, validated with tools like TruffleHog, followed by enumeration and lateral movement.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on npm: The Axios incident underscores ongoing risks in the npm ecosystem, with attackers targeting popular packages to distribute cross-platform malware.
Credential Theft as Attack Enabler: Reports highlight the industrialization of credential theft, fueling ransomware, SaaS breaches, and nation-state cyberattacks, shifting focus toward detecting misuse of legitimate access.
Weaponization of AI Agents: Security research demonstrates attackers exploiting AI agents’ over-privileged access (notably in Vertex AI) for lateral movement and data exfiltration.
Continuous Credential Harvesting: Malware such as Venom Stealer is enabling ongoing, automated credential theft, increasing the persistence and scale of attacks.
Speed of Attacks: Threat groups are accelerating the pace of attacks, particularly in cloud and SaaS environments, emphasizing the need for rapid detection and response.

Regulatory or Policy Developments Affecting the Security Industry

Android Developer Verification Rollout: Google has begun rolling out mandatory developer verification for all Android app developers, aiming to reduce the distribution of malicious apps by anonymous actors, with enforcement set for September.
Apple iOS Backported Patches: Apple announced rare backported security patches for iOS 18 users to address vulnerabilities exploited by the DarkSword hacking tool, without requiring upgrades to newer iOS versions.
Google Drive Ransomware Detection: Google has enabled AI-powered ransomware detection by default for all paying Google Drive users, enhancing protection against file-encrypting malware in cloud storage.

Cybersecurity Brief – 2026-03-31

Tue, 31 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

The Dutch Ministry of Finance took its treasury banking portal and some systems offline following a detected cyberattack, as investigations into the breach continue.
Healthcare IT firm CareCloud disclosed a data breach exposing sensitive patient data and causing an eight-hour network disruption.
The European Commission reported a cyber intrusion and data theft, with the ShinyHunters group claiming to have stolen over 350GB of information from Commission cloud systems.
The FBI confirmed Iranian hackers compromised the personal email account of Kash Patel, noting the data accessed was outdated.
Researchers report that nearly 66 billion stolen identity records are now circulating on criminal forums, a 23% increase from the previous year.
Stolen tax documents are being actively sold on the dark web, with prices ranging from $4 to $20 per identity.
TeamPCP supply chain campaign continues to expand, with Telnyx targeted and Databricks investigating an alleged compromise. The campaign involves dual ransomware operations and data leaks, including AstraZeneca data.

Newly Discovered Vulnerabilities

Citrix NetScaler ADC and Gateway appliances are affected by a critical memory leak vulnerability (CVE-2026-3055) that is being actively exploited to obtain sensitive data, including authenticated administrative session IDs. CISA has ordered U.S. federal agencies to patch the flaw by Thursday.
F5 BIG-IP APM vulnerability (CVE-2025-53521), initially classified as a high-severity DoS, has been reclassified as a critical remote code execution (RCE) vulnerability. Active exploitation has been observed, with attackers deploying webshells on unpatched devices.
A previously unknown vulnerability in OpenAI ChatGPT allowed exfiltration of sensitive conversation data without user consent. Additionally, a critical vulnerability in OpenAI Codex was discovered that could have enabled compromise of GitHub tokens.
A critical, alleged “no-click” vulnerability in Telegram, reportedly triggered by a corrupted sticker and rated 9.8 CVSS, is being disputed by Telegram.
A newly identified RoadK1ll WebSocket implant enables lateral movement within breached networks.
Axios npm package versions 1.14.1 and 0.30.4 were compromised in a supply chain attack, pushing a malicious dependency.
Apple added a security feature in macOS Tahoe 26.4 to block potentially harmful commands in Terminal, specifically targeting ClickFix attack vectors.

Notable Threat Actor Activity

Russian-origin CTRL remote access toolkit is being distributed via malicious LNK files masquerading as private key folders. The toolkit hijacks RDP sessions using FRP tunnels.
Russian APT Star Blizzard is using the DarkSword iOS exploit kit in campaigns targeting government, higher education, financial, legal, and think tank sectors.
Iranian state-affiliated threat group Handala Hack has been linked to recent attacks, and Iran-linked groups are increasingly turning to high-volume, low-impact cyberattacks, often leveraging AI.
The ShinyHunters group claimed responsibility for the European Commission data theft.
TeamPCP is running dual ransomware operations and leveraging compromised software supply chains to target multiple organisations.

Trends, Tools, or Tactics of Interest

Secrets sprawl is accelerating, with GitGuardian reporting a significant increase in exposed secrets across public Git repositories in 2025.
The DeepLoad malware loader, distributed via ClickFix social engineering, uses AI-assisted code obfuscation and WMI persistence to evade detection and steal browser credentials.
LLMs (Large Language Models) are increasingly used by attackers and defenders; however, improper use can inadvertently weaken access controls due to errors or hallucinations in generated policy code.
Application control bypass techniques are being used for data exfiltration, highlighting ongoing risks of data loss even where backup policies are robust.
AI-powered SOC agents are being evaluated for their impact on alert fatigue and operational efficiency, with Gartner providing guidance on assessment.
Manufacturing and healthcare sectors continue to struggle with access management, often viewing it as a roadblock, while attackers exploit weak password practices.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a directive requiring U.S. federal agencies to patch Citrix NetScaler appliances against an actively exploited vulnerability by Thursday.
Apple has implemented mandatory age checks for certain UK users and introduced new macOS security features to counter emerging threats like ClickFix.

Cybersecurity Brief – 2025-09-10

Wed, 10 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Plex has disclosed a data breach affecting emails, usernames, password hashes, and authentication data stored in a database. Users have been urged to reset their passwords.
Wayne Memorial Hospital suffered a breach in May 2024, with hackers stealing names, Social Security numbers, financial information, and protected health information of approximately 160,000 individuals.
Qantas reduced executive pay following a data breach earlier this year in which threat actors compromised a third-party platform and accessed customer personal information.

Newly Discovered Vulnerabilities

Adobe patched a critical vulnerability (CVE-2025-54236, also called SessionReaper) in its Commerce and Magento Open Source platforms, which allows attackers to take over customer accounts. This is described as one of the most severe flaws in the platform’s history. Adobe also released fixes for critical vulnerabilities in ColdFusion.
SAP released updates for 21 vulnerabilities, including three critical issues in NetWeaver (CVSS up to 10.0) that could enable remote code execution and privilege escalation, as well as high-severity flaws in S/4HANA.
Microsoft’s September 2025 Patch Tuesday addressed 81–86 vulnerabilities (depending on source), including two publicly disclosed zero-day flaws and numerous escalation of privilege bugs. No vulnerabilities were reported as actively exploited prior to release.
Researchers disclosed “catastrophic” vulnerabilities in the platforms operated by Restaurant Brands International (RBI) for Burger King, Tim Hortons, and Popeyes.
Microsoft released Windows 10 (KB5065429) and Windows 11 (KB5065426, KB5065431) cumulative updates, addressing security vulnerabilities and system issues.
Microsoft is investigating an anti-spam bug causing Exchange Online and Teams to mistakenly block URLs and quarantine emails.

Notable Threat Actor Activity

A TOR-based cryptojacking campaign is expanding, targeting exposed Docker APIs. Attackers mount host filesystems in new containers, fetch malicious scripts via TOR, and block Docker API access. Tooling updates suggest efforts to build a complex botnet.
A Kosovo national pleaded guilty to running BlackDB.cc, a cybercrime marketplace active since 2018.
The U.S. charged a Ukrainian national for administering the LockerGoga, MegaCortex, and Nefilim ransomware operations.
A threat actor has been identified as connected to Play, RansomHub, and DragonForce ransomware, deploying multiple malware families, backdoors, a proxy tunneller, and reconnaissance tools.
A large NPM supply chain attack involved phishing the Qix NPM account and publishing malicious versions of 18 popular open source packages, collectively receiving over 2 billion weekly downloads.

Trends, Tools, or Tactics of Interest

Axios HTTP client abuse and Salty 2FA phishing kits are being combined with Microsoft’s Direct Send feature in advanced Microsoft 365 phishing campaigns, creating highly efficient attack pipelines.
The Salty2FA phishing kit is being used at an enterprise level, with adversaries employing advanced strategy and planning.
RatOn Android malware has evolved from conducting NFC relay attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) banking fraud capabilities.
Recent phishing campaigns are delivering MostereRAT, a banking malware now functioning as a remote access trojan, using a variety of evasion and delivery techniques.
Ransomware losses are increasing, with trends including triple extortion and more sophisticated social engineering, as reported in midyear insurance claims analysis.
The browser is increasingly viewed as a critical endpoint, with rising usage prompting calls for improved browser-focused security controls.
Shadow AI agents are proliferating within enterprise environments, raising risks related to detection and control.
External Attack Surface Management (EASM) is highlighted as a key approach for identifying and prioritizing remediation of unknown internet-facing assets.
Microsoft is testing new AI-powered features in Windows 11 File Explorer to improve file handling capabilities.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury imposed sanctions on networks of cyber scam operations in Southeast Asia, responsible for stealing over $10 billion from Americans in the past year. Firms in Burma and Cambodia cooperating with these cybercrime syndicates are also facing enforcement actions.
A court ordered Google to pay $425 million in a class action lawsuit for misleading users about their online privacy.
Mitsubishi Electric announced the acquisition of industrial cybersecurity firm Nozomi Networks for nearly $1 billion.
The Public Service Alliance launched a new platform offering privacy and threat monitoring tools to public servants.
Attaullah Baig, former WhatsApp security chief, filed a lawsuit against Meta, alleging retaliation over critical cybersecurity failures.