Azure on DanSec Daily

Cybersecurity Brief – 2026-06-05

Fri, 05 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Windows version of Hola Browser was compromised in a supply chain attack, resulting in the delivery of an undeclared cryptocurrency miner to users ^[15].
DentaQuest, a dental benefits administrator, suffered a data breach exposing sensitive information of 2.6 million accounts ^[17].
The United Nations World Food Programme disclosed a breach of its self-registration application for Palestine, affecting 600,000 Gaza households ^[18].
Nightclub operator RCI reported a data breach after detecting a network intrusion in March, with files containing information on 40,000 individuals stolen ^[32].
Unknown attackers maintained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange for at least five months, exfiltrating inbox data in small batches ^[12].
Meta’s AI support bot was manipulated by attackers to hand over control of Instagram accounts by changing recovery email addresses ^[42].

Newly Discovered Vulnerabilities

Cisco patched a critical vulnerability (CVE-2026-20230) in Unified Communications Manager that allowed unauthenticated attackers to write files and escalate privileges to root. Proof-of-concept exploit code is public ^[5]^[23].
Cisco warned of an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245), enabling root privilege escalation. This is the seventh SD-WAN zero-day exploited in 2026 ^[13]^[33].
A flaw in Anthropic’s Claude Code GitHub Action allowed attackers to hijack public repositories by submitting a single malicious GitHub issue ^[6].
A vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento can be exploited without authentication to execute code on Magento servers using serialized PHP object payloads ^[38].
Researchers identified a hijack method for Google’s Gemini voice assistant via messaging notifications, enabling attackers to control smart home devices and initiate Zoom calls ^[37].

Notable Threat Actor Activity

The threat actor PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create a covert SMTP relay network for email-based attacks ^[4].
The China-linked cybercrime group TA4922 expanded its phishing and malware campaigns to target organizations in the UK, Germany, Italy, and South Africa, leveraging credential phishing, malware distribution, and fraud ^[9]^[25]^[39].
A new Magecart campaign is abusing Stripe’s API infrastructure to host credit card-stealing payloads and exfiltrate stolen payment data from checkout pages ^[16].
Researchers and the FBI warned of a surge in FIFA World Cup 2026 scams, including fake sites, banking malware, and credential theft targeting fans ahead of the event ^[3].
Operation FlutterBridge is distributing the FlutterShell backdoor to macOS users via malicious Google and YouTube ads ^[10].
A supply chain attack infected 36 npm packages with infostealer malware named IronWorm, targeting developers and propagating via compromised credentials ^[19]^[24].

Trends, Tools, or Tactics of Interest

Chinese-language phishing kits are becoming more advanced, with phishing-as-a-service offerings proliferating in Chinese cybercriminal circles ^[2].
Large-scale operations are impersonating open-source and freeware tools using Traffic Distribution Systems (TDS) to deliver malware through highly ranked fake sites in Google search results ^[11].
Attackers are increasingly exploiting gaps in vulnerability management programs, with underground tutorials teaching newcomers how to identify and profit from unpatched systems ^[20].
The use of MSI-branded background payloads embedded in JPEG images for malware delivery has re-emerged, indicating continued evolution of steganographic techniques ^[30].
Law enforcement and technology companies disrupted infrastructure linked to scammers across Southeast Asia, impacting over 1.4 million accounts ^[40].

Regulatory or Policy Developments Affecting the Security Industry

Bugcrowd launched a European Union data residency option to address evolving data sovereignty requirements amid growing geopolitical tensions ^[27].

Sources

Hola Browser for Windows compromised to deliver cryptominer - bleepingcomputer.com
DentaQuest data breach exposed info of 2.6 million accounts - bleepingcomputer.com
UN food agency discloses breach affecting 600,000 Gaza households - bleepingcomputer.com
Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals - securityweek.com
Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months - thehackernews.com
Meta’s AI support bot happily handed Instagram accounts to hackers - malwarebytes.com
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - thehackernews.com
Cisco warns of critical Unified CM flaw with PoC exploit code - bleepingcomputer.com
Cisco warns of unpatched SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 - securityweek.com
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories - thehackernews.com
Mirasvit Vulnerability Exploited to Execute Code on Magento Servers - securityweek.com
Gemini Voice Assistant Hijacked via Messaging Notifications - securityweek.com
PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network - thehackernews.com
China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa - thehackernews.com
China's TA4922 Expands Cybercrime Attacks Globally - darkreading.com
Chinese Cybercrime Group in Spotlight for Record Campaign Pace - securityweek.com
Credit card theft campaign abuses Stripe to host stolen payment info - bleepingcomputer.com
FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins - thehackernews.com
FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads - thehackernews.com
New IronWorm malware hits 36 packages in npm supply-chain attack - bleepingcomputer.com
Rust-Written IronWorm Hits NPM Supply Chain - darkreading.com
Chinese-Language Phishing Kits Are Growing More Advanced - blog.knowbe4.com
Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS - thehackernews.com
Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook - bleepingcomputer.com
The Evil MSI Background is Back!, (Fri, Jun 5th) - isc.sans.edu
Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown - securityweek.com
Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs - darkreading.com

Cybersecurity Brief – 2025-12-02

Tue, 02 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, suffered a data breach impacting 33.7 million customers, exposing personal information.
The CodeRED Emergency Alert Platform was shut down following a cyberattack attributed to the Inc ransomware gang, which claims to have stolen sensitive subscriber data.
The open-source SmartTube YouTube app for Android TV was compromised after an attacker accessed the developer’s signing keys, resulting in a malicious update being distributed to users.
OpenAI experienced a data breach that resulted in exposure of sensitive information, as reported in recent threat intelligence updates.

Newly Discovered Vulnerabilities

CVE-2025-61260: A command injection vulnerability was disclosed in OpenAI Codex CLI, allowing malicious project-local configuration files to execute arbitrary commands.
CISA added CVE-2021-26829, a vulnerability in ScadaBR (an open-source industrial control system), to its Known Exploited Vulnerabilities catalog following a hacktivist ICS attack.
A new variant of the Shai-hulud self-replicating npm-package poisoning worm was identified, capable of stealing credentials and secrets from AWS, Google Cloud Platform, and Azure.
Glassworm malware has returned in a third wave, with 24 new malicious packages uploaded to the OpenVSX and Microsoft Visual Studio Code marketplaces.

Notable Threat Actor Activity

ShadyPanda, a threat actor, has been linked to a seven-year-long campaign using malicious Chrome and Edge browser extensions, amassing over 4.3 million installs. Initially legitimate, these extensions evolved into spyware for data exfiltration.
The Russian-speaking Tomiris group is conducting a cyber-espionage campaign targeting government and diplomatic entities in CIS member states and Central Asia, deploying new tools and tactics.
The Inc ransomware gang claimed responsibility for the CodeRED platform attack, stating it exfiltrated sensitive subscriber data.
Russian cybercriminals have developed and are distributing Albiriox, a new Android banking trojan offered as malware-as-a-service (MaaS), targeting over 400 financial apps and enabling on-device fraud and remote control.

Trends, Tools, or Tactics of Interest

Increase in holiday-themed scams, particularly targeting mobile-first shoppers, as reported by Malwarebytes.
Attackers are leveraging trusted software supply chains, including code packages and browser extensions, to deliver malware (e.g., Glassworm, ShadyPanda).
The emergence of AI-powered browsers is raising new security concerns due to their novel architectures and integration with AI agents.
Threat actors are using deepfakes, fake resumes, and stolen identities to infiltrate organisations via hiring pipelines, increasing insider threat risks.
Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency mixing service, which facilitated laundering of over €1.3 billion in Bitcoin for cybercriminals. Approximately $29 million in Bitcoin was seized.
Albiriox malware is being marketed as a MaaS solution for $720 per month, reflecting the ongoing professionalisation of cybercrime services.

Regulatory or Policy Developments Affecting the Security Industry

India’s telecommunications ministry has mandated that all new mobile devices must come pre-installed with the government-backed cybersecurity app Sanchar Saathi within 90 days, aiming to combat telecom fraud.

Cybersecurity Brief – 2025-09-03

Wed, 03 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Salesloft Drift Supply Chain Attack: Multiple organizations, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a supply chain attack stemming from the compromise of OAuth tokens via Salesloft Drift, a marketing SaaS application. Attackers leveraged the compromised tokens to access Salesforce instances, exposing customer data and support cases.
Jaguar Land Rover Cyberattack: Jaguar Land Rover reported a cyberattack that severely disrupted production and required the shutdown of certain systems.
Evertec/Sinqia Attempted Bank Heist: Hackers breached Sinqia S.A., the Brazilian subsidiary of fintech firm Evertec, and attempted to steal $130 million via unauthorized access to the central bank’s Pix real-time payment system.
Pennsylvania Attorney General’s Office Ransomware Attack: The Pennsylvania AG’s office confirmed a ransomware attack responsible for a two-week service outage.

Newly Discovered Vulnerabilities

WhatsApp Zero-Day (CVE-2025-55177): A zero-day vulnerability in WhatsApp was exploited in attacks targeting Apple users, including iOS and macOS, reportedly as part of suspected spyware operations. CISA added this flaw to its Known Exploited Vulnerabilities catalog.
TP-Link TL-WA855RE Flaw: CISA added a high-severity vulnerability affecting TP-Link TL-WA855RE Wi-Fi Range Extender devices to its KEV catalog amid reports of active exploitation.
Sangoma FreePBX Zero-Day (CVE-2025-57819): Sangoma patched a critical zero-day vulnerability (CVSS 10.0) in FreePBX servers involving insufficient sanitization of user-supplied data, which had been exploited in the wild.
WatchDog Anti-malware Driver Vulnerability: The Silver Fox threat actor exploited a previously unknown vulnerability in a Microsoft-signed WatchDog Anti-malware driver as part of a Bring Your Own Vulnerable Driver (BYOVD) attack to deploy ValleyRAT malware.
Azure Active Directory Credential Exposure: Researchers highlighted risks from leaked JSON configuration files containing Azure Active Directory credentials, potentially allowing attackers to authenticate via Microsoft OAuth 2.0 endpoints and infiltrate Azure environments.

Notable Threat Actor Activity

Lazarus Group: North Korea-linked Lazarus Group expanded its malware arsenal, distributing cross-platform malware strains PondRAT, ThemeForestRAT, and RemotePE via social engineering campaigns.
Silver Fox: This threat actor abused a vulnerable WatchDog driver to deploy ValleyRAT malware, leveraging BYOVD techniques.
Midnight Blizzard/APT29: Russian state-linked group APT29 conducted a credential theft campaign by redirecting victims to fake Cloudflare verification pages and exploiting Microsoft’s device code authentication flow. Amazon disrupted this campaign.
Ukrainian Network FDN3: Researchers observed FDN3 launching massive brute-force and password spraying attacks against SSL VPN and RDP devices between June and July 2025.
MystRodX Backdoor: Researchers disclosed a new backdoor, MystRodX, capable of using DNS and ICMP triggers for stealthy command and control, with features for capturing sensitive data.

Trends, Tools, or Tactics of Interest

Large-Scale DDoS Attacks: Cloudflare mitigated the largest recorded volumetric DDoS attack, peaking at 11.5 Tbps, part of a broader wave of UDP flood attacks originating from IoT and cloud infrastructure.
Supply Chain Risk: The Salesloft Drift incident demonstrates ongoing risks associated with SaaS supply chain dependencies and OAuth token abuse.
WordPress Threat Landscape: Continued exploitation of vulnerable and malicious WordPress plugins enables attackers to compromise sites and leverage them for further cyber threats and scams.
Shadow AI Usage: MIT’s State of AI in Business report revealed that while 40% of organizations have enterprise LLM subscriptions, over 90% of employees are using AI tools outside sanctioned platforms, increasing shadow AI risks.
TagNabIt Tool: TagNabIt released as an offensive security tool enabling enumeration of AWS cloud resources via metadata tags, exposing potential attack surfaces.
Cookie & Session Hijacking Risks: Kaspersky highlighted risks associated with improper cookie management and session hijacking, underscoring the need for secure configuration.

Regulatory or Policy Developments Affecting the Security Industry

NIST Security Controls Update: NIST released Security and Privacy Control version 5.2.0, introducing enhancements to help organizations improve patch management practices.
CISA Leadership Change: CISA announced Nicholas Andersen as the new Executive Assistant Director for Cybersecurity.
UAE Cyber Education Initiative: The United Arab Emirates launched a cyber education initiative aimed at improving cybersecurity preparedness among students.
Varonis Acquisition: Varonis announced the acquisition of email security firm SlashNext for up to $150 million, expanding its security offerings.