Bitwarden on DanSec Daily

Cybersecurity Brief – 2026-07-15

Wed, 15 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

SonicWall confirmed active exploitation of two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SMA 1000 series appliances, enabling remote code execution and administrative command execution. Patches have been released and users are urged to update immediately ^[3]^[15]^[41].
Progress Software attributed the emergency shutdown of ShareFile Storage Zone Controllers to a high-severity zero-day vulnerability and issued security updates to address the flaw ^[21].
Nearly 300 fake GitHub repositories have been published by threat actors impersonating legitimate software projects to distribute infostealer malware ^[17].
The Spanish Police dismantled a cybercrime and money-laundering organisation responsible for €140 million in investment fraud and BEC attacks, arresting four individuals ^[16].
xAI’s Grok Build CLI was found to be uploading entire Git repositories, including full commit histories, to a Google Cloud Storage bucket operated by xAI, rather than just necessary files ^[13].
LastPass and Bitwarden users are being targeted by a phishing campaign using fake security alerts to direct them to fraudulent sites ^[22].
The D1R cybercrime group claimed to have stolen data from Synopsys and Bosch, threatening to leak it unless a ransom is paid. Synopsys reports no evidence of breach ^[43].

Newly Discovered Vulnerabilities

Microsoft released a record-breaking Patch Tuesday update, addressing 622 vulnerabilities (including 570 in Windows), with at least two zero-days under active exploitation affecting Active Directory and SharePoint Server, and a publicly disclosed BitLocker bug. Over 60 flaws were rated critical ^[4]^[18]^[19]^[30]^[36]^[39]^[42].
SAP patched multiple critical vulnerabilities in NetWeaver Application Server ABAP (CVSS 9.9), Commerce Cloud, and AppRouter that could allow attackers to access, modify data, cause system unavailability, and desynchronise requests and responses ^[5]^[26]^[47].
Researchers disclosed two access control flaws in RabbitMQ that could allow attackers to leak OAuth client secrets and expose enterprise queue metadata ^[8].
Eleven old Microsoft-signed Linux UEFI shims have been discovered that can be abused to bypass Secure Boot on most modern systems ^[9].
A critical vulnerability remains unpatched in the Claude for Chrome extension, allowing rogue browser extensions to trigger access to Gmail, Google Docs, and Calendar data via Claude tasks ^[6]^[46].
Adobe patched critical ColdFusion vulnerabilities that could allow remote code execution or privilege escalation ^[44].
VMware patched seven severe vulnerabilities in its Avi Load Balancer, including authentication bypass, remote code execution, privilege escalation, and directory traversal ^[45].
Critical vulnerabilities were patched in Chrome 150 and Firefox 152. Public exploit code exists for Firefox flaws, but no in-the-wild exploitation has been observed ^[40].
Researchers found a vulnerability in the Cursor IDE that allows automatic execution of malicious code from poisoned repositories ^[35].
Automated Frequency Coordination systems for 6 GHz Wi-Fi were found to trust client-side data by default, enabling location spoofing and potential disruption of critical systems ^[31].

Notable Threat Actor Activity

At least two threat actors are using OAuth client ID spoofing to validate stolen Microsoft Entra credentials in cloud campaigns, evading detection ^[12].
LabubaRAT, a previously undocumented Rust-based remote access trojan, is masquerading as NVIDIA software to gain persistence and control over Windows hosts ^[7].
Multiple state-sponsored Russian APTs are targeting critical infrastructure routers, exploiting poorly secured devices across sector networks ^[48].
A threat actor is distributing infostealer malware via hundreds of fake GitHub repositories impersonating legitimate projects ^[17].
The D1R group claimed responsibility for alleged attacks on Synopsys and Bosch, demanding ransom for stolen data ^[43].
A trusted ransomware negotiator was discovered to have secretly assisted the BlackCat ransomware gang in extorting victims, constituting an insider threat ^[51].

Trends, Tools, or Tactics of Interest

The ClickFix social engineering technique has emerged as the leading malware delivery method, involving user interaction to copy and execute malicious commands. The ecosystem is now available for rent at scale, can evade AV and EDR, and relies on YARA analysis for detection ^[1]^[34].
AI tools are being leveraged by scammers to geolocate individuals based on social media photos, enabling more targeted social engineering attacks ^[2].
Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts and using techniques to bypass multi-factor authentication ^[25].
New phishing campaigns are targeting LastPass and Bitwarden users with fake security alerts to lure victims to malicious sites ^[22].
Crypto wallet browser extensions were found to leak address and tracking information, enabling linkage and tracking of users ^[10].
AI-driven security agents are increasingly influencing security operations by summarising findings and prioritising remediation, but most tools remain fragmented ^[11].
Picus described the use of TTP chaining for vulnerability validation without running live exploits, supporting safer risk assessment ^[23].
Cybercriminals are combining FaceTime social engineering with unpatched devices to steal credentials and drain bank accounts ^[50].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury Department’s OFAC sanctioned two individuals and one entity for enabling ransomware attacks against US organisations, targeting VPN and malware providers ^[28].
US federal prosecutors unsealed charges against three Russian nationals accused of providing bulletproof hosting services to ransomware gangs responsible for over $62 million in damages ^[14].
Nigeria advanced rules mandating the disclosure of cyberattacks by organisations, aligning with a global trend towards required transparency ^[29].
Microsoft announced that passkeys will become the default authentication method for Entra ID enterprise identity service starting September 2026 ^[24].
Several US state governments are moving to legislate transparency in the deployment of frontier AI models, responding to increased independence and reduced human oversight in AI systems ^[33].

Sources

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands - thehackernews.com
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now - bleepingcomputer.com
SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits - securityweek.com
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown - bleepingcomputer.com
Nearly 300 GitHub repos pose as legit software to push malware - bleepingcomputer.com
Spanish Police take down €140 million cyber fraud ring, arrest four - bleepingcomputer.com
Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read - thehackernews.com
LastPass, Bitwarden users targeted with fake security alerts - bleepingcomputer.com
Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims - securityweek.com
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack - thehackernews.com
Microsoft releases Windows 10 KB5099539 extended security update - bleepingcomputer.com
Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days - bleepingcomputer.com
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes - darkreading.com
Microsoft Patches a Record 570 Security Flaws - krebsonsecurity.com
Microsoft Patch Tuesday July 2026 - The AI Acopolypse is Here , (Tue, Jul 14th) - isc.sans.edu
Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data - thehackernews.com
SAP warns of critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud - securityweek.com
RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata - thehackernews.com
11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot - thehackernews.com
Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads - thehackernews.com
Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar - securityweek.com
Adobe Patches Critical ColdFusion Vulnerabilities - securityweek.com
7 Severe Vulnerabilities Patched in VMware Avi Load Balancer - securityweek.com
Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates - securityweek.com
Cursor IDE Auto-Executes Malicious Code in Poisoned Repos - darkreading.com
6 GHz Wi-Fi Flaws Could Disrupt Critical Systems - darkreading.com
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials - thehackernews.com
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts - thehackernews.com
US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers - securityweek.com
The inside job that cost ransomware victims millions - malwarebytes.com
ClickFix Social Engineering is Now the Leading Malware Delivery Method - blog.knowbe4.com
ClickFix's Mushrooming Ecosystem Demands New Defense Tactics - darkreading.com
Scammers Can Use AI Tools to Pinpoint Your Location Based on a Photo - blog.knowbe4.com
New phishing kits target Microsoft 365 accounts, evade MFA - bleepingcomputer.com
Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks - thehackernews.com
How Pentera Turns AI Security Workflows into Validation Engines - thehackernews.com
You Don't Have to Run an Exploit to Know If You're Vulnerable - bleepingcomputer.com
Warning: Scammers are using FaceTime to empty bank accounts - malwarebytes.com
US sanctions VPN, malware providers for enabling ransomware attacks - bleepingcomputer.com
US charges alleged operators of Russian bulletproof hosting service - bleepingcomputer.com
Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits - darkreading.com
Microsoft Entra ID gets passkeys default authentication starting September - bleepingcomputer.com
Frontier AI: The Genie's Out of the Bottle, but Where's the Rulebook? - darkreading.com

Cybersecurity Brief – 2026-04-28

Tue, 28 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Checkmarx has confirmed that data from its GitHub repositories was leaked on the dark web following a supply chain attack on March 23. The TeamPCP supply chain campaign has been linked to this and other concurrent compromises, including Bitwarden CLI and xinference PyPI.
Home security provider ADT suffered a breach affecting 5.5 million individuals, with the ShinyHunters extortion group claiming responsibility for stealing personal information.
Medtronic, a major medical device manufacturer, confirmed a breach after hackers claimed to have accessed up to 9 million records. The ShinyHunters group is also linked to this incident.
Itron, an energy and water management firm, reported unauthorized access to its systems detected on April 13.
Vercel disclosed a security incident, as noted in Checkpoint’s latest threat intelligence bulletin.
The elementary-data package on PyPI (with 1.1 million monthly downloads) was compromised to distribute information-stealing malware targeting developer data and cryptocurrency wallets.

Newly Discovered Vulnerabilities

Microsoft patched a privilege escalation flaw in Entra ID’s AI agent administrative role, which could enable service principal takeover.
Microsoft confirmed active exploitation of Windows Shell vulnerability CVE-2026-32202, which has been patched.
An unpatched Windows ‘PhantomRPC’ flaw was disclosed, with five exploit paths allowing privilege escalation via RPC architectural weaknesses.
An incomplete Windows patch left systems vulnerable to zero-click attacks, previously exploited by Russia-linked APT28 against Ukraine and EU targets.
A 15-year-old OpenSSH flaw was disclosed, allowing full root shell access due to certificate principal parsing issues.
A race condition vulnerability in Linux PackageKit, dubbed ‘Pack2TheRoot’, enables unprivileged users to escalate privileges during package installation.
Firefox vulnerability CVE-2026-6770, now patched in Firefox 150 and Tor 15.0.10, allowed fingerprinting of Tor users.

Notable Threat Actor Activity

PhantomCore, a pro-Ukrainian hacktivist group, has been actively targeting Russian TrueConf video conferencing servers since September 2025.
UNC6692, a newly identified threat actor, is conducting campaigns using Microsoft Teams, AWS S3 buckets, and custom “Snow” malware variants (Snowbelt, Snowglaze, Snowbasin). Their tactics include social engineering, email bombing, and cloud resource abuse.
ShinyHunters has claimed responsibility for the recent breaches of ADT and Medtronic, threatening to leak stolen data.
Silk Typhoon: A Chinese national alleged to be part of this group was extradited to the US for cyberespionage activities targeting US interests.

Trends, Tools, or Tactics of Interest

Researchers discovered 73 malicious Visual Studio Code extensions on the Open VSX repository delivering GlassWorm v2 malware, with the campaign leveraging “sleeper” extensions that activate malicious payloads post-update.
Malicious prompt injection attacks against AI systems are increasing, though most remain low in sophistication according to Google.
Deepfake voice attacks are becoming more prevalent, with reports showing that as little as three seconds of audio can enable successful cloning for fraud schemes.
The “fast16” malware framework, dating back 20 years and predating Stuxnet, has been uncovered and is believed to have been used in early cyber sabotage operations.
The Robinhood account creation process was exploited to send phishing messages via legitimate notification emails.
Supply chain attacks remain a key threat, with concurrent compromises (Checkmarx, Bitwarden CLI, xinference PyPI, npm worm “CanisterSprawl”) reported as part of ongoing campaigns.
Americans lost over $2.1 billion to social media scams in 2025, according to the FTC.
Canadian authorities arrested three individuals in Toronto for operating an “SMS blaster” device to send mass phishing texts.

Regulatory or Policy Developments

The US government has launched a sweeping crackdown on Southeast Asian cyberscam operations and imposed sanctions on a Cambodian senator for involvement.

Cybersecurity Brief – 2026-04-25

Sat, 25 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

ADT, a major home security provider, confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid.
Medical data of 500,000 UK Biobank volunteers was listed for sale on Alibaba, despite existing access controls.
NASA disclosed that employees were targeted and duped in a spear-phishing campaign orchestrated by a Chinese national posing as a U.S. researcher, with the intent to compromise U.S. defense software.
A U.S. federal civilian agency’s Cisco Firepower device was compromised with the Firestarter backdoor, which remains persistent even after applying security patches.
Bitwarden’s NPM package was compromised in a supply chain attack attributed to TeamPCP, involving the Shai-Hulud worm.
Over 10,000 Zimbra Collaboration Suite servers remain vulnerable to active exploitation of a cross-site scripting (XSS) flaw.
26 malicious apps impersonating popular cryptocurrency wallets were discovered on the Apple App Store, targeting users’ recovery phrases and private keys.

Newly Discovered Vulnerabilities

PhantomRPC: A newly discovered privilege escalation technique in Windows RPC allows attackers to create fake RPC servers to escalate privileges.
Pack2TheRoot: A vulnerability in the Linux PackageKit daemon allows local users to install or remove system packages and gain root access.
Four new exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
CrowdStrike patched a critical LogScale vulnerability, and Tenable fixed a high-severity flaw in Nessus.

Notable Threat Actor Activity

The ShinyHunters extortion group is behind the ADT breach and subsequent ransom threat.
The BlackFile extortion group has been linked to a surge of data theft and vishing attacks targeting retail and hospitality sectors since February 2026.
Tropic Trooper is targeting Chinese-speaking individuals using a trojanized SumatraPDF reader to deploy the AdaptixC2 post-exploitation agent via GitHub.
North Korea’s Lazarus Group continues to target macOS users through the ClickFix tool for initial access and data theft.
TeamPCP is linked to the Bitwarden NPM package supply chain attack.
A Chinese threat actor conducted a spear-phishing campaign targeting NASA employees and U.S. defense software.

Trends, Tools, or Tactics of Interest

AI-powered phishing attacks have significantly increased in the past six months, evolving from broad campaigns to highly personalized, 1-to-1 attacks.
Attackers are leveraging supply chain vulnerabilities, as evidenced by the Bitwarden NPM compromise.
The Firestarter malware demonstrates advanced persistence capabilities, surviving firmware updates and security patches on Cisco ASA and Firepower devices.
There is a rise in malicious crypto wallet apps on legitimate platforms, with 26 such apps found on the Apple App Store.
The use of trojanized legitimate software (e.g., SumatraPDF) and abuse of GitHub for payload delivery is being seen in targeted attacks.
Shadow IT, SaaS, and shadow AI/agents continue to present significant organizational risks.

Regulatory or Policy Developments

Article 9 of the EU’s Digital Operational Resilience Act (DORA) establishes authentication and access control as legal obligations for financial entities.
CISA set a May 2026 deadline for U.S. federal agencies to remediate newly listed exploited vulnerabilities in its KEV catalog.
Microsoft will roll out Entra passkey support for phishing-resistant passwordless authentication to Windows devices, starting late April.
Microsoft now allows IT administrators to uninstall Copilot from enterprise devices via a new policy setting.
The Trump administration announced intentions to crack down on Chinese companies exploiting U.S.-developed AI models.
A new U.S. bill is under consideration to address concerns about warrantless surveillance powers under a key federal spy program.

Cybersecurity Brief – 2026-04-24

Fri, 24 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Bitwarden CLI npm package was compromised as part of a wider Checkmarx supply chain attack campaign. Attackers uploaded a malicious @bitwarden/cli package to npm, which contained a credential-stealing payload capable of spreading to other projects. The incident is linked to the Shai-Hulud worm and affected developer environments.
Checkmarx KICS analysis tool was impacted in the same supply chain campaign, with compromised Docker images, VSCode, and Open VSX extensions used to harvest sensitive data from developer environments.
Vercel disclosed additional compromised customer accounts following a breach that enabled unauthorized access to internal systems.
Dutch cosmetics company Rituals reported a data breach affecting customers of its “My Rituals” membership programme, with personal information including names and addresses accessed by attackers.
A $290 million DeFi hack was reported, details unspecified but significant in scale.
Hackers are actively exploiting a critical file upload vulnerability in the Breeze Cache WordPress plugin, allowing unauthenticated arbitrary file uploads to affected servers.

Newly Discovered Vulnerabilities

PhantomRPC: A newly discovered Windows RPC privilege escalation technique enables attackers to create fake RPC servers and escalate privileges.
LMDeploy CVE-2026-33626: A high-severity flaw in the LMDeploy open-source toolkit for LLMs was publicly disclosed and exploited in the wild within 13 hours.
Apple patched CVE-2026-28950, a Notification Services vulnerability in iOS/iPadOS (versions 26.4.2 and 18.7.8), which allowed recovery of deleted notifications, including chat previews.
CISA ordered US federal agencies to patch a Microsoft Defender privilege escalation zero-day, dubbed BlueHammer, that has been actively exploited.
Cisco ASA, Firepower, and Secure Firewall products are being targeted by FIRESTARTER malware, with CISA issuing an alert regarding ongoing exploitation.

Notable Threat Actor Activity

GopherWhisper, a newly identified China-aligned APT group, has targeted at least 12 Mongolian government systems using Go-based backdoors and leveraging legitimate services such as Microsoft Outlook, Slack, Discord, and file.io for command and control communications.
UNC6692, a previously undocumented threat cluster, has been observed impersonating IT helpdesk staff via Microsoft Teams and deploying a custom malware suite (SNOW) through social engineering attacks.
Trigona ransomware operators are using a custom command-line exfiltration tool to accelerate and improve data theft from compromised environments.
Tropic Trooper, a Chinese state-sponsored APT, is expanding its targeting to include home routers and Japanese entities, diversifying its tools and attack vectors.
Chinese state-backed groups are increasingly industrializing botnets, using large-scale proxy networks of hijacked consumer devices to mask attack origins and evade detection, as highlighted in coordinated advisories from the UK NCSC, CISA, and international partners.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to escalate, with recent campaigns compromising widely used developer tools and npm packages, demonstrating ongoing risk to software supply chains.
Attackers are increasingly exploiting trusted relationships and routine business workflows, moving away from purely technical exploits to weaponize internal trust and social engineering.
AI-driven attack automation is advancing rapidly. Proofs of concept such as Zealot demonstrate that AI agents can autonomously conduct penetration testing operations-including reconnaissance, exploitation, and exfiltration-at speeds that challenge human defenders. Anthropic’s Project Glasswing AI model has shown exceptional vulnerability discovery capabilities, prompting withheld public release.
Social engineering via IT helpdesk impersonation is being used to bypass security controls, particularly through password reset abuse and collaboration platform phishing.
Legitimate cloud and collaboration tools (e.g., Microsoft 365 Outlook, Slack, Discord) are being repurposed by APTs for covert command and control.
macOS “Living off the Land” (LotL) abuse and SIM farm-based proxy networks are noted as emerging or ongoing tactics.

Regulatory or Policy Developments Affecting the Security Industry

CISA, the UK NCSC, and international partners issued a joint advisory warning of Chinese government-linked covert cyber networks, with emphasis on the use of proxy botnets and evasion techniques.
CISA mandated urgent patching of the Microsoft Defender BlueHammer vulnerability across US federal agencies, responding to evidence of active zero-day exploitation.

Cybersecurity Brief – 2026-02-18

Wed, 18 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.
Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.
Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.
Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint has been exploited since mid-2024 by a Chinese state-backed group (UNC6201).
CISA added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Multiple high- and critical-severity vulnerabilities were discovered in popular Visual Studio Code (VSCode) extensions, exposing over 128 million downloads to potential credential and file theft.
Google released an emergency update for Chrome to patch an actively exploited zero-day allowing code execution via malicious webpages.
Password managers including Bitwarden, LastPass, Dashlane, and 1Password were found vulnerable to vault compromise if a malicious server is present.
Notepad++ enhanced its update security with a new “double-lock” mechanism following a supply-chain compromise.
Research identified widespread exposure of secrets such as API keys in JavaScript front-end code, after scanning 5 million applications.

Notable Threat Actor Activity

Kaspersky uncovered the Keenadu Android backdoor, embedded in device firmware and Google Play apps, with links to major Android botnets. Keenadu enables data exfiltration, remote control, ad fraud, and browser hijacking via supply chain compromise.
Chinese state-backed hackers exploited a Dell zero-day (CVE-2026-22769) for espionage purposes.
A 47-year-old suspect linked to the Phobos ransomware group was arrested in Poland; authorities seized evidence including stolen credentials and server access data.
ClickFix campaigns are abusing DNS lookup commands to deliver ModeloRAT malware, adapting to bypass recent security defenses.
SmartLoader attacks are distributing a trojanized Oura MCP server to deploy StealC infostealer malware.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing legitimate DKIM-signed emails (DKIM replay attacks) to bypass security filters and deliver scams, leveraging trusted invoice and notification templates.
Sophisticated phishing campaigns are bypassing Microsoft 365 multi-factor authentication (MFA) protections.
Remote Monitoring and Management (RMM) software is being widely abused by threat actors for stealth, persistence, and operational efficiency, often replacing traditional malware.
AI-powered assistants (including Copilot and Grok) with web access are being demonstrated as potential command-and-control (C2) proxies for malware operations.
Attackers are exploiting API vulnerabilities at greater scale and speed, with AI-driven systems amplifying potential impact.
The use of AI and context-aware tools is accelerating security operations, especially in cloud breach investigations and SOC workflows.
Three new threat groups began targeting industrial control systems (ICS/OT) in 2025, according to Dragos.
Hobbyist coding error led to the exposure of live camera feeds, microphones, and floor plans from thousands of vacuum robots, highlighting risks in IoT device security.

Regulatory or Policy Developments

Spain’s courts ordered NordVPN and ProtonVPN to block access to 16 websites facilitating illegal LaLiga football match streaming.
Ireland’s Data Protection Commission opened a formal investigation into X (formerly Twitter) over the use of its Grok AI tool to generate sexual images, focusing on data protection and regulatory compliance.

Cybersecurity Brief – 2026-02-17

Tue, 17 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

Notable Threat Actor Activity

The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
A phishing campaign has been observed using fake incident reports as lures.

Trends, Tools, or Tactics of Interest

Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Regulatory or Policy Developments

Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-10-16

Thu, 16 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a significant breach attributed to nation-state actors, resulting in the theft of BIG-IP source code, undisclosed security vulnerabilities, and some customer information. The attack profile suggests Chinese involvement. Patches for stolen vulnerabilities have been released, and CISA has issued an emergency directive regarding F5 devices.
Capita has been fined £14 million by the UK Information Commissioner’s Office for a 2023 data breach that exposed personal data of 6.6 million people.
Harvard University suffered a breach via an Oracle zero-day exploit, with the Clop ransomware group claiming responsibility as part of a broader campaign targeting Oracle customers.
Spanish retailer MANGO disclosed a data breach affecting customer information, resulting from a compromise at a marketing vendor.
A 19-year-old individual was sentenced to four years in prison for orchestrating a major cyberattack on PowerSchool in December 2024.
Over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, creating supply chain risks by allowing attackers to update extensions maliciously.
Discord named customer service firm 5CA as the third-party responsible for a data breach; 5CA denies involvement.
Scientists reported ongoing leakage of unencrypted voice calls and text messages from geostationary satellites, exposing sensitive personal and business data.

Newly Discovered Vulnerabilities

Microsoft released fixes for 183 security flaws, including two new zero-days actively exploited in the wild-one affecting every version of Windows ever shipped.
A critical vulnerability in Adobe Experience Manager, rated CVSS 10.0, is under active attack and has been added to CISA’s Known Exploited Vulnerabilities catalog.
F5 released security updates for BIG-IP vulnerabilities compromised during the recent breach.
High-severity vulnerabilities have been patched by Fortinet and Ivanti in their October 2025 Patch Tuesday updates.
Siemens, Schneider, Rockwell, ABB, and Phoenix Contact published over 20 advisories addressing vulnerabilities in their industrial control systems (ICS).
Microsoft confirmed that September 2025 Windows Server updates are causing Active Directory issues on Windows Server 2025 systems.

Notable Threat Actor Activity

The Mysterious Elephant APT group has intensified operations, targeting government and diplomatic entities in South Asia with custom tools such as BabShell and MemLoader HidenDesk, and exfiltrating WhatsApp-related data.
Chinese threat group ‘Jewelbug’ conducted a five-month-long intrusion into a Russian IT service provider, indicating geographic expansion beyond Southeast Asia.
Clop ransomware group claimed responsibility for the Harvard University breach as part of a campaign exploiting Oracle zero-day vulnerabilities.
A new banking trojan, Maverick, was distributed at scale in Brazil via malicious LNK files sent over WhatsApp. The malware shares code with Coyote.
Ongoing phishing campaigns are targeting LastPass and Bitwarden users with fake breach alerts, leading to PC compromise through malicious downloads. Similar phishing tactics are being used against Robinhood users.

Trends, Tools, or Tactics of Interest

Attackers are actively bypassing synced passkeys, highlighting inherent risks in cloud-based passkey deployments.
There is an increase in supply chain risks due to compromised VS Code extensions, with over 100 leaking tokens that could allow malicious updates.
Satellite communications remain insecure, with continued leakage of unencrypted sensitive data.
Dark web threats are increasingly hiding within normal network traffic, with network detection and response (NDR) platforms being promoted as effective countermeasures.
TikTok is being used as a platform for crypto-related scams, luring victims with fraudulent paywall schemes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £14 million fine on Capita for failing to protect personal data in a 2023 breach.
CISA issued an emergency directive mandating urgent remediation of critical vulnerabilities in F5 devices.
LevelBlue announced plans to acquire Cybereason, expanding its extended detection and response (XDR) and managed detection and response (MDR) portfolio.