Cybersecurity Brief – 2026-02-04

Wed, 04 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Notepad++ Supply Chain Attack: Kaspersky GReAT identified previously undocumented infection chains in the Notepad++ supply chain attack, with new indicators of compromise (IoCs) and use of DLL sideloading.
Panera Bread Data Leak: ShinyHunters leaked 5.1 million Panera Bread account records, claiming theft of 14 million records from the company’s systems.
AT&T Breach Data Resurfacing: Previously leaked AT&T customer data has resurfaced, now merged and enriched with other datasets, increasing risks for affected customers.
AI Plush Toy Data Exposure: Approximately 50,000 chat transcripts between children and Bondu’s AI dinosaur plush toy were exposed and accessible to anyone with a Google account.

Newly Discovered Vulnerabilities

SolarWinds Web Help Desk RCE: CISA added a critical, actively exploited remote code execution vulnerability in SolarWinds Web Help Desk to its Known Exploited Vulnerabilities (KEV) catalog.
Docker Ask Gordon AI Flaw: A critical vulnerability in the Ask Gordon AI assistant within Docker Desktop and CLI allowed code execution via image metadata; the flaw has been patched.
React Native CLI (Metro4Shell) RCE: A critical flaw in the Metro Development Server used by “@react-native-community/cli” npm package has been exploited in the wild to bypass protections and deliver malware.
OpenClaw AI Assistant RCE: OpenClaw (also known as Moltbot or Clawdbot) is vulnerable to one-click remote code execution attacks, allowing attackers to hijack the AI assistant.

Notable Threat Actor Activity

APT28 (Russia-linked): APT28 exploited a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) within three days of patch release. The campaign, codenamed “Paperbug,” used specially crafted RTF documents to initiate multistage infection chains, targeting European entities.
ShinyHunters: Attributed to the breach and leak of Panera Bread customer data.
GlassWorm Malware: The self-replicating GlassWorm malware has re-emerged, infecting Open VSX software components and leading to infostealer infections in developer ecosystems.

Trends, Tools, or Tactics of Interest

LinkedIn Phishing Campaigns: Ongoing phishing campaigns are abusing LinkedIn private messages to target executives and IT personnel, attempting to deliver malicious archive files.
QR Code Phishing (“Quishing”): Attackers are increasingly using visually stylized QR codes to enhance the effectiveness of phishing campaigns.
AI-Accelerated Cloud Attacks: An AI-assisted attack compromised an AWS environment in eight minutes, starting from exposed credentials in public S3 buckets and rapidly escalating to administrative privileges.
Supply Chain Security: Notable focus on attacks via developer ecosystems (Open VSX, Notepad++), and increased investment in automation for software supply chain security (RapidFort funding).
User Interface Manipulation: Reports highlight the use of dark patterns in websites and apps that undermine user security by manipulating user choices.
Cloud Outages: Recent major outages at cloud service providers (AWS, Azure, Cloudflare) have caused significant internet disruptions.
Affiliate Scam Tactics: Fake cloud storage payment alerts are being used to redirect victims through deceptive affiliate schemes.

Regulatory or Policy Developments

Eclipse Foundation Security Checks: The Eclipse Foundation will require mandatory security checks before publishing Microsoft Visual Studio Code (VS Code) extensions to the Open VSX Registry.
Apple iOS Location Privacy: Apple introduced a “Limit Precise Location” setting to reduce the precision of device location tracking by cellular networks, with limited current support.

Cybersecurity Brief – 2026-01-30

Fri, 30 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Match Group, the parent company of Tinder, OkCupid, Hinge, and Match.com, confirmed a cybersecurity incident resulting in the compromise of user data across multiple platforms.
Marquis Software Solutions reported that a ransomware attack in August 2025 affecting dozens of U.S. banks and credit unions was due to a breach of SonicWall cloud backups.
An AI chat toy company, Bondu, exposed over 50,000 logs of conversations between children and its AI-enabled toys due to an unsecured web console.
The French national unemployment agency was fined €5 million for a breach that resulted in the theft of job seekers’ personal information.
eScan antivirus suffered a supply chain attack, with malicious updates detected and distributed through its update mechanism.
Google, in collaboration with industry partners, disrupted the IPIDEA residential proxy network, which had been leveraged by threat actors via malware-infected devices.

Newly Discovered Vulnerabilities

Ivanti released security updates for two zero-day remote code execution (RCE) vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, both of which have been actively exploited.
SolarWinds patched four critical vulnerabilities in its Web Help Desk product, including unauthenticated RCE and authentication bypass flaws.
Multiple critical vulnerabilities were identified in the n8n automation platform, allowing unauthenticated remote code execution and server hijacking via sandbox and AST sanitization flaws.
Microsoft issued an emergency patch for a Microsoft Office zero-day that allowed malicious documents to bypass security checks.
Researchers found 175,000 publicly exposed Ollama AI servers across 130 countries, creating a significant attack surface for exploitation.
Android theft protection features were updated by Google to strengthen device authentication and recovery.

Notable Threat Actor Activity

A new Android malware campaign abused the Hugging Face platform to distribute thousands of APK payload variants targeting financial and payment credentials.
Chinese APT groups deployed advanced malware against organisations in Asia, indicating ongoing high-end cyber-espionage operations.
The Aisuru (Kimwolf) botnet executed a record-setting DDoS attack in December 2025, peaking at 31.4 Tbps and 200 million requests per second.
Flare researchers highlighted how infostealer malware is being distributed via malicious Roblox game mods, enabling lateral movement from home PCs to corporate environments.
An operation dubbed “Bizarre Bazaar” targeted exposed large language models (LLMs) and managed control panels (MCPs) for commercial monetization.
The Clawdbot malware rebranded as Moltbot, sparking impersonation and supply chain risk campaigns.

Trends, Tools, or Tactics of Interest

SentinelOne and Censys reported a widespread issue of unmanaged, publicly accessible AI deployments, specifically Ollama servers, posing risks to data privacy and security.
The use of “semantic chaining” in prompt engineering was shown to bypass content controls in LLMs such as Gemini Nano Banana and Grok 4 by splitting malicious prompts into discrete segments.
The IPIDEA proxy network relied on SDKs embedded in mobile and desktop applications to enroll compromised devices into its proxy service.
The Global Cybersecurity Outlook 2026 and industry commentary emphasize the need for improved vulnerability management, preparation for quantum threats, and responsible AI deployment.
A survey of over 100 energy sector OT systems revealed pervasive cybersecurity gaps in substations, power plants, and control centers.
Microsoft Teams will introduce a feature to report suspicious calls as potential scams or phishing attempts by mid-March 2026.

Regulatory or Policy Developments

The Trump administration rescinded Biden-era guidance requiring U.S. federal agencies to solicit software bills of materials (SBOMs) and compliance attestations with NIST’s Secure Software Development Framework (SSDF) from vendors.
The French data protection authority imposed a €5 million fine on the national unemployment agency for inadequate security measures leading to a data breach.

Bondu on DanSec Daily

Cybersecurity Brief – 2026-02-04

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-01-30

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments