Cybersecurity Brief – 2026-05-02

Sat, 02 May 2026 00:00:00 +0000

Major Incidents or Breaches

Trellix confirmed a breach involving unauthorized access to a portion of its source code.
Instructure, the company behind the Canvas learning platform, disclosed a cybersecurity incident and is investigating its impact.
30,000 Facebook accounts were compromised in a phishing campaign leveraging Google AppSheet as a phishing relay, attributed to a Vietnamese-linked operation.
French authorities detained a 15-year-old suspected of selling data stolen in a cyberattack on the French government agency France Titres (ANTS).
The FBI issued a warning about a surge in hacker-enabled cargo theft, with criminal groups hacking brokers and carriers to facilitate the theft and resale of cargo.
Hugging Face and ClawHub platforms are being abused by threat actors for malware distribution, using social engineering to trick users into downloading malicious files.

A critical Linux vulnerability, CVE-2026-31431 (“CopyFail”), allows attackers to gain root access on affected systems. Although patches are available, many systems remain unpatched.
An actively exploited vulnerability in the cPanel/WHM admin interface allows attackers to access websites without authentication, putting millions of sites at risk.
Poisoned Ruby gems and Go modules have been observed in a supply chain attack campaign, targeting CI pipelines for credential theft, GitHub Actions tampering, and further malware deployment.

A new criminal group, “Storm-2755,” is targeting Canadian employees with payroll hijacking attacks, using social engineering to compromise accounts and redirect payroll funds.
China-aligned threat actors are conducting espionage campaigns against government and defense sectors across South, East, and Southeast Asia, as well as a NATO state, journalists, and activists.
North Korean threat actors are responsible for 76% of all cryptocurrency stolen in 2026, with evidence suggesting increasing frequency and possible use of AI in their operations.
Two cybercrime groups have been identified using vishing and SSO abuse to conduct rapid SaaS extortion attacks that leave minimal forensic traces.
A phishing campaign is targeting senior executives through Microsoft Teams, using social engineering tactics to compromise high-value accounts.
A member of the Scattered Spider group has been arrested, as reported in security news roundups.

Cybercrime groups are increasingly abusing SaaS platforms, employing vishing and SSO abuse for rapid, high-impact extortion attacks.
The use of Google AppSheet as a phishing relay represents a novel tactic for distributing phishing campaigns at scale.
Supply chain attacks via poisoned open-source packages (Ruby gems, Go modules) remain a persistent threat, especially targeting CI/CD environments.
The Deep#Door backdoor, a Python-based framework, is being deployed as a persistent Windows implant for espionage and disruption.
AI agent integrations are being rapidly deployed into production environments without adequate security testing, leading to incidents such as unintended database deletions.
Cisco has released an open-source tool for AI model provenance, aimed at addressing risks related to poisoned models and supply chain integrity.
Microsoft has addressed issues with Remote Desktop security warnings and updated Windows 11 policies to allow IT admins greater control over pre-installed Store apps.
Criminal IP has partnered with Securonix to integrate exposure-based intelligence into ThreatQ, automating threat analysis and investigation.

CISA, in collaboration with US and international partners, has released a guide for the secure adoption of agentic AI systems.
Google has adjusted its bug bounty programme, increasing maximum rewards for certain Android exploits while reducing payouts for Chrome vulnerabilities, reflecting shifting priorities amid increased AI-related activity.
The US Department of Justice sentenced two cybersecurity professionals to four-year prison terms for facilitating BlackCat ransomware attacks.
OFAC has taken action against Iranian central bank crypto reserves as part of broader sanctions enforcement.