Cybersecurity Brief – 2026-05-08

Fri, 08 May 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group breached Instructure’s Canvas platform, exploiting a new vulnerability to deface login portals across hundreds of colleges and universities, disrupting classes and coursework nationwide. The campaign involved mass ransomware extortion and data theft.
RansomHouse ransomware group claimed responsibility for a breach of cybersecurity vendor Trellix, publishing screenshots of access to internal services.
Daemon Tools confirmed a supply chain attack affecting its distribution infrastructure; the vendor reports the attack has been contained, compromised files removed, and installation packages validated.
A massive AI investment scam operation was uncovered, spanning 15,500 domains and using the Keitaro ad-tracking platform for targeted victim exposure.
Thousands of web applications built using AI-driven platforms were found to be leaking sensitive corporate and personal data due to misconfiguration and insecure defaults.

Newly Discovered Vulnerabilities

CVE-2025-68670: A pre-authentication remote code execution (RCE) vulnerability was discovered in the xrdp server component, affecting Kaspersky USB Redirector. The issue has been patched.
Dirty Frag: A new, unpatched local privilege escalation (LPE) vulnerability in the Linux kernel allows attackers to gain root access on all major Linux distributions. It is a successor to the recently disclosed Copy Fail vulnerability.
CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) is affected by a high-severity RCE vulnerability, which has been exploited in limited zero-day attacks. Ivanti has released a patch.
PAN-OS Firewall Zero-Day: Palo Alto Networks disclosed that a critical RCE vulnerability in PAN-OS firewalls has been exploited in the wild since at least April 9, 2026. The campaign exhibits hallmarks of Chinese state-sponsored activity.
Vulnerabilities in Claude AI and associated tools (Claude Chrome extension, Claude Code, Cursor CLI, Gemini CLI, CoPilot CLI) allow code execution and OAuth token theft via malicious repositories or hijacking, due to lax permissions and insufficient warning dialogs.
Chrome 148 was released, addressing 127 security vulnerabilities, including critical-severity integer overflow and use-after-free bugs.

Notable Threat Actor Activity

PCPJack: A new credential-stealing malware framework, PCPJack, is actively targeting exposed cloud infrastructure. It spreads worm-like by exploiting five CVEs, steals credentials, and removes competing TeamPCP malware from infected environments. PCPJack uses parquet files for stealthy, pre-validated target discovery.
ShinyHunters: Conducted a mass extortion and ransomware campaign against the Canvas education platform, impacting thousands of educational institutions.
TCLBanker: A new banking trojan is self-spreading via WhatsApp and Outlook, targeting 59 banking, fintech, and cryptocurrency platforms. Initial infection is delivered through a trojanized MSI installer.
Ongoing campaigns using ClickFix social engineering are distributing Vidar Stealer malware, as warned by the Australian Cyber Security Center.
Fake Claude AI website is distributing a new Windows backdoor, “Beagle,” through malicious downloads.

Trends, Tools, or Tactics of Interest

Credential theft and session hijacking remain prevalent, with attackers using phishing, malicious packages (e.g., PyPI packages delivering ZiChatBot), and browser-based techniques to bypass traditional security controls.
APT groups are increasingly leveraging C2 frameworks for attacks, as detailed in a Q1 2026 vulnerabilities and exploits report.
Attackers are exploiting browser activity (copy/paste, AI prompts) to bypass data loss prevention (DLP) controls, highlighting gaps in current endpoint protection strategies.
AI-integrated attacks are becoming more sophisticated, targeting both vision-language models and SaaS platforms, though some recent attempts failed to breach OT/ICS environments.
Cloud infrastructure is a primary target for worm-like malware and credential stealers, with new frameworks focusing on lateral movement and removal of competing threats.
There is a continued trend of attackers abusing software supply chains and public repositories (e.g., PyPI) to distribute malware.

Regulatory or Policy Developments Affecting the Security Industry

A UK report on the Online Safety Act indicates some progress in online age checks, but highlights ongoing issues with workarounds, persistent harm, and unresolved privacy concerns.

Cybersecurity Brief – 2026-05-06

Wed, 06 May 2026 00:00:00 +0000

Major Incidents or Breaches

DAEMON Tools supply chain attack: Installers downloaded from the official DAEMON Tools website since 8 April were trojanised, delivering a sophisticated backdoor to thousands of systems globally. Government and scientific entities were among those targeted, though the backdoor was selectively deployed on a limited number of systems.
Vimeo data breach: The ShinyHunters extortion group accessed and exfiltrated personal information of over 119,000 users following a breach of the Vimeo platform in April.
Instructure breach: A hacker claims to have stolen 280 million data records from 8,809 educational institutions by breaching Instructure, exposing student and staff data.
Trellix source code breach: Attackers accessed source code for Trellix security products, potentially exposing detection mechanisms and product controls.
Taiwan high-speed rail hack: A university student was arrested for exploiting the TETRA communication system to trigger emergency brakes on Taiwan’s high-speed railway.
CloudZ RAT exploitation via Windows Phone Link: Researchers disclosed an incident involving the CloudZ remote access tool, leveraging a previously undocumented plugin (“Pheno”) to steal credentials and OTPs.
Government targeting by UAT-8302: China-linked APT group UAT-8302 was attributed to ongoing attacks against government entities in South America and South Asia, using malware shared across regions.

Newly Discovered Vulnerabilities

Palo Alto Networks PAN-OS (CVE-2026-0300): A critical buffer overflow vulnerability in PAN-OS User-ID Authentication Portal is under active exploitation, enabling remote code execution on PA and VM series firewalls.
Apache HTTP/2 (CVE-2026-23918): A severe vulnerability in Apache HTTP Server’s HTTP/2 implementation could allow denial-of-service and potential remote code execution. Security updates have been released.
MetInfo CMS (CVE-2026-29014): A critical flaw in the open-source MetInfo CMS is being actively exploited for remote code execution attacks.
Android System (CVE-2026-0073): A critical remote code execution vulnerability was patched in Android’s System component, exploitable without user interaction.
Ollama “Bleeding Llama”: A critical heap out-of-bounds read issue in Ollama LLM deployments could be exploited remotely and without authentication, potentially affecting up to 300,000 deployments.
WhatsApp: Two newly patched vulnerabilities could have allowed attackers to send malicious files to users, potentially leading to malware infection.
Microsoft Edge: Proof-of-concept exploits show that passwords are stored in process memory and can be extracted by users with admin privileges, posing an enterprise risk.

Notable Threat Actor Activity

ShinyHunters: Responsible for the Vimeo data breach, exfiltrating user personal information.
UAT-8302 (China-linked APT): Conducting cross-regional campaigns targeting government agencies using shared APT malware.
Karakurt ransomware group: A Latvian national, Deniss Zolotarjovs, was sentenced in the US for his role as a negotiator in extortion operations.
Quasar Linux (QLNX) malware: A new, previously undocumented Linux implant is targeting software developers with rootkit, backdoor, and credential-stealing features.

Trends, Tools, or Tactics of Interest

Supply chain attacks: DAEMON Tools and Trellix incidents highlight the ongoing risk of supply chain compromise, with attackers leveraging trusted software distribution channels.
OAuth token persistence: Many AI tools and productivity apps connected to Google or Microsoft environments leave persistent OAuth tokens without expiration or automated revocation, increasing lateral movement and persistence risks.
AI service exposure: Scans of one million exposed AI services reveal significant security gaps as businesses rapidly adopt AI technologies, with insecure deployments and insufficient access controls.
Social engineering and AI: Evolution in phishing and social engineering tactics, now leveraging AI to create more convincing lures and automate attacks, as noted in new KnowBe4 SAT platform updates and recent phishing campaigns.
Binary Transparency for Android: Google has expanded public verification of Android app binaries to prevent supply chain attacks.
Microsoft phishing campaign: Ongoing sophisticated phishing attacks against US organisations, using adversary-in-the-middle (AitM) techniques to harvest credentials.
Jailbreaking and data poisoning AI models: Security researchers are actively probing AI guardrails for weaknesses, using jailbreaking and data poisoning to demonstrate attack vectors.

Regulatory or Policy Developments

FTC action against Kochava: The US Federal Trade Commission will ban data broker Kochava and its subsidiary from selling Americans’ location data without explicit consent, as part of a legal settlement.
Oracle patch cadence: Oracle will now release monthly critical security patch updates, aiming to address high-priority vulnerabilities more rapidly.
SSL.com root certificate rotation: SSL.com rotated its root certificate as part of standard lifecycle management.
CISA critical infrastructure initiative: The US Cybersecurity and Infrastructure Security Agency (CISA) announced a new initiative to strengthen the security of critical infrastructure.

Daemon Tools on DanSec Daily

Cybersecurity Brief – 2026-05-08

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-05-06

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments