Dashlane on DanSec Daily

Cybersecurity Brief – 2026-06-02

Tue, 02 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Dashlane, a password manager, disclosed a brute-force attack resulting in the download of encrypted vaults for fewer than 20 personal users. Affected accounts were automatically locked to prevent further compromise. Users also reported account lockouts due to login attempts from unfamiliar locations and devices ^[3]^[12]^[30].
Over 30 npm packages under Red Hat’s @redhat-cloud-services namespace were compromised in a supply chain attack dubbed “Miasma,” distributing a variant of the Shai-Hulud malware to steal developer credentials and secrets ^[4]^[10].
A malicious supply chain campaign targeted developers using OpenAI Codex via a fraudulent npm package, codexui-android, which was designed to steal authentication tokens ^[8].
Dutch police dismantled a botnet comprising 17 million devices that was used as a residential proxy network and facilitated various cybercrimes ^[33].
Nearly 2,000 WordPress websites were infected with malware that uses Steam Community profile comments to hide command-and-control data ^[13].
A fake BlueWallet application targeting Mac users was observed stealing passwords, crypto wallet information, and clipboard data ^[40].
Threat actor DriveSurge hijacked thousands of websites to distribute malware via ClickFix and FakeUpdate campaigns ^[9].
The Spanish National Police arrested an individual responsible for leaking sensitive data of government employees, including those from the National Cybersecurity Institute (INCIBE) ^[11].
The Instagram accounts of high-profile individuals and organisations were compromised via Meta’s AI support bot, allowing attackers to seize and deface accounts with pro-Iranian content ^[27].

Newly Discovered Vulnerabilities

A critical Windows Netlogon remote code execution vulnerability (CVE-2026-41089) is now being actively exploited. Organisations are urged to patch immediately ^[16]^[34].
A new Linux kernel vulnerability, known as CIFSwitch and present for 19 years, allows low-privileged users to escalate to root. Proof-of-concept exploit code has been released ^[5]^[37].
A vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) is being exploited to allow unauthenticated attackers to create administrative accounts on affected sites ^[32].
Palo Alto Networks PAN-OS authentication bypass vulnerability (CVE-2026-0257) has been under active exploitation since four days after its public disclosure, with at least two observed attack waves ^[5]^[22]^[38].

Notable Threat Actor Activity

China-aligned threat groups launched Operation Dragon Weave, targeting officials and citizens in the Czech Republic and Taiwan with the AdaptixC2 agent for cyber espionage ^[6].
Recent campaigns have seen attackers leveraging SVG files in phishing emails, bypassing traditional detection methods ^[28].
Carnival Corporation, a major cruise line operator, was named among top targets in recent cyber incidents ^[39].

Trends, Tools, or Tactics of Interest

Attack vectors in containerised environments remain focused on exposed secrets, privilege misconfigurations, API compromise, and supply chain attacks ^[1].
Malware campaigns are increasingly using unconventional channels for command-and-control, such as hiding payloads in Steam Community profiles ^[13].
There is a trend towards faster exploitation of vulnerabilities following public disclosure, underscoring the importance of rapid patch management ^[15]^[38].
A new browser-based technique, FROST, enables websites to infer user activity on SSDs using JavaScript, raising concerns over novel tracking vectors ^[26].
MSPs are moving beyond traditional vCISO tools, seeking integrated security growth platforms for broader service delivery ^[7].

Regulatory or Policy Developments Affecting the Security Industry

Anthropic will open its Mythos AI system to the EU’s ENISA as part of Project Glasswing, reflecting deepening cooperation between the European Commission and AI vendors ^[20].
Microsoft’s legal threats against researchers disclosing zero-day exploits have sparked backlash, raising concerns about the chilling effect on vulnerability research ^[21].
Oracle has shifted to a monthly patch cadence, with its first rollout addressing 77 vulnerabilities ^[31].

Sources

Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded - thehackernews.com
Dashlane password manager users locked out by brute force attacks - bleepingcomputer.com
Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads - securityweek.com
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm - thehackernews.com
Red Hat npm packages compromised to steal developer credentials - bleepingcomputer.com
OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack - thehackernews.com
Dutch Police Dismantle Massive 17-Million-Device Botnet - securityweek.com
WordPress malware campaign hides payloads in Steam profiles - bleepingcomputer.com
Fake BlueWallet steals passwords, accounts, and crypto from Macs - malwarebytes.com
Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks - bleepingcomputer.com
Spain arrests doxer leaking sensitive data of govt employees - bleepingcomputer.com
Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts - krebsonsecurity.com
Critical Windows Netlogon RCE flaw now exploited in attacks - bleepingcomputer.com
Critical Windows Netlogon Vulnerability in Attackers’ Crosshairs - securityweek.com
⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More - thehackernews.com
19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access - securityweek.com
WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites - securityweek.com
Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit - darkreading.com
Recent Palo Alto Networks Vulnerability Exploited for Weeks - securityweek.com
China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan - thehackernews.com
New Wave Of Phishing Emails with SVG Files, (Tue, Jun 2nd) - isc.sans.edu
1st June – Threat Intelligence Report - research.checkpoint.com
Containers on fire: from container escapes to supply chain attacks - securelist.com
Race Against Time: Why Faster Vulnerability Alerts Matter - bleepingcomputer.com
Websites Can Now Spy on You Through Your Hard Drive - wired.com
The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools - thehackernews.com
Anthropic to Open Mythos AI to EU's ENISA - darkreading.com
Microsoft's Zero-Day Legal Threats Spark Backlash - darkreading.com
Oracle’s First Monthly Patches Resolve 77 Vulnerabilities - securityweek.com

Cybersecurity Brief – 2026-02-18

Wed, 18 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.
Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.
Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.
Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint has been exploited since mid-2024 by a Chinese state-backed group (UNC6201).
CISA added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Multiple high- and critical-severity vulnerabilities were discovered in popular Visual Studio Code (VSCode) extensions, exposing over 128 million downloads to potential credential and file theft.
Google released an emergency update for Chrome to patch an actively exploited zero-day allowing code execution via malicious webpages.
Password managers including Bitwarden, LastPass, Dashlane, and 1Password were found vulnerable to vault compromise if a malicious server is present.
Notepad++ enhanced its update security with a new “double-lock” mechanism following a supply-chain compromise.
Research identified widespread exposure of secrets such as API keys in JavaScript front-end code, after scanning 5 million applications.

Notable Threat Actor Activity

Kaspersky uncovered the Keenadu Android backdoor, embedded in device firmware and Google Play apps, with links to major Android botnets. Keenadu enables data exfiltration, remote control, ad fraud, and browser hijacking via supply chain compromise.
Chinese state-backed hackers exploited a Dell zero-day (CVE-2026-22769) for espionage purposes.
A 47-year-old suspect linked to the Phobos ransomware group was arrested in Poland; authorities seized evidence including stolen credentials and server access data.
ClickFix campaigns are abusing DNS lookup commands to deliver ModeloRAT malware, adapting to bypass recent security defenses.
SmartLoader attacks are distributing a trojanized Oura MCP server to deploy StealC infostealer malware.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing legitimate DKIM-signed emails (DKIM replay attacks) to bypass security filters and deliver scams, leveraging trusted invoice and notification templates.
Sophisticated phishing campaigns are bypassing Microsoft 365 multi-factor authentication (MFA) protections.
Remote Monitoring and Management (RMM) software is being widely abused by threat actors for stealth, persistence, and operational efficiency, often replacing traditional malware.
AI-powered assistants (including Copilot and Grok) with web access are being demonstrated as potential command-and-control (C2) proxies for malware operations.
Attackers are exploiting API vulnerabilities at greater scale and speed, with AI-driven systems amplifying potential impact.
The use of AI and context-aware tools is accelerating security operations, especially in cloud breach investigations and SOC workflows.
Three new threat groups began targeting industrial control systems (ICS/OT) in 2025, according to Dragos.
Hobbyist coding error led to the exposure of live camera feeds, microphones, and floor plans from thousands of vacuum robots, highlighting risks in IoT device security.

Regulatory or Policy Developments

Spain’s courts ordered NordVPN and ProtonVPN to block access to 16 websites facilitating illegal LaLiga football match streaming.
Ireland’s Data Protection Commission opened a formal investigation into X (formerly Twitter) over the use of its Grok AI tool to generate sexual images, focusing on data protection and regulatory compliance.

Cybersecurity Brief – 2026-02-17

Tue, 17 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

Notable Threat Actor Activity

The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
A phishing campaign has been observed using fake incident reports as lures.

Trends, Tools, or Tactics of Interest

Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Regulatory or Policy Developments

Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.