Cybersecurity Brief – 2026-03-03

Tue, 03 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Madison Square Garden confirmed a data breach resulting from the 2025 Oracle E-Business Suite hacking campaign, with the incident only publicly disclosed months after the initial attack.
Wynn Resorts, a major US-based casino and hotel operator, was listed among the top attack and breach victims in the recent Check Point threat intelligence report.
A 22-year-old Alabama man pleaded guilty to hacking and extorting hundreds of women by hijacking their social media accounts, including those of minors.
A Florida woman was sentenced to 22 months in prison for orchestrating a large-scale Microsoft license fraud operation, trafficking thousands of stolen Certificate of Authenticity (COA) labels.
A phishing campaign is leveraging a fake Google Account security page and a Progressive Web App (PWA) to steal credentials, multi-factor authentication codes, and cryptocurrency wallet addresses, as well as proxying attacker traffic.
A fake FileZilla website is distributing a tampered installer that communicates with attacker-controlled servers via encrypted DNS traffic, evading traditional network monitoring.
A phishing campaign is distributing malicious “purchase order” attachments that link to credential-harvesting web pages.

A critical, now-patched vulnerability in Google Chrome’s Gemini Live AI Assistant allowed malicious extensions to escalate privileges, access local files, and potentially violate user privacy.
OpenClaw, a popular AI agent tool, was found to have a critical vulnerability enabling malicious websites to open WebSocket connections to localhost, brute-force passwords, and hijack the AI agent.
Wireshark 4.6.4 was released, addressing three vulnerabilities and 15 bugs.
A 0-day vulnerability (CVE-2026-21513) in Microsoft MSHTML, exploited prior to the February 2026 Patch Tuesday, has been linked to APT28 activity.

Russia-linked APT28 exploited the MSHTML 0-day (CVE-2026-21513) in targeted attacks before its public disclosure and patch.
North Korean threat actors published 26 malicious npm packages as part of the ongoing “Contagious Interview” campaign, embedding Pastebin-based command-and-control for a cross-platform remote access trojan (RAT).
Another North Korean APT campaign targeted air-gapped systems using Windows shortcut files, deploying new implants, loaders, propagation tools, and backdoors.
Pro-Western and Iranian threat actors are engaged in reciprocal cyberattacks amid ongoing Middle East conflict, including wiper malware, DDoS, and attacks on critical infrastructure.
The UK’s National Cyber Security Centre (NCSC) issued a warning to British organizations about increased risk of Iranian cyberattacks due to Middle East tensions.
Global law enforcement arrested 30 alleged members of the cybercriminal collective “The Com” in “Project Compass,” identifying nearly 180 group members in total.
Researchers linked the open-source AI security testing tool CyberStrikeAI to a threat actor responsible for breaching hundreds of Fortinet FortiGate devices.

Attacks on GPS and satellite navigation systems have spiked in the Middle East, with over 1,100 ships impacted since February 28 following US and Israeli actions against Iran.
There is a growing use of deepfakes and injection attacks to bypass identity verification processes, targeting onboarding and account recovery workflows.
Bot attacks against SaaS platforms are increasing, with attackers leveraging automated tools to generate fake sign-ups and abuse APIs.
A trend of threat actors leveraging AI-powered tools, such as CyberStrikeAI, for offensive security testing and exploitation has been observed.
The use of encrypted DNS by malware (as seen in the fake FileZilla campaign) is complicating detection and response efforts.
AI-driven development is contributing to tensions between speed and security, with firewall rule backlogs and automation impacting application security workflows.

Samsung settled a lawsuit in Texas over the collection and monetization of smart TV viewing data using Automated Content Recognition (ACR), with implications for user privacy controls.
Google announced the development of quantum-resistant HTTPS certificates for Chrome, utilizing Merkle Tree Certificates (MTCs) to address future quantum computing threats.
AWS expanded its Security Hub into a cross-domain security platform, aiming to reduce tool sprawl and improve correlation of security findings.
Nick Andersen was appointed Acting Director of CISA (Cybersecurity and Infrastructure Security Agency), following a leadership change within the US Department of Homeland Security.