Grafana on DanSec Daily

Cybersecurity Brief – 2026-05-22

Fri, 22 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub disclosed that attackers accessed internal repositories after compromising an employee device via a malicious Visual Studio Code extension. The breach was reportedly limited in scope but highlights successful social engineering against developer tooling ^[1].
Grafana confirmed that hackers accessed its GitHub repositories and stole codebase and other data by exploiting a token compromised during the TanStack supply chain attack, which had not been rotated ^[34].
A glitch in Robinhood’s account creation process was exploited to send phishing emails from the platform’s own systems to customers ^[3].
Canadian authorities arrested an individual alleged to be the botmaster behind Kimwolf, an IoT botnet that enslaved millions of devices for DDoS and credential stuffing attacks ^[28].
Law enforcement seized the ‘First VPN’ service, which was used to facilitate ransomware and data theft operations ^[16].

Newly Discovered Vulnerabilities

Cisco addressed a maximum-severity vulnerability (CVE-2026-20223) in Secure Workload’s REST API that allowed unauthenticated, remote attackers to access sensitive data and gain Site Admin privileges ^[6]^[15]^[35].
Microsoft disclosed and patched two actively exploited vulnerabilities in Defender, one allowing privilege escalation (CVE-2026-41091) and another enabling denial-of-service, both observed in the wild ^[9]^[40]^[42].
Trend Micro Apex One on-premise was found to have a directory traversal flaw (CVE-2026-34926) actively exploited in the wild ^[5]^[33].
Drupal patched a highly critical vulnerability (CVE-2026-9082) that could be exploited without authentication for information disclosure, privilege escalation, and remote code execution ^[38].
Google accidentally exposed details of an unfixed Chromium flaw that allows JavaScript to run in the background after the browser is closed, enabling potential remote code execution ^[11].
Google API keys were found to remain active for 23 minutes after deletion, contrary to the expected immediate invalidation ^[20].

Notable Threat Actor Activity

Chinese cyber-espionage groups have been targeting telecommunications providers in the Middle East and Central Asia with new Linux (Showboat) and Windows (JFMBackdoor) malware families ^[7]^[14]^[22].
TeamPCP, a threat group, has been conducting an unprecedented scale of software supply chain attacks, recently impacting GitHub and hundreds of organizations ^[27].
China-linked APT Webworm utilized Discord, Microsoft Graph, and SOCKS proxies such as SoftEther VPN for attacks targeting EU governments ^[18].

Trends, Tools, or Tactics of Interest

Attackers are increasingly targeting developer tools and software supply chains, as evidenced by incidents involving GitHub, TanStack, and TeamPCP ^[1]^[27]^[34].
The Underminr domain-fronting attack method enables threat actors to exploit content delivery mechanisms for website brand hijacking by modifying web requests and cloaking malicious activity ^[23].
Crypto drainer platforms like Lucifer DaaS are scaling wallet theft through sophisticated phishing and automation rather than direct wallet hacking ^[13].
A new cross-platform Node.js stealer was observed, designed to exfiltrate credentials and other data, with heavy obfuscation to evade detection ^[29].
AI-driven vulnerability discovery is contributing to a surge in Chrome vulnerability reports, with over 200 vulnerabilities patched in recent releases ^[41].
AI agent identity management is emerging as a significant area of concern, with new research highlighting budgetary shifts and the need for governance as AI agent projects proliferate in enterprises ^[21].

Regulatory or Policy Developments Affecting the Security Industry

CISA updated its Known Exploited Vulnerabilities (KEV) catalog to include new vulnerabilities and introduced a nomination form to facilitate broader reporting and tracking of exploited flaws ^[5]^[32].
The US Federal Trade Commission (FTC) fined three firms nearly $1 million for selling a purported “Active Listening” technology for targeted advertising, which was found to be fraudulent ^[26].

Sources

[Heads Up] GitHub Breach Shows Developer Tools Are Social Engineering Targets - blog.knowbe4.com
Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack - securityweek.com
Robinhood Glitch Allowed Attackers to Send Phishing Emails to Customers - blog.knowbe4.com
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada - krebsonsecurity.com
Police seize “First VPN” service used in ransomware, data theft attacks - bleepingcomputer.com
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access - thehackernews.com
Max severity Cisco Secure Workload flaw gives Site Admin privileges - bleepingcomputer.com
Cisco Patches Critical Vulnerability in Secure Workload - securityweek.com
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities - thehackernews.com
Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days - securityweek.com
Microsoft Defender vulnerabilities are being exploited in the wild - malwarebytes.com
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV - thehackernews.com
TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking - securityweek.com
Google accidentally exposed details of unfixed Chromium flaw - bleepingcomputer.com
Google API Keys Remain Active After Deletion - darkreading.com
Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor - thehackernews.com
Chinese hackers target telcos with new Linux, Windows malware - bleepingcomputer.com
Chinese APTs Share Linux Backdoor in Central Asia Telco Attacks - darkreading.com
A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale - wired.com
China's Webworm Uses Discord, Microsoft Graphs to Hack EU Govts. - darkreading.com
Content Delivery Exploit Opens Websites to Brand Hijacking - darkreading.com
Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet - bleepingcomputer.com
Cross-Platform NPM Stealer, (Fri, May 22nd) - isc.sans.edu
Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI - securityweek.com
AI Agents Are Shifting Identity Security Budget Dynamics - darkreading.com
CISA Enhances Known Exploited Vulnerabilities Catalog to Include New Nomination Form - cisa.gov
‘Creepy’ Listening Tool for Targeted Ads Didn’t Actually Work, FTC Says - wired.com

Cybersecurity Brief – 2026-05-21

Thu, 21 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub confirmed a breach involving the exfiltration of over 3,800 internal repositories. The breach was traced to a compromised employee device, which had installed a malicious version of the Nx Console Visual Studio Code extension. This extension was compromised during the recent TanStack npm supply-chain attack. The threat actor TeamPCP has claimed responsibility. The breach also impacted other organisations, such as Grafana, which failed to rotate a GitHub workflow token after the TanStack incident, leading to further compromise^[4]^[10]^[13]^[16]^[21].
Microsoft disrupted a malware-signing-as-a-service operation, known as Fox Tempest, which weaponised Microsoft’s Artifact Signing system to deliver malicious code and facilitate ransomware campaigns. The service enabled threat actors to sign malware with fraudulent Microsoft-issued certificates to evade security controls^[7]^[42].
Hackers bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances due to incomplete patching, brute-forcing VPN credentials and deploying tools used in ransomware attacks^[15].
The Ukrainian cyberpolice, in cooperation with US authorities, identified an infostealer operator responsible for compromising 28,000 accounts via malware targeting an online service^[14].
Grafana suffered a data breach stemming from a missed token rotation following the TanStack npm supply-chain attack, underscoring the ongoing risks in the software supply chain^[16].

Newly Discovered Vulnerabilities

A critical vulnerability in Drupal Core affecting PostgreSQL-backed sites may allow remote code execution, privilege escalation, or information disclosure. Security updates have been released, and there is a high risk of rapid exploitation^[5]^[18].
A 9-year-old Linux kernel flaw (CVE-2026-46333) was disclosed, enabling root command execution on major Linux distributions^[3].
A newly patched privilege escalation vulnerability in Arch Linux, dubbed PinTheft, now has a public proof-of-concept exploit, allowing local attackers to gain root privileges^[19].
A vulnerability in ExifTool (CVE-2026-3102) allows attackers to compromise macOS systems through malicious image files^[1].
Microsoft Defender is affected by two zero-day vulnerabilities that have been exploited in active attacks, with security patches now rolling out^[12].
Anthropic silently patched a vulnerability in the Claude code sandbox that could have been chained with prompt injection to exfiltrate data^[37].
A critical command injection vulnerability in an OT Robot OS allows unauthenticated attackers to gain remote access and control of robotic systems^[24].
Microsoft rolled out mitigations for the ‘YellowKey’ BitLocker bypass, addressing exploitation via the FsTx Auto Recovery Utility^[34].
Firefox 151 update includes fixes for high-priority security vulnerabilities^[43].

Notable Threat Actor Activity

China-aligned threat actor Webworm was observed deploying custom backdoors, EchoCreep and GraphWorm, leveraging Discord and Microsoft Graph API for command-and-control operations^[8].
Over 320 npm packages in the @antv namespace were compromised in a fresh Mini Shai-Hulud supply-chain attack, using a hijacked maintainer account to publish malicious versions^[38].

Trends, Tools, or Tactics of Interest

Typosquatting attacks are increasingly targeting the software supply chain, with AI-generated lookalike domains embedded in third-party scripts, making detection more difficult^[11].
AI-powered app attacks are becoming faster, more frequent, and harder to stop, with attackers able to target new mobile apps within hours of release^[35].
There is a rising industry focus on securing AI agents during development and production. Microsoft open-sourced RAMPART and Clarity to help developers test AI agent security, while 1Password partnered with OpenAI to implement a just-in-time credential model for AI coding agents, aiming to prevent persistent secret leakage^[6]^[36]^[39].
The supply chain security crisis is intensifying, with an increasing number of vulnerabilities, shorter time-to-exploitation, and limited visibility into supply chain risks^[32].
Zero Trust strategies are increasingly incorporating continuous device verification, as identity checks alone are insufficient to prevent attacks involving stolen session tokens and compromised devices^[17].

Regulatory or Policy Developments Affecting the Security Industry

The EU is accelerating efforts to reduce reliance on US-based technology providers, with countries such as France moving to homegrown alternatives over platforms like Zoom and Microsoft Teams^[27].
A bipartisan US legislative amendment proposes to end nationwide police license plate tracking by tying federal highway funding to the discontinuation of automated plate tracking programmes, except for toll collection^[28].
A report found that opt-out forms used by data brokers and AI firms are often designed to confuse users and hinder effective data privacy choices^[30].

Sources

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension - thehackernews.com
GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos - thehackernews.com
GitHub links repo breach to TanStack npm supply-chain attack - bleepingcomputer.com
Grafana breach caused by missed token rotation after TanStack attack - bleepingcomputer.com
GitHub Confirms Breach, 4K Internal Repos Stolen - darkreading.com
Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks - thehackernews.com
Fake malware-signing service Fox Tempest dismantled by Microsoft - malwarebytes.com
Hackers bypass SonicWall VPN MFA due to incomplete patching - bleepingcomputer.com
Ukraine identifies infostealer operator tied to 28,000 stolen accounts - bleepingcomputer.com
Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks - thehackernews.com
Drupal critical update to fix bug with high exploitation risk - bleepingcomputer.com
9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros - thehackernews.com
Exploit released for new PinTheft Arch Linux root escalation flaw - bleepingcomputer.com
How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) - securelist.com
Microsoft warns of new Defender zero-days exploited in attacks - bleepingcomputer.com
Anthropic Silently Patches Claude Code Sandbox Bypass - securityweek.com
Patch Now: Critical Flaw in OT Robot OS Gives Attackers Control - darkreading.com
Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass - securityweek.com
Firefox 151 packs big privacy upgrades into a small update - malwarebytes.com
Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API - thehackernews.com
Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack - securityweek.com
Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem - thehackernews.com
AI-Powered App Attacks Are Faster, More Frequent and Harder to Stop - securityweek.com
Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development - thehackernews.com
1Password Teams With OpenAI to Stop AI Coding Agents From Leaking Credentials - securityweek.com
Caught Off Guard: Securing AI After It Hits Production - securityweek.com
Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility - securityweek.com
Identity Alone Isn't Enough: Why Device Security Has to Share the Load - bleepingcomputer.com
The EU Is Going Through a Trump-Fueled Breakup With Big Tech - wired.com
A Bipartisan Amendment Would End Police License Plate Tracking Nationwide - wired.com
Data Brokers’ and AI Firms’ Opt-Out Forms Are Built to Fail, Report Finds - wired.com

Cybersecurity Brief – 2026-05-20

Wed, 20 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub confirmed that approximately 3,800 internal repositories were breached after an employee installed a malicious Visual Studio Code extension. The threat actor TeamPCP has claimed responsibility for accessing around 4,000 repositories containing private code, and GitHub is actively investigating the incident ^[6]^[12]^[14].
Grafana Labs disclosed a breach involving its source code repositories, attributed to a supply-chain attack via a compromised npm package (TanStack). The company stated that customer production systems and operations were not affected ^[5].
7-Eleven confirmed a data breach following a cyberattack claimed by the ShinyHunters extortion group. The incident affected the company’s systems last month ^[23].
NYC Health + Hospitals reported a significant breach via a third-party vendor compromise, exposing sensitive data including biometrics, medical diagnoses, and bank details of at least 1.8 million individuals ^[46].
The US FBI reported that Americans lost over $388 million to scams involving cryptocurrency ATMs in 2025 ^[18].

Newly Discovered Vulnerabilities

A critical, unauthenticated remote code execution vulnerability was disclosed in ChromaDB for AI applications. The flaw, present in the latest Python FastAPI version, allows attackers to hijack exposed servers ^[15]^[41].
Proof-of-concept exploit code was released for CVE-2026-31635 (“DirtyDecrypt”), a Linux kernel vulnerability allowing local privilege escalation to root. The issue was patched in April ^[8]^[45].
SEPPMail Secure E-Mail Gateway was found to have critical vulnerabilities that could enable remote code execution and interception of mail traffic ^[11].
Microsoft released mitigations for the “YellowKey” Windows BitLocker zero-day vulnerability, which allows attackers to gain access to protected drives ^[13].
Drupal announced an urgent core security release for all supported branches, addressing a highly critical vulnerability that may be exploited within hours or days of disclosure ^[10]^[38].

Notable Threat Actor Activity

The TeamPCP threat actor claimed responsibility for breaching thousands of GitHub internal repositories ^[6]^[14].
The ShinyHunters gang was confirmed to have breached 7-Eleven’s systems ^[23].
A new wave of Shai-Hulud malware resulted in the publication of over 600 malicious packages to the npm registry, continuing a supply-chain attack campaign ^[22].
Researchers observed a major phishing campaign abusing Google AppSheet to relay phishing emails, compromising over 30,000 Facebook accounts ^[3].
Attackers abused the Kuse AI app’s storage and sharing features to assist in phishing campaigns ^[1].
A phishing-as-a-service platform called EvilTokens bypassed MFA by leveraging OAuth consent, compromising over 340 Microsoft 365 organizations in five countries within five weeks ^[9].
A threat actor exploited Microsoft’s Self-Service Password Reset feature in attacks against Microsoft 365 and Azure environments to steal data ^[19].
Attackers are increasingly abusing the legacy Windows MSHTA utility to deliver malware stealthily via phishing and LOLBIN-based attacks ^[40].
The SHub Reaper stealer is targeting macOS users via fake WeChat and Miro installers, using Apple script-based execution for backdoor access ^[32].

Trends, Tools, or Tactics of Interest

Verizon’s 2026 Data Breach Investigations Report (DBIR) found that vulnerability exploitation has overtaken credential abuse as the primary breach vector, now accounting for 31 percent of initial breach access. The report highlights delays in patching and increased use of AI by attackers ^[29]^[37].
Microsoft disrupted a malware-signing-as-a-service operation, run by the Fox Tempest group, which abused the company’s Artifact Signing service to sign malware and ransomware as legitimate software ^[16]^[39].
A large-scale Android ad fraud operation, dubbed Trapdoor, used 455 apps to generate 659 million daily bid requests for fraudulent advertising ^[7].
B1ack’s Stash marketplace released 4.6 million stolen credit card records for free, reportedly in response to seller misconduct ^[42].
Discord rolled out end-to-end encryption on all voice and video calls by default ^[17].
YouTube introduced “likeness detection” to combat AI deepfakes, requiring creators to provide biometric data ^[48].

Regulatory or Policy Developments Affecting the Security Industry

The US “Take It Down Act” came into effect on May 19, requiring tech platforms to comply with takedown requests for nonconsensual intimate images, impacting how major platforms address privacy requests ^[35].
Interpol’s “Operation Ramz” involved 13 countries in the Middle East and North Africa, resulting in 201 arrests in the largest coordinated law enforcement cybercrime operation in the region to date ^[27]^[44].

Sources

GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories - thehackernews.com
GitHub confirms breach of 3,800 repos via malicious VSCode extension - bleepingcomputer.com
GitHub investigates internal repositories breach claimed by TeamPCP - bleepingcomputer.com
Grafana GitHub Breach Exposes Source Code via TanStack npm Attack - thehackernews.com
7-Eleven confirms data breach claimed by the ShinyHunters gang - bleepingcomputer.com
Biometrics, diagnoses, and bank details exposed in major healthcare breach - malwarebytes.com
FBI: Americans lost over $388 million to scams using crypto ATMs in 2025 - bleepingcomputer.com
Max-severity flaw in ChromaDB for AI apps allows server hijacking - bleepingcomputer.com
Unpatched ChromaDB Vulnerability Can Lead to Server Takeover - securityweek.com
DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability - thehackernews.com
PoC Released for DirtyDecrypt Linux Kernel Vulnerability - securityweek.com
SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access - thehackernews.com
Microsoft shares mitigation for YellowKey Windows zero-day - bleepingcomputer.com
Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare - thehackernews.com
Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation - securityweek.com
New Shai-Hulud malware wave compromises 600 npm packages - bleepingcomputer.com
Phishing Campaign Exploits Google AppSheets to Target Facebook Accounts - blog.knowbe4.com
Warning: Phishing Attacks Are Abusing the Kuse AI App - blog.knowbe4.com
The New Phishing Click: How OAuth Consent Bypasses MFA - thehackernews.com
Microsoft Self-Service Password Reset abused in Azure data theft attacks - bleepingcomputer.com
Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks - securityweek.com
Stealer Spoofs Google, Microsoft & Apple, Then Backdoors macOS - darkreading.com
Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut - darkreading.com
Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector - securityweek.com
Cybercrime service disrupted for abusing Microsoft platform to sign malware - bleepingcomputer.com
Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ - securityweek.com
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps - thehackernews.com
B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards - securityweek.com
Discord rolls out end-to-end encryption on voice, video calls - bleepingcomputer.com
YouTube wants your face to fight deepfakes - malwarebytes.com
You Can Get Some of Your Nudes Removed From the Internet Under a New Law - wired.com
Interpol's 'Operation Ramz' Pioneers Cross-Region Collabs in Middle East - darkreading.com
201 Arrested in Crackdown on Cybercrime in Middle East, North Africa - securityweek.com

Cybersecurity Brief – 2026-05-19

Tue, 19 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana Labs disclosed that hackers stole its source code by breaching its GitHub environment using a stolen access token ^[19].
7-Eleven confirmed a data breach after the ShinyHunters group demanded ransom, with attackers claiming theft of over 600,000 Salesforce records containing personal and corporate data ^[34].
Several large-scale healthcare data breaches in the US were reported, impacting hundreds of thousands to millions of individuals ^[32].
Vodafone, a major international telecom, sustained a cyberattack, as highlighted in recent threat intelligence reporting ^[37].
A CISA contractor publicly exposed highly privileged AWS GovCloud credentials on GitHub until the past weekend ^[28].
INTERPOL’s Operation Ramz led to the arrest of over 200 individuals and the seizure of 53 malware and phishing servers across the Middle East and North Africa, disrupting regional cybercrime networks ^[8]^[15].

Newly Discovered Vulnerabilities

A zero-day cross-site scripting vulnerability in Microsoft Exchange (CVE-2026-42897) is under active exploitation, with no patch currently available. The flaw allows attackers to compromise Outlook Web Access (OWA) mailboxes ^[21]^[9].
Four vulnerabilities in the OpenClaw AI agent framework, collectively known as “Claw Chain,” have been patched. These flaws allowed attackers to steal credentials, escalate privileges, escape sandboxes, and maintain persistence ^[22]^[33].
Universal Robots PolyScope 5 is affected by a critical OS command injection vulnerability (CVE-2026-8153), which could allow attackers to compromise industrial robot fleets ^[31].
Ivanti, Fortinet, SAP, VMware, and n8n released security updates addressing remote code execution, SQL injection, and privilege escalation vulnerabilities ^[12].
A Windows privilege escalation zero-day, dubbed MiniPlasma, enables SYSTEM-level access on fully patched systems. A proof-of-concept exploit has been released ^[13]^[35].

Notable Threat Actor Activity

The ShinyHunters group claimed responsibility for the 7-Eleven data breach, demanding ransom and exposing sensitive Salesforce records ^[34].
The Mini Shai-Hulud campaign compromised npm packages in the @antv ecosystem, distributing infostealers and DDoS malware via supply chain attacks ^[7]^[14]^[18]^[23]^[36].
Threat actors compromised the popular GitHub Actions workflow “actions-cool/issues-helper” to steal CI/CD credentials through a supply chain attack ^[6].
The TeamPCP group continues its supply chain campaign, including a confirmed compromise of the Checkmarx Jenkins plugin and the emergence of a self-spreading npm worm ^[30].
A new SHub macOS infostealer variant was observed spoofing Apple security updates using AppleScript to install a backdoor ^[16].

Trends, Tools, or Tactics of Interest

Multiple software supply chain attacks have targeted developer workstations and development tools, including compromised VS Code extensions, malicious npm packages, and hijacked GitHub Actions workflows ^[5]^[6]^[7]^[11]^[14]^[18]^[23]^[30]^[36].
The release and subsequent adoption of the Shai-Hulud worm source code have accelerated the spread of self-replicating malware targeting npm developers ^[14]^[18]^[23]^[36].
AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the proliferation of AI-generated code introduces new risks for defenders ^[4]^[25].
There is a documented increase in mobile malware, with new versions of SparkCat and Triada identified as notable threats in Q1 2026 ^[1].
Social engineering and phishing remain highly profitable for attackers, with Americans losing $2.1 billion to social media scams in 2025 ^[3].
Shadow AI tool usage by employees is widespread, prompting recommendations for practical AI governance to manage associated risks ^[17].
Microsoft Edge will change its handling of saved passwords so they are no longer stored in plaintext memory throughout the browser session ^[38].

Regulatory or Policy Developments Affecting the Security Industry

INTERPOL’s Operation Ramz represents a significant international law enforcement effort targeting cybercrime infrastructure and actors in the MENA region ^[8]^[15].
The exposure of AWS GovCloud credentials by a CISA contractor raises concerns about government cloud security practices ^[28].

Sources

Grafana says stolen GitHub token let hackers steal codebase - bleepingcomputer.com
7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand - securityweek.com
Millions Impacted Across Several US Healthcare Data Breaches - securityweek.com
18th May – Threat Intelligence Report - research.checkpoint.com
CISA Admin Leaked AWS GovCloud Keys on Github - krebsonsecurity.com
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests - thehackernews.com
INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers - bleepingcomputer.com
Microsoft Exchange Zero-Day Under Attack, No Patch Available - darkreading.com
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More - thehackernews.com
'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments - darkreading.com
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery - securityweek.com
Critical Vulnerability Exposes Industrial Robot Fleets to Hacking - securityweek.com
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws - thehackernews.com
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE - securityweek.com
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account - thehackernews.com
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware - thehackernews.com
Leaked Shai-Hulud malware fuels new npm infostealer campaign - bleepingcomputer.com
Shai-Hulud Worm Clones Spread After Code Release - darkreading.com
First Shai-Hulud Worm Clones Emerge - securityweek.com
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th) - isc.sans.edu
SHub macOS infostealer variant spoofs Apple security updates - bleepingcomputer.com
Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer - thehackernews.com
Developer Workstations Are Now Part of the Software Supply Chain - thehackernews.com
What Is an Al Agent in Cybersecurity? - blog.knowbe4.com
The Boring Stuff Is Dangerous Now - darkreading.com
IT threat evolution in Q1 2026. Mobile statistics - securelist.com
FTC: Americans Lost $2.1 Billion to Social Media Scams Last Year - blog.knowbe4.com
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees - bleepingcomputer.com
Microsoft is changing Edge’s plaintext password behavior - malwarebytes.com

Cybersecurity Brief – 2026-05-18

Mon, 18 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana has confirmed a data breach following claims by the Coinbase Cartel group, which is reportedly linked to ShinyHunters, Scattered Spider, and Lapsus$ threat actors. The extent of data accessed or stolen has not yet been fully disclosed ^[11].
Historical analysis has revealed that the fast16 malware, a Lua-based tool predating Stuxnet, was specifically designed to sabotage nuclear weapons testing simulations ^[1].

Newly Discovered Vulnerabilities

A critical vulnerability in NGINX (CVE-2026-42945) affecting both NGINX Plus and NGINX Open has been publicly disclosed and is now being actively exploited in the wild. The flaw can cause worker process crashes and, if Address Space Layout Randomization (ASLR) is disabled, may enable remote code execution ^[3]^[12].
The “MiniPlasma” Windows zero-day vulnerability allows local privilege escalation to SYSTEM level on fully patched Windows systems. A proof-of-concept exploit has been released publicly ^[2]^[7].
A local privilege escalation vulnerability in the Linux kernel’s rxgk module, known as DirtyDecrypt, now has a public proof-of-concept exploit. Successful exploitation grants root access on affected Linux systems ^[5].

Notable Threat Actor Activity

The Coinbase Cartel cybercrime group, with reported links to ShinyHunters, Scattered Spider, and Lapsus$, is implicated in the recent Grafana breach ^[11].
The Tycoon2FA phishing kit has introduced device-code phishing techniques and leverages Trustifi click-tracking URLs to compromise Microsoft 365 accounts ^[8].

Trends, Tools, or Tactics of Interest

AI agents are increasingly capable of autonomously discovering and exploiting obscure vulnerabilities, coinciding with a surge in potentially insecure AI-generated code. This trend is compelling defenders to adapt their security strategies ^[9].
At the Pwn2Own Berlin 2026 contest, researchers demonstrated exploits for 47 zero-day vulnerabilities across Windows, Linux, VMware, Nvidia, and AI products, earning a combined $1.3 million in rewards ^[6]^[13].

Regulatory or Policy Developments Affecting the Security Industry

South Korea will use its upcoming local elections as a test for new regulations intended to curb the spread of deepfakes, providing an early case study on the efficacy of legal controls against AI-driven disinformation ^[10].

Sources

Grafana Confirms Breach After Hackers Claim They Stole Data - securityweek.com
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations - thehackernews.com
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE - thehackernews.com
Exploitation of Critical NGINX Vulnerability Begins - securityweek.com
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released - bleepingcomputer.com
Exploit available for new DirtyDecrypt Linux root escalation flaw - bleepingcomputer.com
Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing - bleepingcomputer.com
The Boring Stuff is Dangerous Now - darkreading.com
Hackers earn $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026 - bleepingcomputer.com
Hackers Earn $1.3 Million at Pwn2Own Berlin 2026 - securityweek.com
Can Laws Stop Deepfakes? South Korea Aims to Find Out - darkreading.com

Cybersecurity Brief – 2026-05-17

Sun, 17 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana disclosed that an unauthorized party obtained a token granting access to its GitHub environment, resulting in the download of its codebase and an extortion attempt against the company ^[1].
Instructure’s Canvas platform was impacted by a ransomware incident, which has now concluded ^[6].
OpenAI workers were affected by a supply chain attack, though specifics regarding the method or scope were not detailed ^[6].

Newly Discovered Vulnerabilities

A critical vulnerability in the Funnel Builder plugin for WordPress is under active exploitation, enabling attackers to inject malicious JavaScript into WooCommerce checkouts for skimming payment information ^[2].
Proof-of-concept code has been published for a critical vulnerability in NGINX Plus and NGINX open source, which was introduced in 2008 and only recently patched ^[7].
A security researcher alleged that Microsoft quietly fixed a critical Azure Backup for AKS vulnerability without issuing a CVE, after initially rejecting the report. Microsoft disputes these claims ^[3].

Notable Threat Actor Activity

The Russian threat group Secret Blizzard has evolved the Kazuar backdoor into a modular peer-to-peer botnet, enhancing its capabilities for long-term persistence, stealth operations, and data collection ^[4].
An alleged darknet market kingpin was arrested, though further operational details were not provided ^[6].

Trends, Tools, or Tactics of Interest

AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the surge in AI-generated code is contributing to a growing attack surface and new security challenges for defenders ^[5].

Sources

Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt - thehackernews.com
Cybercriminal Twins Caught After They Forgot to Turn Off Microsoft Teams Recording - wired.com
Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming - thehackernews.com
PoC Code Published for Critical NGINX Vulnerability - securityweek.com
Microsoft rejects critical Azure vulnerability report, no CVE issued - bleepingcomputer.com
Russian hackers turn Kazuar backdoor into modular P2P botnet - bleepingcomputer.com
The Boring Stuff is Dangerous Now - darkreading.com

Cybersecurity Brief – 2026-04-08

Wed, 08 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Massachusetts Hospital Cyberattack
- Signature Healthcare in Massachusetts experienced a cyberattack resulting in ambulance diversions, cancellation of some services, and pharmacy disruptions.
Snowflake SaaS Integrator Breach
- Over a dozen companies suffered data theft attacks after a SaaS integration provider was breached, with attackers stealing authentication tokens.
Router Hijacking and Espionage by APT28
- The Russia-linked APT28 (Forest Blizzard) compromised MikroTik and TP-Link routers globally, hijacking DNS settings to steal Microsoft 365 and Office authentication tokens.
- An international law enforcement operation disrupted the “FrostArmada” APT28 campaign.
Critical Infrastructure Attacks by Iran-Linked Actors
- Iran-affiliated threat actors targeted internet-exposed programmable logic controllers (PLCs) and SCADA systems in US critical infrastructure sectors, causing operational disruptions.
Doxing, Spyware, and Nonconsensual Abuse
- Widespread abuse in Telegram groups, where individuals are purchasing hacking tools, sharing nonconsensual images, and engaging in doxing and spyware deployment.

Cybersecurity Brief – 2025-11-22

Sat, 22 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Salesforce Customers Breached via Gainsight Integrations: Threat actors affiliated with the ShinyHunters extortion group used third-party Gainsight applications to steal data from Salesforce instances, repeating tactics seen in previous attacks earlier in the year.
CrowdStrike Insider Incident: An insider at CrowdStrike leaked internal system screenshots to hackers, with the material subsequently appearing on Telegram via the Scattered Lapsus$ Hunters threat group.
Transport for London Breach: Two British teenagers, allegedly linked to the Scattered Spider group, pleaded not guilty to charges related to the August 2024 breach of Transport for London, which caused significant financial and data exposure impacts.
WEL Companies Data Breach: A data breach at WEL Companies affected 120,000 individuals.
Cloudflare Outage: A recent Cloudflare outage highlighted the widespread impact a failure at a major provider can have on the global digital economy.

Newly Discovered Vulnerabilities

Grafana SCIM Flaw (CVE-2025-41115): Grafana has patched a critical vulnerability in its Enterprise product that could allow privilege escalation or user impersonation under certain configurations. The flaw has a CVSS score of 10.0.
Oracle Identity Manager RCE (CVE-2025-61757): An unauthenticated remote code execution vulnerability in Oracle Identity Manager is being actively exploited in the wild. CISA has issued a warning to patch immediately.
SonicWall Firewall and Email Security Appliance: SonicWall released patches for high-severity vulnerabilities that could lead to denial-of-service, arbitrary code execution, or unauthorized file access.
LINE Messaging App Protocol Bugs: Vulnerabilities in the custom protocol used by the LINE messaging app allow for message replay, impersonation attacks, and exposure of sensitive information, potentially facilitating cyber espionage.

Notable Threat Actor Activity

APT24 (China Nexus): APT24 has been observed deploying a new malware family, BADAUDIO, as part of a multi-year espionage campaign targeting over 1,000 domains, including Taiwanese entities. The group used supply chain attacks to deliver the BadAudio downloader and subsequent payloads.
ToddyCat APT: Kaspersky identified new versions of ToddyCat APT tools (TomBerBil, TCSectorCopy, XstReader) being used to steal email data and access tokens from Microsoft Outlook in targeted corporate environments.
ShinyHunters: Continued targeting of Salesforce customers through exploitation of Gainsight integrations.
Scattered Spider/Lapsus$: Ongoing legal developments involving alleged members in the UK; continued insider threat activity linked to Lapsus$-affiliated groups.

Trends, Tools, or Tactics of Interest

Deepfake Attacks: Entrust reports deepfake attacks now comprise 20% of biometric fraud attempts, with a 58% increase in deepfaked selfies, indicating rapid growth in synthetic identity threats.
CSS Stuffing in Phishing: Observations of CSS stuffing being used as an obfuscation technique in phishing emails to bypass security filters.
AI-Driven Scam Detection: Avast has launched Scam Guardian, a free AI-powered tool for detecting scams in websites, messages, and links, reflecting the increasing adoption of AI for consumer security.
Calendar Invite Spam: There is a growing trend of fake calendar invites being used to deliver spam and potentially malicious content via email and messaging apps.
Supply Chain Attacks: APT24’s use of supply chain vectors to deliver BadAudio malware highlights continued adversary focus on third-party compromise.
Insider Threats: The CrowdStrike incident underscores the persistent risk of insiders leaking sensitive information to external threat actors.
Automation and Entry-Level Cybersecurity: Increased automation and AI adoption are impacting entry-level cybersecurity roles, potentially affecting the security talent pipeline.
AI Content Risks: AI-powered toys, such as FoloToy’s Kumma teddy bear, have been found to provide inappropriate responses, raising concerns about content moderation and safety in AI-driven products for children.

Regulatory or Policy Developments Affecting the Security Industry

SEC Drops SolarWinds Lawsuit: The U.S. Securities and Exchange Commission has dropped its case against SolarWinds and its CISO regarding alleged investor misrepresentation related to the 2020 breach.
FCC Cybersecurity Rollback: The U.S. Federal Communications Commission has rescinded a rule requiring telecom carriers to implement stricter cybersecurity measures, despite ongoing state-sponsored hacking concerns.
US Cyber Strategy Shift: The US national cyber director announced a strategic shift toward more aggressive, offensive actions aimed at shaping adversary behaviour and imposing consequences for cyber operations.
CISA Directive: CISA has issued a directive for immediate patching of the actively exploited Oracle Identity Manager vulnerability (CVE-2025-61757).

Cybersecurity Brief – 2025-07-08

Tue, 08 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, experienced a ransomware attack causing widespread outages and disruption to customer ordering and services. The company is working to restore systems; details on data theft remain undisclosed.
Qantas confirmed it is being extorted by threat actors following a cyberattack that potentially exposed the data of 6 million customers.
Hackers stole nearly $140 million from six Brazilian banks by using credentials purchased from a C&M employee for $920.
The International Criminal Court (ICC) disclosed a sophisticated cyberattack in its latest threat intelligence report.
The PC version of Call of Duty: WWII was taken offline after reports of gamers being hacked.
Several Russian industrial enterprises were targeted in a phishing campaign delivering the newly discovered Batavia spyware, which exfiltrates sensitive data from corporate devices.

Newly Discovered Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Researchers released proof-of-concept exploits for CVE-2025-5777 (“CitrixBleed2”), a critical Citrix NetScaler vulnerability that is easily exploitable and now publicly available.
Grafana patched multiple Chromium bugs, including CVE-2025-6554, a zero-day vulnerability exploited in the wild that could allow remote code execution and memory corruption.

Notable Threat Actor Activity

A Chinese national allegedly linked to the Silk Typhoon (APT41) group was arrested in Milan for cyberespionage activities targeting American organizations.
North Korean threat actors were observed targeting cryptocurrency and Web3 platforms on Telegram using malicious Zoom meeting requests to deliver the NimDoor macOS malware.
TAG-140 targeted Indian government entities using “ClickFix-style” lures, leading to BroaderAspect .NET loader execution.
Iranian hackers breached a U.S. water facility, gaining control over a pressure station serving 7,000 people.
Batavia spyware campaigns used contract-themed phishing emails to compromise Russian industrial organizations.
Over 8,500 SMB users were targeted in an SEO poisoning campaign delivering the Oyster malware loader disguised as AI tools.
Hackers exploited a leaked copy of the Shellter Elite red team tool to deploy infostealers in live attacks.

Trends, Tools, or Tactics of Interest

The Atomic macOS infostealer (AMOS) has added a backdoor for persistent access to compromised systems.
The new “Bert” ransomware strain targets both Linux and Windows systems, featuring aggressive multithreading and cross-platform capabilities.
A Chrome browser extension with over 100,000 downloads was found to contain sophisticated spyware, hijacking sessions and redirecting users to malicious sites.
Modern malware increasingly incorporates anti-debugging and anti-analysis features to evade detection.
Hunters International, a Ransomware-as-a-Service (RaaS) group and successor to Hive, announced its shutdown and transition to “World Leaks,” focusing on data theft and extortion. Free decryptors were offered to previous victims.
PayPal has implemented an AI-powered scam alert system that may intercept suspicious transactions to combat increasingly sophisticated fraud attempts.
Let’s Encrypt began issuing free certificates for IP addresses, which, while enhancing security, also presents new opportunities for cybercriminal abuse.

Regulatory or Policy Developments Affecting the Security Industry

CISA’s addition of four new actively exploited vulnerabilities to its KEV catalog may prompt accelerated patching and mitigation efforts across affected organizations.
Let’s Encrypt’s rollout of certificates for IP addresses introduces new considerations for certificate management and threat actor abuse.

Cybersecurity Brief – 2025-07-04

Fri, 04 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Spanish police dismantled an investment fraud ring responsible for over €10 million in losses, targeting victims through fraudulent investment schemes.
IdeaLab confirmed data was stolen during a ransomware attack in October 2024, with notifications being sent to affected individuals.
Microsoft is investigating ongoing intermittent access issues affecting SharePoint Online users.
Over 40 malicious Firefox browser extensions targeting cryptocurrency wallets have been discovered, designed to steal wallet secrets and user assets.

Newly Discovered Vulnerabilities

Grafana Labs released critical security updates for the Image Renderer plugin and Synthetic Monitoring Agent, addressing four Chromium vulnerabilities.
Brother printers have a critical security flaw related to default admin credentials; users are advised to change default passwords immediately.

Notable Threat Actor Activity

A major Android ad fraud operation, IconAds, involving 352 malicious apps, was disrupted. The apps loaded out-of-context ads and performed fraud at scale.
Chinese threat actors exploited Ivanti Connect Secure Appliance (CSA) zero-days in attacks against French government, telecommunications, media, finance, and transport sectors.
Hunters International Ransomware-as-a-Service operation has shut down and released free decryptors for its victims.
Dark web vendors are increasingly shifting to selling access to third-party and software supply chain services, with more data on critical infrastructure being advertised.
Attackers are using QR codes in phishing and malware campaigns, as observed by the Anti-Phishing Working Group.
Callback phishing campaigns are impersonating brands such as Microsoft, PayPal, and DocuSign, luring victims to call attacker-controlled numbers.

Trends, Tools, or Tactics of Interest

Malicious IDE extensions can bypass verification checks in popular integrated development environments, posing a hidden risk to the software supply chain.
There is a notable increase in attacks targeting software supply chains and third-party providers, as evidenced by trends on the dark web.
Weaknesses in AI-powered SOC tools have been highlighted, with concerns around reliance on limited training data and insufficient transparency in automated decision-making.
Southeast Asia remains a hotspot for cybercrime, with organizations in the region experiencing some of the highest cybersecurity risks globally, particularly from phishing.
Criminals are increasingly using QR codes as a vector for phishing and malware distribution.
Leaks suggest OpenAI is developing an Operator-like tool for ChatGPT ahead of the GPT-5 launch, potentially impacting conversational AI security.
xAI is preparing to launch Grok 4, a new state-of-the-art AI model intended to compete with Claude and Gemini.

Regulatory or Policy Developments

Microsoft announced the general availability of Exchange Server Subscription Edition (SE) for enterprise customers.
Deloitte released a new cyber blueprint aimed at guiding organizations on AI adoption and preparedness.
The U.S. Treasury’s sanctions against a Chinese national operating a cloud provider linked to virtual currency scams have seen mixed compliance from major technology firms.

Cybersecurity Brief – 2025-06-16

Mon, 16 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

A malicious package was discovered on the Python Package Index (PyPI), masquerading as the legitimate Chimera module. The package is designed to steal sensitive developer-related information, including AWS credentials, CI/CD secrets, and macOS data.

Newly Discovered Vulnerabilities

Over 46,000 internet-facing Grafana instances remain unpatched and exposed to a client-side open redirect vulnerability. This vulnerability allows for the execution of a malicious plugin and could result in account takeover.
Microsoft acknowledged that the June 2025 Windows Server security updates are causing DHCP services to freeze on some systems, potentially impacting network operations.

Notable Threat Actor Activity

Threat actors are leveraging the PyPI platform to distribute malicious packages targeting developer environments and cloud infrastructure credentials.

Trends, Tools, or Tactics of Interest

Continued exploitation of open-source software repositories, such as PyPI, for supply chain attacks targeting developer systems and cloud infrastructure.
Ongoing issues with timely patching of widely-used software, as evidenced by the large number of unpatched Grafana instances exposed to critical vulnerabilities.