HP on DanSec Daily

Cybersecurity Brief – 2026-06-03

Wed, 03 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

A large-scale malware campaign named WeedHack has infected over 116,000 Minecraft systems since January, targeting users via YouTube links to malware capable of system takeover. The campaign leverages malware-as-a-service infrastructure and has also facilitated the spread of cryptocurrency miners and other payloads through pirated content^[3]^[14].
Multiple Instagram accounts were hijacked after attackers exploited Meta’s AI-powered support tools, convincing them to reassign account ownership by linking accounts to attacker-controlled email addresses^[17]^[33].
23andMe is facing a lawsuit alleging that the genetic information of nearly seven million users was exposed following the compromise of user credentials^[36].
A supply chain attack targeted 32 Red Hat NPM packages, with 96 malicious package versions published. The packages were injected with a credential-stealing worm similar to Mini Shai-Hulud^[34].

Newly Discovered Vulnerabilities

Google’s June 2026 Android update patched 124 vulnerabilities, including a high-severity zero-day (CVE-2025-48595) in the Framework component that has been exploited in targeted attacks^[4]^[20]^[28].
A critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki WordPress plugin is being actively exploited to hijack admin accounts^[13].
Oracle WebLogic Server vulnerability CVE-2024-21182, which allows unauthenticated remote code execution, is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog^[6]^[19]^[32].
A stack-based buffer overflow vulnerability in HP VoIP phones enables remote code execution and could facilitate enterprise network breaches^[31].
A zero-day vulnerability in Visual Studio Code allows attackers to steal GitHub authentication tokens via one-click social engineering attacks^[10].
A development misconfiguration in Microsoft Android apps exposed billions of installations to the risk of unauthorized access to Microsoft account tokens^[27].

Notable Threat Actor Activity

The Russian APT group Gamaredon continues to exploit a WinRAR vulnerability to deliver GammaWorm and GammaSteel malware families, focusing on data theft and propagation in Ukraine^[5].
Malware dubbed Argamal RAT is being distributed via trojanized hentai games, providing attackers with full control over infected machines^[1].

Trends, Tools, or Tactics of Interest

AI-driven exploitation is significantly accelerating the time from vulnerability disclosure to weaponization, with attackers leveraging AI to automate malware development and exploit creation^[7]^[26]^[30].
An AI-built ransomware toolkit has emerged, automating Active Directory discovery and evasion of endpoint detection and response (EDR) solutions^[15].
Attackers are abusing AI-powered support tools, such as Meta’s, to bypass traditional account recovery processes and hijack high-profile social media accounts^[17]^[33].
Scammers are using convincing fake copyright takedown notices with spoofed Google sign-in screens to steal credentials from Chrome developers^[35].
There is an increased emphasis on browser security as a critical frontline for defending against AI-powered attacks and shadow AI adoption^[18].

Regulatory or Policy Developments Affecting the Security Industry

The US President has signed an executive order establishing a framework for the federal government to vet the national security risks of advanced AI models before their public release^[25].
CISA has ordered federal agencies to patch the actively exploited Oracle WebLogic vulnerability (CVE-2024-21182)^[19].
CISA has urged stronger security controls for automatic tank gauge systems in critical infrastructure^[24].

Sources

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content - thehackernews.com
Over 116,000 Minecraft systems infected in WeedHack malware campaign - bleepingcomputer.com
Instagram users locked out after Meta AI abused to steal accounts - bleepingcomputer.com
Meta AI Hands Over High-Profile Instagram Accounts to Hackers - securityweek.com
23andMe exposed genetic information of millions, lawsuit says - malwarebytes.com
Supply Chain Attack Hits 32 Red Hat NPM Packages - securityweek.com
Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited - thehackernews.com
Google fixes one actively exploited Android zero-day, 124 flaws - bleepingcomputer.com
Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities - securityweek.com
Critical Kirki flaw exploited to hijack WordPress admin accounts - bleepingcomputer.com
Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation - thehackernews.com
CISA flags two-year-old Oracle flaw as actively exploited in attacks - bleepingcomputer.com
Oracle WebLogic Vulnerability Exploited in the Wild - securityweek.com
Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches - securityweek.com
VS Code zero-day lets hackers steal GitHub tokens in one click - bleepingcomputer.com
Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk - securityweek.com
Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine - thehackernews.com
Argamal: Malware hidden in hentai games - securelist.com
AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It. - thehackernews.com
Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis - securityweek.com
The Zero-Knowledge Threat Actor and the End of Responsible Disclosure - securityweek.com
AI-built ransomware toolkit automates EDR evasion, AD discovery - bleepingcomputer.com
These convincing copyright notices are designed to steal Google logins - malwarebytes.com
Why the browser is now the front line for AI security - bleepingcomputer.com
Trump Signs Executive Order That Invites Vetting of Top AI Models for National Security Risks - securityweek.com
CISA Urges Stronger Security for Automatic Tank Gauge Systems - cisa.gov

Cybersecurity Brief – 2026-03-27

Fri, 27 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Hightower Holding Data Breach: Hightower Holding disclosed a data breach impacting 130,000 individuals. Attackers stole names, Social Security numbers, and driver’s license numbers.
Ajax Football Club Hack: Ajax Amsterdam reported a breach in which a hacker exploited IT system vulnerabilities, accessing data of several hundred fans and enabling ticket hijacking.
TeamPCP Supply Chain Attack: The TeamPCP supply chain campaign has expanded in scope, now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Detection tools are available.
LiteLLM Supply Chain Attack: A supply-chain attack on LiteLLM, a gateway used in AI agents, was dissected, highlighting the presence of malicious code designed to steal data.
GlassWorm Attack: The GlassWorm attack campaign installs a fake browser extension for surveillance, hiding inside developer tools and enabling data theft and potential supply chain spread.

Newly Discovered Vulnerabilities

Langflow (CVE-2026-33017): CISA warned of active exploitation of a critical code injection vulnerability in the Langflow AI framework, allowing attackers to hijack AI workflows.
Claude Chrome Extension: Researchers disclosed a vulnerability in Anthropic’s Claude Chrome extension, enabling zero-click XSS prompt injection via any website visited by the user.
BIND: High-severity vulnerabilities in BIND resolvers were patched, addressing out-of-memory conditions and memory leaks triggered by specially crafted domains.
Cisco IOS Software: Multiple high- and medium-severity vulnerabilities patched, including issues leading to denial-of-service, secure boot bypass, information disclosure, and privilege escalation.

Notable Threat Actor Activity

Coruna iOS Exploit Kit: The Coruna exploit kit, an evolution of the framework used in the Operation Triangulation espionage campaign, reuses and updates kernel exploits (CVE-2023-32434, CVE-2023-38606) to target iPhones via zero-click iMessage attacks.
Red Menshen (China-linked): This state-sponsored group has conducted a long-term espionage campaign against telecom and government networks, deploying stealthy BPFDoor implants for persistent access and surveillance within backbone infrastructure.
LeakBase Forum: Russian authorities arrested an individual suspected of owning/administering LeakBase, a major cybercrime forum for trading stolen data and hacking tools.
RedLine Infostealer: An Armenian suspect, alleged administrator of the RedLine infostealer malware operation, was extradited to the US to face charges related to managing the malware.
Infiniti Stealer (macOS): A new macOS infostealer, Infiniti Stealer (formerly NukeChain), uses fake CAPTCHA pages to trick users into running malicious Python/Nuitka-based commands.
TikTok for Business Phishing: Threat actors are targeting TikTok for Business accounts in a phishing campaign that evades security bots and attempts credential theft.

Trends, Tools, or Tactics of Interest

AI-Related Threats:
- Attackers are exploiting vulnerabilities in AI-related platforms (Langflow, LiteLLM, Claude extension).
- Researchers demonstrated that AI assistants (e.g., Copilot) can be manipulated to display phishing messages and leak internal information.
- AI-powered dependency management tools have been found to introduce or overlook security bugs due to model hallucinations or errors in recommending software versions.
Phishing and Social Engineering:
- Scammers are abusing Google Calendar invites to deliver phishing subscription renewal notices, using embedded phone numbers for social engineering.
- Multi-stage fraud attacks are increasingly chaining bots, proxies, and stolen credentials to escalate from signup to account takeover.
Supply Chain Risks:
- Attacks like TeamPCP and GlassWorm highlight ongoing concerns about the integrity of software supply chains and dependencies.
Automotive Cybersecurity:
- Reports indicate a growing threat landscape for connected and autonomous vehicles, with persistent vulnerabilities since the 2015 Jeep hack.
Global Spyware Market:
- Third-party intermediaries are facilitating the expansion of the spyware market worldwide, circumventing government restrictions and transparency efforts.

Regulatory or Policy Developments

UK Sanctions on Xinbi Marketplace: The UK Foreign, Commonwealth and Development Office sanctioned Xinbi, a Chinese-language cryptocurrency-based marketplace linked to Asian scam centers and the sale of stolen data and illicit services.
Dell and HP Quantum-Resistant Security: Dell and HP announced the rollout of quantum-resistant security capabilities for PCs and printers, enhancing device resilience against future quantum computing threats.
FCC Router Ban: The US Federal Communications Commission added certain foreign-made consumer routers to its list of prohibited communications devices, aiming to mitigate supply chain risks.
Meta Platform Litigation: Courts are issuing landmark verdicts scrutinising the design and addictive nature of Meta’s social media platforms, not just user-generated content.

Cybersecurity Brief – 2025-10-24

Fri, 24 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Toys “R” Us Canada has notified customers of a data breach involving leaked customer records previously stolen from its systems.
Collin’s Aerospace suffered a cyberattack impacting check-in and passenger systems at several European airports in late September 2025, resulting in significant delays and flight cancellations.
The Universe Browser, downloaded millions of times, has been identified as behaving like malware, with links to Asian cybercrime and illegal gambling networks.
Jingle Thief, a cybercriminal group, has been observed exploiting cloud infrastructure in the retail and consumer services sectors to steal millions in gift cards.
WIRED reported that hacked Deckmate 2 card shufflers enabled a mob-related poker scam that resulted in millions of dollars in losses.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for a critical Windows Server Update Service (WSUS) remote code execution flaw, which has publicly available proof-of-concept exploit code.
CISA and researchers reported active exploitation of a critical zero-day vulnerability in Motex Lanscope Endpoint Manager, prompting inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
A critical vulnerability (CVE-2025-54236, “SessionReaper”) in Adobe Commerce (Magento) is being actively exploited to hijack user sessions on e-commerce platforms, affecting thousands of online stores.
BIND released security updates addressing high-severity cache poisoning vulnerabilities, which could allow attackers to predict source ports and query IDs and inject forged DNS records.
Microsoft has disabled File Explorer’s preview pane for downloaded files to mitigate NTLM credential theft attacks via malicious documents.
OpenAI’s Atlas and Perplexity’s Comet browsers are vulnerable to sidebar spoofing attacks, allowing malicious extensions to impersonate AI sidebar interfaces and mislead users.

Notable Threat Actor Activity

North Korean Lazarus Group targeted at least three European defense companies with Operation DreamJob, leveraging fake job offers to compromise systems and steal drone-related intellectual property.
Russian government involvement with cybercrime groups has shifted from passive tolerance to active management, according to recent security firm analysis.
The “Smishing Triad,” a Chinese cybercriminal group, has shifted tactics to lower-frequency, higher-impact government impersonation SMS phishing attacks.
Researchers identified a new infostealer targeting Android devices, as part of an ongoing expansion in the infostealer threat landscape.
YouTube continues to be leveraged by threat actors as a malware distribution network, with evolving tactics for wider reach.

Trends, Tools, or Tactics of Interest

A phishing campaign is impersonating password managers (LastPass and Bitwarden) with fake breach notifications to steal credentials.
Phishing emails targeting cloud accounts, often in French and English, have been observed, warning recipients about purported payment issues to lure credentials.
Enterprises are increasingly abandoning static secrets in favour of managed identities to address risks associated with machine identities in cloud environments.
The Verizon 2025 Mobile Security Index reports that 85% of organizations believe mobile device attacks are increasing, with AI-powered threats raising particular concern.
AI sidebar spoofing, where browser extensions imitate trusted AI interfaces, is an emerging attack vector against users of AI-enabled browsers.
Zero Trust models are facing challenges in governing AI agents, with new blind spots emerging as AI agents gain broader access and autonomy.
Security researchers at Pwn2Own Ireland 2025 exploited 73 zero-day vulnerabilities, earning over $1 million in rewards, highlighting the ongoing prevalence of unknown flaws in widely used software.
Meta has enhanced scam protection features on WhatsApp and Messenger, as part of efforts to combat impersonation and fraud, following the removal of over 21,000 fake customer support pages from Facebook.
AI coding tools are introducing security risks by generating functional but flawed code, prompting calls for embedding security checks directly into AI development workflows.

Regulatory or Policy Developments Affecting the Security Industry

The UK Competition and Markets Authority (CMA) is considering measures that may require Apple to allow rival app stores on iPhones, challenging its current “walled garden” approach.
A $14 billion cryptocurrency seizure by US authorities signals increased regulatory scrutiny on the use of cryptocurrencies by cybercrime syndicates.
HP withdrew a software update for Windows 11 AI PCs after it caused the deletion of Microsoft certificates necessary for Entra ID authentication, disrupting organizational access.