Intellexa on DanSec Daily

Cybersecurity Brief – 2026-02-22

Sun, 22 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Over 600 FortiGate firewalls in 55 countries were compromised over a five-week period by a Russian-speaking, financially motivated threat actor. The campaign leveraged commercial generative AI services for various stages of the attack, including reconnaissance, exploit development, and scripting. Amazon has issued warnings regarding the scale and sophistication of the breaches.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-2329) in Grandstream phone systems allows unauthenticated remote code execution with root privileges. Exploitation of this flaw could enable attackers to intercept calls and gain full control over affected devices.

Notable Threat Actor Activity

The threat actor responsible for the FortiGate breaches utilised generative AI tools to enhance operational efficiency, automate reconnaissance, and develop custom exploits, demonstrating the increasing use of AI in advanced cybercriminal operations.
Intellexa’s Predator spyware has been observed hooking into iOS SpringBoard to suppress visual indicators of microphone and camera usage, enabling covert surveillance by streaming audio and video feeds to operators without alerting device users.

Trends, Tools, or Tactics of Interest

Commercial generative AI services are being actively used by threat actors to streamline and scale cyberattacks, as evidenced in the FortiGate firewall campaign.
Predator spyware’s ability to hide iOS recording indicators signals a trend towards more sophisticated evasion techniques in mobile surveillance tools.
Anthropic has announced the launch of Claude Code Security, an AI-powered vulnerability scanning tool capable of analysing codebases and recommending patches, highlighting ongoing industry movement towards AI-driven security solutions.
Research indicates that popular password managers share a common underlying weakness, though specific technical details were not provided in the headline summary.

Cybersecurity Brief – 2026-01-16

Fri, 16 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
Eurail reported a breach in which hackers stole personal and reservation information of travellers.
Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

Cisco patched a maximum-severity zero-day remote code execution vulnerability in Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The flaw was exploited in the wild by a China-linked APT.
A critical misconfiguration in AWS CodeBuild was discovered, exposing AWS’s own GitHub repositories-including the AWS JavaScript SDK-to potential supply chain attacks.
A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin is under active exploitation, allowing attackers to bypass authentication and gain admin-level access.
Palo Alto Networks released patches for a high-severity DoS vulnerability in GlobalProtect Gateway and Portal, which can allow unauthenticated attackers to crash firewalls without needing to log in.
A critical vulnerability in Google’s Fast Pair Bluetooth protocol (“WhisperPair”) allows attackers to hijack, track, and eavesdrop on Bluetooth audio devices. Hundreds of millions of devices are impacted.
Researchers disclosed “StackWarp,” a new attack affecting AMD processors that can enable remote code execution inside confidential VMs.
Three critical vulnerabilities were identified in Delta Industrial PLCs, with debate among experts regarding their severity.
Siemens, Schneider, Aveva, and Phoenix Contact released advisories addressing vulnerabilities in their industrial control products as part of ICS Patch Tuesday.

Notable Threat Actor Activity

China-linked APT groups exploited the Cisco Secure Email Gateway zero-day prior to patch release.
Gootloader malware is now using malformed ZIP archives split into up to 1,000 parts to evade detection during delivery.
Researchers highlighted the VoidLink Linux malware framework, which targets cloud and container environments for long-term persistence using loaders, implants, and rootkits.
Intellexa’s Predator spyware was observed using vendor-controlled command-and-control (C2) infrastructure, with failed deployments and thwarted infections used to refine attack methods.
Threat actors are increasingly exploiting network misconfigurations to spoof internal emails for phishing campaigns, as observed by Microsoft.

Trends, Tools, or Tactics of Interest

The “Reprompt” attack technique enables single-click exfiltration of sensitive data from AI chatbots, including Microsoft Copilot, bypassing existing data leak protections-even after chat sessions have ended.
AI voice cloning exploits are on the rise, with new applications emerging for the detection of deepfake voice attacks.
A surge in reported vulnerabilities has been noted, particularly in WordPress plugins, with the overall picture complicated by inconsistent reporting from different organisations.
The Gootloader malware’s adoption of multi-part ZIP archives signals a trend toward more sophisticated evasion strategies in malware delivery.
Security focus in AI is shifting from model security to workflow security, as incidents demonstrate greater risk in workflow integrations and extensions.
Vibe coding tests indicate that AI agents can effectively exploit SQL injection vulnerabilities but perform poorly in implementing security controls.
The VoidLink framework’s targeting of cloud/container environments underscores increased threat activity against cloud infrastructure.
Security leaders are prioritising supply chain security, governance, and operational efficiency over predictive approaches.

Regulatory or Policy Developments

The US Federal Trade Commission (FTC) has banned General Motors from selling drivers’ location data for five years, following findings that GM sold such data without user consent.
Microsoft’s legal action against RedVDS was coordinated in both the US and UK, demonstrating cross-jurisdictional efforts to disrupt cybercrime-as-a-service operations.
Former CISA Director Jen Easterly has been appointed to lead the RSA Conference, reflecting leadership changes at a major industry event.

Cybersecurity Brief – 2025-12-31

Wed, 31 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The European Space Agency (ESA) confirmed a breach of external servers containing unclassified information related to collaborative engineering and project management activities. The compromised systems were outside ESA’s corporate network.
Korean Air reported that data belonging to approximately 30,000 employees was stolen following a breach at its former subsidiary KC&D, which was linked to an Oracle E-Business Suite (EBS) hack.
Two former employees of cybersecurity incident response firms Sygnia and DigitalMint pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. companies in 2023.

Newly Discovered Vulnerabilities

The Cyber Security Agency of Singapore (CSA) issued an alert regarding a critical remote code execution vulnerability in SmarterTools SmarterMail email software. The flaw is rated maximum severity and can be exploited for full compromise.
CISA ordered U.S. federal agencies to patch the actively exploited MongoBleed vulnerability in MongoDB, which can be used to steal credentials, API keys, and other sensitive data.

Notable Threat Actor Activity

The Chinese APT Mustang Panda was observed deploying a previously undocumented, signed kernel-mode rootkit driver to load a new variant of the TONESHELL backdoor. The driver contains user-mode shellcodes for execution.
The threat actor Silver Fox has shifted focus to India, conducting phishing campaigns using income tax-themed lures to deliver the ValleyRAT (Winos 4.0) modular remote access trojan.

Trends, Tools, or Tactics of Interest

Researchers at Push Security identified a new “ConsentFix” technique that blends OAuth consent phishing with ClickFix-style prompts, enabling attackers to trick users into handing over OAuth tokens and compromise accounts.
A new cybercrime service, ErrTraffic, is automating ClickFix attacks by generating fake browser glitches on compromised websites, luring users into downloading malicious payloads or following malicious prompts.
A campaign dubbed Zoom Stealer has been detected, in which 18 malicious browser extensions targeting Chrome, Firefox, and Edge have affected 2.2 million users. The extensions harvest online meeting data, including corporate meeting intelligence.
Analysis of cyber-insurance claims data identified six cybersecurity technologies that are most effective in reducing losses and are recommended for deployment by 2026.
The rapid deployment of artificial intelligence (AI) in security operations is exposing new risks, with practitioners struggling to consistently operationalise AI while maintaining security.

Regulatory or Policy Developments

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) lifted sanctions on three individuals previously linked to the Intellexa Consortium, the commercial spyware vendor behind Predator spyware.
The total disclosed value of cybersecurity M&A deals in 2025 exceeded $84 billion, with eight acquisitions surpassing the $1 billion mark.

Cybersecurity Brief – 2025-12-06

Sat, 06 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

React2Shell (CVE-2025-55182): A maximum-severity remote code execution vulnerability in React and Next.js was disclosed. The flaw is under active exploitation, particularly by China-linked threat actors, and has prompted emergency patching efforts including by Cloudflare.
Apache Tika (CVE-2025-66516): A critical XML external entity (XXE) injection vulnerability, rated CVSS 10.0, was disclosed in Apache Tika, requiring urgent patching.
Perplexity’s Comet Browser: A new agentic browser attack was disclosed, allowing a crafted email to trigger deletion of a user’s entire Google Drive contents via a zero-click exploit.
Akamai HTTP Smuggling: Akamai patched a vulnerability allowing HTTP smuggling attacks.

Notable Threat Actor Activity

Multiple China-nexus threat groups began exploiting the React2Shell vulnerability within hours of its public disclosure, targeting React and Next.js applications.
State-sponsored actors from the People’s Republic of China (PRC), including the group Warp Panda, have been observed deploying the BRICKSTORM, Junction, and GuestConduit malware families for long-term persistence in US systems.
Clop ransomware group exploited an Oracle E-Business Suite zero-day in the Barts Health NHS breach.
Intellexa, operators of Predator spyware, continue to leverage newly acquired zero-day exploits and alternative vectors such as ad-based delivery to bypass security controls and target individuals.

Trends, Tools, or Tactics of Interest

Malicious AI Tools: Researchers at Palo Alto Networks’ Unit 42 identified WormGPT 4 and KawaiiGPT, malicious AI tools enabling threat actors to automate the creation of phishing lures and ransomware code.
DDoS Attacks: The Aisuru botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 29 Tbps and 14.1 billion packets per second, recently mitigated by Cloudflare.
Virtual Kidnapping Scams: The FBI warned of criminals using altered social media images as fake “proof of life” in virtual kidnapping ransom scams.
Attack Surface Management: Emphasis on continuous, automated attack surface visibility as cloud assets and exposures change rapidly.
Detection Tools: Burp Suite has added automated scanning capabilities for React2Shell vulnerabilities in Next.js applications.
Predator Spyware: Leaked Intellexa documents show ongoing use of high-priced zero-day exploits to maintain Predator spyware effectiveness.

Regulatory or Policy Developments

The European Commission fined X (formerly Twitter) €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA), specifically related to deceptive blue checkmarks.
India has rolled back its proposed mandate requiring citizens to install a government cybersecurity app, following surveillance and privacy concerns.

Cybersecurity Brief – 2025-12-05

Fri, 05 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a US-based company, disclosed a ransomware attack resulting in the theft of names, addresses, Social Security numbers, and financial and medical information of 9,542 individuals.
Freedom Mobile reported a data breach involving the compromise of customer personal information through its account management platform.
Marquis suffered a data breach impacting over 780,000 people, with compromised data including names, addresses, Social Security numbers, and card numbers.

Newly Discovered Vulnerabilities

A critical command injection vulnerability in Array Networks AG Series secure access gateways (ArrayOS AG VPN devices) has been actively exploited since August 2025. Threat actors are deploying webshells and creating rogue users.
A maximum-severity vulnerability, CVE-2025-55182 (“React2Shell”), exists in React Server Components’ ‘Flight’ protocol, enabling remote code execution without authentication in React and Next.js applications. AWS and other sources confirm active exploitation attempts, including by China-linked threat groups. Only instances using a newer feature are affected.
Google released a Chrome update addressing 13 security issues, including a high-severity vulnerability in Digital Credentials.

Notable Threat Actor Activity

Chinese state-sponsored actors are actively exploiting the React2Shell vulnerability and targeting VMware vSphere servers with BrickStorm malware, as warned by CISA, NSA, and international partners. The BrickStorm malware is being used to backdoor VMware servers in government and technology sectors.
The Predator spyware, developed by Intellexa, is leveraging a new zero-click infection vector (“Aladdin”) that compromises targets via malicious advertisements without user interaction.
The financially motivated group GoldFactory is distributing modified banking apps in Southeast Asia (Indonesia, Thailand, Vietnam), resulting in over 11,000 mobile infections.
The Silver Fox threat actor is conducting a false flag campaign in China, distributing ValleyRAT malware via fake Microsoft Teams installers and search engine optimization (SEO) poisoning.
Russian state-sponsored hackers targeted Reporters Without Borders (RSF) using phishing emails to deliver malware.
China-based SMS phishing groups have shifted tactics to promote scams involving loyalty points, taxes, and fake retailers during the holiday season.
A student was found selling access to compromised government and university websites to Chinese threat actors for low prices.

Trends, Tools, or Tactics of Interest

Sophisticated fraud attacks are increasing, driven by the accessibility of AI tools and fraud-as-a-service platforms, making advanced techniques available to unskilled attackers.
Multi-stage phishing campaigns targeting Microsoft 365 credentials have been observed since November 2025, employing advanced evasion techniques.
AutoIT3 compiled scripts are being used to deliver shellcode payloads in Windows environments.
There is a marked increase in AI-powered attacks, evolving injection techniques, and the use of automation in both offensive and defensive cyber operations.
Cloudflare reported blocking 416 billion AI bot requests since July 1, indicating a surge in automated scraping and reconnaissance activity.
SMS phishing campaigns are adapting to current events and seasonal trends, with new lures targeting points, taxes, and fake retailers.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) announced the testing of a “Proactive Notifications” service to alert UK organizations about vulnerabilities in exposed devices.
CISA, NSA, and allied cyber agencies published security guidance for the integration of AI in operational technology (OT) environments, outlining principles for secure AI deployment in critical infrastructure.
India’s Ministry of Communications rescinded an order that would have required smartphone manufacturers to preinstall a government cybersecurity app (“Sanchar Saathi”) and prevent users from disabling it.
Canadian police are trialing facial recognition body cameras, raising potential privacy and accuracy concerns.
The US Inspector General’s report on the “Signalgate” incident recommended a single procedural change to improve the handling of classified material.
ServiceNow acquired Veza, a provider of non-human identity (NHI) access control, to enhance its governance and AI Control Tower offerings.