Marimo on DanSec Daily

Cybersecurity Brief – 2026-09-15

Tue, 15 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers exploited a vulnerability in a VPN product used by Japan’s Digital Agency, resulting in a data breach that exposed the personal information of approximately 246,000 government employees ^[20]^[36].
Revolut unintentionally disclosed personal and financial information of users to a third party impersonating a government agency ^[43].
HBO Max’s official Reddit account was compromised and used to distribute malicious ads containing ClickFix attacks, leading to malware infections on Windows and macOS devices ^[23]^[39]^[45].

Newly Discovered Vulnerabilities

A critical vulnerability in LiteSpeed Web Server Enterprise allows a low-privilege website user to gain root access on a shared-hosting server, according to a cPanel advisory ^[6].
Cisco Secure Email Gateway is affected by a critical zero-day vulnerability (CVE-2026-76461) that enables unauthenticated attackers to execute arbitrary commands as root. This flaw is under active exploitation ^[7]^[18]^[40].
A new hardware attack named DDRop has been disclosed, which can bypass the memory protection of Intel TDX and AMD SEV-SNP confidential computing environments by silently dropping memory writes ^[9].
A maximum severity path traversal vulnerability (CVE-2026-85706) in GitLab Community Edition and Enterprise Edition puts software supply chains at risk ^[27].
A flaw in Telegram Desktop allowed hidden JavaScript to be embedded in messages, which could exfiltrate chat content when exported to HTML files ^[11].
Apple released a major update across all operating systems, patching over 200 vulnerabilities, including kernel flaws that could allow memory corruption, privilege escalation, system termination, and information leaks ^[33]^[37].

Notable Threat Actor Activity

A Chinese threat actor exploited a chain of recently patched Chrome and Windows zero-days to deliver the GRIMWEDGE JavaScript backdoor via spear-phishing ^[8].
The Red Heron group, suspected to be China-linked, rapidly exploited a recently disclosed Gitea RCE vulnerability to compromise 13 organizations across six countries ^[12].
Russian threat group Sandworm chained Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware ^[26].
Ransomware gangs have begun exploiting a critical VMware vCenter RCE vulnerability, as warned by CISA ^[15].
Five alleged leaders of the Black Axe cybercrime syndicate, known for global cyber-enabled financial fraud, have been extradited to the United States to face charges ^[16].
An attacker gained and maintained root access inside the network of Thai broadband provider 3BB using the MeshCentral management tool and targeted subscriber credentials ^[10].

Trends, Tools, or Tactics of Interest

Social engineering campaigns are employing phony NDA documents to lure employees into moving conversations to WhatsApp and personal email, evading corporate security controls ^[1].
Threat actors are leveraging AI hallucinations to plant phishing links in AI-generated output, a tactic known as “slop squatting” ^[2].
Mass-scanning campaigns are targeting internet-exposed Vite development servers to extract cloud credentials and configurations from AWS and Azure environments ^[5]^[24].
Attackers are exploiting the Marimo RCE vulnerability to reach SSH bastions in as little as eight seconds, with AI accelerating the timeline from discovery to exploitation ^[3]^[14].
The whitelist-bypass tool tunnels traffic through commercial video-calling platforms using WebRTC, bypassing network domain restrictions ^[34].
Fake Bitrefill checkout pages are appearing in search results, tricking users into sending cryptocurrency to scammers ^[47].
A Twitch browser extension with 30,000 installs was found to be exposing users’ OAuth session tokens to a commercial bot service ^[22].
Google’s new search result redirects make it more difficult for users to verify link destinations before clicking, potentially increasing phishing risk ^[48].
Homebrew 7.0.0 introduces a built-in vulnerability scanner and stronger security controls ^[21].
WordPress is launching automated security reviews for every plugin release before distribution through its update API ^[13].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft introduced an AI Code of Conduct establishing boundaries for cyberattack capabilities, chain of command, and safety constraints, differentiating between defensive research and operational attack use ^[38].
The Manhattan District Attorney’s Office seized 12 deepfake websites targeting around 1,200 victims, marking the largest legal action against harmful deepfake sites to date ^[31].
The CEO of Anthropic called for slowing the pace of frontier AI development to allow security and risk prevention efforts to catch up, prompting public debate and a response from China’s Ministry of Foreign Affairs advocating for international cooperation on AI ^[28]^[41].

Sources

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records - bleepingcomputer.com
240,000 Hit by Data Breach at Japan’s Digital Agency - securityweek.com
Personal, Financial Info Exposed in Revolut Data Breach - securityweek.com
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads - bleepingcomputer.com
Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack - securityweek.com
HBO Max’s verified Reddit account hijacked to spread malware - malwarebytes.com
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server - thehackernews.com
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution - thehackernews.com
Cisco patches Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation - securityweek.com
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing - thehackernews.com
Maximum Severity GitLab Flaw Puts Supply Chains at Risk - darkreading.com
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports - thehackernews.com
Apple Updates Everything, (Mon, Sep 14th) - isc.sans.edu
Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases - securityweek.com
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE - thehackernews.com
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries - thehackernews.com
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink - darkreading.com
CISA: Critical VMware RCE flaw now exploited by ransomware gangs - bleepingcomputer.com
Suspected Black Axe gang leaders face cybercrime charges in the US - bleepingcomputer.com
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials - thehackernews.com
Social Engineering Campaign Uses Phony NDAs to Avoid Detection - blog.knowbe4.com
Warning: “Slop Squatting” Directs AI Users to Phishing Pages - blog.knowbe4.com
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers - thehackernews.com
Hackers target exposed Vite dev servers to steal AWS, Azure secrets - bleepingcomputer.com
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds - thehackernews.com
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits - thehackernews.com
whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms - darknet.org.uk
Search results are sending people to fake Bitrefill checkouts - malwarebytes.com
Twitch extension with 30K installs exposes users’ OAuth tokens - bleepingcomputer.com
Google’s new search redirects make links harder to check before you click - malwarebytes.com
Homebrew 7.0.0 gets built-in GUI, better security controls - bleepingcomputer.com
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution - thehackernews.com
Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints - securityweek.com
New York Seizes a Dozen Celebrity Deepfake Websites - wired.com
Anthropic CEO: Time to Shift From Improving to Controlling AI - darkreading.com
Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development - securityweek.com

Cybersecurity Brief – 2026-08-26

Wed, 26 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Nutex Health, a healthcare and services provider, confirmed a data breach involving unauthorized access and data exfiltration from company servers, with sensitive information exposed^[18]^[31].
The Los Angeles County Museum of Art (LACMA) disclosed that a breach last year exposed customer and employee social security and medical data^[14].
Over 270 Zimbra Collaboration Suite servers have been compromised in ongoing attacks exploiting a high-severity remote code execution vulnerability^[22].
Norway’s shared government digital infrastructure suffered significant disruption due to a large-scale distributed denial-of-service (DDoS) attack, impacting public sector services^[17].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability in Gitea (CVE-2026-60004) is being actively exploited in the wild. The vulnerability was patched in Gitea version 1.27.1, but attackers are deploying miner-like payloads on unpatched instances^[3]^[32].
Two severe unauthenticated authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress are under active exploitation, allowing attackers to gain admin access^[13]^[35].
A high-severity flaw in Marimo notebook software was patched after it was found to allow attacker-supplied Model Context Protocol (MCP) command execution in specially crafted notebooks^[8].
Researchers disclosed a weakness in NVIDIA NemoClaw and its integration with the Ollama API that enables unauthenticated attackers to take control of local AI agent instances and plant persistent malicious instructions^[6]^[26].

Notable Threat Actor Activity

A commercial phishing-as-a-service toolkit, Mirage2FA, has targeted over 4,500 organisations in the US and EU since 2024, abusing Microsoft 365 login flows to bypass two-factor authentication^[9].
Threat actors are abusing npm and its mirrors to host clusters of malicious packages that redirect users to fake Cloudflare CAPTCHA phishing pages^[10]^[15].
A new campaign uses FTP banners as dead drop resolvers to deliver two novel remote access trojans (E4del and PINHOLE RAT), leveraging FTP banner text as a covert command and control channel^[11].
Iranian cyber actors have been sanctioned by the US government for their role in critical infrastructure breaches^[5].
A newly identified phishing-as-a-service platform, AnonyMousKIT, employs AI voice agents to call Apple device theft victims, attempting to phish for passcodes and two-factor authentication codes to bypass Apple’s Activation Lock^[4]^[16].

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector, responsible for more than half of observed cyberattacks in Q2 2026. Microsoft reported observing 7.6 billion phishing emails during this period^[1]^[2].
Attackers are increasingly targeting identity verification and account recovery processes, rather than just login credentials, to compromise accounts^[19].
Prompt injection attacks are being used to manipulate AI-powered email summarizers and assistants by embedding malicious or hidden instructions in otherwise benign-looking content, including encrypted text^[25]^[41].
AI model poisoning is an emerging concern, with vulnerabilities in local AI agent serving platforms allowing attackers to persistently corrupt models via malicious web content^[6]^[26].
WhatsApp has introduced support for multiple passkeys and stronger two-step verification to enhance account security across iOS and Android^[7]^[21]^[36].
Law enforcement agencies from 22 countries arrested 58 individuals and identified 263 suspects in a global crackdown on cybercrime networks coordinated by African crime groups^[23].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of the Treasury announced new sanctions targeting Iranian cyber actors involved in attacks on critical infrastructure^[5].
Nigeria launched new financing, procurement, and infrastructure policies to support sovereign cloud initiatives aimed at strengthening national cybersecurity and technical capabilities^[24].
The Linux Foundation will govern TRACE, an open standard for AI runtime attestation, with contributions from AMD, Intel, Microsoft, OPAQUE, and TII^[33].
Taiwan charged nine individuals, including staff from Nvidia and Super Micro, for illegal exports of AI servers to China, highlighting ongoing regulatory scrutiny in the AI infrastructure supply chain^[40].

Sources

Hospital operator Nutex Health says data stolen in cyberattack - bleepingcomputer.com
Sensitive Information Exposed in Nutex Health Data Breach - securityweek.com
LACMA data breach last year exposed social security and medical data - bleepingcomputer.com
Hackers breached over 270 Zimbra servers in ongoing attacks - bleepingcomputer.com
Massive DDoS attack disrupts Norway’s government digital services - bleepingcomputer.com
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload - thehackernews.com
CISA Warns of Exploited Gitea Vulnerability - securityweek.com
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access - thehackernews.com
WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities - securityweek.com
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode - thehackernews.com
A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw - thehackernews.com
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw - darkreading.com
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows - thehackernews.com
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages - thehackernews.com
Hackers abuse npm mirrors to host phishing redirect pages - bleepingcomputer.com
E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands - thehackernews.com
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches - thehackernews.com
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes - thehackernews.com
AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes - bleepingcomputer.com
Report: Phishing Remains the Primary Initial Access Vector - blog.knowbe4.com
CyberheistNews Vol 16 #34 Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 - blog.knowbe4.com
From Fake Workers to Account Recovery: The Growing Identity Verification Risk - bleepingcomputer.com
Hidden Prompts Trick AI Into False Email Summaries - darkreading.com
Grok fooled into stealing user chat, location data, and more - malwarebytes.com
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android - thehackernews.com
WhatsApp adds stronger two-step verification, multiple passkeys - bleepingcomputer.com
WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update - securityweek.com
Police arrests dozens of suspects in global cybercrime crackdown - bleepingcomputer.com
Nigeria Looks to Sovereign Cloud for Cyber, National Security - darkreading.com
Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation - securityweek.com
Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff - securityweek.com

Cybersecurity Brief – 2026-05-30

Sat, 30 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach affecting 4.9 million accounts, with the ShinyHunters extortion group responsible for stealing and leaking personal information from the US telecom giant in early April ^[16]^[25].
Dutch authorities disrupted a malware botnet comprising 17 million infected devices and seized over 200 servers supporting the operation ^[12].
23andMe, now Chrome Holding Co., is facing a lawsuit from the California Attorney General over a 2023 breach that exposed sensitive customer genetic and personal information ^[10]^[28].
Trump Mobile reportedly exposed customer data in a recent breach ^[24].

Newly Discovered Vulnerabilities

Palo Alto Networks reported that CVE-2026-0257, a medium-severity authentication bypass vulnerability in PAN-OS and Prisma Access, is under active exploitation ^[3].
Researchers disclosed a vulnerability in OpenAI ChatGPT that exploits trust in Markdown links and images, potentially enabling phishing attacks via web summaries ^[4].
A critical argument injection flaw in Gogs, a Git server, allows authenticated attackers to achieve remote code execution via malicious pull requests. The vulnerability has a CVSS score of 9.4 and is considered a zero-day ^[27].
Google Chrome version 148 update addresses 151 vulnerabilities, including critical-severity issues that could lead to remote code execution ^[29].
An exploit chain in a popular cloud automation service combined over-permissioned roles, secrets discovery, and non-human identities, exposing the risk of major compromise in complex cloud integrations ^[19].

Notable Threat Actor Activity

The ShinyHunters extortion gang was responsible for the Charter Communications breach, leaking over 42 million records ^[16]^[25].
A previously undocumented Russia-linked threat actor, GREYVIBE, has been carrying out persistent AI-powered cyberattacks against Ukraine and related entities since at least August 2025 ^[6].
Threat actors are abusing ChatGPT’s content-sharing feature to host fake outage pages, tricking users into downloading malware disguised as a desktop application ^[9].
An unknown threat actor used a large language model (LLM) agent for post-compromise actions after exploiting the Marimo CVE-2026-39987 vulnerability ^[5].
Cybercriminals are impersonating Signal Support in phishing campaigns to steal backup recovery keys, enabling access to victims’ entire message archives ^[30].
Malicious NuGet packages masquerading as a Sicoob SDK were discovered stealing banking credentials, while npm packages targeted cloud secrets ^[8].
Phishing campaigns are targeting the 2026 FIFA World Cup, leveraging event interest for malicious activity ^[24].
The criminal gang known as “The Com” is conducting cyberattacks to financially support violence and sexual exploitation ^[20].

Trends, Tools, or Tactics of Interest

DDoS attacks are increasingly being offered as subscription-based services, featuring pricing tiers, support, and reseller programs, reflecting the professionalization of the DDoS-as-a-Service market ^[11].
The rise of “shadow AI” is evidenced by employees developing and deploying full AI-powered applications into production systems without adequate oversight, resulting in increased exposure and risk ^[7].
There is a trend toward attackers leveraging LLM agents for post-exploitation activities, as seen in the Marimo CVE-2026-39987 incident ^[5].
Attackers are exploiting cloud integration misconfigurations, particularly through over-permissioned roles and secrets exposure, to compromise automation services ^[19].
MokN raised $15 million for a “phish-back” platform that uses decoy access points to lure attackers and capture compromised credentials ^[26].

Regulatory or Policy Developments Affecting the Security Industry

The California Attorney General has initiated legal action against 23andMe (now Chrome Holding Co.) for failing to protect customer data in the wake of its 2023 breach ^[10]^[28].
Google Chrome has rolled out Device Bound Session Credentials (DBSC) to all users, providing enhanced protection against session cookie theft and account takeover ^[13].
Asia’s cyber insurance market is showing signs of increased activity and growth after historically slow uptake ^[18].
The US Cybersecurity and Infrastructure Security Agency (CISA) has responded to recent supply chain attacks, highlighting ongoing government engagement in addressing such threats ^[24].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Charter Communications Data Breach Could Impact Nearly 5 Million - securityweek.com
Dutch govt disrupts malware botnet with 17 million infected devices - bleepingcomputer.com
California AG sues 23andMe over 2023 breach exposing health data - bleepingcomputer.com
California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach - securityweek.com
In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks - securityweek.com
PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation - thehackernews.com
ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface - thehackernews.com
Gogs Zero-Day Exposes Servers to Remote Code Execution - securityweek.com
Chrome 148 Update Patches 151 Vulnerabilities - securityweek.com
With Complex Cloud Integrations, Small Errors Lead to Major Compromises - darkreading.com
New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks - thehackernews.com
ChatGPT share links abused to host fake outage pages to deliver malware - bleepingcomputer.com
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit - thehackernews.com
Signal users targeted in backup-stealing phishing attacks - malwarebytes.com
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets - thehackernews.com
'The Com' Cyberattacks Support Violence & Sexploitation - darkreading.com
From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market - bleepingcomputer.com
What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks - thehackernews.com
MokN Raises $15 Million for Phish-Back Platform - securityweek.com
Google Chrome adds session cookie theft protection for all users - bleepingcomputer.com
Asia's Cyber Insurance Market Shows Signs of Life - darkreading.com

Cybersecurity Brief – 2026-04-17

Fri, 17 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.

Cybersecurity Brief – 2026-04-13

Mon, 13 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

OpenAI revoked its macOS app certificate after discovering that a GitHub Actions workflow used to sign its macOS apps had downloaded a malicious version of the Axios library on March 31. OpenAI stated that no user data or internal systems were compromised as a result of this supply chain incident.

Newly Discovered Vulnerabilities

A critical pre-authentication remote code execution (RCE) vulnerability in Marimo is now under active exploitation. Attackers are leveraging this flaw to steal credentials.

Cybersecurity Brief – 2026-04-11

Sat, 11 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

CPUID suffered a supply chain attack where hackers altered download links for CPU-Z and HWMonitor, serving malicious executables via the official website.
Telehealth company Hims experienced a breach, exposing highly sensitive personal health information (PHI) of users.
Medical technology firm Stryker was impacted by a cyberattack.
Microsoft reported that the financially motivated threat actor Storm-2755 targeted Canadian employees in payroll hijacking attacks.
Nearly 4,000 US industrial devices, including PLCs, have been identified as exposed to Iranian-linked cyberattacks targeting critical infrastructure.
Fake websites impersonating Claude AI were found distributing PlugX malware, providing attackers remote access to victim systems.

Newly Discovered Vulnerabilities

Juniper Networks patched multiple vulnerabilities in Junos OS, including a critical flaw that allows remote, unauthenticated takeover of affected devices.
Chrome 147 addressed 60 vulnerabilities, including two critical bugs in the WebML component.
Orthanc DICOM software vulnerabilities were disclosed, leading to potential denial-of-service, information disclosure, and remote code execution.
A critical vulnerability in Marimo was exploited in the wild within nine hours of public disclosure.
ClickFix campaigns exploited a new method to infect Macs by bypassing macOS Tahoe’s Terminal warnings, using Script Editor instead.

Notable Threat Actor Activity

The “Silver Fox” threat actor is conducting tax-themed phishing campaigns targeting Japanese firms during tax season.
Ongoing GlassWorm campaign now uses a Zig dropper to infect developer integrated development environments (IDEs).
Iranian-linked hackers are actively targeting US critical infrastructure by manipulating PLCs and SCADA systems.
Storm-2755 continues payroll hijacking attacks, focusing on Canadian employees.
Recovery scammers are targeting individuals who have already been victims of fraud, leveraging so-called “sucker lists.”

Trends, Tools, or Tactics of Interest

Analysis of one billion CISA KEV remediation records indicates that most critical vulnerabilities are exploited before defenders can patch, highlighting the limitations of human-scale security operations.
Device Bound Session Credentials (DBSC) have been rolled out in Chrome 146 and above to prevent session theft by cryptographically binding authentication to devices.
Google introduced end-to-end encryption (E2EE) for Gmail on Android and iOS, now available for enterprise users.
AI browser extensions are emerging as an unmonitored channel for AI consumption, raising new security concerns.
Anthropic’s Mythos Preview AI model, capable of finding and exploiting zero-days, is drawing attention to the risks of advanced exploit-writing AI tools.
MITRE released the Fight Fraud Framework, providing a behavior-based model of fraud tactics and techniques.
ClickFix demonstrates a new macOS infection vector by using Script Editor to bypass standard paste warnings.
LayerX and other security vendors highlight the risk of browser extensions as attack vectors, particularly in the context of AI and GenAI usage.

Regulatory or Policy Developments

FINRA launched a Financial Intelligence Fusion Center to enhance response to cybersecurity and fraud threats in the financial sector.
Increased compliance oversight pressure is reported across public sector cybersecurity, with leaders now required to prove security effectiveness, not just prevent attacks.