MetaMask on DanSec Daily

Cybersecurity Brief – 2026-10-01

Thu, 01 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget confirmed that attackers stole $387.5 million by exploiting a zero-day vulnerability in a third-party security product. The investigation is ongoing to determine the full impact and attack vector ^[6].
MetaMask disclosed an ongoing security incident affecting part of its infrastructure, prompting the exit of affected Ethereum validators. The company is actively addressing and remediating the issue ^[7]^[18].
The Pentagon’s Defense Manpower Data Center (DMDC) suffered a breach of its human resources management system, resulting in the theft of personnel records and Social Security numbers of over 3 million military service members and their families ^[17]^[44].
The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached via a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system, enabling attackers to hijack sessions, achieve remote code execution, and escalate privileges to root ^[20]^[39].
Hackers stole sensitive court records, including more than 150,000 foster care reports, from Arizona courts, raising privacy and safety concerns ^[46].

Newly Discovered Vulnerabilities

Cisco patched a critical authentication bypass vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager, which was being actively exploited to escalate attacker privileges to administrative level. The flaw has been added to CISA’s Known Exploited Vulnerabilities catalogue ^[3]^[11]^[23]^[41].
Security researchers published a public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw reportedly used in targeted attacks. There is speculation that WhatsApp PDF checks could be a potential delivery method ^[5].
Kiteworks released security updates to address 126 vulnerabilities, including a maximum severity code injection flaw in its Email Protection Gateway (EPG) security solution ^[15].
CISA issued a warning about a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that could enable attackers to execute code or cause denial-of-service conditions ^[22].
A now-patched Zimbra Collaboration Suite (ZCS) vulnerability (CVE-2026-73570) was exploited in the wild prior to public disclosure. The flaw could be triggered via specially crafted emails without user interaction, allowing attackers to deploy web shells and access mailbox data ^[9]^[36].
Threat actors exploited a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, dropping web shells and attempting theft of configuration data ^[8].

Notable Threat Actor Activity

OpenAI disrupted a coordinated campaign linked to Moonshot AI Associates that attempted to illicitly extract protected reasoning from its AI models ^[2].
Russian state actor Star Blizzard deployed a new technique dubbed “RedFlick” to install the CosmicPulse backdoor via phishing against Ukrainian-linked targets, including NGOs, think tanks, and journalists. This marks a shift away from previous ClickFix tactics ^[19]^[28].
Threat actors abused ChatGPT Custom GPTs, disguising them as legitimate offerings to lure victims to malicious sites using ClickFix-style lures and deliver remote access trojans (RATs) ^[12]^[25].
Microsoft reported phishing campaigns distributing MSP360 Remote Monitoring and Management (RMM) installers, which then deploy ScreenConnect in dual-RMM attacks. These campaigns use meeting invitations and PDF-themed lures to trick users ^[10]^[30].
The Warlock ransomware group, believed to be Chinese and exhibiting both cybercrime and APT characteristics, targeted large organizations in Spain and Portugal ^[24].
Police, through Operation KillSwitch, dismantled the KillSec ransomware gang, seized its leak site and servers, and arrested three individuals, including the alleged 16-year-old leader. At least 110 terabytes of stolen victim data was secured ^[13]^[34].

Trends, Tools, or Tactics of Interest

Over 543,000 valid credentials were found exposed in public GitHub repositories as of July, despite platform security measures. Approximately 200,000 of these credentials were exposed after GitHub enabled push protections by default ^[21]^[40].
AI is accelerating both vulnerability discovery and exploitation, increasing the speed of attacks, while defensive fundamentals such as defense-in-depth remain critical ^[35].
AI is reshaping the Security Operations Center (SOC) career ladder. While 91 percent of security professionals report increased satisfaction due to AI-driven detection and response, nearly half find entry into the field more difficult, and one in four say AI limits skill development ^[27].
Enterprises are struggling to prepare for AI and quantum threats, with only 22 percent of leaders open to fully autonomous AI for cyber defense and just 21 percent implementing quantum-resistant security measures ^[33].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury blacklisted the most-wanted ATM malware developer and his network, continuing efforts to disrupt the Tren de Aragua ATM jackpotting scheme ^[38].
The White House announced a voluntary AI safety accord with major technology companies, including new controls and oversight requirements for “Super Intelligence” systems ^[26].

Sources

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft - thehackernews.com
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators - thehackernews.com
Metamask discloses security incident affecting its infrastructure - bleepingcomputer.com
Hackers stole Pentagon personnel records of over 3 million people - bleepingcomputer.com
Pentagon breach exposes Social Security numbers and military records of millions - malwarebytes.com
DIVD says Zammad zero-days enabled AI-driven network breach - bleepingcomputer.com
Zammad Zero-Days Exploited in AI-Powered DIVD Hack - securityweek.com
Hackers steal protective order and foster care records from Arizona courts - malwarebytes.com
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - thehackernews.com
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - thehackernews.com
Cisco warns of new SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability - securityweek.com
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - thehackernews.com
Kiteworks patches max severity code injection vulnerability - bleepingcomputer.com
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS - bleepingcomputer.com
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets - thehackernews.com
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure - securityweek.com
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - thehackernews.com
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates - thehackernews.com
Russian state hackers use new RedFlick technique to push malware - bleepingcomputer.com
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net - darkreading.com
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures - thehackernews.com
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure - darkreading.com
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks - thehackernews.com
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) - isc.sans.edu
Warlock Ransomware Hits Large Spanish, Portuguese Orgs - darkreading.com
Police dismantle KillSec ransomware gang allegedly led by 16-year-old - bleepingcomputer.com
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader - securityweek.com
Over 543,000 valid credentials exposed in public GitHub repositories - bleepingcomputer.com
500,000 Active Credentials Left Exposed on GitHub - securityweek.com
AI Has Changed Attack Speed, Not Security Fundamentals - securityweek.com
As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half - darkreading.com
Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says - securityweek.com
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network - securityweek.com
Trump, Tech Giants Strike Voluntary AI Safety Accord - darkreading.com

Cybersecurity Brief – 2026-04-21

Tue, 21 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
Booking.com was reported as a recent victim of a cyberattack, with further details pending.
A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

Over twenty malicious apps impersonating popular crypto wallets (Metamask, Coinbase, Trust Wallet, OneKey, etc.) were discovered on the Apple App Store, primarily targeting users in China. These apps phished for recovery/seed phrases to steal cryptocurrency.
SGLang (CVE-2026-5760, CVSS 9.8): A critical vulnerability allows remote code execution via malicious GGUF model files.
Anthropic Model Context Protocol (MCP): A critical design weakness was disclosed, enabling remote code execution and posing a supply chain risk for AI deployments.
Serial-to-IP converters from Lantronix and Silex were found to contain 20 new vulnerabilities, exposing OT and healthcare systems to potential attacks.
CISA added eight new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three affecting Cisco devices.
WhatsApp was found to leak user metadata, allowing attackers to infer limited information about users without direct contact.
Half of the 6 million internet-facing FTP servers were found to lack encryption, exposing users and enterprises to various attacks.

Notable Threat Actor Activity

Lazarus Group (North Korea) linked to the $290 million KelpDAO crypto theft.
Scattered Spider leader pleaded guilty to multiple cybercrimes, including corporate intrusions and cryptocurrency theft.
Pro-Iran hacker group claimed responsibility for the DDoS attack on Bluesky.
The Gentlemen ransomware group was observed using the SystemBC proxy malware botnet (over 1,570 hosts) for bot-powered attacks, facilitating lateral movement and defense evasion.
Threat actors are abusing QEMU, a machine emulator, in campaigns to evade defenses and distribute ransomware and remote access tools.
Microsoft reported increased abuse of Microsoft Teams by threat actors for helpdesk impersonation and lateral movement using legitimate tools.
Reports indicate use of .wav files as a vector for malware delivery.

Trends, Tools, or Tactics of Interest

Third-party tools and compromised OAuth tokens are increasingly leveraged as initial access vectors in breaches, as seen in the Vercel incident.
There is a rise in threat actors exploiting trusted download paths and legitimate collaboration platforms (e.g., Microsoft Teams) for initial access and lateral movement.
The SystemBC proxy is being used by ransomware operators to automate attacks and maintain persistence within victim networks.
QEMU is being leveraged for defense evasion in recent ransomware and RAT campaigns.
Increase in phishing and malicious app distribution on official platforms, such as the Apple App Store, specifically targeting cryptocurrency assets.
Serial-to-IP converters in OT and healthcare environments remain a weak link due to numerous unpatched vulnerabilities.
AI supply chain risks are highlighted by critical vulnerabilities in AI model protocols and concerns about the misuse of powerful AI tools (e.g., Anthropic’s Mythos tool not publicly released over security fears).
Survey data from LevelBlue indicates ongoing concern among security leaders about the human element in cybersecurity, with workforce education seen as insufficient.

Regulatory or Policy Developments

The US Senate extended surveillance powers under a controversial program until 30 April 2026, following legislative delays.
CISA set federal deadlines in April–May 2026 for remediation of newly catalogued exploited vulnerabilities.

Cybersecurity Brief – 2025-05-10

Sat, 10 May 2025 00:00:00 +0000

Major Incidents or Breaches

Ascension Healthcare Breach: Ascension, a major US healthcare provider, disclosed a data breach affecting over 430,000 patients, exposing personal and healthcare information.
Insight Partners Data Breach: Ongoing investigation reveals the impact of the breach at venture capital firm Insight Partners is larger than initially anticipated, with affected customers being notified incrementally.
Japanese Financial Account Compromise: Hackers breached nearly 5,000 Japanese financial accounts in April, conducting almost $2 billion in fraudulent trades across nine securities firms.
LockBit Ransomware Gang Breach: LockBit’s affiliate panel was compromised, leaking sensitive operational data including Bitcoin addresses, private victim chats, and user credentials.

Newly Discovered Vulnerabilities

Firefox ESR 115.11 PDF.js Vulnerability: High-risk arbitrary JavaScript execution vulnerability identified in PDF.js within Firefox ESR 115.11, enabling potential remote code execution.
Apache ActiveMQ 6.1.6 Denial of Service: Medium-risk vulnerability in Apache ActiveMQ 6.1.6 allows attackers to trigger denial of service conditions.

Notable Threat Actor Activity

Proxy Botnet Takedown: US and Dutch authorities dismantled a botnet of over 7,000 IoT and end-of-life devices used as residential proxies (Anyproxy and 5socks). Four foreign nationals (three Russian, one Kazakhstani) have been charged.
Chinese APT Targeting SAP NetWeaver: Ongoing exploitation of a critical SAP NetWeaver vulnerability has been linked to a Chinese threat actor, according to Forescout Vedere Labs.
North Korean OtterCookie Campaign: Updated OtterCookie v4 malware, used by North Korean actors, now features enhanced VM detection and capabilities for Chrome and MetaMask credential theft.
Initial Access Brokers in Brazil: Campaigns targeting Brazilian executives leverage NF-e-themed spam and trial versions of legitimate remote monitoring and management (RMM) tools to gain initial access.
Hacktivist Campaigns (#OpIndia): Following the Pahalgam attack, hacktivists have united under the #OpIndia banner, escalating cyber activity in the India-Pakistan conflict context.

Trends, Tools, and Tactics

Malicious npm Packages: Over 3,200 users of the macOS version of the Cursor AI code editor were infected with backdoored npm packages designed for credential theft.
Phishing Kit Sophistication: Emergence of advanced phishing kits capable of auto-generating customised login pages to evade detection and increase success rates.
Password and Passkey Risks: Even with passkey adoption, residual password vulnerabilities persist, highlighting the need for comprehensive credential management.
Polymorphic Browser Extension Threats: New threats targeting password managers via polymorphic browser extensions pose significant risks to credential security.
Vulnerability Management Challenges: Security teams continue to struggle with the reactive nature of vulnerability management and patching delays due to policy constraints.
AI Security Risks: Increased deployment of AI agents introduces new attack surfaces, including risks of data leaks and identity theft.

Regulatory or Policy Developments

German Law Enforcement Action: German authorities shut down the eXch cryptocurrency mixer, seizing assets linked to cybercrime proceeds and laundering activities.
US Border Surveillance Expansion: US Customs and Border Protection plans to expand facial recognition for vehicle exits, while the US surveillance watchdog recommends transparency and voluntary participation for airport facial recognition programmes.
Google AI Countermeasures: Google is rolling out on-device AI protections (Gemini Nano LLM) in Chrome and Android to detect and block scams, including tech support scams, enhancing user protection through automated detection.

Other Notable Industry Updates

Rapid7 MDR Launch: Rapid7 has introduced a new Managed Detection & Response (MDR) service for enterprise customers.