Progress on DanSec Daily

Cybersecurity Brief – 2026-10-13

Tue, 13 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers remotely compromised refrigeration controllers at hundreds of French supermarkets, setting fridges and freezers to high temperatures and causing significant food spoilage. The attack targeted Danfoss controllers and affected multiple retail chains across France and Europe, with reports of fires and forced food disposal. Ahold Delhaize, a major grocery group, also disconnected some systems in response to a related security issue ^[5]^[16]^[25]^[26]^[29].
Yandex suffered service outages after drone attacks damaged three of its data centers, resulting in loss of access to cloud files for users and the shutdown of two facilities with partial disablement of a third ^[13].
Ledger confirmed that some hardware cryptocurrency wallets distributed via a Southeast Asian reseller were compromised with a spy chip implant. The implant enabled attackers to steal user credentials and drain wallets, with losses linked to an $86 million crypto theft ^[15]^[24].

Newly Discovered Vulnerabilities

Three vulnerabilities in LG webOS smart TVs allow attackers on the same local network to chain exploits for pre-authentication root access without user interaction. LG has issued patches ^[3].
Two critical flaws in Progress Software’s MarkLogic Server could let delegated management accounts escalate privileges to persistent administrator control. A total of 31 vulnerabilities were disclosed ^[6].
GitLab patched a CVSS 10.0 (maximum severity) vulnerability in its Community and Enterprise Editions that could allow unauthenticated users to execute arbitrary code on the server ^[7].
SAP addressed a maximum-severity SSRF vulnerability in the Cloud SDK for Python as part of its October security updates, among other flaws ^[11].
SonicWall SMA 1000 appliances are under active attack targeting a maximum-severity SSRF vulnerability ^[17].
Multiple high-impact vulnerabilities were discovered in LiteLLM, a widely used open-source LLM gateway, tracked as CVE-2026-35029 and CVE-2026-59823. Fixes have been released ^[27].

Notable Threat Actor Activity

Low-cost Android phones are shipping with preinstalled malware in the firmware, enabling threat actors to covertly install apps, conduct ad fraud, and turn the devices into residential proxies ^[8].
The XWorm remote access trojan has evolved into a more advanced surveillance platform, now capable of monitoring user location, live audio streaming, and interacting with authenticated browser sessions through an expanded plugin set ^[22].

Trends, Tools, or Tactics of Interest

Attackers are exploiting gaps in multi-factor authentication coverage by targeting VPNs, RDP, and Windows systems that still rely on passwords, using stolen credentials to bypass incomplete MFA deployments ^[10].
AI is accelerating the speed of cyberattacks, with adversaries able to rapidly exploit newly disclosed vulnerabilities, reducing defenders’ response windows ^[2]^[9]^[23].
Experiments indicate that small AI models may soon be able to self-replicate on IoT devices, including cheap TV boxes, raising concerns about autonomous malware propagation ^[21].
Anthropic has taken its internal AI models offline after tests involving government websites demonstrated the risk of AI-driven breaches during high-risk and cybersecurity evaluations ^[14].

Regulatory or Policy Developments Affecting the Security Industry

The Norwegian Data Protection Authority fined Xandr, a Microsoft-owned advertising company, €8.6 million (NOK 92 million, $9.6 million) for unlawfully sharing sensitive Grindr user data with advertisers, potentially revealing users’ sexual orientation without valid consent ^[1]^[12]^[28].

Sources

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers - thehackernews.com
Cyberattack shuts down refrigerators at French supermarkets - bleepingcomputer.com
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems - securityweek.com
Refrigeration Controller Hack Spoils Food Across European Supermarkets - securityweek.com
Hackers heat up supermarket fridges, spoiling food across France - malwarebytes.com
Yandex confirms service outage as users lose access to cloud files - bleepingcomputer.com
Ledger confirms spy chip implant behind wallet crypto thefts - bleepingcomputer.com
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant - securityweek.com
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network - thehackernews.com
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control - thehackernews.com
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code - thehackernews.com
SAP warns of maximum severity OAuth2 SSRF security flaw - bleepingcomputer.com
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack - darkreading.com
When LLM Gateways Go Wrong: Findings from LiteLLM - research.checkpoint.com
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies - thehackernews.com
XWorm RAT Evolves Into Surveillance Platform - securityweek.com
The MFA Gaps Attackers are Still Exploiting - bleepingcomputer.com
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls - thehackernews.com
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More - thehackernews.com
AI Turns Familiar Cyberattacks Into a Race Against Time - securityweek.com
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns - securityweek.com
Anthropic takes risky AI tests offline after models breach govt sites - bleepingcomputer.com
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation - thehackernews.com
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing - bleepingcomputer.com
Grindr users’ sensitive data shared through ad auctions without valid consent - malwarebytes.com

Cybersecurity Brief – 2026-08-11

Tue, 11 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN), leading to the shutdown of a steam turbine and water treatment system. This attack vector is notable as it marks the first known use of a private APN for access to operational technology networks in critical infrastructure^[7]^[15]^[41].
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline following detection of unusual activity on servers managed by a third-party vendor^[22].
Valve notified European Steam hardware customers of a data breach resulting from a compromise of its shipping partner, CEVA Logistics, leading to theft of customer data^[23].
Corporate data was stolen from Levi Strauss following a social engineering attack that enabled threat actors to access and exfiltrate data from the computers of three employees^[43].

Newly Discovered Vulnerabilities

A critical Progress Kemp LoadMaster command injection vulnerability is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands. CISA has issued an urgent warning to patch affected systems^[24]^[42].
Two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw, are now being exploited by ransomware groups^[19].
A maximum-severity, unauthenticated, remote administrator access vulnerability in Metabase has been exploited as a zero-day. Metabase has released a patch, but the vulnerability does not yet have a CVE^[27]^[40].
High-severity vulnerabilities in ClamAV, Cisco’s anti-malware engine, have been disclosed with a public proof-of-concept. These bugs could be exploited remotely by unauthenticated attackers to cause denial-of-service conditions^[37].
New passkey attacks have been demonstrated that can recover synced private keys or bypass phishing-resistant multi-factor authentication without breaking underlying cryptography^[13].

Notable Threat Actor Activity

Storm-1175, a financially motivated Chinese threat actor and former Medusa ransomware affiliate, has deployed a new ransomware strain named StormEncryptor, likely using an N-central flaw as an entry vector^[10]^[18].
The North Korean Kimsuky group has developed an offline AI stack to enhance phishing campaigns and automate malware development, allowing operations without dependence on public AI services^[12].
The threat actor Head Mare is exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with a backdoor named PhantomCore, targeting Russian companies in various sectors^[14].
A supply chain compromise at WordPress plugin vendor BdThemes allowed attackers to poison a remote JSON feed, creating rogue WordPress admin accounts on affected sites^[8]^[16].
Iranian-linked actors have widened attacks on water systems across at least a dozen US states, targeting internet-exposed industrial control systems at water facilities^[26]^[39].

Trends, Tools, or Tactics of Interest

Malware targeting Windows, macOS, and IoT devices continued to evolve in Q2 2026, with notable increases in sophistication and targeting breadth^[1].
Mobile threat trends in Q2 2026 include the rise of the Anatsa banking trojan and increased use of dropper techniques to bypass detection^[2].
AI-driven social engineering attacks are becoming more convincing and personalized, with attackers leveraging AI to increase the speed and effectiveness of phishing, credential theft, and social engineering operations^[3]^[20].
“Ghostjacking” is a newly described attack method where poisoned security logs or alerts are used to manipulate and hijack AI agents by embedding malicious instructions^[25]^[38].
Sophisticated iOS exploit chains, such as Coruna and DarkSword, are proliferating from nation-state use to wider adoption by organized cybercrime groups^[29].
A turnkey scam kit has been discovered that lowers the technical barrier for conducting online scams, making it easier for non-technical actors to launch fraudulent campaigns^[45].
A new phishing kit, dubbed “Bulletproof Redirector,” uses compromised legitimate websites and hidden directories to evade secure email gateways and facilitate credential theft^[4].
Attackers are increasingly exploiting supply chain weaknesses, as seen in the BdThemes and Metabase incidents, to compromise downstream targets^[8]^[16]^[27]^[40].
Security researchers have demonstrated that passkey-based authentication can be undermined through attacks on synchronization and device trust mechanisms^[13]^[20].
Increased scanning activity targeting Solana blockchain endpoints has been observed, indicating heightened interest in exploiting crypto-related infrastructure^[33].

Regulatory or Policy Developments Affecting the Security Industry

Outdated cybercrime laws are putting security researchers at risk, prompting calls for legal reforms to protect ethical hackers and good-faith security research^[30].
Microsoft Edge is dropping support for Manifest V2, which will impact popular privacy tools that rely on older extension technology, potentially reducing user privacy protections^[46].
Mozilla has issued a new Firefox GPG signing key after the previous subkey was inadvertently exposed on GitHub, requiring a key revocation^[34].

Sources

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine - thehackernews.com
Hackers breached a small Polish energy plant via private APN last year - bleepingcomputer.com
Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility - securityweek.com
LexisNexis shuts down services after suspicious activity on servers - bleepingcomputer.com
Valve notifies Steam hardware customers of a data breach - bleepingcomputer.com
Corporate Data Stolen in Levi Strauss Cyberattack - securityweek.com
Critical Progress LoadMaster flaw now actively exploited in attacks - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability - securityweek.com
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs - bleepingcomputer.com
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading.com
Metabase Patches Vulnerability Exploited as Zero-Day - securityweek.com
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC - securityweek.com
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA - thehackernews.com
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - thehackernews.com
New StormEncryptor ransomware used by former Medusa affiliate - bleepingcomputer.com
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development - thehackernews.com
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore - thehackernews.com
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - thehackernews.com
BdThemes plugins supply-chain hack creates rogue WordPress admins - bleepingcomputer.com
Multistate Water System Attacks Widen, Iran Suspected - darkreading.com
New Jersey, Alabama Join States Targeted in Water Cyberattacks - securityweek.com
IT threat evolution in Q2 2026. Non-mobile statistics - securelist.com
IT threat evolution in Q2 2026. Mobile statistics - securelist.com
Introducing Real-Time Coaching in KnowBe4’s AI-Native Security Awareness Training - blog.knowbe4.com
When Credentials Are No Longer Enough: Device Trust in the AI Era - bleepingcomputer.com
'GhostJacking' Exposes Identity Governance Gaps in AI Agents - darkreading.com
‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad - securityweek.com
Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading.com
New turnkey kit makes it easy for anyone to become a scammer - malwarebytes.com
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs - blog.knowbe4.com
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - isc.sans.edu
Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading.com
Edge is dropping older extensions, affecting popular privacy tools - malwarebytes.com
Mozilla Issues New Firefox GPG Key Following Exposure - securityweek.com

Cybersecurity Brief – 2026-08-08

Sat, 08 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Unlimited Technology Systems, a healthcare software company, reported a data breach impacting more than 3.8 million people, with the incident occurring in October 2025 ^[17].
Levi Strauss & Co. disclosed a cyberattack where hackers used social engineering on three employees to steal corporate data from their machines ^[18].
The North Carolina Ports Authority confirmed a cyberattack that disrupted IT systems and slowed operations at multiple port locations ^[20]^[22].
Metabase instances were breached in zero-day attacks exploiting a critical SQL injection vulnerability, resulting in customer data theft for organisations including Framework and Tally ^[2]^[16].

Newly Discovered Vulnerabilities

A maximum-severity zero-day vulnerability in Metabase’s business intelligence software allows admin access without authentication and has been actively exploited in the wild ^[2]^[16].
Progress Kemp LoadMaster is affected by a critical vulnerability now added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, following 792 reported exploitation attempts ^[4].
WordPress patched a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen affecting all versions, which could allow PHP code execution ^[8].
An 18-year-old use-after-free bug in Linux’s SCTP networking code can allow local users to gain root privileges and escape containers ^[10].
Security researcher Malcolm Stagg disclosed NatJack, a new attack class that manipulates NAT tables to hijack TCP sessions and spoof DNS responses ^[11].
Vulnerabilities in Claude Code and Gemini CLI allowed a GitHub issue from a non-privileged account to execute code on CI runners behind Anthropic’s and Google’s repositories, exposing workflow secrets ^[15].
Apple released a patch for a high-severity authentication bypass, and Microsoft fixed critical vulnerabilities across Azure, Entra, and SharePoint ^[26].
A Bendix EC80 truck brake controller safety recall also addressed remote code execution and denial-of-service vulnerabilities, which were not publicly disclosed at the time ^[24].

Notable Threat Actor Activity

The UNC6671 group, previously known as BlackFile, has been linked to a wave of vishing attacks targeting financial services, private equity, and professional services. The group has rebranded under the names Redact, Pink, Helix, and Falcon and continues to use voice phishing (vishing) and personal phone targeting to steal SaaS data for extortion ^[7]^[23].
Nearly 800 malicious npm packages were published as part of a campaign to deliver cross-platform remote access trojans (RATs) and infostealers targeting Windows, Mac, and Linux systems ^[5].
ClickFix-style attacks are being used to deliver a Go-based macOS stealer capable of draining cryptocurrency wallets and exfiltrating browser, iCloud Keychain, and cached credentials ^[6].
A widespread phishing campaign employing adversary-in-the-middle (AitM) techniques is hijacking Microsoft 365 accounts to collect payroll and financial emails ^[12].
Malware can abuse Windows Hello for Business keys to maintain persistent access to Microsoft Entra ID without user awareness ^[14].
Gen’s H1 2026 Threat Report highlights two attack chains: one using compromised business inboxes and browser manipulation in banking malware campaigns, and another using clipboard hijacking to redirect payments ^[19].
IEH Corporation’s mailbox was breached via phishing ^[22].

Trends, Tools, or Tactics of Interest

Attackers reached managed systems and established persistence through exploitation of a recently disclosed flaw in N-able N-central, prompting the release of additional hotfixes ^[3].
AI-assisted research tool HTTP Terminator identified new HTTP desynchronization techniques and discovered a novel Apache zero-day ^[13].
AI-generated patches were found to fail or introduce new bugs in approximately half of cases, according to a study of over 6,000 patches ^[21].
AI chat bots are being used to send friend requests in League of Legends, indicating evolving social engineering tactics in gaming environments ^[27].

Regulatory or Policy Developments Affecting the Security Industry

Meta was ordered by a court to pay $942 million in fines and required to improve its age assurance tools to address harm to children ^[28].
The US imposed a ban on Chinese data center technology, as reported among noteworthy regulatory developments ^[22].

Sources

Unlimited Technology Systems breach impacts 3.8 million people - bleepingcomputer.com
Levi Strauss & Co. says hackers stole corporate data in cyberattack - bleepingcomputer.com
North Carolina Ports confirms cyberattack disrupting operations - bleepingcomputer.com
In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street - securityweek.com
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication - thehackernews.com
Metabase SQLi zero-day exploited in customer data-theft attacks - bleepingcomputer.com
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts - thehackernews.com
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP - thehackernews.com
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers - thehackernews.com
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables - thehackernews.com
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets - thehackernews.com
Microsoft, Apple Release Fresh Security Updates - securityweek.com
Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix - securityweek.com
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data - thehackernews.com
Vishing Extortion Group UNC6671 Rebrands After Making Millions - securityweek.com
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer - thehackernews.com
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets - thehackernews.com
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails - thehackernews.com
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access - thehackernews.com
Real emails, hijacked payments: Two H1 2026 attack chains - bleepingcomputer.com
N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist - thehackernews.com
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day - thehackernews.com
AI-Generated Patches Fail Half the Time - darkreading.com
AI chat bots are sliding into League of Legends friend requests - malwarebytes.com
Meta ordered to pay $942 million over harm to children - malwarebytes.com

Cybersecurity Brief – 2026-07-15

Wed, 15 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

SonicWall confirmed active exploitation of two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SMA 1000 series appliances, enabling remote code execution and administrative command execution. Patches have been released and users are urged to update immediately ^[3]^[15]^[41].
Progress Software attributed the emergency shutdown of ShareFile Storage Zone Controllers to a high-severity zero-day vulnerability and issued security updates to address the flaw ^[21].
Nearly 300 fake GitHub repositories have been published by threat actors impersonating legitimate software projects to distribute infostealer malware ^[17].
The Spanish Police dismantled a cybercrime and money-laundering organisation responsible for €140 million in investment fraud and BEC attacks, arresting four individuals ^[16].
xAI’s Grok Build CLI was found to be uploading entire Git repositories, including full commit histories, to a Google Cloud Storage bucket operated by xAI, rather than just necessary files ^[13].
LastPass and Bitwarden users are being targeted by a phishing campaign using fake security alerts to direct them to fraudulent sites ^[22].
The D1R cybercrime group claimed to have stolen data from Synopsys and Bosch, threatening to leak it unless a ransom is paid. Synopsys reports no evidence of breach ^[43].

Newly Discovered Vulnerabilities

Microsoft released a record-breaking Patch Tuesday update, addressing 622 vulnerabilities (including 570 in Windows), with at least two zero-days under active exploitation affecting Active Directory and SharePoint Server, and a publicly disclosed BitLocker bug. Over 60 flaws were rated critical ^[4]^[18]^[19]^[30]^[36]^[39]^[42].
SAP patched multiple critical vulnerabilities in NetWeaver Application Server ABAP (CVSS 9.9), Commerce Cloud, and AppRouter that could allow attackers to access, modify data, cause system unavailability, and desynchronise requests and responses ^[5]^[26]^[47].
Researchers disclosed two access control flaws in RabbitMQ that could allow attackers to leak OAuth client secrets and expose enterprise queue metadata ^[8].
Eleven old Microsoft-signed Linux UEFI shims have been discovered that can be abused to bypass Secure Boot on most modern systems ^[9].
A critical vulnerability remains unpatched in the Claude for Chrome extension, allowing rogue browser extensions to trigger access to Gmail, Google Docs, and Calendar data via Claude tasks ^[6]^[46].
Adobe patched critical ColdFusion vulnerabilities that could allow remote code execution or privilege escalation ^[44].
VMware patched seven severe vulnerabilities in its Avi Load Balancer, including authentication bypass, remote code execution, privilege escalation, and directory traversal ^[45].
Critical vulnerabilities were patched in Chrome 150 and Firefox 152. Public exploit code exists for Firefox flaws, but no in-the-wild exploitation has been observed ^[40].
Researchers found a vulnerability in the Cursor IDE that allows automatic execution of malicious code from poisoned repositories ^[35].
Automated Frequency Coordination systems for 6 GHz Wi-Fi were found to trust client-side data by default, enabling location spoofing and potential disruption of critical systems ^[31].

Notable Threat Actor Activity

At least two threat actors are using OAuth client ID spoofing to validate stolen Microsoft Entra credentials in cloud campaigns, evading detection ^[12].
LabubaRAT, a previously undocumented Rust-based remote access trojan, is masquerading as NVIDIA software to gain persistence and control over Windows hosts ^[7].
Multiple state-sponsored Russian APTs are targeting critical infrastructure routers, exploiting poorly secured devices across sector networks ^[48].
A threat actor is distributing infostealer malware via hundreds of fake GitHub repositories impersonating legitimate projects ^[17].
The D1R group claimed responsibility for alleged attacks on Synopsys and Bosch, demanding ransom for stolen data ^[43].
A trusted ransomware negotiator was discovered to have secretly assisted the BlackCat ransomware gang in extorting victims, constituting an insider threat ^[51].

Trends, Tools, or Tactics of Interest

The ClickFix social engineering technique has emerged as the leading malware delivery method, involving user interaction to copy and execute malicious commands. The ecosystem is now available for rent at scale, can evade AV and EDR, and relies on YARA analysis for detection ^[1]^[34].
AI tools are being leveraged by scammers to geolocate individuals based on social media photos, enabling more targeted social engineering attacks ^[2].
Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts and using techniques to bypass multi-factor authentication ^[25].
New phishing campaigns are targeting LastPass and Bitwarden users with fake security alerts to lure victims to malicious sites ^[22].
Crypto wallet browser extensions were found to leak address and tracking information, enabling linkage and tracking of users ^[10].
AI-driven security agents are increasingly influencing security operations by summarising findings and prioritising remediation, but most tools remain fragmented ^[11].
Picus described the use of TTP chaining for vulnerability validation without running live exploits, supporting safer risk assessment ^[23].
Cybercriminals are combining FaceTime social engineering with unpatched devices to steal credentials and drain bank accounts ^[50].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury Department’s OFAC sanctioned two individuals and one entity for enabling ransomware attacks against US organisations, targeting VPN and malware providers ^[28].
US federal prosecutors unsealed charges against three Russian nationals accused of providing bulletproof hosting services to ransomware gangs responsible for over $62 million in damages ^[14].
Nigeria advanced rules mandating the disclosure of cyberattacks by organisations, aligning with a global trend towards required transparency ^[29].
Microsoft announced that passkeys will become the default authentication method for Entra ID enterprise identity service starting September 2026 ^[24].
Several US state governments are moving to legislate transparency in the deployment of frontier AI models, responding to increased independence and reduced human oversight in AI systems ^[33].

Sources

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands - thehackernews.com
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now - bleepingcomputer.com
SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits - securityweek.com
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown - bleepingcomputer.com
Nearly 300 GitHub repos pose as legit software to push malware - bleepingcomputer.com
Spanish Police take down €140 million cyber fraud ring, arrest four - bleepingcomputer.com
Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read - thehackernews.com
LastPass, Bitwarden users targeted with fake security alerts - bleepingcomputer.com
Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims - securityweek.com
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack - thehackernews.com
Microsoft releases Windows 10 KB5099539 extended security update - bleepingcomputer.com
Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days - bleepingcomputer.com
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes - darkreading.com
Microsoft Patches a Record 570 Security Flaws - krebsonsecurity.com
Microsoft Patch Tuesday July 2026 - The AI Acopolypse is Here , (Tue, Jul 14th) - isc.sans.edu
Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data - thehackernews.com
SAP warns of critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud - securityweek.com
RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata - thehackernews.com
11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot - thehackernews.com
Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads - thehackernews.com
Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar - securityweek.com
Adobe Patches Critical ColdFusion Vulnerabilities - securityweek.com
7 Severe Vulnerabilities Patched in VMware Avi Load Balancer - securityweek.com
Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates - securityweek.com
Cursor IDE Auto-Executes Malicious Code in Poisoned Repos - darkreading.com
6 GHz Wi-Fi Flaws Could Disrupt Critical Systems - darkreading.com
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials - thehackernews.com
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts - thehackernews.com
US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers - securityweek.com
The inside job that cost ransomware victims millions - malwarebytes.com
ClickFix Social Engineering is Now the Leading Malware Delivery Method - blog.knowbe4.com
ClickFix's Mushrooming Ecosystem Demands New Defense Tactics - darkreading.com
Scammers Can Use AI Tools to Pinpoint Your Location Based on a Photo - blog.knowbe4.com
New phishing kits target Microsoft 365 accounts, evade MFA - bleepingcomputer.com
Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks - thehackernews.com
How Pentera Turns AI Security Workflows into Validation Engines - thehackernews.com
You Don't Have to Run an Exploit to Know If You're Vulnerable - bleepingcomputer.com
Warning: Scammers are using FaceTime to empty bank accounts - malwarebytes.com
US sanctions VPN, malware providers for enabling ransomware attacks - bleepingcomputer.com
US charges alleged operators of Russian bulletproof hosting service - bleepingcomputer.com
Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits - darkreading.com
Microsoft Entra ID gets passkeys default authentication starting September - bleepingcomputer.com
Frontier AI: The Genie's Out of the Bottle, but Where's the Rulebook? - darkreading.com

Cybersecurity Brief – 2026-07-14

Tue, 14 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft attributed a year-long series of intrusions into corporate Salesforce environments to threat actors linked to the ShinyHunters data-extortion group, who gained access without exploiting technical vulnerabilities in the Salesforce platform ^[3].
Japan’s largest taxi operator, Nihon Kotsu, shut down parts of its infrastructure following a cyberattack that compromised its systems ^[12].
Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands, resulting from a compromise at a third-party service provider ^[16].
The Jscrambler npm package was backdoored with infostealer malware and downloaded nearly 1,500 times before being taken down ^[13].
Google and Microsoft removed the ModHeader browser extension, used by 1.6 million users, after researchers discovered a hidden component collecting browsing history ^[5].
The Cybersecurity and Infrastructure Security Agency (CISA) published details of a data leak caused by a contractor uploading internal credentials, including AWS Govcloud keys, to GitHub ^[26].
Progress Software instructed customers to shut down ShareFile Storage Zone Controllers due to a credible security threat under investigation ^[35].

Newly Discovered Vulnerabilities

Critical remote code execution vulnerabilities in the iCagenda and Balbooa Forms Joomla extensions are being actively exploited by threat actors ^[15]^[34].
Zimbra patched a critical code execution vulnerability that allowed malicious code embedded in crafted emails to execute when the emails were opened ^[32].
A vulnerability in RabbitMQ enables unauthenticated attackers to obtain the broker’s OAuth client secret, potentially allowing full control over the broker ^[31].

Notable Threat Actor Activity

Russian state-backed hackers were jointly sanctioned by the EU and UK for coordinating cyberattacks and disinformation campaigns across Europe, with specific targeting of critical infrastructure and government entities ^[19]^[21]^[33].
US and allied cybersecurity agencies warned that Russian state actors are targeting vulnerable and misconfigured routers to gain access to critical infrastructure networks ^[20].
A new phishing-as-a-service operation, Forg365, is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle session theft, antibot evasion, and AI-assisted phishing page generation ^[8].
An unknown threat actor used an AI-generated PowerShell script to enumerate Active Directory environments during an intrusion ^[11].
The GigaWiper modular implant was identified, combining backdoor and wiper functionalities, allowing threat actors to select their preferred destructive attack method ^[23].
A new macOS infostealer, CrashStealer, poses as Apple’s crash reporting tool to harvest credentials, keychain data, and cryptocurrency wallets, using a notarized dropper to bypass Gatekeeper ^[4]^[14].

Trends, Tools, or Tactics of Interest

AI tools are increasingly used by threat actors to automate social engineering, phishing, and attack flows, making attacks more efficient and scalable ^[1]^[6]^[8]^[36].
The MemGhost attack demonstrates how a single malicious email can implant persistent false memories in AI agents with inbox access, affecting their operational decision-making ^[7].
Proof-of-concept “Ghostcommit” attack shows how malicious prompt injections can be hidden inside image files, potentially compromising AI systems during code reviews ^[39].
Open source tool “ScamBuster” leverages AI-driven victim personas to engage with email scammers, enabling data collection on phishing operations for organizations and law enforcement ^[24].
Organizations are forming “Yellow Teams” to both attack and defend AI systems, developing tools to test AI’s potential in cybersecurity from both perspectives ^[22].
The security industry is seeing a trend towards combining autonomous AI with analyst copilots in security operations centers to enhance detection and response ^[10].
Fake cryptocurrency gift card sites are becoming increasingly sophisticated and harder to distinguish from legitimate sites ^[40].

Regulatory or Policy Developments Affecting the Security Industry

The Pentagon suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program to conduct a comprehensive review and reform of contractor cybersecurity requirements ^[28].
The EU and UK jointly issued their first coordinated cyber sanctions package, targeting Russian individuals and entities for cyberattacks and disinformation campaigns ^[19]^[21]^[33].

Sources

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths - thehackernews.com
Japan's largest taxi operator shuts systems after cyberattack - bleepingcomputer.com
Lidl discloses online shop breach after service provider hack - bleepingcomputer.com
Hackers backdoor Jscrambler npm package with infostealer malware - bleepingcomputer.com
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found - thehackernews.com
Lessons Learned from CISA’s Recent GitHub Leak - krebsonsecurity.com
Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns - securityweek.com
CISA warns of actively exploited RCE flaws in Joomla extensions - bleepingcomputer.com
Organizations Warned of Exploited Joomla Extension Vulnerabilities - securityweek.com
Zimbra Patches Critical Code Execution Vulnerability - securityweek.com
RabbitMQ Vulnerability Threatens Enterprise Systems - securityweek.com
EU sanctions Russian GRU military hackers over cyberattacks - bleepingcomputer.com
Weak Security Continues to Fuel Russian Cyberattacks - darkreading.com
EU Targets Russian Intelligence Officers Accused of Running a Yearslong Cyber Spying Campaign - securityweek.com
US and allies warn of Russian critical infrastructure attacks - bleepingcomputer.com
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft - thehackernews.com
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory - thehackernews.com
GigaWiper Lets Threat Actors Choose Their Own Destructive Attack - darkreading.com
CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks - thehackernews.com
New CrashStealer malware poses as Apple crash reporting tool - bleepingcomputer.com
Report: Attackers Are Using AI to Automate Social Engineering - blog.knowbe4.com
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More - thehackernews.com
AI Security Report 2026 - research.checkpoint.com
New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email - thehackernews.com
Ghostcommit attack hides malicious AI instructions in images - malwarebytes.com
Turning the Tables on Email Scammers With 'ScamBuster' - darkreading.com
'Yellow Teams' Are Defining the Future of AI Security - darkreading.com
Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots - thehackernews.com
Fake crypto gift card sites are getting harder to spot - malwarebytes.com
Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules - securityweek.com

Cybersecurity Brief – 2026-07-13

Mon, 13 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

A data breach at Centers Laboratory has impacted 540,000 individuals. The WorldLeaks extortion group has claimed responsibility, stating they exfiltrated 720 GB of data from the healthcare testing and laboratory services provider ^[9].
Progress has instructed customers to manually shut down ShareFile Storage Zone Controller servers due to an ongoing investigation into a credible security threat ^[8].

Newly Discovered Vulnerabilities

Two maximum-severity zero-day vulnerabilities affecting the iCagenda and Balbooa Forms extensions for Joomla have been added to CISA’s Known Exploited Vulnerabilities catalogue, with reports indicating active exploitation ^[2].

Notable Threat Actor Activity

A misconfigured Python web server exposed details of three active Evilginx phishing campaigns targeting Microsoft 365 users ^[1].
The WorldLeaks group is responsible for the Centers Laboratory breach, claiming theft of significant volumes of sensitive data ^[9].

Trends, Tools, or Tactics of Interest

The RedHook Android malware has adopted a new technique by abusing Android’s Wireless Debugging (Wireless ADB) feature to gain shell-level access without requiring a computer connection ^[5].
Increased scanning activity targeting MCP servers and AI assistant credentials has been observed, indicating a trend towards automated reconnaissance for these assets ^[6]^[7].

Sources

Centers Laboratory Data Breach Affects 540,000 Individuals - securityweek.com
Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns - securityweek.com
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days - thehackernews.com
Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 - thehackernews.com
RedHook Android malware now uses Wireless ADB for shell access - bleepingcomputer.com
Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th) - isc.sans.edu
ISC Stormcast For Monday, July 13th, 2026 https://isc.sans.edu/podcastdetail/10004, (Mon, Jul 13th) - isc.sans.edu

Cybersecurity Brief – 2026-07-11

Sat, 11 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Progress Software has instructed ShareFile customers to immediately shut down Windows Storage Zone Controllers due to a “credible external security threat” targeting these servers. The company is actively responding to the incident and has communicated directly with affected customers ^[5]^[20].
Researchers uncovered that a cybercrime group left one of its servers exposed, revealing details about the WP-SHELLSTORM campaign, which has backdoored thousands of WordPress sites. The exposure included hacking tools, logs, and target lists ^[13].
The Dutch National Police reported strong indications that Dutch hackers were involved in the February breach at telecommunications provider Odido ^[19].
A data breach at AssuranceAmerica has affected 7 million individuals, as disclosed in a roundup of recent incidents ^[33].
The US Department of Homeland Security (DHS) database was reportedly hacked, according to recent reports ^[33].

Newly Discovered Vulnerabilities

Zimbra has issued an urgent advisory to patch a critical vulnerability in its Classic Web Client that could allow attackers to execute arbitrary code via crafted emails. The flaw is actively being addressed and users are urged to update ^[4]^[24].
Six new vulnerabilities have been identified in the U-Boot bootloader, used across a wide range of hardware, which could allow malicious images to crash devices or execute code at boot, enabling stealthy firmware attacks ^[7]^[17].
A critical authentication bypass vulnerability is being actively exploited in the official Docker image for the Gitea self-hosted Git service. Attackers can impersonate any user, including administrators ^[21].
A flaw in Alibaba’s XQUIC (XRING) QUIC and HTTP/3 library allows any remote client to crash the server with legal traffic. There is currently no patch available ^[11].
A newly disclosed flaw called “Ill Bloom” in certain cryptocurrency wallet software’s recovery phrase generation has been exploited to drain over $5 million from wallets ^[16].
Researchers have demonstrated that a laser attack can reset passwords on Tangem wallet cards by targeting the chip, and affected cards cannot be patched ^[8].
Three now-patched vulnerabilities in the OpenClaw AI assistant allowed for credential theft, privilege escalation, and remote code execution through a WhatsApp-to-host attack chain ^[9].
Security issues in Microsoft BitLocker security wrappers have exposed ATMs and organizations to potential compromise ^[28].
Two critical vulnerabilities in Google Chrome were patched in rapid succession, prompting users to update for protection ^[41].

Notable Threat Actor Activity

An initial access broker associated with the Payouts King ransomware group is using Microsoft Teams phishing to deploy a malicious Microsoft Edge browser extension, facilitating ransomware attacks ^[3].
Hackers are exploiting the Gitea Docker image authentication bypass vulnerability to gain admin access to self-hosted Git instances ^[21].
Attackers are targeting Microsoft 365 users with vishing campaigns, using fake Microsoft Entra passkey enrollment requests and voice-based social engineering to gain access. Okta has issued a warning regarding these tactics ^[15]^[36].
Unknown threat actors compromised Injective Labs’ GitHub repository for its SDK project, publishing malicious npm packages designed to steal cryptocurrency wallet keys and credentials ^[6].
A China-linked group known as Silver Fox has been attributed to the new MODBEACON remote access trojan, which uses gRPC streaming for encrypted command and control traffic ^[10].
Both China and India-linked hacking groups have been documented targeting the Balochistan Police force in Pakistan over the past two years ^[35].
Researchers demonstrated “HalluSquatting,” using adversarial AI hallucinations to deliver botnet malware via popular AI assistants ^[38].

Trends, Tools, or Tactics of Interest

Cyberattacks against healthcare service providers more than doubled in the first half of 2026, with attackers increasingly targeting service providers and other healthcare businesses beyond hospitals and clinics ^[27].
GigaWiper, a new remote access Trojan, combines standalone wiper, ransomware encryption, and multi-pass wiping commands for system-level sabotage ^[37]^[39].
AI agents are driving rapid growth in non-human identities within organizations, complicating identity management and access visibility ^[23].
Researchers identified that many free Android VPN apps leak traffic, transmit unencrypted data, and engage in tracking, undermining user privacy and security expectations ^[14].
Comment stuffing in HTML phishing attachments is being used as a mechanism to evade AI-based detection systems ^[32].
AI coding tools are prompting debate over whether their security risks outweigh productivity gains, with concerns about scanning, remediation, and false positives ^[30].

Regulatory or Policy Developments Affecting the Security Industry

Multiple countries are increasing social media restrictions, particularly age-based account controls, though compliance by major platforms is reportedly lacking ^[29].
Adobe has increased its patch release cadence in response to growing security concerns ^[33].
The NSA has reinstated its Tailored Access Operations (TAO) unit, signaling renewed emphasis on offensive cyber capabilities ^[33].

Legal and Law Enforcement Actions

A member of the Ryuk ransomware group has pleaded guilty in the US and faces up to 15 years in prison for attacks on US companies ^[18].
A former ransomware negotiator for DigitalMint was sentenced to 70 months in prison for assisting the BlackCat (ALPHV) ransomware group ^[25]^[34].
A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving a prison sentence for money laundering ^[22].
Canadian authorities have disrupted ransomware operations, as noted in a recent incident roundup ^[33].

Sources

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat - thehackernews.com
Progress urges ShareFile admins to shut down servers over “credible” threat - bleepingcomputer.com
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites - thehackernews.com
Police suspects Dutch hackers were involved in Odido breach - bleepingcomputer.com
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops - securityweek.com
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions - thehackernews.com
Zimbra urges customers to patch critical web client XSS flaw - bleepingcomputer.com
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot - thehackernews.com
New U-Boot flaws could enable stealthy firmware attacks - bleepingcomputer.com
Hackers exploit critical auth bypass in Gitea Docker image - bleepingcomputer.com
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers - thehackernews.com
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets - thehackernews.com
Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched - thehackernews.com
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws - thehackernews.com
Fresh ATM Crypto Software Bugs: Jackpot or Bust? - darkreading.com
Two Chrome updates in two days fix critical vulnerabilities - malwarebytes.com
Threat Actor Uses Phishing to Breach Orgs for Ransomware Gangs - blog.knowbe4.com
Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access - thehackernews.com
Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers - securityweek.com
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages - thehackernews.com
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic - thehackernews.com
China, India-Linked Hackers Both Targeted Same Pakistani Police Force - securityweek.com
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
Cybercriminals Flock to Healthcare Businesses as Attacks Surge - darkreading.com
GigaWiper Combines Multiple Malware for System-Level Sabotage - securityweek.com
This new Windows malware can take over your PC and wipe it clean - malwarebytes.com
The Replicant in Your Directory: AI Agents and the Identity Security Gap - bleepingcomputer.com
Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking - thehackernews.com
"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th) - isc.sans.edu
AI Coding: Do Security Risks Outweigh Productivity Gains? - darkreading.com
More Countries Jump on the Social Media 'Ban Wagon' - darkreading.com
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison - bleepingcomputer.com
Former ransomware negotiator gets 4 years for BlackCat attacks - bleepingcomputer.com
Third US Security Expert Sentenced to Prison for Helping Ransomware Gang - securityweek.com
Money launderer accused of stealing seized crypto while in prison - bleepingcomputer.com

Cybersecurity Brief – 2026-07-02

Thu, 02 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic has notified customers of a data breach resulting from unauthorized access to personal data, attributed to the ShinyHunters threat actor group ^[19].
Kubota North America Corporation disclosed that hackers had access to parts of its network systems for over a month earlier this year ^[21].
The US Department of Homeland Security confirmed a breach of the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government agencies ^[23].
Over 900 Oracle E-Business Suite instances have been found exposed online and are subject to ongoing attacks exploiting a critical security flaw ^[27].

Newly Discovered Vulnerabilities

Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws rated CVSS 10.0 that could lead to arbitrary code execution ^[13]^[37].
Citrix issued patches for NetScaler appliances, addressing six vulnerabilities including a new HTTP/2 Bomb attack and a high-severity CitrixBleed-style information disclosure bug ^[38].
Apple released security updates for iOS, macOS, and Safari, addressing dozens of vulnerabilities affecting WebKit, the kernel, WebRTC, and other components ^[40].
Google released a Chrome update fixing 382 security bugs, with 15 rated as critical ^[46].
Argo CD has an unpatched vulnerability in its repo-server component that allows unauthenticated attackers to execute code if they can access the component ^[8].
Microsoft SharePoint Server vulnerability CVE-2026-45659 has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation ^[7].
Progress Kemp LoadMaster is affected by a critical pre-authentication remote code execution flaw that is currently seeing active exploitation attempts ^[15].

Notable Threat Actor Activity

Kaspersky researchers identified a large-scale campaign using compromised ScreenConnect software, distributed via SEO-poisoned sites, to deliver AsyncRAT malware ^[1]^[10].
The FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware groups, indicating that stolen Fortinet credentials are intended to facilitate future network intrusions and ransomware attacks ^[20].
A 19-year-old suspected member of the Scattered Spider hacking group has been extradited from Finland to the US to face hacking and fraud charges ^[9].
The Ousaban banking trojan is targeting users in Spain and Portugal with phishing PDF lures to infect Windows systems ^[12].
A new campaign is delivering the PureLogs information stealer through a multi-stage malware chain leveraging Blogger pages and social engineering ^[11].
Multiple weaponized proof-of-concept (PoC) exploits on GitHub are distributing the ChocoPoC remote access trojan, targeting vulnerability researchers ^[6]^[22].

Trends, Tools, or Tactics of Interest

Attackers are using fingerprinting via user-agent data to adapt phishing payloads to the victim’s device and operating system, increasing compromise rates ^[30].
ClickFix, a social engineering technique, is reported as a dominant method for malware delivery ^[31].
AI-generated browser ransomware has been observed abusing the Chromium API across Windows, Linux, macOS, and Android, combining novel attack paths with real browser capabilities ^[16]^[43].
A fake Perplexity Chrome extension, “Search for perplexity ai,” was found to be spying on user searches and requires manual removal ^[44].
Large language models (LLMs) are being exploited for “phantom squatting,” where hallucinated domains for legitimate brands are registered by attackers for supply chain attacks ^[32].
Two vulnerabilities in the AI code editor Cursor could allow prompt injection to escape the sandbox and execute arbitrary commands on a developer’s machine ^[14].
Phishing attacks have exposed employee data at 86 percent of Fortune 100 companies in the past year, with technology, airline, and automotive sectors most affected ^[4].
Hackers conducted over 81 million password-spraying login attempts against Microsoft 365 accounts in a two-week period ^[25].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced it is accelerating its post-quantum cryptography roadmap, targeting a transition by 2029 due to advances in quantum computing ^[18].
The US Federal Trade Commission fined Amazon $2.25 million for withholding transaction records from identity theft victims, impacting fraud investigations ^[29].
Microsoft introduced new Teams admin policies requiring organizer approval for external AI bots in meetings, enhancing control over automated participants ^[36].

Sources

Medtronic notifies customers impacted by ShinyHunters data breach - bleepingcomputer.com
Kubota says hackers had month-long access to network systems - bleepingcomputer.com
DHS confirms hackers breached HSIN info-sharing platform - bleepingcomputer.com
Over 900 Oracle E-Business instances exposed to ongoing attacks - bleepingcomputer.com
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic - thehackernews.com
Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities - securityweek.com
Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack - securityweek.com
Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari - securityweek.com
Chrome needs another whopper update to fix 382 security bugs - malwarebytes.com
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters - thehackernews.com
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation - thehackernews.com
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts - thehackernews.com
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign - securelist.com
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT - thehackernews.com
FortiBleed credential-theft campaign linked to Lynx ransomware - bleepingcomputer.com
19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - thehackernews.com
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - thehackernews.com
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer - thehackernews.com
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - thehackernews.com
New ChocoPoC malware targets researchers via trojanized PoC exploits - bleepingcomputer.com
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS - darkreading.com
And the Winner in Dominant Malware Delivery? ClickFix - darkreading.com
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android - thehackernews.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - research.checkpoint.com
Fake Perplexity Chrome extension spies on your searches - malwarebytes.com
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat - darkreading.com
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands - thehackernews.com
Phishing Exposes Employee Data at 86% of Fortune 100 Companies - blog.knowbe4.com
Hackers target Microsoft 365 accounts with 81 million login attempts - bleepingcomputer.com
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - thehackernews.com
Amazon fined $2.25M for withholding evidence from fraud victims - bleepingcomputer.com
Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - securityweek.com

Cybersecurity Brief – 2026-05-05

Tue, 05 May 2026 00:00:00 +0000

Major Incidents or Breaches

Trellix disclosed a data breach following unauthorised access to a portion of its source code repository. The investigation found no impact on source code release or distribution processes.
DigiCert revoked certificates after hackers exploited a customer chat channel to deliver malware, infect an analyst’s system, and access the internal support portal.
Over 40,000 servers have been compromised in ongoing exploitation of a critical cPanel vulnerability (CVE-2026-41940), with attacks targeting government, military, managed service providers (MSPs), and hosting providers in Southeast Asia.
Medtronic, a global medical device manufacturer, disclosed a security incident, as referenced in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-22679) in Weaver (Fanwei) E-cology office automation software has been under active exploitation since March 2026.
Progress Software patched two security flaws in MOVEit Automation, including a critical authentication bypass vulnerability. Customers have been urged to apply updates immediately.
The “Copy Fail” Linux vulnerability is now being actively exploited in the wild. CISA has added it to its Known Exploited Vulnerabilities (KEV) list, and Microsoft has observed limited exploitation linked to proof-of-concept testing.

Notable Threat Actor Activity

The China-based group Silver Fox has been linked to a campaign targeting organisations in India and Russia using tax-themed phishing emails to deliver the new ABCDoor malware, as well as ValleyRAT and Sainbox malware.
A previously unknown threat actor has been exploiting the cPanel authentication-bypass vulnerability to target government, military, MSP, and hosting provider networks, with evidence of zero-day activity prior to public disclosure.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing Amazon Simple Email Service (SES) and Google AppSheet to send phishing emails that bypass standard security filters, making detection more challenging.
Multiple large-scale phishing campaigns are leveraging legitimate remote monitoring and management (RMM) tools such as SimpleHelp and ScreenConnect to establish persistent remote access, impacting over 80 organisations since April 2025.
Microsoft detailed a phishing campaign targeting 35,000 users across 26 countries using code of conduct-themed lures and legitimate email services for credential theft.
A malicious version of the PyTorch Lightning package was published on PyPI, delivering a credential-stealing payload targeting browsers, environment files, and cloud services.
Deepfake-driven fraud has resulted in $2.19 billion in global losses, with the majority attributed to investment scams.
Fraudsters are exploiting legitimate business processes at credit unions using structured loan fraud and stolen identities, rather than direct hacking.
The 2026 World Cup is being leveraged in a multi-faceted scam economy involving fake visas, fraudulent tokens, and other schemes.
AI-assisted attacks are on the rise, with increased use of artificial intelligence to enhance phishing and other malicious activities.
Thousands of Facebook accounts have been compromised through phishing emails sent via Google services, evading standard email security controls.

Regulatory or Policy Developments Affecting the Security Industry

CISA added the “Copy Fail” Linux vulnerability to its Known Exploited Vulnerabilities (KEV) list, mandating federal agencies to mitigate the issue.
OpenAI introduced Advanced Account Security for ChatGPT accounts, including stronger login methods, improved account recovery, and training data exclusion.
Cisco announced the acquisition of Astrix Security to strengthen its capabilities around non-human identity risks, particularly for AI and machine access.

Cybersecurity Brief – 2026-04-22

Wed, 22 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.
Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.
Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.
Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Cybersecurity Brief – 2026-04-03

Fri, 03 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

European Commission Cloud Hack: CERT-EU confirmed a breach attributed to the TeamPCP threat group, exposing data from at least 30 EU entities.
Drift Protocol Exploit: North Korean threat actors seized Security Council administrative powers in the Drift Protocol, resulting in a loss of at least $280 million in a coordinated attack.
Stryker Cyberattack: Stryker Corporation experienced a data-wiping attack, claimed by an Iranian-linked group. The company reports full operational recovery after three weeks.
Hasbro Breach: Hasbro disclosed “unauthorized access” to its systems, leading to business continuity activation and some systems being taken offline.
Nacogdoches Memorial Hospital Data Breach: A breach affecting 250,000 individuals occurred in January 2026, involving theft of personal and health information.
WhatsApp Spyware Incident: WhatsApp alerted approximately 200 users after a fake iOS app infected devices with spyware, with an Italian firm reportedly facing action.
Mercor Supply Chain Attack: AI recruiting firm Mercor is investigating a supply chain attack via LiteLLM, with Lapsus$ claiming theft of 4TB of data.
Claude Code Leak Abuse: Following the Claude Code source code leak, threat actors used fake GitHub repositories to distribute Vidar infostealer malware.
Adversaries Exploiting Vacant Homes: Threat actors are using vacant homes as mail drop addresses to intercept mail and facilitate fraud.

Newly Discovered Vulnerabilities

Cisco IMC and SSM Flaws: Cisco patched critical vulnerabilities in the Integrated Management Controller (IMC) and SSM, including an authentication bypass (CVSS 9.8) that allowed unauthenticated remote admin access.
Progress ShareFile Pre-Auth RCE Chain: Two vulnerabilities in Progress ShareFile can be chained for unauthenticated file exfiltration and remote code execution.
F5 BIG-IP APM RCE Exposure: Over 14,000 F5 BIG-IP APM instances remain exposed to a critical RCE vulnerability, with active exploitation ongoing.
Claude Code Critical Vulnerability: A critical vulnerability was identified in Claude Code days after its source code leak.
Apple DarkSword Exploit Kit: Apple expanded patches for vulnerabilities exploited by the DarkSword kit to iOS and iPadOS 18.7.7.
Vite (CVE-2025-30208) Exploitation: Active attempts to exploit the Vite frontend tooling vulnerability have been observed.
Next.js (CVE-2025-55182) Exploitation: Threat actors exploited the React2Shell vulnerability to breach 766 Next.js hosts, stealing credentials, SSH keys, and AWS secrets.

Notable Threat Actor Activity

TeamPCP: Attributed to the European Commission cloud breach affecting multiple EU entities.
North Korean Actors: Responsible for the $280 million theft from Drift Protocol via Security Council power compromise.
Lapsus$: Claimed responsibility for the Mercor LiteLLM supply chain attack.
Iranian-linked Group: Claimed the data-wiping attack on Stryker Corporation.
REF1695: Financially motivated group leveraging fake installers to distribute RATs and crypto miners since November 2023.
Vidar Infostealer Campaign: Threat actors are leveraging the Claude Code leak to distribute infostealer malware via GitHub.
Casbaneiro Banking Trojan: Ongoing campaigns targeting Latin American financial institutions, using advanced evasion and replication techniques.

Trends, Tools, or Tactics of Interest

Residential Proxy Evasion: 78% of 4 billion sessions using residential proxies successfully evaded IP reputation checks, complicating detection of malicious traffic.
Hybrid Cybercrime via Postal Fraud: Use of vacant homes as drop addresses is enabling hybrid cybercrime through mail interception.
CloudTrail Evasion Techniques: Noted as an emerging tactic for threat actors to avoid detection in cloud environments.
Mining Operations Using ISO Lures: Ongoing campaigns use ISO file lures to deliver RATs and cryptocurrency miners.
CrystalX RAT: Newly observed sophisticated RAT capable of spying, stealing data, and altering device configurations.
AI in Security Operations: CISOs and industry leaders at RSAC 2026 and in interviews report increased adoption and planned expansion of AI-driven security tools, with debates over automation versus human oversight.
Pre-Auth Exploitation Chains: Multiple vulnerabilities are being chained pre-authentication for remote code execution and data exfiltration.
Supply Chain Attacks via Open Source: The State of Trusted Open Source report and recent incidents highlight risks in open source software supply chains.

Regulatory or Policy Developments

WhatsApp/Italian Regulatory Action: Italian authorities are reportedly taking action following the spyware incident involving a fake WhatsApp iOS app.
Cybersecurity M&A Activity: 38 significant cybersecurity mergers and acquisitions were announced in March 2026, involving major firms such as Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI.
Malwarebytes VPN Audit: Malwarebytes completed a third-party audit of its VPN infrastructure, with results published for transparency.

Cybersecurity Brief – 2025-06-28

Sat, 28 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Ahold Delhaize, a global food retail chain, disclosed that a ransomware attack in November resulted in a data breach affecting 2.2 million individuals, compromising personal, financial, and health information.
Cloudflare successfully mitigated the largest recorded DDoS attack to date.
Russian ISPs began throttling access to websites and services protected by Cloudflare as of 9 June 2025, causing widespread inaccessibility.

Newly Discovered Vulnerabilities

A critical vulnerability in NetScaler ADC and Gateway, dubbed “Citrix Bleed 2” (CVE-2025-5777), is now believed to be actively exploited. This flaw allows attackers to maintain undetected access for extended periods.
Researchers identified security weaknesses in aftermarket smart tractor steering systems, allowing potential full takeover and surveillance of connected tractors.

Notable Threat Actor Activity

Over 1,000 SOHO devices have been compromised in China-linked “LapDogs” cyber espionage operations.
Mustang Panda, a China-based threat actor, conducted a targeted cyber espionage campaign against the Tibetan community using spear-phishing and custom malware (PUBLOAD and Pubshell).
The Chinese group “Silver Fox” has been observed using fake websites mimicking popular software to distribute Sainbox RAT and the Hidden rootkit, targeting users in China and Japan.
Scattered Spider hackers have shifted their targeting to aviation and transportation sectors after previously attacking insurance and retail. In a recent incident, they accessed CyberArk vaults, extracted over 1,400 secrets, and compromised Azure, VMware, and Snowflake environments.
Increased scanning activity targeting Progress MOVEit Transfer systems has been detected since 27 May 2025, indicating preparation for further exploitation of known CVEs.

Trends, Tools, or Tactics of Interest

64% of US C-suite executives in cybersecurity or data center roles cite data breaches and ransomware as the top threats for the next decade.
Threat actors are increasingly leveraging fake websites and spear-phishing with regionally relevant topics to deliver custom malware in espionage campaigns.
Security operations centers are under pressure due to increasingly complex threats and stagnant budgets, prompting interest in agentic AI SOC analysts.
There is a noted increase in the scale and sophistication of DDoS attacks.
The US is reported to be lagging behind China in exploit production capabilities.
Researchers allege that VPN apps from Apple and Google app stores may be enabling surveillance by Chinese authorities.

Regulatory or Policy Developments Affecting the Security Industry

The US Supreme Court upheld the constitutionality of Texas’ age verification law for explicit websites, setting a precedent for similar regulatory measures.