Cybersecurity Brief – 2026-03-25

Wed, 25 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

HackerOne disclosed a data breach impacting hundreds of employees, following a compromise of its US benefits administrator, Navia.
Infinite Campus, a widely used K-12 student information system, warned of a data breach and extortion attempt, attributed to the ShinyHunters threat actor.
The Dutch Ministry of Finance confirmed a breach affecting internal systems, detected in the previous week.
QualDerm, a healthcare provider, suffered a breach impacting 3.1 million individuals, with personal, medical, and insurance data stolen.
Extortion group Lapsus$ claimed to have compromised AstraZeneca, including internal code repositories, credentials, and employee data.

PTC Inc. warned of a critical remote code execution vulnerability affecting its Windchill and FlexPLM product lifecycle management solutions.
A critical Citrix NetScaler vulnerability was disclosed, allowing unauthenticated remote attackers to read sensitive information from memory.
Chrome 146 was released, addressing eight high-severity memory safety vulnerabilities across seven components.
Firefox 149 introduced a built-in VPN with a 50GB monthly data limit, enhancing privacy protections.
Researchers highlighted ongoing risks and vulnerabilities in IP KVM devices, following recent reports from Eclypsium.

TeamPCP continued its supply chain attacks, compromising the popular LiteLLM Python package on PyPI (versions 1.82.7–1.82.8) via a Trivy CI/CD compromise, embedding credential harvesters and affecting hundreds of thousands of developers. TeamPCP was also linked to attacks on Trivy, Checkmarx KICS, and VS Code plug-ins, as well as recent compromises of GitHub Actions workflows through stolen CI credentials.
A large-scale malvertising campaign has been leveraging tax-related search ads since January 2026, distributing rogue installers for ConnectWise ScreenConnect. The campaign uses a Huawei driver to disable endpoint detection and response (EDR) solutions.
The Ghost campaign was identified as distributing seven malicious npm packages aimed at stealing cryptocurrency wallets and credentials.
Ongoing phishing campaigns are targeting French-speaking enterprises with fake resumes, leading to the deployment of information stealers and cryptocurrency miners.
FBI and CISA, along with European agencies, warned of Russian threat actors hijacking Signal and WhatsApp accounts via scalable social engineering campaigns.
Scam compounds are hiring individuals to appear as “AI models” in deepfake video calls to facilitate fraud.

The number of newly reported vulnerabilities is expected to exceed 100,000 this year, with a noted trend toward faster exploitation of zero-days.
Security researchers observed a rise in supply chain attacks targeting open-source software and developer tools, with AI-assisted campaigns distributing trojanized packages (e.g., OpenClaw Deployer on GitHub).
Increased use of credential-stealing malware targeting CI/CD pipelines and package repositories.
Attackers are using legitimate drivers (e.g., Huawei) to disable EDR in malware campaigns.
There is a continued increase in phishing campaigns leveraging social engineering and fake documentation (e.g., resumes) to gain initial access.
AI and agentic AI systems are being increasingly targeted, as evidenced by the McKinsey Lilli platform hack and discussions on the need for better governance and identity controls.
JPMorgan Chase reported the use of AI digital twins and digital fingerprints for advanced threat hunting and reducing false positives.
Endpoint security is being challenged by AI coding tools, which facilitate bypassing traditional defenses.
Surveillance systems are being targeted in geopolitical conflicts, as demonstrated by Israel’s exploitation of Iran’s camera network.

The US Federal Communications Commission (FCC) updated its Covered List to ban the sale of all new consumer routers manufactured outside the USA, citing security risks.
The US Department of Energy (DoE) published a five-year energy security plan (Project Armor) to harden critical energy infrastructure.
Microsoft proposed new identity and governance guardrails for agentic AI systems to address emerging threats from autonomous AI agents.
Gartner released its first Market Guide for Guardian Agents, highlighting the emergence of this security technology category.
A Russian national received an 81-month prison sentence for acting as an initial access broker for Yanluowang ransomware attacks.