Roblox on DanSec Daily

Cybersecurity Brief – 2026-08-04

Tue, 04 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

The Police National Legal Database (PNLD) in the UK suffered a cyberattack resulting in the exposure and dark web publication of contact information for over 100,000 police officers, government employees, and criminal justice professionals ^[10]^[16].
A cyberattack targeted Liechtenstein’s Register of People Behind Companies and Foundations, impacting a registry used for anti-money laundering and counter-terrorism efforts ^[31].
Brinks Home disclosed a data breach with hackers leaking files, though alarm monitoring and system functionality were reportedly unaffected ^[35].
River Bank confirmed that data stolen in a June ransomware attack was subsequently deleted by the attackers, with investigations ongoing ^[32].
Brazilian educational institutions have experienced multiple security incidents, as detailed in a new analysis of response cases ^[1].

Newly Discovered Vulnerabilities

An authentication bypass vulnerability (CVE-2026-18577) in N-able N-central remote monitoring and management servers has been exploited in the wild, allowing attackers to gain administrator access. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, and N-able has released patches following reports of active exploitation and patch bypasses ^[3]^[15]^[19]^[34].
Recent vulnerabilities in SonicWall SMA 1000 VPN appliances have been exploited by ransomware actors for root access and lateral movement within victim networks ^[6]^[36].

Notable Threat Actor Activity

The INC Ransomware operation has emerged as the leading group exploiting SonicWall SMA 1000 vulnerabilities, using these flaws for initial access and subsequent ransomware deployment ^[6]^[36].
Russian threat actor Midnight Blizzard (APT29) has been linked to a global campaign targeting hospitality Wi-Fi networks, using custom malware to breach Microsoft 365 accounts ^[11].
A Chinese-speaking threat actor is using a leaked version of the DarkSword exploit kit to deploy GHOSTBLADE malware targeting Apple iOS devices ^[9].
Another Chinese threat actor weaponized the Deepseek AI agent to attack a security firm, attempting proxyjacking across over 1,200 hosts ^[22].
Eighteen malicious npm packages have been discovered delivering a cross-platform remote access trojan (RAT) to users of Alibaba developer tools ^[4].
The ExfilSquad hacking group leaked information for over 100,000 UK police officers and staff following the PNLD breach ^[16].
Fake Roblox Xeno Executor installers are being used to distribute infostealer and RAT malware to Roblox players ^[14].

Trends, Tools, or Tactics of Interest

Device code phishing attacks have increased by 1,500 percent in 2026, with vishing incidents doubling, reflecting the rise of social engineering techniques that bypass traditional security controls ^[18].
A new Russian loader-as-a-service, DOUBLECUP, uses ClickFix techniques to hide malware in browser cache images, delivering payloads to both Windows and macOS devices ^[13].
Threat actors are increasingly abusing trusted platforms and supply chains, including npm packages and Google Password Manager’s passkey sync, to compromise user accounts and systems ^[4]^[5]^[12]^[26].
Researchers have identified three new “Pass-ta-key” attacks that allow malware on compromised Windows devices to hijack Google-synced passkeys, bypassing user verification ^[5]^[12].
The BTMOB Android RAT ecosystem has grown into a fragmented underground business with resellers, source-code vendors, and custom versions ^[17].
AI platforms such as Claude, Codex, and Cursor are being integrated into security operations for detection writing, investigation, and response ^[8]^[21]^[26].
New tools for tracing the origins of AI-generated videos have been developed, aiming to improve detection and attribution of deepfakes ^[20].
WhatsApp and TikTok-related scams continue, with social engineering targeting account takeover and delivering unwanted applications or fraudulent charges ^[38]^[39].

Regulatory or Policy Developments Affecting the Security Industry

The European Union has begun enforcement of key provisions of the AI Act, requiring increased transparency for chatbots, deepfakes, and other consumer-facing AI systems ^[40].
California launched the Delete Request and Opt-out Platform (DROP), enabling residents to send mass deletion and opt-out requests to registered data brokers ^[41].
New York awarded $9 million in grants to enhance cybersecurity at 153 water systems in response to ongoing threats to water and wastewater infrastructure ^[28].
Visa announced the acquisition of fraud intelligence firm BioCatch for $2.4 billion to strengthen account takeover and fraud prevention capabilities for financial institutions ^[30].

Sources

PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web - thehackernews.com
ExfilSquad hackers leak info of over 100,000 UK police officers, staff - bleepingcomputer.com
Cyberattack Hits Liechtenstein’s Register of People Behind Companies and Foundations - securityweek.com
Brinks Home Discloses Data Breach as Hackers Leak Files - securityweek.com
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack - securityweek.com
An analysis of incidents at Brazilian educational institutions - securelist.com
CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises - thehackernews.com
N-able warns of N-central auth bypass flaw exploited in attacks - bleepingcomputer.com
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers - darkreading.com
N‑able Patches Vulnerability Exploited to Hack N-central Servers - securityweek.com
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws - thehackernews.com
Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks - securityweek.com
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts - bleepingcomputer.com
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS - thehackernews.com
Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm - darkreading.com
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users - thehackernews.com
Fake Roblox Xeno script launcher pushes infostealer, RAT malware - bleepingcomputer.com
Device Code Phishing Up 1,500% in 2026; Vishing Doubles - darkreading.com
New DOUBLECUP ClickFix service hides malware in browser cache images - bleepingcomputer.com
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts - thehackernews.com
New Pass-ta-key attacks let malware hijack Google-synced passkeys - bleepingcomputer.com
What cybersecurity experts are talking about in 2026 - virusbulletin.com
Inside the Underground Business of the Android BTMOB RAT malware - bleepingcomputer.com
FOMO in the SOC: Where AI Platforms like Claude Actually Fit - thehackernews.com
Anthropic: Claude Attacks Result of Security Gaps, Not Model Issues - darkreading.com
New Tool Traces AI Videos Back to Their Source - darkreading.com
WhatsApp account takeover scam asks you to “vote for my friend” - malwarebytes.com
“Adult TikTok” searches lead to scams - malwarebytes.com
The AI Act kicks into action, forces companies to be clear about AI chatbots - malwarebytes.com
Californians can tell data brokers to DROP their information - malwarebytes.com
New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems - securityweek.com
Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion - securityweek.com

Cybersecurity Brief – 2026-06-18

Thu, 18 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

A data leak dubbed “FortiBleed” has exposed VPN credentials for 73,932 Fortinet and FortiGate firewall URLs at organizations worldwide. Attackers have compiled working credentials for tens of thousands of compromised devices across nearly 200 countries, actively targeting various sectors ^[11]^[18].
Kodak has confirmed a data breach following claims by the ShinyHunters hacking group. The company states there is no threat to its systems or operations as a result of the incident ^[24].
Researchers discovered an exposed collection of 24 billion stolen records online, including usernames, passwords, and other sensitive account data ^[34].
Roblox developers have been targeted by attackers using fake job offers and malware to steal accounts, Robux, and entire Roblox games ^[32].

Newly Discovered Vulnerabilities

Microsoft has confirmed a zero-day vulnerability in Defender, codenamed RoguePlanet, which allows privilege escalation via a race condition. A patch is in development and public proof-of-concept code is available. The vulnerability is tracked as CVE-2026-50656 ^[4]^[30].
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited ^[15].
Rockwell Automation has released patches for vulnerabilities affecting Logix, CompactLogix, Flex, RSLinx, and FactoryTalk industrial control system products ^[28].
Oracle has issued its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple products, including Communications, EBS, and Enterprise Manager ^[31].

Notable Threat Actor Activity

A coordinated malware campaign has published at least 15 malicious plugins on the JetBrains Marketplace, exfiltrating AI API keys and other sensitive data. Additionally, malicious Chrome extensions are capturing chatbot conversations ^[7].
An unknown threat actor is leveraging paid or promoted posts on legitimate news websites, fake reviews, AI narrators, and comments on VirusTotal to promote a crypto clipper malware campaign ^[3].
A French-speaking attacker compromised a small French automotive business, planted a keylogger, and maintained persistence using Tailscale and OpenSSH after their command-and-control infrastructure went offline ^[5].
The DragonForce ransomware group deployed a Go-based backdoor that uses Microsoft Teams relay servers for command-and-control in a recent attack ^[29].
The INC ransomware group continues to target sectors where operational disruption puts immediate pressure on victims to pay, such as healthcare ^[17].

Trends, Tools, or Tactics of Interest

85.8 percent of phishing attacks in the past 12 months were AI-driven, with threat actors increasingly using AI agents to automate social engineering ^[1].
Enterprise adoption of AI agents is creating security blind spots, with 83 percent of organizations lacking visibility into their AI agents’ activities and 86 percent lacking visibility into AI data flows ^[2].
There is a rise in account takeovers as attackers bypass traditional defenses using phishing, session hijacking, and MFA fatigue attacks ^[12].
Attackers are increasingly exploiting exposed admin panels, credential reuse, and non-zero-day vulnerabilities to gain initial access, as seen in recent attack surface exposure reports ^[8].
Coordinated SSH brute-force attacks remain prevalent, with attackers adapting their tactics over recent months ^[21].
Security researchers highlight that browser-based attacks may evade detection by traditional security tools, creating a “browser blind spot” ^[22].
Adversarial exposure validation is emerging as a method to help security teams prioritize which vulnerabilities to address, moving beyond simple visibility to actual validation of risk ^[6].
New Android malware, Rokarolla, can take full control of infected devices and targets over 200 banking and cryptocurrency apps to steal credentials ^[33].
Attackers are using fake job offers as a vector to deliver malware and compromise developer accounts in gaming platforms ^[32].

Regulatory or Policy Developments Affecting the Security Industry

From August 3, 2026, Google will use IP addresses from UK, EEA, and Switzerland users for ad measurement and personalization, as the UK Information Commissioner’s Office (ICO) considers new consent rules ^[10].
The EU has initiated the “Shield-6G” project to develop security measures for 6G networks, incorporating AI threat detection, digital twins, and honeypots ^[16].
The UK Home Office will implement facial age estimation technology for asylum-seeker age checks despite internal tests showing high risks of errors ^[19].

Sources

FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices - darkreading.com
Kodak Admits Data Breach After ShinyHunters Hack Claims - securityweek.com
24 billion stolen records exposed online. Here’s what to do - malwarebytes.com
Roblox developers are losing entire games to malware attacks - malwarebytes.com
Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development - thehackernews.com
Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day - securityweek.com
CISA orders feds to patch max severity Joomla plugin flaw by Friday - bleepingcomputer.com
Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats - thehackernews.com
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments - thehackernews.com
Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - thehackernews.com
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack - securityweek.com
INC Ransomware Thrives by Mastering the Basics - darkreading.com
From 1% to 26%: How AIDA Orchestration Fixes the Remedial Training Gap - blog.knowbe4.com
Best AI Agent Security Tools for SMB and Enterprise in 2026 - blog.knowbe4.com
Why Account Takeovers Are Rising and How to Stop Them - bleepingcomputer.com
The Top 10 Attack Surface Exposures in 2026 - thehackernews.com
The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization - thehackernews.com
Rokarolla Android malware can take over your phone and steal banking logins - malwarebytes.com
Google to use UK and EU user IP addresses for ad personalization - bleepingcomputer.com
EU Gets a Head Start in Developing 6G Network Security - darkreading.com
The UK Will Scan Asylum-Seekers’ Faces for Age Checks—Despite Knowing the Tech Is Flawed - wired.com

Cybersecurity Brief – 2026-05-01

Fri, 01 May 2026 00:00:00 +0000

Major Incidents or Breaches

Hundreds of thousands of Roblox accounts were compromised through fake “game enhancements” that harvested login credentials, with stolen accounts subsequently sold for profit.
90,000 screenshots, including private messages and photos, from a European celebrity’s smartphone were publicly exposed due to spyware, before being reported and taken down.
A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, WHM, and WP Squared has been actively exploited as a zero-day since late February, granting attackers administrative access to servers. Proof-of-concept code is publicly available.
Several npm packages for SAP’s cloud application ecosystem were compromised in a supply chain attack (“Mini Shai-Hulud”), impacting at least 1,800 downstream projects.
The Lightning Python package and Intercom-client were compromised on PyPI, with malicious versions published to steal credentials. Combined, these packages have nearly 10 million monthly downloads.
A Brazilian anti-DDoS firm was found to be enabling a botnet that conducted large-scale DDoS attacks against Brazilian ISPs.
The FBI reported a sharp surge in cyber-enabled cargo theft attacks targeting transportation and logistics in the US and Canada, with losses exceeding $30 million in 2023.
Law enforcement dismantled nine cryptocurrency investment scam centers, arresting 276 suspects in a joint operation involving US and Chinese authorities.
PayPal email systems are being abused to distribute tech support scams by hijacking legitimate emails.
Two former US ransomware negotiators were sentenced to four years in prison each for their role in facilitating BlackCat (ALPHV) ransomware attacks against US companies.
The leader of an online swatting ring, responsible for targeting over 75 officials and institutions, was sentenced to four years in US federal prison.

Newly Discovered Vulnerabilities

A high-severity local privilege escalation vulnerability (“Copy Fail”) in the Linux kernel, introduced in 2017, allows unprivileged local attackers to gain root access on major distributions. Exploit code is public and patches are available.
Critical vulnerabilities in SonicWall firewalls could allow attackers to bypass security controls, access restricted services, or crash the devices. SonicWall has urged immediate patching.
Two vulnerabilities in EnOcean SmartServer could allow security bypass and remote code execution on building management systems.
A critical flaw in the Gemini CLI allowed attackers to execute arbitrary commands on the host via malicious configuration files, enabling supply chain attacks. The issue has been patched.
The April 2026 KB5083769 Windows 11 update causes failures in third-party backup applications for versions 24H2 and 25H2.
OpenEMR, a widely used open-source medical records system, was reported to have newly discovered vulnerabilities, though details remain limited.

Notable Threat Actor Activity

Iran-linked hackers are targeting critical infrastructure sectors in the US.
The TeamPCP threat group broadened its supply chain attacks, targeting npm packages used in SAP’s cloud development ecosystem.
A sophisticated campaign distributing EtherRAT malware is spoofing administrative tools on GitHub to target high-privilege professional accounts.
Threat actors compromised Lightning and Intercom-client Python packages to steal credentials in a coordinated supply chain attack.
A new Python-based backdoor framework, DEEP#DOOR, was discovered. It leverages tunneling services for persistence and credential theft from browsers and cloud services.
Criminals are using fake cell towers to send scam SMS messages at scale.
A new phishing kit, Bluekit, offers more than 40 templates targeting popular services and integrates basic AI features to assist in campaign creation.

Trends, Tools, or Tactics of Interest

AI is accelerating the speed and scale of cybercrime, with time-to-exploit for new vulnerabilities shrinking to hours. Attackers are increasingly automating scanning and exploitation of newly exposed assets.
AI-assisted software scanning continues to identify longstanding vulnerabilities, with a recent scan uncovering a nine-year-old Linux bug.
There is a growing use of AI in phishing operations, as demonstrated by the Bluekit phishing service.
Attackers begin scanning and targeting new internet-facing assets within minutes of deployment, with compromise attempts occurring within the first 24 hours.
Helpdesk impersonation scams are increasing, exploiting human factors in security.
Abuse of legitimate communications platforms (such as PayPal emails) to deliver scams is ongoing.
DDoS-for-hire services and botnet-enabled attacks remain prevalent, with some security firms implicated in facilitating these attacks.

Regulatory or Policy Developments Affecting the Security Industry

OpenAI has introduced an “Advanced Account Security” mode for at-risk ChatGPT and Codex accounts, aimed at mitigating phishing and account takeover risks.
Anthropic launched “Claude Security” to help defenders respond to the increased risk of AI-powered exploits, particularly as its new AI model, Mythos, is expected to impact cybersecurity operations.

Cybersecurity Brief – 2026-04-30

Thu, 30 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Multiple official SAP-related npm packages were compromised in a supply chain attack attributed to TeamPCP, resulting in credential-stealing malware being distributed to developers.
Checkmarx confirmed data theft from its GitHub environment following a supply chain attack, with exfiltration occurring on March 30.
The Quick Page/Post Redirect WordPress plugin, active on over 70,000 sites, was found to contain a dormant backdoor for five years, enabling arbitrary code injection.
Ukrainian authorities arrested three individuals accused of hijacking and selling over 610,000 Roblox accounts, generating $225,000 in illicit profits.
European law enforcement dismantled a cryptocurrency investment fraud ring responsible for losses exceeding €50 million.
Anthropic’s Claude Opus LLM was leveraged to insert malicious npm dependencies, facilitating a new wave of DPRK-linked attacks.
Vercel suffered a breach due to a compromised third-party OAuth integration, highlighting risks of OAuth sprawl and downstream impact.

Newly Discovered Vulnerabilities

Google patched a CVSS 10-rated remote code execution vulnerability in the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow.
cPanel and WHM released emergency updates for a critical authentication bypass vulnerability affecting most versions, which could allow unauthorised control panel access.
GitHub fixed a critical RCE vulnerability (CVE-2026-3854) that could have exposed millions of private repositories.
Two authentication bypass vulnerabilities in the Qinglong open-source task scheduler are being actively exploited to deploy cryptominers on servers.
A fresh LiteLLM vulnerability was exploited shortly after disclosure, allowing database read and potential modification.
38 vulnerabilities were identified in the OpenEMR medical software, including issues enabling database compromise, RCE, and data theft.
Chrome 147 and Firefox 150 security updates addressed critical and high-severity code execution vulnerabilities.
Researchers highlighted five exploitation methods for PhantomRPC, which Microsoft has classified as “moderate” and does not intend to patch.

Notable Threat Actor Activity

The Silver Fox group is targeting organisations in Russia and India via tax authority impersonation, distributing ValleyRAT and the new ABCDoor backdoor.
North Korean (DPRK) threat actors are using AI-assisted malware insertion, fake companies, and RATs to compromise npm packages and developer environments.
Iranian group Handala targeted US troops in Bahrain with WhatsApp messages threatening drone and missile attacks.
Lotus Wiper malware was deployed in attacks against Venezuelan energy firms and utilities, utilising advanced living-off-the-land and data deletion techniques.
TeamPCP was identified as responsible for the SAP npm supply chain attack and is linked to deployment of Vect 2.0 ransomware, which functions as a wiper due to a design flaw.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI (including LLMs) to automate malware insertion, reconnaissance, and attack workflows, directly integrating AI into the kill chain.
AI-powered reverse engineering tools were used to identify high-severity vulnerabilities, such as the recent GitHub bug.
OAuth sprawl and third-party integrations are being exploited for lateral movement and supply chain compromise, as evidenced by the Vercel breach.
Exposed RDP and VNC servers, including those controlling ICS/OT environments, remain a significant attack surface, with tens of thousands identified as internet-facing.
Dormant backdoors in widely used software (e.g., WordPress plugins) highlight risks of long-term supply chain compromise.

Regulatory or Policy Developments

CISA added actively exploited ConnectWise ScreenConnect and Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and issued a directive for federal agencies to patch a Windows zero-day.
CISA and US government partners released a guide to accelerate zero trust adoption in operational technology (OT) environments.

Cybersecurity Brief – 2026-02-25

Wed, 25 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Wynn Resorts confirmed an employee data breach following an extortion threat, with the ShinyHunters extortion group listing the company on its data leak site.
CarGurus suffered a data breach exposing information of 12.4 million accounts, with ShinyHunters publishing the stolen personal information.
ShinyHunters claimed responsibility for a breach at Dutch telecommunications provider Odido, reportedly affecting millions of user records.
A phishing campaign by the “Diesel Vortex” threat group targeted freight and logistics organisations in the US and Europe, stealing credentials via 52 domains.
Wynn Resorts, CarGurus, and Odido incidents all point to continued large-scale data theft and extortion targeting enterprises.
Roblox faces a lawsuit from Los Angeles County over alleged failure to protect children from predators.
A Taiwan security firm confirmed exploitation of a vulnerability in TeamT5 ThreatSonar Anti-Ransomware, likely by Chinese APTs.

Newly Discovered Vulnerabilities

SolarWinds patched four critical Serv-U remote code execution vulnerabilities that could allow attackers root access to unpatched servers.
VMware Aria Operations patched several vulnerabilities, including high-severity flaws enabling remote code execution.
CISA added FileZen CVE-2026-25108 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.
A vulnerability in GitHub Codespaces allowed attackers to seize repository control by injecting malicious Copilot instructions via GitHub Issues.
A new supply chain attack, “Sandworm_Mode”, was discovered in the NPM ecosystem, propagating like a worm, poisoning AI assistants, exfiltrating secrets, and containing destructive capabilities.
Open redirect vulnerabilities remain overlooked, with continued potential for abuse in phishing and redirection attacks.

Notable Threat Actor Activity

The North Korea-linked Lazarus Group was observed using Medusa ransomware in attacks against US healthcare and Middle Eastern entities, also deploying the Comebacker backdoor, Blindingcan RAT, and Infohook infostealer.
UAC-0050, a Russia-aligned threat actor, targeted a European financial institution using a spoofed domain and RMS malware, likely for intelligence gathering or financial theft.
UnsolicitedBooker, a threat activity cluster, shifted focus to targeting telecommunications companies in Kyrgyzstan and Tajikistan, deploying LuciDoor and MarsSnake backdoors.
The ShinyHunters extortion group remains active, claiming responsibility for recent high-profile breaches.
“Diesel Vortex” threat group continues credential theft campaigns targeting freight and logistics sectors.
The “Arkanix Stealer” malware, written in C++ and Python, was observed exfiltrating system and browser data before disappearing shortly after its debut.
Arrests of Anonymous Fénix members in Spain disrupted part of the group’s operations.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly using fake video meeting invites (Zoom, Teams, Google Meet) to trick users into installing remote monitoring and management (RMM) tools or surveillance software through social engineering.
1Campaign, a new cybercrime service, enables threat actors to run malicious Google Ads that evade detection and remain online for extended periods.
Attackers now require as little as 29 minutes to gain control of a network, aided by credential misuse, AI tools, and security blind spots.
GitHub Copilot can be abused to process malicious instructions embedded in issues, leading to repository takeover when launching Codespaces.
Social engineering remains a primary attack vector, with increasing sophistication in tactics.
Identity-first security is highlighted as critical, with AI agents now provisioning infrastructure and inheriting over-scoped privileges.
Password length recommendations are being revisited in light of AI and quantum computing threats.
Human risk management tools, such as the AIDA Orchestration Agent, are being introduced to address persistent social engineering risks.

Regulatory or Policy Developments

The UK Information Commissioner’s Office (ICO) fined Reddit £14.47 million for unlawfully collecting and processing children’s data under 13 without adequate safeguards.
Ofcom and the ICO fined both Reddit and a US-based pornographic website for failing to protect children’s privacy and safety online.
Microsoft expanded data loss prevention (DLP) controls to restrict Copilot AI from processing confidential Word, Excel, and PowerPoint documents, regardless of storage location.

Cybersecurity Brief – 2026-01-15

Thu, 15 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.
Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.
Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.
Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.

Newly Discovered Vulnerabilities

Fortinet patched a critical unauthenticated remote code execution vulnerability in FortiSIEM. Public exploit code and technical details for this flaw have been released.
Additional critical vulnerabilities in Fortinet products, including FortiFone, were disclosed and patched, with risks of configuration leaks and code execution.
Chrome 144 and Firefox 147 released patches for high-severity vulnerabilities, addressing 26 security defects including code execution risks.
Microsoft’s January 2026 Patch Tuesday addressed 114 Windows vulnerabilities, including one actively exploited in the wild.
A DLL side-loading vulnerability in the open-source c-ares library is being actively exploited to bypass security controls and deploy malware.

Notable Threat Actor Activity

Microsoft and law enforcement disrupted the RedVDS cybercrime-as-a-service platform, which facilitated phishing, BEC, account takeover, and fraud, and was linked to over $40 million in losses.
Researchers null-routed over 550 command-and-control servers associated with the AISURU/Kimwolf botnet, which had infected over two million devices since October 2025.
A major phishing campaign abused Google’s infrastructure, targeting over 3,000 organizations (primarily in manufacturing) to bypass email security defenses.
Magecart skimming attacks are targeting online checkouts using major payment networks such as AmEx, Diners Club, and Mastercard.
The newly emerged Sicarii Ransomware-as-a-Service operation began advertising across underground forums in December 2025.
Predator spyware has been found to use failed attacks for intelligence gathering to improve future exploit attempts.
Fake “account restricted” comments are being posted on LinkedIn as part of phishing campaigns to steal user credentials.

Trends, Tools, or Tactics of Interest

Microsoft was the most impersonated brand in phishing attacks during Q4 2025, followed by Facebook, Roblox, McAfee, and Steam.
OAuth phishing attacks using the ConsentFix technique are evolving, with attackers hijacking Microsoft accounts via browser-based authorization flows.
The “Reprompt” attack technique allowed hijacking of Microsoft Copilot sessions for sensitive data exfiltration.
AI agents are increasingly being integrated into core workflows, raising concerns about privilege escalation pathways.
64% of third-party applications on leading websites now access sensitive data without business justification, up from 51% in 2024.
Attackers are leveraging legitimate open-source software downloads to conceal remote backdoors.
The “VoidLink” modular malware framework is targeting Linux systems, designed for stealthy, long-term access in cloud-first environments.
Infection campaigns are repeatedly adding scheduled tasks and increasing communication with persistent C2 domains.

Regulatory or Policy Developments

The French CNIL imposed a €42 million fine on Free Mobile and Free for failing to adequately protect customer data in a 2024 breach incident.
An investor lawsuit related to the CrowdStrike outage was dismissed due to lack of evidence of investor fraud.

Cybersecurity Brief – 2025-12-04

Thu, 04 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Critical vulnerabilities in React Server Components (RSC), tracked as CVE-2025-5518 and another CVE, allow unauthenticated remote code execution; these flaws may impact more than a third of cloud service providers.
The King Addons for Elementor WordPress plugin (CVE-2025-8489, CVSS 9.8) is under active attack, enabling privilege escalation to administrative permissions.
Microsoft silently patched a high-severity Windows LNK vulnerability that has been exploited by multiple state-backed and cybercrime groups as a zero-day since 2017. The November 2025 Patch Tuesday update addressed the issue, and Windows now displays additional LNK file properties to help identify malicious code.
Three critical vulnerabilities were disclosed in Picklescan, an open-source utility for scanning PyTorch models. These flaws allow malicious PyTorch models to evade scans and execute arbitrary code.
Chrome 143 stable release addressed 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

Notable Threat Actor Activity

Kaspersky identified Shai Hulud 2.0, a new version of the npm worm now equipped with wiper functionality, targeting organizations in Russia, India, Brazil, China, and other countries.
The Water Saci threat actor has evolved its banking trojan campaign in Brazil, now using a multi-layered infection chain involving HTA files, PDFs, and propagation via WhatsApp and RelayNFC for NFC relay fraud. AI-enhanced Python variants are targeting enterprise users of banks and cryptocurrency exchanges.
The MuddyWater APT (linked to Iran) targeted Israeli organizations using new evasion tactics, including techniques mimicking the retro Snake mobile game.
The ShadyPanda group, believed to be China-based, has been using malicious Chrome and Edge browser extensions to spy on millions of users globally.
A malicious Rust crate was discovered targeting Web3 developer systems across Windows, macOS, and Linux, capable of OS-specific malware delivery and stealthy execution.
DragonForce ransomware, in collaboration with the Scattered Spider group, has expanded operations in 2025, leveraging advanced social engineering and initial access techniques.
Attackers are increasingly using Evilginx to steal session cookies, enabling bypass of multi-factor authentication (MFA) protections.
There is a rise in attackers abusing legitimate Remote Monitoring and Management (RMM) tools to gain remote control of victim systems.

Trends, Tools, or Tactics of Interest

The Aisuru botnet’s scale and DDoS throughput set new records, highlighting the growing potency of botnet-driven attacks.
Matrix Push C2, a new criminal toolkit, is abusing browser push notifications to launch social engineering attacks.
Use of AI tools is fueling more sophisticated cybercrime, lowering barriers for less-skilled actors and enhancing the quality of phishing and malware campaigns.
Attackers are increasingly targeting enterprises during off-hours, weekends, and holidays, exploiting reduced staffing and slower response times.
Content Delivery Networks (CDNs) remain a primary mitigation for DDoS and aggressive bot traffic, but attackers are attempting to bypass these protections.
Fileless attack techniques and abuse of legitimate IT tools are increasingly observed, complicating detection and response for defenders.

Regulatory or Policy Developments

The Arizona Attorney General has filed a lawsuit against Chinese online retailer Temu, alleging unauthorized and undisclosed access to and harvesting of user data through its mobile application.
CISA and partners released a new joint guide focused on the secure integration of artificial intelligence in operational technology environments.
Google is expanding Android’s in-call scam protection for financial applications in the US, aiming to address rising phone-based fraud.
Russia has blocked access to the Roblox gaming platform, citing the distribution of LGBT-related content and extremist material as justification.

Cybersecurity Brief – 2025-09-05

Fri, 05 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

PowerSchool Data Breach: Texas Attorney General filed a lawsuit against PowerSchool following a December breach that exposed the personal information of 62 million students, including 880,000 Texans.
Chess.com Data Breach: Chess.com disclosed a breach after threat actors accessed a third-party file transfer application, compromising user data.
Bridgestone Cyberattack: Bridgestone confirmed a cyberattack affecting manufacturing operations in North America; details of the attack vector remain under investigation.
Wytec Website Hack: Wytec’s website was defaced twice by unknown actors and remains offline, with the company anticipating significant financial losses.
Salesloft Drift Supply Chain Attack: Multiple high-profile customers reported data breaches linked to a recent supply chain attack involving Salesloft Drift, though the full impact is still unclear.

Newly Discovered Vulnerabilities

Sitecore Zero-Day: Threat actors exploited a zero-day vulnerability in legacy Sitecore deployments, using exposed ASP.NET machine keys for ViewState deserialization attacks and deployment of WeepSteel malware.
TP-Link Router Flaws: CISA added CVE-2023-50224 and CVE-2025-9377, affecting TP-Link routers, to its Known Exploited Vulnerabilities catalog; TP-Link also confirmed a new unpatched zero-day impacting several router models.
Android Vulnerabilities: Two exploited vulnerabilities in Android-CVE-2025-48543 (Android Runtime) and CVE-2025-38352 (Linux kernel)-were patched after being leveraged in targeted attacks.

Notable Threat Actor Activity

GhostRedirector Campaign: ESET and other researchers identified a new threat actor, GhostRedirector, compromising at least 65 Windows servers (primarily in Brazil) via a passive C++ backdoor and a malicious IIS module (Gamshen), manipulating Google search results and boosting gambling sites.
APT28/NotDoor Backdoor: Russian state-sponsored group APT28 deployed a new Microsoft Outlook backdoor, NotDoor, targeting multiple companies in NATO countries.
Quad7 Botnet: The Quad7 botnet is exploiting end-of-life TP-Link routers to steal Microsoft 365 accounts.
SVG-Based Phishing: A global phishing campaign is leveraging undetected SVG files to deploy Base64-encoded phishing pages, including impersonation of the Colombian judicial system.
Phishing-as-a-Service: Researchers uncovered a long-running phishing-as-a-service operation using cloud infrastructure (Google, Cloudflare) and cloaking techniques to evade detection.
X (Twitter) Grok AI Abuse: Cybercriminals are exploiting X’s Grok AI to bypass ad protections and distribute malware via malicious links.
Model Namespace Reuse: Demonstrated AI supply chain attack method allows attackers to deploy malicious models and achieve code execution in Google and Microsoft environments.
US Rewards for Russian Hackers: The US government offered $10 million for three Russian hackers accused of targeting critical infrastructure and energy firms worldwide.

Trends, Tools, or Tactics of Interest

AI-Driven Attack Chains: Reports indicate AI tools can now automate entire attack chains, increasing operational efficiency for threat actors.
AI-Enhanced Phishing: Healthcare organisations are being warned about an anticipated surge in AI-powered phishing attacks.
Vishing Scams: Continued prevalence of vishing scams, with attackers impersonating law enforcement to issue fake arrest warrants.
Browser-Based Attacks: Security teams are advised to prepare for increasing browser-based threats, including phishing kits, malicious OAuth apps, and browser extensions.
BlockEDRTraffic Tool: Release of BlockEDRTraffic, a tool for EDR-evasive lateral movement, which uses Windows Firewall or Filtering Platform to block telemetry and create stealth windows.
VPN Security Concerns: Popular Android VPN apps found to have security flaws and undisclosed links to China, raising concerns over data privacy and exposure.
Supply Chain Security & SBOMs: US and allied nations are promoting Software Bill of Materials (SBOM) adoption to enhance supply chain transparency and reduce risk.
Incident Response Skills Gap: ISC2 launched a Threat Handling Foundations Certificate to address the digital forensics and incident response (DFIR) skills gap.

Regulatory or Policy Developments

French Data Protection Fines: The French data protection authority fined Google €325 million ($379 million) and Shein €150 million ($175 million) for violating cookie consent rules and displaying unauthorised ads.
Czech Cybersecurity Warning: Czech agency NÚKIB issued a warning regarding the use of products that transmit user data to China, highlighting national security risks.
Roblox Age Verification: Roblox introduced age estimation requirements for access to communication features, aiming to protect minors from sexual predators.