Cybersecurity Brief – 2026-08-22

Sat, 22 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

A new Android malware family targeting vehicle head units manufactured by DoFun has been discovered. The malware is distributed via legitimate software updates and is designed to serve ads and build a proxy botnet, affecting the integrity of in-car systems and potentially exposing user data^[1]^[7].
More than 9,300 Amazon Web Services (AWS) access keys have been found publicly exposed and remain active, granting full control over affected corporate accounts and posing a significant supply chain and cloud security risk^[11].
Toronto’s Hospital for Sick Children (SickKids) suffered a data breach exposing personal information of current and former employees as well as job applicants, due to a vulnerability in third-party software^[18].
Healthcare technology provider CareCloud reported a breach affecting 3.75 million individuals, with exposure of sensitive data including medical records, Social Security numbers, and bank details^[31].

Newly Discovered Vulnerabilities

Cisco released security updates for nine vulnerabilities in Crosswork and Secure Workload platforms. Five of these flaws have a CVSS score of 10.0, allowing unauthenticated remote code execution and privilege escalation^[9].
Microsoft patched a maximum-severity vulnerability in the Entra ID identity and access management platform that was being actively exploited. The company also released a total of 22 security patches, most addressing code execution, privilege escalation, and information disclosure issues^[16]^[29].
CISA ordered US federal agencies to patch two actively exploited vulnerabilities in TrueConf Server, a self-hosted communication platform^[15].
A critical type confusion vulnerability in the isolated-vm JavaScript library can lead to remote code execution on the host, enabling V8 sandbox escape and control-flow hijacking^[26].
Researchers disclosed that Microsoft Defender’s boot-time remediation driver can be abused to perform arbitrary kernel-level operations, such as deleting security software at boot, effectively allowing attackers to disable endpoint protections^[6].

Notable Threat Actor Activity

Fourteen trojanized npm packages were discovered delivering the RedC2 4.0 Linux backdoor, which uses artificial intelligence to enhance command and control operations. These packages masquerade as legitimate utilities^[5].
A supply chain attack on the Rust programming ecosystem was linked to North Korean threat actors, involving a poisoned version of the arrayref crate that fetched malicious payloads from a remote server^[27].
Threat actors are abusing FTP server banners to deliver two previously undocumented Windows remote access trojans, E4del and PINHOLE, via hidden commands^[17].
A new phishing toolkit, iAuthFlow V2, registers attacker-controlled passkeys during phishing attacks, allowing persistent access to victim accounts even after password changes and session revocations^[25].
The SynkLoader malware family was identified as being distributed through Microsoft Teams phishing campaigns, using a fake lock screen to steal credentials^[10].

Trends, Tools, or Tactics of Interest

Vishing (voice phishing) and device code phishing attacks are surging, as attackers increasingly use social engineering methods that bypass traditional security controls^[3].
Researchers demonstrated that encrypted prompts can bypass AI safety guardrails in large language models such as Grok and Gemini, using a method called Cryptographic Context Injection to conceal malicious instructions until runtime^[24].
OWASP published a new Top 10 security risks list specific to AI skill integrations, introducing a Universal Skill Format for consistent and secure AI add-on development^[19].
A new phishing toolkit leverages passkeys for post-compromise persistence, reflecting a shift in phishing tactics to exploit modern authentication mechanisms^[25].
Scientific research revealed that expired Visa credit cards can be manipulated for purchases in so-called Zombie Card attacks, exposing weaknesses in payment processing systems^[30].

Regulatory or Policy Developments Affecting the Security Industry

Two industry surveys indicated that while confidence among defense contractors regarding Cybersecurity Maturity Model Certification (CMMC) compliance is rising, the ability to provide evidence of compliance is lagging^[28].

Sources

The invisible passenger in your car - securelist.com
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet - thehackernews.com
Hundreds of leaked AWS keys give full control over corporate accounts - bleepingcomputer.com
SickKids data breach exposes employee and job applicant info - bleepingcomputer.com
Medical records, SSNs, and bank details exposed in CareCloud data breach - malwarebytes.com
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0 - thehackernews.com
Microsoft patches max severity code execution, privilege escalation flaws - bleepingcomputer.com
Microsoft Patches Exploited Entra ID Vulnerability - securityweek.com
CISA orders feds to patch actively exploited TrueConf Server flaws - bleepingcomputer.com
Critical Isolated-vm Vulnerability Leads to RCE on Host - securityweek.com
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot - thehackernews.com
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 - thehackernews.com
Rust Supply Chain Attack Linked to North Korean Hackers - securityweek.com
Hackers abuse FTP server banners to deliver new Windows malware - bleepingcomputer.com
New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets - securityweek.com
New SynkLoader malware pushed in Microsoft Teams phishing campaign - bleepingcomputer.com
Report: Vishing and Device Code Phishing Are Surging - blog.knowbe4.com
Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini - securityweek.com
OWASP Flags Top AI Skill Risks in New Security Blueprint - darkreading.com
Zombie Card: An expired Visa credit card can be used for purchases - malwarebytes.com
Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind - securityweek.com

SickKids on DanSec Daily

Cybersecurity Brief – 2026-08-22

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources