Cybersecurity Brief – 2026-09-14

Mon, 14 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Revolut disclosed a data breach in which sensitive customer data, including financial information and passport details, was released to a threat actor impersonating a government agency and using a legitimate government email domain. The number of affected customers has not been specified ^[7]^[16]^[24].
Telus warned customers of account breaches after attackers used stolen credentials over several months to access subscriber personal data and billing records ^[20].
A malicious Twitch browser extension leaked OAuth tokens for nearly 31,000 users to proxy servers operated by a Russian commercial bot service ^[3].

Newly Discovered Vulnerabilities

Threat actors are actively exploiting a maximum-severity GitLab vulnerability, according to CISA ^[9].
Chinese threat actors are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows, enabling remote code execution and deployment of the GrayRabbit backdoor ^[10]^[18].
Three vulnerabilities in JFrog Artifactory have been exploited to bypass authentication and escalate privileges to administrator, facilitating backdoor deployment ^[21].
ConnectWise patched a vulnerability in ScreenConnect that allowed attackers to send and execute files without authorization during active remote sessions, which was exploited in worm-like attacks ^[22].

Notable Threat Actor Activity

Threat actors are leveraging AI hallucinations by using “slop squatting” techniques to plant phishing links and other malicious content in AI-generated outputs, directing users to phishing pages ^[1].
Chinese-aligned espionage groups are exploiting the Tencent Sogou Input Method vulnerability to deploy malware ^[10]^[18].

Trends, Tools, or Tactics of Interest

Attackers are increasingly combining social engineering with malicious OAuth applications to access Google Workspace data without relying solely on stolen passwords ^[5].
There is a trend of using AI in both offensive and defensive cybersecurity operations, with vulnerability discovery accelerating due to AI-driven tools ^[2].
Sexually explicit deepfake websites are targeting over 100 politicians across 22 European countries, with nearly all victims being women ^[13].

Regulatory or Policy Developments Affecting the Security Industry

Rising concerns and debate over the risks of AI to humanity are prompting renewed scrutiny and calls for regulatory oversight as AI models become more powerful ^[15]^[17].

Sources

Revolut discloses data breach exposing financial info, passports - bleepingcomputer.com
Personal, Financial Info Exposed in Revolut Data Breach - securityweek.com
Revolut gave customer IDs and financial data to a government impostor - malwarebytes.com
Telus Warns Customers of Account Breaches - securityweek.com
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users - thehackernews.com
CISA: Hackers now exploit max severity GitLab flaw in attacks - bleepingcomputer.com
Hackers exploit Tencent app flaw to deploy GrayRabbit malware - bleepingcomputer.com
Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution - securityweek.com
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment - securityweek.com
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks - securityweek.com
Warning: “Slop Squatting” Directs AI Users to Phishing Pages - blog.knowbe4.com
Webinar: How malicious OAuth apps can lead to Google Workspace breaches - bleepingcomputer.com
AI Changed the Exposure Problem. Validation Needs to Change With It. - thehackernews.com
Sexually Explicit Deepfake Sites Target 100-Plus Politicians in Europe - wired.com
New Warnings About the Risks of AI to Humanity Revive a Long-Running Debate - securityweek.com
The Race to Control AI and Protect What Makes Us Human - securityweek.com

Cybersecurity Brief – 2026-03-13

Fri, 13 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

England Hockey is investigating a potential data breach after the AiLock ransomware group listed the organisation as a victim on its leak site.
Canadian retail giant Loblaw notified customers of a data breach, logging out all users from accounts as a precaution.
Telus Digital confirmed a security incident following claims by threat actors of the theft of nearly 1 petabyte of data.
The SocksEscort proxy botnet, which compromised over 369,000 IPs globally using AVRecon Linux malware, was dismantled in a coordinated law enforcement operation.
Kroll was impersonated in a crypto wallet scam, with attackers leveraging the firm’s reputation to target victims.
The US Department of Justice charged another ransomware negotiator for colluding with the BlackCat/ALPHV ransomware group.
Meta disabled more than 150,000 accounts used to power scam centres in Asia and launched new protection tools across its platforms.

Newly Discovered Vulnerabilities

Veeam released patches for seven critical vulnerabilities in its Backup & Replication software, including multiple remote code execution flaws.
Google issued emergency updates for Chrome to address two zero-day vulnerabilities actively exploited in the wild.
Apple backported patches for a WebKit vulnerability (CVE-2024-23296) exploited by the Coruna exploit kit to older iOS, iPadOS, and macOS versions.
The Ally WordPress plugin was found to have a SQL injection vulnerability exposing over 200,000 websites to potential data theft.
Splunk and Zoom patched critical and high-severity vulnerabilities that could allow arbitrary shell command execution or privilege escalation.
Cisco patched high-severity vulnerabilities in IOS XR that could result in denial-of-service, command execution, or device takeover.
Critical vulnerabilities in the N8n workflow automation tool allowed unauthenticated remote code execution and server takeover.
A newly disclosed Android vulnerability enables attackers to bypass lock screens in under 60 seconds, potentially exposing encryption keys and sensitive data.
Microsoft Authenticator on Android and iOS had a bug that could allow malicious apps to intercept authentication codes or sign-in links. Updates have been released.
Six new Android malware families were identified targeting Pix payments, banking apps, and crypto wallets, with capabilities for data theft and financial fraud.

Notable Threat Actor Activity

Iranian APTs, including the group known as Handala Hack (Void Manticore), have increased destructive cyberattacks, combining wiping attacks with hack-and-leak operations and collaborating with cybercriminal groups.
The Rust-based VENON malware is targeting 33 Brazilian banks, using credential-stealing overlays and marking a shift from previous Delphi-based malware.
The AI-assisted Slopoly malware, attributed to the Hive0163 threat actor, was used for persistent access and data theft in Interlock ransomware attacks.
The Polyfill supply chain attack, initially attributed to China, has been linked to North Korean threat actors following further investigation.

Trends, Tools, or Tactics of Interest

Phishing campaigns are increasingly impersonating city and county officials to solicit fraudulent payments, as warned by the FBI.
Attackers are using phishing not only to target employees but also to overload SOC analysts with complex investigations, increasing operational fatigue.
Modern phishing campaigns are leveraging trusted infrastructure and legitimate-looking domains to evade detection.
A React-based phishing page was observed using EmailJS for credential exfiltration, demonstrating the use of modern web frameworks and third-party services in phishing kits.
Cybercriminals are treating stolen travel loyalty points as a form of underground currency, reselling them for flights and hotel stays.
Automation in DAST (Dynamic Application Security Testing) can introduce hidden costs if not properly aligned with application behaviour.
Delinea’s acquisition of StrongDM highlights a shift in Privileged Access Management (PAM) towards ephemeral, real-time credentials for cloud and developer environments.
Meta has rolled out AI-powered anti-scam tools across WhatsApp, Facebook, and Messenger to detect impersonation, suspicious friend requests, and scam messages.

Regulatory or Policy Developments Affecting the Security Industry

US lawmakers have introduced a bipartisan bill to require the FBI to obtain a warrant before accessing Americans’ communications and to ban federal purchase of commercial data on US residents.
Confusion persists regarding US policy on commercial spyware, with recent reversals of sanctions and contract reactivations raising concerns among privacy advocates.

Telus on DanSec Daily

Cybersecurity Brief – 2026-09-14

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources

Cybersecurity Brief – 2026-03-13

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry