Temu on DanSec Daily

Cybersecurity Brief – 2026-04-17

Fri, 17 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.

Cybersecurity Brief – 2026-03-14

Sat, 14 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Starbucks disclosed a data breach affecting hundreds of employees after threat actors gained access to Starbucks Partner Central accounts via phishing attacks targeting the employee portal.
Poland’s National Centre for Nuclear Research (NCBJ) reported an attempted cyberattack targeting its IT infrastructure; the attack was detected and blocked with no reported impact.
The FBI is investigating eight malicious games uploaded to the Steam platform, which were used to spread malware. The agency is seeking information from affected users.
An Iran-linked hacker group attacked Stryker, disrupting manufacturing and shipping operations. The attackers used legitimate endpoint management software to wipe devices rather than deploying malware.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two high-severity zero-day vulnerabilities (CVE-2026-1234 and CVE-2026-2345) affecting Skia and V8 components, both exploited in the wild to potentially allow code execution and security bypass.
Nine vulnerabilities (“CrackArmor” flaws) were disclosed in the Linux kernel’s AppArmor module. These flaws can be exploited by unprivileged users to escalate privileges to root and bypass container isolation.
A flaw in the n8n automation platform was reported as being actively exploited.
Issues have been reported with some Samsung laptops running Windows 11 after the February 2026 security update, resulting in users losing access to the C:\ drive.

Notable Threat Actor Activity

Storm-2561, a tracked threat actor, is distributing trojanized VPN clients masquerading as legitimate enterprise VPN software (Ivanti, Cisco, Fortinet) via SEO poisoning. These fake downloads are used to steal company VPN credentials.
A suspected China-based cyber espionage group has been targeting Southeast Asian military organizations since at least 2020, deploying custom malware families “AppleChris” and “MemFun.”
Pro-Iranian hackers have increased cyber operations against sites in the Middle East and are expanding attacks to US targets, including defense contractors and critical infrastructure. Recent activity includes the Stryker attack and threats to power and water facilities.
Authorities in the US and Europe disrupted the SocksEscort proxy service, powered by the AVrecon botnet, which had impacted approximately 360,000 devices since 2020.
INTERPOL, as part of Operation Synergia III, sinkholed 45,000 malicious IP addresses and seized servers linked to phishing, malware, and ransomware campaigns. The operation resulted in 94 arrests globally.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging SEO poisoning to distribute malware, as seen in the Storm-2561 campaign targeting VPN users.
Use of fake enterprise software download sites is on the rise for credential theft.
ClickFix variants are being used in scams, such as a fake $TEMU crypto airdrop, to trick victims into executing malware that installs remote-access backdoors.
Scammers are sending fake calendar renewal notices impersonating Malwarebytes to lure victims into calling fraudulent billing numbers.
Real-time banking trojans in Brazil are combining malware with human operators to target Pix users at opportune moments.
Nonprofit organizations remain attractive targets due to security gaps, with underreporting of incidents making risk assessment difficult.
AI is being increasingly leveraged for both cyber defense and attack, with new startups focusing on autonomous agent oversight and real-time device protection.
Research demonstrates that widely-used facial recognition systems can be bypassed using smart glasses, deepfakes, and face swaps.
Most attacks on Google Cloud begin with exploitation of vulnerabilities rather than credential theft or misconfiguration.

Regulatory or Policy Developments Affecting the Security Industry

Meta announced it will discontinue support for end-to-end encrypted (E2EE) chats on Instagram as of May 8, 2026.
Google reported paying out $17 million in bug bounty rewards in 2025, including $3.7 million for Chrome vulnerabilities and $3.5 million for cloud security issues, reflecting ongoing industry investment in vulnerability discovery and disclosure.

Cybersecurity Brief – 2025-12-04

Thu, 04 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Critical vulnerabilities in React Server Components (RSC), tracked as CVE-2025-5518 and another CVE, allow unauthenticated remote code execution; these flaws may impact more than a third of cloud service providers.
The King Addons for Elementor WordPress plugin (CVE-2025-8489, CVSS 9.8) is under active attack, enabling privilege escalation to administrative permissions.
Microsoft silently patched a high-severity Windows LNK vulnerability that has been exploited by multiple state-backed and cybercrime groups as a zero-day since 2017. The November 2025 Patch Tuesday update addressed the issue, and Windows now displays additional LNK file properties to help identify malicious code.
Three critical vulnerabilities were disclosed in Picklescan, an open-source utility for scanning PyTorch models. These flaws allow malicious PyTorch models to evade scans and execute arbitrary code.
Chrome 143 stable release addressed 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

Notable Threat Actor Activity

Kaspersky identified Shai Hulud 2.0, a new version of the npm worm now equipped with wiper functionality, targeting organizations in Russia, India, Brazil, China, and other countries.
The Water Saci threat actor has evolved its banking trojan campaign in Brazil, now using a multi-layered infection chain involving HTA files, PDFs, and propagation via WhatsApp and RelayNFC for NFC relay fraud. AI-enhanced Python variants are targeting enterprise users of banks and cryptocurrency exchanges.
The MuddyWater APT (linked to Iran) targeted Israeli organizations using new evasion tactics, including techniques mimicking the retro Snake mobile game.
The ShadyPanda group, believed to be China-based, has been using malicious Chrome and Edge browser extensions to spy on millions of users globally.
A malicious Rust crate was discovered targeting Web3 developer systems across Windows, macOS, and Linux, capable of OS-specific malware delivery and stealthy execution.
DragonForce ransomware, in collaboration with the Scattered Spider group, has expanded operations in 2025, leveraging advanced social engineering and initial access techniques.
Attackers are increasingly using Evilginx to steal session cookies, enabling bypass of multi-factor authentication (MFA) protections.
There is a rise in attackers abusing legitimate Remote Monitoring and Management (RMM) tools to gain remote control of victim systems.

Trends, Tools, or Tactics of Interest

The Aisuru botnet’s scale and DDoS throughput set new records, highlighting the growing potency of botnet-driven attacks.
Matrix Push C2, a new criminal toolkit, is abusing browser push notifications to launch social engineering attacks.
Use of AI tools is fueling more sophisticated cybercrime, lowering barriers for less-skilled actors and enhancing the quality of phishing and malware campaigns.
Attackers are increasingly targeting enterprises during off-hours, weekends, and holidays, exploiting reduced staffing and slower response times.
Content Delivery Networks (CDNs) remain a primary mitigation for DDoS and aggressive bot traffic, but attackers are attempting to bypass these protections.
Fileless attack techniques and abuse of legitimate IT tools are increasingly observed, complicating detection and response for defenders.

Regulatory or Policy Developments

The Arizona Attorney General has filed a lawsuit against Chinese online retailer Temu, alleging unauthorized and undisclosed access to and harvesting of user data through its mobile application.
CISA and partners released a new joint guide focused on the secure integration of artificial intelligence in operational technology environments.
Google is expanding Android’s in-call scam protection for financial applications in the US, aiming to address rising phone-based fraud.
Russia has blocked access to the Roblox gaming platform, citing the distribution of LGBT-related content and extremist material as justification.