Tenable on DanSec Daily

Cybersecurity Brief – 2026-07-16

Thu, 16 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims ^[11].
Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations ^[18].

Newly Discovered Vulnerabilities

Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products ^[5].
A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts ^[12].
Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable ^[29].
Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform ^[35].
A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service ^[7]^[28].
Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent ^[9]^[24]^[30].
Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks ^[19]^[27].
Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching ^[16]^[31].
A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions ^[37].
The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits ^[23].
July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days ^[38].

Notable Threat Actor Activity

The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications ^[1]^[4].
Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware ^[10]^[14].
A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet ^[13].
The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users ^[39].

Trends, Tools, or Tactics of Interest

Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics ^[2].
TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities ^[3].
Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise ^[20].
Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools ^[32].
The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing ^[15].
SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows ^[6].

Regulatory or Policy Developments Affecting the Security Industry

The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level ^[36].
The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions ^[34].
The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy ^[22].

Sources

Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com

Cybersecurity Brief – 2026-04-25

Sat, 25 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

ADT, a major home security provider, confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid.
Medical data of 500,000 UK Biobank volunteers was listed for sale on Alibaba, despite existing access controls.
NASA disclosed that employees were targeted and duped in a spear-phishing campaign orchestrated by a Chinese national posing as a U.S. researcher, with the intent to compromise U.S. defense software.
A U.S. federal civilian agency’s Cisco Firepower device was compromised with the Firestarter backdoor, which remains persistent even after applying security patches.
Bitwarden’s NPM package was compromised in a supply chain attack attributed to TeamPCP, involving the Shai-Hulud worm.
Over 10,000 Zimbra Collaboration Suite servers remain vulnerable to active exploitation of a cross-site scripting (XSS) flaw.
26 malicious apps impersonating popular cryptocurrency wallets were discovered on the Apple App Store, targeting users’ recovery phrases and private keys.

Newly Discovered Vulnerabilities

PhantomRPC: A newly discovered privilege escalation technique in Windows RPC allows attackers to create fake RPC servers to escalate privileges.
Pack2TheRoot: A vulnerability in the Linux PackageKit daemon allows local users to install or remove system packages and gain root access.
Four new exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
CrowdStrike patched a critical LogScale vulnerability, and Tenable fixed a high-severity flaw in Nessus.

Notable Threat Actor Activity

The ShinyHunters extortion group is behind the ADT breach and subsequent ransom threat.
The BlackFile extortion group has been linked to a surge of data theft and vishing attacks targeting retail and hospitality sectors since February 2026.
Tropic Trooper is targeting Chinese-speaking individuals using a trojanized SumatraPDF reader to deploy the AdaptixC2 post-exploitation agent via GitHub.
North Korea’s Lazarus Group continues to target macOS users through the ClickFix tool for initial access and data theft.
TeamPCP is linked to the Bitwarden NPM package supply chain attack.
A Chinese threat actor conducted a spear-phishing campaign targeting NASA employees and U.S. defense software.

Trends, Tools, or Tactics of Interest

AI-powered phishing attacks have significantly increased in the past six months, evolving from broad campaigns to highly personalized, 1-to-1 attacks.
Attackers are leveraging supply chain vulnerabilities, as evidenced by the Bitwarden NPM compromise.
The Firestarter malware demonstrates advanced persistence capabilities, surviving firmware updates and security patches on Cisco ASA and Firepower devices.
There is a rise in malicious crypto wallet apps on legitimate platforms, with 26 such apps found on the Apple App Store.
The use of trojanized legitimate software (e.g., SumatraPDF) and abuse of GitHub for payload delivery is being seen in targeted attacks.
Shadow IT, SaaS, and shadow AI/agents continue to present significant organizational risks.

Regulatory or Policy Developments

Article 9 of the EU’s Digital Operational Resilience Act (DORA) establishes authentication and access control as legal obligations for financial entities.
CISA set a May 2026 deadline for U.S. federal agencies to remediate newly listed exploited vulnerabilities in its KEV catalog.
Microsoft will roll out Entra passkey support for phishing-resistant passwordless authentication to Windows devices, starting late April.
Microsoft now allows IT administrators to uninstall Copilot from enterprise devices via a new policy setting.
The Trump administration announced intentions to crack down on Chinese companies exploiting U.S.-developed AI models.
A new U.S. bill is under consideration to address concerns about warrantless surveillance powers under a key federal spy program.

Cybersecurity Brief – 2026-01-31

Sat, 31 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

CERT Polska reported coordinated cyber attacks on over 30 wind and solar farms, as well as a private manufacturing company, in Poland. Related reporting attributes a Russia-linked threat actor (Sandworm/Electrum) as responsible for these intrusions, which resulted in bricked ICS devices at 30 sites affecting communication and control systems in the Polish power grid.
ShinyHunters ransomware group claimed breaches of Match Group dating platforms (Match, Hinge, OkCupid) and Panera Bread, allegedly stealing millions of user records.
Illegal cryptocurrency flows reached $158 billion in 2025, marking a record high after several years of decline.
Researchers identified malicious Google Chrome extensions capable of hijacking affiliate links, stealing data, and collecting OpenAI ChatGPT authentication tokens.
Android users were targeted with a remote access trojan (RAT) delivered via malicious applications hosted on Hugging Face repositories.
Over 175,000 exposed Ollama AI model hosts were identified, with 23,000 persistently active, posing risks of LLM abuse.

Newly Discovered Vulnerabilities

Ivanti released patches for critical-severity, actively exploited zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, which allowed unauthenticated remote code execution.
Microsoft fixed a bug in Microsoft 365 Outlook that prevented users from accessing encrypted emails in classic Outlook.
The Windows 11 KB5074105 update addressed multiple issues, including boot, sign-in, and activation failures.

Notable Threat Actor Activity

China-linked threat actor UAT-8099 was observed targeting IIS servers in Asia with the BadIIS SEO malware campaign between late 2025 and early 2026. The campaign focused on search engine manipulation through server compromise.
Sandworm/Electrum, a Russia-linked group, was attributed to the bricking of ICS devices during coordinated attacks on Polish energy infrastructure.

Trends, Tools, or Tactics of Interest

Agentic AI and autonomous AI assistants such as OpenClaw (ClawdBot, MoltBot) are increasingly present in business environments, raising concerns about privileged, autonomous control and the expanding attack surface.
Security researchers noted increased abuse of Google Presentations for phishing campaigns targeting webmail users.
The Tenable One AI Exposure add-on was introduced to discover unsanctioned AI use within organizations and enforce compliance with approved AI tools.
Aisy launched an AI-assisted vulnerability management platform after emerging from stealth with $2.3 million in seed funding.

Regulatory or Policy Developments

Microsoft announced plans to disable the legacy NTLM authentication protocol by default in future Windows releases, citing security vulnerabilities.
The White House revoked two Biden-era memorandums related to software security rules, although some associated resources remain available for government use.
TikTok updated its privacy policy to explicitly reference immigration status in user data, drawing public attention and scrutiny.

Cybersecurity Brief – 2025-09-06

Sat, 06 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Wealthsimple, a Canadian online investment management service, disclosed a data breach involving the theft of personal data from an undisclosed number of customers.
Multiple cybersecurity firms, including Proofpoint, SpyCloud, Tanium, and Tenable, were affected by a breach involving their Salesforce instances, with attackers accessing stored information.
Nexar’s dashcam video database was compromised, exposing video recordings from vehicle-mounted cameras.
The City of Baltimore was reported to have sent $1.5 million to a scammer in a cyber fraud incident.

Newly Discovered Vulnerabilities

A critical command injection vulnerability in SAP S/4HANA (CVE-2025-42957) is under active exploitation. This flaw allows attackers to achieve full system compromise with minimal effort.
A critical Sitecore vulnerability has been identified and is being actively exploited. CISA has ordered immediate patching of affected Sitecore instances by federal agencies.
A max-severity Argo CD API flaw allows users with low-level project permissions to access API endpoints and retrieve all repository credentials for a project.
Academics have developed an AI-powered framework (A2) for discovering and validating vulnerabilities in Android applications.

Notable Threat Actor Activity

TAG-150, a threat actor group operating a malware-as-a-service (MaaS) framework known as CastleLoader, has developed a new remote access trojan called CastleRAT, available in both Python and C variants.
North Korean hackers have targeted hundreds of individuals using fake job interview lures. The group actively monitors cyber threat intelligence to rebuild exposed infrastructure.
Scammers are abusing the Grok AI platform to distribute malicious links on X (formerly Twitter), bypassing restrictions on links in promoted posts.
A smishing campaign is targeting California taxpayers with fraudulent refund offers, as warned by the California Franchise Tax Board.
A wave of spear phishing attacks is targeting C-suite executives and senior leadership across multiple industries.

Trends, Tools, or Tactics of Interest

Q2 2025 threat reports indicate continued high volumes of mobile malware, adware, and unwanted software targeting Android, as well as persistent threats to Windows, macOS, and IoT platforms, including ransomware and cryptominers.
Automation is increasingly being adopted in penetration testing, with AI-powered offensive security platforms such as FireCompass receiving significant investment.
The use of agentic AI introduces new vulnerabilities at integration points with enterprise systems.
There is a trend towards using AI-driven tools for vulnerability discovery and validation in software development.
Smishing, spear phishing, and the abuse of AI platforms for phishing and malware distribution are prominent tactics.
Improvements in IoT security have been noted over the past five years, though significant gaps remain.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated immediate patching of the critical Sitecore vulnerability for federal agencies.
Microsoft has enforced multifactor authentication (MFA) for Azure Portal sign-ins across all tenants since March 2025.
The European Commission fined Google €2.95 billion ($3.5 billion) for anti-competitive practices in the digital advertising market.
Federal budget cuts in the US are impacting cybersecurity funding for local and state agencies, increasing their exposure to cyber risk.

Cybersecurity Brief – 2025-05-21

Wed, 21 May 2025 00:00:00 +0000

Major Incidents or Breaches

Cellcom Cyberattack: Wisconsin-based mobile carrier Cellcom confirmed a cyberattack caused widespread service outages beginning 14 May 2025.
SK Telecom Data Breach: SK Telecom disclosed a malware breach lasting three years (since 2022), exposing USIM data of 27 million subscribers.
RVTools Supply Chain Attack: The official website for RVTools, a VMware management utility, was compromised in a supply chain attack. Trojanized installers delivered the Bumblebee malware loader.
PowerSchool Extortion: A 19-year-old has pleaded guilty to a cyberattack on PowerSchool, involving extortion and exposure of student data.
KrebsOnSecurity DDoS Attack: KrebsOnSecurity experienced a near-record DDoS attack peaking at 6.3 Tbps.

Newly Discovered Vulnerabilities

WordPress ‘Motors’ Theme: A critical privilege escalation vulnerability allows unauthenticated attackers to take over admin accounts on sites using the premium Motors theme.
Virgin Media O2 Location Leak: A security flaw in Virgin Media O2’s mobile network could allow attackers to pinpoint call recipient locations within 100 square meters.
AWS Default IAM Roles: Researchers identified risky default IAM roles in AWS that can enable lateral movement and cross-service exploitation if misconfigured.

Notable Threat Actor Activity

Hazy Hawk: This group has been actively hijacking abandoned cloud resources (e.g., S3 buckets, Azure endpoints) via DNS misconfigurations and CNAME hijacking, targeting high-profile organizations including the US CDC, to deliver malware and conduct scams.
Scattered Spider: The group continues to target large retailers, shifting focus from UK to US organizations, leveraging IT help desk social engineering for initial access.
SideWinder APT: Targeted ministries in Sri Lanka, Bangladesh, and Pakistan using spear phishing, exploiting old Microsoft Office vulnerabilities, and deploying custom malware.
UnsolicitedBooker (China-aligned): Deployed the new MarsSnake backdoor in a multi-year campaign against a Saudi Arabian organization.
RedisRaider: A new Go-based cryptojacking campaign targets publicly accessible Redis servers to deploy XMRig miners.
VanHelsing Ransomware: The ransomware builder, affiliate panel, and data leak blog source code were leaked online, increasing the risk of further ransomware proliferation.
Fake Chrome Extensions: Over 100 malicious Chrome extensions have been discovered since February 2024, used to hijack browser sessions, steal credentials, and inject ads.

Trends, Tools, and Tactics

Service Desk Social Engineering: Attackers are increasingly targeting IT service desks with social engineering to bypass security controls (e.g., password resets, disabling MFA).
Novel Phishing Techniques: Recent phishing campaigns combine AES encryption with malicious npm packages to evade detection.
Supply Chain Threats: The RVTools incident highlights ongoing risks in software supply chains, with attackers distributing malware via compromised legitimate utilities.
Rise in Asia-based APTs: China and North Korea-aligned groups now account for over half of global APT attacks, with expanding international focus.
Exposure Management Enhancements: Tenable has added third-party connectors (AWS, Microsoft, competitors) to its platform for improved attack surface visibility.
Security Key Solutions: Yubico has expanded its YubiKey-as-a-Service globally, supporting hardware-based authentication in 175 countries.
AI Security Impacts: Increased adoption of AI agents is driving both new security opportunities and challenges, with most security leaders anticipating compliance and threat management implications.

Regulatory or Policy Developments

Genetic Data Privacy Concerns: Regeneron’s planned acquisition of 23andMe raises privacy concerns due to the lack of comprehensive federal regulation on genetic information transfers.