TikTok on DanSec Daily

Cybersecurity Brief – 2026-11-06

Fri, 06 Nov 2026 00:00:00 +0000

Major Incidents and Breaches

Update Chainalysis has removed customer access to its Reactor and Data Solutions products while it investigates the agentic attack. It says it still has no evidence that investigations data was accessed. (first reported 2026-10-31)^[1]
Attackers tampered with files used by the Windows launcher for the game Goddess of Victory: NIKKE, putting players’ passwords and personal files at risk. Players are being urged to check their PCs.^[2]
A French bank was reportedly hacked for $133 million.^[3]
A Cyber Monitoring Centre report estimated that an IT failure at UK air traffic services provider NATS cost the UK economy over £33 million.^[4]

Vulnerabilities and Patches

Update watchTowr published a technical analysis of the Barracuda Email Security Gateway chain, combining authorisation bypass CVE-2026-116606 and OS command injection CVE-2026-111560 for unauthenticated root, along with a detection tool but no exploit. No attacks have been reported. ESG is fixed in 9.4.0.030 and later; if patching is delayed, restrict the admin interface to trusted internal networks and re-enable automatic patching. (first reported 2026-11-03)^[5]^[6]
Update Alpine has published fixed openssh packages for releases back to 3.16 for the ‘*sshole’ long-password SSH authentication bypass, also included in point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4. sshd must be restarted after upgrading because the package update does not restart it. (first reported 2026-11-05)^[7]^[3]
Update OpenAI has patched the ChatGPT Lockdown Mode bypass, which allowed silent chat data theft without user interaction. (first reported 2026-11-05)^[8]

Threat Actor Activity

US prosecutors charged three men with using AI to impersonate CEOs and attorneys, often targeting company accounting departments, to steal $129 million.^[9]
Thai opposition figures were targeted with spyware.^[3]

Trends, Tools and Tactics

Microsoft Threat Intelligence observed threat actors using the agentic ARTEX framework to search GitHub for OAuth application secrets. AI agents then used the compromised OAuth applications to perform authenticated actions in the associated tenants.^[10]
Phishing campaigns are using fake OpenAI, SpaceX and Anthropic event invitations, delivered via two phishing-as-a-service platforms, to steal Microsoft and Google credentials and authentication sessions.^[11]
Truffle Security launched a free Secrets Revocation Program to help API key issuers revoke about 1.4 million publicly exposed secrets that remain valid.^[12]
Erroneous or outdated DNS records, including typos, leave some US government email systems open to abuse by attackers.^[13]
Fortra took down holiday rental phishing sites that copy popular rental platforms, including listings, host names and reviews, and use live chat to persuade hesitant travellers to hand over passwords, personal details and card numbers.^[14]
BlueFlag Security’s State of Developer Risk 2026 report found that 99% of repository access tokens never expire.^[15]
Vizio and Samsung smart TVs appear to continue tracking after users opt out.^[16]

Policy and Regulation

The US issued further sanctions against four people and 41 companies linked to Prince Group, the Cambodian company accused of running a billion-dollar scam operation.^[17]
Google, Meta and TikTok each filed federal lawsuits against an incoming California law that blocks platforms from deploying ‘psychologically exploitative’ features for children aged 15 and under.^[18]

Sources

Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services - thehackernews.com
NIKKE PC launcher compromise put players’ passwords and personal files at risk - malwarebytes.com
Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters - news.risky.biz
NATS Air Traffic Control Failure Cost UK Economy £33m - infosecurity-magazine.com
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login - thehackernews.com
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) - labs.watchtowr.com
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux - thehackernews.com
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction - thehackernews.com
3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million - securityweek.com
Threat actors use agentic AI tooling to find and abuse exposed secrets - microsoft.com
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts - bleepingcomputer.com
Nearly 1.5 million exposed secrets targeted in new revocation program - bleepingcomputer.com
US Government Email Systems Open to Abuse Thanks to Typos - darkreading.com
Rental phishing sites use live chat to win over hesitant travelers - helpnetsecurity.com
99% of repository access tokens never expire - helpnetsecurity.com
Vizio, Samsung smart TVs seem to ignore tracking opt outs - malwarebytes.com
US issues more sanctions against Prince Group scam center affiliates - therecord.media
Social media giants sue California to overturn law shielding kids 15 and under from compulsive use - therecord.media

Cybersecurity Brief – 2026-09-04

Fri, 04 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Data on approximately 8.8 million individuals was leaked following a ransomware incident involving Manchester Airports Group. The threat actor claims to have exfiltrated 550GB of data after the company reportedly refused to pay the ransom, with access gained via exposed admin keys ^[33].
Thomson Reuters disclosed that its C-Track court case management platform was breached in March 2026, potentially exposing Social Security numbers and sealed court data ^[9].
Coder’s Cloudflare infrastructure was compromised, enabling attackers to add unauthorized registry servers that distributed malicious Terraform modules containing credential-stealing code ^[12].
A French hospital, Hôpital privé de la Loire, was fined €500,000 by CNIL after a breach exposed data belonging to 727,000 patients and their relatives ^[11].
Over 440,000 exploit attempts have targeted critical remote code execution vulnerabilities in the WordPress plugins Super Forms and Elementor Pro, with attackers exploiting these flaws to deploy webshells and execute arbitrary commands on affected sites ^[2]^[17].
Researchers identified that free streaming boxes, specifically SuperBox devices, may be used to route criminal proxy traffic through users’ home networks via pre-installed apps ^[36].
StreamRat Android malware has infected an estimated 570,000 users through social media adverts on Meta and TikTok, enabling attackers to take control of compromised devices ^[37].
BraZetsu, a Python-based Windows malware framework, is being used to create an underground marketplace by turning compromised hosts into inventory for criminal access sales ^[8].

Newly Discovered Vulnerabilities

Google released updates to patch 12 vulnerabilities in Chrome, including a high-severity V8 zero-day (CVE-2026-85046) that has been actively exploited in the wild ^[4]^[10]^[32].
Cisco patched a critical flaw in Nexus 9000 switches running Silicon One, which could allow unauthenticated remote code execution as root ^[7].
HPE issued fixes for a critical remote code execution vulnerability in the ArubaOS-CX network operating system ^[13].
VMware Workstation and Fusion updates addressed critical vulnerabilities that could allow attackers with admin access to a VM to execute code on the host ^[31].
Plex released urgent updates to patch multiple undisclosed security flaws in Plex Media Server ^[3].
A 12-year-old PostgreSQL vulnerability (CVE-2026-6471, “PostGREShell”) was disclosed, allowing attackers with low-level replication access to achieve code execution, superuser privileges, and establish persistent backdoors ^[29].

Notable Threat Actor Activity

The Toy Ghouls group was found using new backdoors, one leveraging HiveMQ MQTT broker and another using the Matrix protocol for command and control ^[1].
The “Phantom Deal” campaign targets large enterprises with fake merger and acquisition scams, involving detailed reconnaissance to trick midlevel employees into authorizing large financial transfers ^[20].
ShinyHunters’ recent activities and claims of breaches remain under review, with ongoing discussion about their impact and legitimacy ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting OAuth and social engineering traps, such as phishing kits impersonating CEOs and IT staff, to compromise business accounts and bypass MFA ^[6]^[18].
AI-driven attack automation is accelerating breach timelines, with recent research showing that machine-speed agents can compress a two-week attack into ten hours ^[22].
Malicious actors are leveraging residential proxy networks via compromised consumer devices, expanding the footprint and persistence of criminal infrastructure ^[36].
Social media advertising is being used to distribute Android banking trojans at scale, as seen with StreamRat campaigns on Meta and TikTok ^[37].

Regulatory or Policy Developments Affecting the Security Industry

The French data protection regulator CNIL imposed a €500,000 fine on a hospital for inadequate data protection measures following a breach ^[11].

Sources

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal - securityweek.com
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data - thehackernews.com
Coder's registry infrastructure compromised to push malicious modules - bleepingcomputer.com
French hospital fined €500,000 after breach exposes data of 727,000 - bleepingcomputer.com
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws - thehackernews.com
Critical Elementor Pro flaw exploited to take over WordPress sites - bleepingcomputer.com
Free streaming boxes may be routing criminal traffic through your home - malwarebytes.com
StreamRat Android malware spreads through Meta and TikTok ads - malwarebytes.com
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory - thehackernews.com
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day - thehackernews.com
Google warns of new Chrome zero-day flaw exploited in attacks - bleepingcomputer.com
Google Patches 6th Chrome Zero-Day of 2026 - securityweek.com
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root - thehackernews.com
HPE patches critical ArubaOS-CX remote code execution flaw - bleepingcomputer.com
VMware Workstation and Fusion Updates Patch Critical Vulnerability - securityweek.com
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws - thehackernews.com
12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover - securityweek.com
Angry Birds: Toy Ghouls’ new toys - securelist.com
Large Enterprises Targeted in Fake Merger & Acquisition Scams - darkreading.com
What We Missed: Did ShinyHunters 'Breach' ReliaQuest? - darkreading.com
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories - thehackernews.com
Your Employee’s Password Appeared in an Infostealer Log. Now What? - bleepingcomputer.com
AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours - darkreading.com

Cybersecurity Brief – 2026-08-25

Tue, 25 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Iran-linked hackers were responsible for shutting down a UK power plant for four days, causing significant operational disruption and raising concerns about the resilience of the UK’s distributed energy infrastructure ^[35].
Apollo Global, a private equity firm, experienced a data breach that exposed personal information as part of a campaign targeting major financial companies ^[33].
ReliaQuest confirmed that an employee was targeted in a phishing attack following the ShinyHunters breach. Attackers gained access to a dashboard, but the impact was limited and no data theft occurred ^[15]^[28].
A breach at South Korea’s government-backed startup platform exposed encrypted personal data due to an encryption key being included in an API, highlighting key management failures ^[17].

Newly Discovered Vulnerabilities

A maximum-severity vulnerability (CVE-2026-21962) in Oracle HTTP Server and Oracle WebLogic Server is being actively exploited, allowing unauthenticated attackers to access critical data. CISA has added the flaw to its Known Exploited Vulnerabilities catalog ^[3]^[27].
The Zimbra Collaboration Suite is affected by an actively exploited vulnerability (CVE-2026-73570) that allows full takeover of user communications. CISA has mandated a three-day patch deadline for US government agencies ^[19]^[21].
Red Hat and the Keycloak project patched a critical password reset flaw that could allow unauthenticated remote attackers to take over any account on the open-source identity and access management server ^[8].
Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress are being targeted by attackers, enabling the forging of SAML responses and unauthorized admin access ^[13].
An unpatched flaw in Calix GS7 XGS (GS5239XG) residential routers allows remote attackers to bypass NAT and expose internal devices by creating port-forwarding rules ^[12].
The Spring Application Framework has received patches for 91 vulnerabilities, with more than 200 vulnerabilities patched so far this year, compared to 16 in 2025 and 22 in 2024 ^[31].

Notable Threat Actor Activity

The Chinese-speaking cybercrime group UAT-10147 is targeting Windows and Linux web servers globally across education, media, technology, and government sectors. The group uses AI to scale attacks, deploys SPECTRE malware with EDR bypass, and leverages a Linux rootkit ^[11].
Operation QUICSILVER is a cyber espionage campaign targeting Myanmar government and IT sectors using graduation ceremony invitation lures to deliver a Go-based backdoor called QUICAgent ^[9].
Threat actors are distributing the Weedhack malware to gamers by disguising it as fake Minecraft clients and leveraging SEO poisoning ^[5].
Multiple campaigns are using new malware families, including WordlistLoader and SynkLoader, to deliver infostealers and steal Windows credentials. These tools are being used to sell access to ransomware groups and employ techniques such as screen hijacking ^[7]^[22]^[23].

Trends, Tools, or Tactics of Interest

AI chatbots have been shown to be more effective than human scammers at building trust in social engineering attacks, particularly in romance scam scenarios ^[1].
AI-enabled social engineering is increasing the effectiveness of attacks, accounting for over 85 percent of cyber insurance losses in the first half of the year ^[2].
The rapid adoption of AI coding tools is increasing remediation debt as more code is shipped than can be effectively secured ^[4].
Only a small percentage of AI users present disproportionate security risks, particularly those using advanced AI tools for custom development and automation ^[10].
AI is accelerating vulnerability discovery, outpacing the rate of remediation, and tightening the window between disclosure and exploitation ^[25]^[34].
Malware campaigns are leveraging trending topics and fake software downloads, such as fake GTA 6 demo sites, to distribute infostealers targeting browser-stored credentials ^[39].
Fake Microsoft security scans are being used to trick victims into uninstalling antivirus software, facilitating refund scams ^[40].
The latest version of the ToxicPanda Android banking trojan has expanded capabilities to seize control of infected devices, block access to Google Play, and threaten enterprise environments ^[24]^[43].
AliExpress was found using silent audio processing as a browser fingerprinting technique, bypassing traditional cookie-based tracking ^[42].

Regulatory or Policy Developments Affecting the Security Industry

TikTok, ByteDance, and affiliates reached a $400 million settlement with the US Department of Justice over alleged violations of the Children’s Online Privacy Protection Act (COPPA) ^[14]^[36].
The Dutch Data Protection Authority fined Uber nearly $1 billion for violations of the EU’s General Data Protection Regulation related to automated suspensions of driver accounts ^[30].
Microsoft Teams introduced a policy allowing administrators to block all identified external bots from joining meetings, enhancing meeting security ^[16].

Sources

Iran-Linked Hackers Shut Down UK Power Plant for Four Days - securityweek.com
Personal Information Exposed in Apollo Global Data Breach - securityweek.com
ReliaQuest confirms failed data-theft attack after ShinyHunters breach - bleepingcomputer.com
ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited - securityweek.com
South Korean startup platform breach exposes key management failures - bleepingcomputer.com
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data - thehackernews.com
CISA Warns of Exploited Oracle WebLogic Vulnerability - securityweek.com
CISA orders urgent patching of actively exploited Zimbra flaw - bleepingcomputer.com
Exploited Zimbra Flaw Highlights Shrinking Window to Patch - darkreading.com
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account - thehackernews.com
Hackers target WordPress sites in miniOrange auth bypass attacks - bleepingcomputer.com
Unpatched Calix flaw lets hackers bypass NAT to expose internal devices - bleepingcomputer.com
91 Vulnerabilities Patched in Spring Application Framework - securityweek.com
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit - thehackernews.com
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor - thehackernews.com
Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning - thehackernews.com
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords - thehackernews.com
Foul Language: WordlistLoader Disguises Malware as Ordinary Text - darkreading.com
Tricky 'SynkLoader' Multitool May Herald Ransomware - darkreading.com
Report: AI Chatbots Are More Effective at Building Trust Than Human Scammers - blog.knowbe4.com
Human Error Remains at the Core of AI-Enabled Social Engineering - blog.knowbe4.com
Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt - thehackernews.com
The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk - thehackernews.com
The Vulnerability Gap: Why Discovery Is Outrunning Repair - darkreading.com
Rethinking Application Security for the AI Era - securityweek.com
Fake GTA 6 Extended Look and demo sites deliver an infostealer - malwarebytes.com
Fake Microsoft security scans trick victims into uninstalling their antivirus - malwarebytes.com
ToxicPanda Banking Trojan Matures Into Enterprise Threat - darkreading.com
ToxicPanda 2.0 can take over your Android phone and banking apps - malwarebytes.com
AliExpress caught using silent audio to fingerprint visitors’ browsers - malwarebytes.com
TikTok reaches $400M settlement with US over COPPA violations - bleepingcomputer.com
TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy - securityweek.com
Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts - securityweek.com
Microsoft Teams now lets admins block external bots from meetings - bleepingcomputer.com

Cybersecurity Brief – 2026-08-23

Sun, 23 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

A supply-chain attack has compromised Android-based car head units by leveraging a legitimate device-update application to distribute malware. The infected devices are conscripted into a proxy botnet or used for ad fraud operations ^[2].

Newly Discovered Vulnerabilities

Weak access controls on Windows named pipes have been highlighted as a security risk, with the potential for untrusted processes to access privileged services if proper endpoint verification and command authentication are not enforced ^[3].

Notable Threat Actor Activity

Active campaigns involving banking trojans have been observed, including the spyware-equipped Manic trojan, a persistent Grandoreiro campaign targeting Latin America and Europe, and an expanded deployment of ToxicPanda 2.0 malware ^[5].

Regulatory or Policy Developments Affecting the Security Industry

TikTok has agreed to pay a $400 million settlement to resolve a US Department of Justice lawsuit alleging violations of child privacy laws in the United States ^[1].

Sources

Hackers infect Android car head units with proxy botnet malware - bleepingcomputer.com
Named Pipes Under Attack: Securing Windows Interprocess Communication - bleepingcomputer.com
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight - securityweek.com
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit - thehackernews.com

Cybersecurity Brief – 2026-08-14

Fri, 14 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users ^[12]^[20].
A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer ^[4].
Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals ^[5].
The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations ^[8]^[17].
Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash ^[6].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to deploy reverse SSH tools, providing attackers persistence and remote access. The vulnerability is the subject of a global threat campaign, and patching alone may not fully mitigate the threat ^[11]^[16]^[29].
An unpatched SQL injection vulnerability in GeoServer is being exploited in the wild, allowing attackers to achieve remote code execution ^[21].
WordPress 7.0.4 patched a remote code execution vulnerability that could be exploited by users with Author-level or higher permissions via malicious Postscript files ^[25].
Adobe Commerce released a patch for CVE-2026-71362, a vulnerability that saw exploitation attempts immediately after disclosure ^[24].
Fortinet released patches for authentication flaws in FortiWeb and FortiManager that could allow attackers to log in with arbitrary credentials or impersonate FortiGate appliances ^[27].
Microsoft patched the LegacyHive Windows zero-day vulnerability, which was disclosed after the July 2026 Patch Tuesday ^[9].

Notable Threat Actor Activity

The Iran-linked APT42 group is conducting AI-assisted spear phishing campaigns targeting US organizations, leveraging artificial intelligence to enhance the effectiveness of their attacks ^[3].
Akira ransomware affiliates have been observed disabling endpoint detection and response (EDR) by rebooting compromised systems into Safe Mode with Networking, enabling data theft even when encryption fails ^[7].
Initial access brokers are using vishing (voice phishing) attacks through Microsoft Teams to gain entry for ransomware gangs ^[2].
The Jewelbug group is simultaneously engaged in state espionage and financially motivated cybercrime, including cryptocurrency theft ^[8]^[17].

Trends, Tools, or Tactics of Interest

The rise of “Shadow AI” is being identified as a new dimension of Shadow IT, with employees using unapproved AI tools and services in the workplace, increasing organizational risk ^[1].
AI coding tools are introducing unvetted or hallucinated open source dependencies at a pace that exceeds current security review capabilities, raising supply chain risks ^[13].
Multiple “AI watermark remover” tools have appeared online following the introduction of watermarking in Anthropic’s Claude model, though most cannot reliably remove watermarks, highlighting rapid attempts to circumvent AI content authenticity measures ^[10].
AmnesiaStealer, a Rust-based macOS infostealer, is capable of harvesting passwords, keychain data, browser information, and cookies, expanding the threat landscape for macOS users ^[22].
New Android malware combines social engineering, a remote access trojan, and NFC relay capabilities to enable real-time fraudulent use of victims’ bank cards ^[31].
WhatsApp has rolled out a “Scam Alert” feature using a local machine learning model to flag potential scam messages for users ^[15].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued a memo instructing the National Coordination Center to establish a program allowing private security companies to apply for approval to conduct offensive hack-back operations against foreign cybercrime gangs. Contracts may require a $1 million bond to ensure compliance with operational requirements ^[14]^[28].
Over 3,000 lawsuits have been filed by parents against Meta, TikTok, Google, and Snap, challenging the design of social media platforms and their impact on youth safety ^[32].

Sources

Trezor discloses data breach affecting nearly 14,000 customers - bleepingcomputer.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - bleepingcomputer.com
Hackers breach govt webmail while running parallel crypto fraud - bleepingcomputer.com
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading.com
Ukraine shuts down 94 fraudulent call centers, seize millions in cash - bleepingcomputer.com
Critical VMware vCenter RCE flaw exploited for reverse SSH access - bleepingcomputer.com
Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading.com
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs - securityweek.com
Hackers Exploiting Unpatched GeoServer Zero-Day - securityweek.com
WordPress 7.0.4 Patches Remote Code Execution Vulnerability - securityweek.com
Adobe Commerce Bug Targeted Immediately After Disclosure - securityweek.com
Fortinet Patches Authentication Flaws in FortiWeb and FortiManager - securityweek.com
Microsoft patches LegacyHive Windows zero-day vulnerability - bleepingcomputer.com
Iranian APT Launches AI-Assisted Spear Phishing Attacks - blog.knowbe4.com
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - bleepingcomputer.com
Warning: Vishing Attacks Open the Door to Ransomware Gangs - blog.knowbe4.com
Shadow AI: The New Frontier of Shadow IT - blog.knowbe4.com
Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion - bleepingcomputer.com
AI 'watermark removers' flood the web. Almost none can prove they work. - bleepingcomputer.com
AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions - securityweek.com
New Android malware lets criminals use your bank card in real time - malwarebytes.com
WhatsApp rolls out new feature that flags potential scam messages - bleepingcomputer.com
White House taps security firms for offensive hack-back operations - bleepingcomputer.com
White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - securityweek.com
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits - malwarebytes.com

Cybersecurity Brief – 2026-03-28

Sat, 28 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

The European Commission is investigating a security breach after a threat actor gained access to its Amazon cloud environment.
The Dutch National Police disclosed a security breach resulting from a successful phishing attack; the impact is described as limited and did not affect citizens’ data.
A pro-Iranian hacking group claimed responsibility for breaching the personal email account of FBI Director Kash Patel, releasing emails and documents.
Bearlyfy, a pro-Ukrainian group, has conducted over 70 cyberattacks targeting Russian companies since January 2025, recently deploying custom GenieLocker ransomware.
TeamPCP compromised the Telnyx Python package on PyPI, pushing malicious versions that deliver credential-stealing malware hidden in WAV files as part of an ongoing supply chain campaign.
Developers on GitHub are being targeted by a large-scale campaign using fake Visual Studio Code (VS Code) security alerts to spread malware.
Apple is sending Lock Screen alerts to iPhones and iPads running outdated iOS/iPadOS versions, warning of active web-based exploits and urging immediate updates.
The Alliance for Creativity and Entertainment (ACE) announced the shutdown of AnimePlay, an illegal streaming platform with over 5 million users.

Newly Discovered Vulnerabilities

CISA added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager (APM), to its Known Exploited Vulnerabilities (KEV) catalogue after reports of active exploitation.
A now-patched bug in Open VSX’s pre-publish scanning pipeline allowed malicious VS Code extensions to bypass security checks.
Three vulnerabilities in the widely used AI frameworks LangChain and LangGraph could expose filesystem data, environment secrets, and database contents if exploited.
TP-Link patched high-severity router vulnerabilities that could allow attackers to bypass authentication, execute arbitrary commands, and decrypt configuration files.
A critical PTC Windchill vulnerability (CVE-2026-4681) prompted German police to physically warn organizations due to the risk.
Coruna iOS Exploit Kit, likely an update to Operation Triangulation, contains an updated kernel exploit targeting iOS devices.

Notable Threat Actor Activity

TA446, a threat actor linked to Russia, is leveraging the leaked DarkSword iOS exploit kit in targeted spear-phishing campaigns against iOS devices.
TeamPCP continues its supply chain attack campaign, recently compromising the telnyx PyPI package and previously targeting Trivy, KICS, and litellm.
Chinese APT group Red Menshen has upgraded its BPFdoor backdoor malware, improving its capabilities to evade traditional detection and targeting global telecommunications providers.
Threat actors are using adversary-in-the-middle (AitM) phishing techniques with Cloudflare Turnstile evasion to compromise TikTok for Business accounts.
Criminals are renting virtual phones to bypass bank security checks, enabling them to circumvent fraud detection systems.
A fake Avast website is distributing Venom Stealer malware under the guise of a virus scan, stealing passwords, session data, and cryptocurrency wallets.

Trends, Tools, or Tactics of Interest

Researchers at LayerX demonstrated that custom fonts can be used to trick AI web assistants into misclassifying phishing sites as benign, while presenting a deceptive view to human users.
Adaptive email security solutions are being highlighted as necessary to counter increasingly sophisticated, AI-driven phishing attacks that mimic executive communications and reference specific projects.
Wartime exploitation of compromised IP cameras by multiple nation-states is increasing, providing adversaries with surveillance capabilities inside rival borders.
There is a 25% decrease in infrastructure attacks with physical consequences, attributed to a lull in ransomware activity and limited attacker knowledge of operational technology (OT) systems.
Large-scale use of fake security alerts on developer platforms (e.g., GitHub) is being used to distribute malware to software development communities.
Agentic GRC (Governance, Risk, and Compliance) automation is driving a shift in team roles from operational execution to risk leadership.

Regulatory or Policy Developments

Google has set a 2029 deadline for migration to quantum-safe (post-quantum) cryptography across its services.
OpenAI launched a bug bounty program, offering rewards for reports of abuse and safety risks, including design and implementation flaws that could cause material harm.

Cybersecurity Brief – 2026-03-27

Fri, 27 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Hightower Holding Data Breach: Hightower Holding disclosed a data breach impacting 130,000 individuals. Attackers stole names, Social Security numbers, and driver’s license numbers.
Ajax Football Club Hack: Ajax Amsterdam reported a breach in which a hacker exploited IT system vulnerabilities, accessing data of several hundred fans and enabling ticket hijacking.
TeamPCP Supply Chain Attack: The TeamPCP supply chain campaign has expanded in scope, now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Detection tools are available.
LiteLLM Supply Chain Attack: A supply-chain attack on LiteLLM, a gateway used in AI agents, was dissected, highlighting the presence of malicious code designed to steal data.
GlassWorm Attack: The GlassWorm attack campaign installs a fake browser extension for surveillance, hiding inside developer tools and enabling data theft and potential supply chain spread.

Newly Discovered Vulnerabilities

Langflow (CVE-2026-33017): CISA warned of active exploitation of a critical code injection vulnerability in the Langflow AI framework, allowing attackers to hijack AI workflows.
Claude Chrome Extension: Researchers disclosed a vulnerability in Anthropic’s Claude Chrome extension, enabling zero-click XSS prompt injection via any website visited by the user.
BIND: High-severity vulnerabilities in BIND resolvers were patched, addressing out-of-memory conditions and memory leaks triggered by specially crafted domains.
Cisco IOS Software: Multiple high- and medium-severity vulnerabilities patched, including issues leading to denial-of-service, secure boot bypass, information disclosure, and privilege escalation.

Notable Threat Actor Activity

Coruna iOS Exploit Kit: The Coruna exploit kit, an evolution of the framework used in the Operation Triangulation espionage campaign, reuses and updates kernel exploits (CVE-2023-32434, CVE-2023-38606) to target iPhones via zero-click iMessage attacks.
Red Menshen (China-linked): This state-sponsored group has conducted a long-term espionage campaign against telecom and government networks, deploying stealthy BPFDoor implants for persistent access and surveillance within backbone infrastructure.
LeakBase Forum: Russian authorities arrested an individual suspected of owning/administering LeakBase, a major cybercrime forum for trading stolen data and hacking tools.
RedLine Infostealer: An Armenian suspect, alleged administrator of the RedLine infostealer malware operation, was extradited to the US to face charges related to managing the malware.
Infiniti Stealer (macOS): A new macOS infostealer, Infiniti Stealer (formerly NukeChain), uses fake CAPTCHA pages to trick users into running malicious Python/Nuitka-based commands.
TikTok for Business Phishing: Threat actors are targeting TikTok for Business accounts in a phishing campaign that evades security bots and attempts credential theft.

Trends, Tools, or Tactics of Interest

AI-Related Threats:
- Attackers are exploiting vulnerabilities in AI-related platforms (Langflow, LiteLLM, Claude extension).
- Researchers demonstrated that AI assistants (e.g., Copilot) can be manipulated to display phishing messages and leak internal information.
- AI-powered dependency management tools have been found to introduce or overlook security bugs due to model hallucinations or errors in recommending software versions.
Phishing and Social Engineering:
- Scammers are abusing Google Calendar invites to deliver phishing subscription renewal notices, using embedded phone numbers for social engineering.
- Multi-stage fraud attacks are increasingly chaining bots, proxies, and stolen credentials to escalate from signup to account takeover.
Supply Chain Risks:
- Attacks like TeamPCP and GlassWorm highlight ongoing concerns about the integrity of software supply chains and dependencies.
Automotive Cybersecurity:
- Reports indicate a growing threat landscape for connected and autonomous vehicles, with persistent vulnerabilities since the 2015 Jeep hack.
Global Spyware Market:
- Third-party intermediaries are facilitating the expansion of the spyware market worldwide, circumventing government restrictions and transparency efforts.

Regulatory or Policy Developments

UK Sanctions on Xinbi Marketplace: The UK Foreign, Commonwealth and Development Office sanctioned Xinbi, a Chinese-language cryptocurrency-based marketplace linked to Asian scam centers and the sale of stolen data and illicit services.
Dell and HP Quantum-Resistant Security: Dell and HP announced the rollout of quantum-resistant security capabilities for PCs and printers, enhancing device resilience against future quantum computing threats.
FCC Router Ban: The US Federal Communications Commission added certain foreign-made consumer routers to its list of prohibited communications devices, aiming to mitigate supply chain risks.
Meta Platform Litigation: Courts are issuing landmark verdicts scrutinising the design and addictive nature of Meta’s social media platforms, not just user-generated content.

Cybersecurity Brief – 2026-02-23

Mon, 23 Feb 2026 00:00:00 +0000

Notable Threat Actor Activity

Arkanix Stealer, an information-stealing malware, emerged as a short-lived operation promoted on dark web forums towards the end of 2025. The malware was likely developed as an AI-assisted experiment, indicating ongoing interest in leveraging AI for cybercrime. The operation appears to have been discontinued, but demonstrates the continued experimentation with AI-driven infostealers by threat actors.

Trends, Tools, or Tactics of Interest

Cybercriminals are increasingly employing advanced phishing techniques, including text-based attacks using social engineering and highly targeted spear phishing. The evolving tactics highlight the adaptation of threat actors to bypass traditional email security solutions.
There is a growing comparison between Integrated Cloud Email Security (ICES) solutions and Secure Email Gateways (SEG), with emphasis on the need for organisations to evaluate their email security posture in response to evolving phishing threats.

Regulatory or Policy Developments Affecting the Security Industry

TikTok has introduced new rules following its transition to American ownership. The updated content policies may affect the way security and privacy issues are discussed and disseminated on the platform, potentially impacting threat intelligence sharing and public awareness campaigns.

Cybersecurity Brief – 2026-02-07

Sat, 07 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Flickr has disclosed a potential data breach caused by a vulnerability at a third-party email service provider, exposing users’ real names, email addresses, IP addresses, and activity data.
An Illinois man has pleaded guilty to hacking nearly 600 women’s Snapchat accounts to steal, sell, or trade private photos.
Compromised npm and PyPI packages associated with dYdX have been used to deliver wallet stealers and remote access trojans (RATs) in a new software supply chain attack.
Germany’s domestic intelligence agency has warned of suspected state-sponsored phishing attacks targeting high-ranking individuals via the Signal messaging app.

Newly Discovered Vulnerabilities

CISA has issued a warning about CVE-2026-24423, an unauthenticated remote code execution vulnerability in SmarterMail, which has been exploited in ransomware attacks.
Security researchers have identified multiple insecurities in the OpenClaw AI assistant, including vulnerabilities related to malicious add-ons (“skills”) and problematic configuration settings.
ESET product vulnerabilities were noted in a roundup of recent security issues, though specific details were not provided.

Notable Threat Actor Activity

A previously undocumented Asian state-backed group, tracked as TGR-STA-1030, has breached at least 70 government and critical infrastructure entities across 37 countries over the past year in a cyber espionage campaign.
China-linked threat actors have been operating the DKnife adversary-in-the-middle (AitM) framework since at least 2019, targeting routers and edge devices for traffic hijacking and malware delivery in espionage campaigns.
State-sponsored threat actors are suspected in the recent phishing campaign targeting senior figures in Germany via Signal.

Trends, Tools, or Tactics of Interest

A new malware-as-a-service kit called “Stanley” is offering guaranteed publication in the Chrome Web Store by bypassing Google’s security verification process.
Supply chain attacks continue to pose significant risk, as seen in the compromise of npm and PyPI packages and recent incidents involving self-propagating worms.
Modern browser-based attacks are increasingly able to evade detection by traditional EDR, email, and SASE solutions, operating entirely within the browser with minimal forensic evidence.
Apple Pay users are being targeted by phishing campaigns involving fake support calls designed to steal payment details.
Research highlights that attackers are evolving tradecraft to leverage AI assistants and agents in malicious operations (“living off the AI”).

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring federal agencies to identify and remove unsupported or end-of-life network edge devices to reduce federal network risk.
Five bills aimed at boosting cybersecurity defenses for the U.S. energy sector have cleared a House panel.
The European Commission has announced that TikTok is facing a large fine for addictive platform design elements that may violate regulatory standards.
The Electronic Frontier Foundation has launched the “Encrypt It Already” campaign, urging major technology companies to implement end-to-end encryption by default across their services.

Cybersecurity Brief – 2026-01-31

Sat, 31 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

CERT Polska reported coordinated cyber attacks on over 30 wind and solar farms, as well as a private manufacturing company, in Poland. Related reporting attributes a Russia-linked threat actor (Sandworm/Electrum) as responsible for these intrusions, which resulted in bricked ICS devices at 30 sites affecting communication and control systems in the Polish power grid.
ShinyHunters ransomware group claimed breaches of Match Group dating platforms (Match, Hinge, OkCupid) and Panera Bread, allegedly stealing millions of user records.
Illegal cryptocurrency flows reached $158 billion in 2025, marking a record high after several years of decline.
Researchers identified malicious Google Chrome extensions capable of hijacking affiliate links, stealing data, and collecting OpenAI ChatGPT authentication tokens.
Android users were targeted with a remote access trojan (RAT) delivered via malicious applications hosted on Hugging Face repositories.
Over 175,000 exposed Ollama AI model hosts were identified, with 23,000 persistently active, posing risks of LLM abuse.

Newly Discovered Vulnerabilities

Ivanti released patches for critical-severity, actively exploited zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, which allowed unauthenticated remote code execution.
Microsoft fixed a bug in Microsoft 365 Outlook that prevented users from accessing encrypted emails in classic Outlook.
The Windows 11 KB5074105 update addressed multiple issues, including boot, sign-in, and activation failures.

Notable Threat Actor Activity

China-linked threat actor UAT-8099 was observed targeting IIS servers in Asia with the BadIIS SEO malware campaign between late 2025 and early 2026. The campaign focused on search engine manipulation through server compromise.
Sandworm/Electrum, a Russia-linked group, was attributed to the bricking of ICS devices during coordinated attacks on Polish energy infrastructure.

Trends, Tools, or Tactics of Interest

Agentic AI and autonomous AI assistants such as OpenClaw (ClawdBot, MoltBot) are increasingly present in business environments, raising concerns about privileged, autonomous control and the expanding attack surface.
Security researchers noted increased abuse of Google Presentations for phishing campaigns targeting webmail users.
The Tenable One AI Exposure add-on was introduced to discover unsanctioned AI use within organizations and enforce compliance with approved AI tools.
Aisy launched an AI-assisted vulnerability management platform after emerging from stealth with $2.3 million in seed funding.

Regulatory or Policy Developments

Microsoft announced plans to disable the legacy NTLM authentication protocol by default in future Windows releases, citing security vulnerabilities.
The White House revoked two Biden-era memorandums related to software security rules, although some associated resources remain available for government use.
TikTok updated its privacy policy to explicitly reference immigration status in user data, drawing public attention and scrutiny.

Cybersecurity Brief – 2026-01-28

Wed, 28 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for Office zero-day vulnerability CVE-2026-21509, which is actively exploited to bypass security features through malicious Office files.
Fortinet patched a critical authentication bypass vulnerability in FortiOS/FortiCloud SSO (CVE-2026-24858) after reports of active exploitation in the wild.
A critical remote code execution vulnerability has been disclosed in Grist-Core, an open-source spreadsheet-database platform, exploitable via spreadsheet formulas.
A critical sandbox escape flaw (CVE-2026-22709) was found in the vm2 Node.js library, allowing arbitrary code execution on host systems.
OpenSSL patched 12 vulnerabilities, including a high-severity remote code execution flaw.
‘PackageGate’ vulnerabilities in the JavaScript ecosystem allow bypassing NPM supply chain attack protections, leading to arbitrary code execution.
A critical Telnet server flaw exposes legacy and IoT systems to unauthenticated remote access and shell control.
Linux vulnerabilities are being actively exploited, enabling attackers to obtain root privileges or bypass authentication via Telnet.

Notable Threat Actor Activity

The HoneyMyte (aka Mustang Panda/Bronze President) APT group has updated its CoolClient backdoor and is deploying multiple infostealers, including three browser data stealer variants and clipboard monitoring tools, in recent campaigns.
China-aligned APT actors have been using a JScript-based command-and-control (C2) framework called PeckBirdy since 2023 to target multiple environments.
Pakistan-linked threat actors have conducted two cyber campaigns against Indian government entities using previously undocumented techniques.
The ShinyHunters group is running a large-scale phishing campaign targeting over 100 organizations with credential harvesting domains.
The World Leaks ransomware/extortion group claims responsibility for the Nike data breach and has published stolen data to pressure the victim.
Multiple threat actors continue to exploit the WinRAR CVE-2025-8088 vulnerability for initial access and malware deployment.
The ‘Stanley’ malware-as-a-service toolkit enables malicious Chrome extensions to overlay phishing content on legitimate websites without altering the visible URL.
A new ransomware strain, ‘Sicarii’, has emerged, featuring poor code quality and a possible false-flag Hebrew identity, and currently cannot be decrypted.

Trends, Tools, or Tactics of Interest

Attackers are increasingly weaponizing trusted Remote Monitoring and Management (RMM) tools to establish persistent backdoor access in victim networks.
Recent phishing campaigns are leveraging fake CAPTCHAs, Microsoft App-V scripts, and trusted web services to distribute infostealers (ClickFix-style attacks).
Modern ransomware operations are shifting from pure encryption to psychological extortion, leveraging stolen data and exposure threats to increase pressure on victims.
AI-generated data degradation (“model collapse”) is raising concerns about accuracy, malicious activity propagation, and PII protection in zero-trust environments.
Browser extensions are being used as undetectable phishing vectors, with malicious overlays on legitimate sites while maintaining the original URL.
Supply chain vulnerabilities in JavaScript/NPM environments remain a critical risk, with new bypass techniques emerging.
The exposure and exploitation of legacy protocols such as Telnet continue to present significant attack surfaces, especially in IoT and OT environments.

Regulatory or Policy Developments Affecting the Security Industry

Meta (WhatsApp) has introduced a ‘Strict Account Settings’ security mode to protect high-risk users from spyware and advanced cyber attacks, similar to Apple’s Lockdown Mode.
Criticism has been raised regarding MITRE’s management of the CVE vulnerability database, with calls to transfer oversight to the private sector for improved efficiency.
TikTok has narrowly avoided a US ban by forming a new American joint venture, impacting data governance and regulatory oversight for the platform in the US.

Cybersecurity Brief – 2026-01-27

Tue, 27 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Crunchbase has confirmed a data breach following hacking claims. The incident is linked to the ShinyHunters group, which also targeted SoundCloud and Betterment.
A failed cyberattack on the Polish power grid has been attributed to the Russian APT group Sandworm. The attack involved the deployment of data-wiping malware but did not result in significant disruption.
Nearly 800,000 Telnet servers have been found exposed to remote attacks due to a critical authentication bypass vulnerability in GNU InetUtils, with ongoing exploitation attempts observed.
Cloudflare experienced a 25-minute BGP route leak affecting IPv6 traffic due to internal misconfiguration, causing congestion, packet loss, and approximately 12 Gbps of traffic disruption.

Newly Discovered Vulnerabilities

Microsoft has patched an actively exploited Office zero-day vulnerability rated as high severity.
Over 20 vulnerabilities were identified and patched in Dormakaba physical access control systems, which could have allowed attackers to unlock doors at major European firms.
CISA has reported active exploitation of a critical VMware vCenter Server remote code execution vulnerability, mandating U.S. federal agencies to secure their servers within three weeks.
The npm package manager’s Shai-Hulud supply-chain defenses can be bypassed via Git dependencies, exposing users to potential malicious package installations.

Notable Threat Actor Activity

The North Korean Konni group has been observed targeting blockchain developers and engineering teams with a new AI-generated PowerShell backdoor, aiming to compromise development environments and cryptocurrency assets.
A campaign targeting Indian users with tax-themed phishing emails is delivering the Blackmoon malware as part of a suspected cyber espionage operation.
The Russian Sandworm APT group is confirmed to have attempted a wiper attack on Poland’s power grid.
The ShinyHunters group has claimed responsibility for the Crunchbase data breach.
The Kimwolf botnet operators reportedly compromised the control panel of the Badbox 2.0 botnet, which has infected over 2 million devices.

Trends, Tools, or Tactics of Interest

Two malicious Visual Studio Code extensions, posing as AI-powered coding assistants, were discovered stealing developer source code. The extensions had over 1.5 million installs.
The ‘Stanley’ malware-as-a-service toolkit is being marketed on cybercrime forums for $2,000–$6,000, offering phishing Chrome extensions that can bypass Google’s review and be published on the Chrome Web Store.
New attacks are leveraging the ClickFix method combined with fake CAPTCHA prompts and signed Microsoft App-V scripts to deliver the Amatera infostealer malware.
Offensive AI techniques are increasingly used by threat actors, including AI-generated malware and backdoors, complicating detection and response efforts.
Deepfake ‘nudify’ technology is becoming more advanced and accessible, increasing the risk and impact of sexual image abuse.
Threat actors are exploiting misconfigurations in Okta deployments, with security researchers highlighting six commonly overlooked settings that weaken identity security.

Regulatory or Policy Developments

The European Commission has launched an investigation into X (formerly Twitter) to determine if the company properly assessed risks before deploying its Grok AI tool, following incidents involving the generation of sexually explicit images.
TikTok has finalized a deal to create a new American entity, averting a potential ban in the United States.

Cybersecurity Brief – 2025-10-20

Mon, 20 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

China’s Ministry of State Security (MSS) has accused the US National Security Agency (NSA) of conducting a multi-stage cyberattack against the National Time Service Center (NTSC) in Beijing. The MSS claims the NSA used 42 different cyber tools and exploited vulnerabilities in the messaging services of a foreign mobile phone brand to steal sensitive information.
Experian Netherlands has been fined €2.7 million ($3.2 million) for violations of the General Data Protection Regulation (GDPR) related to the mass collection of personal data.

Notable Threat Actor Activity

Cybercriminals are leveraging TikTok videos disguised as free activation guides for popular software (including Windows, Spotify, and Netflix) to distribute information-stealing malware as part of ongoing ClickFix attacks.

Trends, Tools, or Tactics of Interest

Recent malware samples have demonstrated the use of direct syscall() invocation for obfuscation and fileless activity, bypassing traditional detection mechanisms by avoiding standard API calls and making analysis more difficult.

Regulatory or Policy Developments

The €2.7 million GDPR fine against Experian Netherlands highlights ongoing regulatory enforcement actions against improper data collection practices within the EU.

Cybersecurity Brief – 2025-10-16

Thu, 16 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a significant breach attributed to nation-state actors, resulting in the theft of BIG-IP source code, undisclosed security vulnerabilities, and some customer information. The attack profile suggests Chinese involvement. Patches for stolen vulnerabilities have been released, and CISA has issued an emergency directive regarding F5 devices.
Capita has been fined £14 million by the UK Information Commissioner’s Office for a 2023 data breach that exposed personal data of 6.6 million people.
Harvard University suffered a breach via an Oracle zero-day exploit, with the Clop ransomware group claiming responsibility as part of a broader campaign targeting Oracle customers.
Spanish retailer MANGO disclosed a data breach affecting customer information, resulting from a compromise at a marketing vendor.
A 19-year-old individual was sentenced to four years in prison for orchestrating a major cyberattack on PowerSchool in December 2024.
Over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, creating supply chain risks by allowing attackers to update extensions maliciously.
Discord named customer service firm 5CA as the third-party responsible for a data breach; 5CA denies involvement.
Scientists reported ongoing leakage of unencrypted voice calls and text messages from geostationary satellites, exposing sensitive personal and business data.

Newly Discovered Vulnerabilities

Microsoft released fixes for 183 security flaws, including two new zero-days actively exploited in the wild-one affecting every version of Windows ever shipped.
A critical vulnerability in Adobe Experience Manager, rated CVSS 10.0, is under active attack and has been added to CISA’s Known Exploited Vulnerabilities catalog.
F5 released security updates for BIG-IP vulnerabilities compromised during the recent breach.
High-severity vulnerabilities have been patched by Fortinet and Ivanti in their October 2025 Patch Tuesday updates.
Siemens, Schneider, Rockwell, ABB, and Phoenix Contact published over 20 advisories addressing vulnerabilities in their industrial control systems (ICS).
Microsoft confirmed that September 2025 Windows Server updates are causing Active Directory issues on Windows Server 2025 systems.

Notable Threat Actor Activity

The Mysterious Elephant APT group has intensified operations, targeting government and diplomatic entities in South Asia with custom tools such as BabShell and MemLoader HidenDesk, and exfiltrating WhatsApp-related data.
Chinese threat group ‘Jewelbug’ conducted a five-month-long intrusion into a Russian IT service provider, indicating geographic expansion beyond Southeast Asia.
Clop ransomware group claimed responsibility for the Harvard University breach as part of a campaign exploiting Oracle zero-day vulnerabilities.
A new banking trojan, Maverick, was distributed at scale in Brazil via malicious LNK files sent over WhatsApp. The malware shares code with Coyote.
Ongoing phishing campaigns are targeting LastPass and Bitwarden users with fake breach alerts, leading to PC compromise through malicious downloads. Similar phishing tactics are being used against Robinhood users.

Trends, Tools, or Tactics of Interest

Attackers are actively bypassing synced passkeys, highlighting inherent risks in cloud-based passkey deployments.
There is an increase in supply chain risks due to compromised VS Code extensions, with over 100 leaking tokens that could allow malicious updates.
Satellite communications remain insecure, with continued leakage of unencrypted sensitive data.
Dark web threats are increasingly hiding within normal network traffic, with network detection and response (NDR) platforms being promoted as effective countermeasures.
TikTok is being used as a platform for crypto-related scams, luring victims with fraudulent paywall schemes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £14 million fine on Capita for failing to protect personal data in a 2023 breach.
CISA issued an emergency directive mandating urgent remediation of critical vulnerabilities in F5 devices.
LevelBlue announced plans to acquire Cybereason, expanding its extended detection and response (XDR) and managed detection and response (MDR) portfolio.

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

Cybersecurity Brief – 2025-09-26

Fri, 26 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The Co-operative Group (UK) reported a loss of £80 million ($107 million) in operating profit due to a cyberattack attributed to the Scattered Spider threat group.
RTX (Raytheon Technologies) confirmed a ransomware attack affecting its airport services division.
Volvo Group disclosed that employee data was stolen in a ransomware attack linked to the Miljödata breach, impacting multiple Swedish organizations and municipalities.
An unofficial npm package mimicking ‘postmark-mcp’ was found to exfiltrate users’ email communications.
Over 500 npm packages were infected by the Shai-Hulud worm in a supply-chain attack, impacting packages with millions of downloads.
Two malicious Rust crates (fast_tlog and fast_log) on crates.io were found stealing Solana and Ethereum wallet keys from developers, with 8,424 downloads confirmed.

Newly Discovered Vulnerabilities

Cisco disclosed multiple zero-day vulnerabilities in its ASA firewalls and IOS devices, several of which have been actively exploited in the wild, including by nation-state actors (notably the “ArcaneDoor” campaign). Exploits have resulted in remote code execution and privilege escalation.
Salesforce patched a critical vulnerability (“ForcedLeak”) in the Agentforce AI platform that allowed prompt injection attacks, potentially exposing CRM data via AI agent manipulation and expired domain abuse.
Cisco patched a zero-day flaw affecting routers and switches, enabling remote attackers with admin privileges to execute arbitrary code as root.

Notable Threat Actor Activity

The China-linked APT group UNC5221 deployed new versions of the “Brickstorm” backdoor on edge devices, targeting appliances that cannot run traditional EDR agents. Campaigns persisted undetected for nearly 400 days, with evidence of analysis of stolen code to weaponize additional zero-day vulnerabilities.
North Korean actors behind the “Contagious Interview” campaign have been linked to a new backdoor dubbed AkdoorTea, along with tools TsunamiKit and ExistentialKit, targeting global cryptocurrency developers.
The threat actor “Vane Viper” was identified as operating a large-scale ad fraud and malware network, generating over 1 trillion DNS queries and using shell companies to obfuscate operations.
Chinese APT “RedNovember” targeted US defense contractors, government, aerospace, and legal organizations in a recent espionage campaign.
Microsoft reported a new variant of the XCSSET macOS malware targeting Xcode developers, with enhanced browser targeting and credential theft features.

Trends, Tools, or Tactics of Interest

A new AI-driven phishing platform, “SpamGPT”, was observed automating attack campaigns by leveraging generative AI and integrated email campaign tools.
Attackers are using AI-powered development platforms (Lovable, Netlify, Vercel) to rapidly create and host convincing fake CAPTCHA pages for phishing.
A fresh phishing campaign is targeting PyPI users by impersonating administrators and directing victims to credential-harvesting sites.
SVG-based phishing campaigns continue, with recent attacks using malicious SVG files disguised as recipes to deliver malware.
Webshells are increasingly being hidden in “.well-known” directories to evade detection.
Gcore Radar reported that the technology sector has overtaken gaming as the top target for DDoS attacks, with a 41% year-on-year increase and attack peaks reaching 2.2 Tbps.
Cloud Security Alliance introduced a SaaS Security Controls Framework to help customers manage shared responsibility in SaaS environments.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive mandating federal agencies to identify, mitigate, and patch Cisco zero-day vulnerabilities exploited in active attacks.
Microsoft announced it will offer free extended security updates for Windows 10 users in the European Economic Area (EEA), including all EU member states, Iceland, Liechtenstein, and Norway.
LinkedIn will use user data for AI training by default unless users opt out.
Canadian privacy commissioners accused TikTok of improperly collecting data from hundreds of thousands of children on its platform.

Cybersecurity Brief – 2025-08-06

Wed, 06 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Pandora, the Danish jewelry retailer, confirmed a data breach after customer information was stolen in connection with ongoing Salesforce data theft attacks. The company warned customers of potential phishing attempts using their stolen data.
Cisco disclosed a data breach affecting Cisco.com user accounts after a voice phishing (vishing) attack targeted a company representative. Stolen data includes names, email addresses, and phone numbers.
PBS suffered a data breach resulting in the exposure of corporate contact information for employees and affiliates, which was subsequently leaked on Discord servers.

Newly Discovered Vulnerabilities

Google released security updates for Android, addressing six vulnerabilities in its August 2025 update. Two patched Qualcomm vulnerabilities (including an Adreno GPU flaw) were confirmed as actively exploited in the wild.
Adobe issued emergency patches for two zero-day vulnerabilities in Adobe Experience Manager (AEM) Forms on JEE. Proof-of-concept exploit chains allowing unauthenticated remote code execution had been published.
CISA added three legacy D-Link router vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation.
A critical vulnerability (CVE-2025-54136, “MCPoison”) was disclosed in the Cursor AI-powered code editor, enabling persistent remote code execution via malicious MCP file swaps post-approval. This flaw poses a software supply chain risk.
SonicWall warned administrators to disable SSLVPN on Gen 7 firewalls amid a surge in ransomware attacks exploiting a suspected zero-day vulnerability. The company is actively investigating.
Public exploits for Microsoft SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-53771) have been observed in the wild, with attackers reportedly stealing machine keys.

Notable Threat Actor Activity

A widespread phishing campaign is targeting Instagram users with fake notifications about failed login attempts, aiming to harvest credentials.
A global campaign leveraging 15,000 fake TikTok Shop domains is distributing malware and stealing cryptocurrency via AI-driven scams. Threat actors are using trojanized apps and credential theft tactics.
ClickFix social engineering attacks, which employ CAPTCHAs and sophisticated narratives to evade detection, have seen increased adoption over the past year, facilitating cross-platform malware infections.
Ransomware gangs are suspected of exploiting a SonicWall firewall zero-day in recent attacks.
The cybercrime underground continues to rely heavily on traditional attack methods, including phishing and social engineering, despite increasing professionalization and organisation.

Trends, Tools, or Tactics of Interest

Automated and AI-driven adversarial testing is gaining prominence, with vendors showcasing solutions at Black Hat USA 2025 and commentary on the transformation of penetration testing through AI.
Microsoft unveiled Project Ire, an autonomous AI agent capable of reverse engineering software to detect malware.
Attackers are increasingly using vishing (voice phishing) to compromise corporate accounts, as demonstrated in the Cisco breach.
HTTP request smuggling remains a relevant attack vector, with recent educational content highlighting its exploitation potential.
The distinction between misconfigurations and vulnerabilities in SaaS environments is being emphasised, as confusion between the two can result in overlooked security risks.
Security operations centers (SOCs) continue to struggle with alert fatigue, with industry discussion focused on strategies to reduce false positives and improve incident detection.
The rapid proliferation of AI-assisted development tools is raising concerns about software supply chain security and the challenge of securing code produced by non-traditional developers.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced an increase in the prize pool for its Zero Day Quest hacking contest to $5 million, incentivizing research into high-impact vulnerabilities, particularly in cloud and AI security.

Cybersecurity Brief – 2025-08-05

Tue, 05 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Chanel has suffered a data breach as part of a broader wave of attacks targeting Salesforce data, joining other organisations affected by this campaign.
Northwest Radiologists disclosed a data breach impacting 350,000 individuals, with personal information stolen in an incident dating back to January 2025.
Russia’s largest airline, Aeroflot, was reportedly attacked, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

SonicWall is investigating a potential zero-day vulnerability in its SSL VPN devices after a surge in targeted attacks, notably by the Akira ransomware group.
NVIDIA patched multiple critical vulnerabilities in its Triton Inference Server for Windows and Linux. These flaws could allow unauthenticated remote code execution, model theft, data leaks, and response manipulation on AI servers.
A previously undocumented Linux backdoor, dubbed “Plague,” was discovered. The malware, implemented as a malicious PAM module, enables persistent SSH access, bypasses authentication, and removes traces of SSH sessions. It is reported to have evaded detection for over a year.
Proton fixed a vulnerability in its Authenticator iOS app where TOTP secrets were logged in plaintext, potentially exposing multi-factor authentication codes.
Several vulnerabilities were patched in the AI code editor Cursor, which previously allowed attackers to modify sensitive MCP files and execute arbitrary code without user approval.

Notable Threat Actor Activity

Vietnamese threat actors are distributing a Python-based information stealer known as PXA Stealer. The campaign has compromised over 4,000 IP addresses and stolen 200,000 passwords globally.
Akira ransomware operators have escalated attacks using SonicWall SSL VPN devices, leveraging a suspected zero-day for initial access.
Ransomware gangs are exploiting a Microsoft SharePoint vulnerability chain, resulting in breaches of at least 148 organisations.
North Korean IT workers continue to seek fraudulent employment at Western companies, as highlighted in a new FBI advisory.
The “ClickTok” campaign is targeting TikTok Shop users with phishing and trojanised apps, leading to crypto wallet theft and spyware infections.
Mozilla warned of an ongoing phishing campaign targeting add-on developers via its official AMO repository.

Trends, Tools, or Tactics of Interest

Attackers are leveraging Microsoft Teams calls for social engineering, convincing users to install the Matanbuchus malware loader, which is often a precursor to ransomware deployment.
Threat actors are increasingly utilising generative AI tools to enhance offensive cyber operations, including social engineering and malware development.
Recent malware campaigns are adopting advanced evasion techniques, such as blending into legitimate developer workflows and documenting themselves to appear benign.
The proliferation of shadow IT remains a concern, with employees installing unauthorised plugins and tools, increasing organisational risk.
Cisco demonstrated that AI guardrails can be bypassed, allowing sensitive data to be extracted from chatbots trained on proprietary content.

Regulatory or Policy Developments Affecting the Security Industry

CISA and FEMA announced over $100 million in grants to help US states, tribes, and localities enhance cybersecurity resilience.
Illumina agreed to a $9.8 million settlement over allegations that its gene sequencing products supplied to the US government contained cybersecurity vulnerabilities.
Sean Cairncross has been confirmed by the US Senate as National Cyber Director.
Darktrace has acquired Mira Security, contributing to ongoing consolidation in the cybersecurity sector, with 44 M&A deals announced in July 2025.

Cybersecurity Brief – 2025-07-12

Sat, 12 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE-2025-25257) in FortiWeb that allows unauthenticated attackers to execute arbitrary database commands. Proof-of-concept exploits for this vulnerability have been publicly released.
Security researchers disclosed four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack (“PerfektBlue”), which could allow remote code execution on millions of vehicles (including Mercedes, Skoda, and Volkswagen) and over a billion industrial, medical, mobile, and consumer devices.
The U.S. CISA confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway, mandating federal agencies to patch within 24 hours.
A zero-day vulnerability in OpenVSX, a popular extension marketplace, was discovered and patched. The flaw could have enabled attackers to compromise millions of developer machines via a supply chain attack.
Microsoft disclosed new attack techniques targeting AMD CPUs.
NVIDIA issued guidance recommending activation of System Level Error-Correcting Code (ECC) to mitigate Rowhammer attacks on GPUs with GDDR6 memory. Researchers demonstrated Rowhammer-based “GPUHammer” attacks that can degrade machine learning model accuracy.

Notable Threat Actor Activity

The Iranian-backed Pay2Key ransomware-as-a-service operation has resurfaced, offering affiliates an increased profit share (80%) for attacks targeting Western organisations, particularly in the US and Israel. This follows recent geopolitical tensions involving Iran, Israel, and the US.
The Indian APT group DoNot is actively targeting government entities.

Trends, Tools, or Tactics of Interest

Researchers at Netcraft highlighted that AI-generated search engine summaries are inadvertently directing users to phishing sites when queried for legitimate login pages, posing a new phishing risk vector.
SentinelOne reported evolution in the ZuRu macOS malware family.
The 2025 Data Risk Report notes heightened data loss risks from AI-powered tools, with calls for unified, AI-driven data security strategies.
Cyber-insurance premiums are declining from previous highs, though comprehensive coverage remains vital for risk management.
There is increased emphasis on integrating cybersecurity into financial sector digital transformation strategies.
Discussion of passwordless authentication mechanisms-specifically passkeys using public key cryptography-to address the inherent risks of shared secrets in traditional password systems.

Regulatory or Policy Developments

The European Union unveiled a voluntary AI Code of Practice to help businesses comply with the phased rollout of the EU AI Act.
The Irish Data Privacy Commission opened a new investigation into TikTok regarding the transfer of user data to China under EU privacy regulations.
Google did not release a scheduled July 2025 Android security patch, breaking a ten-year streak of monthly updates.

Cybersecurity Brief – 2025-07-05

Sat, 05 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro has suffered a global outage affecting its websites and internal systems. Customers have expressed concern that this may be the result of a cyberattack, although the company has not issued an official statement regarding the cause.
A hacker has claimed to have stolen and leaked 106GB of data from Spanish telecommunications provider Telefónica. The company has not confirmed the breach.

Newly Discovered Vulnerabilities

Two critical vulnerabilities have been disclosed in the Sudo command-line utility for Linux and Unix-like operating systems. These flaws allow local attackers to escalate privileges to root. The vulnerabilities impact major Linux distributions.

Notable Threat Actor Activity

Threat actors are exploiting exposed Java Debug Wire Protocol (JDWP) interfaces to execute code remotely and deploy cryptocurrency miners on compromised systems. Additionally, Hpingbot malware is targeting SSH services to launch DDoS attacks.
A previously undocumented threat actor, NightEagle (also known as APT-Q-95), has been observed exploiting a Microsoft Exchange zero-day vulnerability to target China’s military and technology sectors.

Trends, Tools, or Tactics of Interest

There is increased threat activity leveraging exposed development and debugging interfaces (such as JDWP) for initial access and subsequent crypto mining payload deployment.
AI agents and custom generative AI workflows are emerging as potential sources of sensitive data leakage, introducing new risks for enterprises.

Regulatory or Policy Developments Affecting the Security Industry

A U.S. court has ordered Google to pay $314 million for misusing Android users’ cellular data by passively transmitting information while devices were idle, without user permission.
Taiwan’s National Security Bureau (NSB) has issued a public warning about the security risks associated with Chinese-developed applications including TikTok, Weibo, RedNote (Xiaohongshu), WeChat, and Baidu Cloud, citing concerns over excessive data collection and ties to China.

Cybersecurity Brief – 2025-05-24

Sat, 24 May 2025 00:00:00 +0000

Major Incidents and Breaches

A massive data breach has exposed 184 million unencrypted passwords associated with Google, Microsoft, Facebook, and other platforms, significantly increasing credential stuffing and account takeover risks.
The decentralized exchange Cetus Protocol suffered a cryptocurrency heist resulting in the theft of $223 million. The operator is offering a deal to the attacker for the return of funds.
Europol, as part of Operation Endgame, coordinated a global crackdown on ransomware infrastructure, seizing approximately 300 servers, neutralizing 650 domains, and issuing arrest warrants for 20 individuals.
The FBI issued a warning regarding ongoing extortion attacks by the Luna Moth (Silent Ransom Group) targeting U.S. law firms through callback phishing and social engineering tactics.

Newly Discovered Vulnerabilities

Three critical zero-day vulnerabilities in Versa’s Concerto Orchestrator SD-WAN platform were patched. The flaws could allow complete compromise of both the application and the underlying host system.
Researchers disclosed that the threat actor “ViciousTrap” exploited a Cisco vulnerability to compromise nearly 5,300 network edge devices across 84 countries, creating a global honeypot network.

Notable Threat Actor Activity

A surge in phishing campaigns has been observed impersonating Meta and leveraging Google’s AppSheet platform, enabling attackers to evade detection by exploiting trusted cloud services.
Cybercriminals are actively distributing Vidar and StealC infostealer malware using the ClickFix technique, now propagated via TikTok videos for social engineering and malware delivery.
60 malicious NPM packages have been identified collecting host and network data, exfiltrating it to Discord webhooks controlled by threat actors.

Trends, Tools, and Tactics

Attackers are increasingly abusing legitimate platforms (e.g., Google AppSheet, TikTok, NPM) for phishing, social engineering, and malware distribution, demonstrating a shift toward exploiting trusted ecosystems to bypass security controls.
The open-source SafeLine WAF has been highlighted for its zero-day exploit detection and bot protection capabilities, reflecting increased demand for self-hosted, user-friendly web application firewalls.
The ClickFix technique is gaining traction as a malware distribution vector, leveraging interactive social engineering to facilitate infections.
AI continues to transform security operations, with advancements in automated policy enforcement, threat detection, and user coaching for data protection noted as key developments.
Concerns over data privacy and the extensive collection of user data by AI chatbots remain prominent, with some platforms harvesting up to 90% of user data types.

Regulatory and Policy Developments

Ongoing discussions emphasize the need for strengthened regulatory frameworks and privacy-enhancing technologies to address risks associated with generative AI and data privacy.
Law enforcement’s coordinated actions against ransomware infrastructure signal increased international collaboration and operational pressure on cybercriminal networks.

Cybersecurity Brief – 2025-05-08

Thu, 08 May 2025 00:00:00 +0000

Major Incidents and Breaches

LockBit Ransomware Gang Breach: The LockBit ransomware group suffered a significant breach, with its dark web affiliate panels defaced and victim negotiation data exposed via a leaked MySQL database. This incident may disrupt ongoing operations and expose sensitive data related to victims and affiliates.
PowerSchool Extortion Escalates: Following a December cyberattack, the PowerSchool hacker is now directly extorting individual school districts, threatening to release stolen student and teacher data if ransoms are not paid.
Masimo Cyberattack: Medical device manufacturer Masimo reported a cyberattack that has disrupted production and caused delays in fulfilling customer orders.
South African Airways Disruption: A cyberattack temporarily disrupted operational systems at South African Airways. The company is investigating potential data theft.

Cybersecurity Brief – 2025-05-03

Sat, 03 May 2025 00:00:00 +0000

Major Incidents and Breaches

Co-op Data Theft Confirmed: Co-op has verified that significant data was stolen in a recent cyberattack, following claims by the DragonForce ransomware group. The breach impacts a substantial number of current and former customers.
Magento Supply Chain Attack: Between 500 and 1,000 e-commerce stores, including a $40 billion multinational, were compromised through 21 backdoored Magento extensions in a widespread supply chain attack.
UK Retail Sector Under Attack: Multiple major British retailers, including Harrods, have been targeted by likely ransomware attacks in recent weeks. The UK NCSC has characterised these incidents as a “wake-up call” for the sector, urging improved cyber resilience.
Ransomware Surge in Food and Agriculture: Ransomware attacks targeting the food and agriculture sector have doubled in 2025, with the increase attributed largely to Clop’s exploitation of a popular file-sharing service.

Notable Threat Actor Activity

DragonForce Ransomware: Claimed responsibility for the Co-op breach, confirming ongoing ransomware activity against UK retailers.
Black Kingdom Ransomware: US authorities indicted a Yemeni national believed to be the developer and main operator behind Black Kingdom, which conducted approximately 1,500 attacks on Microsoft Exchange servers.
Scattered Spider: Despite recent law enforcement arrests, the group continues to conduct high-profile cyberattacks, underscoring its resilience and operational capability.
MintsLoader and GhostWeaver: The MintsLoader malware loader is being used to deliver the PowerShell-based remote access trojan GhostWeaver via phishing campaigns. The attacks leverage domain generation algorithms (DGA) and TLS encryption for stealth.

Newly Discovered Vulnerabilities and Exploits

Magento Extensions Backdoors: The compromised Magento extensions represent a significant supply chain vulnerability, affecting hundreds of e-commerce sites.
Developer Secrets Targeting: Threat actors are increasingly scanning for exposed secrets in configuration and repository files, highlighting the ongoing risk of credential leakage in software development pipelines.

Trends, Tools, and Tactics

Passwordless Authentication: Microsoft has made all new accounts passwordless by default, aiming to reduce risks from phishing, brute-force, and credential-stuffing attacks.
Automated Vulnerability Response: The Tines platform is promoting community-driven, pre-built workflows to automate CVE and vulnerability advisory responses, supporting more rapid and consistent remediation.
Stealth Malware Delivery: Recent campaigns (e.g., MintsLoader/GhostWeaver) demonstrate advanced use of multi-stage infection chains, obfuscation, DGA, and TLS for evasion.
Retail Sector Targeting: The ongoing wave of ransomware and cyberattacks against UK retailers signals a trend of increased targeting of the retail sector, likely due to its data-rich environment and operational impact.

Regulatory and Policy Developments

TikTok Fined for GDPR Breach: The Irish Data Protection Commission fined TikTok €530 million ($601 million) for illegally transferring personal data of EEA users to China, in violation of GDPR. This is among the largest fines issued under GDPR, reinforcing regulatory scrutiny of cross-border data transfers.
NCSC Advanced Cryptography Guidance: The UK NCSC has published a white paper on “Advanced Cryptography,” defining and providing guidance on cryptographic techniques for processing encrypted data and enhancing privacy and security.
US Regulatory Actions: The US Treasury is moving to cut off Huione Group, which is accused of laundering funds from North Korean cybercrime and investment scams. Separately, new security rules from the New York Department of Financial Services require finance firms to implement stronger protections against unauthorised access to information systems.

Other Industry Notes

Microsoft Exchange Online Issue Resolved: Microsoft fixed a bug in Exchange Online that was incorrectly flagging Gmail emails as spam due to a machine learning model error.
Privacy Concerns with Consumer Devices: Ongoing media coverage highlights persistent privacy risks associated with smart TVs and streaming devices collecting user data.