Wireshark on DanSec Daily

Cybersecurity Brief – 2026-08-17

Mon, 17 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers after a vulnerability was exploited to steal customer order information. The stolen data is now reportedly being offered for sale by a threat actor ^[1].
A threat actor claims to have exfiltrated millions of records from major organisations including McDonald’s, TCS, and Vodafone as part of an Azure data theft campaign targeting Fortune 500 companies ^[7].

Newly Discovered Vulnerabilities

Wireshark version 4.6.8 was released, addressing 28 vulnerabilities and 25 bugs ^[6].

Notable Threat Actor Activity

Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service, resulting in significant disruption to communications earlier this week ^[3].
A new macOS malware strain, AmnesiaStealer, has been identified. It targets users via ClickFix attacks and includes a streaming module enabling attackers to hijack and remotely control victims’ browser sessions ^[4].

Sources

SafePal data breach impacts 39,798 customers, stolen info for sale - bleepingcomputer.com
Fortune 500 Companies Hit in Azure Data Theft Campaign - securityweek.com
Wireshark 4.6.8 Released, (Sun, Aug 16th) - isc.sans.edu
Large-scale DDoS attacks disrupted Threema secure messaging service - bleepingcomputer.com
New AmnesiaStealer macOS malware hijacks browser sessions via remote control - bleepingcomputer.com

Cybersecurity Brief – 2026-07-12

Sun, 12 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

The jscrambler npm package was compromised, with its 8.14.0 release containing a preinstall hook that executes a Rust-based infostealer on installation, exposing developers and users to credential theft and other risks ^[1].

Newly Discovered Vulnerabilities

Researchers identified a technique named ‘Ghostcommit’ that embeds prompt injection attacks within PNG images to bypass AI code reviewers and steal repository secrets, demonstrating a novel supply chain attack vector targeting AI-integrated development workflows ^[4].
Wireshark version 4.6.7 was released to address 12 security vulnerabilities and 16 additional bugs in the network protocol analysis tool ^[6].
An AI system uncovered a root-level vulnerability in the Linux kernel that had gone undetected for 15 years, highlighting a significant long-term risk in widely deployed operating systems ^[5].

Notable Threat Actor Activity

Multiple threat groups, suspected to be aligned with China and India, have engaged in sustained cyber espionage campaigns targeting Pakistani law enforcement agencies by weaponizing the Balochistan Police portal ^[2].
“Ghost accounts” are being used in mass reconnaissance campaigns to abuse the GitHub API, enabling threat actors to map organizations, repositories, and members at scale ^[7].

Trends, Tools, or Tactics of Interest

The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign actively targeting vulnerable content management systems and associated plugins, indicating an ongoing trend in opportunistic mass exploitation of web platforms ^[3].

Sources

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install - thehackernews.com
'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets - bleepingcomputer.com
Wireshark 4.6.7 Released, (Sat, Jul 11th) - isc.sans.edu
AI Found a Root Bug in Linux That Everyone Missed for 15 Years - wired.com
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns - thehackernews.com
Ghost Accounts Abuse GitHub API in Mass Recon Campaign - securityweek.com
Australia warns of global campaign targeting vulnerable CMS platforms - bleepingcomputer.com

Cybersecurity Brief – 2026-05-25

Mon, 25 May 2026 00:00:00 +0000

Major Incidents or Breaches

Over 5,500 GitHub repositories were compromised in the ‘Megalodon’ supply chain attack, where malicious actors used fake automated commits to inject GitHub Actions workflows containing payloads designed to steal credentials, CI secrets, keys, and tokens ^[6].
A large-scale exploitation campaign is targeting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, enabling attackers to inject malicious JavaScript code and initiate ClickFix attack flows ^[2].

Newly Discovered Vulnerabilities

A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in the wild ^[2].
Wireshark 4.6.6 was released to address one vulnerability and fix 11 bugs ^[5].

Notable Threat Actor Activity

The TrapDoor campaign is conducting a coordinated cross-ecosystem software supply chain attack targeting npm, PyPI, and Crates.io to distribute credential-stealing malware ^[1].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging supply chain vectors across multiple software ecosystems and developer platforms, as evidenced by the TrapDoor campaign affecting npm, PyPI, and Crates.io, as well as the Megalodon attack compromising thousands of GitHub repositories via malicious CI/CD workflows ^[1]^[6].

Sources

Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack - securityweek.com
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign - bleepingcomputer.com
Wireshark 4.6.6 Released, (Sun, May 24th) - isc.sans.edu
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO - thehackernews.com

Cybersecurity Brief – 2026-05-04

Mon, 04 May 2026 00:00:00 +0000

Major Incidents or Breaches

Instructure, an educational technology company, confirmed a data breach following claims by the ShinyHunters extortion group. Data stolen includes names, email addresses, student ID numbers, and user messages. Service disruptions were also reported.
A coordinated international law enforcement operation involving U.S. and Chinese authorities resulted in the arrest of 276 suspects, the shutdown of nine cryptocurrency scam centers, and the seizure of $701 million. The operation targeted large-scale cryptocurrency investment fraud schemes.

Newly Discovered Vulnerabilities

Wireshark released version 4.6.5, addressing 43 vulnerabilities (38 CVEs) and 35 additional bugs.

Notable Threat Actor Activity

The ShinyHunters extortion group claimed responsibility for the Instructure breach, threatening to leak stolen data.
Researchers identified large-scale abuse of Telegram’s Mini App feature by threat actors to conduct cryptocurrency scams, impersonate well-known brands, and distribute Android malware.

Trends, Tools, or Tactics of Interest

Microsoft Defender is generating widespread false-positive detections, incorrectly identifying legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, and in some cases removing certificates from Windows systems.
Threat actors are leveraging Telegram Mini Apps to facilitate both financial fraud and malware delivery, expanding attack vectors beyond traditional phishing and messaging schemes.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Defense reached agreements with seven technology companies (Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection, and SpaceX) to deploy their artificial intelligence solutions on classified military systems, aimed at supporting operational decision-making.

Cybersecurity Brief – 2026-03-03

Tue, 03 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Madison Square Garden confirmed a data breach resulting from the 2025 Oracle E-Business Suite hacking campaign, with the incident only publicly disclosed months after the initial attack.
Wynn Resorts, a major US-based casino and hotel operator, was listed among the top attack and breach victims in the recent Check Point threat intelligence report.
A 22-year-old Alabama man pleaded guilty to hacking and extorting hundreds of women by hijacking their social media accounts, including those of minors.
A Florida woman was sentenced to 22 months in prison for orchestrating a large-scale Microsoft license fraud operation, trafficking thousands of stolen Certificate of Authenticity (COA) labels.
A phishing campaign is leveraging a fake Google Account security page and a Progressive Web App (PWA) to steal credentials, multi-factor authentication codes, and cryptocurrency wallet addresses, as well as proxying attacker traffic.
A fake FileZilla website is distributing a tampered installer that communicates with attacker-controlled servers via encrypted DNS traffic, evading traditional network monitoring.
A phishing campaign is distributing malicious “purchase order” attachments that link to credential-harvesting web pages.

Newly Discovered Vulnerabilities

A critical, now-patched vulnerability in Google Chrome’s Gemini Live AI Assistant allowed malicious extensions to escalate privileges, access local files, and potentially violate user privacy.
OpenClaw, a popular AI agent tool, was found to have a critical vulnerability enabling malicious websites to open WebSocket connections to localhost, brute-force passwords, and hijack the AI agent.
Wireshark 4.6.4 was released, addressing three vulnerabilities and 15 bugs.
A 0-day vulnerability (CVE-2026-21513) in Microsoft MSHTML, exploited prior to the February 2026 Patch Tuesday, has been linked to APT28 activity.

Notable Threat Actor Activity

Russia-linked APT28 exploited the MSHTML 0-day (CVE-2026-21513) in targeted attacks before its public disclosure and patch.
North Korean threat actors published 26 malicious npm packages as part of the ongoing “Contagious Interview” campaign, embedding Pastebin-based command-and-control for a cross-platform remote access trojan (RAT).
Another North Korean APT campaign targeted air-gapped systems using Windows shortcut files, deploying new implants, loaders, propagation tools, and backdoors.
Pro-Western and Iranian threat actors are engaged in reciprocal cyberattacks amid ongoing Middle East conflict, including wiper malware, DDoS, and attacks on critical infrastructure.
The UK’s National Cyber Security Centre (NCSC) issued a warning to British organizations about increased risk of Iranian cyberattacks due to Middle East tensions.
Global law enforcement arrested 30 alleged members of the cybercriminal collective “The Com” in “Project Compass,” identifying nearly 180 group members in total.
Researchers linked the open-source AI security testing tool CyberStrikeAI to a threat actor responsible for breaching hundreds of Fortinet FortiGate devices.

Trends, Tools, or Tactics of Interest

Attacks on GPS and satellite navigation systems have spiked in the Middle East, with over 1,100 ships impacted since February 28 following US and Israeli actions against Iran.
There is a growing use of deepfakes and injection attacks to bypass identity verification processes, targeting onboarding and account recovery workflows.
Bot attacks against SaaS platforms are increasing, with attackers leveraging automated tools to generate fake sign-ups and abuse APIs.
A trend of threat actors leveraging AI-powered tools, such as CyberStrikeAI, for offensive security testing and exploitation has been observed.
The use of encrypted DNS by malware (as seen in the fake FileZilla campaign) is complicating detection and response efforts.
AI-driven development is contributing to tensions between speed and security, with firewall rule backlogs and automation impacting application security workflows.

Regulatory or Policy Developments Affecting the Security Industry

Samsung settled a lawsuit in Texas over the collection and monetization of smart TV viewing data using Automated Content Recognition (ACR), with implications for user privacy controls.
Google announced the development of quantum-resistant HTTPS certificates for Chrome, utilizing Merkle Tree Certificates (MTCs) to address future quantum computing threats.
AWS expanded its Security Hub into a cross-domain security platform, aiming to reduce tool sprawl and improve correlation of security findings.
Nick Andersen was appointed Acting Director of CISA (Cybersecurity and Infrastructure Security Agency), following a leadership change within the US Department of Homeland Security.

Cybersecurity Brief – 2026-01-18

Sun, 18 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

U.S. hackers have reportedly caused a blackout in Venezuela, according to recent reports, indicating a significant cyber operation targeting critical infrastructure.
Nicholas Moore, a Tennessee man, pleaded guilty to repeatedly hacking the U.S. Supreme Court’s filing system and illegally accessing systems belonging to AmeriCorps and the Department of Veterans Affairs.

Newly Discovered Vulnerabilities

Wireshark 4.6.3 has been released, addressing 4 vulnerabilities and 9 bugs.

Notable Threat Actor Activity

Ukrainian and German law enforcement have identified two Ukrainian nationals suspected of working for the Russia-linked Black Basta ransomware group. One of the group’s leaders has been added to the EU Most Wanted list and is the subject of an INTERPOL Red Notice.
Malicious Chrome extensions impersonating productivity and security tools have been found stealing authentication credentials from enterprise HR and ERP platforms or blocking legitimate extensions.
Seventeen additional malicious browser extensions linked to the GhostPoster campaign have been discovered in Chrome, Firefox, and Edge stores, with a combined total of 840,000 installations.

Trends, Tools, or Tactics of Interest

Google Chrome now allows users to delete local AI models used for scam detection under the “Enhanced Protection” feature, providing more user control over on-device AI-powered security functions.

Cybersecurity Brief – 2025-12-15

Mon, 15 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Kaspersky researchers have identified a new Android banking Trojan, dubbed Frogblight, targeting Turkish users. The malware is distributed via a fake app impersonating an official Turkish government portal for accessing court case files.

Newly Discovered Vulnerabilities

Wireshark 4.6.2 has been released, addressing two vulnerabilities and five bugs.

Notable Threat Actor Activity

The pro-Russian hacktivist group CyberVolk (also known as GLORIAMIST) has launched a new ransomware-as-a-service (RaaS) operation called VolkLocker. The ransomware contains a hard-coded master decryption key, allowing free decryption of files.

Trends, Tools, or Tactics of Interest

An email scam is leveraging PayPal’s “Subscriptions” billing feature to send legitimate PayPal emails with fake purchase notifications. The scam embeds fraudulent information in the Customer Service URL field to trick recipients.

Cybersecurity Brief – 2025-11-24

Mon, 24 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Iberia has disclosed a customer data leak resulting from a security breach at a third-party supplier. The airline is notifying affected customers. The incident follows a threat actor’s claim of possessing Iberia customer data on a hacking forum.

Newly Discovered Vulnerabilities

Wireshark version 4.6.1 has been released, addressing two vulnerabilities and resolving 20 bugs in the network protocol analyzer.

Notable Threat Actor Activity

A threat actor has claimed responsibility for the compromise of Iberia customer data, posting about the breach on a hacking forum prior to the airline’s disclosure.

Trends, Tools, or Tactics of Interest

SmbCrawler has been released as a credentialed SMB share crawler designed for red teams to discover misconfigured SMB shares and hunt for secrets within Windows environments.
YARA-X 1.10.0 has been released, introducing a new command to fix warnings and improve rule management for malware researchers and threat hunters.
Passwork 7 has launched as a unified, self-hosted enterprise password and secrets management platform, offering automated credential workflows for organizations.

Cybersecurity Brief – 2025-09-01

Mon, 01 Sep 2025 00:00:00 +0000

Newly Discovered Vulnerabilities

Wireshark 4.4.9 has been released, addressing five bugs. No CVEs or critical vulnerabilities were specified in the release notes.
A bug was reported in the pdf-parser tool causing errors when dumping all filtered streams. This issue could impact the reliability of forensic or malware analysis workflows relying on the tool.

Trends, Tools, or Tactics of Interest

OpenAI is testing a “Thinking effort” picker for ChatGPT, allowing users to select the level of reasoning or computational effort applied to responses. This may have future implications for AI-driven security automation and analysis tools.

Cybersecurity Brief – 2025-07-22

Tue, 22 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Dell confirmed that the “World Leaks” extortion group breached one of its product demonstration/test lab platforms. The group is attempting to extort Dell for ransom.
Dior has begun notifying U.S. customers of a May cybersecurity incident that compromised their personal information.
Cierant Corporation and law firm Zumpano Patricios disclosed separate data breaches, each affecting over 200,000 individuals.
The Alcohol & Drug Testing Service (TADTS) reported a ransomware attack in July 2024 that exposed personal information of 750,000 people.
Over 1,000 CrushFTP servers are currently exposed online and vulnerable to hijack attacks exploiting a critical security bug that provides admin access via HTTPS.
Louis Vuitton suffered a cyberattack, as reported in recent threat intelligence bulletins.
Ring users reported a surge in unauthorized device logins on May 28. Ring (Amazon) attributed the incident to a backend update bug and denied an external breach.

Newly Discovered Vulnerabilities

Microsoft released emergency patches for two actively exploited SharePoint zero-days, CVE-2025-53770 (“ToolShell”) and CVE-2025-53771. These vulnerabilities have been used in ongoing attacks against US government agencies and other organizations.
A zero-day vulnerability in CrushFTP is being exploited to gain administrative privileges on exposed servers. Over 1,000 instances remain vulnerable.
ExpressVPN fixed a flaw in its Windows client that caused Remote Desktop Protocol (RDP) traffic to bypass the VPN tunnel, exposing users’ real IP addresses during remote sessions.
Wireshark 4.4.8 was released, addressing nine bugs.
WinRAR 7.10 does not propagate all Mark-of-the-Web (MOTW) data when extracting files, potentially impacting security controls.

Notable Threat Actor Activity

APT41, a China-linked cyber espionage group, launched a targeted campaign against government IT services in Africa, using hardcoded internal server names and advanced techniques to evade detection.
Iranian APT MuddyWater deployed new variants of the DCHSpy Android spyware, masquerading as VPN apps to target dissidents and Android users, particularly since the escalation of conflict with Israel.
The Russian cybercrime group NoName057(16) has been disrupted by Europol, with seven arrest warrants issued. The group is known for recruiting followers to conduct DDoS attacks on perceived adversaries.
A surveillance firm was found bypassing SS7 protections to obtain user location data from wireless carriers.

Trends, Tools, or Tactics of Interest

Attackers continue to gain access in well-secured environments by leveraging weak system configurations, outdated encryption, and trusted but unprotected tools, rather than relying solely on novel exploits.
Research is emerging on malicious implants targeting AI components and applications, indicating a new vector for stealthy attacks against AI-powered systems.
The propagation of Mark-of-the-Web (MOTW) data by WinRAR has changed, which may impact the effectiveness of MOTW-based security mechanisms.
Zero Trust security, now seen as a foundational requirement, is increasingly incorporating AI to enhance detection and response capabilities.

Regulatory or Policy Developments Affecting the Security Industry

Intel announced the end of the Clear Linux OS project, archiving its GitHub repositories and ceasing further development.
Veeam warned that recent changes to Recovery Orchestrator’s multi-factor authentication (MFA) rollout are preventing users from logging into the Web UI.

Cybersecurity Brief – 2025-06-08

Sun, 08 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

A supply chain attack compromised 15 popular Gluestack NPM packages, which collectively have over 950,000 weekly downloads. The compromised packages were modified to include malicious code functioning as a remote access trojan (RAT).
Two malicious NPM packages, disguised as utility tools, were discovered to be destructive data wipers. When installed, these packages delete entire application directories, causing potential data loss for affected users.

Newly Discovered Vulnerabilities

Wireshark 4.4.7 was released, addressing one security vulnerability (CVE-2025-5601) and resolving eight additional bugs.

Notable Threat Actor Activity

Ongoing investigations and reporting continue regarding unexplained iPhone crashes that some external sources have linked to Chinese threat actors, though Apple denies any connection to Chinese hacking activity.

Trends, Tools, or Tactics of Interest

The tool pngdump.py has been updated to enhance its capability for extracting chunks and embedded data from PNG images, aiding in malware analysis and forensic investigations.
There is a noted trend of malicious actors leveraging NPM packages for both remote access and destructive attacks, with packages either installing RATs or acting as wipers that erase project data.