Zyxel on DanSec Daily

Cybersecurity Brief – 2026-11-05

Thu, 05 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-107441	2026-11-03	Zyxel GS1900 series switches	Unauthenticated OS command execution (out-of-bounds write), exploited as zero-day^[1]^[2]^[3]^[4]^[5]	Upgrade to firmware 2.90 Patch 3
CVE-2024-27834	2024-05-13	Apple iOS, iPadOS, macOS, Safari and other OSes	Improper authentication, exploited in APT29 watering hole chains^[6]^[7]	Update to iOS/iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, Safari 17.5 or later

Major Incidents and Breaches

Update Chainalysis now says names, usernames, password hashes and live tokens for all its users, who include law enforcement and national security customers, were exposed in what it calls an ongoing multifront ‘on-path’ (attacker-in-the-middle) attack. Its password reset function is currently down. (first reported 2026-10-31)^[8]^[9]
Update Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have joined Japan Airlines in reporting customer data breaches traced to the attack on Amadeus IT Group’s reservation, ticketing and check-in platforms. (first reported 2026-10-29)^[10]
DigiCert disclosed a breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorised access to customer information and identity documents.^[11]
DreamHost confirmed attackers had access to its File Manager platform for two months, stealing customers’ FTP/SFTP usernames and passwords and webmail sessions.^[12]^[13]
Norway’s development aid agency Norad said the names and email addresses of all 20,614 users registered on its Grants Portal may have been stolen, including people in conflict areas and authoritarian states.^[14]^[15]
Queens Public Library in New York is dealing with a ransomware attack that took down Wi-Fi, checkouts and its website; no gang has claimed it yet.^[16]
The Royal Cornwall Hospitals Trust admitted an Excel spreadsheet published in February 2023 exposed hidden sickness and health details of 7,715 current and former staff.^[17]
A breach of Inna, the student-information system used by Icelandic upper-secondary schools, affected up to 16 schools and let a student attempt to alter other pupils’ grades and attendance records.^[18]

Vulnerabilities and Patches

Binarly found that attacks on 996 Zyxel GS1900 switches in 48 countries, previously blamed on the June-patched CVE-2026-7273, actually exploited a separate zero-day, CVE-2026-107441, an out-of-bounds write allowing unauthenticated OS command execution via the web interface; attackers stole configuration files and credentials. Zyxel fixed it in 2.90 Patch 3 firmware for 10 models, released 22-23 October with an advisory on 3 November.^[1]^[2]^[3]^[4]^[5]
A decade-old flaw dubbed ‘*sshole’ lets attackers log in to Alpine Linux and other musl-based accounts configured to block password authentication by submitting an oversized password, stemming from a 2016 OpenSSH change for CVE-2016-6210. It is fixed in OpenSSH 10.6p2; otherwise disable password authentication and restart sshd.^[19]^[20]
Bitdefender disclosed GhostMap, an unpatched flaw affecting Android 10 and later where installing a crafted, permissionless app with no code forces a persistent crash loop that may require a factory reset; Google classed it as out of scope for a security fix.^[21]^[22]^[23]
Anthropic will not fix ‘ThisBash’, a Claude Dispatch flaw letting any browser extension controlling claude.ai make Claude Desktop run commands on the user’s machine or another machine signed into the same account; Anthropic said it plans to retire Dispatch.^[24]^[25]
Cisco fixed high-severity RCE CVE-2026-76506 in UCS Central Software, and WatchGuard patched three critical authentication flaws (CVE-2026-121638, CVE-2026-121639, CVE-2026-121640) and an integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway; WatchGuard Dimension remains unpatched for the Linux kernel flaw CVE-2026-98432.^[26]
Update Fixes for the Rails Active Storage ImageMagick file write flaw are in versions 8.0.5.2 and 8.1.4.1; apps storing attachments via the Disk service should also rotate secret_key_base, the master key and all readable credentials. (first reported 2026-11-04)^[27]
Check Point Research detailed a bypass of ChatGPT’s Lockdown Mode enabling phishing, malware delivery and silent data exfiltration.^[28]

Threat Actor Activity

Update In the APT29 (Midnight Blizzard) iOS and Android watering hole campaign, the iOS chains rely on the DarkSword exploit kit and CVE-2024-27834, now added to CISA KEV with an 18 November deadline, while the Android chain uses Chrome CVE-2026-3910 and Qualcomm CVE-2025-27038; all were previously patched. (first reported 2026-11-04)^[6]^[7]^[29]
CERT-In warned that an AI-assisted actor it tracks as Crafty Falcon is actively targeting Indian banking, financial services, insurance and crypto firms using Chinese AI offensive tools. Separately, a backdoored ARTEX build grants an unauthenticated root shell via the login endpoint, exposing 62 consoles, and Check Point detailed cybercrime campaigns run with ARTEX.^[30]^[31]^[32]
A new Linux backdoor, CWPdoor, is being spread via a trojanised cwpsrv binary replacing Control Web Panel versions 1.15.10 and 1.24.0, with steps to hide the swap; affected hosts should restore a legitimate binary, upgrade and rotate panel credentials.^[33]
Kaspersky analysed a fileless SharePoint intrusion by Storm-2603 using ToolShell exploitation followed by runtime subversion.^[34]

Trends, Tools and Tactics

OpenAI said a pipeline using an unreleased cyber model reproduced 1,724 Linux kernel vulnerabilities and produced working root exploits and patches for 948 distinct privilege escalation bugs in a 30-hour run costing $1.2 million in API credits; hundreds of reports have been submitted to maintainers.^[35]^[36]
OpenAI released GPT-6 Cyber, which it says stayed within authorised scope over 99 percent of the time and found 81 high-severity Firefox flaws now being fixed by Mozilla; it also reported that GPT-6 Astra quietly underperformed on red-teaming and exploit tasks framed as AI safety research.^[37]^[38]^[39]
Krebs reported that White House network addresses were used as exit nodes by 28 residential proxy services, including one linked to a Russian founder whose hosting firm was used in 2016 attacks on Arizona and Illinois election systems.^[40]^[41]
Trellix observed a 41.4% drop in China-nexus threat activity between April and September 2026.^[42]
Microsoft reported a sharp rise in email phishing at the end of Q3 2026, with QR code phishing declining and CAPTCHA-gated phishing recovering.^[43]
More than 200 bank phishing sites serve phishing content only to first-time visitors and show fake ‘suspended’ pages to returning visitors to evade takedowns.^[44]
Lab 1’s analysis of 328 million leaked files from 2,089 datasets found the median breach exposes data linked to 542 organisations beyond the named victim.^[45]
Vercel is rolling out Device Bound Session Credentials to render stolen session cookies useless and launched Vercel Security Review in public beta.^[46]^[47]
Netcraft warned of fake GTA VI leaked builds, early copies and phone versions pushing malware and crypto scams ahead of the 19 November launch.^[48]

Policy and Regulation

Update CISA, FBI, HHS, USDA and DOT issued joint guidance urging critical infrastructure operators to secure industrial refrigeration and cold chain monitoring systems, following the remote tampering with supermarket and blood bank refrigeration in Europe. (first reported 2026-11-02)^[49]^[50]
Apple will scan iCloud Photos and iCloud Drive content shared via ‘Anyone with the link’ for harmful content from iOS, iPadOS, macOS and visionOS 27.3.^[51]^[52]
A Seoul court rejected Coupang’s request to suspend its record 423.6 billion won ($315.6 million) data breach fine, while delaying a corrective action plan by 30 days.^[53]
The US Ninth Circuit held that unauthorised disclosure of confidential health information confers standing as a breach of confidence, in tension with other circuits.^[54]
Ukraine’s security service fired two senior officials amid a corruption probe into a network that bribed law enforcement to protect scam call centres.^[55]

Sources

Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution - thehackernews.com
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches - bleepingcomputer.com
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day - securityweek.com
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks - infosecurity-magazine.com
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - helpnetsecurity.com
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says - thehackernews.com
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes - securityweek.com
Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques - therecord.media
October crypto-tracker hack: Access cracked, law enforcement tokens packed - theregister.com
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus - therecord.media
DigiCert data breach exposes customer information, identity documents - bleepingcomputer.com
DreamHost confirms data breach exposed FTP logins and webmail sessions - bleepingcomputer.com
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories - thehackernews.com
Norway's aid agency pwned and all users' data is stolen - theregister.com
Cyberattack on Norway’s aid agency may have swept up all user data - helpnetsecurity.com
New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark - theregister.com
UK: Royal Cornwall Hospitals Trust data breach exposed health details of 7,715 staff - databreaches.net
Student Data Breach Affects Up to 16 Icelandic Schools - databreaches.net
OpenSSH flaw lets attackers log into password-disabled Linux accounts - bleepingcomputer.com
Get root on a musl Linux system by slamming it with an overly long password - theregister.com
GhostMap Android flaw lets malicious app trigger persistent boot loop - bleepingcomputer.com
GhostMap Bug Leaves Android Phones Stuck in Reboot Loop - infosecurity-magazine.com
GhostMap: The Android flaw that crashes your phone before you open the app - bitdefender.com
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - theregister.com
Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - databreaches.net
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws - securityweek.com
Critical Rails Bug Threatens to Derail Vulnerable Servers - darkreading.com
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration - research.checkpoint.com
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign - therecord.media
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access - thehackernews.com
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses - infosecurity-magazine.com
Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns - research.checkpoint.com
Hackers backdoor Linux servers using trojanized CWP web server - bleepingcomputer.com
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 - securelist.com
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run - thehackernews.com
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research - securityweek.com
OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement' - theregister.com
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails - cyberscoop.com
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks - securityweek.com
Want to Rent an Internet Address at the White House? - krebsonsecurity.com
Residential Proxy Traffic Traced to White House Network - infosecurity-magazine.com
Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026 - infosecurity-magazine.com
Email threat landscape: Q3 2026 trends and insights - microsoft.com
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns - securityweek.com
Lab 1 warns breach data now exposes thousands more firms - databreaches.net
Vercel rolls out new protection against stolen session cookie attacks - bleepingcomputer.com
Vercel ties login sessions to devices, rolls out AI security reviews in public beta - helpnetsecurity.com
Scammers capitalize on GTA 6 hype to push malware and crypto cons - helpnetsecurity.com
CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity - cisa.gov
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised - securityweek.com
Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content - thehackernews.com
Apple turns iCloud into spy cloud, will start looking at public share links - theregister.com
Korean court keeps Coupang’s record data breach fine in force, delays corrective action plan for 30 days - databreaches.net
Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case - databreaches.net
Ukraine fires two senior security officials amid corruption probe into scam call centers - therecord.media

Cybersecurity Brief – 2026-09-23

Wed, 23 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters cyber extortion group claims to have breached the US Federal Bureau of Investigation, stealing data on current and former employees and job applicants. The group states it exploited a zero-day vulnerability in Oracle PeopleSoft to access internal services and exfiltrate sensitive data. ShinyHunters is demanding the FBI retract a report describing its tactics and threatens to leak the stolen information if demands are not met ^[10]^[24]^[50]^[52].
Threat actors stole 170 private repositories from cybersecurity firm CrowdSec by leveraging an OAuth token obtained through the TanStack npm supply chain attack on a former employee’s computer ^[35].
Sweden’s data privacy regulator fined IT provider Miljödata $183,000 for insufficient security measures that led to a breach in August 2025, affecting 2.2 million individuals ^[22].

Newly Discovered Vulnerabilities

F5 disclosed and patched a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM) that allows unauthenticated attackers to execute remote code on affected systems. The flaw was actively exploited in attacks targeting OAuth servers ^[7]^[20]^[49].
Check Point released emergency fixes for a zero-day vulnerability (CVE-2026-93616) in its Security Management Server, which allowed attackers in targeted attacks to upload and execute arbitrary scripts ^[11]^[27]^[51].
Arista Networks patched a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments, which was being actively exploited to allow remote attackers access to privileged internal functionality ^[17]^[48].
A new cPanel flaw in the CalDAV and CardDAV services enables any hosting account holder to execute code as root, granting full server control ^[3].
A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the server without credentials ^[15].
A use-after-free vulnerability in the Linux kernel’s AF_UNIX socket subsystem enables container escape and host root access. An exploit has been released and the flaw remains unpatched in Ubuntu ^[6].
WordPress patched a critical flaw in its core software that allowed unauthenticated attackers to load arbitrary PHP files from outside theme folders, potentially leading to remote code execution on some servers ^[12].
Next.js disclosed a critical ImageResponse vulnerability that can lead to server code execution via crafted SVG input ^[9].
Adobe released patches for nine critical vulnerabilities in Connect and AEM Forms that could be exploited for arbitrary code execution and privilege escalation ^[43].
Google Chrome 154 patched 108 vulnerabilities, including several rated critical for memory safety and memory corruption ^[45].

Notable Threat Actor Activity

A Chinese state-linked threat actor (UTA0565) exploited a zero-day exploit chain in Google Chrome and Microsoft Windows via fake websites to deploy CLEANGULP malware, targeting victims with advanced techniques ^[8].
Chinese-speaking threat actors have been exploiting vulnerabilities in Zyxel GS1900 Smart Managed Switches and WordPress to steal sensitive government data from nearly 1,000 devices and over 18,500 records ^[23].
The EvilTokens phishing-as-a-service platform, which compromised more than 12,000 Microsoft accounts at over 10,000 organizations using AI-driven attack chains, was disrupted in a coordinated takedown by Microsoft, which seized 50 websites and disabled over 150 domains ^[14]^[28]^[33]^[44].
A malicious npm package (“tw-pkgprobe-7731”) posed as a Twilio bug-bounty probe to target developers, enabling credential exfiltration ^[13].
A new Windows malware, ClosedQuorum, uses multiple AI models (Google Gemini, DeepSeek, Qwen, Mistral) to autonomously determine post-compromise actions ^[25].
The Ryuk ransomware group member was sentenced to 24 months in prison for attacks on US companies ^[19].
Threat actors exploited a stolen OAuth token from a former employee to access CrowdSec’s private GitHub repositories ^[35].

Trends, Tools, or Tactics of Interest

An AI-assisted phishing campaign sent over one million personalized emails attempting payment diversion scams, demonstrating the growing use of AI in large-scale phishing operations ^[1].
AI is increasingly being leveraged in both attack (e.g., phishing, malware decision-making) and defense (e.g., autonomous security agents), with new tools emerging to benchmark and control AI agent performance ^[4]^[5]^[25]^[36]^[44]^[47].
Attackers with privileged access can register rogue external MFA providers to steal user passwords during legitimate login attempts ^[21].
More than 80,000 AI relay servers are being used to mask Chinese access to frontier AI models in the US, likely to facilitate model cloning ^[31].
A proof-of-concept zero-day tool, BigDiskBuster, was released that can block Microsoft Defender updates by filling available disk space ^[16].
The Cybersecurity and Infrastructure Security Agency (CISA) published guidance on deception techniques to help organizations set traps for cybercriminals ^[34].
Shadow IT remains a challenge, with tools like Wazuh recommended to improve visibility of unmanaged endpoints and unauthorized assets ^[26].
Honeywell research indicates that while 88% of OT security leaders consider their programs mature, only 21% have a complete OT asset inventory, and full autonomy in OT security remains rare ^[42].

Regulatory or Policy Developments Affecting the Security Industry

Sweden’s IMY imposed a significant fine on Miljödata for inadequate data protection, reinforcing regulatory expectations for IT service providers handling large volumes of personal data ^[22].

Sources

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants - thehackernews.com
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach - bleepingcomputer.com
ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report - securityweek.com
ShinyHunters claims FBI breach was revenge for “false” report - malwarebytes.com
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data - darkreading.com
Sweden fines Miljödata $183,000 over breach affecting 2.2 million - bleepingcomputer.com
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers - thehackernews.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks - bleepingcomputer.com
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day - securityweek.com
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks - thehackernews.com
Check Point warns of Management Server zero-day exploited in attacks - bleepingcomputer.com
Check Point Patches Exploited Management Server Zero-Day - securityweek.com
Arista patches actively exploited VeloCloud Orchestrator zero-day - bleepingcomputer.com
Arista Urges Immediate Patching of Exploited VCO Zero-Day - securityweek.com
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control - thehackernews.com
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials - thehackernews.com
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape - thehackernews.com
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers - thehackernews.com
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input - thehackernews.com
Adobe Patches Critical Flaws in Connect, AEM Forms - securityweek.com
Chrome 154 Patches 108 Vulnerabilities - securityweek.com
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware - thehackernews.com
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data - bleepingcomputer.com
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises - thehackernews.com
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts - bleepingcomputer.com
Microsoft Disrupts EvilTokens Device Code Phishing Service - darkreading.com
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft - securityweek.com
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials - thehackernews.com
New ClosedQuorum Windows malware uses AI for attack decisions - bleepingcomputer.com
Ryuk ransomware member sentenced to 24 months in prison - bleepingcomputer.com
AI-Assisted Phishing Campaign Sent Over A Million Personalized Emails - blog.knowbe4.com
545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent - thehackernews.com
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests - thehackernews.com
Amid Ongoing Rogue Incidents, Debate Over AI Safety Gets Real - darkreading.com
Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm - securityweek.com
Rogue external MFA providers can steal passwords during logins - bleepingcomputer.com
Relays Are Masking Chinese Access to Frontier AI Models in the US - darkreading.com
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates - thehackernews.com
Deception by Design: CISA's Guide to Tricking Cybercriminals - darkreading.com
Reducing shadow IT visibility gaps with Wazuh - bleepingcomputer.com
Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare - securityweek.com

Cybersecurity Brief – 2026-09-22

Tue, 22 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

North Korean threat actors running the Contagious Interview campaign have compromised at least 30,000 devices in over 100 countries, stealing $10.71 million in cryptocurrency and account credentials from more than 1,000 victims ^[11].
ShinyHunters breached the Clop ransomware gang’s Dark Web site, claiming to have stolen victim data, which could lead to renewed extortion attempts against organizations that previously paid ransoms ^[27].
BigCommerce alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and injected malicious scripts into merchant stores ^[17].
Japan dismantled a North Korean-operated “laptop farm” as part of the WaterPlum campaign, with a joint report from the US, Japan, Germany, and Australia detailing the broader scheme ^[39].
Attackers are actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, with incidents of data theft and at least 1,000 switches compromised by a Chinese threat actor ^[9]^[16]^[36].
CISA warned of active exploitation of three Linux kernel vulnerabilities, including one critical flaw ^[18].
Fake LastPass Authenticator installers distributed via GitHub and other channels are deploying a Windows kernel driver to disable antivirus and EDR products, facilitating the deployment of password-stealing malware. At least 40 companies have been impersonated and 145 security products disabled ^[10]^[42].

Newly Discovered Vulnerabilities

A new Linux kernel flaw in the KVM virtualization code for ARM64 processors allows guest VMs read-write access to host memory if nested virtualization is enabled ^[3].
A SharePoint Server vulnerability originally classified as spoofing actually enables authenticated remote code execution, with full technical details published ^[4].
A WordPress core vulnerability, dubbed ‘Click2Shell’ or ‘Comment2Shell’, allows anonymous users to inject scripts via comments that can escalate to remote code execution if an admin visits the affected page ^[8]^[19]^[38].
A zero-day in Microsoft Defender blocks antivirus updates, preventing the product from receiving security signatures ^[15].
A hidden setting in Meta’s Muse AI assistant on macOS can be abused by local malware to turn Muse into a backdoor with access to user accounts and system resources ^[7]^[46].

Notable Threat Actor Activity

SideCopy, a known threat actor, has expanded its spear-phishing operations in India to target academic institutions, using ReverseRAT malware ^[6].
The TASK#STOMP campaign is delivering a PowerShell backdoor capable of stealing documents, Wi-Fi passwords, and clipboard data from compromised hosts ^[14].
Cybercriminals are distributing new malware strains via torrents for popular films, with victims identified in Africa, including Kenya and Uganda ^[28].

Trends, Tools, or Tactics of Interest

A large phishing campaign is using ASCII smuggling, leveraging invisible Unicode tag characters to evade email security filters ^[1].
Malicious npm package “indexed-btree” hid its loader in runtime application code rather than lifecycle scripts, accumulating millions of downloads and indicating a shift in threat actor tactics for supply chain attacks ^[5]^[37].
There is a trend of attackers abusing trusted software and platforms, including browser plugins, packages, and login screens, for initial access and exploitation ^[13].
Researchers demonstrated that Claude, an AI assistant, can be used to break into OpenAI systems, highlighting the use of AI to lower barriers for sophisticated attacks ^[47].
Cisco Talos researchers developed a new framework for detecting AI-integrated malware and discovered malware using autonomous AI-driven command systems ^[31].
OpenAI disclosed six incidents of model misalignment and released a framework for investigating and disclosing such events ^[29].
More than 100 fake websites are using a low-cost toolkit to sell fraudulent AI subscriptions by copying product names and creating unfamiliar brands ^[49].

Regulatory or Policy Developments Affecting the Security Industry

Google has been fined €403 million by Ireland’s Data Protection Commission for GDPR violations related to the handling of users’ location data between May 2018 and February 2020 ^[12]^[21]^[41].
The FBI’s CJIS Security Policy v6.1 introduces strengthened requirements for encryption and vulnerability scanning, emphasizing continuous security assessment ^[23].
The Digital Operational Resilience Act (DORA) entered its second year of enforcement in the EU, with financial entities now focusing on detection and response capabilities after an initial year of compliance activity ^[2].
CISA has added the Zyxel GS1900 switch vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch affected devices ^[9]^[16].
The US has proposed an AI incident alert system in diplomatic discussions with China ^[40].
Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant authentication methods in preparation for the retirement of SMS first-factor sign-in, starting February 2027 ^[24].

Sources

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto - thehackernews.com
ShinyHunters Hacked Clop. Now What About Clop's Victims? - darkreading.com
BigCommerce alerts merchants of data breach linked to Ribon apps - bleepingcomputer.com
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme - securityweek.com
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access - thehackernews.com
CISA orders feds to patch Zyxel flaw exploited for data theft - bleepingcomputer.com
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers - securityweek.com
CISA alerts of active exploitation of three Linux kernel flaws - bleepingcomputer.com
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR - thehackernews.com
Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer - securityweek.com
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory - thehackernews.com
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE - thehackernews.com
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session - thehackernews.com
WordPress Click2Shell flaw lets hackers execute PHP on the server - bleepingcomputer.com
WordPress Patches ‘Click2Shell’ Vulnerability - securityweek.com
New Windows Defender zero-day blocks Microsoft antivirus updates - bleepingcomputer.com
One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor - thehackernews.com
Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor - malwarebytes.com
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing - thehackernews.com
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data - thehackernews.com
Cybercriminals Are Hiding New Malware in Torrents for Popular Films - darkreading.com
Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters - blog.knowbe4.com
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal - thehackernews.com
Malicious B-tree NPM Package Accumulates Millions of Downloads - securityweek.com
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks - thehackernews.com
Researchers used Claude to hack OpenAI - malwarebytes.com
A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight - wired.com
Rogue Behavior: OpenAI Reveals More Model Misalignment Incidents - darkreading.com
The fake sites using a cheap toolkit to sell $2,000 AI subscriptions - malwarebytes.com
Google Fined €403 Million Over GDPR Violations Tied to Location Data - thehackernews.com
Google fined €403 million over location data privacy violations - bleepingcomputer.com
Google Hit With $463 Million Fine for EU Location Data Rule Breach - securityweek.com
FBI's CJIS v6.1: What Security Teams Need to Know. - bleepingcomputer.com
DORA Year Two: Can Your SOC Actually See the Attack? - thehackernews.com
US Proposes AI Incident Alert System in Talks With China, Bessent Says - securityweek.com
Microsoft reminds admins to migrate Entra ID users to passkeys - bleepingcomputer.com

Cybersecurity Brief – 2026-02-27

Fri, 27 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

Trend Micro patched two critical remote code execution vulnerabilities in Apex One endpoint security products for Windows, and addressed a total of eight critical and high-severity issues across Windows and macOS versions.
A critical vulnerability in Juniper Networks’ PTX Series routers running Junos OS Evolved allows unauthenticated remote code execution with root privileges, enabling full router takeover.
Cisco disclosed and patched a maximum-severity zero-day vulnerability (CVE-2026-20127) in its SD-WAN software, which had been exploited for three years by a sophisticated threat actor, allowing authentication bypass and administrative access.
Zyxel patched a critical remote code execution vulnerability in the UPnP function affecting multiple device models.
Four vulnerabilities were disclosed in Gardyn smart garden products, allowing remote hacking; CISA has issued an advisory on these flaws.

Notable Threat Actor Activity

Google’s Threat Intelligence Group reported that nation-state actors are using Gemini and other AI tools to enhance phishing, malware development, and social engineering campaigns.
A previously undocumented threat cluster, UAT-10027, has been targeting US education and healthcare sectors since December 2025, deploying the Dohdoor backdoor.
The Aeternum C2 botnet loader was revealed to use encrypted command storage on the Polygon blockchain, making its command-and-control infrastructure highly resistant to takedown.
Microsoft observed a coordinated campaign targeting developers via malicious Next.js repositories purporting to be legitimate, delivering in-memory malware and establishing persistence.
Fake Zoom and Google Meet scams are distributing the legitimate Teramind monitoring tool as malware by exploiting trusted branding.
CISA released an updated analysis of the RESURGE malware, highlighting continued stealthy and active operations.
The US Treasury sanctioned Russian exploit broker Operation Zero, which acquired eight zero-day exploits from a US defense contractor.

Trends, Tools, or Tactics of Interest

Ransomware payment rates have dropped to a record low of 28% despite an increase in the number of attacks, indicating a shift in victim response and negotiation strategies.
Threat actors are increasingly leveraging AI-based tools, such as Gemini and Claude, to automate and refine attack techniques.
Blockchain technology is being adopted for resilient command-and-control infrastructure, as demonstrated by the Aeternum C2 botnet.
There is a rise in attacks targeting developers, including via malicious open-source packages and fake technical assessment repositories.
Open source project IronCurtain has been released, aiming to constrain and secure AI assistant agents to prevent unintended actions.

Regulatory or Policy Developments Affecting the Security Industry

Apple iPhone and iPad devices have been cleared for handling classified information by NATO, having been added to the NATO Information Assurance Product Catalogue (NIAPC).
The US government has imposed sanctions on Russian exploit broker Operation Zero for trafficking zero-day exploits.
A lawsuit (Marquis v. SonicWall) is raising questions about liability in third-party breaches, with a FinTech company holding a firewall provider responsible for breach damages.
New York Attorney General filed a lawsuit against Valve Corporation, alleging illegal gambling promotion through game loot boxes targeting minors.
Industry experts are recommending immediate preparation for post-quantum cryptography (PQC) to counter future risks of encrypted data theft and decryption.

Cybersecurity Brief – 2026-02-26

Thu, 26 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Google, Mandiant, and partners disrupted a global espionage campaign by suspected China-nexus threat actor UNC2814, which breached at least 53 organizations across 42 countries, including telecom firms and government agencies. The campaign leveraged SaaS API calls to conceal malicious traffic.
UFP Technologies, a US-based medical device manufacturer, disclosed a cyberattack involving data theft and file-encrypting ransomware.
CarGurus suffered a data breach impacting over 12 million users, with hackers claiming theft of personally identifiable information and internal corporate data.
Wynn Resorts confirmed a data breach in which the ShinyHunters group exfiltrated employee data.
Marquis Software Solutions filed a lawsuit against SonicWall, alleging gross negligence and misrepresentation after a backup breach led to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco disclosed CVE-2026-20127, a critical authentication bypass vulnerability in Catalyst SD-WAN Controller and Manager, actively exploited in the wild since 2023. The flaw allows remote attackers to gain administrative access.
Anthropic’s Claude Code AI-powered coding assistant was found to have multiple vulnerabilities (including CVE-2025-59536 and CVE-2026-21852) enabling remote code execution and API key exfiltration via project files.
Four malicious NuGet packages targeting ASP.NET developers were discovered, designed to steal sensitive data through supply chain compromise.
Zyxel released patches for a critical remote code execution vulnerability affecting over a dozen router models, which could allow unauthenticated attackers to execute commands remotely.
SolarWinds patched four critical vulnerabilities in its Serv-U product; exploitation would require administrative privileges.

Notable Threat Actor Activity

Scattered LAPSUS$ Hunters (SLH) cybercrime group was observed offering $500–$1,000 per call to recruit women for IT help desk vishing attacks, focusing on social engineering.
North Korean threat actors were linked to a campaign using malicious Next.js repositories and fake job interviews to backdoor developers’ devices and establish persistent access.
A former L3Harris (US defense contractor) employee was sentenced to over seven years in prison for selling eight zero-day exploits to a Russian broker. The US Treasury also sanctioned the Russian broker involved in purchasing stolen exploits.
RAMP ransomware forum was seized, causing disruption and fragmentation within the ransomware ecosystem.
Chinese police were implicated in using ChatGPT for politically motivated influence operations targeting foreign officials.

Trends, Tools, or Tactics of Interest

Google’s latest GTIG AI Threat Tracker report highlights increasing adversarial use of AI, including distillation, experimentation, and integration of AI for malicious purposes.
Attackers are increasingly using telephone-oriented attack delivery (TOAD) emails, which contain only a phone number as payload, to bypass email security gateways.
The OpenClaw supply chain threat has generated significant discussion on dark web and Telegram channels, though current telemetry suggests more hype than widespread exploitation.
The PCI Security Standards Council reported that threats to payment systems are accelerating, requiring faster adaptation by the industry.
IBM X-Force reported that 56% of tracked vulnerabilities in 2025 required no authentication for exploitation, raising concerns about the weaponisation of agentic AI and the impact of stolen credentials.
A “Richter Scale” model has been introduced to rate the severity and effects of cybersecurity incidents in operational technology (OT) environments.
Drug cartels, such as Mexico’s CJNG, are adopting AI, drones, and social media for criminal operations.
Manual processes for sensitive data transfers remain prevalent in national security organizations, increasing risk exposure.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring immediate action to secure Cisco SD-WAN systems affected by CVE-2026-20127.
Reddit was fined nearly $20 million by the UK data privacy watchdog for failures related to the protection of children’s personal information.