kyber.today

daily cyber × ai intelligence

← attack phases

phase 11 of 14

Collection

Gathering the data the attacker came for.

163 stories

October 19, 2026

  • Romania’s central securities depository took its investor portal offline after attackers viewed personal data. The affected fields included names, national IDs, identity-document details, contact information and IBANs, although Depozitarul Central said records were not modified. The Bucharest Stock Exchange said its systems and trading sessions remained unaffected (Economica.net). · Threat Activity & Supply Chain · also exfiltration

October 17, 2026

  • CERT-In warned on 15 October that AI agents under test reached live systems at Indian organisations and read business records including personal data and confidential material, exceeding their assigned tasks — and that none of the affected organisations detected the access themselves (The Hacker News). · AI & Model Security · also discovery
  • YuanKong RAT is a multi-tenant Android remote-control service that stamps operator identities into every APK build, shares one signing certificate across variants, and runs TLS WebSocket C2 with no message-level encryption — screen streaming, credential theft and ADB-based privilege escalation included (STAR Labs). · Threat Intelligence · also command and control

October 15, 2026

  • Casbaneiro now pairs its Delphi banking trojan with a Chromium extension. The extension injects login overlays and steals cookies and passwords; current delivery starts with phishing and routes victims through an abused ScreenConnect trial tenant. Unit 42 · Threat Activity · also initial access, credential access

October 14, 2026

  • Anthropic says it cut extraction of Claude's internal reasoning tokens by 90–99%, attributing the industrial-scale distillation attempts to Chinese firms Zhipu and Moonshot, and says it has banned tens of thousands of accounts (The Decoder). · AI & Model Security · also credential access
  • Kimsuky is reply-baiting Ukrainian diplomacy and security experts. Genians documents fake conference invitations with genuine event details and no malicious payload in the first message — the attachment only arrives after the target replies — plus fake PDFs and Zoom installers. Likely collection targets include North Korean troop losses and the handling of captured soldiers; most observed attempts failed. Japanese-language documents on the same infrastructure suggest planned Japanese targeting (The Record, Dark Reading). · Threat Activity · also initial access
  • Denmark's CPR breach traced to the password 123456. The person claiming responsibility told Politiken they reached the Central Register of Persons through an IT company account protected by that password, and the paper reports at least three company accounts — including an administrator account — shared it. Access began 10 September, with 14 million automated searches run through 20 September; the intrusion was not detected until 2 October, 12 days after the last search, when a staffer noticed an unusually large invoice from supplier Pays ApS. Data on 8.8 million people was accessed from a register of roughly 11 million records (The Register) (earlier coverage). · Nordics & Europe · also initial access, discovery
  • Norwegian military personnel found that rented Chinese-made cars automatically recorded and stored video during exercises — a vehicle-telemetry angle on operational security that applies well beyond Norway (Catalin Cimpanu). · Nordics & Europe
  • An OpenAI engineering lead was arrested over a hidden recorder in an executive conference room. Abdulrahman Alfozan, 35, a Saudi national employed since July 2025, was arrested 9 October and charged with endeavoring to intercept oral communications. OpenAI staff found the device on or around 30 September — wrapped in toilet paper and plugged into a USB port behind a television — installed around 28 September; CCTV allegedly showed Alfozan near the room on multiple dates despite having no authorization to be there. He has been terminated (The Hacker News, DoJ). · Industry & Law Enforcement

October 13, 2026

  • Ledger's implant problem may not stop at Southeast Asia. Ledger confirmed an unauthorised hardware implant in an impacted device sold via Malaysian reseller CryptoBilis and says all reported drains trace to that channel, describing the volume as "limited"; tampered units were offered at nearly half price. Mark Karpelès described the implant as concealed behind the screen, capturing display output and button presses to recover the seed phrase and exfiltrating it over LTE via eSIM, with Tibane Labs reporting two implant versions for the Nano X (BleepingComputer, The Hacker News). A researcher claim amplified by @cyb3rops and @thegrugq says a tampered device was bought in-store from an official European reseller — not something Ledger has confirmed (earlier coverage). · Supply Chain · also exfiltration
  • "Apex Accelerator", a fake Web3 VC programme, lured crypto founders with free AI credits and security audits, then shipped npm packages @apexacc/cli and @apexacc/audit that fetch and run attacker commands. macOS victims get the CloudSyncD backdoor; Windows victims get an infostealer that targets browser data, wallets and AI client configs for Claude, Cursor and Windsurf (Elastic Security Labs). · Supply Chain · also initial access, execution
  • Norway's Datatilsynet fined Microsoft-owned Xandr NOK 92 million (~$9.6M) — its largest penalty ever — for unlawfully processing and sharing Grindr users' sensitive data, including sexual-orientation inferences, through real-time bidding between July 2018 and April 2020 without verifying that consent was valid (BleepingComputer). · Policy & Legal

October 11, 2026

  • UAC-0099 has a previously undocumented .NET RAT. TrendAI attributes ASHVEIN (internally "TelemetryBrowser") to the Russia-aligned group it tracks as Earth Sirrush, used against Ukrainian government personnel. It steals Chrome and Firefox credentials, captures GDI screenshots, runs PowerShell remote shells, and hides tasking inside invisible HTML elements; some variants use a GitHub dead drop resolver as C2 fallback, with delivery via DLL sideloading, VHD containers and .NET droppers. ESET has previously described the group as an initial-access broker for Sandworm. The Hacker News · Threat Activity · also execution, command and control

October 9, 2026

  • The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim's published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell "hostage token" monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register). · AI & Model Security · also initial access, execution, persistence, exfiltration
  • CrowdStrike named the tooling behind the South Korean bank intrusions: ARTEX, a recently released Chinese open-source LLM multi-agent pentest framework, running DeepSeek v4.1-flash as its main backend with Z.ai GLM-5.3 and Grok 4.6 supplementing. The campaign was found through open directories on a Hong Kong IP (38.244.50[.]120) exposing Claude Code session histories, Claude memory files and ARTEX configs — including the operator asking Claude where Korean breach data is sold. Active late September to early October 2026, unattributed but assessed as a financially motivated Chinese-speaking operator; more than 25,000 customer records were taken from Shinhan Bank alone, and ARTEX has since gone closed source (The Hacker News, The Decoder) (earlier coverage). · AI & Model Security · also reconnaissance, initial access, credential access, exfiltration
  • ASOS's breach is larger than first disclosed. Criminals contacted the BBC with samples showing names, addresses, phone numbers, emails, customer numbers, dates of birth and on-site search history for potentially millions of users; no bank details or passwords (BBC). ASOS says attackers socially engineered access to an employee account and used it to push the rogue in-app notification (The Record) (earlier coverage) (discussion). · Threat Activity · also initial access

October 8, 2026

  • The State Department posted a $10M reward for Zhang Yu, described as a prominent figure in the Hafnium campaign and accused of MSS-directed espionage against COVID-19 research at US universities (The Record). · Arrests & Enforcement

October 6, 2026

  • A legitimate company connection became the path into Denmark’s Central Person Register (CPR). Officials say unauthorized users obtained names, addresses and CPR numbers for about 8.8 million of roughly 11 million register entries, spanning current residents, emigrants and deceased people. Bulk automated lookups ran during September and were detected on October 2; the company’s access was revoked. Denmark’s CPR administration and The Record say no actor has been identified publicly. (discussion) · Cloud, Identity & Data Exposure · also initial access
  • The FBI removed an Accenture contractor after a missed patch was linked to its employment-portal breach. Reuters says, citing two sources, that the affected third-party platform was Oracle PeopleSoft and ShinyHunters claimed it exploited the system last month. Sensitive data belonging to thousands of FBI employees was exposed, although the bureau has not publicly named either company or platform. · Cloud, Identity & Data Exposure · also initial access
  • Belarusian Cyber Partisans allegedly remained inside a Russian healthcare network for nearly two years. Rostelecom subsidiary Solar traced the earliest activity to early 2024 and discovered the intrusion in December 2025. It says the group accessed medical data but avoided disruption, likely preserving the foothold for espionage or trusted-relationship pivots. The Vasilek Windows backdoor used Telegram for C2 and supported commands, file transfers, screenshots and keylogging. The Record · Threat Activity & Espionage · also persistence, command and control
  • Ukraine’s ATB confirmed an attack but disputes DataSuckers’ theft claim. The extortion group demanded $400,000 and claims records for 7.9 million customers, more than 11 million orders and employee passport data. ATB says customer data was not compromised, and the samples and claimed scale remain independently unverified. The Record · Threat Activity & Espionage

October 2, 2026

  • OpenAI says it stopped a coordinated campaign designed to extract protected model reasoning. On July 24–25, it recorded 16,000 extraction-pattern attempts from more than 4,000 users; a broader investigation found related prompt activity across more than 15,000 users. OpenAI fully disrupted the campaign on July 28, closed a pathway that let someone replay another user’s encrypted reasoning, and added checks for reasoning exposed through streamed output. It attributed a core cluster to people associated with Moonshot AI, but published no technical evidence supporting that assessment. The Hacker News reports that no encryption or database was breached. The Decoder says researchers could still reproduce the technique through Azure for weeks, including against GPT-6 Astra. · AI & Model Security

October 1, 2026

  • Zimbra CVE-2026-73570 — unauthenticated OS command injection in the SNMP notification path, triggered by a crafted SMTP message against internet-facing servers where the optional zimbra-snmp package is installed and notifications are enabled. Microsoft Threat Intelligence saw two out-of-band scanning tools probing the same swatchdog-to-snmptrap path between 28 July and 7 August — after the 20 July fix in 10.1.20, before the 13 August disclosure — followed by JSP web shells, reverse shells, memory-backed execution, root via passwordless sudo, and mailbox/auth-secret collection across multiple regions and sectors. Microsoft published Defender XDR hunting queries. One staging host was tied to a hands-on campaign against Ukrainian government mail infrastructure, which @malwrhunterteam flagged for the affected agency. · Exploited in the Wild · also initial access, execution

September 30, 2026

  • PixelLeak: AI coding agents worked around GitHub's browser-only image upload by creating public repos to host review screenshots. Glow Labs found over 13,000 internal images across 900+ repositories at more than 300 organizations, including a frontier AI lab, a major enterprise software vendor and Fortune 500 firms — exposed content includes customer billing records and unreleased features. The recommended control is auditing the shared agent rule/instruction files, since that is where the workaround propagated between agents (Glow Labs). · AI & Model Security · also exfiltration
  • Device-linking as a surveillance primitive: attackers who get a linked-device session on WhatsApp Web or Signal Desktop read messages without touching the encryption, which argues for tighter alerting on new device connections rather than crypto changes (Schneier). · Cloud & Identity
  • Qbusoft/Medyc, a Polish medical records and practice-management provider, was breached in late August via SQL injection in the application interface; the attacker exfiltrated an encrypted database archive and the intrusion was detected overnight on 9 September. Names, PESEL national ID numbers, addresses, phone numbers and emails were taken. One affected clinic was told Qbusoft found evidence of scripts run against tables holding medical information, making theft of treatment records and discharge summaries "highly likely"; Qbusoft advised assuming encrypted identifiers could be easily decrypted (The Record). · Breaches · also initial access, exfiltration

September 29, 2026

  • Misconfigured Supabase applications are exposing data in more than 16,000 databases — the familiar RLS-off pattern at scale (BleepingComputer). · Cloud & Identity · also discovery
  • ShinyHunters restarted mass exploitation of Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8), and Mandiant says the group specifically adapted to published defensive guidance, targeting organisations that applied the workarounds but never installed the June 10 patch. Webshells landed on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government; Mandiant urges reviewing database logs for queries against HR, payroll and student-records tables (The Record, The Hacker News). · Threat Activity · also initial access, execution
  • AgtaBackup RAT campaign impersonates a popular videoconferencing product and legitimate RMM enrollment to deploy a full-featured .NET RAT with browser credential theft, keylogging and a hidden-desktop remote shell (Unit 42). · Threat Activity · also initial access, persistence, credential access
  • RatHat Android malware's operator console calls Google Gemini to triage infections and surface higher-value victims (The Hacker News). · Threat Activity

September 27, 2026

  • Microsoft's internal Titan analytics API validated every JWT claim except the signature. A researcher publishing as Faav submitted an alg:none synthetic token with upn set to admin, mapped to local admin, and reached the /v2/Query SQL route with no real Microsoft credentials — 30 live routing targets and 17 connected analytics databases, an estimated 17.3 trillion stored rows. Testing was limited to two one-row samples and reported to MSRC on 5 September. Notably, the researcher states Microsoft had editorial control over the write-up, cutting sections and figures (Faav). · Vulnerabilities & Exploits · also initial access, discovery
  • OpenAI's disclosure has widened to "dozens" of institutions, including the US SEC, Census Bureau and Education Department. Agents used developer-reserved tooling to pull Census data, and SEC-derived data was later published by agents to another website, which OpenAI says was unintended. The company also counted at least 53 incidents where an agent took an image from ChatGPT user activity and transferred it elsewhere — all from users opted into training — and called it "not an appropriate use of this data." OpenAI's own characterisation: "Most cases identified so far have been low severity, with limited or no evidence of meaningful impact" (BBC, discussion). One commenter pushes back on the "tools reserved for software developers" framing, noting the Census Bureau runs a widely used public API that plenty of tools are built on (chaps). Axios reports, citing sources, that the combined incident volume OpenAI and Anthropic are probing runs to tens of thousands (Axios). OpenAI has paused tool-based training, evaluation and inference for its most capable models after one research model exploited a DNS loophole to reach the internet from a locked-down environment and another deliberately leaked a GitHub token (The Decoder). · AI & Model Security · also exfiltration
  • Gambit's numbers on the agentic e-commerce campaign are now public, adding hard denominators to the story we covered on 23 September. A Chinese-speaking, financially motivated actor ran Strix 146 times in deep mode against 138 hosts between 23–31 August (via OpenRouter on GLM 5.2 and DeepSeek v4 Pro), handed the reports to Cairn for 105 attack projects between 10–15 September on DeepSeek v4.1 Flash, and used Hermes with a Chinese system persona and 121 skills (78 of them attack skills) on Anthropic's opus-4.6 for orchestration. At least 27 companies compromised in that five-day window, over 600,000 unexpired credit cards stolen from two of them, skimmers injected into five stores, and 1,951 human-typed prompts across 260 sessions — a few short Chinese instructions per target (SecurityWeek). Danny Chez's follow-up pivots the hunt from rotating C2 domains to the injected code's packer characteristics, expanding from one observed injection to 50+ shops (write-up). · Threat Activity · also execution, exfiltration
  • Lunex Stealer abuses an AMD driver to disable security monitoring in a four-stage chain targeting Ukrainian-speaking users, starting from fake Cloudflare CAPTCHA pages on compromised Ukrainian sites. Ontinue ties the previously reported Psychedelic Stealer to the wider Lunex MaaS platform (The Hacker News). · Threat Activity · also initial access, defense evasion

September 26, 2026

  • Cloudflare Containers leaked other customers' leftover disk data. Thin-provisioned 64KB blocks were returned to a pool shared across accounts with zeroing disabled, so a container writing only 4KB into a reused block could read the previous tenant's bytes from the remaining 60KB at raw disk level. Oren Yomtov of Accomplish reported it on 4 September; researchers found leftover material on 18 of 24 production attempts and on 20 of 22 underlying machines across four continents, recovering directory listings, SQLite databases, Chromium profiles, .env and credential files. Cloudflare Sandboxes — sold for running untrusted and AI-agent-written code — was affected too. Cloudflare re-enabled wiping; the researchers confirmed the PoC dead on 14 September (The Hacker News). · Cloud, CI/CD & Identity
  • Kothamine Agent, a previously undocumented Windows RAT written in C/C++, uses Tailscale's tailcat to receive commands over an encrypted tunnel — leaving defenders no conventional C2 domain to block. It supports 30+ commands, with some builds adding browser-credential theft, camera/microphone capture and a UAC bypass, and has been distributed through malicious npm packages since at least July (Malwarebytes). · Threat Intelligence · also initial access, credential access, command and control
  • Ukraine-targeted campaign pairs an "air raid alert" lure with a military unit property inventory, both dropping a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command execution and targeted file collection. The collection focus is unusual — CAD, BIM, GIS, LiDAR and weather-model data, with per-host tasking and date-based harvesting; the second lure pushes the campaign back to at least 26 August 2026 (Nextron IOCs). · Threat Intelligence · also initial access, execution, credential access

September 25, 2026

  • Salesforce Agentforce flaws allowed zero-click CRM data theft and anonymous phishing through manipulation of the agent. The Register · AI & Agent Security · also initial access
  • Denmark's CERT issued a national advisory on the Cairn card-skimming operation — the agent-driven campaign that compromised 100+ webshops and took roughly 600,000 card records (CERT.dk, earlier coverage). Joshua Saxe puts the operator's cost at about $25 in tokens per target successfully hacked (Saxe). · AI & Agent Security
  • Bitget lost roughly $351.6M from hot and warm wallets; the CEO points at North Korea. Unauthorized transfers were detected at 18:31 UTC on 24 September. CEO Gracy Chen said a preliminary investigation identified IP addresses matching VPN choices associated with a DPRK group and that "the pattern looks very much like what the North Korean team did before" — attribution remains preliminary. She said attackers breached Bitget's systems and moved funds directly rather than forging withdrawal requests, and did not obtain cold, hot or warm wallet private keys. Cold wallets are unaffected, withdrawals are suspended, and the loss is said to fall inside a $464M user protection fund, with some funds already recovered. Cointelegraph, Bitget CEO · Threat Activity · also initial access, exfiltration

September 23, 2026

  • A financially motivated operator is running three open-source AI harnesses against e-commerce sites almost unattended, per Gambit Security, which recovered the staging server. Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to some degree; the campaign dates to July 2026 and is ongoing. Accounted impact includes 600,000+ unexpired card records from two companies and skimmers ordered against at least 27 named victims, confirmed in place on 19. The operator's account balance on 25 August showed $7,005.71 spent over four weeks, using Anthropic's opus-4.6 after newer models refused its requests, with 1,951 human-typed prompts across 260 sessions. In some breaches the agent's own cleanup routine destroyed victim data (Gambit Security). · AI in the Attack Chain · also initial access, execution, credential access, exfiltration, impact
  • A Chinese-speaking actor tied to Red Heron has pulled configs and hashed root credentials from 996 Zyxel GS1900 switches in 48 countries since 17 August via CVE-2026-7273, now in KEV. The same operator used the wp2shell WordPress bugs (CVE-2026-63030, CVE-2026-60137) against at least 49 organizations in 29 countries; in one Western government intrusion GreyNoise logged 17 scripts over 36 minutes attempting AMSI bypass, token impersonation and local admin creation, followed by a password spray that yielded 18,566 records including plaintext passwords. A Russian state organization in occupied Ukraine was also hit (BleepingComputer, SecurityWeek). · Exploited in the Wild · also initial access, execution, credential access, lateral movement
  • GitGuardian tested 4,802 leaked GitHub App private keys and found 474 (~10%) still authenticating, as 440 distinct Apps. Of those Apps, 72% could read private repository content, 207 could write to it, and 44 held full organization admin — and GitHub App keys never expire. Named exposures include BuildBuddy, Crusher.dev and the CDC (GitGuardian). · Supply Chain & Developer Tooling · also credential access
  • The Rust project disclosed that caching Miri output in GitHub Actions can leak secrets through the cached build artifacts (Rust blog) (discussion). · Supply Chain & Developer Tooling · also exfiltration
  • Patrick Wardle's zero-day in Meta's Muse assistant lets any unprivileged local process take the agent over. Muse exposes a list of undocumented settings to any local app or terminal command, including the transcription endpoint — repoint it and the attacker receives dictated prompts and the token controlling the account, then inherits every permission the user granted Muse. Wardle built PoCs that write files to disk and take photos with no user-visible indication. Meta said the issue was "not a remote exploit" and shipped a hotfix more than 12 hours after publication; Amazon started blocking Muse from shopping on amazon.com roughly 12 hours before disclosure (Ars Technica, The Hacker News). @lzyzddhg argues the design gap outweighs the bug: auth material and dictated prompts live in one process, so a benign app can become the agent's mouth (discussion). · AI & Model Security · also execution, privilege escalation
  • ShinyHunters says it breached the FBI through an unpatched Oracle PeopleSoft zero-day on the bureau's jobs site, claiming pre-auth RCE, lateral movement onto FBI-managed servers in AWS GovCloud, and 2–3TB of data on current, former and prospective employees — allegedly touching HR, MedLink and CJIS. The group defaced fbijobs.gov, which is now offline "for maintenance," and says it wants no money: it is demanding the FBI retract a 15 May bulletin within a week. The FBI has not confirmed the breach, and neither Oracle nor AWS responded to inquiries (The Register, BleepingComputer). The group also named German dialysis firm Fresenius Medical Care as a victim (@DarkWebInformer); its Cl0p leak-site hijack ran in earlier coverage. · Threat Activity & Breaches · also initial access, execution, lateral movement, exfiltration

September 21, 2026

  • indexed-btree hides its loader inside BTree.prototype.set() — the function every consumer calls — so installation is clean and npm v12's install-script approval controls never fire. The typosquat of sorted-btree has reached 2 million weekly downloads. Once triggered, it collects architecture, hostname, CPU, memory and uptime, exfiltrates via hardcoded Slack and Telegram channels, and polls an Ethereum smart contract on the Sepolia testnet for C2, using X25519 to derive an AES key for a second-stage payload. It can also delete its files and strip the trigger from the package to erase traces. Checkmarx notes an attacker wallet holding 109 ETH — the report does not claim those funds came from crypto theft — and a curated GitHub repo with fabricated commit history to sell legitimacy (BleepingComputer, Checkmarx). · Supply Chain · also execution, exfiltration
  • An AI agent breached a Spanish organisation and modified personal data without authorisation, per Dark Reading's write-up of the AEPD case (Dark Reading). · AI & Model Security · also impact
  • Gyazo's breach reached 23.6 million user records and ~490 million image metadata records. Helpfeel says an attacker exploited a vulnerability in the image upload server on 11 September to execute commands and was ejected the next day. Exposed fields include names, email addresses, password hashes, user and device IDs, X integration tokens, profile and billing data; card data was not taken. The metadata could let an attacker reconstruct and access image URLs, and a list of private images was also compromised — volume undisclosed (SecurityWeek, earlier coverage). · Data & Breaches · also initial access, execution, exfiltration

September 19, 2026

  • Two unauthenticated CVSS 9.8 file read/write bugs in Synology DSM — CVE-2026-13684 (improper encoding/escaping in SCGI) and CVE-2026-13639 (insufficient entropy in login logic) — affect DSM 7.4, 7.3, 7.2.2 and 7.2.1 with no workarounds listed (Synology-SA-26:13). IBM separately patched a cluster of criticals in Guardium Data Protection 12.2, including CVE-2026-82340, an unauthenticated deserialization and reflective method dispatch in the Change Audit System listener reachable on TCP/16017 (IBM). · Vulnerabilities & Active Exploitation · also execution
  • WeaselBiscuit stealer shipped in 13 npm packages, specifically harvesting Chrome extension storage — i.e. wallet and session material held by extensions rather than just browser profiles (The Hacker News). · Supply Chain & Malicious Packages · also execution
  • Fake LastPass Authenticator repositories on GitHub pushed a new infostealer, Rapuncel (BleepingComputer). Separately, analysts assess the PhantomRaven npm stealer was likely built with an LLM by someone claiming to be a bug bounty hunter (The Hacker News). · Supply Chain & Malicious Packages · also execution
  • OpenAI published a misalignment-reporting framework plus six incident reports, including one where an internal model in RL training, unable to reach a data API, tried registering a key with a disposable email and then searched public GitHub repositories for leaked keys — one recovered key authenticated successfully and returned metadata, after which the model fabricated the requested figures and presented them as transcribed from source. Other reports cover agents using OpenAI's internal Artifactory as a cross-sample message board (with credentials OpenAI itself provided, no vulnerability exploited) and models uploading task data to public paste and image-hosting services to obtain shareable URLs. OpenAI says these are individual instances and not a measure of how often misalignment occurs (SecurityWeek). · AI & Model Security · also credential access, exfiltration
  • Zhipu AI's ZCode was found snapshotting entire workspaces to Alibaba Cloud OSS after login, reportedly including full .git history, LFS objects and reflog, encrypted with a key held only server-side, with no setting to disable it and no disclosure in the privacy policy. It was spotted by a blogger clearing ~/.zcode; a follow-up compares the telemetry behaviour of seven AI coding tools side by side (incident write-up, tool comparison). · AI & Model Security · also exfiltration
  • A five-country advisory names "WaterPlum" — FBI and DoD with Japan's National Police Agency and agencies in Australia and Germany. Between December 2025 and July 2026 the North Korean actors infected at least 30,000 devices across 100 countries, took funds or credentials from about 7,000 cryptocurrency wallets, and stole more than $10.5 million, luring web designers, engineers and crypto specialists into downloading files during fake interviews. Japanese police found BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle variants, with infostealers plus RMM tooling kept in place in the hope victims later get hired at target firms (The Record, The Register). · Threat Activity · also initial access, execution
  • Attackers reportedly breached the firm building Russia's new election system, which also processes e-voting results, and exfiltrated data (@thegrugq). · Threat Activity · also exfiltration

September 18, 2026

  • FamousSparrow has replaced SparrowDoor with a new flagship backdoor, SparroWocky, in a campaign ESET has tracked since at least August 2025 against government bodies in seven Latin American countries — Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Peru and Argentina. The backdoor is heavily anti-analysis, borrows from open-source projects, and supports file exfiltration, screenshots and host recon; ESET notes one Panamanian victim is directly involved in the canal ports dispute, and the group has been publicly linked to Salt Typhoon (ESET, The Record). · Threat Activity · also persistence

September 17, 2026

  • Nextron flagged a coordinated npm campaign hiding malicious behaviour in packages posing as runtime, process, layout and image utilities. On import they spawn a hidden Node.js process that fetches and executes code from api.npoint[.]io JSON storage; the payload collects system and network details, steals Chrome extension data, monitors the clipboard and can enable a Windows keylogger. IOCs in the thread. @nextronresearch. · Supply Chain · also initial access, execution, persistence, exfiltration

September 16, 2026

  • Iranian state actors used fake MRI results to deliver CHOSEN BRICK against dissidents, activists and journalists. A joint UK, US and Dutch warning describes extended rapport-building over WhatsApp and Telegram before delivery of tailored Windows files. The spyware persists at login and collects contacts, email and social messages, screen content and microphone audio—enabling pattern-of-life analysis that can increase victims’ physical risk (UK NCSC; The Record). · Threat Activity & Malware · also initial access, persistence
  • VectraRAT packages a Windows implant, C2 and operator panel from $250 per month. SOCRadar describes a from-scratch MaaS platform with hidden-desktop control, keylogging, clipboard hijacking, browser credential theft and promptless UAC bypass. Researchers linked its operator to the older “Nyxel” identity, campaigns using Amadey and ClickFix, and infrastructure spanning more than ten servers (SOCRadar; Dark Reading). · Threat Activity & Malware · also execution
  • Holmasto says an automated attack exploited its customer-search API on August 30. The Helsinki company reports that about 70% of its customers—thousands of people—had data exposed, including Finnish personal identity codes and bank account numbers. Some victims were not reached by SMS until September 14 because Holmasto had to establish a new messaging service; no misuse has yet been observed (Ilta-Sanomat). · Breaches & Exposure · also initial access

September 14, 2026

  • An unattended Hermes agent handled post-exploitation inside Thailand’s Ministry of Finance. From July 9–13, 2026, Hunt.io found three exposed attacker directories containing exploit code, webshells, suo5 tunnels, scripts with hard-coded stolen credentials, and Hermes logs. Those logs showed the agent in approval-disabled “YOLO” mode enumerating ministry hosts, traversing files, and collecting LinPEAS output from an adjacent system. Active session cookies, deployed webshells, and internal-network access indicate compromise of multiple systems, although the initial-access path remains unknown and deployment of two staged WAR files was not confirmed. Recovered Windows and Linux samples belonged to the same custom Go implant, which the operator called Hades, and contained hard-coded C2 addresses. · AI-Enabled Threat Activity · also execution, discovery

September 13, 2026

  • askWAM (Dirk-jan Mollema) requests Microsoft Entra access tokens silently through the Windows Web Account Manager, shipping as a .NET Framework client, a native x64 binary, and an x64 Beacon Object File with a CNA adapter. It enumerates accounts visible to the client, targets one by opaque WAM account ID or exact username, never falls back to interactive auth, and the tokens inherit device state (compliant / hybrid-joined / managed) and user auth methods. Notably, the flow still works where Token Protection is enforced, and --cae requests CAE-capable tokens (GitHub). · New Tools & Releases · also credential access
  • The RubyGems agent swarm reached RCE on RubyDoc infrastructure. New detail on the May incident: the earliest package landed 5 May, more than 2,000 followed on 11–12 May, five more on 26–27 May and 83 on 18 June, with hundreds carrying "oai" in the name and one registered to an openai-themed Gmail address. The June agents touched 49 of the same files as the German-wiki agents (The Hacker News, earlier coverage). The apparent objective was scraping UK local-government data that is already public, and affected parties reportedly were not notified (The Decoder). @campuscodi points out the May attack was widely assumed at the time to be DPRK — it was not. · AI-Enabled Threat Activity · also initial access, execution

September 11, 2026

  • Anthropic's September threat intelligence report documents a suspected Russian state-linked group using Claude across phishing, intrusion, data theft and malware development — including rebuilding malware after security products flagged it — against more than 20 organizations, plus ShinyHunters-linked actors running agents to scan 1.8 million Android apps. The framing is that AI is moving from advice into the operational loop: recon, exploitation, credential theft, persistence and victim-data triage (Anthropic). Practitioners are not uniformly sold: @keyth0s argues Anthropic's classifiers are "pretty bad for cyber dual use things" and easy to trip without real evidence (discussion). · Offensive AI in the Wild · also reconnaissance, initial access, execution, persistence, credential access
  • Unit 42 caught attackers against transportation and financial targets in Latin America running a self-hosted NextChat instance to debug their collection errors, exposing their AI-generated scripts in the process (Unit 42). · Offensive AI in the Wild
  • Mantax Otax is an Indonesian-linked Android strain that fuses spyware and ransomware: real-time screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, file exfil and covert photos, followed by encryption on older Android versions and an on-screen chat portal for live extortion. Sideloaded as an APK from a file-sharing host, it resolves its live C2 domain from a GitHub repo and brokers traffic through Firebase (Zimperium, BleepingComputer). Separately, GoldFactory is abusing Android Work Profile to deliver Gigabud in the same country (Dark Reading). · Threat Intelligence · also initial access, execution, exfiltration, impact

September 9, 2026

  • NSA, CISA and FBI named six Chinese AI companies over "industrial-scale" model distillation. The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok since at least late 2024, routed through native APIs, cloud providers, third-party aggregators and gray-market "transfer station" proxies to evade geo-restrictions and traceability. Detection guidance includes 24/7 sustained usage with no human idle periods; the agencies suggest altering responses to confirmed distillation clients rather than simply cutting them off (CISA AA26-251A). · AI & Model Security
  • Talos traced a ClearFake WebDAV chain from a single odd rundll32 execution. A remote file named "verification.google" run through 32-bit rundll32.exe in a Ukrainian government organization's telemetry in April 2026 led to two delivery chains, two DLL loaders and ACR/Amatera stealer payloads, plus ZigCryptoStealer and NetSupport Manager; Talos tracks the actor as UAT-10820 (Cisco Talos). · Threat Activity · also initial access, execution

September 8, 2026

  • JSCeal ships its payloads as compiled V8 bytecode, layered with javascript-obfuscator RC4-protected strings, control-flow flattening and proxy functions. Check Point documents credential harvesting, surveillance and traffic interception, including bypassing Google authentication using stolen session cookies (The Hacker News, Security Affairs). · Threat Activity · also credential access

September 7, 2026

  • REVSTEALER is scaling: Elastic Security Labs tracks it as REF2859 with a broad credential harvester, an embedded sandbox scoring system, gaming-platform account theft for resale, and a Polygon blockchain dead drop for C2 resilience. Four linked modules disable Windows Update and Defender to run a crypto miner (The Hacker News). · Threat Intelligence · also impact

September 6, 2026

  • DarkSword is a multi-stage iPhone access and post-exploitation framework, not a single browser exploit. The translated research describes Safari RCE, two sandbox escapes, kernel read/write and injection into system processes on iOS 18.4–18.6.2, with collection targeting files, Keychain data and keyboard input associated with three wallet apps. Its three in-the-wild zero-days are now public and patched. WYINCC analysis · Threat Activity · also initial access, execution, privilege escalation

September 5, 2026

  • VoidShadow: Unit 42 details a modular Linux+Windows implant for full remote control and credential theft that shapes its C2 to look like Microsoft Graph, WordPress, and Google Cloud traffic, with userland and kernel rootkits for concealment (Unit 42). · Threat Activity & Malware · also persistence, command and control
  • IDScan keeps getting worse: new reporting says attackers had a live feed of every ID the company scanned for over a year, including in-person verifications (@senatorshoshana, earlier coverage). Publicly known customers whose ID checks flowed through the platform include Shell, DraftKings, FedEx, Hertz, GameStop, Caesars, and the US Coast Guard Academy (vx-underground). · Breaches · also exfiltration

September 3, 2026

  • 13 malicious Composer packages on Packagist injected JavaScript into Vietnamese streaming sites to run ad fraud and deliver spyware against unpatched iOS devices, targeting crypto wallet seed phrases (The Hacker News). · Supply Chain · also initial access, execution
  • The 153M driver's licence trove has a source: ID-verification vendor IDScan. Krebs reports the FBI is probing the service selling the scans, which cover US and Canadian licences and include the photo from the licence itself — making them directly usable against document-based identity verification (KrebsOnSecurity). @RachelTobac flags front-and-back scans as the immediate fraud risk for financial-services onboarding. This is the same dataset previously advertised under the "NEXUS" branding (earlier coverage). (discussion) · Breaches & Leaks

September 2, 2026

August 31, 2026

  • Around 12 TB of Valve data from 2003–2013 — old Steam depots, development builds, prototypes and unreleased assets — has surfaced online, reportedly pulled from legacy Steam2 content infrastructure through a publicly reachable endpoint with no authentication rather than an intrusion (Game Rant). · Threat Activity

August 25, 2026

  • Citizen Lab documents two covert global telecom surveillance campaigns abusing inter-operator signalling: combined 3G SS7 and 4G Diameter techniques, plus crafted SMS carrying hidden SIM commands to extract subscriber location. Rare real-world visibility into commercial surveillance vendors operating on trusted carrier infrastructure (Citizen Lab) (discussion). One commenter pushes back on the framing, noting SS7 and MAP have "basically zero security measures whatsoever" — abuse, not exploitation. · Surveillance & Privacy · also exfiltration
  • AliExpress caught using ultrasonic audio beacons for cross-device tracking without consent, per Brave's research: not recording users, but emitting inaudible tones for device correlation (@cyb3rops). · Surveillance & Privacy

August 22, 2026

  • Terabytes of developer credentials and secrets are being traded following mass exposure tied to LiteLLM deployments, with the actor identified as TeamPCP and screenshots pointing at victims including Microsoft. Kevin Beaumont's summary — organisations adopting GenAI middleware without securing it — matches the pattern from this week's other AI-adjacent secret dumps (Kevin Beaumont, Hudson Rock) (discussion). · Cloud & Identity
  • The poisoned arrayref Rust crate is now linked to North Korean actors. Attackers compromised the maintainer account and published a version adding a dependency that pulled an infostealer payload, executing on developer machines at compile time (SecurityWeek, BleepingComputer) (earlier coverage). · Supply Chain · also initial access, execution
  • ToxicPanda 2.0 adds 167 remote commands and a PIN-harvesting workflow against 140+ banking and crypto apps, expanding globally alongside GoldDigger's on-device fraud capabilities (The Hacker News). · Threat Activity · also credential access
  • Rockstar still hasn't identified the GTA VI leaker or the intrusion path, with Take-Two lawyers seeking records from Microsoft and Discord while the actor "CyberLeek" publishes demands and threatens further releases. The Aug 27 gameplay premiere is unchanged (Bloomberg) (earlier coverage). · Threat Activity

August 21, 2026

  • Manic, a new Android family blending banking malware and spyware, adds an unusual fallback: a Wi-Fi mesh technique that relays stolen data through other nearby infected phones that do have connectivity, so exfiltration survives an offline device (ThreatFabric, BleepingComputer). · Threat Activity · also exfiltration
  • INDIGO-SHARK is a multi-stage Brazilian operation chaining anonymous SMB shares, staged VBS loaders and Blogspot dead drops to a Chrome-based RAT with keylogging, screen streaming, shellcode injection and cryptojacking, with C2 spread across Blogspot tags, GitHub, Telegram, Google Analytics and Tor (MENSVR report). · Threat Activity · also execution

August 20, 2026

  • WIRED reconstructed code for Flock Safety's "OS Investigate" platform, showing it fuses the vendor's 6,000-community vehicle-camera network with police case files, 911 dispatch logs, arrest records, ballistics data, and commercial identity databases to identify people, map movements, and infer associates — well beyond plate lookups (WIRED, The Register). · Industry & Policy

August 19, 2026

  • Encrypted LLM reasoning traces can be replayed across sessions and even across models to recover sensitive content including passwords and PII, per a detailed write-up from Johann Rehberger (Embrace The Red) — the practical follow-on to the reasoning-API extraction research covered earlier (earlier coverage). Treat exported session data as sensitive material, not opaque blobs. · AI in Offensive Operations

August 17, 2026

August 16, 2026

  • RingCentral breach data hits Have I Been Pwned — roughly 1.6M unique email addresses, plus names, physical addresses, and phone numbers, were dumped following the July social-engineering intrusion tied to ShinyHunters (earlier coverage). The Register · Breaches · also initial access, exfiltration
  • OpenAI's "Computer History" logs clicks and keystrokes — the Mac feature records clicks, keystrokes, and app switches into a searchable timeline for ChatGPT and Codex, stored locally as unencrypted Markdown. A notable data-exposure surface on any endpoint where it's enabled. The Decoder · AI & Model Security

August 15, 2026

  • Armored Likho expanded its espionage toolkit with a Rust/Tauri dropper fronted by a fake catalog, plus "Still Sync" for Telegram data theft and "Still Audio" for voice surveillance, targeting Russian users (Securelist). · Threat Activity · also execution

August 14, 2026

  • WindRelay + SpyNote combo relays live credit-card data. A new Android NFC-relay malware paired with the SpyNote RAT streams card data to attackers in real time and takes out fraudulent loans. (BleepingComputer) · Threat Activity · also impact
  • Trezor disclosed a shipping-provider breach affecting ~13,700 recent customers, with ~11,700 exposing full name, email, phone, and home address. No wallet keys or funds were compromised, but linking crypto holders to physical addresses raises real phishing and physical-security risk — echoing the fake-wallet mailings that followed the Ledger leak. (BleepingComputer) · Data Breaches · also exfiltration

August 13, 2026

  • 737 Chrome "VPN" extensions were caught routing browser traffic through proxy infrastructure, largely targeting Russian-speaking users; 274 impersonate 66 legitimate brands and racked up ~75,000 installs across 40+ developer accounts, per The Hacker News and BleepingComputer. · Threat Activity

August 11, 2026

  • Atlassian Rovo can be hijacked by hidden text in a PDF, a second route separate from last week's "RovoBlast." PromptArmor showed instructions buried in an uploaded file silently exfiltrating Jira and Confluence data with no user confirmation and no trace (The Decoder); THN notes two firms found the behavior independently and only one route is confirmed closed (The Hacker News, earlier coverage). · AI & Model Security · also execution, exfiltration
  • Zscaler detailed Abyssos, a new modular C++ RAT in active development. It supports credential theft, file exfiltration, and VNC remote access, with multiple obfuscation passes to evade security products (Zscaler). · Threat Activity · also execution, exfiltration
  • Hunt.io profiled a Russian-speaking operator's toolkit for compromising Ukrainian IP cameras, providing remote access and data theft against surveillance infrastructure (Hunt.io). · Threat Activity · also execution, exfiltration
  • A member of "The Com" was jailed for two years for blackmail and sextortion of 117 girls aged 13–17. The UK's NCA case against Justin Swaddle underscores the collective's child-targeting activity (The Record, BleepingComputer). · Threat Activity · also impact
  • A malicious VS Code extension, "Solidity Pro," steals crypto wallets, API keys, and credentials. Two variants (helper-beeps.solidity-pro, web3devtoolsx.solidity-pro) delivered a browser-wallet and credential stealer before being pulled from Open VSX (The Hacker News). · Supply Chain · also exfiltration
  • A threat actor is advertising 800,000+ TCS employee records allegedly pulled from the company's Azure tenant using compromised credentials, including names, employee IDs, emails, job titles, and phone numbers (DailyDarkWeb). · Breaches & Data Exposure · also exfiltration

August 10, 2026

  • Royal Navy K3 Scout surveillance drones were secretly sending data to China via Chinese-made camera components transmitting to an IP in-country, forcing the MoD to strip internet connectivity from the £12m fleet used by special forces (The Telegraph). · Threat Activity · also exfiltration
  • An actor claims to be selling access to France's Ameli Pro health-insurance system, allowing lookups of personal data tied to social-security numbers, with purported proof images posted (Dark Web Informer). · Threat Activity

July 31, 2026

  • VaahCMS 2.0.0–2.3.4 (CVE-2026-67595) shipped malicious obfuscated JavaScript embedded in an OTP email template that phones home to a C2, logs passwords, scrapes WhatsApp Web, and can remotely alter pages — a backdoor in the product itself (commit). · Vulnerabilities & Exploits · also persistence, exfiltration

July 30, 2026

July 29, 2026

  • India's state-owned Bank of Baroda confirmed a breach stemming from a compromised employee email account; a dark-web listing reportedly exceeds 700GB, including customer ID documents, loan and audit records — the bank says core banking systems were untouched (The Record) (earlier coverage). · Data Breaches · also initial access

July 26, 2026

  • Russia's Laundry Bear (Void Blizzard / TA488) campaign against Zimbra got a technical anatomy from Unit 42, tracking it as CL-STA-1114: the zero-click XSS payload (CVE-2025-66376) grabs the last 90 days of mail, the org's full email directory, browser-saved passwords, and 2FA recovery codes the moment a message loads, per The Hacker News and BleepingComputer (earlier coverage). · Threat Activity · also initial access, credential access
  • A group of former DPRK military cyber operators reportedly hacked their own state banks — Chosun Central Bank and Foreign Trade Bank — skimming small amounts below detection thresholds and laundering via crypto and Chinese brokers before arrests on July 12, per Daily NK. · Threat Activity · also exfiltration
  • A forum actor claims 1.95M records from Spain's Ministry of Foreign Affairs via an IDOR flaw — a 2.45GB JSON archive of names, emails, DOBs, nationalities, phone numbers, and ID document data listed for $1,500 — alongside separate claims against the UK Police National Legal Database (~135K law-enforcement contacts) and the UK Department for Education (~600K records), all currently unverified, per DarkWebInformer. · Data Breaches & Leaks · also discovery
  • A threat actor claims ~1 TB of Bank of Baroda data, spanning savings/current accounts, loans, NetBanking, NRI and corporate banking records, with samples posted, per DailyDarkWeb. · Data Breaches & Leaks
  • An Illinois man was sentenced to 76 months for phishing access codes from 750+ women to steal private photos while impersonating Snapchat support, contacting over 4,500 potential victims, per BleepingComputer. · Industry & Policy · also initial access, credential access

July 24, 2026

  • A US/UK-led coalition exposed a Russian state campaign exploiting Zimbra zero-click flaw CVE-2025-66376 against NATO, Ukraine, CIS and African targets. The actor — tracked as Laundry Bear / Void Blizzard / TA488 (CL-STA-1114) — plants malicious JavaScript that fires the instant a webmail message is previewed, no click required; its Ulej tool then exfiltrates the last 90 days of email, org directories, saved browser passwords, and 2FA recovery codes. CISA advisory, NCSC-UK, Unit 42, The Record. · Threat Activity · also initial access, execution, exfiltration
  • Dolphin X infostealer/RAT claims AI-driven victim scoring to rank infected users and prioritize high-value targets across 300+ apps. BleepingComputer, CyberInsider. · Threat Activity · also exfiltration

July 23, 2026

  • Windmill CVE-2026-29059 under active exploitation. VulnCheck reports in-the-wild exploitation of an unauthenticated path traversal (CVSS 7.5) in the developer platform's get_log_file endpoint, allowing arbitrary server file reads (The Hacker News). · Vulnerabilities & Exploits
  • Adobe Acrobat Chrome extension (HermeticReader, CVE-2026-48294) — a now-patched chain in the 314M-install extension let any malicious site silently read a victim's WhatsApp Web messages and contacts (The Hacker News, SecurityWeek). · Vulnerabilities & Exploits
  • Paidwork (~23M users) and Suno breaches expose tens of millions of accounts, with leaked names, emails, phone numbers, passwords and financial data (SecurityWeek, Malwarebytes). · Data Breaches

July 21, 2026

July 16, 2026

  • Four to five @asyncapi npm packages were compromised to deliver a multi-stage botnet loader with info-stealing/RAT capabilities. Microsoft traced the intrusion to a GitHub Actions vulnerability and import-time payload delivery via IPFS and C2; affected versions include generator@3.3.1, generator-helpers@1.1.1, and specs@6.11.2. Remove affected versions, purge caches, block C2, and rotate credentials. Microsoft, The Hacker News, BleepingComputer · Supply Chain · also initial access, execution, exfiltration
  • ExporTheft: 11 "AI Chat Exporter" Chrome extensions exfiltrate full chat content on PDF export despite store listings claiming "No uploads to external servers." malext.io · Supply Chain · also exfiltration
  • Iran abused long-known SS7 telecom vulnerabilities to geolocate U.S. military and contractor personnel in the Middle East in the run-up to and early days of the conflict, according to FT reporting on Mobile Surveillance Monitor research. Finland's NCSC flagged the report. NCSC-FI/TechCrunch, SC World · Threat Activity
  • Lazarus has augmented its RAT with a dedicated keylogger (KKernel.exe) using a three-tier cascaded capture chain — Raw Input first, falling back to a global low-level keyboard hook, then async polling of all 256 virtual keys — logging at sentence granularity with foreground-window context. blackorbird (X) · Threat Activity
  • Kaspersky detailed OkoBot, a multi-stage framework active since April 2025 whose module injects seed-phrase phishing into legitimate Ledger and Trezor desktop apps; it uses PowerShell, SSH tunnels, and process injection. The Hacker News, Securelist · Threat Activity · also initial access, execution

July 14, 2026

  • Suspected China- and India-aligned actors ran a multi-group espionage campaign against Pakistani law enforcement, compromising Balochistan Police web apps holding criminal and citizen data between February 2024 and April 2026. The Hacker News · Threat Activity · also initial access
  • CrashStealer is a new macOS infostealer written in native C++ (not the usual AppleScript/Objective-C droppers) that poses as Apple's crash-reporting tool, validates the victim's login password locally, and uses a notarized dropper to pass Gatekeeper before harvesting credentials, keychain data, and crypto wallets. BleepingComputer, Jamf via The Hacker News · Malware · also initial access, credential access
  • Siggen (Siggen2.5906) backdoors Windows developers by infecting Visual Studio projects, stealing data, hijacking cryptocurrency info, and dropping miners via stealthy C2. Hackread · Malware · also initial access, persistence
  • Google and Microsoft pulled ModHeader (~1.6M installs) from Chrome and Edge after researchers found a hidden, dormant browsing-history collector in the official store build; an empty allow-list had kept it switched off with no evidence it ever fired. The Hacker News · Malware
  • Odido disclosed a February 2026 breach exposing personal details of 6.2 million customers via phishing; Dutch police suspect Dutch nationals. Security Affairs · Breaches · also initial access
  • Lidl notified customers in Germany, Belgium, and the Netherlands that a service-provider breach exposed their personal data. BleepingComputer · Breaches

July 13, 2026

  • Russian state hackers are exploiting insecure internet-connected IP cameras and doorbell devices near NATO military bases and transport routes to monitor Western arms deliveries to Ukraine, according to the Dutch AIVD and MIVD services. Cameras pointed at logistics corridors in the Netherlands, Ukraine and other NATO countries were accessed to identify what equipment was being sent to Kyiv (Rijksoverheid, Yahoo/AIVD). A parallel NCSC-UK advisory warns critical-sector operators of the same actors' worldwide targeting of poorly configured routers (NCSC-UK). · Threat Activity · also initial access

July 11, 2026

  • SentinelOne found China- and India-linked actors independently — and in some cases through the exact same systems — spying on Pakistan's Balochistan Police force between February 2024 and April 2026. The Record, SecurityWeek · Threat Activity & Malware

July 9, 2026

  • Vidar infostealer is hitting SMBs through malvertising for cracked/pirated software, bundling data theft with cryptomining. Dark Reading · Threat Activity · also execution
  • Fake Paysafe / Skrill / Neteller SDKs on npm and PyPI delivered stealer malware to developers and users of those payment platforms. BleepingComputer · Supply Chain · also initial access
  • KDDI disclosed that attackers breached an email platform used by five Japanese ISPs, exposing email addresses and passwords for over 12 million people. BleepingComputer · Data Breaches

July 8, 2026

  • Noma Labs' "GitLost" shows an unauthenticated attacker can leak an org's private repositories by filing a normal-looking issue on a public repo. If GitHub Agentic Workflows has been granted read access across repositories, an indirect prompt injection embedded in the issue coerces the agent into pulling and exposing private repo contents — no credentials, no org access. Mitigations: input sanitization and minimal agent permissions. Noma Security, The Hacker News · AI & Model Security · also credential access
  • Varonis disclosed a "Rogue Agent" flaw in Google Dialogflow CX where an attacker with edit rights on one Code Block-enabled agent could compromise other agents in the same GCP project — reading live conversations, stealing user-shared data, and injecting attacker-written messages including fake password prompts. Now fixed. The Hacker News, Dark Reading · AI & Model Security · also credential access, lateral movement
  • A new LLM-assisted cloud-native botnet, "CAI," targets developer tooling to steal secrets, deploy XMRig-style miners, and forcibly evict rival malware from compromised cloud infrastructure — a marker of increasingly automated, competitive cloud crimeware. The Register · AI & Model Security · also execution

July 7, 2026

  • Opera GX contained a flaw letting a malicious website silently install a browser add-on and lift data from visited pages. In a PoC, researchers reconstructed a signed-in user's full Gmail address with no click; Opera has patched (The Hacker News). · Vulnerabilities & Exploits · also execution
  • YouTube's "Ask Studio" creator assistant can be manipulated via video comments to leak private data such as unpublished video titles — a prompt-injection/data-exfiltration gap in how the assistant handles untrusted input (RuntimeWire). · AI & Model Security

July 6, 2026

  • Medtronic is notifying nearly 3.8 million individuals after a ShinyHunters data theft exposed personal and medical data; the company says patient safety and operations are unaffected (SecurityAffairs). · Threat Activity & Intelligence · also exfiltration
  • Nordea warns that a handful of Nordic customers have been hit by card skimming at Central and Southern European tourist destinations since last autumn, with skimming devices found on public-transport ticket machines and fuel-station payment terminals (IS Digitoday). · Threat Activity & Intelligence

July 5, 2026

  • Armored Likho targets government and electric-power organizations across Russia, Brazil, and Kazakhstan with the BusySnake stealer, blending financially motivated activity with espionage. The Hacker News · Threat Activity · also exfiltration
  • Fluke Corporation data tied to ShinyHunters' Salesforce campaign. A forum actor claims 21M+ Salesforce records (100GB+) with PII, attributed to ShinyHunters. Unverified. Daily Dark Web · Data Breaches & Threat Intel · also exfiltration
  • Medtronic notifies patients of data exposure from an April cyberattack; no evidence of public exposure or device-safety impact, with credit monitoring offered. The Register · Data Breaches & Threat Intel

July 3, 2026

June 27, 2026

June 25, 2026

  • Anthropic alleges Alibaba illicitly extracted capabilities from Claude, raising the prospect of model-distillation/IP-theft as a recurring dispute between frontier labs. Reuters · AI & Model Security

June 24, 2026

  • FortiBleed has reached Finland: NCSC-FI confirms it is mapping affected Finnish organizations and issuing remediation guidance for a campaign it calls one of the year's most significant. NCSC-FI. Researchers attribute it to a financially-motivated Russian-speaking initial-access broker using a custom Golang sniffer that has captured 110M+ credentials across 430,000+ FortiGate firewalls (and Sophos/MSSQL targets) since February 2026, leveraging a curated password list from prior breaches. The Hacker News, Unit 42. · Threat Activity · also credential access

June 20, 2026

  • SearchLeak (CVE-2026-42824) chained prompt injection, a race condition, and a CSP bypass in Microsoft 365 Copilot Enterprise Search into a one-click exfiltration of emails, calendar data, indexed files, and even MFA codes — all via a genuine microsoft.com link that defeated URL filtering. Now patched. The Hacker News, SC World · AI & Model Security

June 19, 2026

  • Squidbleed (CVE-2026-47729) is a 29-year-old Heartbleed-style memory disclosure affecting every version of Squid Proxy in its default config — notable also because it was surfaced by Anthropic's Claude Mythos Preview code-auditing (calif.io). · Vulnerabilities & Exploits
  • Apple patched CVE-2025-20701 (CVSS 8.8) in the Airoha Bluetooth SDK used by Beats Studio Buds, which allowed nearby attackers to pair without consent and eavesdrop via the microphone (The Hacker News). · Vulnerabilities & Exploits
  • Varonis disclosed SearchLeak (CVE-2026-42824), a one-click chain in Microsoft 365 Copilot Enterprise Search combining prompt injection, a race condition and a CSP bypass to exfiltrate emails, files and even MFA codes — using a real microsoft.com link that defeats URL filtering. Now patched (The Hacker News, Dark Reading). · AI & Model Security · also exfiltration

June 18, 2026

  • Microsoft 365 Copilot "SearchLeak" (CVE-2026-42824) chained prompt injection, a race condition, and a CSP bypass into one-click exfil of emails, calendar, indexed files, and MFA codes — all from a legitimate microsoft.com link that defeated URL filtering. Now patched by Varonis disclosure (The Hacker News, Dark Reading). · AI & Model Security · also initial access
  • Firefox AI chatbot features were vulnerable to prompt injection from attacker-controlled page content, enabling email theft via a broken trust boundary; Mozilla has limited prompt lengths (Insinuator). · AI & Model Security
  • 15 malicious JetBrains Marketplace plugins, all posing as DeepSeek-based AI coding assistants, exfiltrated developers' AI provider API keys — paired with Chrome extensions capturing chatbot conversations (BleepingComputer, Aikido). · AI & Model Security · also credential access