October 2, 2026
- Proofpoint exposed a previously unreported China-aligned actor targeting people who shape US AI policy. TA419 began with benign rapport-building emails impersonating former White House official Lynne Parker or economist Heidi Crebo-Rediker, using fake invitations to an “AI Policy Advisory Committee” or a Senate report on export controls. Respondents were subsequently sent through redirects to a OneDrive credential-phishing page. Targets included universities, think tanks, law firms, and defense-related organizations. Proofpoint
· Threat Activity & Supply Chain
in OpenAI Disrupts a Coordinated Model-Reasoning Extraction Campaign
August 28, 2026
- Chinese-speaking TA4922 has switched to PackClient, a modular commodity C2 framework bought off a malware marketplace, after months of AI-generated loaders — Proofpoint tracks the shift from vibe-coded custom tooling to purchased capability (DataBreachToday).
· Threat Activity
in Australia Charges Two Over the TeamPCP Supply-Chain Spree
July 25, 2026
- Russian Zimbra campaign broadens across webmail platforms. Proofpoint expands the picture on the state-linked actor (TA488 / Void Blizzard / Laundry Bear), tying the "half-click" Zimbra XSS (CVE-2025-66376) to a wider Operation RoundPress push that also weaponized zero-days in mDaemon (CVE-2025-3929) and SOGo (CVE-2026-8496) (earlier coverage). Proofpoint.
· Threat Activity
in A Default-Config RCE Cracks GitLab, and the PoC Is Already Public