Mazda experienced a cyberattack resulting in the theft of sensitive employee and business partner information, including internal IDs, names, email addresses, and partner IDs from an internal management system. The breach exposed personally identifiable information (PII) that could be leveraged for identity theft, phishing, or further targeted attacks. Although no known exploits are currently active in the wild, the incident highlights vulnerabilities in Mazda's internal security posture. The attack did not disclose technical details about the attack vector or exploited vulnerabilities, limiting the ability to fully assess the attack method. The severity is assessed as medium due to the nature of the stolen data and the potential for misuse, but no direct operational disruption was reported. Organizations with similar internal management systems should review access controls and data protection measures. Countries with significant automotive industry presence and Mazda operations are at higher risk of similar attacks. Immediate mitigation should focus on enhancing internal system security, employee awareness, and monitoring for suspicious activity.
The FBI has issued an alert regarding malware linked to Iranian government hackers, discovered during an investigation involving the company Stryker. This malware represents a targeted cyber threat attributed to state-sponsored actors from Iran. While specific technical details and affected software versions are not disclosed, the medium severity rating suggests moderate risk to confidentiality, integrity, or availability. No known exploits are currently active in the wild, and no specific indicators of compromise have been publicly shared. The threat highlights ongoing geopolitical cyber tensions and the use of malware for espionage or disruption. Organizations in sectors with strategic importance or those operating in regions targeted by Iranian cyber operations should remain vigilant. Mitigation involves enhanced monitoring for suspicious files, network traffic analysis, and applying threat intelligence updates from trusted sources. Countries with significant exposure include the United States, Israel, Saudi Arabia, United Arab Emirates, and other Western and Middle Eastern nations. Given the medium severity, the threat requires proactive defense but is not currently critical. Defenders should focus on early detection and incident response readiness to mitigate potential impacts.
A threat actor known as TeamPCP expanded its supply chain attack from Aqua Security's Trivy to Checkmarx's AST GitHub Action. The attack, which began on March 19, 2026, involved injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories. The malicious code harvested secrets from runner memory, queried cloud metadata, and exfiltrated encrypted data to typosquat domains. The Checkmarx compromise occurred approximately four days after the initial Trivy incident, using identical techniques but targeting a different action. This cascading effect demonstrates how compromised actions can be used to harvest credentials and compromise additional dependencies. Runtime detection proved effective in identifying the attack pattern across both waves, as the underlying behavior remained consistent despite changes in the delivery mechanism.
The KICS GitHub Action, an open-source infrastructure as code security scanner by Checkmarx, was compromised by TeamPCP, the group behind the recent Trivy attack. Between 12:58 and 16:50 UTC on March 23, 35 tags were hijacked, exposing users to credential-stealing malware. The attack involved staging imposter commits and updating tags using a compromised identity. The malware uses a new C2 domain, creates a fallback repository, and adds Kubernetes-focused persistence code. Additionally, two OpenVSX extensions were compromised. The payload targets cloud provider credentials and installs persistence on non-CI systems. Security teams are advised to audit workflows, search for exfiltration artifacts, and implement long-term hardening measures.
A multi-stage malware delivery campaign was uncovered, initially detected through a suspicious VBS file. The investigation revealed a complex attack infrastructure using Unicode obfuscation, PNG-based payload staging, and reflectively loaded .NET execution. The attacker utilized open directories to host multiple obfuscated VBS files, each mapping to different malware payloads including XWorm and Remcos RAT. A secondary infection vector involving a weaponized 'PDF' and batch script was also discovered. The campaign demonstrated a modular approach, allowing for payload rotation and multiple attack vectors from the same domain. This sophisticated infrastructure design enables rapid modification and expansion of available payloads without altering the initial delivery mechanism.
So, I&#;x26;#;39;ve been slow to get on the Claude Code/OpenCode/Codex/OpenClaw bandwagon, but I had some time last week so I asked Claude to review (/security-review) some of my python scripts. He found more than I&#;x26;#;39;d like to admit, so I checked in a bunch of updates. In reviewing his suggestions, he was right, I made some stupid mistakes, some of which have been sitting in there for a long time. It was nothing earth-shattering and it took almost no time for Claude, it took longer for me to read through the updates he wanted to make, figure out what he was seeing, and decide whether to accept them or tweak them. Here are a few of them.
The latest M-Trends report is based on insights from over 500,000 hours of Mandiant incident response investigations in 2025. The post M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds appeared first on SecurityWeek .
Hackers published a malicious scanner release and replaced tags to point to information-stealer malware. The post Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 23rd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Navia Benefit Solutions, a United States-based employee benefits administrator, has disclosed a breach affecting more than 2.6 million individuals after unauthorized access and potential data exfiltration occurred between December 22, 2025 and […] The post 23rd March – Threat Intelligence Report appeared first on Check Point Research .
Attack volumes are back to pre-disruption levels, and the adversary tactics have remained unchanged. The post Tycoon 2FA Fully Operational Despite Law Enforcement Takedown appeared first on SecurityWeek .
The GhostClaw malware campaign has expanded its distribution methods beyond npm packages to include GitHub repositories and AI-assisted development workflows. The attackers impersonate legitimate tools and utilize multi-stage payloads to steal credentials and retrieve additional malicious code. The infection chain involves executing shell commands, presenting fake authentication prompts, and establishing persistence. The campaign leverages both manual installation through README instructions and automated AI-assisted workflows. Multiple GitHub repositories have been identified, all communicating with a common command-and-control infrastructure. This shift in tactics allows the attackers to target a broader range of victims, including developers and users of AI-assisted coding tools.
CVE-2026-4533 is a medium severity SQL injection vulnerability found in version 1.0 of the code-projects Simple Food Ordering System, specifically in the all-tickets.php file. The vulnerability arises from improper sanitization of the 'Status' parameter, allowing remote attackers to inject malicious SQL commands without authentication or user interaction. Although the exploit code is publicly available, there are no confirmed reports of active exploitation in the wild. Successful exploitation could lead to unauthorized data access or modification within the affected database, impacting confidentiality and integrity. The vulnerability affects a niche food ordering system product, limiting its widespread impact but posing risks to organizations using this software. Mitigation requires immediate input validation and parameterized queries in the affected code, along with monitoring and restricting access to the vulnerable endpoint. Countries with notable usage of this software or similar web applications, including the United States, India, United Kingdom, Canada, Australia, and Germany, may face higher risks. Organizations should prioritize patching or applying workarounds to prevent potential data breaches or service disruptions.
Other noteworthy stories that might have slipped under the radar: vulnerabilities found in KVM devices, Claudy Day Claude vulnerabilities, The Gentlemen ransomware group. The post In Other News: New Android Safeguards, Operation Alice, UK Toughens Cyber Reporting appeared first on SecurityWeek .
The men violated U.S.export controls laws by scheming to divert massive quantities of the high-performance servers assembled in the United States to China. The post 3 Men Charged With Conspiring to Smuggle US Artificial Intelligence to China appeared first on SecurityWeek .
The US has seized several domains used by Handala in cyber-enabled psychological operations. The post US Confirms Handala Link to Iran Government Amid Takedown of Hackers’ Sites appeared first on SecurityWeek .
Between late December 2025 and mid-January 2026, hackers stole personal and health plan information from Navia’s environment. The post Navia Data Breach Impacts 2.7 Million appeared first on SecurityWeek .
The attacks started on February 27 and have targeted e-commerce platforms, global brands, and government services. The post Thousands of Magento Sites Hit in Ongoing Defacement Campaign appeared first on SecurityWeek .
