The KeyHunter operation is a multi-vector cyber campaign by the Chinese-speaking threat actor leepsmarts targeting academic institutions and cloud infrastructure. It involves theft of large numbers of LLM API keys from misconfigured cloud platforms, creation of fraudulent student accounts at multiple universities, and processing of stolen Harvard alumni data. The operation uses AI agent frameworks and Telegram bots for automation. Parallel financial fraud includes cryptocurrency draining and credit card validation using stolen credentials. The infrastructure spans multiple countries and has been active since early 2026.
Over 100 stores across multiple European countries experienced cyberattacks targeting internet-exposed refrigeration controllers, causing fridges and freezers to heat up and spoil food. The attacks affected stores in Belgium, Sweden, Ireland, and other countries, with some units set as high as 50°C. The incidents resemble a prior wave of attacks in France that disrupted around 700 supermarkets. The compromised devices include legacy Danfoss and Copeland refrigeration controllers, many of which have management interfaces exposed to the internet and lack available patches. The attackers exploited default credentials and internet exposure to force refrigeration units into defrost mode. Physical modifications alongside software updates are needed to fully mitigate the vulnerability. Investigations are ongoing, and no group has claimed responsibility.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
A cyberattack targeted refrigeration controllers in hundreds of European supermarkets, causing refrigerators and freezers to defrost by raising temperatures to 50°C. The attack affected major supermarket chains including Auchan, Carrefour, E.Leclerc, Intermarché, Monoprix, and Cooperative U, with most damage in France and additional impacts in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain. The attackers exploited vulnerabilities in Danfoss refrigeration controllers, leading to significant food spoilage and financial losses estimated in the millions of euros. The incident followed a recent disclosure of vulnerabilities in the Danfoss AK-SM 800A management platform, which could allow remote code execution and configuration manipulation. It is unclear if the disclosed vulnerabilities were exploited in this attack. Recovery efforts are ongoing, and investigations are underway.
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.
Manic is a newly discovered Android malware family that steals banking credentials, intercepts sensitive data, and allows remote control of infected devices. It uniquely exfiltrates stolen data even without an internet connection by exploiting Android Accessibility services to capture keystrokes and replay them on targeted apps. The malware targets banking apps, government apps, crypto wallets, and two-factor authentication apps across multiple European countries. Infection vectors likely include unofficial app stores, malicious APKs, and phishing links, with no evidence of distribution via Google Play. Manic abuses Accessibility permissions to spy on users, grant itself additional permissions, and prevent removal. It overlays an invisible keyboard to capture passwords and sensitive input. The malware has been active since at least May 2026 and continues to evolve to evade detection.
A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.
The OpenAI models targeted services beyond Hugging Face as they attempted to solve the tasks they were given. The post JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack appeared first on SecurityWeek .
Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands due to a hack of a third-party service provider. Attackers accessed and stole personal information from a separately stored file containing customer data related to Lidl's online shop. The online shop systems themselves were not compromised. Stolen data includes customer names, contact details, dates of birth, and customer numbers, with potential but unconfirmed exposure of passwords, billing, delivery addresses, and payment information. Lidl has notified affected customers and relevant authorities and warned about possible phishing attempts.
Turla has been using the backdoor against government and military organizations in Ukraine for espionage. The post Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets appeared first on SecurityWeek .
Global law enforcement, including agencies from the Netherlands, Canada, United States, and Germany, coordinated Operation Endgame to disrupt TA569, a prominent cybercriminal group tracked since 2018. The operation targeted SocGholish infrastructure, taking down over 100 servers and domains while remediating 14,971 compromised websites. TA569 pioneered web inject techniques using fake browser updates to distribute malware, often leading to ransomware attacks. The group compromised high-traffic websites across multiple industries, affecting millions of visitors globally. Their attack chains involved traffic distribution systems like Keitaro TDS and ParrotTDS, delivering GhoLoader payloads that could lead to ransomware deployment in enterprise environments. Law enforcement actions included server disruption and website disinfection, significantly impacting the threat actor's operations, infrastructure, and reputation within the cybercriminal ecosystem.
A sophisticated smishing and phishing operation active since the second half of 2025 has impersonated over 267 brands across 72 countries, with particular concentration in Latin America. The campaign generated 4,389 phishing domain instances, with Mexico accounting for 1,851 cases. Telecommunications is the most targeted sector with 1,754 instances, followed by financial services and consumer rewards programs. The operation employs fake Cloudflare error pages as decoys, revealing malicious content only to victims matching specific geofencing and mobile device criteria. Data exfiltration occurs through encrypted WebSocket channels using binary encoded payloads. Approximately 30% of infrastructure is hosted on Tencent Cloud and Alibaba US servers, fronted by Cloudflare to mask hosting IPs. The attack chain progresses from SMS lures through progressive credential harvesting, ultimately capturing complete credit card details including CVV codes.
A newly uncovered campaign abuses the Trillion (formerly Trellian) AdTech network, mimicking the flow of a Traffic Direction System (TDS) to trick visitors of typo-squatted domains into downloading Microsoft Store apps that contain browser hijacking malware. While the abuse of AdTech networks to deliver malware isn’t new, this campaign highlights incredibly similar tactics to VexTrio and previous TDS networks; further blurring the line between AdTech and malicious TDS systems.
Endpoint detection and response (EDR) tools are widely deployed and far more capable than traditional antivirus. As a result, attackers use EDR killers to disable or bypass them. The malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. It can terminate over 300 different EDR drivers from almost every vendor in the market.
In January 2026, Nacogdoches Memorial Hospital experienced a data breach where a threat actor infiltrated the hospital's internal network and exfiltrated personal and health information of approximately 250,000 individuals. The breach involved unauthorized access to sensitive patient data, potentially including medical records and personally identifiable information (PII). No specific vulnerability or exploit details have been disclosed, and no known exploits are reported in the wild. The incident highlights risks associated with healthcare network security and data protection. Organizations handling sensitive health data should review their network defenses and incident response plans. The breach underscores the importance of robust access controls, network segmentation, and continuous monitoring in healthcare environments. Given the medium severity and lack of detailed technical information, the threat primarily impacts confidentiality and privacy. Healthcare providers globally should be vigilant against similar attacks targeting patient data. Mitigation should focus on strengthening internal network security, employee training, and rapid detection of intrusions.
Mercor, an AI recruiting firm, suffered a supply chain attack involving the LiteLLM component, resulting in the theft of approximately 4TB of data as claimed by the Lapsus$ threat group. The incident highlights risks associated with third-party AI software dependencies in recruitment technology. Although no known exploits are currently active in the wild, the breach could expose sensitive candidate and corporate information, impacting confidentiality and trust. The attack underscores the importance of securing supply chains, especially for AI-driven platforms handling personal data. Organizations relying on similar AI recruiting tools should be vigilant and assess their exposure to LiteLLM or related components. Mitigation requires thorough supply chain audits, enhanced monitoring of third-party software, and rapid incident response capabilities. Countries with significant AI technology adoption and recruitment sector reliance, such as the United States, United Kingdom, Germany, Canada, Australia, and South Korea, are most at risk. Given the medium severity rating, the threat poses a moderate risk primarily to confidentiality with limited immediate availability or integrity impact. No authentication or user interaction is required for exploitation, but the attack vector is indirect via supply chain compromise.
