A China-linked threat actor deployed autonomous AI agents to conduct cyber intrusions targeting multiple government entities and critical sectors across Asia. The campaign infrastructure was discovered on an exposed VPS hosting over 150 active campaign files without authentication. Investigations revealed 66 active intrusion projects, with 48 achieving session-level access and 6 escalating to root or SYSTEM privileges. Notable targets include the Vietnam Ministry of Defence and Ministry of Public Security, Taiwan Legislative Yuan, Indonesia State Intelligence Agency, India CDAC, as well as airlines, payment systems, and retail sectors across Asia.
A Microsoft 365 API credential for ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by an attacker to access hundreds of customer M365 environments. The attacker obtained Microsoft Graph access tokens and moved through tenants in an automated fashion. In at least one case, the ConnectWise Cloud Management MS Teams application was elevated to Global Administrator, allowing the attacker to add credentials to other applications, including security tools. The campaign started with password spraying against law firms, followed by role assignments in about 50 tenants, and widespread credential abuse across nearly 1,000 Entra tenants. A second wave targeted 16 tenants in sensitive sectors such as policy, national security, trade, and critical minerals. No official patch or remediation guidance is currently available.
An AI-powered espionage campaign, tracked as CL-UNK-1211, targeted government and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, custom malware, web shells, and credential harvesting techniques to maintain persistent access and conduct reconnaissance. They deployed multiple web shells, modified PHP configurations for persistence, and used advanced anti-forensics methods including disabling endpoint protections and tampering with system logs. Credential theft was achieved through hijacked .bashrc files and PHP login page modifications. The campaign aimed to dump sensitive databases and exfiltrate government mailboxes to access social media accounts. The attackers combined open-source tools with custom cross-platform backdoors and employed AI to streamline payload creation. No specific patch or fix is mentioned.
This report details the first confirmed incident where AI-driven agents executed a complex attack on an Apache Tomcat server running Spring Batch. Attackers exploited an exposed job-submission endpoint that required no authentication or zero-day vulnerabilities. Using the open-source Cairn AI agent orchestration platform, the attackers executed commands via JavaScript through the Nashorn engine, extracting data in small chunks over many requests. They obtained plaintext database credentials, enabled xp_cmdshell, and escalated privileges to SYSTEM using known tools such as PrintSpoofer and GodPotato. The attackers extracted registry hives, created administrator accounts, and deleted artifacts. The attack was characterized by automated, rapid command execution and structured output formatting, indicating machine-driven orchestration.
A coordinated disruption targeted Chinese-speaking cybercriminals operating three major phishing kits—CoGUI, CoAceV, and CoFish_Ws—that distributed hundreds of millions of credential phishing messages primarily against Japanese organizations. These phishing campaigns impersonated 66 well-known consumer and finance brands to steal usernames, passwords, and payment data. The threat actors used sophisticated evasion techniques, including approximately 17,000 unique rotating domains. The disruption involved civil lawsuits and domain seizures against ecosystem enablers YAM Store and Iron Man, conducted collaboratively by Microsoft, Health-ISAC, and security partners. This action is expected to significantly disrupt multiple threat groups involved in financial fraud within the Chinese phishing ecosystem.
A phishing campaign uses fake Calendly booking pages impersonating Meta Careers to steal Facebook and Google login credentials. Victims are tricked into selecting interview times, submitting personal data, and completing fake CAPTCHAs before being prompted to log into their accounts. The phishing kit captures credentials and bypasses two-factor authentication by relaying authentication codes in real-time. The fake pages include convincing replicas of legitimate login screens with fake address bars showing authentic URLs. Eleven domains with recruiting-related names are involved, and the infrastructure operates via Amazon API Gateway in Singapore. Code comments in Vietnamese suggest possible origins of the operation.
A credential phishing campaign targeted WatchGuard Mobile VPN users via a fake download site watchguard-vpn.net. The attackers used SEO poisoning to appear in search results and collected credentials through repeated browser pop-ups, deliberately rejecting the first submission to capture multiple passwords. After credential theft, the campaign downloaded the genuine WatchGuard VPN client from the official CDN, bypassing detection by security tools. The stolen credentials included server addresses, usernames, and passwords, potentially granting attackers network access. The phishing domain watchguard-ssl.online was re-registered and fully operational by September after being inactive earlier in the year.
In October 2026, a large-scale cyberattack targeted French supermarket refrigeration systems, remotely raising temperatures to 50°C and causing food spoilage, fires, and sprinkler floods. The attack exploited legacy Danfoss refrigeration controllers (AK-SM800 and AK-SC355) that no longer receive security updates. These controllers were accessible via the internet, allowing attackers to force defrost cycles and disrupt food preservation across hundreds of stores. The incident caused significant financial losses and operational disruption. The exact attack vector remains undisclosed, but known vulnerabilities in unsupported firmware versions were previously documented. Recovery efforts are ongoing, with long-term impacts expected.
The Kimsuky threat group is conducting spear phishing campaigns targeting Ukrainian experts in diplomacy, security, and international policy. The campaign, named GitPower, uses fraudulent international conference invitations and collaboration requests to lure victims. Attackers distribute malware and exfiltrate data via legitimate platforms such as GitHub, employing malicious LNK files and fake Zoom installers. This operation is linked to previous CHM-based attack methods and appears to be state-sponsored cyber espionage focused on monitoring South Korea-Ukraine cooperation developments. Organizations are advised to enhance endpoint detection and response (EDR) capabilities and conduct threat hunting for suspicious LNK execution, PowerShell abuse, and unauthorized GitHub activity.
Critical infrastructure organizations face increasing cyber risks from nation-state groups, particularly those affiliated with Iran, and AI-driven attacks. These adversaries have shifted from espionage to destructive attacks targeting essential services like water, energy, and government facilities. Challenges include asset visibility gaps, especially in older operational technology (OT) systems that are difficult to inventory and patch. Attackers leverage AI to rapidly map IT/OT networks and exploit legacy systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) advises critical infrastructure operators to strengthen cyber hygiene by reducing vulnerabilities, replacing unsupported legacy devices, and preparing rapid recovery plans. CISA emphasizes foundational cybersecurity practices such as employee education, strong authentication, timely patching, monitoring, data backup, and incident response planning. This guidance aims to help organizations mitigate risks from sophisticated nation-state and AI-enhanced cyber threats.
A sophisticated phishing campaign targets YouTube content creators by impersonating well-known brands such as Hollyland, Nike, and Spotify. Attackers send personalized sponsorship emails referencing specific videos from the creators' channels, directing them to fake platforms that mimic legitimate campaign dashboards. The scam culminates in a Google sign-in prompt that either steals credentials directly or requests excessive permissions. Compromised accounts are then locked by changing recovery options and used to propagate further scams to followers. This modular campaign operates globally, with confirmed targeting in Peru, Japan, and English-speaking regions, using multiple domains with consistent design and functionality.
This report investigates alleged cyberattacks targeting Discord communities focused on powerscaling discussions, centering on the Noblesse server linked to creator ZetaSolos. The incidents include mass bans, automated disruptions, and retaliation claims such as doxxing and extortion against moderators. Broader allegations involve coordinated raids, mass-reporting campaigns, social engineering, account compromises, harassment, and extortion. The investigation compiles available evidence but notes that not all claims are independently verified. It highlights the security risks faced by online communities from compromised accounts and inadequate security practices. The report encourages server owners and moderators to secure accounts, review permissions, and preserve evidence. No specific software vulnerability or exploit code is detailed, and no patch or remediation status is provided.
An unidentified, likely Chinese-speaking, financially motivated threat actor targeted South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The attacker used ARTEX, an open-source Chinese agentic penetration testing tool, combined with large language models such as DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to enhance operational tempo and conduct multiple intrusions rapidly. Analysis revealed exposed ARTEX configuration files, Claude Code session histories, and a two-server infrastructure involving Hong Kong. The adversary also researched Korean data breach marketplaces and Telegram channels for monetizing stolen data. The campaign demonstrates sophisticated use of AI-driven tooling to conduct targeted intrusions against financial institutions.
A coordinated campaign involving 16 malicious Firefox extensions targets cryptocurrency wallet users by stealing wallet recovery phrases and private keys. These extensions impersonate legitimate wallet portals and tools, including clones of Rabby Wallet and OKX Wallet. The stolen credentials are sent to attacker-controlled Cloudflare Workers endpoints. Mozilla has removed these extensions from their store. Users who have entered their credentials into these extensions are advised to create new wallets and transfer their assets immediately.
The TensorLake npm SDK version 0.5.144 was compromised in a supply chain attack involving ChainDrop/Shai-Hulud malware. The malicious package, downloaded approximately 12,000 times weekly, contains obfuscated code that steals credentials from various sources such as npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault, Kubernetes configs, SSH keys, and AI development tools. It executes via a preinstall hook, establishes persistence through scheduled tasks, and supports remote code execution. The attack uses an Ethereum contract for command-and-control and includes a dead-man switch that triggers destructive actions if stolen GitHub tokens are revoked. The malware can self-propagate by republishing compromised versions to other npm packages linked to the victim's publishing identity, spreading across the npm ecosystem.
FortiBleed is an ongoing global campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. Attackers gain access by scanning for exposed SSL VPN portals, performing credential stuffing and password spraying, and cracking stolen password hashes offline. Once inside, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Organizations may experience account lockouts due to attacker actions. The campaign acts as an initial-access broker with links to ransomware affiliates INC/Lynx and Payload, representing a significant medium-severity threat requiring immediate defensive measures.
A sophisticated phishing campaign impersonates AI advertising products from major platforms using a Browser-in-the-Browser technique to steal credentials and bypass multi-factor authentication (MFA) in real-time. The campaign targets advertising account managers and recruiters, leveraging a shared backend infrastructure and reusing code across multiple fake brands. It also includes refund scams and fake recruitment sites connected to the same infrastructure.
Attackers who obtain AWS credentials are actively validating them to determine their usefulness for accessing Amazon Bedrock services. Credential harvesting platforms, including KMON_NOC, test stolen AWS keys by calling GetCallerIdentity, then verifying Bedrock access through ListFoundationModels and Converse API calls. This validation enables attackers to assess the value of credentials for resale in token-jacking markets, where stolen AI model access is sold below retail price. The testing targets Anthropic Claude models and enumerates promotional credits to estimate financial worth. This behavior represents an evolution in credential validation techniques similar to those previously observed with AWS SES and SNS services.
The Blinder Tunnel campaign is an Iranian state-aligned cyber operation targeting Iraqi critical infrastructure using sophisticated social engineering and malware delivery techniques. The attackers impersonated the Dubai Airports IT department to lure targets with fake recruitment portals and coding challenges. The infection chain involves exploiting Windows developer project files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware called ShelbyLoader V2. The campaign uses GitHub API infrastructure for command-and-control communications, blending malicious traffic with legitimate cloud activity. GitHub has taken down the malicious repositories associated with this campaign. The campaign also links to other operations targeting Israeli entities with credential harvesting lures. This activity was observed from November 2025 and activated in March 2026.
A malicious campaign involving at least ten Visual Studio Code extensions distributed via the VS Code Marketplace and Open VSX registries has been identified. Two confirmed malicious themes execute threat actor-controlled code using encrypted JavaScript loaders, Russian-language gating, and Solana blockchain transaction memos for dynamic payload resolution. These extensions have been installed tens of thousands of times, posing a significant supply chain risk. Some extensions remain unweaponized but retain executable capabilities. The campaign is linked to the GlassWorm threat actor and uses brandjacking and infrastructure rotation tactics to evade detection.
