Author: Staff Writer

Top Highlights Multiple vulnerabilities allow apps to execute arbitrary code, gain root privileges, or break out of sandbox restrictions, risking full system control. Attackers can cause unexpected system or app crashes, or leak sensitive user data through malicious web content, crafted files, or network attacks. Several flaws enable remote denial-of-service attacks or memory corruption, potentially leading to system instability or kernel memory disclosure. Threats, Attack Techniques, and Targets The recent findings reveal multiple vulnerabilities in Apple systems. For example, CVE-2025-43524 allows an app to break out of its sandbox, affecting the Icons component. CVE-2026-28819 enables an app to execute arbitrary…

Quick Takeaways Attackers exploit misconfigured AD CS certificate templates—such as overly permissive rights and subject supply options—to impersonate privileged accounts and escalate privileges stealthily. Shadow credentials and Key Trust misuse enable persistent, passwordless access by manipulating cryptographic attributes like msDS-KeyCredentialLink, resisting typical password resets. Recently observed open-source tools like Certipy and Certify lower the expertise barrier, facilitating widespread abuse of vulnerable AD CS configurations for reconnaissance, privilege escalation, and persistent access. Threat, Attack Techniques, and Targets Active Directory Certificate Services (AD CS) is vital for network security, providing certificates for user and service authentication and encryption. However, misconfigurations and default…

Essential Insights The FCC has extended the deadline to January 2029, allowing foreign manufacturers to continue providing major software and firmware updates for existing consumer routers in the U.S., citing security concerns. This change offers relief for millions of users and businesses, alleviating fears of losing security patches on their devices amid ongoing risks. Experts emphasize that the underlying security issues are operational—like default passwords and outdated patches—rather than manufacturing origin, advocating for a security-focused approach. While the extension mitigates immediate security gaps, organizations are advised to implement zero-trust principles and rigorous security practices, as broader risks of foreign-manufactured hardware…

Top Highlights Operation SilentCanvas employs a fake JPEG file to deliver malware, tricking victims into executing a PowerShell script that downloads additional malicious components without detection. The attack uses advanced techniques such as runtime command reconstruction, in-memory payloads, and fileless registry manipulation to evade antivirus defenses and elevate privileges silently. Once active, the malware deploys a trojanized version of ScreenConnect for persistent control, enabling real-time surveillance, credential harvesting, and long-term access through hidden accounts. Security measures recommended include blocking suspicious Windows binaries, monitoring PowerShell activity, controlling remote access tools, and implementing strict credential resets after exposure. Key Challenge A new…

Fast Facts A maliciously altered version of the Jenkins AST plugin was published, exploiting supply chain vulnerabilities to target users of Checkmarx Jenkins plugin. The cybercrime group TeamPCP has repeatedly compromised Checkmarx-related assets, including GitHub repositories and Docker images, to deploy credential-stealing malware. Persistent adversary access, indicated by defaced repositories and unrotated credentials, suggests ongoing, targeted exploitation of supply chain security gaps. Threat, Attack Techniques, and Targets Checkmarx has confirmed that a modified version of its Jenkins AST plugin was posted to the Jenkins Marketplace. This malicious plugin was published after an unauthorized access to Checkmarx’s GitHub repository. The compromised…

Fast Facts Law enforcement successfully dismantled the reactivated “Crimenetwork” platform, arresting its 35-year-old operator in Mallorca through international cooperation involving German, Spanish, Moldovan, and European authorities. The platform, which quickly gained over 22,000 users and 100 vendors offering illegal goods like stolen data, forged documents, and narcotics, generated over €3.6 million in revenue before its takedown. Authorities seized €194,000 in assets and obtained extensive user data, leading to ongoing investigations targeting buyers and sellers, primarily in German-speaking regions. The operation underscores the legal risks of darknet crime, exemplified by the recent nearly 8-year prison sentence for the platform’s predecessor and…

Fast Facts Cybercriminals have launched a sophisticated fake website mimicking Anthropic’s Claude AI to distribute malware, employing tactics akin to state-linked espionage, including malvertising and SEO poisoning to lure victims. The attack involves a malicious installer (“Claude-Pro Relay”) that secretly installs a backdoor called “Beagle” via DLL sideloading with a legitimate signed updater, making detection difficult. The malware chain includes the DonutLoader shellcode, which decrypts and executes the Beagle backdoor, providing threat actors persistent access, file management, and command execution capabilities. Users are advised to download Claude only from official sources, monitor startup folders and outbound connections, and be vigilant…

Top Highlights The Google Threat Intelligence Group (GTIG) reports that cybercriminals used AI to develop a functioning zero-day exploit, bypassing two-factor authentication in open-source web tools. AI-generated Python scripts with high-level logic flaws, like trust assumptions in 2FA, pose a significant security threat, with frontier language models effectively identifying such vulnerabilities. State-sponsored and cybercriminal groups leverage AI to discover, automate, obfuscate, and exploit vulnerabilities at scale, including deploying AI-enabled malware like PROMPTSPY and AI-assisted credential theft. The increasing use of AI for offensive and defensive cyber operations necessitates organizations to meticulously audit CI/CD pipelines, AI dependencies, and threat actor tactics…

Summary Points The Google Threat Intelligence Group (GTIG) has identified the first instance of an AI-crafted zero-day exploit used in the wild, which bypasses two-factor authentication (2FA). Evidence suggests AI models are increasingly capable of discovering high-level logic flaws in software, moving beyond simple bugs, and even writing exploits, as seen in the Python 2FA bypass script. Known threat groups such as UNC2814 and APT45 are actively experimenting with AI models like Google’s Gemini to identify vulnerabilities in embedded devices and network infrastructure across multiple countries. AI is also being exploited for various cyberattack activities, including malware development, autonomous attack…

Essential Insights Ransomware attacks in April 2026 heavily targeted critical infrastructure sectors such as Manufacturing, Healthcare, and Finance globally. New ransomware groups emerged while existing ones remained active, indicating evolving threat actor landscapes. The report highlights a rise in targeted damage, with an expansion of attacks on key industries and the emergence of new threat trends. Threat, Attack Techniques, and Targets In April 2026, ransomware groups continued their attacks worldwide. They targeted many industries, especially critical ones like manufacturing, healthcare, and finance. New ransomware groups appeared while existing ones stayed active. These groups use various techniques, often exploiting vulnerabilities in…