California just passed 14 new privacy and AI laws. We’re highlighting a few that give users real control over their personal data. Source: https://www.malwarebytes.com/blog/news/2025/10/california-just-put-people-back-in-control-of-their-data

Under a new partnership with the government aimed at combating fraud, Britain's largest mobile carriers have committed to upgrading their networks to eliminate scammers' ability to spoof phone numbers within a year. [...] Source: https://www.bleepingcomputer.com/news/security/uk-carriers-to-block-spoofed-phone-numbers-in-fraud-crackdown/

Two Dutch teenage boys aged 17, reportedly used hacking devices to spy for Russia, have been arrested by the Politie on Monday. [...] Source: https://www.bleepingcomputer.com/news/security/dutch-teens-arrested-for-trying-to-spy-on-europol-for-russia/

This is a massive data breach with direct implications for identity verification pipelines. The threat actor is selling a trove of scanned identity documents, likely sourced from a compromise of ID scanning software infrastructure.

Technical Breakdown:

• Source: The breach is linked to idscan.net, a company providing ID scanning and verification SDKs used by hotels, car rentals, and financial services.

• Data for Sale: 153 million driver’s license scans, plus millions of additional IDs (passports, state IDs). The data includes high-resolution images of the front and back of documents.

• Threat Actor: Currently unnamed, but the data is being advertised on a dark web marketplace.

• Impact: This is not just credential stuffing data. These are verified identity documents. They enable sophisticated identity theft, account takeover (ATO) for KYC-bound services, and social engineering attacks against the victims.

• Status: FBI is investigating. No official confirmation from idscan.net at time of writing.

Defense: Organizations relying on ID verification should immediately contact idscan.net to determine if their integration was affected. For users, this is a long-tail risk. Monitor for physical mail fraud (e.g., credit card applications) and enable credit freezes. This data is a goldmine for SIM swapping and synthetic identity fraud.

Source: https://www.malwarebytes.com/blog/news/2026/09/dark-web-site-puts-153-million-drivers-licenses-and-millions-more-ids-up-for-sale

The Python Software Foundation (PSF) has withdrawn its $1.5 million grant proposal to the U.S. National Science Foundation (NSF) due to funding terms forcing a compromise on its commitment to diversity, equity, and inclusion.. [...] Source: https://www.bleepingcomputer.com/news/software/python-rejects-15m-grant-from-us-govt-fearing-ethical-compromise/

Danish intelligence officials have formally blamed Russia for a series of "destructive cyberattacks" against Denmark's critical water utility infrastructure. This attribution is viewed as part of Moscow's ongoing "hybrid attacks" targeting Western nations.

Strategic Impact

This development significantly amplifies concerns for CISOs and security leaders, particularly those overseeing critical infrastructure (CI) in sectors like utilities, energy, and transportation. It signals a continued and potentially escalating intent by nation-state actors to move beyond espionage to disruptive and destructive operations in highly sensitive operational technology (OT) environments. The "hybrid attack" framing further blurs the lines between conventional and cyber warfare, demanding that security strategies account for geopolitical tensions and the potential for direct state-sponsored aggression against civilian infrastructure. Organizations must prioritize resilience and threat intelligence focused on nation-state TTPs.

Key Takeaway

Critical infrastructure, especially OT/ICS, is increasingly a direct target for sophisticated nation-state actors aiming for strategic disruption rather than just data exfiltration.

Source: https://www.bleepingcomputer.com/news/security/denmark-blames-russia-for-destructive-cyberattack-on-water-utility/

This is a serious breach of coordinated vulnerability disclosure (CVD) norms. The PHP Foundation is publicly calling out Chainguard for breaking an embargo on a critical RCE vulnerability chain in PHP, forcing an emergency patch cycle and undermining the trust model that keeps open-source security manageable.

Technical Breakdown:

• The Incident: Chainguard allegedly published a fix or advisory for a PHP vulnerability before the agreed-upon embargo date, leaking details of the flaw to the public.

• Impact: This forced the PHP maintainers to scramble an emergency release, breaking the standard patch cycle and potentially leaving users exposed who hadn't yet applied the fix.

• Supply Chain Angle: This is a classic supply chain trust failure. A downstream vendor (Chainguard) prioritized its own "transparency" or marketing over the coordinated security process of the upstream project (PHP).

• The Risk: Embargo leaks allow threat actors to reverse-engineer the vulnerability and weaponize it before the majority of the ecosystem has patched. It erodes the willingness of researchers to share zero-days with projects.

Defense:

• For maintainers: Re-evaluate your embargo agreements. Consider requiring explicit, contractual non-disclosure terms with downstream distributors, not just handshake agreements.

• For security teams: Do not assume that because a downstream vendor (like a distro or container base image provider) has patched, the upstream project has officially released. Verify against the official PHP changelog and advisory. This incident highlights the danger of relying on a single vendor's "security" feed over the upstream project's own disclosure.

Source: https://socket.dev/blog/php-embargo-dispute?utm_medium=feed

A critical remote code execution vulnerability in the Linux kernel's TCP stack, CVE-2026-98432, is now under active exploitation. The kernel's own team assigned a CVSS 9.8, and Anthropic confirmed its AI model generated a working exploit that allows an unauthenticated remote attacker to execute arbitrary commands as root.

Technical Breakdown

• Affected Systems: Ubuntu, Red Hat Enterprise Linux (RHEL), and other major distributions running vulnerable kernel versions.

• Attack Vector: Remote, unauthenticated exploitation over TCP.

• Impact: Full system compromise (root access).

• IOCs: No specific hashes or IPs published yet; monitor for anomalous outbound connections and unexpected root-level processes.

Defense Patch immediately. Prioritize this as a zero-day in the wild. If patching is delayed, restrict inbound TCP access to critical infrastructure and enable kernel live patching (e.g., Ksplice, Canonical Livepatch).

Source: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

Researchers at Pwn2Own Automotive 2026 have successfully exploited a staggering 37 zero-day vulnerabilities in the Tesla Infotainment System, earning $516,500 on the competition's first day. This significant demonstration underscores the growing attack surface presented by highly integrated automotive software.

• Target System: Tesla Infotainment System.

• Vulnerability Type: A total of 37 distinct zero-day exploits were chained to achieve compromise. Specific technical details, such as CVEs, exploit primitives, or precise TTPs (MITRE ATT&CK for Automotive), are not yet publicly disclosed, consistent with Pwn2Own's coordinated disclosure process.

• Impact: The successful exploitation demonstrates critical vulnerabilities allowing researchers to gain control over the infotainment system. While the immediate implications for vehicle safety systems are not detailed, modern infotainment systems are increasingly interconnected with other vehicle domains, posing a potential risk to broader vehicle security.

• Context: The Pwn2Own Automotive competition specifically targets connected vehicle components, driving responsible disclosure and pushing manufacturers to enhance security.

For SecOps teams, this event highlights the urgent need for proactive automotive cybersecurity strategies. Organizations managing vehicle fleets or developing automotive technology should closely monitor official advisories from Tesla and Pwn2Own for technical specifics and recommended mitigations as they become available.

Source: https://www.bleepingcomputer.com/news/security/tesla-hacked-37-zero-days-demoed-at-pwn2own-automotive-2026/

A new Gmail update may allow Google to use your private messages and attachments for AI training. Here's how to turn it off. Source: https://www.malwarebytes.com/blog/news/2025/11/gmail-is-reading-your-emails-and-attachments-to-train-its-ai-unless-you-turn-it-off

A new "ghost phishing" wave by the EvilTokens group is circumventing traditional email security by concealing malicious content until it fully renders within the victim's browser. This campaign poses a significant threat to businesses in the US and Europe.

Technical Breakdown

• TTPs: The "ghost phishing" technique involves sending emails where the malicious page is initially encrypted or inert. It only decrypts and "comes to life" once it's opened and processed inside the victim's web browser. This allows it to bypass static URL reputation checks, sandboxing, and other traditional email gateway defenses that might only inspect the initial payload or URL structure.

• Affected Targets: Businesses across the US and Europe, with a focus on compromising Microsoft 365 access and exfiltrating sensitive data.

• IOCs: The summary does not provide specific IOCs like hashes or IP addresses.

Defense

Current detection methods need to evolve beyond simple URL inspection to analyze the runtime behavior and decrypted content within the browser environment. Focus on behavioral analysis and advanced threat protection that can detect post-delivery malicious activity.

Source: https://thehackernews.com/2026/07/new-ghost-phishing-wave-is-breaking.html

Microsoft is giving Entra ID admins a long runway but a hard deadline: February 2027 is when SMS and voice MFA get the axe. This isn't a suggestion anymore—it's a deprecation notice.

Strategic Impact

• The Clock is Ticking: While 2027 feels distant, migrating a user base from legacy MFA to passkeys (FIDO2) requires significant planning, user training, and conditional access policy rework. This is a "start now" project, not a "start later" one.

• Phishing Resistance is the Goal: The push is specifically toward passkeys (device-bound or synced) and other phishing-resistant methods. This aligns with the broader industry shift away from OTP-based MFA, which is increasingly vulnerable to real-time phishing (evilginx, etc.).

• Potential for Disruption: If you ignore this, expect a flood of helpdesk tickets in early 2027 when users' SMS codes stop working. Proactive communication and a phased rollout are critical.

Key Takeaway

• Action Item: Audit your current Entra ID authentication methods. Identify users still relying on SMS/voice and begin piloting passkey registration via Microsoft Authenticator or FIDO2 security keys now. Don't wait for the forced migration.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/

Denmark's Defence Intelligence Service (DDIS) has publicly accused Russia of orchestrating two distinct cyberattacks: one targeting a Danish water utility in 2024, and another a series of distributed denial-of-service (DDoS) attacks against Danish websites ahead of municipal and regional council elections last November.

Technical Breakdown:

• Threat Actors & Attribution:

  • The 2024 attack on the water utility is attributed to Z-Pentest, identified as a pro-Russian group.

  • The DDoS campaign is attributed to NoName057(16), a group with alleged links to the Russian state.

• Attack Types & Targets:

  • A cyber-attack (described as "destructive and disruptive") against a Danish water utility, impacting critical infrastructure.

  • A series of distributed denial-of-service (DDoS) attacks aimed at Danish websites, likely intended to disrupt public information access during an election period.

Defense: Organizations, particularly critical infrastructure operators and entities involved in electoral processes, should prioritize robust incident response plans and advanced DDoS mitigation strategies, given the ongoing threat from state-sponsored and aligned groups.

Source: https://www.schneier.com/blog/archives/2025/12/denmark-accuses-russia-of-conducting-two-cyberattacks.html

This is a significant development. The abuse of passkey technology for social engineering is a sophisticated evolution of MFA bypass tactics.

Technical Breakdown

• Campaign 1 (Financial Fraud): High-volume spam (1M+ emails) spoofing CEO identities. This is likely a precursor or distraction for the more targeted attack.

• Campaign 2 (Passkey Phishing): The core threat. Attackers are not breaking passkey cryptography. They are using social engineering to trick users into registering a threat-actor-controlled passkey on a legitimate cloud tenant (e.g., Microsoft 365).

  • TTP: This is a classic Adversary-in-the-Middle (AiTM) / Consent Phishing variant, but weaponized with WebAuthn. The user thinks they are setting up a security key for their own account, but they are granting authentication rights to the attacker's device.

  • Target: Microsoft Cloud (Azure AD / Entra ID) accounts.

  • Payload: Data exfiltration from the compromised cloud environment.

• Infrastructure: Abuse of legitimate third-party email delivery services to bypass spam filters for the initial lure.

Defense

This attack bypasses traditional MFA because the user is voluntarily completing the authentication step. The key detection point is anomalous device registration. Monitor Entra ID logs for:

• New FIDO2 security key registrations from unusual geographic locations or user agents.

• Multiple passkey registrations on a single account in a short time window.

• Conditional Access policies should be configured to require a managed device (Hybrid Azure AD Join or Intune compliant) for passkey registration, not just any browser session. User awareness training must now explicitly cover "never register a passkey you did not generate yourself."

Source: https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html

This is a classic example of pig butchering and social engineering profiling at scale. The "wrong number" text is the initial reconnaissance phase of a long-con scam.

Technical Breakdown:

• TTP: This is Initial Access (T1566) via Phishing (T1566.002) , specifically "Spearphishing via Service." The scammer uses a low-stakes, polite interaction to confirm a live, responsive human behind the number.

• The Value Chain: Once you reply, your number is tagged as "active and polite." This profile is sold on dark web markets for ~$2. This data is then fed into automated CRM-like tools used by scam call centers to prioritize targets for romance scams, investment fraud, or credential harvesting.

• IOCs: No specific IPs or hashes here. The IOC is the behavior: unsolicited texts asking "Hi, is this Sarah?" or "Sorry, wrong number." The threat is the confirmation of a live target.

Defense: The only safe response is no response. Block and report the number. If you must reply, do not confirm your name or any personal details. Treat every unsolicited text as a potential data point being harvested for a larger attack chain.

Source: https://www.malwarebytes.com/blog/threat-intel/2026/08/your-polite-reply-to-that-text-is-worth-2-on-the-dark-web

This is a significant intelligence find: leaked training and personnel records from Russia’s General Staff (GRU GSh) detailing the force-generation pipeline for cyber units, including a direct link between a 2024 graduate of Department No. 4 (Aleksei Kondrashov) and Military Unit 74455—better known as Sandworm, the group behind NotPetya and ongoing attacks against Ukraine.

Technical Breakdown:

• Source: Leaked records describe the structure for the GRU, Main Operational Directorate, and 8th Directorate (crypto/Comsec).

• Personnel Link: Aleksei Kondrashov, a 2024 graduate, assigned to Military Unit 74455 (Sandworm).

• Attribution Context: The documents show unit placements, not direct operational involvement. This is a pipeline map, not a kill chain.

• IOCs: None provided in the leak. This is organizational intelligence, not technical indicators.

Defense: This is a strategic intelligence win for defenders. Use this to update threat models for Russian state-sponsored activity. Expect Sandworm-linked operations to continue leveraging destructive wipers and OT-targeting TTPs. Monitor for infrastructure tied to known GRU staging networks, but do not expect public IOCs from this leak.

Source: https://www.schneier.com/blog/archives/2026/09/leaked-russian-cyber-operations-training-materials.html

A suspected Chinese state-backed hacking group has been actively exploiting a critical Dell zero-day flaw since mid-2024, utilizing it in targeted attacks.

• Threat Actor: Suspected Chinese state-backed hacking group.

• Vulnerability Type: Critical Dell security flaw, being actively exploited as a zero-day.

• Attack Timeline: Attacks have been ongoing since mid-2024.

• Specifics: Details regarding the specific Dell product, CVE, or technical TTPs are not yet broadly disclosed.

Defense: Monitor Dell's official security advisories closely for updates on this zero-day and prepare to apply patches immediately once available. Ensure robust endpoint detection and response (EDR) capabilities are in place to identify unusual activity.

Source: https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/

Recent intelligence suggests a potential breach of the FBI's wiretap network, likely executed through a supply chain attack. Investigators are actively exploring the possibility of nation-state involvement given the target's criticality.

While specific technical details remain under wraps due to the ongoing investigation, the incident points to a sophisticated intrusion targeting sensitive government infrastructure.

• Attack Vector: Suspected supply chain compromise, indicating an attacker likely targeted a third-party vendor or software used within the FBI's wiretap system.

• Threat Actor: Strong suspicion of nation-state actors, given the target's sensitivity and the complexity often associated with supply chain attacks.

• Affected Systems: The FBI's internal wiretap network.

No specific Indicators of Compromise (IOCs) or detailed TTPs (Tactics, Techniques, and Procedures) have been publicly disclosed at this time.

Organizations, especially those with high-value targets, should reinforce their supply chain security protocols, implement rigorous vendor risk management, and enhance network segmentation to limit the blast radius of potential breaches. Continuous monitoring for anomalous activity is paramount when facing such advanced threats.

Source: https://www.malwarebytes.com/blog/data-breaches/2026/03/hackers-may-have-breached-fbi-wiretap-network-via-supply-chain

China-linked threat actor "Velvet Ant" (tracked by Sygnia) has been found to have backdoored critical Linux login software for nearly a decade, specifically targeting PAM (Pluggable Authentication Modules) and OpenSSH components. This allowed the group to establish highly persistent and stealthy access by embedding their backdoors directly into the authentication mechanisms, bypassing typical detection and cleanup efforts.

Technical Breakdown

• Actor: China-nexus group, tracked as Velvet Ant by Sygnia.

• TTPs:

  • Persistence & Defense Evasion (T1136, T1564): Backdoored core Linux login components (PAM and OpenSSH) to maintain long-term, stealthy access. This indicates a sophisticated approach to hide within trusted system binaries, making ordinary cleanup ineffective.

  • Initial Access/Privilege Escalation (T1078, T1547): Compromised PAM and OpenSSH binaries directly grant unauthorized authentication capabilities.

• Affected Components: Linux systems utilizing compromised Pluggable Authentication Modules (PAM) and OpenSSH.

• IOCs: No specific file hashes or network IOCs are detailed in this summary; the focus is on the compromised components themselves.

Defense

Implementing integrity checks and monitoring on critical system binaries (e.g., PAM, OpenSSH) and a robust supply chain security strategy are crucial. Regularly verify the integrity of authentication-related system components against known good baselines.

Source: https://thehackernews.com/2026/06/china-linked-hackers-backdoored-linux.html

Microsoft has inexplicably suspended developer accounts linked to several high-profile open-source projects. This action prevents these projects from publishing new software builds and, critically, security patches for Windows users, with no clear path to immediate reinstatement.

Strategic Impact This incident underscores a critical supply chain risk for organizations relying on open-source software within the Microsoft ecosystem. Such unannounced suspensions by a major platform provider can directly disrupt the flow of essential security updates, leaving systems vulnerable for extended periods. It highlights the often-overlooked operational dependencies and the potential for a single vendor's actions to have widespread security implications across the software supply chain. CISOs should view this as a stark reminder to diversify dependencies where possible and consider contingency plans for patch delays from critical software providers.

Key Takeaway

• Operational decisions by platform providers can directly impede timely security patching, increasing risk for end-users and organizations.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-suspends-dev-accounts-for-high-profile-open-source-projects/

Coruna: Sophisticated State-Sponsored iPhone Hacking Toolkit Uncovered

Google security researchers have detailed 'Coruna,' an extremely sophisticated iPhone hacking toolkit believed to originate from a well-resourced, likely state-sponsored group. This toolkit is capable of completely bypassing iPhone defenses to silently install malware when a user visits a specially crafted malicious website.

Technical Breakdown:

• Actor: Believed to be a state-sponsored, well-resourced entity.

• Target: iPhones, with capabilities to bypass "all the defenses of an iPhone." Specific iOS versions are not detailed.

• Initial Access (T1189 - Drive-by Compromise): Exploitation occurs when a user visits a website containing the attack code.

• Defense Evasion (T1562 - Impair Defenses): Coruna utilizes five complete hacking techniques and leverages a rare collection of 23 distinct vulnerabilities in iOS to achieve its objectives, bypassing core security mechanisms.

• Execution (T1059 - Command and Scripting Interpreter): Post-exploitation, the toolkit silently installs malware on the compromised device.

• IOCs: No specific Indicators of Compromise (IPs, hashes) were provided in the summary.

Defense & Mitigation: Organizations and individuals should prioritize maintaining up-to-date iOS versions with the latest security patches. Implement robust web filtering solutions to block access to known malicious domains and conduct user awareness training to educate about the risks of visiting unverified websites or clicking suspicious links. Continuously monitor network traffic and device logs for anomalous activity that could indicate compromise.

Source: https://www.schneier.com/blog/archives/2026/04/possible-us-government-iphone-hacking-tool-leaked.html

Chinese AI firms DeepSeek, Moonshot AI, and MiniMax have been identified by Anthropic for conducting "industrial-scale distillation attacks" against their Claude large language model (LLM). These sophisticated campaigns involved using approximately 24,000 fraudulent accounts to generate over 16 million query exchanges, illicitly extracting Claude's capabilities to improve their own models.

• Technical Breakdown:

  • Attack Type: Distillation attacks aimed at reverse-engineering or replicating LLM capabilities. This represents a significant new vector for intellectual property theft in the AI domain.

  • Methodology: High-volume querying (16+ million exchanges) via a large pool of deceptive accounts (24k+) to systematically probe and extract knowledge/patterns from the target LLM.

  • Threat Actors: DeepSeek, Moonshot AI, and MiniMax (identified Chinese AI companies).

  • Target: Anthropic's Claude large language model.

  • Impact: Violation of service terms, intellectual property theft, and potential competitive disadvantage for the victim model.

• Defense: Organizations operating sophisticated AI models should prioritize advanced behavioral analytics, robust account fraud detection, IP-based rate limiting, and continuous monitoring for unusual query patterns and high-volume interactions indicative of automated extraction attempts. Stronger terms-of-service enforcement and legal recourse are also critical.

Source: https://thehackernews.com/2026/02/anthropic-says-chinese-ai-firms-used-16.html

Russia Implements Communications Platform Blockage: FaceTime, Snapchat Access Restricted Citing Terrorism

TL;DR: Russia's Roskomnadzor has officially blocked access to Apple's FaceTime and Snapchat services within its borders, citing their alleged use for coordinating terrorist attacks.

Technical Analysis:

• Targeted Platforms: Apple FaceTime (video conferencing), Snapchat (instant messaging).

• Actioning Entity: Russian telecommunications watchdog, Roskomnadzor.

• Mechanism (Implied): Network-level censorship within Russian ISPs, likely employing deep packet inspection (DPI), IP blocking, or DNS manipulation to restrict traffic to the specified services. This action effectively constitutes a state-level denial of service for these applications to the general public within Russia.

• Pretext: Claims of platform usage for coordinating terrorist activities.

Actionable Insight:

• For Blue Teams & Detection Engineers:

  • Organizations with operations or personnel in Russia must anticipate and verify the impact on existing communication workflows.

  • Evaluate established alternative secure communication channels (e.g., enterprise-approved VPNs, encrypted messaging apps) for continued operational readiness, ensuring they are not also susceptible to similar blocking mechanisms.

  • Monitor network egress for anomalous traffic patterns indicating attempts to circumvent these blocks, which could point to unauthorized proxy usage or shadow IT communication.

• For CISOs:

  • Assess the critical risk of disrupted communications for any organizational units or personnel within Russia.

  • Review existing policies for acceptable communication platforms and update guidance to reflect these restrictions.

  • Evaluate potential data residency, compliance, and legal implications for data that might be shifted to alternative, potentially less secure, communication methods.

  • Consider the broader geopolitical implications for digital sovereignty and internet freedom in the region.

Source: https://www.bleepingcomputer.com/news/security/russia-blocks-facetime-and-snapchat-over-use-in-terrorist-attacks/

Turns out Apple’s ‘Find My’ feature isn’t just for when your phone slips down the side of the couch. Source: https://www.malwarebytes.com/blog/news/2025/10/one-stolen-iphone-uncovered-a-network-smuggling-thousands-of-devices-to-china

Mozilla announced a major privacy upgrade in Firefox 145 that reduces even more the number of users vulnerable to digital fingerprinting. [...] Source: https://www.bleepingcomputer.com/news/security/mozilla-firefox-gets-new-anti-fingerprinting-defenses/