Malware activity expanded across consumer and mobile platforms, with VVS Stealer targeting Discord accounts through obfuscated Python code distributed via Telegram. The Kimwolf botnet continued scaling through exposed Android Debug Bridge services and residential proxy networks.

Multiple breach disclosures and breach-linked impacts affected technology and service providers. LastPass breach fallout persisted through traced cryptocurrency theft, while Ledger reported customer data exposure tied to a third-party Global-e incident. Brightspeed investigated data theft claims involving over one million customer records.

Public sector and critical services faced disruption following confirmed and suspected cyber incidents. The European Space Agency acknowledged a breach involving external servers, and New Zealand initiated a formal review of the ManageMyHealth attack affecting patient data. A cyberattack also forced a British high school to remain closed after the holiday period.

Abuse of trusted platforms and ecosystems featured prominently in multiple incidents. VSCode IDE forks exposed developers to malicious extension namespace takeovers, while the NeoShadow npm supply-chain attack compromised JavaScript projects. Russia-aligned actor UAC-0184 leveraged Viber messaging to deliver malware to Ukrainian government and military targets.

Security researchers analysed a Python-based information stealer known as VVS Stealer that targets Discord users and browser data. The malware uses PyArmor obfuscation to evade detection, supports session hijacking through Discord injection, and has been sold via Telegram since at least April 2025.

Blockchain analysis has linked more than $35 million in stolen cryptocurrency to the 2022 LastPass breach, with thefts continuing through 2025. Investigators traced the laundering of funds through mixing services and Russian-linked exchanges, identifying consistent infrastructure and transaction patterns suggesting involvement from Russian cybercriminal actors.

The European Space Agency confirmed a security incident involving a small number of external servers supporting unclassified collaborative engineering activities. The agency said the affected systems were outside its core network and that forensic analysis is ongoing following claims of large-scale data theft.

Researchers have tracked the Kimwolf Android botnet to more than two million infected devices, largely compromised through exposed Android Debug Bridge services accessed via residential proxy networks. The botnet is monetised through DDoS-for-hire activity, proxy bandwidth resale, and paid app installs, with a significant concentration of compromised TV streaming devices.

Several popular AI-powered development environments recommended extensions that did not exist in the OpenVSX registry, leaving the namespaces open to potential abuse. The issue stemmed from inherited VS Code configuration files, allowing unclaimed extension names to be registered and distributed to developers through trusted in-product recommendations.

An analysis of 500 SafePay ransomware leak records shows that more than 90% of victims are small and mid-sized organisations, primarily in service-based sectors. Victims are concentrated in North America and Western Europe, with the United States and Germany most affected, reflecting attackers’ focus on regulated, high-value environments where data exposure increases leverage.