Russian state-sponsored hackers are conducting a large-scale campaign to compromise Signal and WhatsApp accounts belonging to government officials, military personnel, and journalists worldwide. Dutch intelligence agencies MIVD and AIVD confirmed Dutch government employees are among the victims, noting the operation abuses legitimate app features — including a fake Signal Support chatbot used to extract verification codes and the "linked devices" function to maintain persistent access — rather than exploiting any technical vulnerabilities in the messaging platforms.

Social engineering via trusted communication channels extended to corporate environments, with the threat cluster Blitz Brigantine — linked to Black Basta ransomware affiliates — deploying a new backdoor dubbed A0Backdoor against financial and healthcare organisations. Attackers overwhelmed targets with email spam before contacting them via Microsoft Teams posing as IT support, then used Windows Quick Assist to sideload a malicious DLL; the backdoor evades detection by routing command-and-control traffic through covert DNS MX record queries via public resolvers.

A separate social engineering pattern targeted developers through cloned installation pages for Anthropic's Claude Code, surfaced via paid Google Search placement. The campaign, dubbed InstallFix, replaced legitimate install commands with malicious one-liners fetching Amatera Stealer payloads from attacker-controlled infrastructure hosted on Cloudflare Pages, Squarespace, and Tencent EdgeOne, harvesting browser credentials, session tokens, and system data.

INC Ransom, a Russia-linked Ransomware-as-a-Service operation, has expanded activity across the Pacific, prompting a joint advisory from the ACSC, New Zealand's NCSC, and CERT Tonga. Confirmed incidents include a June 2025 attack on Tonga's Ministry of Health and intrusions against New Zealand health-sector organisations, with 11 attributed incidents recorded in Australia between July 2024 and December 2025; affiliates gain initial access via spear-phishing, unpatched systems, or purchased credentials before conducting data exfiltration and double extortion.

Google Cloud's H1 2026 Threat Horizons Report found identity compromise drove 83% of cloud and SaaS intrusions in the second half of 2025, with third-party software vulnerabilities overtaking weak credentials as the leading initial access vector. The exploitation window between vulnerability disclosure and active attack has collapsed from weeks to days, a pattern reflected in the disclosure of three HTTP/1.x request smuggling flaws — CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836 — affecting standalone Pingora OSS deployments, patched in version 0.8.0.

Dutch intelligence agencies MIVD and AIVD have confirmed that Russian state-sponsored hackers are conducting a large-scale campaign to compromise Signal and WhatsApp accounts belonging to government employees, military personnel, and dignitaries, with Dutch officials confirmed among the victims. The operation exploits legitimate app features rather than technical vulnerabilities — primarily by impersonating a Signal Support chatbot to extract verification codes, and by abusing the "linked devices" function to gain persistent access. Once an account is compromised, attackers can silently read messages and access group chats, with the campaign likely yielding sensitive information.

Researchers at Push Security have identified a campaign, dubbed "InstallFix," in which threat actors cloned the installation pages of Anthropic's Claude Code and distributed them via Google Search sponsored results. The fake pages are near-identical replicas of the legitimate site, with the sole difference being malicious install commands that fetch payloads from attacker-controlled servers rather than the official source. Analysis of the payloads identified Amatera Stealer, a subscription-based infostealer capable of harvesting browser credentials, session tokens, and system information, with malicious infrastructure hosted across Cloudflare Pages, Squarespace, and Tencent EdgeOne.

Australia, New Zealand, and Tonga have issued a joint advisory warning of escalating activity from INC Ransom, a Russia-linked Ransomware-as-a-Service operation that has been actively targeting healthcare and professional services organisations across the Pacific since early 2025. The group's affiliate model enables distributed attackers to conduct intrusions using shared infrastructure, with entry typically gained through spear-phishing, exploitation of unpatched systems, or purchased credentials — followed by data exfiltration and double-extortion tactics. Confirmed incidents include a June 2025 attack on Tonga's Ministry of Health and a separate intrusion against a New Zealand health-sector organisation, with the ACSC recording 11 attributed incidents in Australia between July 2024 and December 2025.

A campaign delivering REMCOS RAT has been observed using trojanised versions of the legitimate open-source video editor Shotcut as a delivery vehicle, with the malware embedded in replaced DLL files rather than the application itself. The attack chain begins with a ClickFix social engineering lure — typically a fake CAPTCHA on a compromised website — that tricks victims into executing malicious commands, ultimately unpacking the poisoned Shotcut package. Once deployed, the paid version of REMCOS grants attackers extensive capabilities including keylogging, credential theft, webcam access, UAC bypass, and persistent command-and-control communication.

BlueVoyant has identified a new malware payload, dubbed A0Backdoor, deployed by the threat cluster Blitz Brigantine — also tracked as Storm-1811 and linked to Black Basta ransomware affiliates. The campaign follows a well-documented playbook: targets are overwhelmed with email spam, then contacted via Microsoft Teams by attackers posing as IT support, who request remote access through Windows Quick Assist before sideloading a malicious DLL to deliver the backdoor. Notably, A0Backdoor communicates with its command-and-control infrastructure via covert DNS MX record queries routed through trusted public resolvers, helping it evade detection controls tuned to earlier attack patterns.

Google Cloud's H1 2026 Threat Horizons Report, drawing on data from Google Threat Intelligence Group and Mandiant, found that identity compromise underpinned 83% of cloud and SaaS intrusions in the second half of 2025, with data theft the primary objective in 73% of cases. Third-party software vulnerabilities overtook weak credentials as the leading initial access vector for the first time, with the window between vulnerability disclosure and active exploitation collapsing from weeks to days. The report also documents a North Korean campaign abusing Kubernetes workloads to steal millions in cryptocurrency, a CI/CD supply chain attack that achieved full cloud compromise within 72 hours, and a growing trend of malicious insiders using cloud storage services to exfiltrate sensitive data.