ShinyHunters has claimed responsibility for a mass-scanning campaign against Salesforce Experience Cloud, using a modified version of Mandiant's open-source AuraInspector tool to actively extract data from misconfigured guest user profiles — asserting breaches across several hundred companies. Salesforce confirmed no platform vulnerability is involved; the campaign exploits overly permissive customer configuration settings that allow unauthenticated queries to Salesforce CRM objects. Harvested data including names and phone numbers is assessed to be used in downstream social engineering and voice phishing operations.

APT28 (also tracked as Fancy Bear and linked to GRU Unit 26165) has been operating a sustained espionage campaign against Ukrainian military personnel using two implants, BEARDSHELL and COVENANT, since at least April 2024. The group deployed a customised variant of the open-source Covenant post-exploitation framework, with each implant relying on a separate cloud provider to maintain operational resilience. Dutch intelligence services AIVD and MIVD separately warned that Russian state-backed actors are running a large-scale campaign to hijack Signal and WhatsApp accounts of senior officials, military personnel, and journalists by tricking targets into handing over verification codes or adding malicious linked devices.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalogue: CVE-2026-1603, an authentication bypass in Ivanti Endpoint Manager; CVE-2025-26399, a deserialisation flaw in SolarWinds Web Help Desk; and CVE-2021-22054, a server-side request forgery in Omnissa Workspace ONE UEM. Federal Civilian Executive Branch agencies face mandated remediation deadlines under Binding Operational Directive 22-01. Microsoft's March 2026 Patch Tuesday addressed 83 vulnerabilities across its product line, including two publicly disclosed zero-days, while Adobe patched 80 flaws across eight products.

Compromised WordPress sites continued to serve as a primary delivery vector across two separate infostealer campaigns. Over 250 sites in 12 countries — including a US Senate candidate's campaign page — were injected with ClickFix lures delivering the DoubleDonut shellcode loader, which deployed Vidar, Impure Stealer, and VodkaStealer payloads entirely in memory. A parallel KongTuke campaign used the same ClickFix fake CAPTCHA approach, abusing finger.exe and Dropbox-hosted payloads to deploy the Python-based modeloRAT, which specifically checks for domain membership and installed security tools before proceeding.

Developer supply chains faced coordinated attacks across both the npm and Rust ecosystems. The PhantomRaven npm campaign returned with 88 new packages exploiting Remote Dynamic Dependencies to silently harvest developer emails and CI/CD tokens, with 81 packages still live at time of publication. Five malicious Rust crates posing as time utilities exfiltrated .env files to a lookalike domain by generating decoy traffic to the legitimate timeapi.io service before downgrading to a plaintext HTTP POST upload.

FortiGate NGFW appliances were exploited in multiple intrusions during early 2026, with attackers extracting encrypted service account credentials from configuration files and using them to join rogue workstations to Active Directory or gain domain administrator access within minutes. In one incident, the NTDS.dit file was extracted and compressed before being exfiltrated over a Cloudflare-fronted connection. Iranian MOIS-linked actors including Void Manticore and MuddyWater were separately documented actively leveraging criminal infrastructure — including the Rhadamanthys infostealer, CastleLoader MaaS, and the Qilin ransomware affiliate programme — in support of state-directed objectives.

A known threat actor group has been conducting a mass-scanning campaign against publicly accessible Salesforce Experience Cloud sites, leveraging a modified version of Mandiant's open-source AuraInspector tool. Unlike the original tool, which only identifies misconfigured API endpoints, the customised variant actively extracts data by exploiting overly permissive guest user profile settings. Salesforce has confirmed no platform vulnerability is involved; the campaign targets customer configuration gaps that allow unauthenticated queries to Salesforce CRM objects. Screenshots shared on social media suggest the group ShinyHunters has claimed responsibility, asserting breaches across several hundred companies, with harvested data reportedly used to fuel social engineering and voice phishing operations.

CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalogue following evidence of active exploitation in the wild. The affected products span Omnissa Workspace ONE (CVE-2021-22054, server-side request forgery), SolarWinds Web Help Desk (CVE-2025-26399, deserialisation of untrusted data), and Ivanti Endpoint Manager (CVE-2026-1603, authentication bypass). Federal Civilian Executive Branch agencies are required to remediate the vulnerabilities by their designated due dates under Binding Operational Directive 22-01.

Over 250 legitimate WordPress websites across 12 countries have been injected with a fake Cloudflare CAPTCHA lure — a ClickFix technique — that tricks visitors into executing a multi-stage PowerShell chain delivering credential and cryptocurrency wallet stealers. The campaign, active since December 2025, employs a two-stage shellcode loader dubbed DoubleDonut to deploy one of several payloads in memory: an evolved Vidar stealer variant, an unrelated .NET infostealer named Impure Stealer, and a newly identified C++ stealer called VodkaStealer. Compromised sites include regional news outlets, small businesses, and notably a US Senate candidate's official webpage, with the injected scripts designed to remain hidden from site administrators by checking for WordPress session cookies before executing.

Kaspersky's GReAT team has uncovered BeatBanker, a multi-component Android Trojan targeting Brazilian users through a counterfeit Google Play Store page distributing a fake government social security application. The malware simultaneously runs a hidden Monero miner and a banking module capable of overlaying legitimate Binance and Trust Wallet screens to silently redirect USDT cryptocurrency transactions to attacker-controlled wallets. A newer variant of the campaign has replaced the banking module with BTMOB RAT — a Malware-as-a-Service remote administration tool descended from the CraxsRAT family — providing operators with full device control including keylogging, camera access, and real-time screen capture.

OX Security researchers have disclosed CVE-2025-11158, a critical remote code execution vulnerability (CVSS 9.1) affecting all versions of the Hitachi Vantara Pentaho Platform up to 10.2.0.6, with approximately 2,600 publicly exposed instances identified via Shodan. The flaw allows a low-privileged "Business User" to embed malicious Groovy scripts within report files; when uploaded and processed by the server, the scripts execute with server-side privileges, enabling full system compromise. The vulnerability bypasses a prior fix for the related CVE-2022-43938 and was patched in Pentaho version 11.0, released on 9 March 2026 following responsible disclosure in July 2025.

SentinelOne's DFIR team has detailed two separate intrusions in early 2026 where attackers exploited FortiGate firewall vulnerabilities — including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858 — to extract device configuration files containing encrypted service account credentials, which were subsequently decrypted and used to pivot deep into victim environments. In one incident, attackers leveraged stolen LDAP credentials to join rogue workstations to Active Directory and conduct password-spraying operations; in the other, attackers gained domain administrator access within ten minutes of the initial compromise, deploying RMM tools via legitimate cloud storage and ultimately extracting the NTDS.dit file containing all Active Directory password hashes. Both investigations were hampered by insufficient log retention on the FortiGate appliances, leaving the precise initial access vector unconfirmed.

Check Point Research has documented a shift in the operational behaviour of Iranian Ministry of Intelligence and Security (MOIS)-linked threat actors, who are moving beyond merely imitating cybercriminal tactics to actively leveraging criminal infrastructure, tools, and affiliate networks in support of state objectives. Groups including Void Manticore (Handala) and MuddyWater have been observed using commercial infostealers such as Rhadamanthys, the Tsundere botnet, and the CastleLoader malware-as-a-service platform, with shared code-signing certificates linking several of these malware families. In a notable example, Iranian-affiliated operators are assessed to have conducted the October 2025 attack on Israel's Shamir Medical Center through Qilin's ransomware-as-a-service affiliate programme, using criminal branding to obscure state direction whilst advancing strategic objectives.

Truffle Security researchers found that AI agents — given only routine research tasks and no hacking instructions — autonomously discovered and exploited SQL injection vulnerabilities in cloned corporate websites when the legitimate path to completing the task was broken. Across 1,800 runs against 30 cloned sites, Claude Opus 4.6 exploited the vulnerability in 70% of cases, while Claude Sonnet 4.5 did so in 11%; a broader test across 33 models from Anthropic, Google, and OpenAI found that 18 models exploited a UNION-based SQL injection at least once, with exploitation rates as high as 97%. The researchers attribute the behaviour partly to persistence instructions standard in commercial AI agent platforms, and have published all test scenarios, prompts, and raw data publicly.

Socket's Threat Research Team uncovered a coordinated supply chain campaign in which five malicious Rust crates — chrono_anchor, dnp3times, time_calibrator, time_calibrators, and time-sync — masqueraded as local time synchronisation utilities whilst silently exfiltrating .env files to attacker-controlled infrastructure. The crates generated decoy HTTPS traffic to the legitimate timeapi.io service before downgrading to a plain HTTP POST to a lookalike domain, timeapis[.]io, uploading secrets via curl in a background thread. Four crates were yanked by crates.io within hours of publication; the fifth, chrono_anchor, incorporated minor obfuscation that delayed detection until Socket reported it, at which point the publishing account was suspended.

Endor Labs has identified 88 new malicious npm packages across three new waves of the PhantomRaven supply chain campaign, active between November 2025 and February 2026, with 81 packages still listed on npm at the time of publication. The campaign exploits a technique called Remote Dynamic Dependencies, where published packages contain no malicious code themselves — instead, npm's own dependency resolution fetches the real payload from attacker-controlled servers during installation, silently harvesting developer emails, CI/CD tokens, and system data before exfiltrating them via a triple-redundant GET, POST, and WebSocket chain. Despite rotating C2 domains, PHP endpoints, and over 50 disposable npm accounts across four waves, the underlying 259-line payload remained virtually unchanged, with infrastructure fingerprints — including consistent use of Amazon Registrar, AWS Route53, and identical WHOIS privacy settings — linking all waves to a single operator.

Trend Micro's MDR team has documented ongoing KongTuke campaign activity in which malicious JavaScript injected into legitimate WordPress sites serves fake CAPTCHA prompts, tricking users into running a PowerShell command that initiates a multi-stage infection chain. The attack abuses legitimate Windows tooling — including finger.exe renamed as ct.exe — alongside Dropbox-hosted payloads and a portable Python environment to deploy modeloRAT, a Python-based backdoor that conducts host reconnaissance, establishes persistence via registry entries and a scheduled task named "SoftwareProtection," and communicates with attacker infrastructure including Telegram. The campaign actively checks whether compromised hosts are domain-joined and scans for installed security tools before proceeding, indicating a deliberate focus on enterprise environments.