Find what you’re looking for

Exposed Interfaces & Supply Chain Risks: The 2026 Moltbot AI Assistant Breach

In January 2026, researchers uncovered widespread security vulnerabilities in Moltbot (formerly Clawdbot), an open-source AI assistant that achieved viral adoption among both consumers and employees in the enterprise sector. Due to prevalent misconfigurations—specifically, exposed admin interfaces and reverse proxy errors—hundreds of Moltbot instances were accessible online, allowing unauthenticated attackers to steal API keys, OAuth tokens, credentials, message histories, and even execute commands remotely with system-level permissions. Additional risks arose as malicious skills (modules) could be planted in the official registry, rapidly propagating supply-chain threats to unsuspecting enterprise and developer systems, further compounded by the assistant lacking sandboxing or privilege separation by default. This incident highlights a growing trend where AI/GenAI tools, easily adopted outside corporate IT control, create new vectors for credential theft, data leakage, and lateral movement. As attackers focus on AI-driven endpoints and shadow IT, failure to enforce zero trust, segmentation, and robust monitoring introduces significant business risk and regulatory exposure.

Fortinet Authentication Bypass: CVE-2026-24858 (2026 Breach & Response)

In January 2026, Fortinet released emergency security patches to address a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.4) actively exploited in the wild. Attackers leveraged the flaw in FortiOS's Single Sign-On (SSO) feature, bypassing authentication to gain unauthorized access to sensitive systems including FortiManager and FortiAnalyzer. The incident highlights the risks of unpatched perimeter defenses, with exploitation enabling potential lateral movement, privilege escalation, and access to business-critical data or control systems—potentially at scale for unremediated customers. This event is significant given the continued targeting of network infrastructure through novel bypass techniques. Escalating regulatory scrutiny and threat actor sophistication underscore the need for timely patching, robust segmentation, and ongoing monitoring of privileged identity solutions.

Google Flags Ongoing Exploitation of WinRAR CVE-2025-8088 by Elite Threat Actors

In July 2025, a critical vulnerability (CVE-2025-8088) in RARLAB WinRAR was identified and subsequently patched, but not before multiple threat actors, including government-backed groups from Russia and China as well as financially motivated cybercriminals, actively exploited it. Attackers leveraged the flaw as an initial access vector, distributing diverse malicious payloads to compromise targeted systems. The exploitation campaign enabled unauthorized access to sensitive environments and facilitated follow-on activities such as lateral movement and data exfiltration, raising serious concerns for organizations and individuals relying on WinRAR for file management. This incident is significant as it highlights the speed and sophistication with which both nation-state and financially driven attackers weaponize zero-day vulnerabilities. The continued exploitation of unpatched systems following disclosure underscores the persistent risks organizations face from lagging patch cycles and evolving adversary tactics.

Mustang Panda’s 2025 Cyber Espionage: Updated COOLCLIENT Backdoor Hits Government

In late 2025, cyber espionage group Mustang Panda (also known as Earth Preta and Twill Typhoon) launched a series of targeted attacks against government entities, deploying an updated version of the COOLCLIENT backdoor. These intrusions leveraged spear-phishing and custom malware to establish persistent access, exfiltrate sensitive government data, and conduct surveillance. The campaign relied on advanced command-and-control infrastructure and encrypted traffic to evade detection, demonstrating the group’s evolving tactics and technical sophistication. The breach resulted in notable data theft and highlighted vulnerabilities in governmental East-West network security and policy enforcement. This incident underscores a rising trend of state-sponsored attackers continuously updating malware toolsets and intensifying operations against government organizations. The sophistication and stealth of these campaigns demand enhanced data protection, visibility, and zero trust network controls to meet regulatory and operational requirements.

Critical vm2 Node.js Flaw Enables Sandbox Escape and Supply-Chain Exploit

In January 2026, a critical vulnerability (CVE-2026-22709, CVSS 9.8) was disclosed in the popular Node.js library vm2, enabling attackers to escape its JavaScript sandbox and execute arbitrary code on affected systems. The flaw, present in version 3.10.0, allowed exploitation via manipulation of Promise.prototype.then and Promise.prototype.catch, providing a direct path to remote code execution. Organizations relying on vm2 for untrusted code execution and sandboxing were at significant risk, with the vulnerability exposing underlying infrastructure to privilege escalation, data exfiltration, or supply-chain compromise. This incident highlights increased supply-chain risk in NPM ecosystems, where critical open-source dependencies like vm2 are often trusted by default. There is growing urgency as attackers increasingly target widely-used libraries to compromise downstream applications at scale, underscoring the need for stronger package vetting, runtime segmentation, and elastic incident response.

Critical n8n Vulnerabilities Allow Authenticated Remote Code Execution (2026)

In January 2026, cybersecurity researchers uncovered two critical vulnerabilities in the n8n workflow automation platform, including a CVE-2026-1470 flaw (CVSS 9.9) which enables authenticated users to achieve remote code execution via eval injection. Discovered by the JFrog Security Research team, attackers exploiting these weaknesses could bypass the Expression system and execute arbitrary commands on affected servers. Successful exploitation could allow lateral movement and data exfiltration by leveraging internal automation integrations, putting sensitive business processes and connected services at significant risk. This incident underscores a rising trend of attackers targeting automation and orchestration platforms as high-value footholds in enterprise environments. With the increased adoption of low-code automation, vulnerabilities in such platforms can propagate risk across multiple systems, driving urgent need for software vendors and organizations to prioritize security reviews, patch management, and robust segmentation controls.

Fake AI Coding Assistant Delivers Malware via VS Code Marketplace in 2026 Supply-Chain Attack

In January 2026, cybersecurity researchers discovered a malicious Visual Studio Code extension masquerading as "ClawdBot Agent - AI Coding Assistant" in the official VS Code Marketplace. The extension claimed to offer AI-assisted coding functionality but instead delivered a concealed malware payload to users who installed it. The attack leveraged the supply chain vector—abusing trust in a popular development marketplace—and could compromise the local development environment, providing the threat actor with unauthorized access and control over the affected system. This incident highlights the expanding risk of supply-chain attacks in developer ecosystems and raises concerns about the integrity of widely used software distribution platforms. This case underscores a rising trend of threat actors exploiting trusted software repositories to launch targeted malware campaigns. As AI coding assistants and marketplace extensions surge in popularity, organizations face mounting pressure to implement rigorous vetting and monitoring to protect software supply chains from increasingly sophisticated threats.

Russian ELECTRUM APT Strikes Polish Power Grid with Coordinated December 2025 Attack

In December 2025, a coordinated cyber attack disrupted multiple sites within Poland's national power grid, marking the first significant compromise of distributed energy operational technology in the region. The campaign, attributed with medium confidence to Russian state-sponsored APT group ELECTRUM, leveraged supply chain vulnerabilities and advanced lateral movement techniques to infiltrate the grid's OT networks. Attackers exploited unencrypted east-west traffic and segmentation gaps, enabling persistent access and operational disruption that triggered brief power outages and forced manual intervention by Polish operators. The incident showcased a notable escalation in critical infrastructure targeting methods by highly skilled actors. This incident highlights the increasing risk of state-sponsored attacks on energy infrastructure, especially in the context of rising geopolitical tensions and adversarial use of sophisticated supply chain compromise and network segmentation evasion. Organizations should reassess their visibility and controls for east-west and encrypted traffic to mitigate similar risks.

SafePay 2025: Ransomware Double-Extortion Escalates Against SMBs

In late 2024 and throughout 2025, the SafePay ransomware group rapidly escalated its operations, launching a string of highly targeted double-extortion attacks against small and mid-sized businesses (SMBs), particularly in highly regulated markets such as the US and Germany. SafePay affiliates compromised victim networks via common attack vectors, exfiltrated sensitive data, and deployed ransomware to encrypt crucial assets. Victims predominantly included service-based companies lacking the resilience to handle operational downtime or public exposure. Attackers leveraged leak sites and aggressive negotiation tactics, threatening regulatory action, legal liability, and reputational damage to compel payment, creating severe business, legal, and financial impacts. This incident exemplifies a broader trend in ransomware: extortion is no longer just about encrypting files, but about exploiting regulatory frameworks and psychological leverage. The rise of fragmented ransomware ecosystems and pressure-centric extortion highlights the need for organizations to move beyond classic recovery strategies and address emerging risks such as data exposure, legal repercussions, and reputational harm.

Stanley Malware: Chrome Web Store Defense Bypassed for Phishing – 2026 Breach Analysis

In January 2026, security researchers uncovered 'Stanley', a Malware-as-a-Service (MaaS) operation specializing in the distribution of phishing Chrome extensions designed to bypass Google’s official Chrome Web Store review process. Marketed on underground forums, Stanley provides subscribers with malicious browser extensions capable of injecting full-page phishing iframes, silently installing on Chrome, Edge, and Brave, and maintaining persistent command-and-control communication. The malware enables attackers to manipulate users’ browsing sessions while masking the true origin, collect sensitive credentials, and target victims based on IP and geography. This poses a significant risk of data theft and compromise within organizations that rely on browser-based workflows. This incident underscores the growing trend of abusing trusted extension platforms to deliver targeted phishing and credential theft at scale. The ability for criminal actors to bypass established security vetting processes presents urgent challenges for enterprise security teams and highlights the broader concern over supply chain weakness in browser ecosystems.

SoundCloud’s 2024 Mega Breach: 29.8 Million User Records Exposed

In June 2024, SoundCloud suffered a major data breach compromising the personal and contact information of approximately 29.8 million user accounts. Attackers infiltrated the audio streaming platform's systems and exfiltrated sensitive customer records, including names, email addresses, and other profile data, which were subsequently advertised on cybercriminal forums. Initial investigations suggest the threat actors exploited a weakness in SoundCloud’s platform, though details on the exact attack vector remain under investigation. The breach not only poses reputational risks but could also lead to targeted phishing and identity theft for impacted users. This incident underscores the growing trend of large-scale credential and data theft affecting prominent digital platforms globally. Organizations are facing mounting pressure from regulators and customers to bolster cloud security, enforce rigorous access controls, and demonstrate proactive incident response capabilities in line with privacy frameworks.

Over 6,000 SmarterMail Servers Hijacked via Critical Authentication Bypass (2026)

In January 2026, over 6,000 SmarterMail servers were found exposed online and vulnerable due to a critical authentication bypass vulnerability (CVE-2026-23760). This flaw in the password reset API allowed unauthenticated attackers to reset administrator passwords, granting them full administrative access and enabling remote code execution on affected servers. Reports of in-the-wild exploitation emerged within days of public disclosure, prompting both mass, automated hijacking attacks and urgent guidance from governmental agencies. The vulnerability impacted organizations globally, particularly across North America and Asia, and posed significant risk to business continuity, privacy, and service integrity. This incident underlines rapid attacker adoption of zero-day vulnerabilities and the risks of delayed patching for internet-exposed business systems. With threat actors leveraging automation and targeting widely-used administrative interfaces, organizations must adopt faster patch cycles and stronger access controls to reduce exposure to similar authentication bypass attacks.