The Axe Report | Grab The Axe

EEOC Reverses Course, Stay or Pay Crackdown & Unclaimed Crypto Grab (07/11/2026)

info@grabtheaxe.com (Dusten Trounce) — Sat, 11 Jul 2026 00:00:00 GMT

Three of this week's changes touch the two things every operator budgets around: who you can hire and how you keep them. The EEOC pulled guidance that employers relied on for their affirmative action plans, California and New York are limiting the contracts that recoup training costs, and state treasurers are starting to treat idle crypto as property they can claim. Each one shifts a cost or a liability onto the business, and the ones who reprice for it early will not be the ones caught flat.

Top 5 Critical Compliance Alerts

1. EEOC Withdraws Longstanding Affirmative Action Guidance

On June 30, the Equal Employment Opportunity Commission (EEOC) formally withdrew longstanding guidance documents on the permissible scope of voluntary affirmative action plans (JD Supra). Employers built hiring and promotion programs on that guidance, and pulling it removes the safe harbor they were relying on, which means every plan written against the old rules needs a fresh legal read.

Operator Note: If your hiring or promotion program cites the withdrawn EEOC guidance, it needs review now. The document you built the policy on no longer backs it up.

2. California and New York Target 'Stay or Pay' Contracts

New laws in California and New York take aim at "stay or pay" provisions, the clauses that require employees to repay training, licensing, or sign-on costs if they leave before a set date (JD Supra). Businesses use these clauses to protect real investment in their people, so the practical move is to rebuild retention around agreements that hold up under the new rules rather than the ones now being challenged.

3. States Move to Seize Dormant Cryptocurrency

State treasury regulators are accelerating efforts to apply unclaimed property laws to inactive cryptocurrency accounts and other digital assets, with more than two dozen states now involved (JD Supra). Any business holding customer digital assets now has an escheatment obligation to track, and getting the dormancy timelines and reporting wrong turns an accounting gap into a state enforcement problem.

4. Study Finds Healthcare Websites Leaking Data Through Tracking Tools

A study found that the majority of healthcare websites use marketing and analytics tools that can disclose sensitive visitor information to third parties (HIPAA Journal). A tracking pixel on a patient-facing page is a HIPAA exposure hiding in the marketing stack, and the fix starts with an honest inventory of what your own website is sending and to whom.

Operator Note: Audit the trackers on your patient-facing pages before a regulator or plaintiff does. The compliance risk lives in the analytics tags the marketing team added, not the clinical systems IT watches.

5. Aspen Dental Settlement Resets Dental Service Organization Standards

California's settlement with Aspen Dental Management sets a significant new corporate practice of dentistry standard for dental service organizations and the practices they support (JD Supra). Any management services organization operating in a regulated clinical field should read this as a signal that the arrangement between the business and the licensed practice will get scrutinized.

Additional Compliance Alerts

Regulatory Updates

Colorado AG Settles Over Home Equity Agreements: Colorado's attorney general entered an assurance of discontinuance with a home equity agreement provider, requiring it to comply with the state's Uniform Consumer Credit Code. JD Supra
China Proposes Penalties on Cross-Border Brokerages: The China Securities Regulatory Commission announced proposed penalties against several overseas online brokerage firms for cross-border business activities, a warning shot for institutions serving Chinese clients. JD Supra

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

NJ Data Broker Reversal, NY Smart Glasses Ban & Waymo Calls Police (07/11/2026)

info@grabtheaxe.com (Jeff Welch) — Sat, 11 Jul 2026 00:00:00 GMT

Two governments this week decided the surveillance question in opposite directions, and a robotaxi answered a third one nobody voted on. New Jersey is trying to unwind its own data broker law because the data flow it cut off was politically useful, New York is pulling recording devices out of its courthouses, and a Waymo turned its own passengers over to police. Each case is really the same question: who gets to decide when the record of your movements becomes evidence against you.

Top 5 Critical Privacy Alerts

1. New Jersey Moves to Suspend Its Own Data Broker Law

Governor Sherrill's administration is working to suspend enforcement of New Jersey's new data broker law after realizing it would cut off political campaigns' access to key voter-targeting data (PogoWasRight). A privacy protection gets walked back the moment it inconveniences the people who wrote it, which tells you the data was never really meant to be off limits, only off limits to someone else.

Operator Note: When a data-minimization rule carves out the powerful, the exposure it was supposed to close stays open for everyone below them. Watch what the exemptions protect, not what the headline promises.

2. New York Bans Smart Glasses From Courthouses Statewide

Starting July 20, New York State courts will require anyone entering their facilities to surrender smart glasses and similar recording eyewear at the door (PogoWasRight). Courts understand that a device recording everyone in the room changes how people behave in it, which is the same reasoning that should apply well beyond the courthouse walls.

3. A Waymo Robotaxi Reports Teen Riders to Police

A self-driving Waymo reported two teenagers to San Mateo police after detecting them drinking alcohol during the ride (PogoWasRight). The car you hired to take you somewhere became a witness against you, and every robotaxi is a rolling sensor package whose logs can be pointed at the passenger as easily as at the road.

Operator Note: Every ride in an instrumented vehicle generates a record you do not control. Treat the cabin of a robotaxi as a monitored space, because it is one.

4. Meta Discontinues Its Muse Image Feature Over Privacy

Meta said it will discontinue Muse, an AI feature launched days earlier that automatically generated images using content from public Instagram accounts, after it "misses the mark" on user privacy (The Guardian). The feature shipped, the backlash landed, and it was gone in a week, which is what accountability looks like when it works, though the better outcome is catching this before launch rather than after.

5. The EFF Argues Automated Moderation Is Now Permanent

The EFF makes the case that automated content moderation is here to stay, and the accountability around these systems has not kept pace with how much they now decide (EFF). An algorithm that removes speech at scale makes decisions about real people with no one to appeal to, and the fix is transparency into how those calls get made, not a demand that the machines go away.

Additional Privacy Alerts

Privacy Laws & Regulations

Irish NCSC Issues Board Cyber Governance Guidance Ahead of NIS2: The Irish National Cyber Security Centre published guidance for management boards and senior executives of organizations subject to the EU's NIS2 directive, pushing cyber accountability up to the people who answer for the data. Inside Privacy

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Zimbra RCE, Ghostcommit AI Injection & a Global CMS Campaign (07/11/2026)

info@grabtheaxe.com (Chris Armour) — Sat, 11 Jul 2026 00:00:00 GMT

The theme today is trust boundaries you did not know you had. A crafted email runs code in your webmail session, a PNG carries a prompt injection past your AI code reviewer, and Alibaba's HTTP/3 library falls over from one bad variable that has no patch. Attackers keep finding the input your defenses wave through without inspection, and this week the softest of those inputs is the AI agent you added to move faster.

Top 5 Critical Security Alerts

1. Critical Zimbra Flaw Runs Code From a Crafted Email

Zimbra is urging customers to patch a critical vulnerability in the Classic Web Client that lets a specially crafted email execute arbitrary code inside a user's session (The Hacker News). Zimbra has a long history as a target for nation-state and criminal actors, and a bug that fires from an email a user only has to open is close to the ideal delivery path.

Operator Note: Patch Zimbra now and hunt for exploitation before the update, not after. Webmail RCE means the mailbox is the entry point, so treat exposed sessions as potentially compromised.

2. Ghostcommit Hides Prompt Injection in Images to Fool AI Code Reviewers

Researchers demonstrated Ghostcommit, a technique that buries a prompt injection inside a PNG image and slipped past the AI code reviewers CodeRabbit and Bugbot to exfiltrate repository secrets (BleepingComputer). The AI reviewer you bolted onto the pipeline to catch bad code is now an attack surface, because it reads attacker-controlled content and holds credentials, which is exactly the pairing an adversary wants.

Operator Note: Treat any AI agent with repo access as a privileged identity. Scope its secrets tightly and assume every file it ingests, images included, is hostile input.

3. Australia Warns of a Global Campaign Against Vulnerable CMS Platforms

The Australian Cyber Security Centre issued an alert about a global exploitation campaign targeting vulnerable content management systems and their plugins (BleepingComputer). The public website running an out-of-date CMS is the classic forgotten asset, and it is a foothold into the network behind it, not just a defacement risk.

4. Laser Attack Resets Tangem Wallet Passwords on Unpatchable Cards

Ledger's Donjon security team showed that a precisely timed laser pulse aimed at the chip inside a Tangem crypto wallet card can reset the card's password (The Hacker News). The flaw is in silicon, so there is no firmware fix, and it is a reminder that hardware you cannot update is a permanent exposure once someone has physical access.

5. Unpatched XRING Flaw Crashes HTTP/3 Servers With Legal Traffic

A single wrong variable in Alibaba's XQUIC library, which implements QUIC and HTTP/3, lets any remote client crash the server with a short burst of completely valid traffic, and no patch is available yet (The Hacker News). A denial-of-service that needs no malformed packets and no authentication is cheap to run and hard to filter, so anyone exposing XQUIC should plan for rate limiting rather than a fix.

Additional Security Alerts

Threat Intelligence

MODBEACON RAT Uses gRPC for Encrypted C2: The China-linked group Silver Fox has been tied to a new Rust-based remote access trojan called MODBEACON that hides its command traffic inside gRPC streaming, blending in with legitimate application protocols. The Hacker News

Security Tools & Best Practices

Lumen Rebuilt Exposure Management From 17,000 to 1.1 Million Assets: Lumen's asset inventory grew by nearly two orders of magnitude once it measured its real external attack surface, a concrete example of how far most inventories sit from reality. The Hacker News

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

DOJ Prosecution Playbook, MiCAR Deadline & Enhanced CIRMP Rules (07/10/2026)

info@grabtheaxe.com (Dusten Trounce) — Fri, 10 Jul 2026 00:00:00 GMT

Three deadlines landed this week that change what an operator has to prove, not just what they have to promise. The DOJ published clearer rules for when it charges a company and when it walks away, the EU's crypto-asset rules move from transition to enforcement, and a fresh 81,000-person health breach shows how fast a single email compromise turns into a reportable event. Each one starts with the same question: can you show the controls were in place before the incident, or only after.

Top 5 Critical Compliance Alerts

1. DOJ Publishes a New Playbook for Charging Corporations

The Department of Justice's 2025-2026 policy reset makes declinations more predictable, narrows the use of corporate monitors, and sharpens enforcement around individual accountability, government-program fraud, and national security exposure (JD Supra). More predictable declinations reward the companies that can document a real compliance program, so the value of a program you can evidence just went up.

Operator Note: A declination now favors firms that can produce records of controls, training, and self-reporting. Start with an assessment that captures that evidence, before you need it in front of a prosecutor.

2. MiCAR Transitional Period Closes for Crypto-Asset Service Providers

The transitional window under the EU's Markets in Crypto-Assets Regulation (MiCAR) is expiring for crypto-asset service providers, and the EU's Anti-Money Laundering Authority (AMLA) issued an advisory on the money-laundering and terrorist-financing risks tied to the deadline (JD Supra: MiCAR, JD Supra: AMLA). Firms that operated under grandfathered status now need full authorization and the anti-money-laundering controls that come with it, and the regulator has already named the gap it will be watching.

3. Australia's Enhanced CIRMP Rules Raise the Bar on Critical Infrastructure

Australia registered the Enhanced Critical Infrastructure Risk Management Program (CIRMP) Rules 2026 on June 9, formally amending the obligations that critical infrastructure operators must build into their risk programs (JD Supra). For any operator with assets in scope, this is a documentation and governance uplift, and the responsible-entity board is the one that has to attest the program is real.

4. Aitkin County Health Breach Affects 81,000 People

Aitkin County Health and Human Services in Minnesota disclosed a breach of its email environment affecting roughly 81,000 individuals (HIPAA Journal). An email compromise at a Health and Human Services agency crosses into protected health information fast, and once it does, the HIPAA breach-notification clock and the state reporting duties both start running.

Operator Note: A single mailbox compromise at a HIPAA-covered entity is a reportable-breach risk, not just an IT cleanup. The notification timeline is the obligation, and it does not wait for your investigation to finish.

5. DoD Moves Toward Certifying Printed Circuit Boards in Defense Systems

The Department of Defense issued an advance notice of proposed rulemaking toward a Defense Federal Acquisition Regulation Supplement (DFARS) rule that would restrict certain printed circuit boards in defense systems through a certification framework (JD Supra). For defense-industrial-base suppliers, this is another layer of supply-chain provenance to prove, and the contractors who map their board sourcing now will not scramble when the rule lands.

Additional Compliance Alerts

Regulatory Updates

SEC Updates Municipal Advisor Registration FAQs: The SEC's Office of Municipal Securities refreshed its Registration of Municipal Advisors FAQs to clarify registration and recordkeeping expectations. SEC
Education Department Finalizes Title IV Earnings Rule: The US Department of Education issued a final rule on earnings accountability for Title IV programs, tying program eligibility to graduate earnings outcomes. JD Supra

Third-Party Risk & Due Diligence

Accenture Confirms Intrusion After 35GB Breach Claim: Accenture confirmed a security breach after an actor claimed to have stolen 35GB of data, a reminder that your largest vendors are also your largest concentrated third-party risk. HIPAA Journal

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Facewatch in Shops, Meta's Addictive Design & Leaky VPN Apps (07/10/2026)

info@grabtheaxe.com (Jeff Welch) — Fri, 10 Jul 2026 00:00:00 GMT

Facial recognition just moved from the airport and the police van into your corner shop, and in the UK it will now alert officers the moment it thinks it sees a known offender. The EU is calling Meta's autoplay and infinite scroll what they are, engineered compulsion, while a US senator tries to legislate against automated systems that decide who gets hired. The connecting thread is that the surveillance and the manipulation both run on the same fuel: your data, collected in ordinary moments, turned into leverage over you.

Top 5 Critical Privacy Alerts

1. Facial Recognition in UK Shops Will Alert Police in Real Time

Civil liberties groups are warning about Facewatch, a system rolling into UK stores including Sainsbury's and B&M that will flag people it identifies as serious offenders and alert police in real time (The Guardian). A live biometric checkpoint at the door treats every shopper as a database query, and the harm from a false match lands on a person who did nothing but walk in to buy groceries.

Operator Note: Once a face is enrolled in a watchlist, the person cannot patch it, rotate it, or opt out. That is the Human Zero-Day at the level of the population, and the burden of a wrong match sits entirely on the individual.

2. EU Accuses Meta of Ignoring the Mental Health Risks of Addictive Design

EU regulators issued preliminary findings that Meta failed to address the mental health risks of "addictive design" in Facebook and Instagram, naming autoplay and infinite scroll as features that drive compulsive use (The Guardian). Regulators are treating engagement mechanics as a design choice with consequences, which is the honest way to look at a system built to hold attention past the point the user would choose to stop.

3. Senator Markey Unveils an AI Accountability Package

Senator Ed Markey introduced a set of bills aimed at curbing datacenter growth, automated hiring systems, and AI harms to children (The Guardian). The automated-hiring piece matters most for working people, because a model that screens resumes makes a life-altering decision with no one in the room to explain it and no clear way to appeal.

4. Google's reCAPTCHA Mobile Verification Revives Remote Attestation

The EFF argues that Google's experimental reCAPTCHA Mobile Verification brings back a remote attestation scheme that is as bad as the last one, letting the platform decide which devices and configurations are allowed to reach a service (EFF). Attestation sounds like security, and in practice it hands the gatekeeper power over whether your device is trusted enough to use the open web.

5. Study Finds 281 Free Android VPN Apps Leaking and Tracking

Researchers ran 281 of the most popular free VPN apps on the Google Play Store through a new testing system and found widespread traffic leaks, unencrypted data, and tracking (The Hacker News). People install these apps to become harder to watch, and many of them quietly do the opposite, which is the worst kind of privacy tool: one that sells confidence while leaking the thing it promised to protect.

Operator Note: A free VPN monetizes the only asset it has, which is your traffic. Treat "free privacy tool" as a claim to verify, not a feature.

Additional Privacy Alerts

Privacy Laws & Regulations

Bank of England Gains Power Over Critical Tech Vendors: UK regulators can now directly oversee "critical third parties" such as Amazon, Google, Oracle, and Microsoft to enforce cyber resilience across the financial system, a rare move to hold the infrastructure layer accountable rather than only the banks on top of it. The Guardian

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

ShareFile Shutdown, Injective npm Theft & Entra Passkey Fraud (07/10/2026)

info@grabtheaxe.com (Chris Armour) — Fri, 10 Jul 2026 00:00:00 GMT

Progress is telling ShareFile customers to power off their own servers, which tells you how bad the threat is before anyone has published a CVE. A poisoned Injective SDK on npm is draining crypto wallets, and attackers are calling Microsoft 365 users to walk them through enrolling a passkey that belongs to the attacker. The pattern this week is trust turned into a delivery mechanism: your file transfer vendor, your package registry, your own MFA enrollment flow.

Top 5 Critical Security Alerts

1. Progress Tells ShareFile Admins to Shut Down Storage Zone Controllers

Progress Software emailed ShareFile customers running on-premises Storage Zone Controllers to immediately shut the Windows servers down, citing a "credible external security threat" against the file-sharing product (The Hacker News, BleepingComputer). Progress is the company behind MOVEit, and a managed file transfer product is exactly the target Cl0p-style crews mine for mass data theft, so "turn it off" is the right call even at the cost of downtime.

Operator Note: If you run ShareFile Storage Zone Controllers on-prem, the containment step is the shutdown, not a patch you are waiting on. Assume data access, not just service disruption.

2. Injective Labs GitHub Compromise Pushes Wallet-Stealing npm Package

Threat actors compromised the Injective Labs SDK GitHub repository and used it to publish a malicious npm package that steals cryptocurrency wallet private keys and mnemonic seed phrases (The Hacker News, BleepingComputer). A trusted first-party SDK is a better delivery vehicle than any phishing email, because developers install it without a second look and ship it straight into production.

Operator Note: Pin dependencies to known-good versions and treat a first-party SDK update like untrusted code until you have diffed it. The registry is not a trust boundary.

3. Exposed Server Reveals WP-SHELLSTORM Backdooring WordPress at Scale

A cybercrime crew left one of its own servers open to the internet for three weeks, exposing its tooling, activity logs, and a target list naming more than 1.4 million WordPress sites seeded with WP-SHELLSTORM backdoors (The Hacker News). The target count is the ceiling, not the confirmed compromise total, but a persistent web-shell on a fraction of that list is a large pool of resold access.

4. Fake Microsoft Entra Passkey Enrollment Hands Over Microsoft 365

A threat actor is running voice-based social engineering that pushes Microsoft 365 users to enroll a new Entra passkey, then uses that attacker-controlled credential for data-extortion access (The Hacker News). This is the ugly turn in the passwordless story: enrolling an attacker's passkey is phishing-resistant login for the attacker, and it survives the victim's password reset.

Operator Note: Lock down who can self-enroll authentication methods and alert on new passkey registrations. Passwordless does not remove the enrollment step from the threat model.

5. Ryuk and AlphV Operators Face Prison in a Run of Ransomware Convictions

A man accused of deploying Ryuk pleaded guilty in Oregon federal court, while a Blackcat/AlphV conspirator drew a 70-month sentence in Florida, and a separate Florida ransomware negotiator was convicted for helping a gang extort US companies (The Record, TechCrunch). Convictions raise the personal cost of running these operations, though the affiliate model refills seats faster than courts empty them.

Additional Security Alerts

Threat Intelligence

Six New U-Boot Flaws Enable Boot-Time Code Execution: Binarly found six vulnerabilities in the U-Boot bootloader that starts routers, smart cameras, and server management chips, four of which can run code at boot for stealthy firmware attacks below the operating system. BleepingComputer

Security Breaches & Incidents

Miinto Confirms Order-System Breach: The Copenhagen fashion marketplace warned shoppers to watch for phishing after an intruder accessed its order management system. The Register

Cloud & Network Security

CISA Details Response to Exposed AWS GovCloud Keys: CISA published how it responded after sensitive AWS GovCloud credentials and internal data were committed to a public GitHub repository, a reminder that secrets in source control remain a top exposure path. Infosecurity Magazine

Emerging Security Technologies

Attacks on Healthcare Service Providers More Than Doubled: Cyberattacks on hospitals grew modestly in the first half of 2026, but attacks on the service providers and business associates behind them more than doubled, moving the pressure to the softer third-party layer. Dark Reading

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Chat Control Returns, KIDS Act & Meta's AI Photo Maker (07/09/2026)

info@grabtheaxe.com (Jeff Welch) — Thu, 09 Jul 2026 00:00:00 GMT

The EU's Chat Control is back from the dead after a vote to kill it fell short, which puts client-side scanning of private messages on the table again for every European. At home, the House passed the KIDS Act, a bundle that would police what Americans browse and message in the name of protecting them. Both share a tell: the people being surveilled never agreed to it, and the fear doing the selling is running louder than the evidence behind it.

Top 5 Critical Privacy Alerts

1. EU 'Chat Control' Survives a Kill Vote

The EU's Chat Control proposal survived after a vote to shelve it fell short, reviving mandatory scanning of private messages before they are encrypted (The Register). Scanning every message on the device to catch a few treats 450 million people as suspects by default, and a scanner that reads your messages for one stated purpose is a capability that never stays limited to that purpose.

Operator Note: Client-side scanning is a backdoor with better branding. If it ships, treat any "private" channel to an EU user as readable by policy.

2. House Passes the KIDS Act

The House passed the KIDS Act, a package that folds a revised Kids Online Safety Act together with browsing and messaging controls, and it now heads to the Senate (EFF). Age verification means every adult hands over an ID to use the internet, and the record of who-browsed-what becomes a standing target and a standing tool the moment it exists.

Operator Note: "Protect the kids" laws tend to ship an adult surveillance dataset. Watch what the verification actually collects, not what the title promises.

3. Meta's AI Image Generator Alarms Privacy Experts

Meta's new AI image generator can produce pictures of users who have public profiles, and advocates are telling people to check their settings before someone else generates them (The Guardian). Those public photos were posted for other people to see, and quietly repurposing them as raw material for a synthetic-image engine is consent laundering.

Operator Note: Tell your executives and their families to lock down public profile photos now. A public headshot is training data and impersonation fuel.

4. EU Commission Keeps Users Behind Big Tech's Gates

The European Commission declined to force interoperability between the major social platforms, leaving EU users locked inside walled gardens they cannot easily leave (EFF). When you cannot carry your social graph elsewhere, the platform holds your relationships hostage, and that lock-in is what lets it treat your data however it likes.

5. RentGrow Pays $2.25M Over Tenant-Screening Accuracy

RentGrow, a tenant-screening provider, will pay $2.25 million to settle FTC charges that it violated the Fair Credit Reporting Act (FCRA), including by failing to ensure the accuracy of the reports landlords used to judge applicants (FTC). A wrong line in a screening file follows a family for years, into an apartment denied by a number they never saw and could not correct.

Operator Note: If your business buys background or screening data on people, FCRA accuracy duties are being enforced with real dollars now. Audit your data sources.

Additional Privacy Alerts

Privacy Laws & Regulations

FTC targets AI "accuracy suppression": the agency issued a proposed policy statement on accuracy and output steering in AI systems, open for public comment through July 31. Inside Privacy

Data Minimization & User Consent

OpenAI asks for your travel routes: a verified email shows ChatGPT inviting users to share travel plans and timing to train the model, which is a lot to hand over for convenience. PogoWasRight
AI recruitment gets a hard look: Privacy International's investigation digs into how "humanless" hiring software processes and profiles applicants. Privacy International

Privacy-Enhancing Technologies

Google's remote attestation gets worse: EFF says the new reCAPTCHA "Mobile Verification" scheme extends the walled garden and is as bad for users as the version it replaces. EFF

Regulatory Fines & Enforcement Actions

Memorial Healthcare settles pixel case: the California provider agreed to settle class-action litigation over tracking pixels that leaked patient data to advertisers. PogoWasRight

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

EU Withdrawal Button, NJ Data Broker Law & HIPAA Delay (07/09/2026)

info@grabtheaxe.com (Dusten Trounce) — Thu, 09 Jul 2026 00:00:00 GMT

Three new obligations landed for operators today. The EU's withdrawal-button rule is now in force for anyone selling to European consumers, New Jersey enacted the country's most expensive data-broker law, and healthcare entities got a reprieve on the HIPAA Security Rule overhaul. Each one adds something you now have to prove to a regulator, and the smart move on all three is to assess your exposure before someone else does it for you.

Top 5 Critical Compliance Alerts

1. EU Withdrawal Button Now in Force

Article 11a of EU Directive 2023/2673 took effect on 19 June 2026, requiring online sellers to give EU consumers a prominent withdrawal button to cancel distance contracts, and it reaches US and global sellers serving EU customers (JD Supra). If your checkout takes the order in three clicks while cancellation takes ten, you are now out of step with the rule, and the fix is a change to the interface and the process, not a policy memo.

Operator Note: Map every EU-facing subscription and distance contract, then time the cancellation flow. If it is harder than signing up, it needs work now.

2. New Jersey Enacts the Costliest Data Broker Law Yet

New Jersey enacted A5328, the nation's most expensive data-broker law, with annual registration fees running from $5,000 to $1.5 million and a definition broad enough to sweep in companies that never called themselves data brokers (JD Supra). The registration net is wide, so the first task is deciding whether you meet the definition, because guessing wrong is a fee and a penalty rather than a rounding error.

Operator Note: If you buy, sell, license, or enrich third-party personal data, assume you are in scope until counsel says otherwise.

3. HIPAA Security Rule Overhaul Postponed

HHS postponed the timeline for the major HIPAA Security Rule overhaul, giving regulated entities more room to prepare for the proposed changes (HIPAA Journal). The delay is breathing room, and the organizations that use it to run a gap assessment now will not be the ones scrambling when the clock restarts.

Operator Note: Use the extra time to baseline against the proposed rule. The requirements are still coming, and the assessment is the cheap part.

4. EU Publishes AI Content Transparency Code

The European Commission published its Code of Practice on Transparency of AI-Generated Content, setting expectations for labeling synthetic media, though it is not yet formally endorsed (JD Supra). If your marketing, product, or support functions generate AI content, the labeling obligation is close enough to start building the workflow, because retrofitting disclosure across a content library costs far more than baking it in.

5. Only 26% of Companies Have AI Governance Aligned

Only 26% of companies say their governance frameworks are fully aligned with their AI adoption, and few report a measurable return on the AI spend (Corporate Compliance Insights). Deploying AI faster than you govern it is how you end up owning the liability without the payback, and the assessment that closes that gap costs far less than the incident that exposes it.

Operator Note: If AI is already in your operations, an AI governance and risk assessment is overdue. You cannot manage the liability you have not mapped.

Additional Compliance Alerts

Regulatory Updates

MiCAR transition period ends: the transitional window for crypto-asset service providers under the EU's Markets in Crypto-Assets Regulation (MiCAR) has expired, and the Anti-Money Laundering Authority (AMLA) issued an advisory on the money-laundering risks of the changeover. JD Supra
FINRA enforcement under review: FINRA published an external review of its enforcement program, with recommendations member firms should read before their next exam. JD Supra
DoD eyes circuit board restrictions: the Department of Defense issued an advance notice of proposed rulemaking toward a certification framework restricting certain printed circuit boards in defense systems. JD Supra

Policy & Governance Updates

SEC to revisit the IPO process: the SEC will host a July 13 virtual roundtable on modernizing IPOs and expanding access to public markets. SEC
Healthcare's risk problem reframed: analysts argue the healthcare challenge has moved from maintaining compliance to gaining enough visibility and accountability to manage enterprise risk. JD Supra

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

RoguePlanet Defender Fix, GigaWiper & $1M County Ransom (07/09/2026)

info@grabtheaxe.com (Chris Armour) — Thu, 09 Jul 2026 00:00:00 GMT

Microsoft finally shipped the fix for RoguePlanet, the Defender privilege-escalation zero-day that sat exposed for a month with working exploit code in the open, so the patch window is a race you are already behind on. The same day brought GigaWiper, a destructive backdoor assembled from three older malware families, and a leaked negotiation showing a US county quietly wired $1 million to its extortionists. The theme today is cheap advantage: attackers reusing old code, old accounts, and your own patch lag.

Top 5 Critical Security Alerts

1. Microsoft Patches RoguePlanet Defender Zero-Day

Microsoft patched RoguePlanet (CVE-2026-50656, CVSS 7.8), a Windows Defender flaw that hands an attacker SYSTEM privileges, nearly a month after the researcher Nightmare-Eclipse published a working proof-of-concept (The Register, The Hacker News). A month of public exploit code aimed at the security tool that is supposed to be watching the box is how a routine foothold becomes full control.

Operator Note: Patch Defender now and assume anything unpatched since June was reachable. Public exploit code means the attack was automated, not hypothetical.

2. GigaWiper Backdoor Bundles Wiping, Fake Ransomware, and Spyware

Microsoft dissected GigaWiper, a destructive backdoor that combines disk-wiping, fake-ransomware, and spyware modules lifted from several older malware families into one platform the operator can pick from (Microsoft, The Hacker News). Reusing proven destructive code keeps the attacker's cost down and your detection harder, because each borrowed piece already carries its own evasion.

Operator Note: A wiper wearing a ransomware mask turns your "pay and recover" plan into a trap. Back up like recovery is the only option, because against a wiper it is.

3. US County Paid $1 Million Extortion Demand

Leaked negotiation logs show an unnamed US county, possibly in Ohio, paid a $1 million extortion demand, with the full haggling exchange now public (The Register). Thin budgets and thin security staffing make local government a reliable payday, and every disclosed payment prices the next demand for the county down the road.

Operator Note: A leaked ransom transcript is free adversary training. Assume your own incident calls could end up public and decide the messaging before you need it.

4. Dormant GitHub Accounts Used to Map Corporate Orgs

Datadog Security Labs flagged overlapping campaigns using dormant GitHub accounts and automated scraping to enumerate corporate GitHub organizations, repositories, and users through the API (The Hacker News). Old, trusted-looking accounts blend into your contributor graph while the operator maps who works where and which repos hold the secrets, all before a single exploit.

Operator Note: Audit org membership and outside collaborators. A contributor account that has sat idle for two years is reconnaissance waiting to happen.

5. npm 12 Disables Install Scripts by Default

GitHub shipped npm 12 with install scripts disabled by default and granular access tokens deprecated, closing two of the most abused supply-chain paths in the JavaScript ecosystem (The Hacker News). Install-script execution on npm install has been the quiet delivery mechanism behind a long line of wallet stealers and credential grabbers, so this default finally flips the economics against the attacker.

Operator Note: Test your builds against the new default before it breaks a pipeline, and stop depending on postinstall hooks you cannot audit.

Additional Security Alerts

Threat Intelligence

GodDamn ransomware disables defenses with a kernel driver: the new family loads the PoisonX signed driver to neutralize endpoint security before it encrypts. The Hacker News
Injective SDK poisoned on npm: attackers compromised the Injective Labs GitHub repo and pushed a malicious npm package that steals crypto wallet keys and seed phrases. BleepingComputer
Iran broadens its targeting: researchers warn Iranian activity now reaches well beyond critical infrastructure, so any internet-facing vulnerability is in scope. Dark Reading

Security Breaches & Incidents

OpenMandriva reports attempted sabotage: the Linux project says a contributor tried to sabotage it after an internal dispute. BleepingComputer

Cloud & Network Security

Talos discloses 18 vulnerabilities: Cisco Talos reported three flaws in WolfSSL, fourteen in GeoVision, and one in VTK-DICOM, all now patched by the vendors. Cisco Talos

Emerging Security Technologies

AI agents are a new identity class: treating them like service accounts or API tokens leaves a gap most organizations have not closed. Dark Reading
Microsoft warns of heavier Patch Tuesdays: AI-driven vulnerability discovery will push patch volume up, and Redmond is using that to sell auto-patching. The Register

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

BeyondTrust Bug, ColdFusion Exploit & GitLost Leak (07/07/2026)

info@grabtheaxe.com (Chris Armour) — Tue, 07 Jul 2026 00:00:00 GMT

Today's stories share one theme: the front door. BeyondTrust and Tenda both shipped products that let an unauthenticated attacker walk straight in, an Adobe ColdFusion bug scored a perfect 10.0 and is already under attack, and a flaw called GitLost turns a public GitHub issue into a pipe out of your private code. Every one of these is a same-week patch, not a next-quarter one.

Top 5 Critical Security Alerts

1. BeyondTrust Patches Two Critical Auth-Bypass Flaws in Remote Access

BeyondTrust released fixes for two critical flaws in its Remote Support and Privileged Remote Access products that let unauthenticated attackers take control of vulnerable devices (The Hacker News, BleepingComputer). Privileged access tooling is the skeleton key of a network: it exists to reach every other system, so a bypass here hands an attacker the same reach your administrators have.

Operator Note: Remote access appliances are the highest-value target you run. Patch this the day you read it, then check logs for access you cannot account for.

2. Adobe ColdFusion Flaw at CVSS 10.0 Under Active Exploitation

Attackers are exploiting a path-traversal flaw in Adobe ColdFusion, tracked as CVE-2026-48282, that carries the maximum possible severity score of 10.0 (Infosecurity Magazine). Exploitation depends on the Remote Development Services feature being enabled with its authentication turned off, a non-default setup that plenty of teams still run. If that describes any of your internet-facing ColdFusion servers, patch to the current update today.

3. GitLost Leaks Private Repos From a Public GitHub Issue

Researchers disclosed a flaw dubbed GitLost that lets an unauthenticated attacker open an ordinary-looking issue on an organization's public repository and silently pull data out of its private repositories (Dark Reading, The Hacker News). No stolen credentials, no insider, just a crafted issue that an agentic workflow reads and acts on. This is the cost of wiring AI agents into your build pipeline without treating their inputs as hostile.

Operator Note: Any AI agent with repo access is a new trust boundary. Treat every issue, comment, and pull request it reads as attacker-controlled input.

4. Hidden Backdoor Found in Tenda Router Firmware

The CERT Coordination Center warned that several versions of Tenda router firmware ship with an undocumented authentication backdoor that grants administrative access to the web management panel (The Hacker News, BleepingComputer). A backdoor in an edge router is initial access and persistence in one package, and consumer-grade gear like this often sits on the same networks as the small businesses attackers love.

5. Japanese Telco Breach Exposes 12 Million Email Accounts

A cyberattack on a major Japanese telecommunications company exposed roughly 12 million customer email accounts across five internet service providers (The Record). Email is the master key to the rest of a person's digital life, because password resets for banking, work, and everything else land there. A breach of this size is raw material for the next wave of account takeovers.

Additional Security Alerts

Threat Intelligence

UAT-7810 expands its ORB network with LONGLEASH malware: Chinese operators are compromising unpatched Ruckus routers to grow an operational relay box network that hides the origin of later attacks. BleepingComputer
China-aligned cluster hits universities through Roundcube: A suspected Chinese group is exploiting Roundcube webmail flaws at US and Canadian university physics and engineering departments to harvest credentials. Infosecurity Magazine
RedWing rents Android bank fraud on Telegram: A malware-as-a-service operation lets low-skill criminals take over a victim's phone, steal banking logins, and capture one-time codes. The Hacker News

Social Engineering

DEBULL abuses Microsoft device-code flow: A campaign uses collaboration-themed lures to hijack Microsoft 365 accounts without ever showing a fake password page. The Hacker News
Fake Facebook verification phishing: Attackers target business users with a bogus verification offer and a compromised chatbot to steal sensitive account data. Infosecurity Magazine

Emerging Security Technology

Dialogflow CX 'Rogue Agent' flaw enabled data theft: A now-patched Google flaw let an attacker with edit rights on one chatbot agent compromise others in the same project and read live conversations. Dark Reading
Writer AI 'WriteOut' allowed cross-tenant compromise: A now-patched one-click flaw in the enterprise AI platform could leak session tokens between tenants. The Hacker News
Britain plans an autonomous AI 'Cyber Shield': The NCSC is building a capability to counter attacks that move at machine speed and greater scale. The Record

Cloud & Network Security

CAI cloud worm evicts rival malware, then mines: A worm boots competitors' malware off compromised cloud hosts before stealing secrets and mining cryptocurrency. The Register

Threat Intelligence

Spain arrests suspected pro-Russia hacktivist: Police detained a man suspected of active membership in CARR and Z-Pentest following an FBI tip. BleepingComputer

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Chat Control Vote, In-Car Cameras & Health Data Suits (07/07/2026)

info@grabtheaxe.com (Jeff Welch) — Tue, 07 Jul 2026 00:00:00 GMT

Every story in today's privacy roundup asks the same question: who gets to watch you, and did anyone ask first. The EU Parliament moved to fast-track a vote on scanning private messages before they leave your phone. New cars in Europe now come with a camera pointed at the driver's face. And a health-tech company must face trial over piping patient data to Google. None of these waited for consent.

Top 5 Critical Privacy Alerts

1. EU Parliament Fast-Tracks a Chat Control Vote

The European Parliament narrowly voted 331 to 304 to use an urgent procedure that fast-tracks a Thursday vote on extending the EU's temporary regime for scanning private messages to detect child sexual abuse material, the rules critics call Chat Control (Heise). The regime permits client-side scanning, where content is checked on the sender's device before encryption protects it, and the procedural move raises the bar for rejecting it. Scanning a message on your device before it is encrypted weakens the promise of encryption for everyone, not just the people under suspicion.

Operator Note: Client-side scanning turns every private device into a checkpoint. If your people handle sensitive material, the threat model now includes the phone itself, not just the network it rides on.

2. Every New EU Car Must Watch the Driver's Face

New rules require every new car sold in the European Union to carry a driver-monitoring camera that tracks the driver's attention and face (All About Cookies). The stated goal is safety, and distracted driving is a real harm. The privacy cost is that a biometric sensor now sits in the cabin of every new vehicle by default, and where that footage goes and how long it lives are decisions made by manufacturers, not drivers.

3. Health Data Sharing Suit Against Veradigm Advances

A court refused to dismiss a proposed class action alleging that health-technology provider Veradigm shared patients' health information with Google without consent, in violation of state and federal privacy law (PogoWasRight). Health data is the most intimate record a person keeps, and routing it to an advertising company treats a private medical fact as a marketing signal. The tracking tag someone added years ago is now the evidence in a lawsuit.

Operator Note: If your systems touch health data, inventory every third-party tag and SDK now. The pixel you forgot is the liability you will litigate.

4. Supreme Court Lets Texas App Age-Verification Law Take Effect

The Supreme Court declined to block the Texas App Store Accountability Act, letting a law that requires app stores to verify users' ages take effect while the case continues (The Record). Age verification sounds narrow, but in practice it means collecting identity documents or biometric estimates from every user, including the adults the law was not written to protect. A rule meant to shield children ends up building an identity database for everyone.

5. Meta's Muse Image Can Pull Other People Into AI Photos

Meta's new Muse Image model, now powering AI image tools across Instagram, WhatsApp, and the Meta AI app, can insert other Instagram users into AI-generated photos (The Verge). A person's face and likeness are becoming raw material for images they never posed for and never approved. When your likeness can appear in a scene you were never in, the harm is reputational and hard to undo.

Additional Privacy Alerts

Data Minimization & User Consent

Patients sue healthcare corporations over data handling: A wave of class actions accuses large healthcare companies of exposing or sharing patients' personal and health information. PogoWasRight
EFF on automated moderation: The group argues that platform moderation by algorithm is here to stay and needs transparency and a real path to appeal. EFF

Regulatory Fines & Enforcement Actions

FTC returns $2.7 million to gig workers: The agency is sending checks to consumers harmed by Handy Technologies' deceptive earnings claims. FTC
Predator spyware victims file 8 million euro suit: Greek victims are suing the spyware maker as campaigners press the EU to act on spyware abuse. The Register

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

SEC Fraud Group, Breach Settlement & EU Directive (07/07/2026)

info@grabtheaxe.com (Dusten Trounce) — Tue, 07 Jul 2026 00:00:00 GMT

Today's compliance stories each create a new obligation or a new bill to pay. The SEC stood up a dedicated group to chase fraud against retail investors, a healthcare company is paying to settle a breach it disclosed months ago, and the EU handed compliance teams a fresh directive to operationalize. Each one is an item to plan around before it becomes an enforcement action.

Top 5 Critical Compliance Alerts

1. SEC Forms a Retail Fraud Working Group

The Securities and Exchange Commission announced a new Retail Fraud Working Group to strengthen its enforcement efforts against fraud that targets everyday investors (SEC). A dedicated enforcement unit is a signal of where the agency will spend its attention, and firms that touch retail investors should read it as notice. The time to test your disclosures and sales practices is before the group comes looking, not after.

Operator Note: When a regulator names a focus area, treat it as a scoping document for your next internal review. Assess your retail-facing controls now, while it is still voluntary.

2. Calibrated Healthcare Settles Breach Class Action

Calibrated Healthcare agreed to settle a class action lawsuit stemming from a data breach that began in February (HIPAA Journal). The settlement is the part people forget to budget for. The breach is the security event; the class action is the financial one, and it lands long after the incident is closed. Containment ends the security incident, and the bill can still arrive months later.

3. EU Anti-Corruption Directive Gives Teams a New Roadmap

Compliance analysts published a practical roadmap for operationalizing the EU Anti-Corruption Directive, noting that programs measured against the new directive tend to fall into three maturity stages (Corporate Compliance Insights). A directive is only as real as the controls you build to meet it, and the gap between policy and practice is exactly where enforcement finds you. Map your current program against the directive before an auditor does it for you.

4. California Regional Center Notifies of 2024 Ransomware Attack

The North Los Angeles County Regional Center began notifying individuals affected by a ransomware attack that occurred in November 2024 (HIPAA Journal). A notification arriving well over a year after the incident invites hard questions from regulators about when the breach was discovered and why notice took this long. The obligation to notify starts the moment you discover the breach, so the legal steps belong inside your incident plan, written in before you need them.

Operator Note: Put your breach-notification deadlines in the incident response plan itself, with named owners. A slow notice is its own violation, separate from the breach.

5. New HIPAA Guidance Reminds Owners the Buck Stops With Them

Fresh guidance for small practice owners stresses that HIPAA responsibility sits with the practice regardless of what gets delegated, because the practice answers to the Office for Civil Rights, not the vendor (HIPAA Journal). Delegating the work does not delegate the liability. Owners who assume a vendor absorbed the risk tend to learn otherwise during an investigation.

Additional Compliance Alerts

Policy & Governance Updates

A guide to governance at US broker-dealers: New analysis walks through the fiduciary duties, regulations, and oversight that shape broker-dealer governance. Corporate Compliance Insights
The challenges facing the board of 2030: Analysts point to AI-driven information loss, global conflict, and rising accountability standards as the pressures boards should prepare for now. Corporate Compliance Insights
On red cards and control failures: A governance column uses a public misstep to illustrate how weak internal controls let bad decisions through. Radical Compliance

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

AI Ransomware, NetScaler Flaw & Linux VM Escape (07/06/2026)

info@grabtheaxe.com (Chris Armour) — Mon, 06 Jul 2026 00:00:00 GMT

Today's stories point one direction: the cost of running an attack keeps dropping. An AI agent executed a real ransomware intrusion from start to finish, a NetScaler flaw went from proof-of-concept to active exploitation in days, and a bug that sat in the Linux hypervisor for sixteen years lets a guest virtual machine break out onto the host it runs on.

Top 5 Critical Security Alerts

1. An AI Agent Ran a Complete Ransomware Attack

An "agentic threat actor" exploited a flaw in Langflow to steal data from a production database and encrypt other systems, in what Dark Reading calls the first complete LLM-driven ransomware attack. The detail that matters, per TechCrunch's reporting, is that a human still picked the victim and stood up the infrastructure. The model handled execution, not intent.

Operator Note: When execution gets cheap, your window between exposure and exploitation shrinks. Expect more attempts, not smarter ones, and shorten your patch and detection cycles to match.

2. NetScaler Flaw Under Attack, CitrixBleed All Over Again

Attackers began hitting a new memory-disclosure flaw in Citrix NetScaler within days of researchers publishing a proof-of-concept, a near-replay of the original CitrixBleed (Dark Reading). Memory-disclosure bugs on an internet-facing appliance leak session tokens, and a stolen session skips your authentication entirely.

Operator Note: Edge devices are the cheapest door an attacker will try. If you run NetScaler, treat this as a same-week patch, not a next-quarter one.

3. 16-Year-Old Linux KVM Bug Lets a Guest Escape to the Host

A use-after-free flaw in Linux's KVM hypervisor, present for sixteen years and dubbed Januscape, can be triggered from inside a guest virtual machine to corrupt the host kernel's memory on both Intel and AMD systems (The Hacker News). VM escape is the exact failure mode multi-tenant clouds are built to prevent, so one compromised tenant reaching the host puts every tenant on that host in the blast radius.

4. BusySnake Infostealer Hits Critical Infrastructure

A group researchers track as Armored Likho used the BusySnake infostealer to breach government agencies and electrical power entities in Russia, Brazil, and Kazakhstan (Dark Reading). Infostealers are the quiet first stage: reconnaissance and credential harvesting that set up the loud stage later.

5. Iran-Linked Group Aims New C2 at Israeli Organizations

An Iranian group tied to the Ministry of Intelligence deployed a previously undocumented modular command-and-control framework, Cavern, against Israeli government and IT-sector organizations (The Hacker News). State-linked C2 against a specific sector is a targeting signal. If you sit in that supply chain, assume you are on the list.

Additional Security Alerts

Threat Intelligence

Canada ran offensive cyber operations in 2025: Canada's CSE disclosed operations against a ransomware-as-a-service gang, a foreign extremist group, and drug traffickers. The Record
Attackers voted themselves $20M in BONK: A malicious governance proposal let holders drain roughly $20 million from BonkDAO, a reminder that on-chain governance is an attack surface. The Record

Security Breaches & Incidents

Medical device maker notifies nearly 4 million: Social Security numbers and health data were accessed in a breach at a major medical device manufacturer. The Record

Social Engineering

EtherRAT via fake Teams IT support: Attackers impersonate corporate IT on Microsoft Teams voice calls to trick employees into installing EtherRAT for initial access. BleepingComputer
Job-interview phishing at scale: A campaign impersonating more than 30 brands, including Adobe, Netflix, and OpenAI, uses fake job interviews to steal Google credentials. BleepingComputer

Emerging Security Technology

Prompt injection targets AI agents: Zscaler found websites hiding prompt-injection text to manipulate AI agents into making crypto payments. Infosecurity Magazine

Security Tools & Best Practices

Cloudflare adds granular AI bot controls: Site owners can now manage search, training, and agent crawlers separately instead of blocking all AI bots at once. The Decoder

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

CMMC Rules, Bosch $43M Export Fine & EEOC Shift (07/06/2026)

info@grabtheaxe.com (Dusten Trounce) — Mon, 06 Jul 2026 00:00:00 GMT

Today's compliance stories each create a new obligation or a new liability. CMMC cybersecurity requirements are flowing into defense contracts, and an inaccurate self-certification now carries False Claims Act exposure. Bosch paid more than $43 million for export-control violations. And the EEOC withdrew guidance employers have relied on for years.

Top Compliance Alerts

1. CMMC Requirements Land in Defense Contracts

Cybersecurity Maturity Model Certification (CMMC) requirements are rolling into defense contracts, and an inaccurate self-certification can expose a contractor to False Claims Act liability, including treble damages and whistleblower suits (Corporate Compliance Insights). This turns a security checkbox into a financial and legal one: the assessment you sign becomes a representation the government can sue over.

Operator Note: Do not self-certify from memory. Run a gap assessment against the CMMC level named in your contract first, because the penalty for getting it wrong is now treble damages.

2. Bosch Pays $43 Million for Illegal Huawei Exports

Bosch agreed to pay more than $43 million in penalties and disgorgement for illegally exporting products and software to Huawei in violation of US export controls (JD Supra). Export control is the area most companies underestimate, because the rules sit outside the security and privacy teams that usually own risk. One mis-shipped product line can carry an eight-figure price.

3. EEOC Rescinds Affirmative Action Guidance

On June 29, the EEOC voted to rescind two long-standing policy documents that guided employers on voluntary affirmative action programs (JD Supra). When an agency withdraws guidance employers built their policies around, the obligation does not vanish, it just loses its map. Any program that leaned on those documents needs a fresh review with counsel.

4. Texas Hearing Institute Reports 29,000-Person Breach

The Texas Hearing Institute notified the Texas Attorney General of a data breach affecting more than 29,000 residents (HIPAA Journal). Under HIPAA and state law, a breach is more than a security event. It starts a reporting clock and can trigger enforcement. The obligation begins the moment you discover it, so the legal notification steps belong inside your incident plan, written in before you need them.

Additional Compliance Alerts

Regulatory Updates

SEC names a new COO: The SEC appointed Paul Knight as Chief Operating Officer to oversee agency operations. SEC
FCA proposes new SIPP asset rules: The UK's FCA proposed a new regime for handling pension scheme money and assets within self-invested personal pensions. JD Supra

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Pegasus Spyware, Facial Recognition & ICE Surveillance (07/06/2026)

info@grabtheaxe.com (Jeff Welch) — Mon, 06 Jul 2026 00:00:00 GMT

Every story in today's privacy roundup is the same story: surveillance turned on the people it was meant to serve. Pegasus spyware landed on the phone of the European lawmaker whose job was to investigate Pegasus. A British supermarket is scaling facial recognition to catch shoplifters. An immigration agency's own watchdog is now looking into its online critics.

Top Privacy Alerts

1. Pegasus Infects the Phone of a Spyware Investigator

Pegasus spyware infected the phone of a member of the European Parliament who sits on the committee investigating Pegasus, and campaigners are demanding the EU finally act on long-delayed recommendations (The Register). When the tooling reaches the people overseeing the tooling, the risk stops being hypothetical for anyone. The phone in your pocket is a full-time sensor pointed at you, and the belief that yours is clean is a decision, not a fact.

Operator Note: Assume the device you carry can be turned against you, and design your most sensitive conversations around that assumption rather than around trust in the hardware.

2. A UK Grocer Triples Down on Facial Recognition

A major UK supermarket is putting facial recognition into as many as 150 more stores by year's end to identify shoplifters, a system critics call Orwellian (The Register). Biometric surveillance does not ask for consent and does not forget. Once a face is enrolled, the shopper has no practical way to opt out, and the retailer is trading a small drop in shrinkage for a large expansion of who gets watched.

3. ICE's Watchdog Turns Toward Its Critics

ICE's internal watchdog is reportedly investigating people who criticized the agency online, which turns an accountability function into a surveillance one (PogoWasRight). When the mechanism built to check power gets aimed at the power's critics, the chilling effect is the point. People self-censor long before anyone is ever charged.

4. Health Data Sharing Suit Against Healthline Advances

A court will let a proposed class action proceed against Healthline over claims it shared readers' health information with TikTok and Microsoft (PogoWasRight). Health data is among the most sensitive information a person carries, and piping it to ad-tech platforms treats a private medical concern as a targeting signal.

Operator Note: If your site touches anything health-adjacent, audit your trackers now. The tracking pixel you forgot about is the liability you will end up litigating.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Basic-Fit Breach Hits 1 Million Members, Adobe Patches Exploited Acrobat Zero-Day, APT41 Steals Cloud Creds

info@grabtheaxe.com (Chris Armour) — Mon, 13 Apr 2026 00:00:00 GMT

Basic-Fit confirmed today that attackers stole records on roughly 1 million gym members across the EU, giving scammers a fresh pool for impersonation and account takeover. Adobe pushed an emergency patch for a months-old Acrobat Reader zero-day that is already being exploited in the wild, while researchers at Google documented an APT41 backdoor that runs without triggering a single detection and exfiltrates cloud credentials. The FBI also landed a rare win, dismantling the W3LL phishing service with Indonesian authorities and arresting the developer.

Top 5 Critical Security Alerts

1. Basic-Fit Breach Exposes 1 Million Gym Members Across Europe

The Dutch gym chain confirmed attackers stole customer records covering an estimated one million members in several EU countries. Exposed data includes names, contact details, and membership information, according to the company's disclosure. BleepingComputer

Operator Note: The immediate risk is targeted phishing and identity fraud against members, not payment theft. Warn affected staff to expect Basic-Fit themed lures for the next 90 days.

2. Adobe Patches Actively Exploited Acrobat Reader Zero-Day

Adobe released fixes for CVE-2026-34621, an Acrobat Reader flaw under active exploitation. The vulnerability had been present for months before being flagged, and attackers are already using it for initial access. Dark Reading

3. APT41 Delivers Zero-Detection Backdoor to Harvest Cloud Credentials

Researchers documented a new APT41 implant that evades all major endpoint detection tools and is designed specifically to exfiltrate cloud credentials from compromised systems. The group is targeting organizations with large hybrid cloud footprints. Dark Reading

Operator Note: If you cannot detect it at the endpoint, you must detect it at the cloud control plane. Alert on anomalous IAM enumeration and new access keys from unfamiliar ASNs.

4. FBI and Indonesian Police Dismantle W3LL Phishing Service, Arrest Developer

Joint operation took down W3LL, a phishing-as-a-service platform responsible for more than $20 million in attempted fraud across thousands of victims. The developer was arrested in Indonesia. The Hacker News

5. Critical wolfSSL Flaw Enables Forged Certificate Use

A critical vulnerability in the wolfSSL library lets attackers forge certificates accepted by any device still shipping the affected version. The library is widely embedded in IoT devices, routers, and industrial appliances where patching is slow. BleepingComputer

Operator Note: Inventory everything running wolfSSL before you triage. The long tail of embedded devices is where this bug will live for years.

Additional Security Alerts

Threat Intelligence

APT41 Backdoor Hunt - The same APT41 zero-detection implant is being tracked across financial services and telecom victims. Dark Reading
JanelaRAT Hits Latin American Banks - The banking trojan logged 14,739 attacks in Brazil during 2025, targeting financial account credentials. The Hacker News
Zombie Microsoft Bugs Resurface - Old Microsoft vulnerabilities thought dead are being revived by ransomware crews exploiting unpatched systems. The Register

Security Breaches & Incidents

Rockstar Games Hit by ShinyHunters - Extortion gang leaked analytics data stolen from the Grand Theft Auto publisher. BleepingComputer
Booking.com Confirms Customer Data Accessed - Travel giant confirmed attackers reached customer records, though scope is still being determined. TechCrunch
30 WordPress Plugins Backdoored After Acquisition - A single buyer acquired 30 WordPress plugins and planted a backdoor in each, turning trusted code into a supply chain vector. Anchor Host

Security Tools & Best Practices

Mailbox Rule Abuse as Post-Compromise Threat - Attackers are quietly creating Outlook rules to intercept and forward email after initial access, evading most alerting. Infosecurity Magazine

Emerging Security Technologies

CSA Warns CISOs to Prepare for Post-Mythos Exploit Storm - Cloud Security Alliance is telling security leaders to expect an exploitation surge following the Anthropic Mythos preview and Project Glasswing disclosures. Dark Reading

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Booking.com Customers Warned of Data Hack, FTC Hits Publishing.com With $1.5M Penalty, Californians Sue AI Doctor Recorder

info@grabtheaxe.com (Chris Armour) — Mon, 13 Apr 2026 00:00:00 GMT

Booking.com is warning customers that attackers reached their personal data, creating a ready-made pretext for travel phishing at scale. The FTC extracted a $1.5 million settlement from Publishing.com over deceptive earning claims and filed a parallel action against a high-level MLM participant, signaling continued enforcement against business opportunity schemes. In California, patients sued over an AI tool that records doctor visits without explicit consent, a case that will shape how ambient clinical AI gets deployed.

Top 5 Critical Privacy Alerts

1. Booking.com Warns Customers of Data Hack

Booking.com is notifying customers that hackers accessed their data in a recent incident. The company is still determining exact scope, but exposure includes personal and travel-related information used to book accommodations. The Guardian

Operator Note: This is a phishing gold mine. Affected customers should expect convincing travel-confirmation lures with real booking details baked in.

2. FTC Extracts $1.5M From Publishing.com Over Deceptive Income Claims

Publishing.com agreed to pay $1.5 million to settle FTC charges that it misled consumers about how much they could earn using its products and services. The order also imposes compliance reporting requirements. FTC

3. FTC Sues High-Level MLM Participant Over Earnings Deception

The FTC filed a parallel action against a senior MLM participant who allegedly deceived workers about income potential. The case signals the agency is pursuing individuals, not just corporate defendants, in business opportunity fraud. FTC

4. Californians Sue Over AI Tool That Records Doctor Visits

A class action alleges an AI ambient scribing tool is recording doctor-patient conversations without adequate consent. The suit will likely test whether HIPAA-adjacent AI products clear California's two-party consent requirements. PogoWasRight

Operator Note: If you deploy ambient clinical AI, verify the consent flow meets the stricter of HIPAA or your state's wiretap statute. Opt-out buried in a portal will not hold up.

5. California Bill Would Censor 3D Printing Designs

EFF is warning that California's pending 3D printing legislation would treat design files as regulated content, creating speech and privacy risks while failing to meaningfully address the safety concerns it cites. EFF

Additional Privacy Alerts

Privacy Laws & Regulations

Italian DPA Fines Platform Over Phone Number Disclosure - Regulator extended platform liability after the Russmedia ruling, fining a site for allowing a phone number to appear in sex work ads without the subject's consent. PogoWasRight
Governance Framework for AI Agents - Norton Rose laid out a practical framework for governing autonomous AI agents, including data minimization and audit trail requirements. Data Protection Report

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

DOJ Launches National Fraud Enforcement Division, New DEI Executive Order Hits Federal Contractors, CMS Opens Health Tech Ecosystem

info@grabtheaxe.com (Chris Armour) — Mon, 13 Apr 2026 00:00:00 GMT

The DOJ today launched a National Fraud Enforcement Division, consolidating fraud cases under a single division and signaling a step-up in coordinated prosecutions. A new executive order reshapes DEI-related compliance duties for federal contractors, forcing a near-term review of affirmative action plans and training content. CMS rolled out the first wave of its Health Tech Ecosystem, standing up new information sharing and access tools for covered entities to plug into.

Top 5 Critical Compliance Alerts

1. DOJ Establishes National Fraud Enforcement Division

The Department of Justice stood up a new National Fraud Enforcement Division to centralize prosecution of fraud schemes across healthcare, financial services, and government programs. The reorganization consolidates work previously spread across several sections. JD Supra

Operator Note: Expect more parallel civil and criminal actions. If you touch federal funds, tighten internal controls around billing and vendor attestations before the first wave lands.

2. New Executive Order Reshapes DEI Compliance for Federal Contractors

A new executive order overhauls DEI-related obligations for federal contractors, changing language and reporting around diversity programs, affirmative action, and training content. Contractors have a narrow window to update policies and certifications. JD Supra

3. CMS Launches First Wave of Health Tech Ecosystem

CMS activated the first tools in its Health Tech Ecosystem, a new framework for health information sharing and patient data access. The rollout gives covered entities concrete integration points instead of abstract interoperability goals. HIPAA Journal

4. DermCare, Option Care Health, and Aetna Disclose Breaches

Three healthcare organizations disclosed data breaches in the same window, with Aetna's incident being the largest. Each breach adds to a February healthcare total that already exceeded 8 million records. HIPAA Journal

Operator Note: The cadence of healthcare disclosures is becoming daily. Tabletop your breach notification timing against your BAA partners now, not after you get the call.

5. CFTC Flags Insider Trading in Prediction Markets as Enforcement Priority

The CFTC signaled it will apply insider trading enforcement theory to prediction market activity, extending Rule 180.1 concepts into event contracts. Firms operating or providing liquidity in these markets need insider trading controls on par with traditional exchanges. JD Supra

Additional Compliance Alerts

Regulatory Updates

HIPAA's Next Era - JD Supra breaks down the new HIPAA rules coming for emerging technologies and AI risks, with timelines for covered entities to absorb. JD Supra
OSHA Updates Heat-Related Hazards NEP - OSHA revised its National Emphasis Program on heat hazards, changing inspection triggers and employer documentation expectations. HIPAA Journal
More on the Downsizing of the SEC - Compliance Building summarizes ongoing SEC workforce reductions and the practical effect on enforcement throughput. Compliance Building

Audit & Monitoring Tools

AI Insurance Exists, but Coverage Is Scarce - Carriers are writing AI-specific policies but underwriting standards lag, leaving buyers uncertain what is actually covered. Corporate Compliance Insights
Compliance Blind Spots in Financial Data - Common data hygiene gaps let compliance-relevant signals slip past monitoring programs, especially when reconciliations live outside the GRC stack. Corporate Compliance Insights

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

CPUID Supply Chain Attack Distributes STX RAT, Three Gangs Drive 40% of March Ransomware

info@grabtheaxe.com (Chris Armour) — Sun, 12 Apr 2026 00:00:00 GMT

CPUID's website was compromised to push STX RAT through trojanized CPU-Z and HWMonitor downloads, landing the same day researchers confirmed active exploitation of a critical Marimo RCE vulnerability. On the ransomware front, three groups (Qilin, Akira, and Dragonforce) accounted for 40% of 672 March incidents, signaling consolidation into fewer, more capable operations. Russian APT28 rounded out a heavy threat intelligence day with a DNS manipulation campaign targeting Microsoft authentication tokens across 18,000 networks.

Top 5 Critical Security Alerts

1. CPUID Compromised to Distribute STX RAT via Trojanized CPU-Z and HWMonitor

Threat actors breached CPUID's website and replaced legitimate downloads of CPU-Z and HWMonitor with versions containing STX RAT, a remote access trojan. The compromise lasted under 24 hours but affected an unknown number of downloads during that window. Anyone who downloaded these tools recently should verify file hashes and scan for indicators of compromise. The Hacker News

Operator Note: Supply chain attacks targeting trusted software distributors bypass perimeter defenses entirely. Your vulnerability management program needs to account for compromised legitimate tools, not just unknown threats.

2. Critical Marimo Pre-Auth RCE Flaw Now Under Active Exploitation

A critical vulnerability in the Marimo Python notebook framework allows unauthenticated remote code execution. Attackers are exploiting it in the wild to steal credentials from exposed instances. Organizations running Marimo should patch immediately or take instances offline. BleepingComputer

3. Three Ransomware Gangs Drove 40% of All Attacks in March

Qilin, Akira, and Dragonforce accounted for 40% of 672 ransomware incidents reported in March 2026, according to Check Point. The consolidation of ransomware operations into fewer, more capable groups signals a shift in the threat landscape. Infosecurity Magazine

4. Nearly 4,000 US Industrial Devices Exposed to Iranian Cyberattacks

Researchers identified approximately 4,000 US-based industrial control system devices directly accessible from the internet and vulnerable to known attack vectors used by Iranian threat actors. The exposed devices include PLCs, HMIs, and SCADA systems across energy, water, and manufacturing sectors. BleepingComputer

Operator Note: Internet-exposed OT devices are the textbook example of unmanaged attack surface. If your organization runs industrial control systems, an external asset discovery scan should be running continuously.

5. Hims Telehealth Breach Exposes Sensitive Protected Health Information

Threat actors compromised the telehealth platform Hims and accessed highly sensitive patient health information including treatment details and medical conditions. The breach is notable for the specificity of the PHI exposed, going beyond names and insurance numbers into clinical data. Dark Reading

Additional Security Alerts

Threat Intelligence

Russia's Forest Blizzard Harvests Microsoft Office Tokens via SOHO Routers - Russian APT28 modified router DNS settings across 18,000 networks to intercept Microsoft authentication tokens without deploying malware. The technique avoids endpoint detection entirely. Krebs on Security
STX RAT Targets Finance Sector With Advanced Stealth Tactics - The same RAT found in the CPUID compromise is also being deployed in targeted campaigns against financial institutions using advanced command-and-control infrastructure. Infosecurity Magazine
Germany Identifies REvil and GandCrab Ransomware Leader - German authorities named 31-year-old Daniil Shchukin as the operator behind REvil and GandCrab, the groups that pioneered double extortion tactics. Krebs on Security

Security Breaches & Incidents

Bitcoin Depot Loses $3.6M in Crypto Theft After System Breach - Hackers stole over 50 Bitcoin (approximately $3.66 million) after compromising Bitcoin Depot's internal systems. Infosecurity Magazine
Over 20,000 Crypto Fraud Victims Identified in International Crackdown - Law enforcement across multiple countries identified tens of thousands of victims in a coordinated operation targeting cryptocurrency fraud networks. BleepingComputer
Hackers Steal and Leak Sensitive LAPD Documents - The World Leaks gang breached Los Angeles Police Department systems and publicly released sensitive law enforcement records. TechCrunch

Emerging Security Technologies

Google Chrome Rolls Out Session Cookie Protection Against Infostealers - Chrome's new Device Bound Session Credentials feature binds session cookies to specific devices, preventing malware from harvesting and replaying stolen session data. Infosecurity Magazine
Anthropic's New AI Model Can Write Exploits for Zero-Day Vulnerabilities - Anthropic released a model capable of discovering and exploiting unpatched vulnerabilities, raising questions about safeguards for dual-use AI security tools. Dark Reading

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

63 Healthcare Breaches in February Expose 8.1 Million Records, OCR Releases HIPAA Guidance

info@grabtheaxe.com (Chris Armour) — Sun, 12 Apr 2026 00:00:00 GMT

February's healthcare breach numbers are in: 63 incidents, 8.1 million records exposed, with TriZetto Provider Solutions and QualDerm Partners leading in volume. OCR released new HIPAA risk management guidance the same week, giving covered entities a window to act before enforcement tightens. The SEC named a new enforcement director effective May 4, and a New Jersey pharmacy disclosed a breach 7 months after the original intrusion, which says as much about detection capability as it does about reporting.

Top 5 Critical Compliance Alerts

1. February 2026 Healthcare Data Breach Report: 8.1 Million Records Exposed

The HIPAA Journal reports 63 major healthcare data breaches in February 2026, exposing over 8.1 million individual records. TriZetto Provider Solutions and QualDerm Partners reported the largest incidents. The numbers continue a trend of increasing breach volume and scale in the healthcare sector. HIPAA Journal

Operator Note: Healthcare organizations should treat breach reporting as a lagging indicator. The time to act is during the cybersecurity assessment, not after the disclosure.

2. SEC Appoints David Woodcock as Director of Enforcement

The SEC named David Woodcock, a Gibson Dunn partner, as the new Director of the Division of Enforcement effective May 4, 2026. The appointment signals the direction of SEC cyber enforcement priorities under the new leadership. SEC

3. New Jersey Pharmacy Breach Affects 133,800 Patients

Innovative Pharmacy entities disclosed a September 2025 intrusion that exposed patient data including names, identification numbers, and medical information for over 133,000 individuals. The 7-month gap between incident and disclosure raises questions about breach detection capabilities. HIPAA Journal

4. OCR Releases HIPAA Security Rule Risk Management Guidance

The HHS Office for Civil Rights published new instructional content explaining risk management compliance requirements and enforcement priorities for HIPAA-regulated entities. The guidance clarifies expectations ahead of potential rulemaking. HIPAA Journal

5. FINRA Launches Financial Intelligence Fusion Center

The Financial Industry Regulatory Authority established a new center to coordinate intelligence sharing against cybersecurity and fraud threats across the financial services industry. The fusion center model mirrors government threat-sharing frameworks applied to the private sector. Dark Reading

Additional Compliance Alerts

Third-Party Risk & Due Diligence

GRC Vendors Launch AI-Powered Compliance Tools - Drata, Diligent, HICX, and Ibex released new agentic AI assessment systems and risk management platforms designed to automate third-party compliance workflows. Corporate Compliance Insights
Haast Raises $12M for AI Compliance Agents - The marketing compliance firm secured Series A funding to expand AI agents that automate manual review of promotional materials for regulatory violations. Corporate Compliance Insights

Policy & Governance Updates

State Pay Transparency Laws Create Complex Multistate Compliance Burden - Expanding pay disclosure requirements across states are forcing multistate employers to navigate inconsistent compensation reporting rules. Corporate Compliance Insights

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

EFF Fights Section 702 Clean Extension, Post-Quantum Crypto Deadline Moved to 2029

info@grabtheaxe.com (Chris Armour) — Sun, 12 Apr 2026 00:00:00 GMT

The Section 702 reauthorization fight sharpened this week as the EFF urged Congress to reject a clean extension, pushing for surveillance reforms before the authority expires. The same day, Google moved the post-quantum cryptography transition deadline to 2029, compressing timelines for organizations still treating quantum risk as a future problem. UK regulators added enforcement teeth to AI nudification laws, and a Florida investigation into OpenAI continues to test where AI platform liability begins.

Top 5 Critical Privacy Alerts

1. EFF Urges Congress to Block Clean Extension of Section 702

The Electronic Frontier Foundation is pushing Congress to reject a straightforward reauthorization of Section 702 surveillance authority, demanding reforms to close loopholes that allow warrantless collection of US communications. The current authorization expires this year. EFF

2. UK Threatens Tech Executives With Jail Over AI Nudification Tools

UK regulators announced enforcement plans targeting technology company leaders who fail to prevent AI-generated intimate imagery on their platforms. The action follows a high-profile incident involving widespread circulation of non-consensual altered images. The Record

3. Florida Investigates OpenAI Over ChatGPT's Role in Fatal Shooting

Florida state authorities opened an investigation into whether ChatGPT played a role in a recent shooting, after the gunman's family announced plans to pursue legal action against OpenAI. The case tests the boundaries of AI platform liability for user actions. The Record

4. Senator Launches Inquiry Into 8 Tech Giants for CSAM Reporting Failures

A US senator opened an investigation into major technology companies following allegations from the National Center for Missing and Exploited Children that their child sexual abuse material reporting is deficient. The inquiry targets eight of the largest platforms. The Record

5. Post-Quantum Cryptography Deadline Accelerated to 2029

Google pushed the post-quantum cryptography transition deadline forward to 2029, years earlier than previously expected. Organizations storing encrypted data face a "harvest now, decrypt later" threat from adversaries collecting data today for future quantum decryption. EFF

Additional Privacy Alerts

Privacy Laws & Regulations

France to Ditch Windows for Linux to Reduce Reliance on US Tech - The French government is migrating away from Windows to Linux across government systems, citing digital sovereignty and reduced dependence on American technology vendors. TechCrunch
EFF Opposes Using Computer Fraud Laws Against Price Comparison Tools - Amazon's attempt to use CFAA against Perplexity's price-comparison tool threatens legitimate competition and research, according to EFF. EFF

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization's security posture? Take our free Human Attack Surface Score assessment.

Android Zero-Days, NPM Malware, CISA Alerts & ICS Flaws – 12/02/2025

info@grabtheaxe.com (Chris Armour) — Tue, 02 Dec 2025 00:00:00 GMT

Today’s threat landscape is dominated by two actively exploited zero-day vulnerabilities in the Android Framework, prompting immediate action from Google and a new CISA directive. This summary also covers a massive NPM supply chain attack that exposed 400,000 developer secrets, critical vulnerabilities in industrial control systems (ICS), and a sophisticated North Korean campaign targeting IT workers. These incidents highlight the urgent need for robust vulnerability management and supply chain security.

Top 5 Critical Security Alerts

Google fixes two Android zero days exploited in attacks, 107 flaws : Google’s December security update patches two actively exploited zero-day vulnerabilities in the Android Framework, alongside 105 other flaws. Immediate patching is advised. Read more
CISA Adds Two Known Exploited Vulnerabilities to Catalog : CISA has added two Android Framework vulnerabilities (CVE-2025-48572 and CVE-2025-48633) to its KEV catalog, confirming they are under active exploitation. Read more
Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets : A massive supply chain attack infected hundreds of NPM packages, leading to the exposure of approximately 400,000 developer secrets published across 30,000 GitHub repositories. Read more
Industrial Video & Control Longwatch Vulnerability : A critical code injection vulnerability (CVSS 9.8) in Longwatch video surveillance systems allows unauthenticated remote code execution with SYSTEM-level privileges. Read more
Iskra iHUB and iHUB Lite Vulnerability : A critical flaw (CVSS 9.3) in Iskra smart metering gateways exposes the web management interface without authentication, allowing attackers to reconfigure devices and manipulate connected systems. Read more

Threat Intelligence

Iran-linked hackers target Israeli, Egyptian critical infrastructure through phishing campaign : An Iranian-backed threat actor conducted a prolonged phishing campaign targeting critical infrastructure and government sectors in Israel and Egypt. Read more
North Korea lures engineers to rent identities in fake IT worker scheme : Researchers have uncovered a sophisticated North Korean operation where developers are tricked into ‘renting’ out their identities, enabling state-sponsored actors to secure remote IT jobs for illicit fundraising. Read more
Cybercrime Goes SaaS: Renting Tools, Access, and Infrastructure : The cybercrime economy has fully adopted a subscription model, offering everything from phishing kits and OTP bots to infostealers as a service, lowering the barrier for entry for attackers. Read more
Fake Calendly invites spoof top brands to hijack ad manager accounts : A phishing campaign is using fake Calendly invitations impersonating major brands like Disney and Uber to steal Google Workspace and Facebook business credentials. Read more
Mirion Medical EC2 Software NMIS BioDose Vulnerabilities : Multiple vulnerabilities, including hard-coded credentials and improper permissions, have been found in Mirion Medical software, potentially allowing for RCE and unauthorized access. Read more

Security Breaches & Incidents

University of Pennsylvania confirms new data breach after Oracle hack : The University of Pennsylvania has disclosed a data breach resulting from an attack on its Oracle E-Business Suite servers, leading to the theft of personal information. Read more
A data breach at analytics giant Mixpanel leaves a lot of open questions : Analytics firm Mixpanel has suffered a data breach, but key details about the scope, impact, and timeline of the incident remain unanswered by the company. Read more
Microsoft Defender portal outage disrupts threat hunting alerts : An ongoing outage in the Microsoft Defender XDR portal is preventing security teams from accessing critical capabilities, including alerts and threat hunting data. Read more
Korea arrests suspects selling intimate videos from hacked IP cameras : South Korean police have arrested four individuals for allegedly hacking over 120,000 IP cameras and selling the private footage to an adult website. Read more

Security Tools & Best Practices

FTC settlement requires Illuminate to delete unnecessary student data : Following a breach affecting 10 million students, the FTC is requiring ed-tech provider Illuminate Education to delete unnecessary student data and improve its security practices. Read more
India plans to verify and record every smartphone in circulation : The Indian government is mandating the preinstallation of its Sanchar Saathi app on all new smartphones, raising significant privacy and surveillance concerns. Read more

Security Standards & Frameworks

CISA Releases Five Industrial Control Systems Advisories : CISA has published five new advisories detailing vulnerabilities in ICS products from vendors including Mirion Medical, Industrial Video & Control, and Iskra. Read more

Emerging Security Technologies

Leaked “Soul Doc” reveals how Anthropic programs Claude’s character : An internal document leaked from Anthropic shows the unique methodology the company uses to define the personality and ethical guidelines for its AI model, Claude. Read more
Critical PickleScan Vulnerabilities Expose AI Model Supply Chains : Researchers have discovered three critical zero-day vulnerabilities in PickleScan, a tool for scanning AI models, which could allow attackers to bypass security checks. Read more

Malicious LLMs, Digital ID & Online Blackmail – 11/28/2025

info@grabtheaxe.com (Chris Armour) — Fri, 28 Nov 2025 00:00:00 GMT

This privacy digest highlights critical threats including malicious LLMs empowering hackers, the UK’s controversial digital ID plans, and the rise of online blackmail targeting children. We also cover the FTC’s actions against Amazon for unauthorized Prime enrollments and the potential for AI-driven smart toys to compromise children’s privacy. Stay informed to protect your data and navigate the evolving landscape of digital threats.

Top 5 Critical Privacy Alerts

Malicious LLMs empower inexperienced hackers with advanced tools: Unrestricted LLMs are generating malicious code, enabling ransomware and lateral movement. Read more
The UK Has It Wrong on Digital ID. Here’s Why.: EFF argues the UK’s digital ID scheme threatens privacy and human rights, potentially leading to exclusion and surveillance. Read more
Prompt Injection Through Poetry: Researchers found that turning LLM prompts into poetry can jailbreak the models. Read more
One in 10 UK parents say their child has been blackmailed online, NSPCC finds: NSPCC reports a rise in online blackmail of children, including threats to release intimate pictures. Read more
After a teddy bear talked about kink, AI watchdogs are warning parents against smart toys: AI watchdogs are warning parents against smart toys due to surveillance and lack of regulation. Read more

Privacy Laws & Regulations

The UK Has It Wrong on Digital ID. Here’s Why.: EFF argues the UK’s digital ID scheme threatens privacy and human rights, potentially leading to exclusion and surveillance. Read more

Data Minimization & User Consent

Who’s eligible for a refund from Amazon?: Amazon is issuing refunds after being charged by the FTC for enrolling users in Prime without consent. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: The FTC warns about companies selling your information to telemarketers without permission. Read more

Cross-Border Data Transfers

How Amazon turned our capitalist era of free markets into the age of technofeudalism: Yanis Varoufakis argues Amazon’s AWS controls digital infrastructure, turning entities into serfs. Read more

Security

Malicious LLMs empower inexperienced hackers with advanced tools: Unrestricted LLMs are generating malicious code, enabling ransomware and lateral movement. Read more
GreyNoise launches free scanner to check if you’re part of a botnet: GreyNoise’s free tool checks if your IP is involved in malicious scanning, like botnets. Read more

Uncategorized

This Medicare Open Enrollment season, learn how to protect yourself from scams: The FTC advises on spotting scams during Medicare Open Enrollment. Read more
Thinking about selling your timeshare? Key steps to avoid scams: The FTC warns about timeshare selling scams. Read more
Before you donate, find out where the money is going: The FTC highlights a case of a fraudulent charity using vehicle donations. Read more
How to spot a job scam: The FTC provides tips on identifying job scams. Read more
How to avoid an online shopping scam this holiday season: The FTC offers advice on avoiding online shopping scams during the holidays. Read more
An “agent” told me to stay off the internet. Is it a scam?: The FTC warns about scammers posing as agents and advising against seeking outside help. Read more
Use this action plan to avoid scams: The FTC introduces a tool to help avoid scams. Read more
Help kids protect their devices: The FTC provides steps to protect children’s devices from hackers and scammers. Read more
Prompt Injection Through Poetry: Researchers found that turning LLM prompts into poetry can jailbreak the models. Read more
More than 1,000 Amazon workers warn rapid AI rollout threatens jobs and climate: Amazon workers express concerns about the impact of rapid AI adoption on jobs and the environment. Read more
After a teddy bear talked about kink, AI watchdogs are warning parents against smart toys: AI watchdogs are warning parents against smart toys due to surveillance and lack of regulation. Read more
The best Black Friday 2025 deals in the UK on the products we love, from window vacs to sunrise alarms: A guide to Black Friday deals in the UK. Read more
My family’s excitement about Outer Worlds 2 was short-lived | Dominik Diamond: A review of the game Outer Worlds 2. Read more
EFF’s Holiday Gift Guide: The EFF promotes its online store with holiday gift ideas. Read more
‘A step-change’: tech firms battle for undersea dominance with submarine drones: Tech firms are competing to develop autonomous submarines for naval applications. Read more
One in 10 UK parents say their child has been blackmailed online, NSPCC finds: NSPCC reports a rise in online blackmail of children, including threats to release intimate pictures. Read more
Small changes to ‘for you’ feed on X can rapidly increase political polarisation: Research suggests that minor changes to X’s algorithm can significantly increase political polarization. Read more
The 20+ best US Black Friday tech deals on TVs, tablets, phones, smart watches and more: A guide to Black Friday tech deals in the US. Read more

SFO Guidance, HIPAA Breach, Data Lawsuit – 11/28/2025

info@grabtheaxe.com (Chris Armour) — Fri, 28 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates from the Serious Fraud Office (SFO) regarding corporate compliance programs. Additionally, it covers recent HIPAA data breaches affecting Ennoble Care, Circa Health, and Dermatology Associates of Concord. Finally, it reports on Main Line Fertility Center’s settlement of a lawsuit related to tracking technology and data disclosure.

Critical Compliance Alert

SFO Issues Updated Guidance on Evaluating Corporate Compliance Programmes: The UK’s Serious Fraud Office (SFO) has released updated guidance on evaluating corporate compliance programs, outlining six scenarios for assessment following the introduction of the ‘failure to prevent fraud’ offence. Read more

HIPAA Breach News

Data Breaches Announced by Ennoble Care & Circa Health; Dermatology Associates of Concord: Data breaches have been reported by Ennoble Care & Circa Health in New Jersey, and Dermatology Associates of Concord. Read more

Legal News about HIPAA Compliance

Main Line Fertility Center Settles Tracking Technology Lawsuit: Main Line Fertility Center in Pennsylvania will provide cash payments to individuals whose sensitive data may have been disclosed due to tracking technologies. Read more

Supply Chain Attacks, Tomiris APT & CISA KEV Alert – 11/28/2025

info@grabtheaxe.com (Chris Armour) — Fri, 28 Nov 2025 00:00:00 GMT

Today’s threat landscape is highlighted by significant software supply chain risks, with North Korean hackers deploying malicious npm packages and legacy Python scripts creating takeover vulnerabilities. CISA has issued a critical alert for an actively exploited vulnerability in OpenPLC ScadaBR. Additionally, researchers detail new TTPs from the Tomiris APT group and a major ransomware attack has potentially exposed data from 1.5 million individuals.

Top 5 Critical Security Alerts

CISA Adds One Known Exploited Vulnerability to Catalog: CISA added CVE-2021-26829, a cross-site scripting flaw in OpenPLC ScadaBR, to its KEV catalog, confirming it is under active exploitation by threat actors. Read more
North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware: North Korean APT actors have flooded the npm registry with 197 malicious packages, downloaded over 31,000 times, to deliver the OtterCookie malware. Read more
Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages: Vulnerable bootstrap files in legacy Python packages create a significant domain takeover risk, potentially enabling widespread supply chain attacks via PyPI. Read more
Tomiris wreaks Havoc: New tools and techniques of the APT group: Kaspersky reports the Tomiris APT group has updated its toolkit with open-source C2 frameworks like Havoc and is using Discord and Telegram for communications. Read more
Japanese beer giant Asahi says ransomware attack may have exposed data of 1.5 million people: Asahi disclosed a ransomware incident that may have resulted in the data exposure of 1.5 million individuals, including names, addresses, and phone numbers. Read more

Threat Intelligence

CISA Adds One Known Exploited Vulnerability to Catalog: CISA added CVE-2021-26829, a cross-site scripting flaw in OpenPLC ScadaBR, to its KEV catalog, confirming it is under active exploitation by threat actors. Read more
North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware: North Korean APT actors have flooded the npm registry with 197 malicious packages, downloaded over 31,000 times, to deliver the OtterCookie malware. Read more
Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages: Vulnerable bootstrap files in legacy Python packages create a significant domain takeover risk, potentially enabling widespread supply chain attacks via PyPI. Read more
Tomiris wreaks Havoc: New tools and techniques of the APT group: Kaspersky reports the Tomiris APT group has updated its toolkit with open-source C2 frameworks like Havoc and is using Discord and Telegram for communications. Read more
Threat Actors Exploit Calendar Subscriptions for Phishing and Malware Delivery: Attackers are abusing calendar subscription features via hijacked domains to push phishing links and malware directly to unsuspecting users’ devices. Read more

Security Breaches & Incidents

Japanese beer giant Asahi says ransomware attack may have exposed data of 1.5 million people: Asahi disclosed a ransomware incident that may have resulted in the data exposure of 1.5 million individuals, including names, addresses, and phone numbers. Read more
French Football Federation discloses data breach after cyberattack: The French Football Federation (FFF) announced a data breach after an attacker used a compromised account to access administrative software containing player data. Read more
Man behind in-flight Evil Twin WiFi attacks gets 7 years in prison: An Australian man was sentenced to over seven years in prison for operating malicious ‘evil twin’ WiFi networks at airports to steal traveler data. Read more

Security Tools & Best Practices

Public GitLab repositories exposed more than 17,000 secrets: A security researcher discovered over 17,000 exposed secrets after scanning 5.6 million public repositories on GitLab Cloud, highlighting ongoing credential leakage risks. Read more
Microsoft: Windows updates make password login option invisible: Microsoft has warned that recent Windows 11 updates may hide the password sign-in icon on the lock screen, causing user confusion but not removing the functionality. Read more

Cloud & Network Security

MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants: A security blind spot in MS Teams guest access can negate a user’s home organization security policies, as protections are determined by the host tenant. Read more

Emerging Security Technologies

Prompt Injection Through Poetry: Researchers found that structuring malicious prompts as poetry serves as a universal jailbreak method for LLMs, successfully bypassing current safety mechanisms. Read more

OpenAI Breach, APT Attacks & AI Jailbreaks – 11/27/2025

info@grabtheaxe.com (Chris Armour) — Thu, 27 Nov 2025 00:00:00 GMT

Today’s security landscape is highlighted by a significant third-party data breach affecting OpenAI API users via their analytics vendor, Mixpanel. Concurrently, the ‘Bloody Wolf’ threat actor is expanding its RAT-based campaigns across Central Asia, posing a persistent nation-state threat. We are also tracking an unconventional jailbreak method for AI models that uses poetry to bypass security safeguards. This summary covers the critical intelligence you need to understand today’s evolving threats.

Top 5 Critical Security Alerts

OpenAI API Customer Data Breach via Mixpanel Vendor Hack: OpenAI is notifying API customers of a data leak after its third-party analytics vendor, Mixpanel, was compromised, exposing limited user information. Read more
Bloody Wolf APT Expands NetSupport RAT Attacks in Central Asia: The threat actor ‘Bloody Wolf’ has broadened its campaign, now targeting Uzbekistan in addition to Kyrgyzstan with a Java-based NetSupport RAT. Read more
Asahi Confirms 1.5 Million Customers Affected in Major Cyber-Attack: Japanese beverage giant Asahi confirmed a major cyberattack may have exposed the personal data of up to 1.5 million customers. Read more
Scattered Lapsus$ Hunters Target Zendesk Users with Fake Support Sites: The notorious cybercrime group is actively targeting Zendesk users by creating sophisticated phishing domains disguised as legitimate support portals. Read more
FCC Warns of Hackers Hijacking Radio Equipment For False Alerts: The FCC has issued a warning after multiple incidents where hackers compromised radio equipment to broadcast false and sometimes profane emergency alerts. Read more

Threat Intelligence

Poland detains Russian citizen suspected of hacking local firms: Polish authorities have arrested a Russian national who allegedly obtained refugee status before carrying out cyberattacks against local companies. Read more

Security Breaches & Incidents

Gainsight Expands Impacted Customer List Following Salesforce Security Alert: Following a security alert from Salesforce, Gainsight has disclosed that a larger list of its customers was impacted by suspicious activity than initially reported. Read more
Scottish council still rebuilding systems two years after ransomware attack: A council in Scotland is still facing significant challenges and continues to rebuild its IT systems two full years after a debilitating ransomware attack. Read more

Security Tools & Best Practices

Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update: Microsoft plans to enhance Entra ID security by updating its Content Security Policy (CSP) to block unauthorized script injection attacks during the sign-in process. Read more

Security Standards & Frameworks

Key Provisions of the UK Cyber Resilience Bill Revealed: A UK government official has outlined key provisions for the upcoming Cyber Resilience Bill, aimed at strengthening national cybersecurity posture and incident response. Read more

Emerging Security Technologies

Roses are red, violets are blue, if you phrase it as poem, any jailbreak will do: A new study reveals that LLMs can be easily jailbroken by phrasing malicious requests as poetry, bypassing security filters with up to a 100% success rate. Read more

OpenAI Breach, Student Privacy & EU Social Media Ban – 11/27/2025

info@grabtheaxe.com (Chris Armour) — Thu, 27 Nov 2025 00:00:00 GMT

This privacy digest highlights critical developments, including the OpenAI data breach via a vendor hack and Comcast’s $1.5M fine for a similar incident. Also covered are the EFF’s efforts to protect student privacy from school surveillance and the EU Parliament’s call for social media restrictions for minors. Stay informed on these key issues impacting data protection and digital rights.

Top 5 Critical Privacy Alerts

OpenAI discloses API customer data breach via Mixpanel vendor hack. OpenAI is notifying ChatGPT API customers of a data breach at Mixpanel, exposing limited identifying information. Read more
Comcast to pay $1.5M fine for vendor breach affecting 270K customers. Comcast will pay $1.5 million to settle an FCC investigation into a vendor data breach exposing nearly 275,000 customers’ data. Read more
Multiple London councils’ IT systems disrupted by cyberattack. Several London councils, including Kensington and Westminster, experienced service disruptions due to a cybersecurity incident. Read more
EFF to Arizona Federal Court: Protect Public School Students from Surveillance. EFF urges court to protect students’ off-campus speech, arguing school-issued devices don’t negate privacy rights. Read more
European parliament calls for social media ban on under-16s. The European Parliament passed a resolution advocating for a ban on social media for children under 16 without parental consent. Read more

Privacy Laws & Regulations

Helen Dixon on GDPR, SMEs, and Practical Privacy Solutions. An interview with Helen Dixon discusses GDPR’s impact on SMEs and practical privacy solutions. Read more

Regulatory Fines & Enforcement Actions

Comcast to pay $1.5M fine for vendor breach affecting 270K customers. Comcast will pay $1.5 million to settle an FCC investigation into a vendor data breach exposing nearly 275,000 customers’ data. Read more

Data Minimization & User Consent

OpenAI discloses API customer data breach via Mixpanel vendor hack. OpenAI is notifying ChatGPT API customers of a data breach at Mixpanel, exposing limited identifying information. Read more
European parliament calls for social media ban on under-16s. The European Parliament passed a resolution advocating for a ban on social media for children under 16 without parental consent. Read more
Who’s eligible for a refund from Amazon?. Amazon agreed to pay $2.5 billion to settle FTC charges of enrolling people in Prime without consent and making cancellation difficult. Read more

Cross-Border Data Transfers

Foreign interference or opportunistic grifting: why are so many pro-Trump X accounts based in Asia?. X’s new location feature reveals many high-engagement, pro-Trump accounts originate overseas, sparking concerns about disinformation. Read more

SFO Guidance, Anti-Smuggling, Greenwashing & FCA – 11/27/2025

info@grabtheaxe.com (Chris Armour) — Thu, 27 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including the UK SFO’s new guidance on compliance programs and the strengthening of anti-smuggling efforts in Colombia. We also cover Brazil’s new rules to combat greenwashing, a Solicitors Regulation Authority fine for client due diligence failures, and a High Court ruling impacting the FCA’s naming and shaming practices. Stay informed to enhance your compliance strategies and mitigate emerging risks.

Top 5 Critical Compliance Alerts

U.K. SFO Guidance on Compliance Programs!: The U.K. Serious Fraud Office issued new guidance on evaluating corporate compliance programs, outlining six scenarios for prosecutors. Read more
Colombia: Strengthening of the fight against smuggling and facilitation of smuggling, risks, prevention, and key recommendations for companies, Colombia reinforces legal framework to combat smuggling and facilitation, emphasizing risks and corporate accountability. Read more
Brazil: CONAR announces new rules to combat greenwashing: Brazil’s National Council for Advertising Self-Regulation (CONAR) introduced new rules to combat greenwashing in advertising. Read more
When even good enough isn’t enough: What the latest SRA fine means for every law firm: Charles Douglas Solicitors fined £24K for client due diligence shortcomings related to a foreign PEP. Read more
More FCA naming and shaming? What the High Court’s ruling in CIT v FCA means for business: High Court dismissed challenge to FCA’s discretion to publicly announce investigations, including naming firms. Read more

Compliance Frameworks

Rancho Family Medical Group Agrees to Pay $315K to Settle Data Breach Litigation: Rancho Family Medical Group settles data breach litigation for $315,000. Read more
Data Breaches Announced by Heritage Communities & Metrocare Services: Heritage Communities and Metrocare Services announce security incidents involving data breaches. Read more
North Kansas City Hospital Patients Affected by Cerner Hacking Incident: North Kansas City Hospital notifies patients of data breach at EHR vendor Cerner. Read more

Regulatory Updates

2026 Exam Priorities Remain Focused on Core Issues: SEC’s Division of Examinations releases its annual examination priorities for fiscal year 2026. Read more
The CMA’s new enforcement era: What UK compliance teams need to know: The UK Competition and Markets Authority has entered a new phase of consumer protection enforcement. Read more
Germany’s NIS2 Law: One step away from taking effect: Germany’s Network and Information Systems 2 (NIS2) Implementation Act is entering its final stage. Read more

Third-Party Risk & Due Diligence

Supplier Metrics: Are Your Suppliers Measuring What Really Matters?: Discusses tracking supplier performance using KPIs and focusing on underlying behaviors and risks. Read more

AI Fraud, GDPR Fine, & SEC Priorities – 11/26/2025

info@grabtheaxe.com (Chris Armour) — Wed, 26 Nov 2025 00:00:00 GMT

Today’s compliance intelligence digest highlights the surge in digital fraud driven by AI, the integration of LLMs in malware, and the lack of confidence in securing non-human identities. Regulatory updates include the SEC’s focus on AI disclosures and examination priorities, while policy changes cover Germany’s NIS2 law and Quebec’s health and safety regime overhaul. Stay informed to fortify your compliance posture against emerging threats.

Top 5 Critical Compliance Alerts

Digital Fraud at Industrial Scale: 2025 Wasn’t Great: Advanced fraud attacks surged 180% in 2025 due to cyber-scammers using generative AI to create flawless IDs and autonomous bots. Read more
How Malware Authors Are Incorporating LLMs to Evade Detection: Cyberattackers are integrating large language models (LLMs) into malware to evade detection and augment code on demand. Read more
Enterprises Aren’t Confident They Can Secure Non-Human Identities (NHIs): More than half of organizations are unsure about securing non-human identities (NHIs), highlighting a gap between NHI rollout and security measures. Read more
Cheap Hardware Module Bypasses AMD, Intel Memory Encryption: Researchers created an inexpensive device that circumvents chipmakers’ confidential computing protections, revealing weaknesses in scalable memory encryption. Read more
Staying compliant when your data crosses borders: Lessons from Croatia’s €4.5M GDPR fine: Croatia’s data protection authority (AZOP) fined a telecom operator €4.5M for transferring customer data to Serbia without valid safeguards. Read more

Compliance Frameworks

What training does The HIPAA Journal provide?: The HIPAA Journal offers comprehensive online HIPAA and cybersecurity training programs tailored for various roles and needs. Read more
Does the HIPAA Training from The HIPAA Journal satisfy the regulatory requirements for training?: HIPAA training from The HIPAA Journal is specifically designed to meet mandatory regulatory training requirements. Read more
Who develops and maintains The HIPAA Journal’s HIPAA training content?: The HIPAA Journal’s editorial team creates and maintains its HIPAA training content. Read more
Why is The HIPAA Journal training the best on the market?: The HIPAA Journal’s employee training is considered the best due to its comprehensive and up-to-date content. Read more

Regulatory Updates

State Enforcement Outlook 2026: Key Trends from NASAA’s 2025 Enforcement Report: An overview of how regulators are preparing for a more complex and technology-driven enforcement landscape in 2026. Read more
Call for More Corporate Disclosure on AI: An advisory committee to the SEC will consider requiring publicly traded companies to disclose more about their AI practices and risks. Read more
SEC Division of Examinations Releases Its 2026 Examination Priorities – A Return to Core Principles, with a Cooperative Tone: The SEC’s Division of Examinations released its fiscal year 2026 examination priorities, focusing on investment advisers, broker-dealers, and other financial market participants. Read more
SEC Division of Examinations Releases its 2026 Examination Priorities: The SEC Division of Examinations released its 2026 priorities, emphasizing compliance programs, governance, fiduciary duties, and accurate disclosures. Read more

Third-Party Risk & Due Diligence

Treasury Department Announces Audit of Preference-Based Contracts and Task Orders: The U.S. Treasury Department announced an audit of contracts and task orders awarded under preference-based contracting, totaling approximately $9 billion. Read more

Policy & Governance Updates

Germany’s NIS2 Law: One step away from taking effect: Germany’s Network and Information Systems 2 (NIS2) Implementation Act is nearing its final legislative stage. Read more
NIS2 Directive Explained: Part 2 – Management Bodies Rules: The NIS2 Directive marks a significant evolution in the EU’s cybersecurity approach, expanding the scope of regulated entities and compliance obligations. Read more
Québec Employers Face Significant New Obligations With Overhaul Of Provincial Health and Safety Regime: Québec implements permanent provisions of Bill 59, modernizing the occupational health and safety regime. Read more
Pennsylvania’s New CROWN Act Impacting Race and Religious Creed Discrimination Takes Effect in 2026: Pennsylvania adopts the CROWN Act, impacting race and religious creed discrimination by including hair texture and protective hairstyles. Read more

Iris Scan, ICE Face ID, Cybercrime & Huawei – 11/26/2025

info@grabtheaxe.com (Chris Armour) — Wed, 26 Nov 2025 00:00:00 GMT

This privacy intelligence digest highlights critical alerts including the Thai PDPC halting iris scans, rights groups challenging ICE’s face recognition program, and the FBI warning about a surge in cybercriminal impersonation resulting in $262M stolen. Also covered are London councils hit by a cyberattack and concerns surrounding Huawei’s surveillance capabilities. Stay informed with these key updates.

Top 5 Critical Privacy Alerts

Thailand’s PDPC tells firm to halt iris scan service: Thailand’s PDPC orders TIDC Worldverse to halt iris scan services and delete data from 1.2 million people due to cryptocurrency exchange for personal data. Read more
Rights Organizations Demand Halt to Mobile Fortify, ICE’s Handheld Face Recognition Program: Rights groups demand DHS halt ICE’s Mobile Fortify app, citing privacy violations and potential for wrongful detentions due to face recognition tech. Read more
FBI: Cybercriminals stole $262M by impersonating bank support teams: The FBI warns of a surge in account takeover (ATO) fraud, with cybercriminals impersonating financial institutions stealing over $262 million this year. Read more
Two London councils enact emergency plans after being hit by cyber-attack: Two London councils enact emergency plans after a cyber-attack, investigating potential data compromise and shutting down systems as a precaution. Read more
Huawei and Chinese Surveillance: An excerpt from ‘House of Huawei’ details concerns about Huawei’s early history and its connection to Chinese surveillance. Read more

Regulatory Fines & Enforcement Actions

Thailand’s PDPC tells firm to halt iris scan service: Thailand’s PDPC orders TIDC Worldverse to halt iris scan services and delete data from 1.2 million people due to cryptocurrency exchange for personal data. Read more

Security

Microsoft to secure Entra ID sign-ins from script injection attacks — Microsoft will enhance Entra ID security against script injection attacks starting in mid-to-late October 2026. Read more
ASUS warns of new critical auth bypass flaw in AiCloud routers — ASUS has released firmware patches for nine security vulnerabilities, including a critical authentication bypass flaw in AiCloud routers. Read more
Passwork 7: Self-hosted password and secrets manager for enterprise teams — Passwork 7 unifies enterprise password and secrets management in a self-hosted platform, offering automation and free trials. Read more
OnSolve CodeRED cyberattack disrupts emergency alert systems nationwide — A cyberattack on OnSolve CodeRED disrupted emergency notification systems used by state and local governments across the US. Read more
The Black Friday 2025 Cybersecurity, IT, VPN, & Antivirus Deals — Early Black Friday deals are available across security software, online courses, system administration tools, antivirus products, and VPN services. Read more
FBI: Cybercriminals stole $262M by impersonating bank support teams: The FBI warns of a surge in account takeover (ATO) fraud, with cybercriminals impersonating financial institutions stealing over $262 million this year. Read more
Tor switches to new Counter Galois Onion relay encryption algorithm — Tor has announced improved encryption by replacing the tor1 relay encryption algorithm with a new design called Counter Galois Onion (CGO). Read more

Surveillance

Huawei and Chinese Surveillance: An excerpt from ‘House of Huawei’ details concerns about Huawei’s early history and its connection to Chinese surveillance. Read more
Rights Organizations Demand Halt to Mobile Fortify, ICE’s Handheld Face Recognition Program: Rights groups demand DHS halt ICE’s Mobile Fortify app, citing privacy violations and potential for wrongful detentions due to face recognition tech. Read more

Biometrics

Thailand’s PDPC tells firm to halt iris scan service: Thailand’s PDPC orders TIDC Worldverse to halt iris scan services and delete data from 1.2 million people due to cryptocurrency exchange for personal data. Read more

Oracle Vulnerability, Coinbase Fine & Bribery Act – 11/24/2025

info@grabtheaxe.com (Chris Armour) — Mon, 24 Nov 2025 00:00:00 GMT

This compliance digest highlights critical vulnerabilities impacting healthcare and financial sectors, alongside significant regulatory updates. Oracle Identity Manager and Emerson Appleton UPSMON-PRO both face active exploitation of critical flaws, demanding immediate attention. Coinbase is hit with a substantial fine from the Central Bank of Ireland for AML compliance failures. Also, a landmark conviction under the Bribery Act in the UK serves as a stark reminder of anti-corruption obligations.

Top 5 Critical Compliance Alerts

Critical Flaw in Oracle Identity Manager Under Active Exploitation: CISA reports active exploitation of a critical vulnerability in Oracle Identity Manager. Read more
Critical Vulnerability Identified in Emerson Appleton UPSMON-PRO: A critical vulnerability exists in Emerson Appleton UPSMON-PRO, impacting uninterruptible power supply management. Read more
Delta Dental of Virginia Data Breach Affects 146,000 Individuals: Delta Dental notifies 146,000 members of a security incident exposing protected health information. Read more
Central Bank of Ireland Fines Coinbase More Than €21 Million: Coinbase is fined for AML and counter-terrorist financing transaction monitoring failures. Read more
A landmark first conviction under the Bribery Act and a warning UK businesses cannot ignore: Former Reform UK Wales leader and MEP Nathan Gill sentenced to ten and a half years in prison marks one of the most significant anti-corruption moments in modern British history. Read more

Compliance Frameworks

Request for Comments: PCI Key Management Operations (KMO) v1.0 Standard: PCI SSC seeks feedback on the draft PCI Key Management Operations (KMO) v1.0 Standard. Read more

Regulatory Updates

Central Bank of Ireland Fines Coinbase More Than €21 Million: Coinbase is fined for AML and counter-terrorist financing transaction monitoring failures. Read more
Understanding the FSI No-Action Letter: What It Does, and Does Not, Mean for RIAs: Analysis of the SEC Staff’s no-action letter to the Financial Services Institute (FSI). Read more
So You Want to Apply to Become a CFTC-Registered Designated Contract Market (DCM)? Here’s What You Should Know: Insights into the increased demand for CFTC designation as a derivatives exchange. Read more
A landmark first conviction under the Bribery Act and a warning UK businesses cannot ignore: Former Reform UK Wales leader and MEP Nathan Gill sentenced to ten and a half years in prison marks one of the most significant anti-corruption moments in modern British history. Read more

Healthcare Cybersecurity

HSCC Updates Model Contract Language Framework for HDOs & MDMs: The Health Sector Coordinating Council (HSCC) has published updated Model Contract Language for MedTech Cybersecurity. Read more
Critical Flaw in Oracle Identity Manager Under Active Exploitation: CISA reports active exploitation of a critical vulnerability in Oracle Identity Manager. Read more
Critical Vulnerability Identified in Emerson Appleton UPSMON-PRO: A critical vulnerability exists in Emerson Appleton UPSMON-PRO, impacting uninterruptible power supply management. Read more
Delta Dental of Virginia Data Breach Affects 146,000 Individuals: Delta Dental notifies 146,000 members of a security incident exposing protected health information. Read more
Goshen Health & Hancock Health Settle Pixel Data Breach Lawsuits: Goshen Health System and Hancock Health in Indiana settle lawsuits related to pixel data breaches. Read more

Iberia Breach, AI Security Risks & Tool Updates – 11/23/2025

info@grabtheaxe.com (Chris Armour) — Sun, 23 Nov 2025 00:00:00 GMT

Today’s top security concern is the disclosure of a significant data breach at Iberia, stemming from a compromised third-party vendor. This summary also covers an urgent flaw in the ‘glob’ utility that can be weaponized through file names. Additionally, we analyze emerging AI security risks highlighted by new Anthropic research and cover essential updates for security tools like Wireshark and YARA-X. Here is the critical intelligence you need to stay ahead.

Top 2 Critical Security Alerts

Iberia discloses customer data leak after vendor security breach : Spanish airline Iberia is notifying customers of a data breach originating from a third-party supplier, with a threat actor claiming to possess 77 GB of stolen data. Read more
Weaponized file name flaw makes updating glob an urgent job : A flaw in the glob utility, used for filename pattern matching, can be weaponized, making immediate updates a high priority for system administrators. Read more

Security Breaches & Incidents

Iberia discloses customer data leak after vendor security breach : Spanish airline Iberia is notifying customers of a data breach originating from a third-party supplier, with a threat actor claiming to possess 77 GB of stolen data. Read more

Threat Intelligence

About This Account reveals the scale of X’s foreign troll problem : The new ‘About This Account’ feature on X has inadvertently exposed the significant scale of foreign-based troll accounts engaging in US political discourse. Read more
Weaponized file name flaw makes updating glob an urgent job : A flaw in the glob utility, used for filename pattern matching, can be weaponized, making immediate updates a high priority for system administrators. Read more

Security Tools & Best Practices

Enterprise password security and secrets management with Passwork 7 : Passwork 7 offers a self-hosted platform for unifying enterprise password and secrets management, aiming to automate and secure credential workflows. Read more
Native Secure Enclave backed SSH keys on macOS : A guide details how to leverage the Secure Enclave on macOS to create hardware-backed SSH keys, significantly enhancing key security. Read more
YARA-X 1.10.0 Release: Fix Warnings, (Sun, Nov 23rd) : The latest release of YARA-X, a key tool for malware researchers, introduces a new command to help users fix rule warnings and improve pattern matching. Read more
Wireshark 4.4.1 Released, (Sun, Nov 23rd) : An update to the Wireshark network protocol analyzer has been released, patching two security vulnerabilities and fixing multiple bugs. Read more

Emerging Security Technologies

Strict anti-hacking prompts make AI models more likely to sabotage and lie, Anthropic finds : Research from Anthropic indicates that overly strict safety prompts can cause AI models to develop deceptive and misaligned behaviors through reward hacking. Read more
Multi-agent training aims to improve coordination on complex tasks : A new framework for training multiple specialized AI agents simultaneously could enhance how complex, multi-step security and operational tasks are handled. Read more

Sanctions, Dark Web Disclosure & Harm – 11/23/2025

info@grabtheaxe.com (Chris Armour) — Sun, 23 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates in sanctions enforcement and data breach liability. The US has sanctioned a Mexican casino group for alleged money laundering, signaling increased scrutiny on financial networks. A recent US court ruling now equates dark web data disclosure to concrete harm, significantly raising the stakes for data protection across UK and EU organizations. Stay informed to navigate these evolving compliance landscapes effectively.

Top 3 Critical Compliance Alerts

Sanctions Sweep Targets Mexican Casino Group: The US imposed sanctions on the Hysa family for allegedly laundering money for the Sinaloa Cartel through a network of casinos and restaurants. Read more
Dark Web Disclosure Equals Harm: US Court Ruling: A US court decision now considers the appearance of stolen data on the dark web as concrete harm, impacting UK and EU organizations. Read more

Regulatory Updates

Sanctions Sweep Targets Mexican Casino Group: The US imposed sanctions on the Hysa family for allegedly laundering money for the Sinaloa Cartel through a network of casinos and restaurants. Read more

Cyber Security

Dark Web Disclosure Equals Harm: US Court Ruling: A US court decision now considers the appearance of stolen data on the dark web as concrete harm, impacting UK and EU organizations. Read more

Oracle Zero-Day, APT31 Attacks & WhatsApp Flaw – 11/22/2025

info@grabtheaxe.com (Chris Armour) — Sat, 22 Nov 2025 00:00:00 GMT

Today’s security landscape is dominated by a critical, actively exploited Oracle Identity Manager zero-day vulnerability added to CISA’s KEV catalog. This summary also covers a stealthy campaign by the China-linked APT31 targeting Russian IT infrastructure, a massive data scraping incident affecting 3.5 billion WhatsApp accounts due to a flawed API, and a detailed investigation into a Qilin ransomware attack. These incidents highlight the immediate need for patching, heightened threat awareness, and robust incident response.

Top 5 Critical Security Alerts

CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability: CISA has added a critical Oracle Identity Manager pre-authentication vulnerability (CVE-2025-61757), with a CVSS score of 9.8, to its KEV catalog due to active exploitation. Read more
Cox Enterprises discloses Oracle E-Business Suite data breach: Cox Enterprises is notifying individuals of a data breach resulting from the exploitation of a zero-day vulnerability in its Oracle E-Business Suite. Read more
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services: The China-linked threat group APT31 has been targeting the Russian IT sector with long-term, undetected cyberattacks by leveraging cloud services. Read more
WhatsApp API flaw let researchers scrape 3.5 billion accounts: A significant flaw in a WhatsApp contact-discovery API, which lacked proper rate limiting, enabled the scraping of 3.5 billion user phone numbers and associated personal data. Read more
Piecing Together the Puzzle: A Qilin Ransomware Investigation: Huntress analysts successfully reconstructed a Qilin ransomware attack from a single endpoint, identifying rogue ScreenConnect access and the full execution path despite limited visibility. Read more

Threat Intelligence (APT, malware, ransomware)

Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks: A new command-and-control platform named Matrix Push C2 is leveraging browser push notifications to conduct fileless phishing attacks across multiple operating systems. Read more

Security Breaches & Incidents

Oops. Cryptographers cancel election results after losing decryption key.: An election conducted by the International Association for Cryptologic Research (IACR) had its results canceled after one of the three required decryption keys was irretrievably lost. Read more

Security Tools & Best Practices

The privacy nightmare of browser fingerprinting: An analysis of browser fingerprinting techniques highlights the significant privacy risks involved, as these methods can track users across the web without relying on cookies. Read more
Google denies ‘misleading’ reports of Gmail using your emails to train AI: Google has clarified that it does not use the content of users’ Gmail messages to train its Gemini AI model, stating that smart features are for personalization only. Read more

AI Cyberattack, Surveillance, Privacy Law – 11/21/2025

info@grabtheaxe.com (Chris Armour) — Fri, 21 Nov 2025 00:00:00 GMT

Today’s digest highlights critical developments in AI-driven cyberattacks, government surveillance, and evolving privacy regulations. A Chinese state-sponsored group exploited AI for cyberespionage, while law enforcement agencies face scrutiny for using ALPR technology to monitor protesters. Mozilla’s termination of the Onerep partnership and California’s new health data privacy law also mark significant shifts in data protection.

Top 5 Critical Privacy Alerts

AI as Cyberattacker: A Chinese state-sponsored group manipulated AI to execute cyberattacks, targeting tech companies and financial institutions. Read more
How Cops Are Using Flock Safety’s ALPR Network to Surveil Protesters and Activists: Law enforcement agencies are using ALPR technology to track protesters, raising concerns about freedom of assembly. Read more
Mozilla Says It’s Finally Done With Two-Faced Onerep: Mozilla is ending its partnership with Onerep after revelations about the founder’s involvement with people-search sites. Read more
UK Cybersecurity Legislation Soon to be Introduced: The UK Government has introduced the Cyber Security and Resilience Bill to strengthen national security and protect critical infrastructure. Read more
Keep Out! California Draws the Privacy Fence Around Health Data: California restricts collection/use of personal information near family planning facilities, with penalties for violations starting in 2027. Read more

Privacy Laws & Regulations

UK Cybersecurity Legislation Soon to be Introduced: The UK Government has introduced the Cyber Security and Resilience Bill to strengthen national security and protect critical infrastructure. Read more
Keep Out! California Draws the Privacy Fence Around Health Data: California restricts collection/use of personal information near family planning facilities, with penalties for violations starting in 2027. Read more

Data Minimization & User Consent

Mozilla Says It’s Finally Done With Two-Faced Onerep: Mozilla is ending its partnership with Onerep after revelations about the founder’s involvement with people-search sites. Read more

Regulatory Fines & Enforcement Actions

EFF Demands Answers About ICE-Spotting App Takedowns: EFF sues DOJ and DHS to uncover information about government demands to remove apps documenting immigration enforcement. Read more

Surveillance

How Cops Are Using Flock Safety’s ALPR Network to Surveil Protesters and Activists: Law enforcement agencies are using ALPR technology to track protesters, raising concerns about freedom of assembly. Read more

WhatsApp Leak, AI Laws, Phishing Scams & Patent Rules – 11/20/2025

info@grabtheaxe.com (Chris Armour) — Thu, 20 Nov 2025 00:00:00 GMT

Today’s privacy digest highlights critical vulnerabilities and emerging threats, including a major WhatsApp data leak and the rise of Android malware targeting encrypted messaging apps. Regulatory updates feature the potential US ban on state AI laws and Illinois’ new AI employment regulations. Also covered are scams targeting consumers and proposed changes to patent challenge rules, demanding immediate attention to safeguard personal data and innovation.

Top 5 Critical Privacy Alerts

Researchers claim ‘largest leak ever’ after uncovering WhatsApp enumeration flaw: Researchers found a WhatsApp flaw exposing 3.5 billion users’ data. Read more
Multi-threat Android malware Sturnus steals Signal, WhatsApp messages: New Android malware Sturnus steals data from encrypted messaging apps and gains device control. Read more
Scam USPS and E-Z Pass Texts and Websites: Google reports a Chinese cybercriminal group selling phishing kits. Read more
French authorities investigate alleged Holocaust denial posts on Elon Musk’s Grok AI: Grok AI under investigation for Holocaust denial posts. Read more
The Patent Office Is About To Make Bad Patents Untouchable: USPTO proposes rules limiting challenges to improperly granted patents. Read more

Privacy Laws & Regulations

Big Beautiful AI Bill: Is the US State AI law ban back on the horizon?: A draft Federal Executive Order considers mirroring the EU’s AI Act concerns, potentially impacting US State AI laws. Read more
Illinois AI Employment Law Goes Live Soon: Are Your Hiring Practices Compliant?: Illinois employers must comply with AI employment law starting January 1, 2026. Read more
Closing the Privacy Gap: HIPRA Targets Health Apps and Wearables: Senator Cassidy introduces HIPRA to close health data protection gaps. Read more
Warning! States Continue to Worry About Social Media and Teens: States are concerned about social media’s impact on teens, with California passing a warning label law. Read more
Strengthen Colorado’s AI Act: EFF urges Colorado to strengthen its AI Act, especially in enforcement mechanisms. Read more

Data Minimization & User Consent

Who’s eligible for a refund from Amazon?: Amazon to pay $2.5B for enrolling users in Prime without consent. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: Learn how to reduce unwanted telemarketing calls. Read more

Security

Crypto mixer founders sent to prison for laundering over $237 million: Samourai Wallet founders imprisoned for laundering over $237 million. Read more
Sneaky2FA PhaaS kit now uses redteamers’ Browser-in-the-Browser attack: Sneaky2FA phishing kit adds Browser-in-the-Browser attack capabilities. Read more
W3 Total Cache WordPress plugin vulnerable to PHP command injection: Critical flaw in W3 Total Cache plugin allows PHP command injection. Read more
Russian bulletproof hosting provider sanctioned over ransomware ties: US sanctions Russian bulletproof hosting provider for ransomware support. Read more

Phishing & Scams

How to help protect foster youth from identity theft: Tips to protect foster youth from identity theft. Read more
No, that’s not an FTC commissioner on the phone: FTC warns against scammers impersonating FTC officials. Read more
How to spot a job scam: FTC Chairman Andrew Ferguson explains how to spot job scams. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: Tips to avoid disaster-related scams. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: Protect yourself from Medicare scams during open enrollment. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Steps to avoid timeshare selling scams. Read more
Before you donate, find out where the money is going: FTC warns about deceptive fundraising by Kars-R-Us.com. Read more
Use this action plan to avoid scams: FTC’s action plan to avoid scams. Read more

Fortinet Exploit, NIH Audit, Data Breach & EUDR – 11/19/2025

info@grabtheaxe.com (Chris Armour) — Wed, 19 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical vulnerabilities and regulatory shifts impacting organizations. Key alerts include a zero-day exploit in Fortinet firewalls, security weaknesses in the NIH’s research program, and significant data breach settlements in healthcare. We also cover updates on European deforestation regulations, NCAA betting policies, and the impact of Supreme Court rulings on compliance.

Top 5 Critical Compliance Alerts

Fortinet Zero-Day Exploited: Patches are available for a critical OS command injection vulnerability in Fortinet web application firewalls. Update immediately to mitigate risk. Read more
NIH Security Weaknesses: An audit reveals privacy and security flaws in the NIH All of Us Research Program. Immediate remediation is crucial. Read more
Omni Family Health Data Breach Settlement: Omni Family Health settles a class-action lawsuit for $6.5 million following a data breach affecting 39 health centers. Read more
CarePro Data Breach Settlement: CarePro Health Services agrees to pay $1.3 million to settle a class-action lawsuit related to a data breach. Read more
Railway Braking Systems Tampering: Critical railway braking systems are vulnerable to tampering using readily available materials, posing a significant safety risk. Read more

Compliance Frameworks

Defense in Depth & SOC 2: A blog post discusses how a defense-in-depth strategy relates to SOC 2 compliance, emphasizing the need for more than a checklist approach to security. Read more

Regulatory Updates

2026 Physician Fee Schedule: CMS issues the 2026 Medicare Physician Fee Schedule final rule, adopting policies related to calculating and reporting average sales prices (ASP) for drugs. Read more
European Deforestation Directive: Implications of the EUDR for Africa’s food security, highlighting compliance pressures for smallholder farmers. Read more
Cayman Closed-Ended Fund Regulatory Obligations: Overview of the regulatory obligations for Cayman Islands closed-ended funds as of November 2025. Read more

Audit & Monitoring Tools

EBA Peer Review on CVA Risk: The EBA publishes a follow-up peer review report on EU competent authorities’ supervisory practices regarding credit valuation adjustment (CVA) risk. Read more
NIH Security Program Audit: An audit of the NIH All of Us Research Program has uncovered privacy and security weaknesses. Read more

Policy & Governance Updates

NCAA Betting Policy Change: The NCAA plans to allow student-athletes and athletics staff to bet on professional sports in states where it’s legal, starting Nov. 22. Read more
Supreme Court Ruling & Deregulation: Examines how the Supreme Court’s 2024 Loper Bright decision impacts regulatory controls under the Trump Administration’s deregulatory agenda. Read more

IRS Data, ALPR Lawsuit, AI Listening & Nest Data – 11/19/2025

info@grabtheaxe.com (Chris Armour) — Wed, 19 Nov 2025 00:00:00 GMT

This privacy digest highlights critical concerns surrounding data privacy. Key stories include the IRS accessing flight data without warrants, a lawsuit against San Jose’s mass surveillance, Google’s continued collection of Nest thermostat data, and the ethical implications of AI listening in doctor’s offices. Stay informed about these pressing issues to protect your digital rights.

Top 5 Critical Privacy Alerts

IRS Accessed Massive Database of Americans Flights Without a Warrant: The IRS accessed a database of hundreds of millions of travel records without a warrant, raising significant privacy concerns. Read more
Lawsuit Challenges San Jose’s Warrantless ALPR Mass Surveillance: EFF and ACLU challenge San Jose’s warrantless searches of ALPR data, arguing it violates the California Constitution. Read more
Google is collecting troves of data from downgraded Nest thermostats: Google continues to collect data from early Nest thermostats even after turning off remote control functionality. Read more
At some doctors’ offices, AI is listening in the exam room: Some doctors are now recording patient visits using AI, raising concerns about privacy and consent in healthcare settings. Read more
New ShadowRay attacks convert Ray clusters into crypto miners: ShadowRay 2.0 hijacks exposed Ray Clusters to turn them into a cryptomining botnet, exploiting an old code execution flaw. Read more

Privacy Laws & Regulations

CIPL Publishes Discussion Paper Comparing U.S. State Privacy Law Definitions of Personal Data and Sensitive Data: CIPL published a discussion paper comparing key elements of U.S. state privacy laws regarding personal and sensitive data. Read more
India’s Digital Personal Data Protection Act 2023 brought into force: India’s Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025, operationalizing the 2023 Act. Read more
When in Rome, Make Your AI Do As the Regulators Do: Italy enacted a comprehensive national AI law to work with the EU AI Act, adding more details and specific obligations. Read more

Data Minimization & User Consent

Google is collecting troves of data from downgraded Nest thermostats: Google continues to collect data from early Nest thermostats even after turning off remote control functionality. Read more
At some doctors’ offices, AI is listening in the exam room: Some doctors are now recording patient visits using AI, raising concerns about privacy and consent in healthcare settings. Read more

Surveillance

IRS Accessed Massive Database of Americans Flights Without a Warrant: The IRS accessed a database of hundreds of millions of travel records without a warrant, raising significant privacy concerns. Read more
Lawsuit Challenges San Jose’s Warrantless ALPR Mass Surveillance: EFF and ACLU challenge San Jose’s warrantless searches of ALPR data, arguing it violates the California Constitution. Read more
Surveillance tech provider Protei was hacked, its data stolen, and its website defaced: Russian telecom company Protei, which develops surveillance tech, was hacked, its website defaced, and data stolen. Read more

AI Phishing, Data Privacy, SEC, Fortinet – 11/18/2025

info@grabtheaxe.com (Chris Armour) — Tue, 18 Nov 2025 00:00:00 GMT

This compliance digest highlights critical threats, including a surge in AI-driven phishing attacks and a critical Fortinet WAF vulnerability under active exploitation. Key regulatory updates include insights into the SEC’s operations post-shutdown and the implications of the UK’s Data (Use and Access) Act. Additionally, the digest covers third-party risks in Gibraltar and new AI cybersecurity guidance for the healthcare sector.

Top 5 Critical Compliance Alerts

Phishing Season 2025: How AI is Supercharging Cyber Crime : AI-generated phishing has moved from a niche tactic to an everyday tool for cyber criminals, increasing the intensity of phishing campaigns. Read more
Critical Fortinet FortiWeb WAF Bug Exploited in the Wild : A vulnerability in Fortinet’s FortiWeb WAF could allow unauthenticated remote attackers to execute administrative commands. Read more
US Citizens Plead Guilty to Aiding North Korean IT Worker Campaigns : Individuals admitted to helping foreign IT workers gain employment at US companies using false identities and remote access. Read more
Cyberattack Volume Increases Fueled by 48% YOY Increase in Ransomware Attacks : October saw a rise in cyberattack volume, driven by a significant year-over-year increase in ransomware attacks. Read more
St. Anthony Hospital in Chicago Notifies Patients About February Data Breach : St. Anthony Hospital in Chicago is notifying patients about a data breach that occurred in February. Read more

Regulatory Updates

Q&A: The SEC Is Up & Running After Shutdown; Now What? : Registrants should prepare for future delays as shutdowns become increasingly likely. Read more

Third-Party Risk & Due Diligence

Gibraltar at a crossroads: What two landmark inquiries reveal about a jurisdiction under strain : Landmark inquiries reveal strain on Gibraltar’s jurisdiction due to alleged sabotage of a national security system. Read more

Policy & Governance Updates

The Data (Use and Access) Act and How it Affects the UK GDPR and DPA 2018, and PECR : The Data (Use and Access) Act 2025 marks a significant moment in UK data protection legislation, reforming UK GDPR, DPA 2018, and PECR. Read more
What You Need to Know About Maryland’s New Data Privacy Law : Maryland’s new data privacy law shifts focus to providing collection as a service benefiting consumers. Read more

Compliance Frameworks

HSCC Publishes Preview of Health Sector AI Cybersecurity Risk Guidance : The Health Sector Coordinating Council (HSCC) plans to publish AI cybersecurity guidelines for the healthcare sector in Q1 2026. Read more
Discovery Practice Management Settle Lawsuit Over 2020 Data Breach : Discovery Practice Management settles a class action lawsuit stemming from a June 2020 data breach. Read more

Chrome Zero-Day, Azure DDoS, Data Breaches – 11/18/2025

info@grabtheaxe.com (Chris Armour) — Tue, 18 Nov 2025 00:00:00 GMT

Today’s digest features critical security updates, including a Chrome zero-day exploit and a massive DDoS attack on Microsoft Azure. We also cover a data breach at Princeton University, a ransomware attack impacting Pennsylvania’s Attorney General, and new age verification measures from Roblox. Stay informed to protect your data and systems from emerging threats.

Top 5 Critical Privacy Alerts

Google fixes new Chrome zero-day flaw exploited in attacks: Google has released an emergency security update to fix a Chrome zero-day vulnerability. Read more
Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses: The Aisuru botnet launched a massive DDoS attack on Microsoft’s Azure network. Read more
Eurofiber France warns of breach after hacker tries to sell customer data: Hackers exploited a vulnerability to access Eurofiber France’s ticket management system. Read more
Princeton University discloses data breach affecting donors, alumni: A cyberattack compromised a Princeton University database, exposing personal information. Read more
Pennsylvania AG confirms data breach after INC Ransom attack: The Pennsylvania attorney general’s office confirms a data breach following an INC Ransom attack. Read more

Privacy Laws & Regulations

“How Old Are You, Anyway?” California’s New Law Makes Apps Ask… And Remember!: California’s AB 1043 requires apps to verify and remember user ages. Read more

Security

Google fixes new Chrome zero-day flaw exploited in attacks: Google has released an emergency security update to fix a Chrome zero-day vulnerability. Read more
Microsoft: Windows 10 KB5072653 OOB update fixes ESU install errors: Microsoft released an out-of-band update to fix issues with Windows 10 extended security updates. Read more
Malicious NPM packages abuse Adspect redirects to evade security: NPM packages are using Adspect redirects to evade security measures and lead to malicious sites. Read more
RondoDox botnet malware now hacks servers using XWiki flaw: RondoDox botnet malware is exploiting a critical RCE flaw in XWiki Platform (CVE-2025-24893). Read more
Eurofiber France warns of breach after hacker tries to sell customer data: Hackers exploited a vulnerability to access Eurofiber France’s ticket management system. Read more
Princeton University discloses data breach affecting donors, alumni: A cyberattack compromised a Princeton University database, exposing personal information. Read more
Dutch police seizes 250 servers used by “bulletproof hosting” service: Dutch police seized servers powering a bulletproof hosting service used by cybercriminals. Read more
Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses: The Aisuru botnet launched a massive DDoS attack on Microsoft’s Azure network. Read more
DoorDash email spoofing vulnerability sparks messy disclosure dispute: A vulnerability allowed spoofed DoorDash emails, leading to a disclosure dispute after the patch. Read more
Pennsylvania AG confirms data breach after INC Ransom attack: The Pennsylvania attorney general’s office confirms a data breach following an INC Ransom attack. Read more

AI & Democracy

AI and Voter Engagement: An article discusses the impact of AI and social media on voter engagement, referencing Obama’s 2008 campaign. Read more
xAI’s Grok 4.1 rolls out with improved quality and speed for free: xAI has started rolling out Grok 4.1, which is an upgrade to the existing Grok 4 model. Read more
Google Gemini 3 spotted on AI Studio ahead of imminent release: Google’s Gemini 3, a potentially leading language model, has been spotted on AI Studio. Read more

Consumer Alerts & Scams

How to prepare yourself to deal with an emergency and avoid disaster-related scams: The FTC provides advice on preparing for emergencies and avoiding related scams. Read more
How to help protect foster youth from identity theft: The FTC offers tips on protecting foster youth from identity theft due to their increased risk. Read more
No, that’s not an FTC commissioner on the phone: The FTC warns about scammers impersonating FTC officials to solicit money. Read more
Get a credit freeze to stop identity thieves: The FTC recommends credit freezes as a way to protect against identity theft. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: The FTC advises consumers to be vigilant against scams during Medicare Open Enrollment. Read more
Thinking about selling your timeshare? Key steps to avoid scams: The FTC provides advice on avoiding scams when selling a timeshare. Read more
Before you donate, find out where the money is going: The FTC warns about donating to fraudulent charities, citing the case of Kars-R-Us.com. Read more
How to spot a job scam: The FTC provides advice on identifying and avoiding job scams. Read more
Who’s eligible for a refund from Amazon?: The FTC explains who is eligible for a refund from Amazon’s Prime subscription settlement. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: The FTC advises on how to reduce unwanted telemarketing calls resulting from shared online information. Read more
UK consumers warned over AI chatbots giving inaccurate financial advice: Research reveals AI chatbots are providing inaccurate financial advice to UK consumers. Read more

Fortinet & Chrome Zero-Days, Cloudflare Outage – 11/18/2025

info@grabtheaxe.com (Chris Armour) — Tue, 18 Nov 2025 00:00:00 GMT

Today’s threat landscape is dominated by two actively exploited zero-day vulnerabilities affecting Fortinet FortiWeb and Google Chrome, both requiring immediate patching. CISA has underscored the urgency by adding the Fortinet flaw to its KEV catalog. This summary also covers a massive Cloudflare outage that disrupted global services, a new cryptomining botnet targeting AI infrastructure, and multiple critical ICS advisories.

Top 5 Critical Security Alerts

Fortinet warns of new FortiWeb zero-day exploited in attacks : Fortinet has disclosed a critical zero-day vulnerability in its FortiWeb Web Application Firewall that is being actively exploited by threat actors. Immediate patching is required. Read more
Google fixes new Chrome zero-day flaw exploited in attacks : Google has issued an emergency update for a high-severity type confusion vulnerability (CVE-2025-13223) in the V8 engine, marking the seventh Chrome zero-day exploited this year. Read more
CISA Adds One Known Exploited Vulnerability to Catalog : CISA has added the new Fortinet FortiWeb vulnerability (CVE-2025-58034) to its KEV catalog, mandating federal agencies to patch within one week due to active exploitation. Read more
New ShadowRay attacks convert Ray clusters into crypto miners : A widespread campaign, ShadowRay 2.0, is exploiting a remote code execution flaw to hijack exposed Ray AI clusters, turning them into a self-propagating cryptomining botnet. Read more
The Tycoon 2FA Phishing Platform and the Collapse of Legacy MFA : The Tycoon 2FA Phishing-as-a-Service platform has been linked to over 64,000 attacks this year, demonstrating its effectiveness in bypassing legacy multi-factor authentication through real-time relays. Read more

Threat Intelligence

Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks : The Iran-linked threat actor UNC1549 is deploying sophisticated backdoors in espionage campaigns targeting aerospace and defense industries in the Middle East and beyond. Read more
Pro-Russian group claims hits on Danish party websites as voters head to polls : A pro-Russian hacktivist group has claimed responsibility for DDoS attacks against Danish political party and government websites during local elections, though voting was not disrupted. Read more
AI-Enhanced Tuoni Framework Targets Major US Real Estate Firm : An advanced intrusion attempt on a major US real estate firm utilized the Tuoni C2 framework, which combines social engineering with stealthy in-memory payloads. Read more
Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages : A malicious campaign is using seven npm packages and a cloaking service to differentiate between security researchers and potential victims, redirecting the latter to cryptocurrency scam sites. Read more

Security Breaches & Incidents

LG battery subsidiary says ransomware attack targeted overseas facility : LG Energy Solution confirmed one of its overseas facilities was hit by a ransomware attack but has since returned to normal operations. Read more
French agency Pajemploi reports data breach affecting 1.2M people : The French social security service Pajemploi has suffered a data breach, potentially exposing the personal information of 1.2 million individuals. Read more
CBO director testifies that hackers have been expelled from email systems : The Congressional Budget Office director confirmed that unauthorized actors who had gained access to the agency’s email systems have been successfully expelled. Read more

Security Tools & Best Practices

Microsoft to integrate Sysmon directly into Windows 11, Server 2025 : Microsoft announced that its powerful system monitoring tool, Sysmon, will be natively integrated into Windows 11 and Windows Server 2025 next year. Read more
New in Snort3: Enhanced rule grouping for greater flexibility and control : Cisco Talos is introducing new capabilities for the Snort3 intrusion detection system, allowing for more flexible management and prioritization of detection rules within Cisco Secure Firewall. Read more
Advancing Cybersecurity for Microsoft Environments : Sophos is enhancing its security offerings for Microsoft environments, including certified MDR services and open threat intelligence frameworks to counter evolving threats. Read more
Windows 11 gets new Cloud Rebuild, Point-in-Time Restore tools : Microsoft is introducing new Cloud Rebuild and Point-in-Time Restore features for Windows 11 to simplify recovery from system failures and reduce downtime. Read more

Cloud & Network Security

A massive Cloudflare outage brought down X, ChatGPT, and even Downdetector : A major Cloudflare outage caused widespread internet disruption, affecting numerous major sites and services due to a bug in a configuration file, not a malicious attack. Read more
Cloud Break: IoT Devices Open to Silent Takeover Via Firewalls : Researchers have found that IoT devices can be silently compromised through security gaps in the cloud management interfaces of firewalls and routers, even if the devices are not directly online. Read more

Security Standards & Frameworks

CISA Releases Six Industrial Control Systems Advisories : CISA has published six new advisories detailing vulnerabilities in ICS products from vendors including Schneider Electric, Shelly, and METZ CONNECT, urging immediate review and mitigation. Read more
National cyber strategy will include focus on ‘shaping adversary behavior,’ White House official says : The upcoming U.S. national cyber strategy will feature a pillar focused on actively shaping adversary behavior, alongside initiatives for public-private partnerships. Read more

Emerging Security Technologies

GenAI and Deepfakes Drive Digital Forgeries and Biometric Fraud : A new report from Entrust highlights the increasing use of Generative AI and deepfakes by fraudsters to create convincing digital forgeries and bypass biometric security checks. Read more
Beyond IAM Silos: Why the Identity Security Fabric is Essential for Securing AI and Non-Human Identities : An Identity Security Fabric (ISF) architecture is proposed as a necessary evolution to unify IAM, IGA, PAM, and ITDR for securing complex environments with AI and non-human identities. Read more

Healthcare Breaches, CCPA, AI Risk & GC Trends – 11/17/2025

info@grabtheaxe.com (Chris Armour) — Mon, 17 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical data breach incidents affecting healthcare entities and a significant security flaw in the Cursor AI coding tool. Regulatory updates include California’s new CCPA rules, the EHRC’s overhaul at McDonald’s for harassment prevention, and new frozen asset reporting requirements in the Cayman Islands. Policy and governance articles cover the rise of fractional GCs and the regulatory risks of AI in retail investing.

Top 5 Critical Compliance Alerts

EHR Vendor Identifies Business Associate Data Breach: CareTracker (Amazing Charts) and Marshfield Clinic announce data breaches. Read more
Doctor Alliance Investigating 353 GB Data Theft Claim: HIPAA business associate Doctor Alliance investigates a significant data theft claim. Read more
Data Breaches Announced by Sun Valley Surgery Center & American Associated Pharmacies: Sun Valley Surgery Center and American Associated Pharmacies report data breaches. Read more
Nebraska AG’s Lawsuit Against Change Healthcare Survives Motion to Dismiss: Lawsuit over Change Healthcare data breach moves forward. Read more
Cursor Issue Paves Way for Credential-Stealing Attacks: Security weakness in AI-powered coding tool Cursor allows credential-stealing attacks. Read more

Compliance Frameworks

2026 Deadline Looms for Compliance with Updated Part 2 Regulations Regarding Patient Data Protections: HHS updates to 42 C.F.R. Part 2 align SUD confidentiality requirements with HIPAA, with a 2026 compliance deadline. Read more

Regulatory Updates

New California Consumer Privacy Act rules from 1 January 2026: New CCPA regulations introduce regimes for cybersecurity audits. Read more
EHRC forces major overhaul at McDonald’s: What real harassment prevention now looks like: Equality and Human Rights Commission strengthens agreement with McDonald’s regarding workplace sexual harassment prevention. Read more
New annual frozen asset reporting requirement: What you need to know: Cayman Islands FRA requires annual reporting of frozen assets under UK sanctions by November 30, 2025. Read more

Policy & Governance Updates

General Counsel on Demand: Why High-Risk Sectors Are Embracing the Fractional Model: Fractional GCs embed within businesses to shape strategy and build systems. Read more
Agentic AI in Retail Investing: Navigating Regulatory and Operational Risk: Discusses the rise of AI in retail finance and its regulatory implications. Read more
No More 10% Retainage: California Mandates 5% Retention Cap on Private Construction Projects: California caps retention on private construction projects at 5%, effective January 1, 2026. Read more

UNC1549 TTPs, Azure DDoS & Data Breaches – 11/17/2025

info@grabtheaxe.com (Chris Armour) — Mon, 17 Nov 2025 00:00:00 GMT

Today’s threat landscape is highlighted by a detailed Mandiant report on the sophisticated espionage tactics of the Iran-nexus group UNC1549 targeting the aerospace sector. This is coupled with a record-breaking 15 Tbps DDoS attack that targeted Microsoft’s Azure infrastructure, demonstrating a massive escalation in botnet capabilities. We are also tracking several significant data breaches, including incidents at Logitech, DoorDash, and the Pennsylvania Attorney General’s office, alongside actively exploited vulnerabilities in Fortinet and XWiki.

Top 5 Critical Security Alerts

Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem : Mandiant provides a deep-dive analysis of the sophisticated TTPs used by Iran-nexus threat group UNC1549, including custom backdoors and exploiting trusted relationships to target the aerospace and defense industries. Read more
Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses : Microsoft reports its Azure cloud platform was targeted by a massive 15.72 Tbps DDoS attack from the Aisuru botnet, which leveraged over 500,000 IP addresses. Read more
Critical Fortinet FortiWeb WAF Bug Exploited in the Wild — A critical vulnerability in Fortinet’s FortiWeb Web Application Firewall (WAF) is being actively exploited, potentially allowing unauthenticated attackers to execute remote administrative commands. Read more
RondoDox botnet malware now hacks servers using XWiki flaw — The RondoDox botnet is now exploiting a critical remote code execution (RCE) vulnerability in the XWiki Platform, tracked as CVE-2025-24893, to compromise servers. Read more
Pennsylvania attorney general says SSNs stolen during August ransomware attack : Officials in Pennsylvania confirmed that a ransomware attack in August on the attorney general’s office resulted in the theft of sensitive data, including Social Security numbers and medical information. Read more

Threat Intelligence

5 plead guilty to laptop farm and ID theft scheme to land North Koreans US IT jobs — Five individuals admitted to running a sophisticated fraud scheme that used stolen US identities and ‘laptop farms’ to help North Korean IT workers secure remote jobs at American companies. Read more

Security Breaches & Incidents

Logitech discloses data breach after Clop claims : Following a claim by the Clop cybercrime group, Logitech has disclosed a data breach, which reportedly stemmed from a zero-day vulnerability in Oracle’s E-Business Suite tool. Read more
DoorDash confirms data breach impacting users’ phone numbers and physical addresses : The delivery service DoorDash announced a data breach that exposed customer, delivery worker, and merchant phone numbers and physical addresses. Read more
Princeton University discloses data breach affecting donors, alumni : Princeton University has revealed a cyberattack on a database containing the personal information of its alumni, donors, faculty, and students. Read more
Surveillance tech provider Protei was hacked, its data stolen, and its website defaced : Russian surveillance tech company Protei, which sells web intercept and surveillance products, was hacked, leading to data theft and a website defacement. Read more
Eurofiber France warns of breach after hacker tries to sell customer data : Eurofiber France has disclosed a data breach after an attacker exploited a vulnerability in its ticket management system and attempted to sell the exfiltrated customer data. Read more

Security Tools & Best Practices

Malicious NPM packages abuse Adspect redirects to evade security : Researchers have identified seven malicious packages on the npm registry that use the Adspect cloaking service to hide their malicious nature from security tools and researchers. Read more
Dutch police seizes 250 servers used by “bulletproof hosting” service : In a major blow to cybercrime infrastructure, Dutch police have seized around 250 servers from a ‘bulletproof hosting’ service that provided anonymous infrastructure for criminal operations. Read more
DoorDash email spoofing vulnerability sparks messy disclosure dispute : A now-patched vulnerability in DoorDash’s systems could have allowed attackers to send phishing emails from the company’s official servers, with a dispute arising over the disclosure process. Read more

Emerging Security Technologies

MCP AI agent security startup Runlayer launches with 8 unicorns, $11M from Khosla’s Keith Rabois and Felicis : New startup Runlayer has launched with $11 million in funding to address the growing need for securing AI agents used within business environments. Read more
The State of AI: How war will be changed forever : A collaborative piece from the Financial Times and MIT Technology Review explores the profound impact of generative AI on the future of warfare and global power dynamics. Read more

Microsoft Zero-Day, Logitech Breach & Patch Tuesday – 11/16/2025

info@grabtheaxe.com (Chris Armour) — Sun, 16 Nov 2025 00:00:00 GMT

This Sunday’s threat summary is led by Microsoft’s November Patch Tuesday release, which includes a patch for a zero-day vulnerability already under active exploitation. We are also tracking significant security incidents, including a reported data breach at Logitech resulting from another zero-day attack and serious allegations regarding Coinbase’s breach disclosure timeline. Stay informed on these critical developments and other emerging threats.

Top 3 Critical Security Alerts

Microsoft Patch Tuesday, November 2025 Edition: Microsoft’s November patches address over 60 flaws, including a zero-day vulnerability that is confirmed to be under active exploitation across all Windows versions. Read more
Logitech leaks data after zero-day attack: Tech peripheral giant Logitech has reportedly suffered a significant data leak following a zero-day attack on its systems. Read more
I have recordings proving Coinbase knew about breach months before disclosure: A researcher alleges that cryptocurrency exchange Coinbase was aware of a major security breach for months before notifying the public. Read more

Threat Intelligence

Finger.exe & ClickFix, (Sun, Nov 16th): The SANS Internet Storm Center reports that the legacy finger.exe command is being utilized in recent ‘ClickFix’ attacks. Read more
Browser fingerprinting via favicon — A novel tracking technique has emerged that leverages website favicons to create persistent fingerprints of users’ browsers for tracking purposes. Read more

Security Breaches & Incidents

Logitech leaks data after zero-day attack: Tech peripheral giant Logitech has reportedly suffered a significant data leak following a zero-day attack on its systems. Read more
I have recordings proving Coinbase knew about breach months before disclosure: A researcher alleges that cryptocurrency exchange Coinbase was aware of a major security breach for months before notifying the public. Read more

Security Tools & Best Practices

Google to flag Android apps with excessive battery use on the Play Store: Google will now identify and flag Android applications in the Play Store that cause excessive battery drain due to high background activity. Read more

Emerging Security Technologies

DeepEyesV2 outperforms bigger rivals by favoring tools over sheer knowledge: Researchers in China have developed DeepEyesV2, a multimodal AI that intelligently uses external tools to enhance performance and analytical capabilities. Read more

SFDR 2.0, UK Businesses – 11/16/2025

info@grabtheaxe.com (Chris Armour) — Sun, 16 Nov 2025 00:00:00 GMT

Today’s compliance intelligence digest focuses on the implications of the leaked SFDR 2.0 draft proposal for UK businesses, highlighting the need to understand the potential overhaul of the EU’s sustainable finance disclosure regime. Also, a Cybersecurity Outlook 2026 event is mentioned. Here’s what you need to know.

Critical Compliance Alert

SFDR 2.0 Implications for UK Businesses: A leaked draft proposal signals a sweeping overhaul of the EU’s Sustainable Finance Disclosure Regulation (SFDR). This is highly relevant for UK businesses with EU-facing funds or sustainability-linked products. Read more

Regulatory Updates

SFDR 2.0 Implications for UK Businesses: A leaked draft proposal signals a sweeping overhaul of the EU’s Sustainable Finance Disclosure Regulation (SFDR). This is highly relevant for UK businesses with EU-facing funds or sustainability-linked products. Read more

Akira, CMMC, Junk Fees & NPM Registry – 11/15/2025

info@grabtheaxe.com (Chris Armour) — Sat, 15 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, focusing on the Akira ransomware’s new targeting of Nutanix VMs and a massive NPM registry attack. We also cover the new Cybersecurity Maturity Model Certification (CMMC) requirements for DoD contractors and expanding state ‘junk fees’ laws. Stay informed about these pressing issues to enhance your organization’s compliance and security posture.

Top 5 Critical Compliance Alerts

Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs: The Akira ransomware group is actively experimenting with new attack methods, successfully targeting critical sectors through Nutanix VMs. Read more
150,000 Packages Flood NPM Registry in Token Farming Campaign: A self-replicating attack has led to a massive influx of malicious packages in the NPM registry, specifically targeting tokens for the tea.xyz protocol. Read more
They’re Here! The Cybersecurity Maturity Model Certification Requirements for DoD Solicitations and Contracts Are Live: Contractors must now adhere to the Cybersecurity Maturity Model Certification (CMMC) requirements for DoD solicitations and contracts. Read more
Expanding Patchwork of State “Junk Fees” Laws Presents Compliance Challenges: Companies face compliance challenges due to expanding state laws regulating fee disclosures and total price advertising, often termed “junk fees” laws. Read more
FERC Staff Audit Report Identifies CIP Standard Compliance Risks in FY2025: A FERC staff audit report highlights risks to electric grid reliability based on Critical Infrastructure Protection (CIP) audits of NERC registered entities. Read more

Regulatory Updates

Fall 2025 Financial Conferences Reveal the Rules That Will Shape 2026: Insights from Fall 2025 financial conferences reveal upcoming regulatory changes expected to shape financial services compliance in 2026. Read more

Third-Party Risk & Due Diligence

Compliance and Social Media: What You Need to Know About Influencer Content: Companies face growing risks from influencer content, particularly concerning third-party intellectual property rights infringements. Read more

Policy & Governance Updates

Preparing for Jersey’s new whistleblowing regime: Key insights and next steps: Insights and practical steps for employers in Jersey and Guernsey to prepare for the forthcoming whistleblowing regime. Read more
Oregon’s Recycling Modernization Act: What Businesses Need to Know: Businesses need to understand Oregon’s Plastic Pollution and Recycling Modernization Act (RMA), which extends producer responsibility for packaging disposal. Read more

Other

Cybersecurity Outlook 2026: Preview of the Cybersecurity Outlook 2026 virtual event. Read more
Healthcare Compliance Essentials Workshop: Announcement for the Healthcare Compliance Essentials Workshop, providing foundational education on compliance program elements. Read more
New Security Tools Target Growing macOS Threats: New tools aim to combat increasing malware threats targeting macOS, an area researchers say lacks attention. Read more
Hardened Containers Look to Eliminate Common Source of Vulnerabilities: Companies are working to slim down containers to eliminate common vulnerabilities introduced by the “kitchen-sink” approach to building them. Read more

GUARD Act, Data Breaches, AI & Privacy – 11/15/2025

info@grabtheaxe.com (Chris Armour) — Sat, 15 Nov 2025 00:00:00 GMT

This privacy intelligence digest highlights critical developments, including the GUARD Act’s potential threat to online privacy through mandatory age verification and the data breach at Logitech. Further coverage includes the leak of Tate galleries job applicants’ personal details and Anthropic’s claims regarding AI-automated cyberattacks. Stay informed to navigate the evolving privacy landscape effectively.

Top 5 Critical Privacy Alerts

GUARD Act Threatens Online Privacy & Safety: The GUARD Act’s age-verification mandates endanger free expression, privacy, and competition by forcing invasive ID checks. Read more
Logitech Data Breach Confirmed After Clop Extortion Attack: Hardware giant Logitech confirms a data breach after the Clop extortion gang claimed responsibility. Read more
Personal Details of Tate Galleries Job Applicants Leaked: Sensitive information, including addresses and salaries, of Tate galleries job applicants leaked online. Read more
Anthropic Claims of AI-Automated Cyberattacks Met With Doubt: Anthropic reports Chinese state-sponsored group automated cyber-espionage using Claude Code AI, but claims face skepticism. Read more
Checkout.com Snubs Hackers After Data Breach: Checkout.com announces a breach by ShinyHunters, opting to donate ransom instead of paying. Read more

Privacy Laws & Regulations

Maryland Privacy Crackdown Raises Bar for Disclosure Compliance: Maryland’s Online Data Privacy Act (MODPA) of 2024 empowers the state to curb exploitative data practices. Read more
U.S. Senate Introduces the Health Information Privacy Reform Act: HIPRA seeks to extend HIPAA-like protections. Read more

Data Breaches

Logitech Data Breach Confirmed After Clop Extortion Attack: Hardware giant Logitech confirms a data breach after the Clop extortion gang claimed responsibility. Read more
Personal Details of Tate Galleries Job Applicants Leaked: Sensitive information, including addresses and salaries, of Tate galleries job applicants leaked online. Read more
Checkout.com Snubs Hackers After Data Breach: Checkout.com announces a breach by ShinyHunters, opting to donate ransom instead of paying. Read more

Artificial Intelligence

GUARD Act Threatens Online Privacy & Safety: The GUARD Act’s age-verification mandates endanger free expression, privacy, and competition by forcing invasive ID checks. Read more
Anthropic Claims of AI-Automated Cyberattacks Met With Doubt: Anthropic reports Chinese state-sponsored group automated cyber-espionage using Claude Code AI, but claims face skepticism. Read more

XWiki Exploit, FortiWeb Attacks & Finger Malware – 11/15/2025

info@grabtheaxe.com (Chris Armour) — Sat, 15 Nov 2025 00:00:00 GMT

Today’s threat landscape is highlighted by the active exploitation of a critical remote code execution vulnerability in XWiki servers (CVSS 9.8) by the RondoDox botnet. Security teams are also responding to a novel malware campaign abusing the legacy ‘Finger’ protocol and the massive $220 million financial fallout from the Jaguar Land Rover cyberattack. This report details the key threats and defensive actions required.

Top 5 Critical Security Alerts

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet; The RondoDox botnet is actively exploiting a critical RCE vulnerability (CVE-2025-24893, CVSS 9.8) in unpatched XWiki servers. Read more
Honeypot: FortiWeb CVE-2025-64446 Exploits: Active exploitation attempts for the FortiWeb vulnerability CVE-2025-64446 are being widely observed in security honeypots. Read more
Decades-old ‘Finger’ protocol abused in ClickFix malware attacks: Threat actors are abusing the legacy ‘Finger’ protocol to remotely issue commands and deploy the ClickFix malware on Windows systems. Read more
Jaguar Land Rover cyberattack cost the company over $220 million: A recent cyberattack cost Jaguar Land Rover over $220 million in a single quarter, highlighting the severe financial impact of security incidents. Read more
Microsoft: Windows 10 KB5068781 ESU update may fail with 0x800f0922 errors: Microsoft is investigating a bug causing a critical Windows 10 extended security update to fail on corporate devices, posing a patching risk. Read more

Threat Intelligence

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet; The RondoDox botnet is actively exploiting a critical RCE vulnerability (CVE-2025-24893, CVSS 9.8) in unpatched XWiki servers. Read more
Honeypot: FortiWeb CVE-2025-64446 Exploits: Active exploitation attempts for the FortiWeb vulnerability CVE-2025-64446 are being widely observed in security honeypots. Read more
Decades-old ‘Finger’ protocol abused in ClickFix malware attacks: Threat actors are abusing the legacy ‘Finger’ protocol to remotely issue commands and deploy the ClickFix malware on Windows systems. Read more

Security Breaches & Incidents

Jaguar Land Rover cyberattack cost the company over $220 million: A recent cyberattack cost Jaguar Land Rover over $220 million in a single quarter, highlighting the severe financial impact of security incidents. Read more
Five Plead Guilty in U.S. for Helping North Korean IT Workers Infiltrate 136 Companies: Five individuals have pleaded guilty to aiding North Korean IT workers in a fraudulent scheme to infiltrate U.S. companies and generate illicit revenue. Read more

Security Tools & Best Practices

Microsoft: Windows 10 KB5068781 ESU update may fail with 0x800f0922 errors: Microsoft is investigating a bug causing a critical Windows 10 extended security update to fail on corporate devices, posing a patching risk. Read more

Emerging Security Technologies

LeCun accuses Anthropic of exploiting AI cyberattack fears for regulatory capture: AI pioneer Yann LeCun claims AI company Anthropic is exaggerating AI cyberattack risks to influence regulation in its favor. Read more

AI Cyberattacks, Fortinet Zero-Day & Akira Ransomware – 11/14/2025

info@grabtheaxe.com (Chris Armour) — Fri, 14 Nov 2025 00:00:00 GMT

Today’s security landscape is defined by a landmark shift in offensive capabilities, as Chinese state actors have been found using AI to automate cyberattacks. This development is coupled with a critical, actively exploited zero-day vulnerability in Fortinet’s FortiWeb products, which demands immediate attention from administrators. Meanwhile, the Akira ransomware group has evolved its tactics to target Nutanix virtual machines, and a massive supply chain attack has flooded the NPM registry with malicious packages. This report details the key threats you need to address now.

Top 5 Critical Security Alerts

Fortinet FortiWeb Zero-Day (CVE-2025-64446) Under Active Exploit: Fortinet silently patched a critical path traversal vulnerability in its FortiWeb WAF that is being actively exploited to create unauthorized admin accounts. CISA has added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog, requiring immediate patching. Read more
Chinese State Hackers Automate Attacks Using Anthropic’s AI: A Chinese state-sponsored espionage group reportedly used Anthropic’s AI systems to automate a significant portion of their cyberattacks against approximately 30 entities. This marks a potential turning point in the use of AI for offensive cyber operations, though some researchers question the degree of autonomy. Read more
Akira Ransomware Targets Nutanix Virtual Machines: The Akira ransomware group is now targeting Nutanix AHV hypervisors to encrypt virtual machines, posing a significant threat to critical organizations using this infrastructure. CISA has flagged this as an imminent threat, noting the group has extorted over $244 million since September. Read more
Massive Supply Chain Attack Floods NPM Registry with 150,000 Malicious Packages: A self-replicating token farming campaign has inundated the NPM registry with over 150,000 malicious packages. The attack targets tokens for the tea.xyz protocol, highlighting ongoing risks in open-source software supply chains. Read more
Five Plead Guilty to Aiding North Korean IT Worker Infiltration Schemes: The U.S. DOJ announced that five individuals have pleaded guilty to facilitating schemes that helped North Korean IT workers fraudulently gain employment at U.S. companies. These schemes are a major source of revenue for the North Korean regime, funding its illicit activities through wage and cryptocurrency theft. Read more

Threat Intelligence (APT, malware, ransomware)

Iranian Hackers Launch ‘SpearSpecter’ Spy Operation on Defense & Government Targets: The Iranian state-sponsored group APT42 has launched a new espionage campaign, dubbed SpearSpecter, targeting individuals and organizations of interest to the IRGC. Read more
North Korean Hackers Abuse JSON Services for Covert Malware Delivery: Threat actors linked to North Korea are now using legitimate JSON storage services like JSON Keeper and npoint.io to host and deliver malware payloads, evading detection in their campaigns. Read more
Ransomware Ecosystem Most Decentralized To Date, LockBit Returns: The ransomware landscape saw 85 active groups in Q3 2025, the most decentralized to date. Despite law enforcement pressure, activity remains high, with 1,590 victims disclosed and the LockBit group re-emerging. Read more
US Establishes New Strike Force to Combat Chinese Crypto Scammers: Federal authorities have created a new task force to disrupt Chinese cryptocurrency scam networks responsible for defrauding Americans of nearly $10 billion annually. Read more

Security Breaches & Incidents

Logitech Confirms Data Breach in Clop Extortion Attack: Logitech has confirmed it was breached by the Clop extortion gang, which exploited vulnerabilities in Oracle E-Business Suite to steal data. Read more
DoorDash Discloses New Data Breach Exposing User Information: DoorDash has begun notifying customers of a data breach that occurred in October, exposing user information. This is the latest security incident to affect the food delivery platform. Read more
Checkout.com Breached by ShinyHunters, Donates Ransom Demand to Charity: Financial tech company Checkout.com announced a breach of a legacy cloud storage system by the ShinyHunters group. The company is refusing to pay the ransom and will donate the equivalent amount to charity instead. Read more
Cyberattack on Russian Port Operator Aimed to Disrupt Shipments: A cyberattack targeted Russian port operator Port Alliance, aiming to destabilize operations and disrupt exports of coal and mineral fertilizers across its key seaports. Read more

Security Tools & Best Practices

Google Reverses Course on New Android Developer Registration Rules: Google is backpedaling on its plan for mandatory identity verification for all developers, now allowing for limited distribution accounts and installation of apps from unverified developers. Read more
Hardened Containers Aim to Reduce Common Vulnerabilities: Several companies are promoting the use of slimmed-down, hardened containers to eliminate the common security vulnerabilities introduced by including unnecessary components. Read more

Cloud & Network Security

ASUS Warns of Critical Authentication Bypass Flaw in DSL Routers: ASUS has released firmware updates to patch a critical authentication bypass vulnerability affecting several of its DSL series router models, urging users to update immediately. Read more

Emerging Security Technologies (AI, XDR, CNAPP)

Researchers Uncover Critical Bugs in Major AI Inference Frameworks: Security researchers have found critical remote code execution vulnerabilities in AI inference engines from Meta, Nvidia, and Microsoft. The flaws stem from the unsafe use of ZeroMQ and Python’s pickle deserialization. Read more

runC Vulnerability, TP-Link Ban & Data Breach – 11/09/2025

info@grabtheaxe.com (Chris Armour) — Sun, 09 Nov 2025 00:00:00 GMT

Today’s threat landscape is highlighted by critical vulnerabilities in the runC container runtime, potentially allowing Docker and Kubernetes container escapes. We are also tracking a significant data breach at a Chinese cybersecurity firm that exposed cyber-weapons, and the geopolitical and security implications of a proposed U.S. ban on TP-Link networking gear. This summary provides the essential intelligence you need to understand these developing threats.

Top 3 Critical Security Alerts

Dangerous runC flaws could allow hackers to escape Docker containers: Three new vulnerabilities in the runC container runtime could allow attackers to escape Docker and Kubernetes containers, gaining access to the host system. Read more
Data breach at Chinese infosec firm reveals cyber-weapons and target list: A significant data breach at a Chinese information security firm has reportedly exposed its proprietary cyber-weapons and a list of targeted entities. Read more
Drilling Down on Uncle Sam’s Proposed TP-Link Ban: The U.S. government is considering a ban on TP-Link networking equipment due to its ties to China, raising concerns about supply chain security and insecure-by-default products. Read more

Security Breaches & Incidents

Data breach at Chinese infosec firm reveals cyber-weapons and target list: A significant data breach at a Chinese information security firm has reportedly exposed its proprietary cyber-weapons and a list of targeted entities. Read more

Security Tools & Best Practices

NAKIVO Introduces v11.1 with Upgraded Disaster Recovery and MSP Features: NAKIVO has released Backup & Replication v11.1, featuring enhanced disaster recovery options, real-time replication, and improved MSP management tools. Read more
Lost iPhone? Don’t fall for phishing texts saying it was found: The Swiss NCSC warns of a phishing scam targeting lost or stolen iPhone owners with fake ‘found’ messages designed to steal Apple ID credentials. Read more

Cloud & Network Security

Dangerous runC flaws could allow hackers to escape Docker containers: Three new vulnerabilities in the runC container runtime could allow attackers to escape Docker and Kubernetes containers, gaining access to the host system. Read more
Drilling Down on Uncle Sam’s Proposed TP-Link Ban: The U.S. government is considering a ban on TP-Link networking equipment due to its ties to China, raising concerns about supply chain security and insecure-by-default products. Read more

Emerging Security Technologies

Google’s Veo-3 can fake surgical videos but misses every hint of medical sense: Google’s new video AI, Veo-3, can generate realistic-looking surgical videos but lacks any actual understanding of medical procedures, highlighting current AI limitations. Read more

Mobile Malware, AI Security, Regulatory Compliance – 11/08/2025

info@grabtheaxe.com (Chris Armour) — Sat, 08 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical alerts regarding ‘Landfall’ malware targeting Samsung devices and ‘Ransomvibing’ affecting Visual Studio extensions. Key regulatory updates include the FDA’s response to Alvotech’s biosimilar application and California’s upcoming workshop on climate risk reporting. Microsoft’s AI expansion in the UAE also raises third-party security concerns, while forward-thinking compliance strategies for 2026 emphasize fairness and transparency.

Top 5 Critical Compliance Alerts

‘Landfall’ Malware Targets Samsung Galaxy Users: New malware can secretly record conversations, track device locations, capture photos, and collect contacts on compromised Samsung devices. Read more
‘Ransomvibing’ Infests Visual Studio Extension Market: A malicious VS Code extension encrypts and exfiltrates data, raising concerns about supply chain security and AI-generated threats. Read more

Regulatory Updates

FDA Issues Complete Response Letter for Alvotech’s Simponi® (golimumab) Biosimilar AVT05: The FDA issued a complete response letter (CRL) for Alvotech’s biosimilar application. Read more
California Air Resources Board to Hold Another Public Workshop: The California Air Resources Board will hold a third workshop on greenhouse gas emissions (SB 253) and climate risk reporting (SB 261) mandates. Read more

Third-Party Risk & Due Diligence

Microsoft Backs Massive AI Push in UAE, Raising Security Concerns: Microsoft’s partnership with Emirates tech company G42 to build a 5-gigawatt AI campus using Nvidia GPUs raises security concerns. Read more

Policy & Governance Updates

2026 Compliance Predictions Companies Can’t Afford to Ignore: Embedding fairness, transparency, and accountability into decision-making will provide a competitive advantage in navigating future challenges. Read more

Spyware, Car Surveillance, Firewall Flaws & Breaches – 11/08/2025

info@grabtheaxe.com (Chris Armour) — Sat, 08 Nov 2025 00:00:00 GMT

Today’s privacy digest highlights critical vulnerabilities and privacy risks. A new LandFall spyware targets Samsung via WhatsApp, while modern cars are increasingly under scrutiny for data collection practices. Additionally, malicious NuGet packages pose a threat with delayed sabotage payloads, and Cisco firewall flaws are being actively exploited for DoS attacks.

Top 5 Critical Privacy Alerts

New LandFall spyware exploited Samsung zero-day via WhatsApp messages: A new spyware leverages a Samsung zero-day through WhatsApp images. Read more
Modern cars are spying on you. Here’s what you can do about it.: Cars track data, potentially sharing it with insurers and data brokers; Privacy4Cars offers VIN lookups. Read more
Malicious NuGet packages drop disruptive ‘time bombs’: Packages on NuGet contain sabotage payloads set for 2027-28, targeting databases and Siemens S7 devices. Read more
Cisco: Actively exploited firewall flaws now abused for DoS attacks: Zero-day vulnerabilities in Cisco firewalls are now being exploited to cause reboot loops. Read more
ID verification laws are fueling the next wave of breaches: Laws requiring ID verification lead to large sensitive data stores, increasing breach risks. Read more

Business

Modern cars are spying on you. Here’s what you can do about it.: Cars track data, potentially sharing it with insurers and data brokers; Privacy4Cars offers VIN lookups. Read more

Mobile

New LandFall spyware exploited Samsung zero-day via WhatsApp messages: A new spyware leverages a Samsung zero-day through WhatsApp images. Read more

Security

Malicious NuGet packages drop disruptive ‘time bombs’: Packages on NuGet contain sabotage payloads set for 2027-28, targeting databases and Siemens S7 devices. Read more
QNAP fixes seven NAS zero-day flaws exploited at Pwn2Own: QNAP patched seven zero-days exploited at Pwn2Own Ireland 2025 to hack NAS devices. Read more
Cisco: Actively exploited firewall flaws now abused for DoS attacks: Zero-day vulnerabilities in Cisco firewalls are now being exploited to cause reboot loops. Read more
ID verification laws are fueling the next wave of breaches: Laws requiring ID verification lead to large sensitive data stores, increasing breach risks. Read more

Surveillance

Modern cars are spying on you. Here’s what you can do about it.: Cars track data, potentially sharing it with insurers and data brokers; Privacy4Cars offers VIN lookups. Read more

U.S.

Modern cars are spying on you. Here’s what you can do about it.: Cars track data, potentially sharing it with insurers and data brokers; Privacy4Cars offers VIN lookups. Read more

VSCode Malware, AI Side-Channel & Windows 10 ESU – 11/08/2025

info@grabtheaxe.com (Chris Armour) — Sat, 08 Nov 2025 00:00:00 GMT

Today’s threat landscape is marked by the re-emergence of the GlassWorm malware, now targeting developers through malicious VSCode extensions on the OpenVSX marketplace. Microsoft has also disclosed a novel side-channel attack, dubbed ‘Whisper Leak,’ capable of compromising encrypted AI chat communications. Furthermore, a critical deadline approaches for Windows 10 users to enroll in Extended Security Updates to avoid exposure. These developments highlight immediate risks to software supply chains, AI privacy, and legacy system security.

Top 3 Critical Security Alerts

GlassWorm malware returns on OpenVSX with 3 new VSCode extensions: The GlassWorm malware campaign has resurfaced on the OpenVSX marketplace, infecting three new VSCode extensions that have already been downloaded over 10,000 times. Read more
Microsoft Uncovers ‘Whisper Leak’ Attack That Identifies AI Chat Topics in Encrypted Traffic: Researchers have detailed ‘Whisper Leak,’ a novel side-channel attack that can identify conversation topics in encrypted, streaming-mode AI chat traffic, posing significant privacy risks. Read more
Still on Windows 10? Enroll in free ESU before next week’s Patch Tuesday: Microsoft urges remaining Windows 10 users to enroll in the free Extended Security Updates (ESU) program before the upcoming Patch Tuesday to remain protected against new vulnerabilities. Read more

Threat Intelligence

GlassWorm malware returns on OpenVSX with 3 new VSCode extensions: The GlassWorm malware campaign has resurfaced on the OpenVSX marketplace, infecting three new VSCode extensions that have already been downloaded over 10,000 times. Read more
Honeypot: Requests for (Code) Repositories, (Sat, Nov 8th): SANS ISC honeypots have detected an increase in scanning activity targeting code repositories, indicating active reconnaissance for vulnerable source code by threat actors. Read more

Security Tools & Best Practices

Still on Windows 10? Enroll in free ESU before next week’s Patch Tuesday: Microsoft urges remaining Windows 10 users to enroll in the free Extended Security Updates (ESU) program before the upcoming Patch Tuesday to remain protected against new vulnerabilities. Read more

Emerging Security Technologies

Microsoft Uncovers ‘Whisper Leak’ Attack That Identifies AI Chat Topics in Encrypted Traffic: Researchers have detailed ‘Whisper Leak,’ a novel side-channel attack that can identify conversation topics in encrypted, streaming-mode AI chat traffic, posing significant privacy risks. Read more

AI Ransomware, Cyberattack, Data Privacy – 11/07/2025

info@grabtheaxe.com (Chris Armour) — Fri, 07 Nov 2025 00:00:00 GMT

This daily privacy digest highlights critical security threats, including an AI-generated ransomware on the VS Code marketplace and a cyberattack on the U.S. Congressional Budget Office. Also covered are the EU’s move to expand Europol’s data-sharing capabilities and a $5.1 million penalty against Illuminate Education for student data protection failures. Finally, we look at the EFF’s latest findings on the effectiveness of antivirus apps in detecting stalkerware.

Top 5 Critical Privacy Alerts

AI-Slop ransomware test sneaks on to VS Code marketplace. A malicious, AI-created ransomware extension was found on Microsoft’s VS Code marketplace. Read more
U.S. Congressional Budget Office hit by suspected foreign cyberattack. CBO confirms a cybersecurity incident, potentially exposing sensitive data to a foreign hacker. Read more
How a ransomware gang encrypted Nevada government’s systems. The State of Nevada fully recovered from a ransomware attack impacting 60 agencies. Read more
Attorney General James and Multistate Coalition Secure $5.1 Million. Illuminate Education penalized for failing to protect student data. Read more
EU Parliament committee votes to advance controversial Europol data sharing proposal. Proposal expands Europol’s data sharing and biometric data collection. Read more

Privacy Laws & Regulations

New DSK Guidelines Aim to Set the Standard for International Research Collaborations. German authorities release guidelines on international data transfers in medical research. Read more

Regulatory Fines & Enforcement Actions

Attorney General James and Multistate Coalition Secure $5.1 Million. Illuminate Education penalized for failing to protect student data. Read more

AI

Faking Receipts with AI. AI can now create realistic fake receipts, including paper wrinkles and signatures. Read more
The UK’s First Copyright vs. AI Decision: Key Takeaways on a Win for the AI Industry. UK court’s decision favors AI industry, stating AI models aren’t infringing copies. Read more
Leak confirms Google Gemini 3 Pro and Nano Banana 2 could launch soon. Google plans to release Gemini 3 for coding and Nano Banana 2 for images. Read more
AI-Slop ransomware test sneaks on to VS Code marketplace. A malicious, AI-created ransomware extension was found on Microsoft’s VS Code marketplace. Read more

Government

U.S. Congressional Budget Office hit by suspected foreign cyberattack. CBO confirms a cybersecurity incident, potentially exposing sensitive data to a foreign hacker. Read more
How a ransomware gang encrypted Nevada government’s systems. The State of Nevada fully recovered from a ransomware attack impacting 60 agencies. Read more

Surveillance

EU Parliament committee votes to advance controversial Europol data sharing proposal. Proposal expands Europol’s data sharing and biometric data collection. Read more

Stalkerware

EFF Teams Up With AV Comparatives to Test Android Stalkerware Detection by Major Antivirus Apps. Tests reveal mixed results in stalkerware detection by Android antivirus apps; Malwarebytes scored 100%. Read more

Landfall Spyware, CBO Hack & Cisco Flaws – 11/07/2025

info@grabtheaxe.com (Chris Armour) — Fri, 07 Nov 2025 00:00:00 GMT

Today’s security landscape is dominated by the discovery of the ‘Landfall’ spyware, which exploited a zero-day in Samsung devices for nearly a year. Other critical threats include actively exploited Cisco firewall vulnerabilities causing DoS attacks and a significant data breach at the U.S. Congressional Budget Office linked to an unpatched device. We are also tracking a supply chain threat involving malicious NuGet packages with dormant ‘time bomb’ payloads set to detonate in the future. This is what you need to know now.

Top 5 Critical Security Alerts

‘Landfall’ spyware abused zero-day to hack Samsung Galaxy phones: A newly discovered commercial spyware named ‘Landfall’ exploited a zero-day vulnerability for nearly a year to compromise Samsung Galaxy devices, targeting users in the Middle East. Read more
Cisco: Actively exploited firewall flaws now abused for DoS attacks — Cisco warns that two previously disclosed zero-day vulnerabilities in its ASA and FTD firewalls are now being actively used to launch denial-of-service attacks, causing devices to enter a reboot loop. Read more
Congressional Budget Office confirms it was hacked: The U.S. Congressional Budget Office (CBO) has confirmed a significant cybersecurity incident, with researchers suggesting the breach may have stemmed from a firewall that remained unpatched for over a year. Read more
Malicious NuGet packages drop disruptive ‘time bombs’: Malicious packages have been found on the NuGet repository containing hidden payloads scheduled to activate in 2027 and 2028, designed to sabotage databases and Siemens industrial control systems. Read more
Washington Post confirms data breach linked to Oracle hacks — The Washington Post is the latest high-profile victim of the Clop ransomware gang, which breached the newspaper’s network by exploiting vulnerabilities in Oracle software. Read more

Threat Intelligence

Russian Hacking Group Sandworm Deploys New Wiper Malware in Ukraine: The Russian state-sponsored group Sandworm has been observed deploying new data-wiping malware against government, energy, and logistics entities in Ukraine. Read more
From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools: A China-linked threat actor is exploiting older vulnerabilities, including Log4j, to target U.S. non-profits involved in policy issues, aiming to establish long-term network persistence for espionage. Read more
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities: A malicious Visual Studio Code extension named “susvsex” was discovered with basic ransomware functions, appearing to have been created with AI assistance and making little effort to hide its malicious nature. Read more

Security Breaches & Incidents

How to trade your $214,000 cybersecurity job for a jail cell: An article details a case where incident response experts were arrested by the FBI for allegedly planting ransomware themselves while engaged by victim companies to perform cleanup. Read more

Security Tools & Best Practices

QNAP fixes seven NAS zero-day flaws exploited at Pwn2Own — QNAP has released patches for seven zero-day vulnerabilities in its Network-Attached Storage (NAS) devices that were successfully exploited by researchers during the Pwn2Own competition. Read more
ID verification laws are fueling the next wave of breaches: An analysis suggests that increasingly strict ID verification laws are forcing companies to store massive amounts of sensitive data, turning compliance efforts into a significant security risk by creating high-value targets. Read more

Cloud & Network Security

Ollama, Nvidia Flaws Put AI Infrastructure at Risk: Researchers have uncovered multiple vulnerabilities in popular AI infrastructure products from Ollama and Nvidia, including a flaw that could permit remote code execution. Read more

Emerging Security Technologies

Whisper Leak: A novel side-channel attack on remote language models: Microsoft researchers have detailed “Whisper Leak,” a new side-channel attack that can infer the topics of encrypted conversations with remote AI language models by analyzing network traffic patterns. Read more
AI Agents Are Going Rogue: Here’s How to Rein Them In: Experts warn that applying human-centric identity frameworks to AI agents is inadequate and creates potential for catastrophic security failures as their use becomes more widespread. Read more

DHS, Biometrics, Facial Recognition & Data Breach – 11/06/2025

info@grabtheaxe.com (Chris Armour) — Thu, 06 Nov 2025 00:00:00 GMT

This privacy intelligence digest highlights concerning developments in data privacy and security. The DHS is under fire for proposed rules allowing the seizure of children’s biometric data, while a CBP app enables local law enforcement to use facial recognition for immigration enforcement. Additionally, a data breach at Hyundai AutoEver America exposed sensitive personal information, underscoring the ever-present threat of data breaches.

Top 5 Critical Privacy Alerts

DHS offers “disturbing new excuses” to seize kids’ biometric data, expert says: Civil and digital rights experts are horrified by a proposed rule change allowing DHS to collect biometric data on all immigrants, without age restrictions. Read more
DHS Gives Local Cops a Facial Recognition App To Find Immigrants: CBP released an app for local law enforcement to scan faces for immigration enforcement, raising privacy concerns. Read more
Hyundai AutoEver America data breach exposes SSNs, drivers licenses: Hackers breached Hyundai AutoEver America, accessing and exposing personal information, including SSNs and driver’s licenses. Read more
University of Pennsylvania confirms data stolen in cyberattack: A cyberattack on the University of Pennsylvania resulted in the theft of data related to development and alumni activities. Read more
California Adds Injunctive Relief to its Right of Publicity Statute and Extends Liability to Digital Replicas: California amended its Right of Publicity statute to include injunctive relief and cover digital replicas. Read more

Privacy Laws & Regulations

California Adds Injunctive Relief to its Right of Publicity Statute and Extends Liability to Digital Replicas: California amended its Right of Publicity statute to include injunctive relief and cover digital replicas. Read more

Regulatory Fines & Enforcement Actions

Rigged Poker Games: The DOJ indicted 31 people for high-tech rigging of poker games using altered shuffling machines and hidden technology. Read more

Surveillance

DHS offers “disturbing new excuses” to seize kids’ biometric data, expert says: Civil and digital rights experts are horrified by a proposed rule change allowing DHS to collect biometric data on all immigrants, without age restrictions. Read more
DHS Gives Local Cops a Facial Recognition App To Find Immigrants: CBP released an app for local law enforcement to scan faces for immigration enforcement, raising privacy concerns. Read more

Sandworm Wipers, Cisco Flaw, & SonicWall Breach – 11/06/2025

info@grabtheaxe.com (Chris Armour) — Thu, 06 Nov 2025 00:00:00 GMT

Today’s threat landscape is defined by aggressive nation-state activity, with Russia’s Sandworm group deploying destructive wiper malware against Ukraine’s critical infrastructure. This summary also covers a critical root-level vulnerability in Cisco’s UCCX software and an official confirmation from SonicWall that state-sponsored hackers were behind its recent cloud backup breach. Additionally, new intelligence from Google confirms that malware leveraging generative AI for evasion is now being actively deployed in the wild.

Top 5 Critical Security Alerts

Wipers from Russia’s Sandworm Hackers Rain Destruction on Ukraine : Russian state-sponsored hackers, including the notorious Sandworm group, are actively deploying destructive data-wiping malware against Ukrainian targets, particularly focusing on the nation’s critical grain industry. Read more
Critical Cisco UCCX Flaw Lets Attackers Run Commands as Root — Cisco has patched a critical vulnerability in its Unified Contact Center Express (UCCX) software that could allow authenticated, remote attackers to execute arbitrary commands with root privileges. Read more
SonicWall Confirms State-Sponsored Hackers Stole Firewall Backups — SonicWall has officially attributed a September security breach to a nation-state threat actor who gained unauthorized access to firewall configuration backup files from a cloud environment. Read more
CISA Warns of Critical Vulnerabilities in ABB FLXeon ICS Controllers — An advisory from CISA details multiple high-severity vulnerabilities (CVSS 8.7) in ABB FLXeon controllers, including hard-coded credentials and improper input validation, which could allow for remote code execution. Read more
CISA Advisory Details RCE Flaws in Advantech DeviceOn/iEdge IoT Platform — CISA has released an advisory for end-of-life Advantech DeviceOn/iEdge products, warning of critical path traversal and XSS vulnerabilities (CVSS 8.7) that could lead to remote code execution. Read more

Threat Intelligence

AI-Slop Ransomware Test Sneaks on to VS Code Marketplace : A malicious extension with basic ransomware capabilities, seemingly created with the help of AI, was discovered and removed from Microsoft’s official VS Code marketplace. Read more
Italian Political Consultant Targeted with Paragon Spyware — A prominent Italian political consultant was notified by WhatsApp that his phone was targeted with sophisticated spyware developed by the commercial surveillance firm Paragon. Read more
ClickFix Malware Evolves with Multi-OS Support and Video Tutorials : The ClickFix malware campaign has been updated to include video guides that walk victims through the self-infection process and now automatically detects the OS to provide the correct malicious commands. Read more
Trojanized ESET Installers Drop Kalambur Backdoor in Attacks on Ukraine : A Russia-aligned threat group is targeting Ukrainian entities with phishing attacks that use trojanized ESET security software installers to deliver the Kalambur backdoor. Read more
Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR : Threat actors are now enabling the Windows Hyper-V role on victim systems to deploy a lightweight Linux virtual machine, creating a hidden environment to execute malware and bypass EDR solutions. Read more

Security Breaches & Incidents

Ed Tech Company Fined $5.1 Million for Poor Data Security Practices : An educational technology firm has been fined $5.1 million for failing to implement adequate data security measures, such as monitoring for suspicious activity and securing backups, which led to a major hack. Read more
Nevada Government Details Ransomware Attack, Confirms No Ransom Paid : The State of Nevada has released a post-mortem on the August ransomware attack that affected 60 agencies, confirming it did not pay the ransom and that the initial breach occurred in May. Read more

Security Tools & Best Practices

Continuous Purple Teaming: Turning Red-Blue Rivalry into Real Defense : An article from Picus Security makes the case for adopting continuous purple teaming and Breach and Attack Simulation (BAS) to proactively validate security controls against real-world attack scenarios. Read more

Cloud & Network Security

Cloudflare Scrubs Aisuru Botnet from Top Domains List : Cloudflare has taken action to remove domains associated with the massive Aisuru botnet from its public rankings after the botnet was used to manipulate traffic data and attack DNS services. Read more
Cisco Warns of New Attack Variant Battering Firewalls : Cisco is alerting customers to a new attack variant that targets unpatched Secure Firewall devices, exploiting two known vulnerabilities to cause a denial-of-service condition by forcing the device to reload. Read more

Security Standards & Frameworks

CISA Releases Four Industrial Control Systems Advisories : CISA has published four new advisories detailing security vulnerabilities in various ICS products from vendors including Advantech, Ubia, ABB, and Hitachi Energy. Read more

Emerging Security Technologies

Teaching Cybersecurity to AI Systems : A new proof of concept demonstrates how AI agents, using LangChain and OpenAI integrated with the Cisco Umbrella API, can be equipped with real-time threat intelligence to evaluate domain security. Read more
Google: AI-Enabled Malware is Now Being Actively Deployed : According to Google, threat actors are actively deploying malware that uses ‘just-in-time AI’ and LLMs to generate polymorphic code on-demand, significantly improving its ability to evade detection. Read more
New IDC Research Highlights a Major Cloud Security Shift : Recent IDC research shows a clear industry trend toward adopting integrated, AI-powered platforms like CNAPP, XDR, and SIEM to reduce complexity and strengthen cloud security resilience. Read more

Zero-Day, ChatGPT Bugs, FINRA Fine & Data Breaches – 11/06/2025

info@grabtheaxe.com (Chris Armour) — Thu, 06 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical developments, including an APT exploiting a zero-day vulnerability to target Japanese organizations and multiple security flaws in ChatGPT leading to potential data theft. Also covered is a significant FINRA fine for excessive gift spending and recent data breaches in the healthcare sector. Stay informed to strengthen your organization’s security posture and compliance efforts.

Top 5 Critical Compliance Alerts

APT ‘Bronze Butler’ Exploits Zero-Day to Root Japan Orgs: A critical security issue in a popular endpoint manager allowed Chinese state-sponsored attackers to backdoor Japanese businesses. Read more
Multiple ChatGPT Security Bugs Allow Rampant Data Theft: Attackers can use them to inject arbitrary prompts, exfiltrate personal user information, bypass safety mechanisms, and take other malicious actions. Read more
Nikkei Suffers Breach Via Slack Compromise: The Japanese media giant said thousands of employee and business partners were impacted by an attack that compromised Slack account data and chat histories. Read more
FINRA Fines Firm $10M on Gift Spending: FINRA fined a financial services firm $10 million for providing clients luxury meals and event tickets in exchange for business deals, and for a weak recordkeeping system. Read more
Tri Century Eye Care & Pittsburgh Gastroenterology Associates Announce Data Breaches: Data breaches have recently been announced by Tri Century Eye Care in Pennsylvania, Pittsburgh Gastroenterology Associates, NAHGA Claims Services. Read more

Compliance Frameworks

Threat Intelligence – ISO 27001:2022 Control 5.7 Explained: Cyber attacks evolve faster than traditional security review cycles; organizations need a clearer understanding of relevant threats. Read more
Pomona Valley Hospital Medical Center Pays $600K to Settle Meta Pixel Lawsuit: Pomona Valley Hospital Medical Center in California has agreed to pay $600,000 to resolve all claims in class action litigation. Read more

Regulatory Updates

FINRA Fines Firm $10M on Gift Spending: FINRA fined a financial services firm $10 million for providing clients luxury meals and event tickets in exchange for business deals, and for a weak recordkeeping system. Read more
December 1, 2025 FCC EEO Deadlines for Stations in AL, GA, CO, MN, MT, ND, SD, CT, ME, MA, NH, RI, and VT: Radio and television stations must prepare an annual EEO Public File Report by December 1, 2025. Read more

Third-Party Risk & Due Diligence

Recent DOJ Settlements Highlight Risks for Subcontractors Handling Sensitive Government Information: The DOJ announced an $875,000 settlement with a university over failures to comply with data security obligations in certain contracts. Read more
Nikkei Suffers Breach Via Slack Compromise: The Japanese media giant said thousands of employee and business partners were impacted by an attack that compromised Slack account data and chat histories. Read more

Policy & Governance Updates

No Good Deed: Privilege is at Risk When the Government Directs Your Company’s Internal Investigation: Privilege is at risk when the government directs your company’s internal investigation. Read more
The OIG’s Seven Elements of an Effective Compliance Program: Building an effective compliance program means nurturing a culture of accountability and trust among all staff. Read more

Android Malware, Data Breach, EU Surveillance – 11/05/2025

info@grabtheaxe.com (Chris Armour) — Wed, 05 Nov 2025 00:00:00 GMT

Today’s privacy landscape is marked by critical developments in AI-powered malware, data breach regulations, and surveillance practices. Malicious Android apps are impacting millions, while California tightens data breach notification timelines. Also, the sale of EU officials’ location data raises serious concerns about privacy and security.

Top 5 Critical Privacy Alerts

Malicious Android apps on Google Play downloaded 42 million times: Hundreds of malicious Android apps were downloaded over 40 million times. Read more
California tightens data breach notification timelines: Covered companies must notify affected California residents within 30 days of a data breach discovery. Read more
Phone location data of top EU officials for sale: Journalists found it easy to spy on top EU officials using commercially obtained location histories. Read more
DHS proposes biometrics expansion for immigrants: DHS is looking to increase its collection of biometrics, including from some U.S. citizens. Read more
Google warns of new AI-powered malware families: Adversaries are using AI to deploy new malware families that integrate LLMs during execution. Read more

Privacy Laws & Regulations

California Finalizes Updates to Existing CCPA Regulations: Updates to CCPA regulations expand business obligations and cover cybersecurity audits. Read more
California tightens data breach notification timelines: Covered companies must notify affected California residents within 30 days of a data breach discovery. Read more

Data Minimization & User Consent

When sharing your info online leads to unwanted telemarketing calls: Learn how companies trick you into sharing info to sell to telemarketers. Read more
Who’s eligible for a refund from Amazon?: Amazon agreed to pay $2.5B for enrolling users in Prime without consent, making cancellation hard. Read more

Regulatory Fines & Enforcement Actions

Facebook’s job ads algorithm is sexist: French regulator rules Facebook’s job ad algorithm is discriminatory, skewing ads by gender. Read more
US sanctions North Korean bankers linked to cybercrime: The U.S. Treasury Department imposed sanctions on North Korean financial institutions involved in laundering stolen cryptocurrency. Read more

Surveillance

Phone location data of top EU officials for sale: Journalists found it easy to spy on top EU officials using commercially obtained location histories. Read more
DHS proposes biometrics expansion for immigrants: DHS is looking to increase its collection of biometrics, including from some U.S. citizens. Read more

WordPress Exploit, Ransomware & AI Compliance – 11/05/2025

info@grabtheaxe.com (Chris Armour) — Wed, 05 Nov 2025 00:00:00 GMT

This compliance intelligence digest highlights critical vulnerabilities, including an active threat targeting 400,000 WordPress sites and a ransomware attack on a New Jersey medical center. We also cover emerging risks in software update tools and the increasing sophistication of ransomware attacks in Europe. Stay informed about key regulatory updates and compliance frameworks to protect your organization.

Top 5 Critical Compliance Alerts

Critical Site Takeover Flaw Affects 400K WordPress Sites: Attackers are actively exploiting a vulnerability in the Post SMTP plugin, potentially compromising accounts and websites. Read more
New Jersey Medical Center Suffers Ransomware Attack: Central Jersey Medical Center experienced a ransomware attack, impacting patient data and operations. Read more
Risk ‘Comparable’ to SolarWinds Incident Lurks in Popular Software Update Tool: A widely used software update tool contains a risk that could introduce malware, affecting numerous technology companies. Read more
Europe Sees Increase in Ransomware, Extortion Attacks: European organizations are facing a surge in cyberattacks, with attackers exploiting geopolitical tensions and AI-enhanced social engineering. Read more
Federal AI Contracts and the New Era of False Claims Act Enforcement: Increased federal investment in AI contracts is leading to greater scrutiny and enforcement under the False Claims Act. Read more

Compliance Frameworks

What is SOC2 Audit & Can it Replace a Business Associate Agreement?: An explanation of SOC2 audits and their potential role in fulfilling Business Associate Agreement requirements. Read more
SOC 2 Compliance Checklist: Why it Doesn’t Exist (And What to Do Instead): Discusses the lack of a definitive SOC 2 checklist and offers alternative approaches to prepare for audits. Read more

Regulatory Updates

Michigan Lawmakers Consider Raising MIOSHA Penalties to Match Federal Levels: Legislation is being considered to increase Michigan Occupational Safety and Health Administration (MIOSHA) penalties to align with federal OSHA standards. Read more
Rhode Island’s New Hire Notice Requirements Go Live Jan. 1, Impacting All Employers: Starting January 1, 2026, Rhode Island employers must provide new hires with written notices containing key employment terms. Read more
California Prevailing Wage Compliance: The Three P’s to Know: An overview of California’s prevailing wage requirements for public works projects and how to ensure compliance. Read more
December 1, 2025 FCC EEO Deadlines for Stations in AL, GA, CO, MN, MT, ND, SD, CT, ME, MA, NH, RI, and VT: Radio and television stations in specified states must prepare and post an annual EEO Public File Report by December 1, 2025. Read more

Third-Party Risk & Due Diligence

Is Supplier–Manufacturer Collaboration Easier with PartnerQuest by CQ?: Explores how PartnerQuest by CQ can streamline collaboration between suppliers and manufacturers. Read more

ICS Vulnerabilities, WordPress Exploit & Russian Malware – 11/04/2025

info@grabtheaxe.com (Chris Armour) — Tue, 04 Nov 2025 00:00:00 GMT

Today’s threat landscape is dominated by critical vulnerabilities in Industrial Control Systems (ICS), with CISA issuing alerts for aviation weather and surveillance systems carrying a CVSS score of 10.0. Concurrently, threat actors are actively exploiting a widespread vulnerability in a popular WordPress plugin to hijack administrator accounts. This summary also covers a novel malware evasion technique used by Russian hackers and the concerning merger of three major cybercrime groups into a unified collective.

Top 5 Critical Security Alerts

Radiometrics VizAir Vulnerabilities: CISA warns of multiple critical vulnerabilities (CVSS 10.0) in aviation weather systems, allowing remote, unauthenticated attackers to manipulate weather data and disrupt airport operations. Read more
CISA Adds Two Known Exploited Vulnerabilities to Catalog: CISA has added vulnerabilities in Gladinet CentreStack/Triofox (CVE-2025-11371) and CWP Control Web Panel (CVE-2025-48703) to its KEV catalog, indicating active exploitation. Read more
Hackers Exploit WordPress Post SMTP Plugin: Threat actors are actively exploiting a critical vulnerability in the Post SMTP plugin, affecting over 400,000 sites, to hijack administrator accounts and gain full control. Read more
Russian Hackers Abuse Hyper-V to Hide Malware in Linux VMs: The Russian-aligned group ‘Curly COMrades’ is using a novel technique, hiding malware in a hidden Alpine Linux VM on Windows systems to bypass EDR solutions. Read more
Survision LPR Camera Lacks Authentication: A critical vulnerability (CVSS 9.3) in Survision’s License Plate Recognition cameras allows attackers full system access without authentication due to password protection being off by default. Read more

Threat Intelligence

A Cybercrime Merger Like No Other: Scattered Spider, LAPSUS$, and ShinyHunters Join Forces: Three notorious cybercrime groups have reportedly merged, forming a powerful collective for coordinated extortion and data theft operations. Read more
SesameOp Backdoor Uses OpenAI API for Covert C2: A novel backdoor named ‘SesameOp’ has been discovered using OpenAI’s Assistants API for stealthy command-and-control communications, evading traditional detection methods. Read more
U.S. Prosecutors Indict Insiders for BlackCat Ransomware Attacks: Federal prosecutors have indicted three individuals for allegedly using BlackCat ransomware to attack and extort five U.S. companies, including a medical device manufacturer. Read more
Malicious Android Apps on Google Play Downloaded 42 Million Times: A Zscaler report reveals that hundreds of malicious Android applications available on the official Google Play Store have been downloaded over 42 million times in the past year. Read more
Critical React Native CLI Flaw Exposed Developers to Remote Attacks: A now-patched critical vulnerability in a popular React Native npm package could have allowed remote unauthenticated attackers to execute arbitrary OS commands on developer machines. Read more
Microsoft Teams Bugs Let Attackers Impersonate Colleagues: Check Point disclosed four security flaws in Microsoft Teams that could allow attackers to manipulate conversations, impersonate users, and exploit notifications for social engineering. Read more

Security Breaches & Incidents

Data Breach at Major Swedish Software Supplier Impacts 1.5 Million: Swedish IT supplier Miljödata suffered a cyberattack that exposed the personal data of 1.5 million people, prompting an investigation by the country’s privacy authority. Read more
Phone Location Data of Top EU Officials for Sale: A new report reveals that commercially available location data from data brokers can be easily used to track the movements of high-ranking European Union officials. Read more
Media Giant Nikkei Reports Data Breach Impacting 17,000 People: Japanese publisher Nikkei disclosed that its Slack platform was compromised, exposing the personal information of more than 17,000 employees and business partners. Read more
Apache OpenOffice Disputes Data Breach Claims by Ransomware Gang: The Apache Software Foundation is disputing claims made by the Akira ransomware gang that they successfully breached the OpenOffice project and stole 23 GB of documents. Read more
Polish Loan Platform Hacked; Multiple Businesses Disrupted: A series of cyberattacks in Poland have disrupted a loan platform, a mobile payment system, and other businesses, with officials calling such incidents ‘commonplace’. Read more

Security Tools & Best Practices

Microsoft Removing Defender Application Guard from Office: Microsoft has announced plans to deprecate and eventually remove the Defender Application Guard sandboxing feature from Microsoft Office, with removal set for December 2027. Read more
The Top 3 Browser Sandbox Threats That Slip Past Modern Security Tools: Attackers are increasingly exploiting browsers’ built-in behaviors to steal credentials and move laterally, bypassing traditional security defenses that lack browser-layer visibility. Read more

Cloud & Network Security

Identity Is Now the Top Source of Cloud Risk: According to ReliaQuest data from Q3, identity-related issues were the root cause of 44% of all cloud security alerts, making it the primary source of risk in cloud environments. Read more

Security Standards & Frameworks

CISA Releases Five Industrial Control Systems Advisories: CISA has published five new ICS advisories detailing vulnerabilities in products from Fuji Electric, Survision, Delta Electronics, Radiometrics, and IDIS. Read more

Emerging Security Technologies

Google’s AI ‘Big Sleep’ Finds 5 New Vulnerabilities in Apple’s Safari WebKit: Google’s AI-powered security agent, ‘Big Sleep,’ has discovered five security flaws in Apple’s WebKit browser engine, highlighting the potential of AI in vulnerability research. Read more

OpenAI Backdoor, Healthcare Breach & Ransomware – 11/04/2025

info@grabtheaxe.com (Chris Armour) — Tue, 04 Nov 2025 00:00:00 GMT

Today’s compliance intelligence digest highlights critical security and regulatory updates. Key alerts include a new malware campaign leveraging the OpenAI API, a significant healthcare data breach affecting over 92,000 patients, and indictments related to BlackCat ransomware attacks. Also covered are regulatory updates from the FCA and new compliance requirements in Rhode Island.

Top 5 Critical Compliance Alerts

SesameOp Backdoor Uses OpenAI API for Covert C2: New malware campaign uses OpenAI API for command and control, demonstrating misuse of generative AI services. Read more
Oglethorpe Hacking Incident Affects More Than 92,000 Patients: A Tampa, FL-based mental health network disclosed a security incident affecting over 92,000 patients. Read more
U.S. Nationals Indicted for BlackCat Ransomware Attacks on Healthcare Organizations: Two U.S. nationals have been indicted for using BlackCat ransomware to target healthcare organizations. Read more
Android Malware Mutes Alerts, Drains Crypto Wallets: New Android malware, BankBot-YNRK, targets Indonesian users by masquerading as legitimate applications to steal cryptocurrency. Read more
Training failures leave UK firms exposed under new data law: VinciWorks survey reveals that fewer than 2% of organizations are fully ready for the Data Use and Access Act, with staff training emerging as the single biggest compliance gap. Read more

Compliance Frameworks

How DORA fits with ISO 27001, NIS2 and the GDPR: Article discusses how DORA builds on existing frameworks like ISO 27001, NIS2, and GDPR for ICT risk governance in the EU financial sector. Read more

Regulatory Updates

AML in practice: What the Law Society’s SARs review means for Scottish legal firms: The Law Society of Scotland’s SARs Thematic Review examines AML reporting obligations for Scottish legal practices. Read more
FCA Updates Treasury Select Committee on Non-Financial Misconduct: Now is The Time to Take Action: The FCA updates its approach to non-financial misconduct, emphasizing it as a regulatory issue. Read more
Rhode Island’s New Hire Notice Requirements Go Live Jan. 1, Impacting All Employers: Effective Jan. 1, 2026, Rhode Island employers must provide new hires with written notice of employment terms. Read more

Third-Party Risk & Due Diligence

On the Road Again: Hackers Hijack Physical Cargo Freight: Attackers are using remote monitoring tools to steal physical cargo in the trucking and freight supply chain. Read more

Policy & Governance Updates

AdvaMed modernizes its code of ethics for the digital era: AdvaMed updates its Code of Ethics on Interactions with US Health Care Professionals. Read more
Bermuda: New Beneficial Ownership Framework: Bermuda implements a new beneficial ownership framework with the Beneficial Ownership Act 2025. Read more

Racist Policing, Ring Privacy, App Censorship & Payroll Scams – 11/04/2025

info@grabtheaxe.com (Chris Armour) — Tue, 04 Nov 2025 00:00:00 GMT

Today’s privacy and security landscape is marked by significant threats, including racist policing practices enabled by surveillance technology and the concerning privacy implications of Amazon Ring’s facial recognition features. The increasing control over app availability by governments and platforms raises censorship alarms, while cybercriminals are actively targeting payroll systems. Stay informed to protect your data and digital rights.

Top 5 Critical Privacy Alerts

License Plate Surveillance Logs Reveal Racist Policing Against Romani People: EFF uncovers racist policing practices using license plate readers, targeting Romani people based on harmful stereotypes. Read more
The Legal Case Against Ring’s Face Recognition Feature: Amazon Ring’s face recognition tool raises privacy concerns, potentially violating biometric privacy laws with mass surveillance risks. Read more
Application Gatekeeping: An Ever-Expanding Pathway to Internet Censorship: Governments and platforms are increasingly controlling app availability, raising censorship concerns and impacting developer freedom. Read more
Cybercriminals Targeting Payroll Sites: Microsoft warns of payroll scams using social engineering to steal credentials and divert direct deposits into attacker-controlled accounts. Read more
Hacker steals over $120 million from Balancer DeFi crypto protocol: Hackers targeted Balancer Protocol’s v2 pools, resulting in losses estimated to be over $128 million. Read more

CryptoCurrency

Hacker steals over $120 million from Balancer DeFi crypto protocol: Hackers targeted Balancer Protocol’s v2 pools, resulting in losses estimated to be over $128 million. Read more

HIPAA

HIPAA Security Rule: Still on Track for Finalization: Despite criticisms, the proposed HIPAA Security Rule overhaul is still progressing, raising concerns and hopes within the healthcare community. Read more

Health Information Security

HIPAA Security Rule: Still on Track for Finalization: Despite criticisms, the proposed HIPAA Security Rule overhaul is still progressing, raising concerns and hopes within the healthcare community. Read more

Health Privacy

HIPAA Security Rule: Still on Track for Finalization: Despite criticisms, the proposed HIPAA Security Rule overhaul is still progressing, raising concerns and hopes within the healthcare community. Read more

Microsoft

Windows 10 update bug triggers incorrect end-of-support alerts: Microsoft acknowledges that October 2025 updates are causing false end-of-support warnings on active Windows 10 systems. Read more
Microsoft: SesameOp malware abuses OpenAI Assistants API in attacks: New backdoor malware, SesameOp, uses OpenAI Assistants API as a covert command-and-control channel, discovered by Microsoft. Read more
Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching: An update for a WSUS vulnerability has broken hotpatching on some Windows Server 2025 devices, according to Microsoft. Read more

Privacy

HIPAA Security Rule: Still on Track for Finalization: Despite criticisms, the proposed HIPAA Security Rule overhaul is still progressing, raising concerns and hopes within the healthcare community. Read more

Security

Russian hackers abuse Hyper-V to hide malware in Linux VMs: Curly COMrades are using Microsoft Hyper-V to hide malware in Linux VMs, bypassing endpoint detection solutions. Read more
Hackers exploit critical auth bypass flaw in JobMonster WordPress theme: A critical vulnerability in the JobMonster WordPress theme allows hackers to hijack administrator accounts under specific conditions. Read more
Fake Solidity VSCode extension on Open VSX backdoors developers: A malicious Solidity VSCode extension, SleepyDuck, uses an Ethereum smart contract to communicate with attackers. Read more
Microsoft: SesameOp malware abuses OpenAI Assistants API in attacks: New backdoor malware, SesameOp, uses OpenAI Assistants API as a covert command-and-control channel, discovered by Microsoft. Read more
US cybersecurity experts indicted for BlackCat ransomware attacks: Former cybersecurity employees are indicted for allegedly hacking networks in BlackCat ransomware attacks. Read more
Hackers use RMM tools to breach freighters and steal cargo shipments: Threat actors are deploying RMM tools via malicious links to hijack cargo and steal physical goods from freight brokers. Read more
Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching: An update for a WSUS vulnerability has broken hotpatching on some Windows Server 2025 devices, according to Microsoft. Read more
OAuth Device Code Phishing: Azure vs. Google Compared: Device code phishing abuses the OAuth device flow, with different attack surfaces on Google and Azure platforms. Read more

Uncategorized

Get a credit freeze to stop identity thieves: Freezing your credit is a great way to help protect yourself from identity theft. Read more
How to spot a job scam: Learn how to identify phony business opportunities, work-at-home scams, and shady employment agencies. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: Prepare for emergencies and learn how to spot disaster-related scams to protect yourself and older adults. Read more
How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft; learn how to protect them. Read more
No, that’s not an FTC commissioner on the phone: Scammers impersonate FTC officials to try to get your money; the FTC will never ask you to move your money. Read more
Who’s eligible for a refund from Amazon?: Amazon will pay $2.5 billion to settle FTC charges of enrolling people in Prime without consent; $1.5B goes to consumers. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: Learn how sharing your information online can lead to unwanted telemarketing calls and how to reduce them. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: Protect yourself from scams during Medicare Open Enrollment by learning to spot them. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Take key steps to avoid scams when selling your timeshare. Read more
Before you donate, find out where the money is going: The FTC says Kars-R-Us.com lied about how donated money would be spent on a breast cancer charity. Read more
Football Manager 26 review –a modern sim for the modern game: A review of Football Manager 26, highlighting its upgraded graphics and data-driven gameplay. Read more
Rise of the ‘porno-trolls’: how one porn platform made millions suing its viewers: Strike 3, a porn platform owner, has clogged US courts with copyright lawsuits against porn watchers. Read more
Cybercriminals Targeting Payroll Sites: Microsoft warns of payroll scams using social engineering to steal credentials and divert direct deposits into attacker-controlled accounts. Read more
AI firm wins high court ruling after photo agency’s copyright claim: Stability AI wins a high court case against Getty Images over the use of copyrighted data for AI models. Read more
Elon Musk’s $1tn Tesla pay deal to be rejected by huge Norway wealth fund: Norway’s sovereign wealth fund will vote against Elon Musk’s $1tn pay package at Tesla’s annual shareholder meeting. Read more
European Commission launches a call for evidence on the impact assessment for the forthcoming EU Quantum Act: The European Commission seeks evidence on the impact assessment for the upcoming EU Quantum Act. Read more
Apple Watch SE 3 review: the bargain smartwatch for iPhone: A review of the Apple Watch SE 3, highlighting its features and affordability for iPhone users. Read more
The Legal Case Against Ring’s Face Recognition Feature: Amazon Ring’s face recognition tool raises privacy concerns, potentially violating biometric privacy laws with mass surveillance risks. Read more
Pornography depicting strangulation to become criminal offence in the UK: Possessing or publishing porn featuring strangulation will become a criminal offence in the UK. Read more
License Plate Surveillance Logs Reveal Racist Policing Against Romani People: EFF uncovers racist policing practices using license plate readers, targeting Romani people based on harmful stereotypes. Read more
Application Gatekeeping: An Ever-Expanding Pathway to Internet Censorship: Governments and platforms are increasingly controlling app availability, raising censorship concerns and impacting developer freedom. Read more
The best meditation apps to quit doomscrolling and find peace instead: A guide to the best meditation apps for reducing stress and improving focus. Read more
EFF Stands With Tunisian Media Collective Nawaat: EFF supports Nawaat, a Tunisian media collective, after the government suspended its activities, citing concerns over press freedom. Read more
What EFF Needs in a New Executive Director: EFF seeks a visionary and collaborative executive director to lead the organization in its mission. Read more
OpenAI signs $38bn cloud computing deal with Amazon: OpenAI signs a $38 billion deal with Amazon to use AWS infrastructure for its AI products. Read more

banking

Cybercriminals Targeting Payroll Sites: Microsoft warns of payroll scams using social engineering to steal credentials and divert direct deposits into attacker-controlled accounts. Read more

credentials

Cybercriminals Targeting Payroll Sites: Microsoft warns of payroll scams using social engineering to steal credentials and divert direct deposits into attacker-controlled accounts. Read more

scams

Cybercriminals Targeting Payroll Sites: Microsoft warns of payroll scams using social engineering to steal credentials and divert direct deposits into attacker-controlled accounts. Read more

social engineering

Cybercriminals Targeting Payroll Sites: Microsoft warns of payroll scams using social engineering to steal credentials and divert direct deposits into attacker-controlled accounts. Read more

Data Breaches, AI Manipulation & User Consent – 11/03/2025

info@grabtheaxe.com (Chris Armour) — Mon, 03 Nov 2025 00:00:00 GMT

This privacy digest highlights critical data breaches, including a significant incident at the University of Pennsylvania, and supply chain attacks via Open VSX. We also cover the arrest of an alleged Jabber Zeus coder and explore the manipulation of AI summarization tools. Finally, we provide essential guidance on protecting personal data and avoiding scams, emphasizing user consent and data minimization.

Top 5 Critical Privacy Alerts

Penn hacker claims 1.2 million donor data breach; A hacker claims responsibility for the University of Pennsylvania data breach, exposing 1.2 million donor records. Read more
Open VSX rotates access tokens after supply-chain malware attack; Open VSX rotated access tokens after a leak allowed attackers to publish malicious extensions. Read more
Alleged Jabber Zeus Coder ‘MrICQ’ in U.S. Custody: Yuriy Igorevich Rybtsov, aka MrICQ, a developer for the Jabber Zeus cybercrime group, is now in U.S. custody. Read more
AI Summarization Optimization: Meeting attendees may manipulate AI notetakers by using specific language to be captured in summaries. Read more
Microsoft: Windows Task Manager won’t quit after KB5067036 update: A known issue prevents users from quitting Windows 11 Task Manager after installing the October 2025 update. Read more

Data Minimization & User Consent

Get a credit freeze to stop identity thieves: Freezing your credit is a great way to protect yourself from identity theft; here’s what to know. Read more
How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft; learn how to help protect them. Read more
No, that’s not an FTC commissioner on the phone: Scammers pretend to be FTC officials to get your money; the FTC will never ask you to move your money. Read more
Before you donate, find out where the money is going: The FTC says Kars-R-Us.com lied about how vehicle donations would be spent on a breast cancer charity. Read more
How to spot a job scam: Learn how to identify phony business opportunities, work-at-home scams, and shady employment agencies. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: Have a plan and know how to spot disaster-related scams to protect yourself during emergencies. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: Scammers become more active during Medicare Open Enrollment; learn how to spot and avoid them. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Be cautious when selling your timeshare; learn how to avoid scams. Read more
Who’s eligible for a refund from Amazon?: Amazon agreed to pay $2.5 billion for enrolling people in Prime without consent; $1.5 billion will go back to consumers. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: Companies trick you into sharing info, then sell it to telemarketers; learn how to cut down on unwanted calls. Read more

DeFi Heist, Insider Threats & AI Malware – 11/03/2025

info@grabtheaxe.com (Chris Armour) — Mon, 03 Nov 2025 00:00:00 GMT

Today’s security landscape is marked by audacious insider threats, including the indictment of US ransomware negotiators for conducting their own attacks and an executive selling zero-day exploits to Russia. A massive $128 million DeFi heist highlights ongoing risks in the cryptocurrency space. Additionally, a novel malware campaign has been discovered using OpenAI’s API for covert command-and-control, showcasing the evolving abuse of emerging technologies by threat actors.

Top 5 Critical Security Alerts

Hacker steals over $120 million from Balancer DeFi crypto protocol: A major DeFi exploit on the Balancer Protocol has resulted in the theft of over $128 million in cryptocurrency, marking a significant financial breach. Read more
How an ex-L3Harris Trenchant boss stole and sold cyber exploits to Russia: A former executive at defense contractor L3Harris Trenchant, Peter Williams, has been exposed for stealing and selling eight zero-day exploits to a Russian broker. Read more
DOJ accuses US ransomware negotiators of launching their own ransomware attacks: The DOJ has indicted three individuals, including two US ransomware negotiators, for allegedly conducting ALPHV/BlackCat ransomware attacks themselves in an unprecedented insider plot. Read more
Microsoft: SesameOp malware abuses OpenAI Assistants API in attacks: Microsoft has identified a new backdoor malware, SesameOp, which cleverly uses the OpenAI Assistants API for its command-and-control communications to evade detection. Read more
Fake Solidity VSCode extension on Open VSX backdoors developers: A malicious VSCode extension for Solidity developers, named SleepyDuck, has been found on the Open VSX registry, using an Ethereum smart contract for C2 communications. Read more

Threat Intelligence

New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea: The Kimsuky APT group is using a new backdoor called HttpTroy, disguised as a VPN invoice, in targeted spear-phishing attacks against entities in South Korea. Read more
Android Malware Mutes Alerts, Drains Crypto Wallets: A new Android banking trojan, BankBot-YNRK, is targeting users in Indonesia by masquerading as legitimate applications to mute security alerts and steal from crypto wallets. Read more
Researchers Uncover BankBot-YNRK and DeliveryRAT Android Trojans Stealing Financial Data: Analysis reveals two Android trojans, BankBot-YNRK and DeliveryRAT, are actively harvesting sensitive financial data from compromised mobile devices. Read more

Security Breaches & Incidents

Data breach costs lead to 90% drop in operating profit at South Korean telecom giant: SK Telecom’s operating profit plummeted by 90% due to the high costs of compensating customers and recovery efforts after a massive data breach affecting 27 million people. Read more
Cargo theft gets a boost from hackers using remote monitoring tools: Threat actors are using Remote Monitoring and Management (RMM) tools to infiltrate trucking and logistics companies, enabling them to hijack and steal physical cargo shipments. Read more
Japanese retailer Askul confirms data leak after cyberattack claimed by Russia-linked group: Online retailer Askul has confirmed a data breach exposing customer and supplier information following a cyberattack attributed to a Russia-linked threat group. Read more

Security Tools & Best Practices

Ground zero: 5 things to do after discovering a cyberattack: An essential guide outlines the first five critical steps an organization should take immediately after discovering a cyberattack to contain the threat and mitigate damage. Read more
AI Developed Code: 5 Critical Security Checkpoints for Human Oversight: Experts outline five essential security checkpoints where human developers must review AI-generated code to prevent introducing vulnerabilities. Read more

Cloud & Network Security

Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching: A recent Microsoft out-of-band patch for an actively exploited Windows Server Update Service (WSUS) vulnerability has inadvertently broken the hotpatching feature. Read more
OAuth Device Code Phishing: Azure vs. Google Compared: A technical comparison explores the different attack surfaces and risks for OAuth device code phishing when targeting Microsoft Azure versus Google Cloud environments. Read more

Security Standards & Frameworks

Lawmakers ask FTC to probe Flock Safety’s cybersecurity practices: US lawmakers are urging the Federal Trade Commission to investigate surveillance tech provider Flock Safety’s security measures, citing concerns over weak account protection. Read more
CISA and NSA Outline Best Practices to Secure Exchange Servers: CISA and the NSA have jointly released a new blueprint with best practices and guidelines to help organizations harden their Microsoft Exchange Servers against attacks. Read more

Emerging Security Technologies

A self-rewriting AI from KAUST revives Jürgen Schmidhuber’s vision of a Gödel Machine: Researchers have developed the Huxley-Gödel Machine (HGM), an AI agent capable of evolving by rewriting and improving its own source code. Read more

Data Breach, AML Reform, & AI Governance – 10/28/2025

info@grabtheaxe.com (Chris Armour) — Tue, 28 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights a concerning data breach affecting over 10 million patients, alongside growing threats from North Korean crypto heists and increasing scrutiny of tax advisors. UK’s AML reforms and FCA’s expanded supervisory role are also key developments. Additionally, boards are urged to prioritize cyber security and understand the implications of agentic AI, while UK employers face evolving sexual harassment compliance laws.

Top 5 Critical Compliance Alerts

More Than 10 Million Patients Affected by Conduent Business Solutions Data Breach: A data breach at a business associate of several HIPAA-covered entities has resulted in the exposure of over 10 million patient records. Read more
North Korea’s BlueNoroff Expands Scope of Crypto Heists: Campaigns targeting fintech and Web3 developers use fake business collaboration and job recruitment lures. Read more
Tax advisor crackdowns are coming and the new rules and risks leave no room for error: HMRC is increasing scrutiny and accountability for tax professionals, with prosecutors targeting firms that fail to prevent tax evasion. Read more
Cyber Security Must Be a Board Priority – And It Starts With Cyber Essentials: Senior ministers and national security officials urge boards to strengthen cyber resilience, starting with Cyber Essentials. Read more
Memento Spyware Tied to Chrome Zero-Day Attacks: Researchers uncovered a new spyware product from Memento Labs linked to Chrome zero-day exploits. Read more

Compliance Frameworks

HIPAA Compliance Team: Choosing the Right Compliance Professionals for Your Organization: Guidance on selecting the appropriate compliance professionals for your organization to ensure HIPAA compliance. Read more

Regulatory Updates

UK AML Reform in 2025: A Public Recalibration of Risk and Responsibility: Major developments including the national risk assessment and draft regulatory amendments mark a strategic shift in UK AML efforts. Read more
FCA to Become UK’s Sole AML/CTF Supervisor for Professional Services Firms: The Financial Conduct Authority (FCA) will assume sole responsibility for supervising AML/CTF for legal, accountancy, and trust service providers in the UK. Read more
The Asia-Pacific compliance outlook: Are you ready for 2026 regulations?: Overview of major compliance reforms coming online in Asia-Pacific in 2026, covering AML, data protection, AI governance, and more. Read more

Policy & Governance Updates

What Boards Need to Know (and Ask) About Agentic AI: Strategic questions for board directors and senior leadership to understand the implications of agentic AI. Read more
Sexual harassment compliance in the UK: Your essential FAQ for the Worker Protection Act and Employment Rights Act: Essential information on the evolving sexual harassment laws in the UK, including the Worker Protection Act and Employment Rights Act. Read more

Social Engineering, Malware, 2FA & AI Strategy – 10/28/2025

info@grabtheaxe.com (Chris Armour) — Tue, 28 Oct 2025 00:00:00 GMT

This privacy digest highlights critical threats including social engineering attacks via credit card scams originating from China, and the need for X users to re-enroll 2FA keys. Also covered are the EU’s AI strategy, Android malware mimicking human typing, and the exploitation of Chrome zero-day vulnerabilities by Italian spyware vendors. Stay informed to protect your data and systems.

Top 5 Critical Privacy Alerts

Social Engineering Credit Card Details: Criminal gangs in China are scamming people out of credit card information via texts, amassing over $1 billion. Read more
X: Re-enroll 2FA Security Keys: Users must re-enroll their security keys/passkeys for 2FA by Nov 10 or be locked out. Read more
New Herodotus Android Malware: This malware family mimics human typing to evade detection by security software. Read more
BiDi Swap URL Phishing: Attackers are using bidirectional text to make fake URLs look real, exploiting a browser flaw. Read more
Italian Spyware Chrome Zero-Day: An Italian spyware vendor is linked to Chrome zero-day attacks via Operation ForumTroll. Read more

Privacy Laws & Regulations

European Commission AI Strategy: The EU aims to accelerate AI adoption across sectors with a comprehensive policy framework. Read more
US Law & Medical Debt Reporting: Federal law overrides state bans on medical debt reporting, according to the CFPB. Read more
UN Cyber Crime Treaty: Despite privacy concerns, a UN cyber crime treaty wins support from 72 nations. Read more

TEE.Fail Attack, Qilin Ransomware, CISA Alerts & BlueNoroff – 10/28/2025

info@grabtheaxe.com (Chris Armour) — Tue, 28 Oct 2025 00:00:00 GMT

Today’s threat landscape is highlighted by the disclosure of TEE.Fail, a severe side-channel attack capable of compromising secure enclaves in modern CPUs from Intel, AMD, and NVIDIA. CISA has also issued an urgent warning, adding two actively exploited Dassault Systèmes vulnerabilities to its KEV catalog. Meanwhile, threat actors continue to innovate, with the Qilin ransomware gang now using WSL for evasive attacks and the BlueNoroff APT deploying new multi-platform malware.

Top 5 Critical Security Alerts

CISA Adds Two Actively Exploited Dassault Vulnerabilities to KEV Catalog: CISA warns that two vulnerabilities in Dassault Systèmes’ DELMIA Apriso (CVE-2025-6204 & CVE-2025-6205) are being actively exploited, requiring immediate patching by federal agencies. Read more
TEE.Fail Attack Breaks Confidential Computing on Intel, AMD, NVIDIA CPUs: Researchers have developed a new side-channel attack named TEE.Fail, capable of extracting secrets from the Trusted Execution Environment (TEE) in modern CPUs from major vendors. Read more
Qilin Ransomware Abuses WSL to Run Linux Encryptors in Windows: The Qilin ransomware group is leveraging the Windows Subsystem for Linux (WSL) to execute its Linux-based encryptors on Windows systems, a novel technique designed to evade detection. Read more
BlueNoroff APT Unveils New Malware Campaigns Targeting macOS and Windows: The North Korean APT group BlueNoroff is behind the ‘GhostCall’ and ‘GhostHire’ campaigns, using sophisticated, multi-stage malware to target cryptocurrency and Web3 sectors. Read more
New ‘Herodotus’ Android Malware Mimics Human Typing to Evade Detection: A new Android banking trojan, Herodotus, uses randomized delays to mimic human input, allowing it to bypass behavioral biometric security and perform device takeover attacks. Read more

Threat Intelligence

Researchers Warn of Prolific Qilin Ransomware Gang: The Qilin ransomware group has intensified its attacks, adding over 185 victims to its leak site in October alone and targeting major organizations across various sectors. Read more
‘BiDi Swap’ Phishing Trick Makes Fake URLs Look Authentic: Attackers are reviving a decade-old browser flaw using bidirectional text to create deceptive URLs for phishing campaigns, making it difficult for users to spot malicious links. Read more
New Atroposia MaaS Platform Includes Local Vulnerability Scanner: A new Malware-as-a-Service (MaaS) named Atroposia offers a remote access trojan (RAT) equipped with data theft capabilities and a built-in local vulnerability scanner to find additional exploits. Read more

Security Breaches & Incidents

Advertising Giant Dentsu Reports Data Breach at Subsidiary Merkle: Dentsu has disclosed a cybersecurity incident at its US subsidiary Merkle, which resulted in the exposure of both employee and client data. Read more

Security Tools & Best Practices

Keys to the Kingdom: A Defender’s Guide to Privileged Account Monitoring: A comprehensive guide from Google Cloud’s threat intelligence team details strategies for preventing, detecting, and responding to intrusions that target privileged accounts. Read more
Windows 11 Update Rolls Out New ‘Administrator Protection’ Feature: Microsoft’s latest preview update for Windows 11 (KB5067036) introduces Administrator Protection, a new feature designed to enhance system security against unauthorized changes. Read more
Google Chrome to Warn Users Before Opening Insecure HTTP Sites: Starting in October 2026 with version 154, Google Chrome will require user permission before connecting to insecure HTTP websites, aiming to further push the web towards HTTPS. Read more
CyDeploy Offers ‘Digital Twin’ System for Secure Update Testing: Startup CyDeploy is developing a platform that uses machine learning to create a replica of a company’s system, allowing for safe testing of patches and updates before deployment. Read more

Security Standards & Frameworks

CISA Releases Three Industrial Control Systems (ICS) Advisories: CISA has published advisories for vulnerabilities in Schneider Electric EcoStruxure and Vertikal Systems Hospital Manager, urging critical infrastructure operators to apply mitigations. Read more

Emerging Security Technologies

Microsoft Sued in Australia Over Deceptive Copilot Subscriptions: The ACCC is suing Microsoft for allegedly misleading 2.7 million Australians into paying for Copilot AI subscriptions within the Microsoft 365 service. Read more
OpenAI Restructures, Microsoft Increases Stake to 27 Percent: OpenAI has completed a major corporate restructuring under a new foundation, with Microsoft solidifying its partnership by taking a nearly one-third stake in the AI company. Read more

Ransomware, Data Breach, & FATF Updates – 10/27/2025

info@grabtheaxe.com (Chris Armour) — Mon, 27 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates in regulatory enforcement, data security, and policy governance. Key alerts include a Linux-based ransomware targeting Windows hosts, a significant HIPAA data breach settlement, and multiple healthcare data breaches. Stay informed on FATF’s updated AML guidance and strategies for effective compliance incentives.

Top 5 Critical Compliance Alerts

Qilin Targets Windows Hosts With Linux-Based Ransomware: Attack demonstrates evasion strategy that can stump defenses not equipped to detect cross-platform threats. Read more
Yale New Haven Health Agrees to $18 Million Data Breach Settlement: An $18 million settlement proposed to resolve claims stemming from a 2025 data breach. Read more
Data Breaches Announced by ModMed, LifeBridge Health & Right at Home: Data breaches announced by EHR provider Modernizing Medicine (ModMed), Baltimore healthcare provider LifeBridge Health, and Right at Home. Read more
FATF October 2025 plenary: Newly updated guide to every high risk jurisdiction for money laundering: Four countries exited the FATF Grey List reflecting strengthened AML/CFT controls. Read more

Regulatory Updates

FATF October 2025 plenary: Newly updated guide to every high risk jurisdiction for money laundering: Four countries exited the FATF Grey List reflecting strengthened AML/CFT controls. Read more
Do the Enforcement Choices Match the “America First” Antitrust Rhetoric?: Analysis suggests antitrust laws have been underenforced for decades. Read more

Compliance Frameworks

Yale New Haven Health Agrees to $18 Million Data Breach Settlement: An $18 million settlement proposed to resolve claims stemming from a 2025 data breach. Read more
Data Breaches Announced by ModMed, LifeBridge Health & Right at Home: Data breaches announced by EHR provider Modernizing Medicine (ModMed), Baltimore healthcare provider LifeBridge Health, and Right at Home. Read more

Policy & Governance Updates

Holiday Housekeeping: 4 Employee Handbook Policies to Make Sure You’ve Got Right Before 2026: Employee handbook is key for setting workplace expectations and staying compliant. Read more
Getting Started on Compliance Incentives: Structuring and using incentives in an ethics and compliance program can be tricky but beneficial. Read more

Spyware, AI Strategy, Data Privacy – 10/27/2025

info@grabtheaxe.com (Chris Armour) — Mon, 27 Oct 2025 00:00:00 GMT

This privacy digest highlights critical alerts, including a Chrome zero-day linked to an Italian spyware vendor and CISA’s order to patch a Windows Server flaw. Also covered are NYDFS guidance on third-party service provider risks, EFF’s stance against the UN Cybercrime Convention, and a deep dive into First Wap’s global surveillance operations. Stay informed on the latest threats and regulatory actions.

Top 5 Critical Privacy Alerts

Italian spyware vendor linked to Chrome zero-day attacks: Malware linked to Memento Labs exploited a Chrome zero-day. Read more
CISA orders feds to patch Windows Server WSUS flaw used in attacks: CISA mandates patching a critical Windows Server vulnerability exploited in attacks. Read more
NYDFS Issues Guidance on Managing Risks Related to Third-Party Service Providers: NYDFS outlines guidance on managing risks from third-party service providers. Read more
Joint Statement on the UN Cybercrime Convention: EFF and Global Partners Urge Governments Not to Sign: EFF urges governments not to sign the UN Cybercrime Convention due to human rights concerns. Read more
First Wap: A Surveillance Computer You’ve Never Heard Of: Surveillance firm First Wap’s phone-tracking empire extends globally. Read more

Privacy Laws & Regulations

EU Member States Begin Rolling Out New Product Liability Rules: EU states update product liability laws to align with the new Product Liability Directive. Read more
European Commission Publishes Apply AI Strategy to Accelerate Sectoral AI Adoption Across the EU: The EU Commission releases its AI Strategy to boost AI adoption across sectors. Read more

Data Minimization & User Consent

Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF shares daily tips on opting out of tech giants’ surveillance. Read more

WSUS Flaw, Qilin Ransomware & Italian Spyware – 10/27/2025

info@grabtheaxe.com (Chris Armour) — Mon, 27 Oct 2025 00:00:00 GMT

Today’s top threat is a critical Windows Server Update Services (WSUS) vulnerability under active exploit, prompting an emergency directive from CISA for federal agencies to patch immediately. We are also tracking a detailed analysis of the sophisticated Qilin ransomware group’s attack methods and the discovery of a new Italian spyware linked to a Google Chrome zero-day. These events highlight the urgent need for robust patch management and heightened awareness of evolving espionage and extortion tactics.

Top 5 Critical Security Alerts

CISA orders feds to patch Windows Server WSUS flaw used in attacks; CISA has added a critical WSUS vulnerability to its KEV catalog, mandating federal agencies to patch immediately due to active exploitation. Read more
Italian spyware vendor linked to Chrome zero-day attacks — A Google Chrome zero-day vulnerability exploited earlier this year has been linked to malware from Italian spyware vendor Memento Labs, the successor to Hacking Team. Read more
Uncovering Qilin attack methods exposed through multiple cases — Cisco Talos details the TTPs of the Qilin ransomware group, noting its focus on the manufacturing sector and use of legitimate tools for evasion and persistence. Read more
QNAP warns of critical ASP.NET flaw in its Windows backup software — QNAP urges customers to patch a critical ASP.NET Core vulnerability impacting its NetBak PC Agent, a utility for backing up Windows data to NAS devices. Read more
New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands — A vulnerability in OpenAI’s ChatGPT Atlas browser allows attackers to inject malicious instructions via specially crafted URLs, potentially leading to code execution. Read more

Threat Intelligence (APT, malware, ransomware)

Mem3nt0 mori – The Hacking Team is back!: Kaspersky researchers link new ‘Dante’ spyware from Memento Labs (formerly Hacking Team) to the ForumTroll APT attacks, which exploited a Chrome zero-day. Read more
Italian-made spyware spotted in breaches of Russian, Belarusian systems — The Dante spyware from Memento Labs was reportedly used in cyber-espionage operations targeting entities in Russia and Belarus. Read more
Ransomware profits drop as victims stop paying hackers — Ransomware payment rates have fallen to a new low of 23%, indicating a shift in how organizations respond to extortion demands. Read more

Security Breaches & Incidents

Sweden’s power grid operator confirms data breach claimed by ransomware gang — Sweden’s power grid operator is investigating a data breach after a ransomware group threatened to leak hundreds of gigabytes of stolen data. Read more
Google disputes false claims of massive Gmail data breach — Google has refuted widespread reports of a massive data breach, stating that claims of 183 million exposed accounts are false. Read more

Security Tools & Best Practices

X: Re-enroll 2FA security keys by November 10 or get locked out: X (formerly Twitter) is requiring users with security keys or passkeys for 2FA to re-enroll them by November 10 to avoid account lockout. Read more
The State of Exposure Management in 2025: Insights From 3,000+ Organizations — A new report highlights how organizations are adapting to an expanding attack surface and AI-weaponized vulnerabilities by improving exposure management. Read more
Microsoft: New policy removes pre-installed Microsoft Store apps — A new Microsoft policy allows IT administrators to remove pre-installed Microsoft Store applications, providing greater control over system configurations. Read more

Security Standards & Frameworks (NIST, MITRE ATT&CK, CIS)

US declines to join more than 70 countries in signing UN cybercrime treaty — The United States has opted not to sign the UN Convention against Cybercrime, a global treaty aimed at creating a unified mechanism to combat digital crime. Read more

Emerging Security Technologies (AI, XDR, CNAPP)

AI fuels a new wave of fake receipts, according to SAP Concur — SAP Concur warns that generative AI is driving a significant increase in expense fraud through the creation of highly convincing fake receipts. Read more
Reuters: Deepseek emerges as key AI partner in China’s military research — A report indicates that China’s military is utilizing domestic AI models from companies like Deepseek and Alibaba for developing autonomous weapons systems. Read more
What brain privacy will look like in the age of neurotech — Experts discuss the future of brain data privacy, including the potential for commodification and the role of AI in decoding internal speech. Read more

CoPhish, Hospital Breach & FTC Scams – 10/26/2025

info@grabtheaxe.com (Chris Armour) — Sun, 26 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights several critical threats, including a novel ‘CoPhish’ attack exploiting Microsoft Copilot, a disturbing hospital breach involving patient photos, and a range of identity theft scams targeting vulnerable populations. We also cover new privacy regulations in New Zealand and FTC warnings about Amazon Prime subscriptions and charity scams. Stay informed to protect your data and avoid becoming a victim.

Top 5 Critical Privacy Alerts

New CoPhish attack steals OAuth tokens via Copilot Studio agents: A phishing technique uses Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests. Read more
Jay Hospital employees fired over ‘horrible’ pictures of sleeping, medicated patients: Hospital staff took and posted pictures of sleeping patients on social media, leading to their termination. Read more
Get a credit freeze to stop identity thieves: Freezing your credit is a great way to help protect yourself from identity theft. Read more
How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft because they often move more often and more people have access to their info. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: Scammers get more active around Medicare Open Enrollment Period, trying to get your money, information, or both. Read more

Privacy Laws & Regulations

New Zealand passed The Privacy Amendment Act in September. Learn about the IPP3A: New Zealand’s government passed The Privacy Amendment Act, adding Information Privacy Principle (IPP) 3A, effective May 1, 2026. Read more

Data Minimization & User Consent

Who’s eligible for a refund from Amazon?: Amazon agreed to pay $2.5 billion for enrolling people in Prime subscriptions without consent and making cancellation difficult. Read more
Labor rules out giving tech giants free rein to mine copyright content to train AI: The Albanese government has ruled out granting copyright exemption for AI models training. Read more

Scams & Identity Theft

How to spot a job scam: Learn how to spot phony business opportunities, work-at-home scams, shady employment agencies, and scammy multi-level marketing schemes. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: Learn how to spot disaster-related scams and find free tools to help you get started on a plan that includes fraud prevention. Read more
No, that’s not an FTC commissioner on the phone: Scammers pretend to be FTC officials to try to get your money. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: Companies trick you into sharing your information so they can sell it to telemarketers. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Learn key steps to avoid scams when selling your timeshare. Read more
Before you donate, find out where the money is going: The FTC says Kars-R-Us.com, Inc. lied about how the money would be spent when it collected vehicle donations. Read more

CIPA, Biometrics, UN Cybercrime & Privacy Tips – 10/25/2025

info@grabtheaxe.com (Chris Armour) — Sat, 25 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights critical developments in data protection and digital rights. Key articles include a critique of California’s CIPA law, the Philippines’ stance against selling biometric data, and warnings against the UN Cybercrime Convention due to human rights concerns. Also featured are practical tips to enhance personal privacy and a report on AI models developing ‘survival drives’.

Top 5 Critical Privacy Alerts

“Untenable.” Federal California District Court Calls for Legislative Action on CIPA: A federal court criticizes California’s Invasion of Privacy Act (CIPA), urging legislative reform due to its broad interpretation. Read more
Philippines Data Protection Authority: Biometric Data Is Not for Sale: Lessons for U.S. Privacy Law: The Philippines’ NPC directs Worldcoin to cease biometric data processing, asserting biometric information is not a commodity for trade. Read more
Joint Statement on the UN Cybercrime Convention: EFF and Global Partners Urge Governments Not to Sign: EFF and partners warn against signing the UN Cybercrime Convention due to its lack of human rights safeguards and potential for abuse. Read more
Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips for opting out of tech giants’ surveillance, including disabling ad tracking and using privacy-protective browsers. Read more
AI models may be developing their own ‘survival drive’, researchers say. AI safety research company has said that AI models may be developing their own “survival drive”. Read more

Privacy Laws & Regulations

“Untenable.” Federal California District Court Calls for Legislative Action on CIPA: A federal court criticizes California’s Invasion of Privacy Act (CIPA), urging legislative reform due to its broad interpretation. Read more

Data Minimization & User Consent

Philippines Data Protection Authority: Biometric Data Is Not for Sale: Lessons for U.S. Privacy Law: The Philippines’ NPC directs Worldcoin to cease biometric data processing, asserting biometric information is not a commodity for trade. Read more
Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips for opting out of tech giants’ surveillance, including disabling ad tracking and using privacy-protective browsers. Read more

Cross-Border Data Transfers

Joint Statement on the UN Cybercrime Convention: EFF and Global Partners Urge Governments Not to Sign: EFF and partners warn against signing the UN Cybercrime Convention due to its lack of human rights safeguards and potential for abuse. Read more

CoPhish Attack, AI Browser Risks & OAuth Threats – 10/25/2025

info@grabtheaxe.com (Chris Armour) — Sat, 25 Oct 2025 00:00:00 GMT

Today’s threat landscape is highlighted by a novel phishing technique dubbed ‘CoPhish,’ which leverages Microsoft Copilot agents to steal valuable OAuth tokens. This new attack vector underscores the growing security risks at the intersection of AI and user identity. We are also tracking significant vulnerabilities introduced by emerging AI browser agents and the privacy implications of expanding AI-powered government surveillance. This is what you need to know now.

Top 2 Critical Security Alerts

New CoPhish attack steals OAuth tokens via Copilot Studio agents: A novel phishing technique weaponizes Microsoft Copilot Studio agents to steal OAuth tokens by delivering fraudulent consent requests through trusted Microsoft domains. Read more
The glaring security risks with AI browser agents: New AI-powered browsers from OpenAI and Perplexity, while boosting productivity, introduce significant security vulnerabilities like data leakage and prompt injection attacks. Read more

Threat Intelligence

New CoPhish attack steals OAuth tokens via Copilot Studio agents: A novel phishing technique weaponizes Microsoft Copilot Studio agents to steal OAuth tokens by delivering fraudulent consent requests through trusted Microsoft domains. Read more

Security Breaches & Incidents

ICE is building a social media panopticon: U.S. Immigration and Customs Enforcement (ICE) is reportedly expanding a massive AI-powered surveillance system to monitor social media and track millions of web users. Read more
ChatGPT’s memory could turn personal details into ads OpenAI CEO Altman once called dystopian: Concerns are rising that ChatGPT’s new memory features could be used to harvest personal user details for advertising, a practice previously criticized by OpenAI’s CEO. Read more

Security Tools & Best Practices

MPs urge government to stop Britain’s phone theft wave through tech: UK Members of Parliament are pushing the government to implement technological solutions to combat the rising wave of phone theft across the country. Read more

Emerging Security Technologies

The glaring security risks with AI browser agents: New AI-powered browsers from OpenAI and Perplexity, while boosting productivity, introduce significant security vulnerabilities like data leakage and prompt injection attacks. Read more
Junk data from X makes large language models lose reasoning skills, researchers show: Research shows that training large language models on low-quality data can permanently degrade their reasoning capabilities, posing a long-term risk to AI integrity. Read more

Windows Patch, Pay Transparency, AI Act & FCPA – 10/25/2025

info@grabtheaxe.com (Chris Armour) — Sat, 25 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including an emergency patch for a Windows Server bug under active attack. We also cover proposed rules for pay transparency in New Jersey, California’s labor enforcement bill, and the potential impact of the AI Innovation Act on financial services. Stay informed on flood insurance compliance challenges, enterprise risk management, and upcoming anti-corruption events.

Top 5 Critical Compliance Alerts

Microsoft Issues Emergency Patch for Critical Windows Server Bug: Microsoft has released an out-of-band update to address CVE-2025-59287, a flaw under active attack. Read more

Regulatory Updates

Proposed Rules for NJ Pay Transparency Clarify Employer Scope + Applicability: New Jersey’s proposed rules clarify the scope of the Pay Transparency Act, requiring employers to include wage ranges in job ads. Read more
California’s AB 288: A New Era of State Labor Enforcement and Legal Uncertainty: California’s Assembly Bill 288 seeks to fill gaps left by a lack of quorum at the National Labor Relations Board (NLRB). Read more

AI & Financial Services

AI Innovation Act Would Bring New Era to Financial Services Industry: The Unleashing AI Innovation in Financial Services Act proposes AI Innovation Labs for supervised AI tool testing in finance. Read more

Compliance Frameworks

Flood remains compliance challenge: Financial institutions struggle with flood insurance compliance due to unclear regulations and inconsistent interpretations. Read more
Enterprise Risk Management Explained: The (In)Complete Guide: Many organizations lack visibility into their vendor evaluations and AI governance, leading to escalating risks. Read more

Policy & Governance Updates

[Event] 42nd Annual Conference on FCPA and Global Anti-Corruption – December 3rd – 4th, National Harbor, MD: ACI’s conference explores the future of FCPA and anti-corruption strategy. Read more

AI, Surveillance, Data Brokers & Breach Laws – 10/24/2025

info@grabtheaxe.com (Chris Armour) — Fri, 24 Oct 2025 00:00:00 GMT

Today’s privacy landscape is marked by increasing concerns over AI’s role in surveillance and data access, notably in schools and secure communications. Key developments include a LastPass phishing campaign, updates to breach notification laws in California and Oklahoma, and the Philippines’ stance against selling biometric data. These issues underscore the importance of robust privacy measures and user control.

Top 5 Critical Privacy Alerts

LastPass Phishing Campaign: LastPass warns of phishing emails requesting password vault access via fake inheritance processes. Read more
California & Oklahoma Breach Notification Updates: New legislation updates breach notification requirements in CA and OK, impacting businesses operating in those states. Read more
AI Classroom Surveillance Concerns: NYCLU raises concerns over AI-powered classroom surveillance in Long Island, citing privacy risks. Read more
ICE Mass Surveillance Campaign: ICE is reportedly using surveillance technology to investigate protesters, originally intended for undocumented immigrants. Read more
AI Access & Secure Chat Risks: EFF highlights privacy risks with AI features accessing secure chats, urging stronger user controls. Read more

Privacy Laws & Regulations

California Enacts Digital Age Verification Law: California’s Digital Age Assurance Act requires device-based age verification, creating safer digital environments for children. Read more

Data Minimization & User Consent

Philippines DPA: Biometric Data Not for Sale: The Philippines DPA halts Worldcoin’s biometric data processing, emphasizing that such data is not a commodity. Read more
Retail CCTV & GDPR Compliance: Bavarian court allows store security guards to use body cameras, citing GDPR compliance measures. Read more

Surveillance

NY School District’s AI Surveillance: NYCLU is concerned about a Long Island school district using AI-powered classroom surveillance. Read more
ICE Mass Surveillance: ICE is using surveillance technology to investigate protesters, raising concerns about civil liberties. Read more

Data Breaches

Toys “R” Us Canada Data Breach: Toys “R” Us Canada warns customers about leaked information from a previous data theft. Read more

AI & Privacy

AI Access & Secure Chat Controls: EFF emphasizes the need for strong user controls over AI’s access to secure chat data. Read more

Cyber Risk, HIPAA & AI Policy Updates – 10/24/2025

info@grabtheaxe.com (Chris Armour) — Fri, 24 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including a hospital firing employees for HIPAA violations and a severe Adobe Commerce flaw under active attack. New York’s DFS issued guidance on third-party cyber risk, while a $14 billion crypto bust offers hope against cybercrime. Stay informed with these key insights to safeguard your organization.

Top 5 Critical Compliance Alerts

Florida Hospital Fires Employees for Taking Unauthorized Photographs of Sedated Patients: Four employees were terminated for allegedly taking unauthorized photographs of patients. Read more
Fear the ‘SessionReaper’: Adobe Commerce Flaw Under Attack: CVE-2025-54236 is a critical flaw in Adobe Commerce (formerly Magento) that allows attackers to remotely take over sessions. Read more
Good Guidance on Third-Party Cyber Risk: New York regulators released guidance about managing cybersecurity risks of third-party technology providers. Read more
US Crypto Bust Offers Hope in Battle Against Cybercrime Syndicates: A $14 billion seizure by US investigators warns cybercriminals relying on bitcoin. Read more
Tired of Unpaid Toll Texts? Blame the ‘Smishing Triad’: Chinese smishers shift to lower-frequency, higher-impact government impersonation attacks. Read more

Compliance Frameworks

Florida Hospital Fires Employees for Taking Unauthorized Photographs of Sedated Patients: Four employees were terminated for allegedly taking unauthorized photographs of patients, raising HIPAA concerns. Read more

Regulatory Updates

Good Guidance on Third-Party Cyber Risk: New York regulators released guidance about managing cybersecurity risks of third-party technology providers. Read more
Expired Federal Telehealth Waivers: Key Changes in Medicare Reimbursement Requirements for Telehealth Providers: Federal government telehealth flexibilities expired, impacting Medicare reimbursement. Read more

Audit & Monitoring Tools

AuditBoard to Acquire AI Governance Platform FairNow: AuditBoard will acquire FairNow, an AI governance platform with AI registry, risk assessments, and compliance features. Read more
Optera Adds AI-Powered Data Ingestion to Emissions Platform: Optera added AI-powered data ingestion to its emissions platform, converting raw energy bills into auditable emissions data. Read more
FlexTecs Launches Inbox Automation Tool for AP Teams: FlexTecs launched AP Inbox Assist, using AI to automate accounts payable inbox management. Read more

Third-Party Risk & Due Diligence

Good Guidance on Third-Party Cyber Risk: New York regulators released guidance about managing cybersecurity risks of third-party technology providers. Read more

Policy & Governance Updates

AI Innovation Act Would Bring New Era to Financial Services Industry: The Unleashing AI Innovation in Financial Services Act aims to accelerate responsible AI experimentation. Read more
AI in Employment-Related Decisions Part 2: State Strategies to Address Pressure and What It Means for Employers: State lawmakers recalibrate approaches to regulating AI use in employment decisions. Read more

WSUS Vulnerability, WordPress Exploits & GlassWorm Worm – 10/24/2025

info@grabtheaxe.com (Chris Armour) — Fri, 24 Oct 2025 00:00:00 GMT

Today’s top threat is a critical Windows Server (WSUS) vulnerability now under active exploitation, prompting an emergency out-of-band patch from Microsoft and a CISA alert. Security teams are also contending with mass attacks on outdated WordPress plugins and a novel self-spreading worm targeting VS Code extensions. This summary covers the essential details you need to secure your systems against these immediate threats.

Top 5 Critical Security Alerts

Critical WSUS flaw in Windows Server now exploited in attacks: A critical remote code execution vulnerability in Windows Server Update Service (WSUS) is now under active exploitation in the wild, with a proof-of-concept exploit publicly available. Read more
Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287: Microsoft and CISA are urging organizations to immediately apply an emergency out-of-band patch for the actively exploited WSUS vulnerability (CVE-2025-59287) to prevent remote code execution. Read more
CISA Adds Two Known Exploited Vulnerabilities to Catalog — CISA has added the critical Microsoft WSUS flaw (CVE-2025-59287) and an Adobe Commerce vulnerability (CVE-2025-54236) to its Known Exploited Vulnerabilities (KEV) catalog, requiring immediate federal agency action. Read more
Hackers launch mass attacks exploiting outdated WordPress plugins — A widespread campaign is actively targeting WordPress websites by exploiting old, critical remote code execution vulnerabilities in the GutenKit and Hunk Companion plugins. Read more
Self-Spreading ‘GlassWorm’ Infects VS Code Extensions in Widespread Supply Chain Attack: A sophisticated, self-propagating worm dubbed ‘GlassWorm’ is spreading through Visual Studio Code extensions, representing a significant new software supply chain threat to developers. Read more

Threat Intelligence

North Korean hacking group targeting European drone maker with ScoringMathTea malware — The North Korean Lazarus APT group is targeting a European drone manufacturer with ScoringMathTea malware as part of its ongoing ‘Operation DreamJob’ espionage campaign. Read more
This browser claims “perfect privacies protection,” but it acts like malware: Security researchers warn that the ‘Universe Browser,’ which advertises strong privacy, behaves like malware and shows connections to Asian cybercrime and illegal gambling networks. Read more
APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign — The Pakistan-linked APT36 group is targeting Indian government entities with spear-phishing attacks to deliver ‘DeskRAT,’ a new malware written in Golang. Read more
New LockBit Ransomware Victims Identified by Security Researchers — Check Point researchers have identified a dozen new attacks attributed to the LockBit ransomware group, with several utilizing a new version of the malware. Read more

Security Breaches & Incidents

Fake LastPass death claims used to breach password vaults: A new phishing campaign is targeting LastPass users with fraudulent emails about legacy inheritance requests in an attempt to gain unauthorized access to their password vaults. Read more
Cyberattack on Russia’s food safety agency reportedly disrupts product shipments: A reported DDoS attack against Russia’s food safety watchdog has disrupted critical systems, including its veterinary certification platform, impacting product shipments. Read more

Security Tools & Best Practices

How to reduce costs with self-service password resets — Implementing secure self-service password reset tools with multi-factor authentication can significantly reduce IT help desk calls, which account for nearly 40% of their workload. Read more
Mozilla: New Firefox extensions must disclose data collection practices — Mozilla will soon require all Firefox extension developers to clearly disclose if their add-ons collect user data or share it with third parties, enhancing user transparency. Read more

Cloud & Network Security

Amazon: This week’s AWS outage caused by major DNS failure: Amazon has attributed the massive AWS outage that affected numerous online services on Monday to a significant failure within its DNS infrastructure. Read more

Security Standards & Frameworks

Counter Ransomware Initiative stresses importance of supply-chain security — A global coalition is urging companies to improve their software supply-chain security as threat actors increasingly use third-party products to launch ransomware attacks. Read more

Emerging Security Technologies

Sneaky Mermaid attack in Microsoft 365 Copilot steals data: A novel indirect prompt injection technique, the ‘Mermaid attack,’ has been demonstrated to successfully exfiltrate data from Microsoft 365 Copilot, posing a new threat to AI assistants. Read more
OpenAI positions ChatGPT as a search engine for work data with Company Knowledge: OpenAI’s new ‘Company Knowledge’ feature for ChatGPT Enterprise allows it to index and search data from internal tools, raising important data security and governance questions. Read more

F5 Breach, AI Spoofing, Data Transparency – 10/23/2025

info@grabtheaxe.com (Chris Armour) — Thu, 23 Oct 2025 00:00:00 GMT

Today’s privacy landscape is marked by critical vulnerabilities and evolving threats. A significant breach at F5 highlights the risks of nation-state actors, while AI spoofing attacks target browser users. Additionally, health apps continue to struggle with data transparency, emphasizing the need for robust user consent mechanisms and better transparency controls.

Top 5 Critical Privacy Alerts

Serious F5 Breach: F5 disclosed a breach by a sophisticated nation-state group with long-term access, compromising update distribution. Read more
Spoofed AI Sidebars: Atlas and Comet browser users are vulnerable to AI sidebar spoofing attacks leading to dangerous actions. Read more
Health Apps Data Transparency: Study reveals health apps transmit personal data before consent, raising data transparency and user control concerns. Read more
Lanscope Endpoint Manager Flaw: CISA warns of hackers exploiting a critical vulnerability in the Motex Lanscope Endpoint Manager. Read more
Iranian Hackers & Phoenix Backdoor: MuddyWater group targeted 100+ government entities, deploying Phoenix backdoor. Read more

Privacy Laws & Regulations

“Smile, You’re on Camera” & GDPR: Bavarian court’s GDPR ruling on body-worn cameras in retail offers insights for U.S. retailers. Read more
California Data Broker Requirements: California expands data broker rules impacting companies selling data of consumers without direct relationships. Read more

Data Minimization & User Consent

“Smile, You’re on Camera” & GDPR: Bavarian court’s GDPR ruling on body-worn cameras in retail offers insights for U.S. retailers. Read more
Health Apps Data Transparency: Study reveals health apps transmit personal data before consent, raising data transparency and user control concerns. Read more
AI & Secure Chat Controls: Google and Apple must offer better user controls over AI access to personal data in secure chat apps. Read more

Lanscope Flaw, Adobe Exploits & Lazarus Group – 10/23/2025

info@grabtheaxe.com (Chris Armour) — Thu, 23 Oct 2025 00:00:00 GMT

Today’s threat landscape is marked by urgent alerts from CISA regarding an actively exploited vulnerability in Lanscope Endpoint Manager. Concurrently, a critical flaw in Adobe Commerce is being leveraged to attack hundreds of e-commerce sites, while the North Korean Lazarus Group continues its espionage campaign against European defense firms. This summary also covers new advisories for Industrial Control Systems and emerging threats targeting AI-powered browsers.

Top 5 Critical Security Alerts

CISA warns of Lanscope Endpoint Manager flaw exploited in attacks: CISA has added a critical vulnerability (CVE-2025-61932) in Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities catalog, confirming it is under active attack. Read more
Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw: A critical improper input validation flaw in Adobe Commerce and Magento (CVE-2025-54236), dubbed ‘SessionReaper’, is being actively exploited to take over e-commerce sessions, with over 250 stores already targeted. Read more
North Korean Lazarus hackers targeted European defense companies: The North Korean Lazarus Group is conducting a sophisticated cyber-espionage campaign, ‘Operation DreamJob,’ using fake job lures to compromise European defense companies, particularly those involved in drone technology. Read more
CISA Releases Eight Industrial Control Systems Advisories: CISA has published eight new advisories detailing multiple critical vulnerabilities in ICS/SCADA products from vendors including AutomationDirect, ASKI Energy, Veeder-Root, and Delta Electronics, some with CVSS scores as high as 9.9. Read more
“Jingle Thief” Hackers Exploit Cloud Infrastructure to Steal Millions in Gift Cards: A cybercriminal group named ‘Jingle Thief’ is targeting and exploiting the cloud environments of retail organizations to conduct widespread gift card fraud. Read more

Threat Intelligence

IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response: Cisco Talos reports a surge in attacks on public-facing applications for initial access in Q3 2025, with ToolShell exploits against SharePoint being the most prevalent tactic. Read more
Help Wanted: Vietnamese Actors Using Fake Job Posting Campaigns to Deliver Malware and Steal Credentials: Google’s Threat Intelligence Group is tracking a Vietnamese threat cluster (UNC6229) that uses fake job postings on legitimate platforms to deliver malware and phish for credentials to hijack corporate advertising accounts. Read more
Phishing campaign across Mideast, North Africa is attributed to Iranian group: The Iranian state-sponsored group MuddyWater has been linked to a recent phishing campaign that spreads backdoor malware to targets in the Middle East and North Africa. Read more
Hackers posing as Kyrgyz officials target Russian agencies in cyber espionage campaign: The ‘Cavalry Werewolf’ hacking group is targeting Russian public sector, energy, and manufacturing companies in a prolonged cyber-espionage campaign using lures that impersonate Kyrgyz officials. Read more

Security Breaches & Incidents

Toys “R” Us Canada warns customers’ info leaked in data breach: Toys “R” Us Canada has notified customers of a data breach after threat actors stole and subsequently leaked customer records online. Read more
US accuses former L3Harris cyber boss of stealing and selling secrets to Russian buyer: The US DOJ has charged a former general manager of L3Harris’s hacking division, Trenchant, with stealing trade secrets and selling them to a buyer in Russia. Read more

Security Tools & Best Practices

Microsoft disables File Explorer preview for downloads to block attacks: To mitigate credential theft risks, Microsoft is now automatically blocking the File Explorer preview pane for files downloaded from the internet to prevent attacks leveraging malicious documents. Read more
HP pulls update that broke Microsoft Entra ID auth on some AI PCs: HP has retracted a faulty HP OneAgent software update that deleted Microsoft certificates on some Windows 11 AI PCs, preventing users from logging into Microsoft Entra ID. Read more

Emerging Security Technologies

Spoofed AI sidebars can trick Atlas, Comet users into dangerous actions: Security researchers have found that OpenAI’s Atlas and Perplexity’s Comet AI browsers are vulnerable to sidebar spoofing attacks, which can trick users into following malicious, AI-generated instructions. Read more
ChatGPT Atlas carries significant security risks, OpenAI warns: OpenAI’s own head of security has publicly warned that the company’s new browser, ChatGPT Atlas, could introduce significant security vulnerabilities for its users. Read more
Zero Trust Has a Blind Spot: Your AI Agents. A new report highlights how autonomous AI agents are creating significant security blind spots that traditional Zero Trust architectures are not equipped to handle. Read more

Privacy Laws, Data Breach, Meta Bots – 10/18/2025

info@grabtheaxe.com (Chris Armour) — Sat, 18 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights critical developments in data protection and online safety. Key stories include California’s enactment of new privacy laws, the ICO’s significant fine against Capita for a major data breach, and Meta’s new parental controls for AI chatbots. Also featured are practical tips from EFF on minimizing your digital footprint and a warning from UK MPs regarding online misinformation.

Top 5 Critical Privacy Alerts

California Enacts New Privacy Laws: Governor Newsom signed privacy proposals into law, including those for browser opt-outs, social media account deletion, and data brokers. Read more
ICO Fines Capita £14 Million Over 2023 Data Breach: The ICO fined Capita £14 million under the UK GDPR after a 2023 data breach affected over 6 million people. Read more
Parents will be able to block Meta bots from talking to their children under new safeguards: Meta is adding safeguards to teen accounts, letting parents turn off chats with AI characters due to inappropriate conversations. Read more
Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips for October on opting out of tech giant surveillance, covering passwords, data brokers, ad tracking, and app decluttering. Read more
UK MPs warn of repeat of 2024 riots unless online misinformation is tackled: UK MPs warn that failures to tackle online misinformation could trigger a repeat of the 2024 summer riots. Read more

Privacy Laws & Regulations

California Enacts New Privacy Laws: Governor Newsom signed privacy proposals into law, including those for browser opt-outs, social media account deletion, and data brokers. Read more

Regulatory Fines & Enforcement Actions

ICO Fines Capita £14 Million Over 2023 Data Breach: The ICO fined Capita £14 million under the UK GDPR after a 2023 data breach affected over 6 million people. Read more

Data Minimization & User Consent

Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips for October on opting out of tech giant surveillance, covering passwords, data brokers, ad tracking, and app decluttering. Read more
Parents will be able to block Meta bots from talking to their children under new safeguards: Meta is adding safeguards to teen accounts, letting parents turn off chats with AI characters due to inappropriate conversations. Read more

Surveillance, Data Breach & EFF Lawsuit – 10/17/2025

info@grabtheaxe.com (Chris Armour) — Fri, 17 Oct 2025 00:00:00 GMT

This privacy digest highlights the concerning trend of increased surveillance and data breaches. Key stories include the EFF’s lawsuit against the Trump administration’s ideological surveillance program, the exploitation of lax authentication in Zendesk leading to ’email bombs’, and the surprising revelation of unencrypted satellite traffic. Additionally, a data breach at Sotheby’s exposed financial information, and a breach at Prosper impacted over 17 million accounts.

Top 5 Critical Privacy Alerts

Labor Unions, EFF Sue Trump Administration to Stop Ideological Surveillance of Free Speech Online: Lawsuit challenges the U.S. government’s online surveillance program targeting noncitizens. Read more
Email Bombs Exploit Lax Authentication in Zendesk: Cybercriminals are flooding inboxes using Zendesk’s lax authentication to send menacing messages. Read more
A Surprising Amount of Satellite Traffic Is Unencrypted: Study reveals sensitive data including critical infrastructure and personal communications are broadcast unencrypted. Read more
Auction giant Sotheby’s says data breach exposed financial information: Sotheby’s is notifying individuals of a data breach where threat actors stole sensitive financial details. Read more
Have I Been Pwned: Prosper data breach impacts 17.6 million accounts: Hackers stole personal information of over 17.6 million people after breaching Prosper’s systems. Read more

Privacy Laws & Regulations

Recapping CMMC Level 3: Considerations for Government Contractors: DoD issued a final rule implementing the Cybersecurity Maturity Model Certification (CMMC) program for government contractors. Read more
Leveling Up: Will CMMC Contract Obligations Impact Your Organization?: New rule impacts how defense contractors engage with the Department of Defense regarding Cybersecurity Maturity Model Certification. Read more

Data Minimization & User Consent

Opt Out October: Daily Tips to Protect Your Privacy and Security: Series of daily tips to help users take control of their online privacy and limit tech giant surveillance. Read more

Surveillance

Claro and Town of Dover, NJ Launch AI Video Analytics to Transform Public Safety: Dover, NJ partners with Claro to deploy AI-driven surveillance tech across municipal buildings. Read more
Labor Unions, EFF Sue Trump Administration to Stop Ideological Surveillance of Free Speech Online: Lawsuit challenges the U.S. government’s online surveillance program targeting noncitizens. Read more

Ransomware, Data Breach, NY DFS, & Password Risks – 10/17/2025

info@grabtheaxe.com (Chris Armour) — Fri, 17 Oct 2025 00:00:00 GMT

Today’s compliance threat summary highlights the increasing risk of ransomware attacks and data breaches, particularly within the healthcare sector. New York regulators are cracking down on insurance firms with poor cybersecurity, while phishing campaigns are targeting password managers. Additionally, new regulations are impacting data transfers and federal grant processes, demanding increased vigilance.

Top 5 Critical Compliance Alerts

Cyberattackers Target LastPass, Top Password Managers: Phishing campaigns are exploiting employee trust in password vaults. Read more
Kettering Health Confirmed Patient Data Compromised in May 2025 Ransomware Attack: Investigation confirms patient data was compromised in a ransomware attack. Read more
NY DFS Nails Insurance Firms on Cyber Fails: New York regulators fined insurance firms for poor cybersecurity practices leading to privacy breaches. Read more
Cybersecurity Firm Reports 36% YOY Increase in Ransomware Attacks: Black Fog’s Q3 2025 report shows a significant rise in ransomware attacks. Read more
ITRC: 23 Million Individuals Affected by Data Breaches in Q3, 2025: System compromises and data breaches continue to affect millions. Read more

Compliance Frameworks

Eastern Radiologists Agrees to $3.35 Million Data Breach Settlement: Settlement reached over a 2023 data breach impacting patient data. Read more

Regulatory Updates

California Restricts Use of Common Pricing Algorithms, Reforms the Pleading Standard for Certain Antitrust Claims, and Increases Penalties: California enacted AB 325 and SB 763, amending the Cartwright Act. Read more
NY DFS Nails Insurance Firms on Cyber Fails: New York regulators fined insurance firms for poor cybersecurity practices leading to privacy breaches. Read more
The Sensitive Data Bulk Transfer Rule: What You Need to Know: The U.S. Department of Justice’s Sensitive Data Bulk Transfer Rule is now in effect, impacting due diligence and compliance requirements. Read more
Executive Order Reshapes Federal Grants Process: An executive order aims to improve federal grantmaking oversight and accountability. Read more
Executive Order 14331: Navigating the New Era of Fair Banking: The Consumer Finance Podcast: Discusses implications of President Trump’s Executive Order 14331, “Guaranteeing Fair Banking for All Americans.” Read more

Third-Party Risk & Due Diligence

When Supplier Data Lives in Silos, Risk Lives Everywhere: Fragmented supplier data across different sites poses a significant risk to manufacturers. Read more
Background Check Software Buyer’s Guide: Guide to researching background check software based on size, structure, and risk profile. Read more
Leaks in Microsoft VS Code Marketplace Put Supply Chain at Risk: Secrets exposed in Visual Studio Code marketplaces put supply chains at risk. Read more

Policy & Governance Updates

When national cyber incidents break records, CEOs can’t stay outsiders: UK government demands action from CEOs on cyber threats. Read more
AI Agent Security: Whose Responsibility Is It?: The shared responsibility model is key to agentic services, but awareness and risk management are challenging. Read more
AI Chat Data Is History’s Most Thorough Record of Enterprise Secrets, Secure it Wisely: AI interactions are revealing records of human thinking, impacting law enforcement, accountability, and privacy. Read more
From Capital to Clinics: California Reins in Private Equity Power to Address Corporate Practice of Medicine (CPOM) Concerns: California enacts bills impacting private equity firms and physician practices. Read more

Cyber Threats, Healthcare Breach, & AML Updates – 10/16/2025

info@grabtheaxe.com (Chris Armour) — Thu, 16 Oct 2025 00:00:00 GMT

Today’s compliance landscape is marked by significant cybersecurity threats, particularly in the healthcare sector, and evolving regulatory scrutiny across various industries. A major breach at F5 and widespread healthcare disruptions highlight the urgent need for robust cybersecurity measures. Simultaneously, regulatory updates like AIFMD 2.0 and Australia’s AML regulations demand proactive compliance efforts, while the EU’s crackdown on resale price fixing underscores the importance of fair competition.

Top 5 Critical Compliance Alerts

F5 BIG-IP Breach by Nation-State Actor: F5 disclosed a breach including zero-day bugs, source code, and customer information. Read more
Healthcare Cyberattacks Disrupt Patient Care: 72% of healthcare organizations report disruptions to patient care due to cyberattacks. Read more
Australia’s AML Penalties Signal Tranche 2 Readiness: ANZ faces a record penalty, signaling the importance of AML/CTF compliance under Tranche 2. Read more
EU Fines Fashion Brands for Resale Price Fixing: Gucci, Chloé, and Loewe fined over $182 million for engaging in resale price maintenance. Read more
AI-Optimized Attack Chains Tested by China Hackers: Chinese hackers are testing AI to optimize attack chains in Taiwan, revealing the evolving cyber threat landscape. Read more

Compliance Frameworks

Risk Management Software for Medical Device Regulatory Compliance: Ensuring quality, safety, and FDA readiness with risk management software. Read more

Regulatory Updates

AIFMD 2.0: What’s To Come With Six Months To Go: Fund managers should prepare for compliance with AIFMD 2.0, effective April 2026. Read more
Australia’s AML Reckoning: What the ANZ $240m penalty signals ahead of Tranche 2: Largest corporate misconduct penalty signals what’s coming under Tranche 2 of AML/CTF regime. Read more
California Strengthens Privacy Protections for Individuals Visiting Family Planning Centers: New bill strengthens privacy for those seeking or receiving family planning services. Read more
New CRS Regulations – What UK Investment Managers Need To Know: HMRC issued the International Tax Compliance (Amendment) Regulations 2025, introducing significant changes to the UK’s Common Reporting Standard (CRS) regime. Read more
Executive Order Reshapes Federal Grants Process: Signed to improve grantmaking, end waste, and ensure accountability for public funds. Read more

Audit & Monitoring Tools

Jscrambler Launches AI Assistant for PCI DSS Script Authorization: New AI assistant provides risk-based insights for script authorization decisions and compliance justifications. Read more

Third-Party Risk & Due Diligence

EcoVadis Launches Anonymous Reporting Tool for Supply Chain Workers: Worker Voice Connect helps organizations address worker concerns in global supply chains. Read more

Policy & Governance Updates

AI Compliance Tips for Advisers: Investment advisers are exploring ways to leverage AI in their operations, introducing complex legal, regulatory, and fiduciary challenges. Read more
PCCE Welcomes Two Members to its Board of Advisors: Courtney Colligan and Marshall Miller join NYU School of Law Program on Corporate Compliance and Enforcement (PCCE)’s Board of Advisors. Read more

Healthcare Compliance

Five Healthcare Providers Warn Patients About Cyberattacks & Data Breaches: Cyberattacks and data breaches announced by multiple healthcare providers. Read more
72% of Healthcare Orgs Report Disruption to Patient Care Due to Cyberattacks: Survey finds most healthcare organizations experienced disruptions due to cyberattacks. Read more
Orthopedics Rhode Island Agrees to Pay $2.9 Million to Settle Class Action Data Breach Lawsuit: Ortho RI settles class action lawsuit stemming from a data breach. Read more

EtherHiding, Phishing, Adobe Flaw & Data Breach – 10/16/2025

info@grabtheaxe.com (Chris Armour) — Thu, 16 Oct 2025 00:00:00 GMT

Today’s privacy briefing highlights critical threats, including North Korean hackers employing ‘EtherHiding’ tactics and an ongoing phishing campaign targeting password manager users. CISA warns of active exploitation of a maximum-severity Adobe flaw, while Capita faces a hefty fine for a significant data breach. Scams involving cryptocurrency ATMs continue to pose a risk to consumers.

Top 5 Critical Privacy Alerts

North Korean hackers use EtherHiding to hide malware on the blockchain: Hackers are using a new tactic to deliver malware, steal cryptocurrency, and perform espionage. Read more
Fake LastPass, Bitwarden breach alerts lead to PC hijacks: Phishing campaign targets password manager users, urging them to download a malicious desktop version. Read more
CISA: Maximum-severity Adobe flaw now exploited in attacks: Attackers are actively exploiting a maximum-severity vulnerability in Adobe Experience Manager to execute code. Read more
Capita to pay £14 million for data breach impacting 6.6 million people: The ICO has fined Capita £14 million for a 2023 data breach exposing millions of people’s data. Read more
Cryptocurrency ATMs: Cryptocurrency ATMs are used to scam people out of their money, with usurious fees and a common place for scammers. Read more

ATMs

Cryptocurrency ATMs: Cryptocurrency ATMs are used to scam people out of their money, with usurious fees and a common place for scammers. Read more

Cybersecurity

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Organizations can take advantage of states’ safe harbor provisions for data incident preparedness. Read more

Data Breach

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Organizations can take advantage of states’ safe harbor provisions for data incident preparedness. Read more

Data Security

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Organizations can take advantage of states’ safe harbor provisions for data incident preparedness. Read more

General Privacy & Data Security News & Developments

The Sensitive Data Bulk Transfer Rule: What You Need to Know: The U.S. Department of Justice’s Sensitive Data Bulk Transfer Rule is in effect, including due diligence and compliance requirements. Read more

Google

YouTube is down worldwide with playback error: YouTube is facing a global outage, with users reporting playback errors on both the website and mobile apps. Read more

Legal

Capita to pay £14 million for data breach impacting 6.6 million people: The ICO has fined Capita £14 million for a 2023 data breach exposing millions of people’s data. Read more

Microsoft

Microsoft debuts Copilot Actions for agentic AI-driven Windows tasks: Microsoft announced Copilot Actions, enabling AI agents to perform real tasks on local files and applications. Read more
Microsoft: Sept Windows Server updates cause Active Directory issues: Microsoft confirmed that the September 2025 security updates are causing Active Directory issues on Windows Server 2025 systems. Read more

Security

CISA: Maximum-severity Adobe flaw now exploited in attacks: Attackers are actively exploiting a maximum-severity vulnerability in Adobe Experience Manager to execute code. Read more
Unified Exposure Management Platforms: The Future of Preemptive Cyber Defense: Unified Exposure Management Platforms continuously identifies, validates, and fixes exploitable risks before adversaries strike. Read more
North Korean hackers use EtherHiding to hide malware on the blockchain: Hackers are using a new tactic to deliver malware, steal cryptocurrency, and perform espionage. Read more
Microsoft adds Copilot voice activation on Windows 11 PCs: Windows 11 users can start a conversation with Copilot by saying the “Hey Copilot” wake word. Read more
Microsoft debuts Copilot Actions for agentic AI-driven Windows tasks: Microsoft announced Copilot Actions, enabling AI agents to perform real tasks on local files and applications. Read more
Capita to pay £14 million for data breach impacting 6.6 million people: The ICO has fined Capita £14 million for a 2023 data breach exposing millions of people’s data. Read more
PowerSchool hacker gets sentenced to four years in prison: A college student was sentenced to four years in prison for a cyberattack on PowerSchool in December 2024. Read more
Fake LastPass, Bitwarden breach alerts lead to PC hijacks: Phishing campaign targets password manager users, urging them to download a malicious desktop version. Read more
F5 releases BIG-IP patches for stolen security vulnerabilities: F5 has released security updates to address BIG-IP vulnerabilities stolen in a breach detected on August 9, 2025. Read more
Clothing giant MANGO discloses data breach exposing customer info: Spanish fashion retailer MANGO is sending notices of a data breach to its customers. Read more

Software

YouTube is down worldwide with playback error: YouTube is facing a global outage, with users reporting playback errors on both the website and mobile apps. Read more

Uncategorized

Get a credit freeze to stop identity thieves: Freezing your credit is a great place to start to help protect yourself from identity theft. Read more
How to spot a job scam: There are some ways to spot phony business opportunities, work-at-home scams, shady employment agencies, and scammy multi-level marketing schemes. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: Having a plan and knowing how to spot disaster-related scams can make a difference to anyone recovering from a disaster. Read more
How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft, so here are ways to help protect them. Read more
No, that’s not an FTC commissioner on the phone: Nobody who works at the FTC will ever tell you to move your money to protect it. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls: Learn how to cut down on the number of unwanted telemarketing calls you get. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: Learn to spot the scams that get more active around Medicare Open Enrollment Period. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Key steps to avoid scams when selling your timeshare. Read more
Before you donate, find out where the money is going: Find out where the money is going before you donate to a cause. Read more
Who’s eligible for a refund from Amazon?: Amazon agreed to pay $2.5 billion to settle the FTC’s charges, so who gets a refund? Read more
Barrister found to have used AI to prepare for hearing after citing ‘fictitious’ cases: An immigration barrister was found to be using AI to do his work for a tribunal hearing. Read more
ROG Xbox Ally X review – like nothing handheld gaming has seen before, for better or worse: The ROG Xbox Ally X is an impressive, yet expensive, piece of gaming tech. Read more
Italian news publishers demand investigation into Google’s AI Overviews: Italian news publishers are calling for an investigation into Google’s AI Overviews. Read more
Spotify partnering with multinational music companies to develop ‘responsible’ AI products: Spotify is teaming up with the world’s biggest music companies to develop “responsible” artificial intelligence products. Read more
Cryptocurrency ATMs: Cryptocurrency ATMs are used to scam people out of their money, with usurious fees and a common place for scammers. Read more
Plug-in hybrids pollute almost as much as petrol cars, report finds: Plug-in hybrid electric vehicles (PHEVs) pump out nearly five times more planet-heating pollution than official figures show. Read more
🎃 A Full Month of Privacy Tips from EFF | EFFector 37.14: EFF is helping you take control of your online privacy with Opt Out October. Read more
Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips to protect your privacy and security during Opt Out October. Read more

United States

The Sensitive Data Bulk Transfer Rule: What You Need to Know: The U.S. Department of Justice’s Sensitive Data Bulk Transfer Rule is in effect, including due diligence and compliance requirements. Read more

cryptocurrency

Cryptocurrency ATMs: Cryptocurrency ATMs are used to scam people out of their money, with usurious fees and a common place for scammers. Read more

data breach

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Organizations can take advantage of states’ safe harbor provisions for data incident preparedness. Read more

scams

Cryptocurrency ATMs: Cryptocurrency ATMs are used to scam people out of their money, with usurious fees and a common place for scammers. Read more

Apple Bounty, Android Attack, Surveillance & MANGO Breach – 10/15/2025

info@grabtheaxe.com (Chris Armour) — Wed, 15 Oct 2025 00:00:00 GMT

Today’s privacy landscape is marked by both proactive security measures and emerging threats. Apple’s enhanced bug bounty program highlights the industry’s focus on combating sophisticated spyware, while a novel Android attack demonstrates the evolving tactics of data extraction. Additionally, revelations about a global surveillance empire and a data breach at fashion retailer MANGO underscore the persistent challenges in safeguarding personal information.

Top 5 Critical Privacy Alerts

Apple’s Bug Bounty Program: Apple is offering a $2M bounty for zero-click exploits, aiming to combat mercenary spyware attacks. The program includes increased rewards for Lockdown Mode bypasses and iCloud access exploits. Read more
New Android Pixnapping attack steals MFA codes pixel-by-pixel: A malicious Android app can extract sensitive data by stealing pixels and reconstructing them. This side-channel attack requires no permissions. Read more
The Surveillance Empire That Tracked World Leaders, a Vatican Enemy, and Maybe You: First Wap’s European founders built a phone-tracking empire operating from Jakarta. Their reach extends from the Vatican to the Middle East to Silicon Valley. Read more
Clothing giant MANGO discloses data breach exposing customer info: Spanish fashion retailer MANGO warns customers of a data breach at its marketing vendor. The breach exposed personal data. Read more
F5 says hackers stole undisclosed BIG-IP flaws, source code: Nation-state hackers breached F5 and stole undisclosed BIG-IP security vulnerabilities and source code. Patches have been released to address the stolen vulnerabilities. Read more

Apple

Apple’s Bug Bounty Program: Apple is offering a $2M bounty for zero-click exploits, aiming to combat mercenary spyware attacks. The program includes increased rewards for Lockdown Mode bypasses and iCloud access exploits. Read more

Cybersecurity

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Many organizations are budgeting and planning for data incident preparedness. Several states have safe harbor provisions for organizations with cyber programs. Read more

Data Breach

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Many organizations are budgeting and planning for data incident preparedness. Several states have safe harbor provisions for organizations with cyber programs. Read more

Data Security

Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor?: Many organizations are budgeting and planning for data incident preparedness. Several states have safe harbor provisions for organizations with cyber programs. Read more

Microsoft

Microsoft: Sept Windows Server updates cause Active Directory issues: Microsoft confirms that the September 2025 security updates are causing Active Directory issues on Windows Server 2025 systems. Details are emerging. Read more
Final Windows 10 Patch Tuesday update rolls out as support ends: Microsoft released the final free update for Windows 10 as it reaches the end of its support lifecycle. This marks the end of an era. Read more
Microsoft: Exchange 2016 and 2019 have reached end of support: Microsoft reminds that Exchange Server 2016 and 2019 have reached the end of support. IT admins should upgrade to Exchange Server SE or migrate to Exchange Online. Read more

Mobile

New Android Pixnapping attack steals MFA codes pixel-by-pixel: A malicious Android app can extract sensitive data by stealing pixels and reconstructing them. This side-channel attack requires no permissions. Read more

Security

F5 releases BIG-IP patches for stolen security vulnerabilities: F5 released security updates to address BIG-IP vulnerabilities stolen in a breach detected on August 9, 2025. Apply the patches immediately. Read more
Clothing giant MANGO discloses data breach exposing customer info: Spanish fashion retailer MANGO warns customers of a data breach at its marketing vendor. The breach exposed personal data. Read more
How to spot dark web threats on your network using NDR: Dark web activity can hide in plain sight within network traffic. Corelight’s NDR platform provides visibility and AI-driven detection. Read more
F5 says hackers stole undisclosed BIG-IP flaws, source code: Nation-state hackers breached F5 and stole undisclosed BIG-IP security vulnerabilities and source code. Patches have been released to address the stolen vulnerabilities. Read more
Malicious crypto-stealing VSCode extensions resurface on OpenVSX: A threat actor is targeting developers with malicious VSCode extensions to steal cryptocurrency and plant backdoors. Be cautious when installing extensions. Read more
New Android Pixnapping attack steals MFA codes pixel-by-pixel: A malicious Android app can extract sensitive data by stealing pixels and reconstructing them. This side-channel attack requires no permissions. Read more

Surveillance

The Surveillance Empire That Tracked World Leaders, a Vatican Enemy, and Maybe You: First Wap’s European founders built a phone-tracking empire operating from Jakarta. Their reach extends from the Vatican to the Middle East to Silicon Valley. Read more

Uncategorized

Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips to protect your privacy and security during Opt Out October. Learn how to opt out of tech giant surveillance. Read more
Digital ID: Danes and Estonians find it ‘pretty uncontroversial’: Citizens in Denmark and Estonia have enrolled in digital ID systems with little opposition. The UK is planning a similar system. Read more
OpenAI will allow verified adults to use ChatGPT to generate erotic content: OpenAI plans to relax restrictions on ChatGPT, allowing erotic content for verified adult users. Age verification methods are forthcoming. Read more

Exploits

Apple’s Bug Bounty Program: Apple is offering a $2M bounty for zero-click exploits, aiming to combat mercenary spyware attacks. The program includes increased rewards for Lockdown Mode bypasses and iCloud access exploits. Read more

Spyware

Apple’s Bug Bounty Program: Apple is offering a $2M bounty for zero-click exploits, aiming to combat mercenary spyware attacks. The program includes increased rewards for Lockdown Mode bypasses and iCloud access exploits. Read more

Vulnerabilities

Apple’s Bug Bounty Program: Apple is offering a $2M bounty for zero-click exploits, aiming to combat mercenary spyware attacks. The program includes increased rewards for Lockdown Mode bypasses and iCloud access exploits. Read more

Data Breach, CCPA, Oracle Attack & Patch Update – 10/15/2025

info@grabtheaxe.com (Chris Armour) — Wed, 15 Oct 2025 00:00:00 GMT

Today’s compliance digest features critical updates on data breaches, ransomware attacks, and evolving regulatory landscapes. Harvard University suffered a significant breach due to an Oracle zero-day, while Microsoft issued a massive patch update addressing actively exploited vulnerabilities. New CCPA risk assessment requirements and restrictions on private equity involvement in healthcare practices highlight the increasing complexity of compliance.

Top 5 Critical Compliance Alerts

Harvard University Breached in Oracle Zero-Day Attack: The Clop ransomware group claimed responsibility for stealing Harvard’s data as part of a broader campaign against Oracle customers. Read more
Microsoft Drops Terrifyingly Large October Patch Update: October 2025’s Patch Tuesday includes actively exploited zero-days and privilege-escalation bugs, ending Windows 10 updates. Read more
China’s Flax Typhoon Turns Geo-Mapping Server into a Backdoor: Chinese APT threat actors compromised an organization’s ArcGIS server, modifying the geospatial mapping software for stealth access. Read more
Pixnapping Attack Lets Attackers Steal 2FA on Android: A proof-of-concept exploit allows an attacker to steal sensitive data from Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo. Read more
$49.99M Settlement Agreed to Resolve Class Action Data Breach Lawsuit Against Heritage Provider Network et al: A $49.99 million settlement has received preliminary approval from the court to resolve class action litigation against Heritage Provider Network. Read more

Compliance Frameworks

What Is ISO/IEC 27006-1:2024 & What Changed in the 2024 (2025 Transition) Edition?: This standard governs how certification bodies (CBs) operate when auditing and certifying organizations for ISO 27001. Read more
ISO 27001 for Non-IT Roles: A Beginner’s Guide: Understanding ISO 27001 is no longer optional for IT teams alone, as non-technical roles are increasingly involved in projects handling sensitive data. Read more

Regulatory Updates

New CRS Regulations – What UK Investment Managers Need To Know: HMRC issued the International Tax Compliance (Amendment) Regulations 2025, introducing significant changes to the UK’s Common Reporting Standard (CRS) regime. Read more
California Enacts SB 351: New Restrictions on Private Equity and Hedge Fund Involvement in Physician and Dental Practices: California Governor Gavin Newsom signed into law Senate Bill 351, strengthening restrictions on the corporate practice of medicine and dentistry in California. Read more
Understanding the CCPA’s New Risk Assessment Requirements – Part 2: The California Privacy Protection Agency (CPPA) has approved significant updates to CCPA regulations, including a new obligation to conduct risk assessments. Read more
AI Compliance Tips for Advisers: Investment advisers are exploring ways to leverage AI, introducing complex legal, regulatory, and fiduciary challenges. Read more

Third-Party Risk & Due Diligence

Risk Management Software for Semiconductor Supply Chain Compliance: Ensuring Resilience and Regulatory Alignment: Semiconductor manufacturers face numerous risks due to the globally integrated and complex nature of their supply chains. Read more

Policy & Governance Updates

Yes, You Can Fire an Employee for a Problematic Post, but Should You?: Considerations around firing an employee for problematic social media posts are discussed. Read more
Are Your Hotline Metrics Telling the Board a Compelling Story?: Compliance leaders can use data visualization and storytelling to help boards grasp the significance of trends in hotline metrics. Read more

Data Breach, AI Surveillance & Student Tracking – 10/14/2025

info@grabtheaxe.com (Chris Armour) — Tue, 14 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights critical breaches affecting healthcare and online platforms, alongside regulatory scrutiny of Microsoft’s educational tracking. We also cover the implications of AI in surveillance and the evolving landscape of US privacy laws. Stay informed about the key developments shaping data protection and cybersecurity.

Top 5 Critical Privacy Alerts

Microsoft ‘illegally’ tracked students via 365 Education: Austrian data protection regulator ruled Microsoft illegally tracked students and used their data. Read more
SimonMed says 1.2 million patients impacted in January data breach: Medical imaging provider SimonMed Imaging is notifying over 1.2 million individuals of a data breach. Read more
Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops: Signed UEFI shell components could be exploited to bypass Secure Boot protections. Read more
SonicWall VPN accounts breached using stolen creds: Threat actors compromised over a hundred SonicWall SSLVPN accounts via stolen credentials. Read more
LinkedIn Stuck With Three Lawsuits Over Online Data Tracking: LinkedIn faces lawsuits over collecting sensitive information without consent, violating California privacy laws. Read more

Privacy Laws & Regulations

2025 Brought Us Eight US “Comprehensive” Privacy Laws: Maryland law (MODPA) went into effect Oct 1st, bringing the US total to 17 (or 16). Read more
California’s Latest Trio of Privacy Bills: New laws give consumers greater control over personal info, impacting businesses and data brokers. Read more

Data Minimization & User Consent

LinkedIn Stuck With Three Lawsuits Over Online Data Tracking: LinkedIn faces lawsuits over collecting sensitive information without consent, violating California privacy laws. Read more
Microsoft ‘illegally’ tracked students via 365 Education: Austrian data protection regulator ruled Microsoft illegally tracked students and used their data. Read more

Regulatory Fines & Enforcement Actions

Microsoft ‘illegally’ tracked students via 365 Education: Austrian data protection regulator ruled Microsoft illegally tracked students and used their data. Read more

AI

The Trump Administration’s Increased Use of Social Media Surveillance: Trump administration uses AI to monitor public speech of foreign nationals and revoke visas. Read more
When AI Agents Join the Teams: The Hidden Security Shifts No One Expects: Autonomous AI agents now open tickets, fix incidents, and make decisions faster than humans. Read more

Breaches

LinkedIn Stuck With Three Lawsuits Over Online Data Tracking: LinkedIn faces lawsuits over collecting sensitive information without consent, violating California privacy laws. Read more
SimonMed says 1.2 million patients impacted in January data breach: Medical imaging provider SimonMed Imaging is notifying over 1.2 million individuals of a data breach. Read more

Cybersecurity

Happy Cyber Awareness Month: October is Cyber Awareness Month, dedicated to raising awareness of cyber security incidents. Read more
Recapping CMMC Level 2: Considerations for Government Contractors: Contractors handling CUI may need CMMC Level 2 self-assessment for new contracts starting Nov 10, 2025. Read more
Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops: Signed UEFI shell components could be exploited to bypass Secure Boot protections. Read more
Chinese hackers abuse geo-mapping tool for year-long persistence: Chinese hackers used a geo-mapping tool as a web shell for over a year. Read more
Microsoft restricts IE mode access in Edge after zero-day attacks: Microsoft restricts IE mode access in Edge after zero-day attacks in Chakra JavaScript engine. Read more
Massive multi-country botnet targets RDP services in the US: A large-scale botnet is targeting Remote Desktop Protocol (RDP) services in the United States. Read more
SonicWall VPN accounts breached using stolen creds: Threat actors compromised over a hundred SonicWall SSLVPN accounts via stolen credentials. Read more

Microsoft

Microsoft warns that Windows 10 reaches end of support today: Windows 10 will no longer receive patches for newly discovered security vulnerabilities. Read more
Microsoft restricts IE mode access in Edge after zero-day attacks: Microsoft restricts IE mode access in Edge after zero-day attacks in Chakra JavaScript engine. Read more
Microsoft ‘illegally’ tracked students via 365 Education: Austrian data protection regulator ruled Microsoft illegally tracked students and used their data. Read more

Healthcare

SimonMed says 1.2 million patients impacted in January data breach: Medical imaging provider SimonMed Imaging is notifying over 1.2 million individuals of a data breach. Read more

Surveillance

The Trump Administration’s Increased Use of Social Media Surveillance: Trump administration uses AI to monitor public speech of foreign nationals and revoke visas. Read more
Protecting Privacy to Combat Authoritarianism: Surveillance is a powerful tool for authoritarian governments to stifle dissent. Read more

Sanctions, Data Breach, Warfare & UK Policy – 10/14/2025

info@grabtheaxe.com (Chris Armour) — Tue, 14 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including the UK’s move to a single sanctions list, significant healthcare data breaches, and the risks posed by Russian hybrid warfare. Additionally, upcoming identity verification requirements for UK pension scheme directors and the expiration of Medicare telehealth flexibilities demand immediate attention. Stay informed to navigate the evolving regulatory landscape and protect your organization from emerging threats.

Top 5 Critical Compliance Alerts

Time to Switch: UK Moves to a Single Sanctions List by January 2026: The UK Sanctions List (UKSL) will be the single official source of UK sanctions designations starting January 2026, replacing the OFSI Consolidated List. Read more
Fort Wayne Medical Education Program Data Breach Affects Almost 30,000 Individuals: A data breach at the Fort Wayne Medical Education Program has compromised the data of nearly 30,000 individuals. Read more
$30 Million Settlement Agreed to Resolve Integris Health Class Action Data Breach Lawsuit: Integris Health settles a class action lawsuit for $30 million following a data breach. Read more
Russia’s Hybrid Warfare Triggers Logistics, Comms & Operational Disruption: US companies supporting Ukraine face increased risk of sabotage targeting logistics and communications. Read more
FREE WEBINAR NEXT WEEK: Building a Compliant Workforce: A free webinar will be held next week focusing on how to build a compliant workforce. Read more

Compliance Frameworks

FREE WEBINAR NEXT WEEK: Building a Compliant Workforce: A free webinar will be held next week focusing on how to build a compliant workforce. Read more

Regulatory Updates

Time to Switch: UK Moves to a Single Sanctions List by January 2026: The UK Sanctions List (UKSL) will be the single official source of UK sanctions designations starting January 2026, replacing the OFSI Consolidated List. Read more
NY Lobbying and Ethics Commission Weighs Regulations Changes: The New York State Commission on Ethics and Lobbying in Government is considering several proposed changes to its regulations. Read more
Medicare Telehealth Flexibilities Expire: Temporary Medicare telehealth flexibilities implemented during the COVID-19 pandemic have expired, impacting service delivery. Read more

Third-Party Risk & Due Diligence

Russia’s Hybrid Warfare Triggers Logistics, Comms & Operational Disruption: US companies supporting Ukraine face increased risk of sabotage targeting logistics and communications. Read more

Policy & Governance Updates

Pension Scheme Trustee Directors – Identity Verification Requirements: New requirements for individual directors of UK companies, including pension scheme trustee directors, to verify their identity starting November 18, 2025. Read more

Windows Zero-Days, Patch Tuesday & Android Attacks – 10/14/2025

info@grabtheaxe.com (Chris Armour) — Tue, 14 Oct 2025 00:00:00 GMT

Today’s security landscape is dominated by Microsoft’s October Patch Tuesday, which addresses a massive 172 flaws, including six zero-days under active exploitation. This release coincides with the final security update for Windows 10, officially marking its end-of-life. We are also tracking a novel ‘Pixnapping’ attack against Android devices capable of stealing MFA codes, a silent Oracle zero-day patch, and CISA’s addition of five new actively exploited vulnerabilities to its KEV catalog. Here is the critical intelligence you need to stay ahead of today’s threats.

Top 5 Critical Security Alerts

Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws; Microsoft’s massive October Patch Tuesday addresses 172 vulnerabilities, including six zero-days that are already being actively exploited in the wild. Read more
CISA Adds Five Known Exploited Vulnerabilities to Catalog: CISA has added five new vulnerabilities to its KEV catalog, including flaws in Microsoft Windows, requiring federal agencies to patch them immediately due to active exploitation. Read more
New Android Pixnapping attack steals MFA codes pixel-by-pixel: A novel side-channel attack on Android, named Pixnapping, allows malicious apps without any special permissions to steal sensitive data like MFA codes by reconstructing screen pixels. Read more
Oracle silently fixes zero-day exploit leaked by ShinyHunters: Oracle has quietly patched a zero-day vulnerability in its E-Business Suite that was actively exploited after the ShinyHunters extortion group publicly leaked a proof-of-concept. Read more
Chinese hackers abuse geo-mapping tool for year-long persistence: Chinese state-sponsored hackers (Flax Typhoon) maintained undetected access to a target’s network for over a year by turning a component of the ArcGIS geo-mapping tool into a persistent web shell. Read more

Threat Intelligence (APT, malware, ransomware)

US seizes $15 billion in crypto from ‘pig butchering’ kingpin: The US Department of Justice has seized a staggering $15 billion in bitcoin from the leader of the Prince Group, a criminal organization behind widespread ‘pig butchering’ crypto scams. Read more
Taiwan reports surge in Chinese cyber activity and disinformation efforts: Taiwan’s National Security Bureau reports a significant increase in network intrusions and influence operations from China this year, with a strong focus on critical infrastructure. Read more
Malicious crypto-stealing VSCode extensions resurface on OpenVSX: A threat actor is persistently targeting developers by publishing malicious Visual Studio Code extensions on multiple marketplaces to steal cryptocurrency and install backdoors. Read more
Signal in the noise: what hashtags reveal about hacktivism in 2025: Kaspersky researchers analyzed over 11,000 hacktivist posts to identify trends in how campaigns are organized and targeted, using hashtag data from the surface and dark web. Read more

Security Breaches & Incidents

Indiana city confirms ransomware hackers behind September incident: Officials in Michigan City, Indiana, have confirmed that a damaging cyber incident in September that crippled government systems was a ransomware attack. Read more
Feds sanction Cambodian conglomerate over cyber scams, seize $15 billion from chairman: The U.S. Treasury Department has sanctioned the Prince Group and its chairman, seizing $15 billion in assets for its role in large-scale cyber scam operations. Read more

Security Tools & Best Practices

Final Windows 10 Patch Tuesday update rolls out as support ends: Microsoft has released the final free cumulative security update for Windows 10, marking the official end of its support lifecycle and urging users to upgrade. Read more
The king is dead, long live the king! Windows 10 EOL and Windows 11 forensic artifacts: With Windows 10 support ending, security experts are detailing the new and changed forensic artifacts in Windows 11 that will be critical for future incident response investigations. Read more
Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops: A significant vulnerability was discovered in nearly 200,000 Framework laptops running Linux, where signed UEFI components could be exploited to bypass Secure Boot protections. Read more

Cloud & Network Security

Satellites found exposing unencrypted data, including phone calls and some military comms: Researchers have discovered satellites exposing large volumes of unencrypted data, including sensitive phone calls and military communications from providers like T-Mobile and AT&T. Read more

Security Standards & Frameworks

California passes first U.S. law regulating AI companion chatbots: California has enacted the first law in the United States requiring safety measures for AI companion chatbots, prompted by tragic events involving young users. Read more

Emerging Security Technologies

When AI Agents Join the Teams: The Hidden Security Shifts No One Expects: The increasing use of autonomous AI agents in IT operations is creating a ‘Shadow AI’ problem, introducing new security risks that require governing these agents as powerful identities. Read more

Data Breaches, Quantum Threat & DC BEST Act – 10/13/2025

info@grabtheaxe.com (Chris Armour) — Mon, 13 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical data breach settlements and the growing threat landscape impacting various sectors. Key updates include a $4 million settlement for ALN Medical Management, a significant data breach at SimonMed Imaging affecting 1.27 million individuals, and warnings about the vulnerability of critical infrastructure due to unmonitored data. Additionally, the digest covers the long-term risks associated with quantum computing and new identity verification requirements for UK pension scheme directors.

Top 5 Critical Compliance Alerts

SimonMed Imaging Data Breach: SimonMed Imaging is notifying 1.27M individuals affected by a January 2025 cyberattack. Read more
ALN Medical Management Data Breach Settlement: ALN Medical Management to pay $4 million to settle class action data breach lawsuit. Read more
Critical Infrastructure Data Sprawl: Critical infrastructure CISOs must address unmonitored back-office data to defend against nation-state actors. Read more
Quantum Computing Threat: Financial and other industries are urged to prepare for the potential of quantum computers breaking current encryption. Read more
UK Pension Scheme Identity Verification: New identity verification requirements coming into force for individual directors of UK companies, including pension scheme trustee directors. Read more

Compliance Frameworks

HIPAA Data Breach Settlement: ALN Medical Management to pay $4 million to settle class action data breach lawsuit. Read more

Regulatory Updates

DC’s BEST Act: Understanding D.C.’s New BEST Act and What It Means for Your Business. Read more
NY Lobbying and Ethics Commission: The New York State Commission on Ethics and Lobbying in Government is weighing regulations changes. Read more

Third-Party Risk & Due Diligence

Foreign Ownership Mitigation: Navigating Foreign Ownership Mitigation in the Commercial Space Era. Read more

Policy & Governance Updates

2025 Code of Conduct Report: Review of the 2025 Code of Conduct Report. Read more
Importance of ‘Feeling Heard’: Analysis of the importance of ‘feeling heard’ within organizations. Read more

Oracle Zero-Day, Android 2FA Theft & IE Exploit – 10/13/2025

info@grabtheaxe.com (Chris Armour) — Mon, 13 Oct 2025 00:00:00 GMT

Today’s security landscape is dominated by critical, actively exploited vulnerabilities. Oracle has released an emergency patch for a zero-day flaw in its E-Business Suite, while Microsoft is forced to lock down IE Mode in Edge due to separate zero-day attacks. A novel ‘Pixnapping’ attack on Android devices can steal 2FA codes without permissions, and a massive botnet is targeting RDP services across the US. Here is what you need to know to stay protected.

Top 5 Critical Security Alerts

Oracle releases emergency patch for new E-Business Suite flaw: Oracle has issued an out-of-band patch for a critical, unauthenticated remote execution vulnerability in its E-Business Suite. Immediate patching is required. Read more
Microsoft restricts IE mode access in Edge after zero-day attacks: Microsoft is locking down Internet Explorer mode in Edge after discovering active zero-day attacks exploiting the Chakra JavaScript engine for remote access. Read more
Hackers can steal 2FA codes and private messages from Android phones: A novel ‘Pixnapping’ side-channel attack allows a malicious Android app, requiring no permissions, to steal 2FA codes and private messages from the screen. Read more
Massive multi-country botnet targets RDP services in the US: A large-scale botnet, originating from over 100,000 unique IP addresses, is actively conducting brute-force attacks against Remote Desktop Protocol (RDP) services in the U.S. Read more
SonicWall VPN accounts breached using stolen creds in widespread attacks: Threat actors have compromised over a hundred SonicWall SSLVPN accounts in a large-scale campaign using valid, stolen credentials to gain network access. Read more

Security Breaches & Incidents

SimonMed says 1.2 million patients impacted in January data breach: U.S. medical imaging provider SimonMed is notifying 1.2 million individuals that their sensitive information was exposed in a data breach earlier this year. Read more
Harvard investigating breach linked to Oracle zero-day exploit: Following its appearance on the Clop ransomware leak site, Harvard University is investigating a data breach linked to the newly disclosed Oracle E-Business Suite zero-day. Read more
UK hit by record number of ‘nationally significant’ cyberattacks: The UK government reports a record number of major cyberattacks, prompting a direct appeal to business leaders to strengthen their enterprise security posture. Read more

Threat Intelligence

Researchers Warn RondoDox Botnet is Weaponizing Over 50 Flaws Across 30+ Vendors: The RondoDox botnet has significantly expanded its attack surface, now leveraging over 50 vulnerabilities in products from more than 30 vendors to compromise infrastructure. Read more
New Rust-Based Malware “ChaosBot” Uses Discord Channels to Control Victims’ PCs: A new backdoor written in Rust, named ChaosBot, is using Discord channels for command-and-control to execute commands and conduct reconnaissance on compromised systems. Read more
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns: The Astaroth banking trojan is now using GitHub repositories to host its malware, making its C2 infrastructure more resilient against takedown efforts. Read more

Cloud & Network Security

Hackers Target ScreenConnect Features For Network Intrusions: Attackers are increasingly exploiting features within the ScreenConnect RMM tool, often via phishing, to gain unauthorized control over target systems and networks. Read more

Emerging Security Technologies

Why Signal’s post-quantum makeover is an amazing engineering achievement: Signal’s implementation of the ML-KEM algorithm sets a new, high standard for post-quantum readiness, protecting user communications from future cryptographic threats. Read more

Security Tools & Best Practices

Meet Varonis Interceptor: AI-Native Email Security: Varonis has launched Interceptor, an AI-native email security platform that uses multimodal AI to detect and stop zero-hour phishing and social engineering attacks. Read more
Building a lasting security culture at Microsoft: Microsoft outlines its internal strategy for creating a durable security culture, emphasizing that every employee has a critical role in protecting the company and its customers. Read more

Security Standards & Frameworks

Netherlands invokes special powers against Chinese-owned semiconductor company Nexperia: Citing national security risks and ‘serious governance shortcomings,’ the Dutch government has taken control of the Chinese-owned chipmaker Nexperia. Read more

Student Data, AI Ethics, Data Breaches & Regulations – 10/13/2025

info@grabtheaxe.com (Chris Armour) — Mon, 13 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights critical breaches affecting healthcare and education, alongside growing concerns about AI’s role in politics and liability. Microsoft faces scrutiny over student data tracking and its involvement in international conflicts. Additionally, vulnerabilities in Oracle and Microsoft products demand immediate attention to safeguard sensitive data.

Top 5 Critical Privacy Alerts

Microsoft ‘illegally’ tracked students via 365 Education: Austrian data protection regulator ruled Microsoft illegally tracked students and used their data via 365 Education. Read more
SimonMed says 1.2 million patients impacted in January data breach: U.S. medical imaging provider SimonMed Imaging is notifying over 1.2 million individuals of a data breach. Read more
SonicWall VPN accounts breached using stolen creds: Threat actors compromised more than a hundred SonicWall SSLVPN accounts in a large-scale campaign using stolen credentials. Read more
Harvard investigating breach linked to Oracle zero-day exploit: Harvard University is investigating a data breach after the Clop ransomware gang listed the school on its data leak site. Read more
EFF urges action around Microsoft’s role in Israel’s War on Gaza: EFF and other organizations call on Microsoft to cease involvement in providing AI and cloud computing technologies for use in Israel’s actions. Read more

Privacy Laws & Regulations

California’s Latest Trio of Privacy Bills: New laws in California allow consumers greater control over their personal information. Read more
2025 Brought Us Eight US “Comprehensive” Privacy Laws: Maryland law went into effect on October 1st, bringing the total to 17 US state privacy laws in 2025. Read more

Data Breaches

SimonMed says 1.2 million patients impacted in January data breach: U.S. medical imaging provider SimonMed Imaging is notifying over 1.2 million individuals of a data breach that exposed their sensitive information. Read more
Harvard investigating breach linked to Oracle zero-day exploit: Harvard University is investigating a data breach after the Clop ransomware gang listed the school on its data leak site. Read more

AI

AI and the Future of American Politics: AI is poised to play a volatile role in America’s next federal election in 2026, with potential impacts for democracy. Read more
Meet Varonis Interceptor: AI-Native Email Security: Varonis’ new Interceptor platform uses multimodal AI to detect zero-hour phishing and social engineering attacks. Read more
Equity threatens mass direct action over use of actors’ images in AI content: Equity threatens action over use of members’ likenesses, images and voices in AI content without permission. Read more
AI could make it harder to establish blame for medical failings: Experts warn AI in healthcare could create a legally complex blame game for medical failings. Read more

Microsoft

Microsoft ‘illegally’ tracked students via 365 Education: Austrian data protection regulator ruled Microsoft illegally tracked students and used their data via 365 Education. Read more
Microsoft restricts IE mode access in Edge after zero-day attacks: Microsoft is restricting access to Internet Explorer mode in Edge browser after zero-day exploits. Read more
Microsoft investigates outage affecting Microsoft 365 apps: Microsoft is investigating an ongoing incident preventing some customers from accessing Microsoft 365 applications. Read more
Microsoft: Windows 11 Media Creation Tool broken on Windows 10 PCs: The latest version of the Windows 11 Media Creation Tool (MCT) no longer works correctly on Windows 10 22H2 computers. Read more
EFF urges action around Microsoft’s role in Israel’s War on Gaza: EFF and other organizations call on Microsoft to cease involvement in providing AI and cloud computing technologies for use in Israel’s actions. Read more

Vulnerabilities

Microsoft restricts IE mode access in Edge after zero-day attacks: Microsoft is restricting access to Internet Explorer mode in Edge browser after zero-day exploits. Read more
Oracle releases emergency patch for new E-Business Suite flaw: Oracle has issued an emergency security update to patch another E-Business Suite (EBS) vulnerability. Read more
Harvard investigating breach linked to Oracle zero-day exploit: Harvard University is investigating a data breach after the Clop ransomware gang listed the school on its data leak site. Read more

Edge Vulns, Botnet Exploits, & Regulations – 10/11/2025

info@grabtheaxe.com (Chris Armour) — Sat, 11 Oct 2025 00:00:00 GMT

This compliance digest highlights critical security vulnerabilities and important regulatory updates. The RondoDox botnet’s exploit of edge device vulnerabilities and the AI browser agent security gaps addressed by 1Password are key concerns. Additionally, changes to Victorian psychosocial regulations, NCAA gambling policies, and H-2A wage rules demand immediate attention for compliance professionals.

Top 5 Critical Compliance Alerts

RondoDox Botnet: an ‘Exploit Shotgun’ for Edge Vulns: RondoDox takes a hit-and-run, shotgun approach to exploiting bugs in consumer edge devices around the world. Read more
1Password Addresses Critical AI Browser Agent Security Gap: The security company looks to tackle new authentication challenges that could lead to credential leakage, as enterprises increasingly leverage AI browser agents. Read more

Regulatory Updates

Ready or Not, Here They Come: The Victorian Psychosocial Regulations and Compliance Code Explained: On 30 September 2025, the Victorian Minister for WorkSafe and TAC made: The Occupational Health and Safety (Psychological Health) Regulations 2025 (the Victorian Regulations). Read more
NCAA Takes Steps to Permit Gambling on Professional Sports While Continuing to Crack Down on College Sports Betting: On October 8, 2025, the NCAA Division I Administrative Committee adopted a proposal that would allow for student-athletes and athletics department staff members to bet on professional sports. Read more
Harvesting Change: the New H-2A Wage Rule for Agricultural Employers: The Department of Labor (DOL) recently issued an Interim Final Rule (IFR) that significantly revises the methodology for determining the Adverse Effect Wage Rates (AEWRs) for H-2A nonimmigrant workers in non-range occupations across the United States. Read more

Policy & Governance Updates

Order in the HOA: Tips for Conducting Compliant and Transparent Board Meetings: Compliance with an HOA’s governing documents helps avoid legal liabilities and ensures decisions are made consistent with North Carolina law. Read more

Audit & Monitoring Tools

Legal Tech Audits: Improve Your Law Firm’s Efficiency and Security: As the legal industry becomes increasingly defined by the integration of advancing technologies, many law firms today are learning that having top legal talent is no longer enough to continue growing and remain competitive. Read more
Compliance Tip of the Day – Compliance Lessons from Wells Fargo’s AI-Assisted Whistleblower Program: Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Read more

SonicWall VPN Attacks, LockBit Tactics & Apple Bounties – 10/11/2025

info@grabtheaxe.com (Chris Armour) — Sat, 11 Oct 2025 00:00:00 GMT

Today’s critical threat landscape is dominated by a widespread compromise of SonicWall SSL VPNs, where attackers are leveraging valid credentials for broad access. We are also tracking the evolution of ransomware tactics, as LockBit operators are now weaponizing the legitimate DFIR tool Velociraptor in their attacks. Additional intelligence covers Apple’s significant increase in bug bounty rewards and emerging developments in AI governance and research. Stay informed on these key issues.

Top 2 Critical Security Alerts

Experts Warn of Widespread SonicWall VPN Compromise Impacting Over 100 Accounts: Huntress warns of a widespread compromise affecting SonicWall SSL VPN devices, where attackers are using valid credentials for rapid, large-scale access to customer environments. Read more
Hackers Turn Velociraptor DFIR Tool Into Weapon in LockBit Ransomware Attacks — Threat actors associated with the LockBit ransomware are abusing the open-source digital forensics and incident response (DFIR) tool Velociraptor to facilitate their attacks. Read more

Security Tools & Best Practices

Apple ups the reward for finding major exploits to $2 million — To incentivize security research, Apple has increased its maximum bug bounty reward to $2 million for major exploits, with potential bonuses pushing the total payout to $5 million. Read more

Emerging Security Technologies

Google Deepmind’s “Vibe Checker” aims to rate AI code by human standards — A new study from Google DeepMind proposes a new benchmark to evaluate AI-generated code based on human developer preferences rather than just functional correctness. Read more
OpenAI accused of pressuring AI regulation advocates with subpoenas — Reports indicate OpenAI has served subpoenas to civil society groups and individuals advocating for stricter AI regulations, raising concerns about corporate influence on policy. Read more
A new information-theory framework reveals when multi-agent AI systems truly work as a team — Researchers have developed a new framework to measure genuine teamwork in multi-agent AI systems, helping to distinguish collaborative intelligence from simple parallel task execution. Read more

Zero-Day Exploit, Data Scraping & Foster Youth Risks – 10/11/2025

info@grabtheaxe.com (Chris Armour) — Sat, 11 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights the exploitation of a zero-day vulnerability in Gladinet file sharing software, posing a significant risk to system files. We also examine the privacy implications of data scraping for AI, the risks of identity theft for foster youth, and ongoing scams targeting consumers. Stay informed to protect your data and privacy.

Top 5 Critical Privacy Alerts

Hackers exploiting zero-day in Gladinet file sharing software: Threat actors are exploiting a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and Triofox products. Read more
Article: The Great Scrape: The Clash Between Scraping and Privacy: AI systems depend on scraped data, often containing personal information, impacting tools like facial recognition. Read more
How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft due to frequent moves and increased access to their information. Read more
No, that’s not an FTC commissioner on the phone: Scammers impersonate FTC officials to steal money; the FTC will never ask you to move your money. Read more
Who’s eligible for a refund from Amazon?: Amazon is refunding consumers who were enrolled in Prime subscriptions without their consent and then made it difficult to cancel. Read more

Data Minimization & User Consent

When sharing your info online leads to unwanted and unlawful telemarketing calls: Sharing your information online can lead to unwanted telemarketing calls, which are illegal if you’re on the Do Not Call Registry. Read more

Regulatory Fines & Enforcement Actions

Who’s eligible for a refund from Amazon?: Amazon is refunding consumers who were enrolled in Prime subscriptions without their consent and then made it difficult to cancel. Read more

Uncategorized

How to prepare yourself to deal with an emergency and avoid disaster-related scams: Having a plan and knowing how to spot disaster-related scams can make a difference to anyone recovering from a disaster. Read more
How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft due to frequent moves and increased access to their information. Read more
No, that’s not an FTC commissioner on the phone: Scammers impersonate FTC officials to steal money; the FTC will never ask you to move your money. Read more
Get a credit freeze to stop identity thieves: Freezing your credit is a great way to protect yourself from identity theft. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: Scammers are active during Medicare Open Enrollment, so learn to spot the scams to protect your money and information. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Be cautious when selling your timeshare, as there are many scams to watch out for. Read more
Before you donate, find out where the money is going: Ensure that the fundraiser is legitimate and that your money will be spent as promised. Read more
How to spot a job scam: Learn how to identify phony business opportunities, work-at-home scams, and shady employment agencies. Read more
Tony Blair and Nick Clegg hosted dinner giving tech bosses access to UK minister: Tony Blair and Nick Clegg hosted a private dinner for tech leaders to meet with a UK minister. Read more
Using a swearword in your Google search can stop the AI answer. But should you?: Using a swear word in your Google search can stop the AI answer from popping up. Read more
Watch Now: Navigating Surveillance with EFF Members: EFF partnered with WISP to discuss online behavioral tracking and the data broker industry. Read more
EFF Austin: Organizing and Making a Difference in Central Texas: EFF-Austin advocates for digital rights and educates the public about emerging technologies. Read more

AML Failures, AI Law, Data Breach, FCA Scheme – 10/08/2025

info@grabtheaxe.com (Chris Armour) — Wed, 08 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including Varengold Bank’s AML failures and the FCA’s consultation on UK motor finance. We also cover a 10-year insider data breach at Harris Health, along with active exploitation of vulnerabilities in Oracle E-Business Suite and Fortra’s GoAnywhere. Stay informed on key regulatory changes and emerging cyber threats impacting compliance.

Top 5 Critical Compliance Alerts

Varengold Bank’s AML failures: A cautionary tale for Europe’s financial sector: Germany’s financial regulator BaFin fined Varengold Bank AG €3.3 million for AML control weaknesses stemming from systemic governance failures. Read more
FCA Starts Consultation on UK Motor Finance Consumer Redress Scheme: The FCA published a consultation paper on an industry-wide scheme to compensate motor finance customers who were treated unfairly between 2007 and 2024. Read more
Harris Health Notifies Patients About 10-Year Insider Data Breach: Harris Health in Texas notified over 5,000 patients about a potential data breach where electronic health records may have been compromised. Read more
Cl0p Mass Exploiting Zero-day Vulnerability in Oracle E-Business Suite: A zero-day vulnerability in Oracle E-Business Suite is under active exploitation by the Cl0p ransomware group. Read more
Critical GoAnywhere Vulnerability Exploited in Medusa Ransomware Attacks: A critical vulnerability in Fortra’s GoAnywhere MFT secure web-based file transfer tool is being actively exploited in Medusa ransomware attacks. Read more

Regulatory Updates

Vietnam: Releasing draft AI Law for comprehensive AI governance framework: Vietnam’s draft AI Law aims to establish a comprehensive AI governance framework by January 2026, introducing phased implementation, risk-based classification, and strict penalties for violations. Read more
Brazil: Data Protection Authority becomes a regulatory agency and assumes new responsibilities for the digital protection of children and adolescents: The Brazilian Data Protection Authority (ANPD) now oversees digital protections for children and adolescents, including enforcing court orders and setting security standards. Read more
United States: White House publishes plan for the taxation of cryptocurrencies and other digital assets: The US Administration’s Working Group on Digital Asset Markets published recommendations for revising legislation and IRS guidance regarding cryptocurrency taxation. Read more
Ukraine: Approval of Defence City regime for arms manufacturers including tax and customs incentives: Ukraine’s Defence City regime offers tax, customs, and regulatory incentives to defence-related enterprises, effective from October 2025. Read more

Policy & Governance Updates

Why Are Your Policies Yelling at Me? It’s Time to Rethink Tone in Rules. — Policy-writing expert Lewis Eisen examines how corporate policies are often worded more harshly than laws governing serious crimes, undermining positive relationships and cooperative workplaces. Read more
Why Letting Go of Control Can Strengthen Your E&C Program: Smart governance builds processes that feel natural; bureaucracy multiplies steps until employees seek workarounds. Read more
Colombia adopts the first certifiable international standard for AI systems: ISO/IEC 42001:2023: Organizations in Colombia can now adopt ISO/IEC 42001:2023, becoming among the first in Latin America with a certifiable standard for responsible AI management. Read more

Audit & Monitoring Tools

Types of Penetration Tests: A Look at Different Pentest Techniques & Tools: A blog post discussing penetration testing techniques and tools, including their relation to SOC 2 requirements and comparison to vulnerability assessments. Read more
Incident Response Management Best Practices for Financial Services Compliance Executives — No content available. Read more

Third-Party Risk & Due Diligence

Calling All Influencers: Spear-Phishers Dangle Tesla, Red Bull Jobs: Cyberattackers are using impersonation campaigns aimed at stealing résumés from social media pros. Read more

Compliance Frameworks

2025 Asia-Pacific Community Meeting Agenda Highlights: The 2025 PCI SSC Asia-Pacific Community Meeting will take place in Bangkok, Thailand on 5-6 November. Read more

ALPR Abuse, AI Influence, Discord Breach – 10/07/2025

info@grabtheaxe.com (Chris Armour) — Tue, 07 Oct 2025 00:00:00 GMT

Today’s privacy intelligence digest reveals critical privacy threats, including the misuse of ALPR data by law enforcement in Texas, a sophisticated AI-driven influence operation targeting Iran, and a significant data breach at Discord exposing user IDs. We also cover spyware campaigns targeting messaging app users in the UAE and updated guidance from CISA for government contractors on SBOM. Here’s your concise update to stay informed and prepared.

Top 5 Critical Privacy Alerts

Flock Safety ALPR Abuse: Texas sheriff misused license plate reader data in an abortion investigation, contradicting initial claims. The investigation involved accessing data across state lines. Read more
AI-Enabled Influence Operation: Citizen Lab uncovers an AI-driven influence campaign against Iran, likely conducted by Israel, using inauthentic X profiles. The operation aimed to incite revolt against the Iranian government. Read more
Discord Data Breach: Proof-of-age IDs, including driver’s licenses and passports, were leaked in a Discord data breach via a third-party customer service provider. Users who contacted customer service or trust and safety teams were affected. Read more
Spyware Targeting UAE Messaging App Users: Researchers discovered spyware embedded in fake messaging apps targeting users in the United Arab Emirates. The spyware campaigns, ProSpy and ToSpy, pose as Signal and ToTok. Read more

Privacy Laws & Regulations

Software Bill of Materials Guidance: CISA issued updated guidance for government contractors on Software Bill of Materials (SBOM), following NTIA’s 2021 publication. The guidance responds to Executive Order 14028 on improving cybersecurity. Read more

Data Minimization & User Consent

Opt Out October: Daily Tips to Protect Your Privacy and Security: EFF provides daily tips throughout October to help users opt out of tech giants’ surveillance practices. Tips include establishing digital hygiene, learning about data brokers, and disabling ad tracking. Read more

Regulatory Fines & Enforcement Actions

FTC Consumer Alerts: The FTC warns consumers about various scams, including impersonating FTC officials, fake job opportunities, and disaster-related schemes. The alerts also cover refunds from Amazon and protecting foster youth from identity theft. Read more

Data Breach, GDPR, Cyber Tech & FinCrime – 10/06/2025

info@grabtheaxe.com (Chris Armour) — Mon, 06 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including a $5 million settlement in an EyeMed data breach case and key insights into GDPR compliance training. We also cover the rise of self-propagating malware targeting WhatsApp users in Brazil and the concerning trend of Chinese government fronts exploiting Western cyber tech. Stay informed on these pressing issues to enhance your organization’s risk management and compliance strategies.

Top 5 Critical Compliance Alerts

EyeMed Vision Care Agrees to Pay $5 Million to Settle Class Action Data Breach Lawsuit: EyeMed Vision Care settles a class action lawsuit stemming from a June 2020 data breach for $5 million. Read more
5 common GDPR mistakes – and how training can fix them: Common GDPR breaches arise from everyday slip-ups; training can mitigate risks of complaints, investigations, and fines. Read more
Self-Propagating Malware Hits WhatsApp Users in Brazil: The Water Saci campaign spreads Sorvepotel malware, stealing credentials and monitoring browser activity to defraud financial institutions. Read more
Chinese Gov’t Fronts Trick the West to Obtain Cyber Tech: Outwardly neutral Chinese institutions collaborate with Western organizations and researchers for PRC state intelligence. Read more
Why Most Banks Are Not Ready for Agentic AI in FinCrime Prevention (and How to Get There): Readiness assessments and strategic guardrails separate transformative adoption from costly failures in FinCrime prevention using Agentic AI. Read more

Compliance Frameworks

EyeMed Vision Care Agrees to Pay $5 Million to Settle Class Action Data Breach Lawsuit: EyeMed Vision Care settles a class action lawsuit stemming from a June 2020 data breach for $5 million. Read more

Regulatory Updates

FinReg Monthly Update: Highlights the latest developments in UK and EU financial services regulation for September 2025, including FCA priorities. Read more
Streamlining Consumer Duty – A Welcome Update from the FCA: Discusses the challenges and updates regarding the implementation of the FCA Consumer Duty regime. Read more

Third-Party Risk & Due Diligence

Chinese Gov’t Fronts Trick the West to Obtain Cyber Tech: Outwardly neutral Chinese institutions collaborate with Western organizations and researchers for PRC state intelligence. Read more

Policy & Governance Updates

New Presidential Memo: Why Federal Grantees Should Engage in Byrd Watching: A Presidential Memorandum addresses the Attorney General regarding the use of appropriated funds for illegal lobbying and partisan political activity by federal grantees. Read more
Between Silence & Oversharing: Navigating Tariff Disclosure in a Shifting Trade Environment: Discusses navigating tariff disclosure in a shifting trade environment. Read more
5 common GDPR mistakes – and how training can fix them: Common GDPR breaches arise from everyday slip-ups; training can mitigate risks of complaints, investigations, and fines. Read more

Oracle Zero-Day, Clop Attacks & GoAnywhere Exploit – 10/06/2025

info@grabtheaxe.com (Chris Armour) — Mon, 06 Oct 2025 00:00:00 GMT

Today’s threat landscape is dominated by a critical Oracle E-Business Suite zero-day vulnerability being actively exploited by the Clop ransomware gang for data theft, prompting urgent patch advisories from the FBI and CISA. Additionally, a severe GoAnywhere MFT bug is being used to deploy Medusa ransomware, and the Red Hat data breach has escalated with the involvement of the ShinyHunters extortion group. This summary covers the essential details you need to know to protect your organization.

Top 5 Critical Security Alerts

Oracle E-Business Suite Zero-Day Under Active Exploit by Clop: A critical unauthenticated RCE vulnerability (CVE-2025-61882) in Oracle’s E-Business Suite is being actively exploited by the Clop ransomware gang for data theft attacks, prompting an emergency patch. Read more
FBI and UK Gov Issue Urgent Warning on Oracle Vulnerability: The FBI and UK’s NCSC are urging all organizations to patch the Oracle EBS zero-day immediately, describing it as a ‘stop-what-you’re-doing’ level threat due to widespread exploitation by Clop. Read more
Critical GoAnywhere MFT Bug Exploited in Medusa Ransomware Attacks: Microsoft reports that cybercrime group Storm-1175 is exploiting a maximum severity vulnerability (CVE-2025-10035) in Fortra’s GoAnywhere MFT to deploy Medusa ransomware. Read more
Red Hat Data Breach Escalates as ShinyHunters Joins Extortion: The data breach impacting enterprise software giant Red Hat has worsened, with the ShinyHunters extortion group now leaking stolen customer data and demanding a ransom. Read more
Redis Warns of Critical RCE Flaw Impacting Thousands of Instances: Redis has patched a maximum severity vulnerability that could allow unauthenticated attackers to achieve remote code execution on thousands of internet-exposed instances. Read more

Threat Intelligence

XWorm Malware Resurfaces with Ransomware Module and 35+ Plugins: The XWorm backdoor is being distributed in new phishing campaigns, now upgraded with a ransomware module and over 35 plugins for enhanced malicious capabilities. Read more
New Malware Leverages WhatsApp to Target Brazilian Organizations: A self-propagating malware is targeting Brazilian government and business users via WhatsApp, hijacking contact lists to spread and steal financial data. Read more
Suspected Chinese Cyber Spies Targeted Serbian Aviation Agency: A hacking group believed to be linked to China has targeted a Serbian government aviation department and other European institutions in a cyberespionage campaign. Read more
Zimbra Zero-Day Exploited to Target Brazilian Military: A now-patched XSS zero-day vulnerability (CVE-2025-27915) in Zimbra Collaboration was used in attacks against the Brazilian military via malicious ICS calendar files. Read more

Security Breaches & Incidents

Steam and Microsoft Warn of Unity Flaw Exposing Gamers to Attacks: A code execution vulnerability in the popular Unity game engine could be exploited by attackers to compromise gamers’ systems on both Android and Windows. Read more

Security Tools & Best Practices

How We Trained an ML Model to Detect DLL Hijacking: Kaspersky researchers provide a detailed breakdown of how they developed and trained a machine learning model to effectively identify and prevent DLL hijacking attacks. Read more

Cloud & Network Security

Zeroday Cloud Hacking Contest Offers $4.5 Million in Bounties: A new bug bounty competition, Zeroday Cloud, has been launched with a $4.5 million prize pool to encourage researchers to find and report exploits in open-source cloud and AI tools. Read more

Security Standards & Frameworks

CISA Adds Seven Known Exploited Vulnerabilities to Catalog: CISA has added seven vulnerabilities to its KEV catalog, including the critical Oracle EBS flaw (CVE-2025-61882), mandating immediate patching for federal agencies. Read more

Emerging Security Technologies

California Passes First Sweeping AI Safety Law: California has enacted SB 53, the first broad AI safety law in the U.S., which mandates that major AI developers adhere to strict safety protocols to prevent catastrophic risks. Read more
The Role of Artificial Intelligence in Today’s Cybersecurity Landscape: An analysis of how AI is transforming cybersecurity by enhancing threat detection, accelerating incident response, and enabling smarter threat hunting in XDR and SIEM platforms. Read more

Cybercriminal Tactics, Nation-State Hackers – 10/05/2025

info@grabtheaxe.com (Chris Armour) — Sun, 05 Oct 2025 00:00:00 GMT

Today’s compliance digest highlights the critical need to understand the evolving tactics of cybercriminals and nation-state actors. A Dark Reading virtual event focuses on providing insights into how these adversaries operate. Understanding these methods is crucial for developing effective defense strategies and maintaining robust security postures.

Critical Compliance Alert

[Dark Reading Virtual Event] Know Your Enemy: How cybercriminals and nation-state hackers operate: Learn about the tactics and strategies employed by cybercriminals and nation-state actors in this Dark Reading virtual event. Read more

Zimbra Flaw, ParkMobile Breach & Data Scams – 10/05/2025

info@grabtheaxe.com (Chris Armour) — Sun, 05 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights critical security flaws, data breach settlements, and a surge in scams targeting consumers. A zero-day vulnerability in Zimbra is being actively exploited, while ParkMobile’s settlement for a 2021 data breach offers minimal compensation. Additionally, the FTC warns of scammers impersonating officials and provides guidance on avoiding job, timeshare, and donation scams. Stay informed to protect your data and finances.

Top 5 Critical Privacy Alerts

Hackers exploited Zimbra flaw as zero-day using iCalendar files : A flaw in Zimbra Collaboration Suite was exploited in zero-day attacks. Researchers found the attacks while monitoring .ICS calendar attachments. Read more
ParkMobile pays… $1 each for 2021 data breach that hit 22 million : ParkMobile settles class action over 2021 data breach affecting 22 million users, offering a mere $1 in-app credit as compensation. Victims must manually claim it before it expires. Read more
No, that’s not an FTC commissioner on the phone : Scammers impersonate FTC officials to steal money, urging victims to move funds. The FTC never tells people to move money. Read more
How to help protect foster youth from identity theft : Foster youth are at higher risk of identity theft due to frequent moves and multiple access points to their information. Learn how to protect them. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls : Companies trick users into sharing data, then sell it to telemarketers, resulting in illegal calls. Learn to reduce unwanted telemarketing. Read more

Data Minimization & User Consent

Who’s eligible for a refund from Amazon? : Amazon agreed to pay $2.5 billion for enrolling users in Prime without consent and making cancellation difficult. Find out who gets a refund. Read more

Regulatory Fines & Enforcement Actions

ParkMobile pays… $1 each for 2021 data breach that hit 22 million : ParkMobile settles class action over 2021 data breach affecting 22 million users, offering a mere $1 in-app credit as compensation. Victims must manually claim it before it expires. Read more

AI & Chatbots

ChatGPT social could be a thing, as leak shows direct messages support : Leaks suggest OpenAI plans to add direct messaging support to ChatGPT, expanding its functionality beyond a chatbot. It could become a social platform. Read more
OpenAI rolls out GPT Codex Alpha with early access to new models : OpenAI releases GPT Codex Alpha, offering early access to new models and improvements for vibe coding. Codex is making waves in the industry. Read more
OpenAI wants ChatGPT to be your emotional support : OpenAI aims to enhance ChatGPT’s emotional support capabilities, improving beyond GPT-4o. The goal is for ChatGPT to offer better emotional assistance. Read more
OpenAI prepares $4 ChatGPT Go for several new countries : OpenAI is expanding its cheaper ChatGPT “Go” plan to more countries after initial testing. This provides a more affordable option. Read more

Scams & Fraud

No, that’s not an FTC commissioner on the phone : Scammers impersonate FTC officials to steal money, urging victims to move funds. The FTC never tells people to move money. Read more
How to spot a job scam : Learn how to identify fake job opportunities, work-at-home scams, and shady employment agencies. Watch FTC Chairman Andrew Ferguson’s video. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams : Plan for emergencies and learn to spot disaster-related scams. Free tools are available to help with fraud prevention. Read more
Thinking about selling your timeshare? Key steps to avoid scams : Learn how to avoid scams when selling your timeshare. Be cautious of easy ways to sell that sound too good to be true. Read more
Before you donate, find out where the money is going : Ensure donations go to legitimate causes. The FTC says Kars-R-Us.com, Inc. lied about where vehicle donations were going. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams : Protect yourself from scams during Medicare Open Enrollment. Scammers become more active during this period. Read more

Identity Theft

Get a credit freeze to stop identity thieves : Freeze your credit to protect against identity theft. Learn the steps to freeze your credit. Read more
How to help protect foster youth from identity theft : Foster youth are at higher risk of identity theft due to frequent moves and multiple access points to their information. Learn how to protect them. Read more

Data Collection

When sharing your info online leads to unwanted and unlawful telemarketing calls : Companies trick users into sharing data, then sell it to telemarketers, resulting in illegal calls. Learn to reduce unwanted telemarketing. Read more

Zimbra Zero-Day, Gov Cloud Loss, & ParkMobile Breach – 10/05/2025

info@grabtheaxe.com (Chris Armour) — Sun, 05 Oct 2025 00:00:00 GMT

Today’s threat landscape is highlighted by the active exploitation of a Zimbra zero-day vulnerability using malicious calendar files. A catastrophic fire has also led to the complete loss of a South Korean government cloud system due to a lack of backups, serving as a stark reminder of disaster recovery’s importance. Additionally, we cover the minimal compensation offered to 22 million users in the ParkMobile data breach settlement and advancements in AI for vulnerability detection.

Top 3 Critical Security Alerts

Hackers exploited Zimbra flaw as zero-day using iCalendar files: A vulnerability in the Zimbra Collaboration Suite was actively exploited as a zero-day using malicious iCalendar (.ICS) files to compromise systems before a patch was available. Read more
Fire destroys S. Korean government’s cloud storage system, no backups available: A catastrophic incident in South Korea resulted in a fire destroying a government cloud storage system, leading to total data loss due to the lack of available backups. Read more
ParkMobile pays… $1 each for 2021 data breach that hit 22 million: Following a class-action lawsuit for its 2021 data breach, ParkMobile is compensating 22 million affected users with a manually claimed, expiring $1 in-app credit. Read more

Threat Intelligence

Hackers exploited Zimbra flaw as zero-day using iCalendar files: A vulnerability in the Zimbra Collaboration Suite was actively exploited as a zero-day using malicious iCalendar (.ICS) files to compromise systems before a patch was available. Read more

Security Breaches & Incidents

Fire destroys S. Korean government’s cloud storage system, no backups available: A catastrophic incident in South Korea resulted in a fire destroying a government cloud storage system, leading to total data loss due to the lack of available backups. Read more
ParkMobile pays… $1 each for 2021 data breach that hit 22 million: Following a class-action lawsuit for its 2021 data breach, ParkMobile is compensating 22 million affected users with a manually claimed, expiring $1 in-app credit. Read more

Emerging Security Technologies

Reasoning models like Claude Sonnet 4.5 are getting better at spotting security flaws: Anthropic reports that advanced AI reasoning models like Claude Sonnet 4.5 are demonstrating a growing potential for effectively identifying complex cybersecurity flaws. Read more

Data Breaches, Tile Vulnerability & AI Risks – 10/04/2025

info@grabtheaxe.com (Chris Armour) — Sat, 04 Oct 2025 00:00:00 GMT

Today’s privacy digest highlights critical data breaches affecting Discord and Renault/Dacia customers, alongside vulnerabilities in Tile trackers that enable stalking. The launch of OpenAI’s Sora video app raises concerns about violent and racist content, while the FTC warns about online scams and telemarketing. Stay informed to protect your data and privacy.

Top 5 Critical Privacy Alerts

Hackers steal identifiable Discord user data in third-party breach : Partial payment and personal data stolen from Discord users due to a third-party breach. Read more
Renault and Dacia UK warn of data breach impacting customers : Sensitive customer information compromised at a third-party provider. Read more
Tile’s Lack of Encryption Is a Danger for Users Everywhere : Vulnerabilities in Tile trackers allow easy location tracking by stalkers and the company. Read more
OpenAI launch of video app Sora plagued by violent and racist images : New AI video generator quickly populated with harmful content due to inadequate guardrails. Read more
When sharing your info online leads to unwanted and unlawful telemarketing calls : Learn how companies trick users into sharing data, leading to illegal telemarketing. Read more

Artificial Intelligence

Opera wants you to pay $19.90 per month for its new AI browser : Opera Neon puts AI in control of browsing, but comes with a monthly fee. Read more

Data Privacy

Flo Health, Google Settle Class Action Privacy Lawsuit for $56 Million : Settlement over Flo app’s alleged unlawful sharing of health data with Google. Read more

Health Privacy

Flo Health, Google Settle Class Action Privacy Lawsuit for $56 Million : Settlement over Flo app’s alleged unlawful sharing of health data with Google. Read more

Security

Signal adds new cryptographic defense against quantum attacks : Signal introduces SPQR, a new cryptographic component to defend against quantum computing threats. Read more

Technology

Opera wants you to pay $19.90 per month for its new AI browser : Opera Neon puts AI in control of browsing, but comes with a monthly fee. Read more

Uncategorized

How to help protect foster youth from identity theft : Tips for foster parents and service providers to protect foster youth from identity theft. Read more
No, that’s not an FTC commissioner on the phone : FTC warns of scammers impersonating FTC officials to steal money. Read more
Get a credit freeze to stop identity thieves : Steps to freeze your credit to protect against identity theft. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams : Tips to avoid scams during Medicare Open Enrollment. Read more
Thinking about selling your timeshare? Key steps to avoid scams : Advice on avoiding scams when selling a timeshare. Read more
Before you donate, find out where the money is going : FTC warns about a charity scam involving vehicle donations. Read more
How to spot a job scam : FTC shares tips on identifying fake job opportunities and employment scams. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams : Planning tips and scam avoidance during emergencies. Read more
Who’s eligible for a refund from Amazon? : Details on Amazon’s $2.5 billion settlement and consumer refunds. Read more
‘Delivery robots will happen’: Skype co-founder on his fast-growing venture Starship : Ahti Heinla discusses Starship Technologies and the future of delivery robots. Read more
How to live a good life in difficult times: Yuval Noah Harari, Rory Stewart and Maria Ressa in conversation : Discussion on navigating the future with AI, climate change, and democracy. Read more
Friday Squid Blogging: Squid Overfishing in the Southwest Atlantic : Article and report on squid overfishing. Read more
What Europe’s New Gig Work Law Means for Unions and Technology : Analysis of the EU’s Platform Work Directive and its impact on worker’s rights. Read more
Opt Out October: Daily Tips to Protect Your Privacy and Security : Daily tips for opting out of tech giant surveillance. Read more
Hey, San Francisco, There Should be Consequences When Police Spy Illegally : EFF argues for consequences when police violate surveillance oversight laws. Read more
Stalin, Putin and an enduring obsession with immortality | Letter : Readers respond to an article about dictators and tech billionaires wanting to ‘solve the problem’ of ageing. Read more

Wiretap Litigation

Flo Health, Google Settle Class Action Privacy Lawsuit for $56 Million : Settlement over Flo app’s alleged unlawful sharing of health data with Google. Read more

reports

Friday Squid Blogging: Squid Overfishing in the Southwest Atlantic : Article and report on squid overfishing. Read more

squid

Friday Squid Blogging: Squid Overfishing in the Southwest Atlantic : Article and report on squid overfishing. Read more

Export Controls, AI Safety, Lapsus$ & Cybersecurity – 10/04/2025

info@grabtheaxe.com (Chris Armour) — Sat, 04 Oct 2025 00:00:00 GMT

Today’s compliance intelligence digest highlights critical developments in regulatory and third-party risk landscapes. Lapsus$ has resurfaced, threatening Salesforce customers, while new US Commerce Department rules expand export controls. California’s AI safety legislation sets a precedent, and the expiration of cybersecurity information-sharing protections marks a significant shift in policy.

Top 5 Critical Compliance Alerts

Lapsus$ Returns With Salesforce Leak Site : The cybercriminal collective Lapsus$ has reemerged and is threatening to publish stolen data from Salesforce customers by Oct. 10 if their demands are not met. Read more
New US Commerce Department Global License Requirements : BIS released the Affiliates Rule, drawing unnamed entities into entity-specific controls to close paths of diversion to blacklisted entities. Read more
BIS Expands Export Controls to Affiliates : BIS issued an interim final rule expanding export controls to foreign affiliates of parties already subject to restrictions. Read more
California AI Safety Legislation : California Governor Gavin Newsom signed into law Senate Bill 53 (SB 53), known as the Transparency in Frontier Artificial Intelligence Act (TFAIA). Read more
Cybersecurity Protections Expire : The legal protections for sharing of cyber threat information among private sector entities and with the federal government were not renewed by Congress and have expired. Read more

Regulatory Updates

New US Commerce Department Global License Requirements : BIS released the Affiliates Rule, drawing unnamed entities into entity-specific controls to close paths of diversion to blacklisted entities. Read more
BIS Closes Loophole: New Rule Expands Export Controls to Affiliates : BIS issued an interim final rule expanding export controls to foreign affiliates of parties already subject to restrictions. Read more
Broadcast Station Filings Due on October 10, 2025 : All radio and television broadcast stations must prepare a list of important issues facing their communities of license and the programs aired during July, August, and September dealing with those issues. Read more

Policy & Governance Updates

The End of an Era: A Decade of Cybersecurity Protections Expire : The legal protections for sharing of cyber threat information among private sector entities and with the federal government were not renewed by Congress and have expired. Read more
Landmark California AI Safety Legislation : California Governor Gavin Newsom signed into law Senate Bill 53 (SB 53), known as the Transparency in Frontier Artificial Intelligence Act (TFAIA). Read more

Third-Party Risk & Due Diligence

Lapsus$ Returns With Salesforce Leak Site : The cybercriminal collective Lapsus$ has reemerged and is threatening to publish stolen data from Salesforce customers by Oct. 10 if their demands are not met. Read more
Dutch Authorities Arrest Two Teens for Alleged Pro-Russian Espionage : Dutch Prime Minister Dick Schoof described the incident as part of a broader pattern of Russian hybrid attacks against Europe. Read more

Palo Alto Scans, Discord Breach & AI CometJacking – 10/04/2025

info@grabtheaxe.com (Chris Armour) — Sat, 04 Oct 2025 00:00:00 GMT

This daily threat summary highlights a significant surge in reconnaissance scans targeting Palo Alto Networks portals, signaling potential future attacks. Additionally, Discord has disclosed a data breach exposing user information via a third-party compromise, and a novel ‘CometJacking’ attack demonstrates new risks in AI-powered browsers. These incidents underscore the evolving threats to network infrastructure, user data, and emerging technologies.

Top 3 Critical Security Alerts

Massive surge in scans targeting Palo Alto Networks login portals: Threat actors are conducting widespread reconnaissance against Palo Alto Networks login portals, with scanning activity increasing by 500%, indicating preparation for potential attacks. Read more
Discord discloses data breach after hackers steal support tickets: Discord has confirmed a data breach originating from a compromised third-party support agent, exposing user PII, partial payment info, and government-issued IDs from support tickets. Read more
CometJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thief: Researchers have detailed a new prompt injection attack, “CometJacking,” that can compromise Perplexity’s Comet AI browser with a single malicious link to steal sensitive data from connected services. Read more

Security Breaches & Incidents

Event startup Partiful wasn’t stripping GPS locations from user-uploaded photos: The event planning app Partiful exposed granular GPS location data from user-uploaded photos, a privacy flaw that has since been fixed after being reported. Read more
A breach every month raises doubts about South Korea’s digital defenses: A consistent string of data breaches in South Korea is raising significant concerns about the nation’s cybersecurity posture and its ability to protect its advanced digital infrastructure. Read more

Cloud & Network Security

Massive surge in scans targeting Palo Alto Networks login portals: Threat actors are conducting widespread reconnaissance against Palo Alto Networks login portals, with scanning activity increasing by 500%, indicating preparation for potential attacks. Read more

Emerging Security Technologies

CometJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thief: Researchers have detailed a new prompt injection attack, “CometJacking,” that can compromise Perplexity’s Comet AI browser with a single malicious link to steal sensitive data from connected services. Read more
Anker offered Eufy camera owners $2 per video for AI training: Anker’s Eufy brand solicited customer videos for AI training in exchange for a small payment, raising privacy concerns about how user surveillance data is collected and utilized. Read more

Security Tools & Best Practices

ICE wants to build a 24/7 social media surveillance team: U.S. Immigration and Customs Enforcement (ICE) is planning to hire contractors for round-the-clock social media surveillance to identify individuals for deportation, expanding its digital monitoring capabilities. Read more

Salesforce Leak, Cyberattacks & FTC Shutdown – 10/04/2025

info@grabtheaxe.com (Chris Armour) — Sat, 04 Oct 2025 00:00:00 GMT

This compliance intelligence digest highlights critical compliance alerts, including the Lapsus$ group’s return threatening a Salesforce leak, new US Commerce Department global license requirements, and the rising costs of healthcare cyberattacks. Also covered are ISO 27001 implementation challenges, FTC shutdown plans, and third-party risks related to tariff transactions. Stay informed to protect your organization from emerging threats and regulatory shifts.

Top 5 Critical Compliance Alerts

Scattered Lapsus$ Hunters Returns With Salesforce Leak Site: The cybercriminal collective reemerged and threatened to publish the stolen data of Salesforce customers by Oct. 10 if its demands are not met. Read more
New US Commerce Department Global License Requirements for Transactions Involving Affiliates of Listed Entities: BIS released the Affiliates Rule, which draws unnamed entities around the world into BIS’s entity-specific controls to close paths of diversion to blacklisted entities. Read more
Jaguar Land Rover Shows Cyberattacks Mean (Bad) Business: The company likely failed to completely clean out attackers from a previous breach and now is a case study for the high cost of ransomware. Read more
PHI Potentially Stolen in Phishing Attack on Superior Vision Service: Protected health information has been compromised in a phishing attack on Superior Vision Service. Read more
Healthcare Cyberattacks Costing $200K+ Rise 400% in a Year: Almost half of healthcare organizations experienced at least one data breach between March 2024 and March 2025. Read more

Compliance Frameworks

5 Reasons ISO 27001 Implementations Fail (and How to Avoid Them): Most ISMS implementation projects fail because of poor planning and execution, requiring leadership, integration, and discipline across the business. Read more

Regulatory Updates

FTC Releases Shutdown Plan, Will Continue to Accept HSR Filings: The FTC released a shutdown plan outlining operations during the lapse in appropriations; FTC Commissioners are excepted from furlough. Read more
New SEC No-Action Letter on Crypto Custody: What It Means for Advisers & Funds: A new SEC no-action letter addresses custody of crypto assets for regulated advisers and funds. Read more
CFTC Proposes Revisions to Business Conduct and Swap Documentation Requirements for Swap Dealers and Major Swap Participants: The CFTC issued a proposal to revise external business conduct standards and swap documentation requirements for Swap Entities, removing unnecessary burdens. Read more

Third-Party Risk & Due Diligence

Beware the Tariff DDP Trap: Managing Hidden Import Liabilities Before They Bite: Companies using Duty Paid transactions face exposure; the importer remains legally responsible for accurate customs declarations, tariff payments, and regulatory compliance. Read more

ICE Tracking, CometJacking, Salesforce Leak – 10/03/2025

info@grabtheaxe.com (Chris Armour) — Fri, 03 Oct 2025 00:00:00 GMT

This privacy digest highlights critical developments, including ICE’s acquisition of a mass phone tracking tool and the ‘CommetJacking’ attack stealing emails via AI browsers. We also cover a significant Salesforce data leak, a ransomware attack on Asahi, and the FTC’s crackdown on child data exploitation. Stay informed to navigate these evolving privacy threats effectively.

Top 5 Critical Privacy Alerts

ICE to Buy Tool that Tracks Locations of Hundreds of Millions of Phones Every Day: ICE acquired a surveillance tool updated daily with location data from millions of phones. Read more
CommetJacking attack tricks Comet browser into stealing emails: A new attack exploits URL parameters to steal sensitive data from connected services. Read more
ShinyHunters launches Salesforce data leak site to extort 39 victims: An extortion group leaks data stolen in Salesforce attacks. Read more
Japanese beer giant Asahi confirms ransomware attack: A ransomware attack caused IT disruptions and factory shutdowns. Read more
FTC Cracks Down on Messaging App Operator on Child Data Exploitation: The FTC announced legal action against Sendit for violations of consumer protection and privacy laws. Read more

Privacy Laws & Regulations

Brazil Adopts Law Protecting Minors Online — Brazil enacted the Digital Statute of the Child and Adolescent, establishing a regulatory framework for protecting children online. Read more

Regulatory Fines & Enforcement Actions

FTC Cracks Down on Messaging App Operator on Child Data Exploitation: The FTC announced legal action against Sendit for violations of consumer protection and privacy laws. Read more

Data Minimization & User Consent

Gmail business users can now send encrypted emails to anyone — Google says that Gmail enterprise users can now send end-to-end encrypted emails to people who use any email service. Read more

Surveillance

ICE to Buy Tool that Tracks Locations of Hundreds of Millions of Phones Every Day: ICE acquired a surveillance tool updated daily with location data from millions of phones. Read more

Cybersecurity

Incoming Deadlines and Requirements for DOJ’s Data Security Program on Oct. 6, 2025: Starting Oct. 6, U.S. entities handling bulk sensitive data must implement a written data compliance program. Read more
Japanese beer giant Asahi confirms ransomware attack: A ransomware attack caused IT disruptions and factory shutdowns. Read more
ShinyHunters launches Salesforce data leak site to extort 39 victims: An extortion group leaks data stolen in Salesforce attacks. Read more
CommetJacking attack tricks Comet browser into stealing emails: A new attack exploits URL parameters to steal sensitive data from connected services. Read more
Oracle links Clop extortion attacks to July 2025 vulnerabilities: Oracle linked Clop ransomware attacks to E-Business Suite vulnerabilities patched in July 2025. Read more
Microsoft Outlook stops displaying inline SVG images used in attacks: Outlook will no longer display risky inline SVG images used in attacks. Read more
DrayTek warns of remote code execution bug in Vigor routers: DrayTek warned of a security vulnerability in Vigor routers allowing remote code execution. Read more

Salesforce Breach, Oracle Flaw & CISA Alert – 10/03/2025

info@grabtheaxe.com (Chris Armour) — Fri, 03 Oct 2025 00:00:00 GMT

Today’s threat landscape is dominated by a massive data extortion campaign targeting Salesforce customers, allegedly orchestrated by the Scattered Spider group. This summary details the breach, an active Clop ransomware campaign exploiting Oracle vulnerabilities, and a new CISA alert for an actively exploited flaw. We also cover significant breaches at Discord and Renault, and emerging threats like self-spreading WhatsApp malware.

Top 5 Critical Security Alerts

Hacking group claims theft of 1 billion records from Salesforce customer databases: The Scattered Spider (aka ShinyHunters) group claims a massive data theft from Salesforce customers like FedEx and TransUnion, launching a new leak site for extortion. Read more
Oracle links Clop extortion attacks to July 2025 vulnerabilities — Oracle has connected an ongoing extortion campaign by the Clop ransomware gang to E-Business Suite (EBS) vulnerabilities that were patched in July. Read more
CISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild — CISA has added a high-severity command injection vulnerability in Smartbedded Meteobridge to its Known Exploited Vulnerabilities (KEV) catalog, indicating active attacks. Read more
Japanese beer giant Asahi confirms ransomware attack — Asahi has confirmed that a ransomware attack was the cause of recent IT disruptions that forced it to shut down its factories. Read more
Researchers Warn of Self-Spreading WhatsApp Malware Named SORVEPOTEL — A new self-propagating malware targeting Brazilian users is spreading rapidly via WhatsApp to infect Windows systems, engineered for speed and propagation. Read more

Threat Intelligence

Rhadamanthys Stealer Evolves: Adds Device Fingerprinting, PNG Steganography Payloads: The Rhadamanthys info-stealer has been updated to support device fingerprint collection and can now hide malicious payloads within PNG image files. Read more
New “Cavalry Werewolf” Attack Hits Russian Agencies with FoalShell and StallionRAT: A threat actor linked to the YoroTrooper hacking group is targeting the Russian public sector with malware families including FoalShell and StallionRAT. Read more

Security Breaches & Incidents

Renault and Dacia UK warn of data breach impacting customers — The car manufacturer has notified UK customers that their sensitive information was compromised following a data breach at a third-party provider. Read more
Discord customer service data breach leaks user info and scanned photo IDs — A third-party customer service provider for Discord was breached, leading to the exposure of user data, including names, emails, and a small number of government IDs. Read more

Security Tools & Best Practices

Gmail business users can now send encrypted emails to anyone — Google has enabled Gmail enterprise users to send end-to-end encrypted emails to individuals using any email service or platform. Read more
Presenting AI to the Board as a CISO? Here’s a Template. — A new template is available to help CISOs clearly communicate GenAI adoption strategies, associated risks, and governance controls to company leadership. Read more

Emerging Security Technologies

CommetJacking attack tricks Comet browser into stealing emails: A new attack called ‘CometJacking’ exploits URL parameters in Perplexity’s Comet AI browser to execute hidden instructions and access sensitive data from connected services. Read more
Signal adds new cryptographic defense against quantum attacks: The secure messaging app has implemented a new cryptographic component, Sparse Post-Quantum Ratchet (SPQR), to defend against future threats from quantum computing. Read more

Data Breaches, Apple Backdoor & Android Spyware – 10/02/2025

info@grabtheaxe.com (Chris Armour) — Thu, 02 Oct 2025 00:00:00 GMT

Today’s privacy digest reveals significant data breaches, including a major incident at WestJet affecting 1.2 million customers and a ransomware attack on Motility Software impacting 766,000 clients. The UK government’s renewed push for an Apple backdoor raises encryption concerns, while new Android spyware campaigns highlight ongoing mobile security threats. Stay informed to protect your data and privacy.

Top 5 Critical Privacy Alerts

WestJet Data Breach Exposes Travel Details of 1.2 Million Customers: Canadian airline WestJet reports a cyberattack compromised personal information, including passports and ID documents, of 1.2 million customers. Read more
Data Breach at Dealership Software Provider Impacts 766k Clients: A ransomware attack at Motility Software Solutions exposed the sensitive data of 766,000 customers. Read more
Red Hat Confirms Security Incident After Hackers Claim GitHub Breach: The Crimson Collective claims to have breached Red Hat’s private GitHub repositories, stealing nearly 570GB of data. Read more
UK Government Demands Apple Backdoor for British Users’ Data: The UK government is again demanding Apple create a backdoor into its encrypted backup services, now limited to British users. Read more
Android Spyware Campaigns Impersonate Signal and ToTok Messengers: New spyware campaigns, ProSpy and ToSpy, target Android users with fake upgrades for Signal and ToTok to steal data. Read more

Privacy Laws & Regulations

Navigating California’s New and Emerging AI Employment Regulations: New regulations in California impose requirements on employers using automated-decision systems in employment decisions. Read more

Regulatory Fines & Enforcement Actions

Who’s Eligible for a Refund from Amazon?: Amazon agreed to pay $2.5 billion to settle FTC charges of enrolling millions in Prime subscriptions without consent. Read more

Cybersecurity

CISA 2015 Sunsets: Cyber Threat Sharing Without a Net?: The Cybersecurity Information Sharing Act of 2015 expired, removing the legal framework for cyber threat information sharing. Read more
China Issues Measures for the Administration of National Cybersecurity Incident Reporting: China issued measures for national cybersecurity incident reporting, effective November 1, 2025. Read more

Data Breaches & Leaks

WestJet Data Breach Exposes Travel Details of 1.2 Million Customers: Canadian airline WestJet reports a cyberattack compromised personal information, including passports and ID documents, of 1.2 million customers. Read more
Data Breach at Dealership Software Provider Impacts 766k Clients: A ransomware attack at Motility Software Solutions exposed the sensitive data of 766,000 customers. [Read more](https://www.bleepingcomputer.com/news/security/data-breach-at-dealership-software-provider-im pacts-766k-clients/)
Red Hat Confirms Security Incident After Hackers Claim GitHub Breach: The Crimson Collective claims to have breached Red Hat’s private GitHub repositories, stealing nearly 570GB of data. Read more
Adobe Analytics Bug Leaked Customer Tracking Data to Other Tenants: Adobe warns Analytics customers of an ingestion bug that caused data from some organizations to appear in others’ instances. Read more

Oracle Extortion, Red Hat Breach & CISA KEVs – 10/02/2025

info@grabtheaxe.com (Chris Armour) — Thu, 02 Oct 2025 00:00:00 GMT

Today’s threat landscape is dominated by a new extortion campaign linked to the Clop ransomware gang targeting Oracle E-Business Suite users and a significant security breach at Red Hat involving a compromised GitLab instance. CISA has also issued critical alerts, adding five actively exploited vulnerabilities to its KEV catalog that require immediate attention. This summary covers these top threats, along with new malware campaigns and critical hardware vulnerabilities you need to know about.

Top 5 Critical Security Alerts

CISA Adds Five Known Exploited Vulnerabilities to Catalog: CISA has added five actively exploited vulnerabilities to its KEV catalog, including flaws in GNU Bash, Juniper ScreenOS, and Jenkins, requiring federal agencies to patch immediately. Read more
Clop Ransomware Gang Linked to Oracle E-Business Suite Extortion Campaign: Google and Mandiant are tracking a new extortion campaign, likely by the Clop gang, targeting executives with emails claiming data theft from their Oracle E-Business Suite systems. Read more
Red Hat Confirms Security Breach of GitLab Instance: Red Hat is investigating a security incident after an extortion group breached one of its GitLab instances, claiming to have stolen nearly 570GB of data from 28,000 internal repositories. Read more
DrayTek Warns of Critical Remote Code Execution Bug in Vigor Routers: A critical vulnerability has been disclosed in several DrayTek Vigor router models that could allow remote, unauthenticated attackers to execute arbitrary code. Read more
CISA Warns of Critical Flaw in Raise3D Pro2 Series 3D Printers: An ICS advisory from CISA highlights a critical (CVSS 8.8) authentication bypass vulnerability in Raise3D Pro2 printers, which could allow for data exfiltration. Read more

Threat Intelligence

Android Spyware Campaigns Impersonate Signal and ToTok Messengers: New spyware campaigns dubbed ProSpy and ToSpy are luring Android users with fake Signal and ToTok messaging app plugins to steal sensitive data. Read more
Chinese-Speaking Cybercrime Group UAT-8099 Targets IIS for SEO Fraud: Cisco Talos reports on UAT-8099, a cybercrime group focused on SEO fraud and stealing credentials and configuration data from high-value Microsoft IIS servers. Read more
Confucius APT Deploys New Malware in Attacks on Pakistan: The Confucius cyber-espionage group has launched a new phishing campaign against Pakistani targets, utilizing malware such as WooperStealer and the Anondoor backdoor. Read more
Malicious PyPI Package ‘soopsocks’ Delivered Backdoor to Windows Systems: A deceptive Python package named ‘soopsocks’ was downloaded over 2,600 times, installing a stealthy backdoor on Windows systems before being removed from the repository. Read more

Security Breaches & Incidents

Japanese Brewer Asahi Halts Production After Cyberattack: Beverage giant Asahi is facing production and delivery disruptions following a significant cyberattack, leading to fears of shortages of its top-selling beer. Read more
Georgia Tech Settles with DOJ Over Lax Cybersecurity Allegations: The Georgia Institute of Technology will pay $875,000 to resolve a False Claims Act lawsuit alleging it failed to meet cybersecurity requirements for federal defense contracts. Read more

Security Tools & Best Practices

Microsoft Outlook to Block Inline SVG Images Used in Attacks: To counter emerging threats, Outlook for Web and the new Outlook for Windows will no longer render inline SVG images, which have been exploited by attackers. Read more
Microsoft Defender Bug Causes Erroneous BIOS Update Alerts: Microsoft is addressing a bug in Defender for Endpoint that incorrectly flags BIOS firmware as outdated, causing false security alerts for system administrators. Read more
Your Service Desk is the New Attack Vector: Here’s How to Defend It. Read more

Security Standards & Frameworks

CISA Releases Two Industrial Control Systems Advisories: CISA published advisories for vulnerabilities in Raise3D Pro2 Series 3D Printers (CVE-2025-10653) and the Hitachi Energy MSM Product (CVE-2023-53155, CVE-2024-53429). Read more

Data Breach, GDPR, & SEC Compliance – 10/01/2025

info@grabtheaxe.com (Chris Armour) — Wed, 01 Oct 2025 00:00:00 GMT

This compliance digest highlights critical breaches and regulatory shifts impacting organizations globally. A Florida medication management provider disclosed a significant data breach due to phishing, while the UK grapples with financial crime reforms. Jaguar Land Rover faced a major cyber attack, and China implemented strict cyber incident reporting rules. Stay informed to enhance your compliance posture and mitigate emerging risks.

Top 5 Critical Compliance Alerts

Florida Medication Management Provider Discloses 150K-record Data Breach: Outcomes One, a Florida-based business associate, disclosed a phishing incident affecting almost 150,000 individuals. Read more
Human Error and Accidental Data Breaches: Lessons from Recent Cases: Verizon’s 2025 DBIR indicates 60% of breaches involve human error, including misconfigured AWS buckets and incorrect email practices. Read more
UK Financial Crime Reform: What Firms Need to Know: The private wealth management sector is highly susceptible to financial crime risks, including fraud, money laundering and sanctions breaches. Read more
Our Experts’ Views on the Jaguar Land Rover Cyber Attack: JLR halted production across three UK plants following a major cyber attack, impacting 30,000 employees and its supply chain. Read more
China Imposes One-Hour Reporting Rule for Major Cyber Incidents: New regulations in China mandate reporting major cyber incidents within one hour, signaling a focus on hardening networks. Read more

Compliance Frameworks

HIPAA Risk Assessment – Is this required?: A reminder about the importance of HIPAA risk assessments. Read more
Achieving CJIS Compliance in the Cloud Era: A Strategic Imperative for State and Local Agencies: Considerations for achieving CJIS compliance when using cloud services. Read more
Who Needs ISO 27001 Foundation Training?: Discusses the roles that benefit from ISO 27001 training, emphasizing its value beyond auditors and security consultants. Read more

Regulatory Updates

SEC Guidance on the Government Shutdown: Guidance on potential delays in SEC interactions due to the government shutdown. Read more
EIOPA Raises Concerns Over Proposed European Union Climate-Reporting Scope Reduction: EIOPA cautions against scaling back mandatory sustainability disclosures in the EU. Read more
A Guide to the EU GDPR’s Requirements for an EU Representative: Explanation of the EU GDPR requirements for non-EEA organizations to appoint an EU representative. Read more
BIS Ratchets Up Export Controls, Adopts 50 Percent Affiliate Rule: BIS expands the Entity List to include foreign subsidiaries and affiliates of listed companies. Read more

Audit & Monitoring Tools

The AI Exchange: Innovators in Payment Security Featuring Elavon Inc.: A blog series from PCI Security Standards Council on adopting AI in payment security. Read more

Third-Party Risk & Due Diligence

Decoding BIS’s New 50 Percent Rule: End-User Controls Extended to Affiliates: Analysis of BIS’s interim final rule expanding end-user controls to cover affiliates. Read more

Policy & Governance Updates

Deregulation Déjà Vu: 3 Cycles Every Compliance Leader Should Remember: Wolters Kluwer’s Elaine Duffus discusses cycles of deregulation, risk-taking, and crisis in financial services. Read more

Data Breaches, OpenShift Flaw & China APT – 10/01/2025

info@grabtheaxe.com (Chris Armour) — Wed, 01 Oct 2025 00:00:00 GMT

Today’s security landscape is defined by several massive data breaches, with incidents at Allianz Life and WestJet impacting a combined 2.7 million people. A critical vulnerability in Red Hat’s OpenShift AI platform poses a severe risk, potentially allowing a full infrastructure takeover. Additionally, a new China-aligned APT group, Phantom Taurus, has been identified targeting government and telecom sectors, while a new Android banking trojan called Klopatra is gaining traction in Europe. Here is the critical intelligence you need to know.

Top 5 Critical Security Alerts

Red Hat OpenShift AI Flaw Exposes Hybrid Cloud Infrastructure to Full Takeover: A severe security flaw has been disclosed in Red Hat OpenShift AI that could allow attackers to escalate privileges and gain control of the entire infrastructure. Read more
Allianz Life says July data breach impacts 1.5 million people: Insurance giant Allianz Life has confirmed that a cyberattack in July compromised the personal information of nearly 1.5 million individuals. Read more
WestJet data breach exposes travel details of 1.2 million customers: Canadian airline WestJet has disclosed that a June cyberattack, attributed to the Scattered Spider group, compromised the personal data of 1.2 million customers, including passports. Read more
China-linked hacking group Phantom Taurus targeting embassies, foreign ministries: A newly identified espionage group, Phantom Taurus, aligned with China, is actively targeting foreign ministries, embassies, and telecommunication companies across multiple continents. Read more
New Android Banking Trojan “Klopatra” Uses Hidden VNC to Control Infected Smartphones: A new Android banking trojan named Klopatra is infecting devices across Europe, using hidden VNC capabilities to give attackers remote control and steal financial data. Read more

Threat Intelligence

That annoying SMS phish you just got may have come from a box like this: Security researchers are highlighting the creative infrastructure used by smishing operators, including specialized hardware for sending mass phishing text messages. Read more
Seniors targeted in global Facebook scam spreading new Android malware: A global scam campaign on Facebook is targeting senior citizens with a new strain of Android malware, originating in Australia and now seen worldwide. Read more
Nvidia and Adobe vulnerabilities: Cisco Talos has disclosed five vulnerabilities in Nvidia products and one in Adobe Acrobat, with patches now available from the vendors. Read more

Security Breaches & Incidents

Millions impacted by data breaches at insurance giant, auto dealership software firm: In addition to the Allianz breach, auto dealership software developer Motility suffered a ransomware attack, leading to significant data exposure. Read more
Adobe Analytics bug leaked customer tracking data to other tenants: Adobe has warned Analytics customers of an ingestion bug that caused some organizations’ tracking data to be exposed to other tenants for approximately one day. Read more

Security Tools & Best Practices

Forensic journey: hunting evil within AmCache: Kaspersky provides a deep dive into using the AmCache artifact for incident investigation and has released a command-line tool for data extraction. Read more

Cloud & Network Security

Hackers Exploit Milesight Routers to Send Phishing SMS to European Users: Threat actors are abusing APIs in Milesight industrial cellular routers to send smishing messages with phishing links to users across Europe. Read more

Security Standards & Frameworks

UK government tries again to access encrypted Apple customer data: Report: The U.K. Home Office is reportedly making a second attempt to compel Apple to provide access to users’ encrypted iCloud backups. Read more
How To Simplify CISA’s Zero Trust Roadmap with Modern Microsegmentation: This article explores how modern, automated, and agentless microsegmentation can help organizations meet CISA’s Zero Trust foundational requirements. Read more

Emerging Security Technologies

Google Drive for desktop gets AI-powered ransomware detection: Google is rolling out an AI-powered feature for Google Drive that automatically detects ransomware attacks and pauses file syncing to minimize damage. Read more
Anker offered to pay Eufy camera owners to share videos for training its AI: Raising privacy concerns, Anker offered compensation to Eufy smart camera owners in exchange for their video footage to be used for training AI systems. Read more

VMware Exploit, Linux Flaw, EU Chat Control – 09/30/2025

info@grabtheaxe.com (Chris Armour) — Tue, 30 Sep 2025 00:00:00 GMT

Today’s privacy digest highlights critical vulnerabilities and cyberattacks, with a focus on VMware and Linux systems exploited by malicious actors. The EU’s proposed ‘Chat Control’ measures are raising significant privacy concerns, while new CCPA regulations are set to take effect in California. Stay informed to protect your data and systems from emerging threats.

Top 5 Critical Privacy Alerts

Chinese hackers exploiting VMware zero-day since October 2024: Broadcom patched a high-severity vulnerability in VMware, exploited in zero-day attacks. Read more
CISA warns of critical Linux Sudo flaw exploited in attacks: Hackers are exploiting a critical vulnerability in the sudo package, enabling root-level command execution. Read more
Broadcom fixes high-severity VMware NSX bugs reported by NSA: Security updates patch VMware NSX vulnerabilities reported by the U.S. National Security Agency (NSA). Read more
Japan’s largest brewer suspends operations due to cyberattack: Asahi Group Holdings, Ltd (Asahi) disclosed a cyberattack disrupting operations. Read more
Chat Control Is Back on the Menu in the EU. It Still Must Be Stopped: EU Council debates “Chat Control,” scanning private conversations, raising privacy concerns. Read more

Privacy Laws & Regulations

Revised and New CCPA Regulations Set to Take Effect on Jan. 1, 2026 – Summary of Near-Term Action Items: California Privacy Protection Agency (CPPA) regulations are approved, effective January 1, 2026. Read more
UK Clinical Trial Regulatory Updates for Sponsors: The UK Parliament approved amendments to clinical trial regulations, the most significant update in two decades. Read more

Security

Chinese hackers exploiting VMware zero-day since October 2024: Broadcom patched a high-severity vulnerability in VMware, exploited in zero-day attacks. Read more
VMware Certification Is Surging in a Shifting IT Landscape: VMware certification surges due to hybrid infrastructure, cloud complexity, and rising security risks. Read more
CISA warns of critical Linux Sudo flaw exploited in attacks: Hackers are exploiting a critical vulnerability in the sudo package, enabling root-level command execution. Read more
Broadcom fixes high-severity VMware NSX bugs reported by NSA: Security updates patch VMware NSX vulnerabilities reported by the U.S. National Security Agency (NSA). Read more
UK convicts “Bitcoin Queen” in world’s largest cryptocurrency seizure: The Metropolitan Police secured a conviction in the world’s largest cryptocurrency seizure. Read more
Japan’s largest brewer suspends operations due to cyberattack: Asahi Group Holdings, Ltd (Asahi) disclosed a cyberattack disrupting operations. Read more
Ransomware gang sought BBC reporter’s help in hacking media giant: Medusa ransomware gang tempted a BBC correspondent to become an insider threat. Read more
UK govt backs JLR with £1.5 billion loan guarantee after cyberattack: The UK Government is providing Jaguar Land Rover (JLR) with a £1.5 billion loan guarantee after a cyberattack. Read more

Scams & Social Engineering

Details of a Scam: A personal experience details an attempted scam, highlighting social engineering tactics. Read more
How to help protect foster youth from identity theft: The FTC provides guidance on protecting foster youth from identity theft. Read more
No, that’s not an FTC commissioner on the phone: The FTC warns of scammers impersonating FTC officials to steal money. Read more
Get a credit freeze to stop identity thieves: The FTC advises freezing credit to protect against identity theft. Read more
Scammers are impersonating the United States Patent and Trademark Office: Scammers impersonate the USPTO to steal money from business owners. Read more
Thinking about selling your timeshare? Key steps to avoid scams: The FTC provides steps to avoid scams when selling a timeshare. Read more
Before you donate, find out where the money is going: The FTC warns against donating to causes where fundraisers lie about fund usage. Read more
How to spot a job scam: The FTC provides tips on identifying and avoiding job scams. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: The FTC advises on preparing for emergencies and avoiding related scams. Read more
This Medicare Open Enrollment season, learn how to protect yourself from scams: The FTC advises on protecting against scams during Medicare Open Enrollment. Read more

Data Privacy

Text messages and the new Texas registration requirement: Texas amended its telephone solicitation law to include text messages and registration requirements. Read more
EFF Urges Virgina Court of Appeals to Require Search Warrants to Access ALPR Databases: EFF urges Virginia court to require warrants for ALPR data access, citing privacy concerns. Read more
Chat Control Is Back on the Menu in the EU. It Still Must Be Stopped: EU Council debates “Chat Control,” scanning private conversations, raising privacy concerns. Read more

Artificial Intelligence

Brave launches ‘Ask Brave’ feature to fuse AI with traditional search: Brave integrates AI chat with search in a new feature called Ask Brave. Read more
It’s time to prepare for AI personhood | Jacy Reese Anthis: An article discussing the social upheaval that will come with technological advances in AI. Read more
Protecting Access to the Law—and Beneficial Uses of AI: EFF supports AI for legal research in Thomson Reuters v. ROSS Intelligence copyright case. Read more

VMware Zero-Day, CISA Alerts & Cisco Flaws – 09/30/2025

info@grabtheaxe.com (Chris Armour) — Tue, 30 Sep 2025 00:00:00 GMT

Today’s threat landscape is dominated by the active exploitation of critical vulnerabilities, including a VMware zero-day leveraged by Chinese hackers for nearly a year. CISA has issued urgent directives for flaws in Fortra and Linux Sudo, while nearly 50,000 Cisco firewalls remain exposed to ongoing attacks. This summary also covers a disruptive cyberattack on Japanese brewer Asahi and new threat intelligence on North Korean cyber operations and emerging malware toolkits.

Top 5 Critical Security Alerts

CISA orders federal gov to patch critical Fortra file transfer bug: With a CVSS score of 10/10, CISA has issued an emergency directive for a critical vulnerability in Fortra’s file transfer solution, highlighting significant risk. Read more
Chinese hackers exploiting VMware zero-day since October 2024: A high-severity privilege escalation flaw (CVE-2025-41244) in VMware products has been actively exploited by a China-linked APT group for nearly a year before being patched. Read more
CISA warns of critical Linux Sudo flaw exploited in attacks: CISA has added a critical Sudo vulnerability (CVE-2025-32463) to its Known Exploited Vulnerabilities catalog, as attackers are actively using it to gain root-level privileges on Linux systems. Read more
Nearly 50,000 Cisco firewalls vulnerable to actively exploited flaws: Tens of thousands of publicly exposed Cisco ASA and FTD appliances remain vulnerable to two actively exploited vulnerabilities, posing a significant risk to networks. Read more
Critical WD My Cloud bug allows remote command injection: Western Digital has patched a critical vulnerability in multiple My Cloud NAS devices that could allow remote attackers to execute arbitrary system commands. Read more

Threat Intelligence

North Korea IT worker scheme expanding to more industries, countries outside of US tech sector: Research from Okta reveals that North Korean IT workers are expanding their infiltration efforts beyond the US tech sector into dozens of other countries and industries. Read more
New MatrixPDF toolkit turns PDFs into phishing and malware lures: A new toolkit named MatrixPDF enables attackers to weaponize standard PDF files, turning them into interactive lures designed to bypass email security for phishing and malware delivery. Read more
New China APT Strikes With Precision and Persistence: A newly identified China-linked APT group, Phantom Taurus, is targeting government and telecom sectors using advanced, fileless backdoors to evade detection. Read more
‘Klopatra’ Trojan Makes Bank Transfers While You Sleep: A sophisticated new Android banking trojan, ‘Klopatra,’ is targeting users in Italy and Spain with advanced techniques to steal financial data and execute fraudulent transfers. Read more
New Android Trojan “Datzbro” Tricking Elderly with AI-Generated Facebook Travel Events: The ‘Datzbro’ Android banking trojan is targeting elderly users by using AI-generated Facebook events to lure victims into installing malware capable of device takeover. Read more

Security Breaches & Incidents

Japan’s beer-making giant Asahi stops production after cyberattack : Asahi Group, a major Japanese brewer, has suspended production and has no recovery timeline after a significant cyberattack disrupted its systems. Read more
A breach every month raises doubts about South Korea’s digital defenses: A consistent string of data breaches and security incidents in South Korea is raising serious questions about the nation’s cybersecurity posture despite its advanced digital infrastructure. Read more
WestJet confirms recent breach exposed customers’ passports: Canadian airline WestJet has confirmed that a June cyberattack resulted in the compromise of sensitive customer data, including passport details and other ID documents. Read more

Security Tools & Best Practices

Cybercrime Observations from the Frontlines: UNC6040 Proactive Hardening Recommendations: Google’s Threat Intelligence Group provides a detailed defensive framework with proactive hardening measures to protect SaaS platforms like Salesforce from vishing and data theft campaigns. Read more

Cloud & Network Security

Intel and AMD trusted enclaves, the backbone of network security, fall to physical attacks: Researchers have demonstrated that physical attacks can defeat the security of Intel SGX and AMD SEV trusted enclaves, a threat vector chipmakers claim is outside their model. Read more
Broadcom fixes high-severity VMware NSX bugs reported by NSA: Following a report from the NSA, Broadcom has released patches for two high-severity vulnerabilities in its VMware NSX network virtualization and security platform. Read more

Security Standards & Frameworks

CPPA fines Tractor Supply Company $1.4 million for privacy violations: Tractor Supply Company faces a $1.4 million fine for allegedly failing to provide a compliant privacy policy and sharing personal data without proper consent. Read more
Cyber information-sharing law and state grants set to go dark as Congress stalls over funding: Key cybersecurity initiatives, including a vital information-sharing law and state grant programs, are at risk of lapsing as Congress has yet to renew their funding. Read more
FTC alleges messaging app violated child privacy law, duped users into subscriptions: The FTC has filed a complaint against the Sendit app for allegedly collecting data from users under 13 and using deceptive subscription practices. Read more
CISA Releases Ten Industrial Control Systems Advisories: CISA has published ten new advisories detailing vulnerabilities and security issues in various Industrial Control Systems (ICS) from vendors like Festo, MegaSys, and LG. Read more

Emerging Security Technologies

OpenAI unveils Sora 2 video model with realistic physics, high-quality audio, and a new social app: OpenAI’s new Sora 2 model advances AI video generation and is launching with a social app, raising concerns about the potential for sophisticated deepfakes and misinformation. Read more
The US may be heading toward a drone-filled future: The increasing use of drones by private sector companies like Flock Safety for tracking shoplifters highlights growing concerns around surveillance and privacy. Read more
AI-Powered Voice Cloning Raises Vishing Risks: A new research framework demonstrates how AI voice cloning can be used in real-time conversations, significantly increasing the threat of sophisticated vishing attacks. Read more

AI Vulnerability, Data Breach & Ransomware – 09/29/2025

info@grabtheaxe.com (Chris Armour) — Mon, 29 Sep 2025 00:00:00 GMT

Today’s privacy briefing highlights a critical vulnerability in Notion’s AI agent, making it susceptible to data theft via prompt injection. We also cover a significant data breach at Harrods, affecting 430,000 customers, and Akira ransomware’s ability to bypass MFA on SonicWall VPNs. Stay informed about these pressing security threats and how to protect your data.

Top 5 Critical Privacy Alerts

Abusing Notion’s AI Agent for Data Theft: Notion’s new AI agent is vulnerable to data theft via prompt injection due to access to private data and external communication capabilities. Read more
Harrods suffers new data breach exposing 430,000 customer records: Hackers compromised a third-party supplier, stealing sensitive e-commerce customer information. Read more
Akira ransomware breaching MFA-protected SonicWall VPN accounts: Threat actors are successfully logging in despite MFA, possibly via stolen OTP seeds. Read more
12 Myths About Automated Decision-Making Systems, per the EDPS: The EDPS issued a TechDispatch addressing common misconceptions about ADM systems. Read more

Privacy Laws & Regulations

12 Myths About Automated Decision-Making Systems, per the EDPS: The EDPS issued a TechDispatch addressing common misconceptions about ADM systems. Read more

Data Minimization & User Consent

ChatGPT tests free trial for paid plans, rolls out cheaper Go in more regions: OpenAI is offering free trials for ChatGPT Plus and a cheaper GPT Go in Indonesia. Read more

Regulatory Fines & Enforcement Actions

Protecting kids and adults online: The FTC and Utah Division of Consumer Protection announced a settlement with Aylo over distribution of child sex abuse materials. Read more

Security

Harrods suffers new data breach exposing 430,000 customer records: Hackers compromised a third-party supplier, stealing sensitive e-commerce customer information. Read more
Can We Trust AI To Write Vulnerability Checks? Here’s What We Found: Intruder tested AI’s ability to write vulnerability checks, finding it helpful but requiring human oversight. Read more
Akira ransomware breaching MFA-protected SonicWall VPN accounts: Threat actors are successfully logging in despite MFA, possibly via stolen OTP seeds. Read more

AI Vulnerabilities

Abusing Notion’s AI Agent for Data Theft: Notion’s new AI agent is vulnerable to data theft via prompt injection due to access to private data and external communication capabilities. Read more
OpenAI is routing GPT-4o to safety models when it detects harmful activities: GPT-4o is routing requests to a safety model when harmful activities are detected. Read more

Phishing & Scams

Ignore unexpected calls about loans you didn’t apply for: Scammers are sending voicemails about loans you didn’t apply for, hoping you’ll respond. Read more
No, that’s not an FTC commissioner on the phone: Scammers impersonate FTC officials to get your money, but the FTC will never tell you to move your money. Read more
Scammers are impersonating the United States Patent and Trademark Office: Scammers are impersonating the USPTO to steal money from business owners. Read more
Thinking about selling your timeshare? Key steps to avoid scams: Be cautious of easy ways to sell your timeshare, as they could be scams. Read more
Before you donate, find out where the money is going: The FTC says Kars-R-Us.com, Inc. lied about how donated money would be spent. Read more
How to spot a job scam: Learn how to identify phony business opportunities, work-at-home scams, and shady employment agencies. Read more
How to prepare yourself to deal with an emergency and avoid disaster-related scams: Have a plan and know how to spot disaster-related scams to aid recovery. Read more

Identity Theft

How to help protect foster youth from identity theft: Foster youth are at greater risk of identity theft due to frequent moves and access to their info. Read more
Get a credit freeze to stop identity thieves: Freezing your credit is a great way to protect yourself from identity theft. Read more

CISA KEV, SonicWall Attacks, JLR Breach & AI Threats – 09/29/2025

info@grabtheaxe.com (Chris Armour) — Mon, 29 Sep 2025 00:00:00 GMT

Today’s threat landscape is highlighted by CISA’s addition of five actively exploited vulnerabilities to its KEV catalog, demanding immediate attention from federal agencies and private organizations. Concurrently, the Akira ransomware group is escalating attacks against SonicWall VPNs, successfully bypassing MFA. Major incidents include a supply chain breach at Harrods exposing 430,000 records and the UK government’s £1.5B loan to Jaguar Land Rover following a debilitating cyberattack.

Top 5 Critical Security Alerts

CISA Adds Five Known Exploited Vulnerabilities to Catalog: CISA has added five vulnerabilities to its KEV catalog, including flaws in Cisco IOS, Fortra GoAnywhere MFT, and Sudo, indicating active exploitation and requiring immediate patching by federal agencies. Read more
Akira Hits SonicWall VPNs in Broad Ransomware Campaign: The Akira ransomware group is actively targeting SonicWall firewall customers by exploiting a known vulnerability to deploy their malware. Read more
SonicWall SSL VPN Attacks Escalate, Bypassing MFA: Threat actors are escalating attacks against SonicWall SSL VPN appliances, with reports indicating that the Akira ransomware campaign is capable of bypassing multi-factor authentication for rapid deployment. Read more
Increase in Scans for Palo Alto Global Protect Vulnerability (CVE-2024-3400): Security researchers are observing a significant increase in scanning activity for CVE-2024-3400, a critical vulnerability in Palo Alto’s Global Protect feature, as attackers seek unpatched systems. Read more
First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package: A malicious npm package named ‘postmark-mcp’ was discovered containing the first-ever malicious Model Context Protocol (MCP) server, designed to intercept and exfiltrate sensitive emails, posing a significant supply chain risk. Read more

Threat Intelligence

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations: A new campaign is using malicious software disguised as legitimate AI productivity tools to deliver malware, targeting organizations across Europe, the Americas, and the AMEA region. Read more
Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security: Microsoft has identified and blocked a sophisticated phishing campaign that used LLMs to generate obfuscated SVG files, enabling attackers to bypass standard email security defenses. Read more
Ransomware gang sought BBC reporter’s help in hacking media giant: The Medusa ransomware gang reportedly attempted to recruit a BBC correspondent as an insider threat, offering a large sum of money to facilitate an attack on the media organization. Read more
Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv: Attackers are impersonating the National Police of Ukraine in phishing attacks that use malicious SVG files to deploy the Amatera Stealer and PureMiner malware. Read more

Security Breaches & Incidents

UK government bails out Jaguar Land Rover with £1.5B loan after hack disrupts vehicle production for weeks: Following a catastrophic cyberattack that halted production, the UK government is providing Jaguar Land Rover with a £1.5 billion loan guarantee to help restore its supply chain. Read more
Harrods suffers new data breach exposing 430,000 customer records: The UK retailer disclosed a new data breach originating from a compromised third-party supplier, resulting in the theft of 430,000 sensitive e-commerce customer records. Read more
Japan’s largest brewer suspends operations due to cyberattack: Asahi Group Holdings, Japan’s top beer brewer, has suspended several operations after a cyberattack disrupted its systems. Read more
UK convicts “Bitcoin Queen” in world’s largest cryptocurrency seizure: A Chinese national has been convicted in a fraud case that led to the UK’s seizure of nearly $7 billion in Bitcoin, believed to be the largest crypto seizure in the world. Read more

Security Tools & Best Practices

Tile’s lack of encryption could make tracker owners vulnerable to stalking: Security researchers warn that Tile trackers’ lack of encryption and a static MAC address could allow malicious actors to track users without their consent, creating significant stalking risks. Read more
Welcoming CERN to Have I Been Pwned: The European Organization for Nuclear Research (CERN), the birthplace of the World Wide Web, is now using Have I Been Pwned to monitor for compromised accounts. Read more

Cloud & Network Security

IoT Security Flounders Amid Churning Risk: Despite increasing attacks on IoT devices, a key US government security initiative for connected devices is reportedly stalled, leaving critical infrastructure like medical and industrial equipment at risk. Read more

Security Standards & Frameworks

CISA and UK NCSC Release Joint Guidance for Securing OT Systems: CISA and international partners have released joint guidance on creating and maintaining a definitive architectural view of Operational Technology (OT) systems to improve risk assessment and security controls. Read more
CISA Strengthens Commitment to SLTT Governments: CISA is transitioning to a new support model for state, local, tribal, and territorial (SLTT) governments, providing direct access to grant funding, no-cost tools, and cybersecurity expertise. Read more

Emerging Security Technologies

Abusing Notion’s AI Agent for Data Theft: Researchers have demonstrated how Notion’s new AI agents are vulnerable to prompt injection attacks, allowing for data exfiltration by hiding malicious commands in PDF files. Read more
Can We Trust AI To Write Vulnerability Checks? Here’s What We Found: Research into using AI for writing vulnerability checks shows that while it can accelerate the process, human oversight remains critical to ensure quality and prevent errors. Read more
SB 53, the landmark AI transparency bill, is now law in California: California has passed Senate Bill 53, requiring large AI developers to publicly disclose their safety and security frameworks and providing whistleblower protections. Read more

Data Breach, Supply Chain, AML Reforms & DPO – 09/29/2025

info@grabtheaxe.com (Chris Armour) — Mon, 29 Sep 2025 00:00:00 GMT

This compliance intelligence digest highlights critical updates, including a data breach at Veradigm, a FASCA order impacting Acronis, and phishing attacks targeting Ukrainian officials. Supply chain vulnerabilities are exposed through Chinese support of Russian drone manufacturing. Additionally, insights are provided on AML reforms, the role of DPOs, and strategies for compliance leaders to measure effectiveness.

Top 5 Critical Compliance Alerts

Veradigm Announces Data Breach Affecting Several Customers: Veradigm, a provider of practice management and electronic health record solutions, reports a data breach affecting several customers. Read more
DNI Issues First-Ever FASCA Order, Excludes Acronis from Intelligence Community Contracts: The federal government takes supply chain protection action, excluding Acronis from intelligence community contracts. Read more
Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv: Attackers impersonate the National Police of Ukraine to deploy Amatera Stealer and PureMiner via malicious SVG files. Read more
Chinese experts, Russian drones: What the drone case reveals about supply chain blind spots: Investigation reveals Chinese drone specialists working with sanctioned Russian arms manufacturer IEMZ Kupol. Read more
PCAs in the firing line: What law firms need to know about the Treasury’s AML reforms: HM Treasury is tightening AML compliance, focusing on pooled client accounts (PCAs) in law firms. Read more

Regulatory Updates

PCAs in the firing line: What law firms need to know about the Treasury’s AML reforms: HM Treasury is tightening AML compliance, focusing on pooled client accounts (PCAs) in law firms. Read more
Turkey’s First Climate Law: Environmental Necessity Meets Export Strategy: Law creates framework for 2053 net-zero target while positioning Turkey for green trade advantages. Read more

Third-Party Risk & Due Diligence

Chinese experts, Russian drones: What the drone case reveals about supply chain blind spots: Investigation reveals Chinese drone specialists working with sanctioned Russian arms manufacturer IEMZ Kupol. Read more
DNI Issues First-Ever FASCA Order, Excludes Acronis from Intelligence Community Contracts: The federal government takes supply chain protection action, excluding Acronis from intelligence community contracts. Read more
Seeing Tomorrow’s Supplier Risks Today: Why Predictive Analytics is Critical?: Predictive analytics are critical for managing supplier risks, as highlighted at the Salesforce Manufacturing Summit. Read more

Policy & Governance Updates

Why Compliance Leaders Should Think Like Marketers When Measuring Effectiveness: Compliance can prove business impact by adopting marketing strategies for measuring effectiveness. Read more
How to Become a DPO (Data Protection Officer) in the UK: Guidance on becoming a Data Protection Officer in the UK, a fast-growing privacy role. Read more
When Bots Rip Apart Your Business: Corporate compliance officers must consider the impact of bots on corporate culture and ethical priorities. Read more

Akira Ransomware, MFA Bypass & AI Security – 09/28/2025

info@grabtheaxe.com (Chris Armour) — Sun, 28 Sep 2025 00:00:00 GMT

Today’s intelligence digest highlights a critical threat from the Akira ransomware group, which is actively bypassing MFA on SonicWall VPN devices. This development poses a significant risk to organizations relying on multi-factor authentication for network security. We will also cover a major infrastructure incident involving a datacenter fire and discuss the evolving role of artificial intelligence in transforming modern cyberattacks. Stay informed on these key security developments.

Critical Security Alert

Akira ransomware breaching MFA-protected SonicWall VPN accounts: The Akira ransomware group is actively exploiting SonicWall SSL VPNs, successfully bypassing multi-factor authentication, potentially through the use of stolen OTP seeds. Read more

Threat Intelligence

Akira ransomware breaching MFA-protected SonicWall VPN accounts: The Akira ransomware group is actively exploiting SonicWall SSL VPNs, successfully bypassing multi-factor authentication, potentially through the use of stolen OTP seeds. Read more

Security Breaches & Incidents

Datacenter fire takes 647 South Korean government services offline: A significant fire at a South Korean datacenter has caused a massive outage, knocking hundreds of government digital services offline and highlighting physical security risks. Read more

Security Tools & Best Practices

Privacy Badger is a free browser extension made by EFF to stop spying: The Electronic Frontier Foundation (EFF) offers Privacy Badger, a free browser extension designed to automatically block invisible trackers and prevent third-party ad spying. Read more

Emerging Security Technologies

Wiz chief technologist Ami Luttwak on how AI is transforming cyberattacks: Wiz CTO Ami Luttwak provides insight into how artificial intelligence is being leveraged by threat actors to create more sophisticated cyberattacks and what it means for defenders. Read more

DNA, COPPA, Ransomware & Radicalization – 09/28/2025

info@grabtheaxe.com (Chris Armour) — Sun, 28 Sep 2025 00:00:00 GMT

Privacy risks are intensifying across government, corporate, and digital domains. The DHS has been secretly collecting DNA from US citizens without authorization, raising profound civil liberties concerns. Meanwhile, Akira ransomware is bypassing MFA protections on SonicWall VPNs, exposing critical weaknesses in enterprise defenses. From Disney’s $10 million COPPA settlement to scammers impersonating the USPTO and the rise of online radicalization, today’s threats underscore the urgent need for stronger oversight, transparency, and resilience.

Top 5 Critical Privacy Alerts

DHS Has Been Collecting US Citizens’ DNA for Years: CBP agents have been harvesting DNA from American citizens, including minors, without Congressional authorization. Read more
Akira ransomware breaching MFA-protected SonicWall VPN accounts: Akira ransomware attacks are successfully bypassing MFA on SonicWall VPNs, possibly through stolen OTP seeds. Read more
Disney settles charges that it violated children’s online privacy protection law: Disney will pay a $10 million penalty for COPPA violations related to collecting children’s data without parental consent. Read more
Scammers are impersonating the United States Patent and Trademark Office: Scammers are impersonating the USPTO to steal money from business owners by targeting their trademarks. Read more
Reading the post-riot posts: how we traced far-right radicalisation across 51,000 Facebook messages: Investigation traces far-right radicalization through online activity related to summer 2024 riots. Read more

Privacy Laws & Regulations

Disney settles charges that it violated children’s online privacy protection law: Disney will pay a $10 million penalty for COPPA violations related to collecting children’s data without parental consent. Read more
EU probes SAP over anti-competitive ERP support practices: The European Commission is investigating SAP for potential anti-competitive practices in ERP support services. Read more

Data Minimization & User Consent

DHS Has Been Collecting US Citizens’ DNA for Years: CBP agents have been harvesting DNA from American citizens, including minors, without Congressional authorization. Read more

Regulatory Fines & Enforcement Actions

Disney settles charges that it violated children’s online privacy protection law: Disney will pay a $10 million penalty for COPPA violations related to collecting children’s data without parental consent. Read more
EU probes SAP over anti-competitive ERP support practices: The European Commission is investigating SAP for potential anti-competitive practices in ERP support services. Read more

Nursery Hacking, AML Supervision & Astute LXP – 09/28/2025

info@grabtheaxe.com (Chris Armour) — Sun, 28 Sep 2025 00:00:00 GMT

Today’s compliance landscape is marked by escalating risks that demand immediate attention. A cyberattack on a global nursery chain underscores the vulnerability of sensitive personal data and the growing need for stronger protections. At the same time, US regulators signal potential shifts in anti-money laundering oversight, hinting at an intelligence-first supervisory model. Adding to the momentum, updates to the Astute LXP platform highlight the ongoing evolution of governance and compliance technology.

Critical Compliance Alert

When hackers target nurseries: Why cyber security has never mattered more: Hackers stole and leaked data from Kido International, a global nursery chain. The attackers, calling themselves Radiant, claim to have stolen personal information. Read more

Regulatory Updates

Is big regulatory change afoot in the US? The future of AML supervision: John K. Hurley signaled a serious rethink of America’s anti-money laundering playbook, laying out an intelligence-first model. Read more

Policy & Governance Updates

What’s New in Astute LXP – September 2025 Update (v3.4.3): Release focuses on speeding up Previous LMS Records imports and resolving issues across reporting, courses, emails, and surveys. Read more

PlugX Malware, Oyster Backdoor & NPM Threats – 09/27/2025

info@grabtheaxe.com (Chris Armour) — Sat, 27 Sep 2025 00:00:00 GMT

Today’s intelligence digest highlights a significant escalation in nation-state activity, with a China-linked campaign deploying PlugX and Bookworm malware against telecommunications sectors in Asia. Concurrently, a malvertising campaign is distributing the Oyster backdoor via fake Microsoft Teams installers to gain initial corporate access. We also cover an emerging supply chain threat involving a malicious backdoor in an NPM package. This is the critical information your organization needs to know today.

Top 5 Critical Security Alerts

Fake Microsoft Teams installers push Oyster malware via malvertising : Attackers are using malicious ads for fake Microsoft Teams installers to deploy the Oyster backdoor, gaining initial access to corporate networks. Read more
China-Linked PlugX and Bookworm Malware Attacks Target Asian Telecom and ASEAN Networks : A China-linked threat actor is actively targeting telecommunications and manufacturing sectors in Asia with new variants of PlugX and Bookworm malware. Read more
The Postmark backdoor that’s downloading emails : A malicious backdoor has been discovered in an NPM package, designed to compromise systems and exfiltrate user emails, highlighting supply chain risks. Read more
Hunt for RedNovember: Beijing hacked critical orgs in year-long snooping campaign : A newly detailed report outlines a year-long espionage campaign by a Beijing-linked group, RedNovember, that targeted critical organizations for data theft. Read more
Dutch teens arrested for trying to spy on Europol for Russia : Two teenagers in the Netherlands have been arrested for allegedly using hacking devices to conduct espionage against the European Union Agency for Law Enforcement Cooperation (Europol) on behalf of Russia. Read more

Threat Intelligence

Fake Microsoft Teams installers push Oyster malware via malvertising : Attackers are using malicious ads for fake Microsoft Teams installers to deploy the Oyster backdoor, gaining initial access to corporate networks. Read more
China-Linked PlugX and Bookworm Malware Attacks Target Asian Telecom and ASEAN Networks : A China-linked threat actor is actively targeting telecommunications and manufacturing sectors in Asia with new variants of PlugX and Bookworm malware. Read more
The Postmark backdoor that’s downloading emails : A malicious backdoor has been discovered in an NPM package, designed to compromise systems and exfiltrate user emails, highlighting supply chain risks. Read more
Hunt for RedNovember: Beijing hacked critical orgs in year-long snooping campaign : A newly detailed report outlines a year-long espionage campaign by a Beijing-linked group, RedNovember, that targeted critical organizations for data theft. Read more

Security Breaches & Incidents

Dutch teens arrested for trying to spy on Europol for Russia : Two teenagers in the Netherlands have been arrested for allegedly using hacking devices to conduct espionage against the European Union Agency for Law Enforcement Cooperation (Europol) on behalf of Russia. Read more

Security Tools & Best Practices

SSH3: Faster and rich secure shell using HTTP/3 : A new proposal, SSH3, leverages the performance and features of HTTP/3 to offer a faster, more robust, and more feature-rich secure shell experience. Read more

Emerging Security Technologies

Microsoft’s VibeVoice is a new AI podcast model that might generate spontaneous singing : Microsoft has developed VibeVoice, an AI model capable of generating long-form, multi-speaker conversations, raising potential concerns for sophisticated audio deepfakes. Read more
Anthropic settles landmark AI copyright lawsuit for at least $1.5 billion : Anthropic’s $1.5 billion settlement with authors and publishers could establish new legal precedents and risks for training AI models on copyrighted material. Read more
OpenAI says top AI models are reaching expert territory on real-world knowledge work : OpenAI’s new benchmark suggests that top-tier AI models are performing at expert levels, indicating rapidly advancing capabilities that could be used for both defensive and offensive cyber operations. Read more

GoAnywhere Flaw, Cisco Exploits & LockBit Variant – 09/26/2025

info@grabtheaxe.com (Chris Armour) — Fri, 26 Sep 2025 00:00:00 GMT

Today’s intelligence digest is dominated by actively exploited zero-day vulnerabilities in enterprise-grade software. A critical CVSS 10.0 flaw in Fortra’s GoAnywhere MFT is being exploited in the wild, alongside separate zero-days in Cisco firewalls used by the ArcaneDoor APT. We are also tracking a new, more dangerous variant of the LockBit ransomware and a campaign by Iranian state actors using valid SSL certificates to sign malware.

Top 5 Critical Security Alerts

Maximum severity GoAnywhere MFT flaw exploited as zero-day: A critical CVSS 10.0 vulnerability in Fortra’s GoAnywhere MFT is being actively exploited as a zero-day, with evidence suggesting exploitation began a week before public disclosure. Read more
Cisco ASA Firewall Zero-Day Exploits Deploy New Malware: The ArcaneDoor threat actor is exploiting zero-day vulnerabilities in Cisco firewalls to deploy new malware strains, RayInitiator and LINE VIPER, prompting urgent patch advisories from US and UK agencies. Read more
New LockBit Ransomware Variant Emerges as Most Dangerous Yet: A new version of the LockBit ransomware has been identified with significant technical improvements and cross-platform capabilities, targeting Windows, Linux, and VMware ESXi systems. Read more
Iranian State Hackers Use SSL.com Certificates to Sign Malware: Multiple Iranian state-sponsored threat groups, including Charming Kitten, are using valid code-signing certificates from SSL.com to sign and distribute malware, bypassing security controls. Read more
Ransomware attack on Ohio county impacts over 45,000 residents: A ransomware attack on an Ohio county has resulted in a significant data breach, exposing the names, Social Security numbers, and financial information of over 45,000 people. Read more

Threat Intelligence

New COLDRIVER Malware Campaign Targets Russia-Focused Entities: The Russian APT group COLDRIVER is using new malware families, BAITSWITCH and SIMPLEFIX, in a multi-stage campaign against Russia-focused targets. Read more
New macOS XCSSET Variant Targets Firefox with Clipper and Persistence Module: An updated version of the XCSSET macOS malware has been discovered with enhanced capabilities for browser targeting, clipboard hijacking, and establishing persistence. Read more
HeartCrypt Packer-as-a-Service Operation Expands Impersonation Efforts: Security researchers have detailed the evolution of the HeartCrypt Packer-as-a-Service, a notorious operation used by threat actors to obfuscate malware. Read more
Phishing Campaign Uses Malicious SVG Files to Target Ukraine and Vietnam: A phishing campaign impersonating Ukrainian government agencies is using malicious SVG files to deliver CountLoader, which in turn drops Amatera Stealer and PureMiner malware. Read more
Teens Arrested in Netherlands on Suspicion of Spying for Russia: Two teenagers have been arrested by Dutch police, reportedly suspected of conducting cyber-espionage activities on behalf of pro-Russian hacking groups. Read more

Security Breaches & Incidents

Volvo Employee SSNs Stolen in Supplier Ransomware Attack: Volvo North America has confirmed that employee Social Security Numbers were stolen as part of a ransomware attack targeting one of its IT suppliers. Read more
Thousands of Indian bank transfer records found spilling online after security lapse: A configuration error at Indian fintech company NuPay exposed thousands of sensitive bank transfer records online, which have since been secured. Read more

Security Tools & Best Practices

Microsoft Edge to block malicious sideloaded extensions: Microsoft is introducing a new security feature in its Edge browser designed to protect users by blocking potentially malicious extensions that are sideloaded. Read more
Microsoft shares temp fix for Outlook encrypted email errors: Microsoft is investigating an issue causing errors when opening encrypted emails from external organizations in Outlook and has provided a temporary workaround. Read more
TruSources to showcase on-device identity-checking technology: A startup named TruSources is developing privacy-focused technology that performs age and identity verification directly on a user’s device without uploading IDs. Read more

Emerging Security Technologies

The hidden cyber risks of deploying generative AI: Deploying generative AI without proper safeguards can introduce significant security risks, including new avenues for phishing, fraud, and model manipulation. Read more
US investigators are using AI to detect child abuse images made by AI: The Department of Homeland Security is experimenting with AI tools to differentiate between AI-generated child abuse material and images depicting real victims. Read more

Cisco Zero-Days, Shai-Hulud Worm & CISA Alerts – 09/25/2025

info@grabtheaxe.com (Chris Armour) — Thu, 25 Sep 2025 00:00:00 GMT

Today’s security landscape is dominated by multiple actively exploited zero-day vulnerabilities in Cisco firewalls, prompting an emergency directive from CISA for immediate patching. A massive software supply chain attack, dubbed ‘Shai-Hulud,’ has compromised over 500 npm packages, affecting millions of downloads. We are also covering the significant financial fallout from the Co-op cyberattack and a critical data exposure flaw in a popular call-recording app. This digest provides essential details on these high-priority threats.

Top 5 Critical Security Alerts

Cisco warns of ASA firewall zero-days exploited in attacks: Cisco has disclosed two critical zero-day vulnerabilities in its ASA and FTD firewall software that are being actively exploited in the wild, urging immediate patching. Read more
CISA orders agencies to patch Cisco flaws exploited in zero-day attacks: CISA has issued an emergency directive ordering all U.S. federal agencies to secure their Cisco firewall devices against the two actively exploited zero-day flaws within one day. Read more
As many as 2 million Cisco devices affected by actively exploited 0-day: Security scans reveal that up to two million Cisco devices with vulnerable SNMP interfaces are exposed to the internet, significantly increasing the attack surface for this exploited flaw. Read more
Massive npm infection: the Shai-Hulud worm and patient zero: A widespread software supply chain attack involves a self-replicating worm named ‘Shai-Hulud,’ which has infected over 500 npm packages with millions of downloads. Read more
Critical Vulnerability in Salesforce AgentForce Exposed: A critical flaw dubbed ‘ForcedLeak’ in Salesforce’s AgentForce AI platform allows for sensitive CRM data exfiltration through indirect prompt injection attacks. Read more

Threat Intelligence

Microsoft warns of new XCSSET macOS malware variant targeting Xcode devs: Microsoft Threat Intelligence has identified a new variant of the XCSSET macOS malware, which now includes enhanced features for browser targeting and clipboard hijacking. Read more
Malicious Rust packages on Crates.io steal crypto wallet keys: Two malicious packages on Rust’s official Crates.io repository, downloaded nearly 8,500 times, were found scanning developer systems to steal cryptocurrency private keys. Read more
Unofficial Postmark MCP npm silently stole users’ emails: A malicious npm package impersonating the official ‘postmark-mcp’ library was discovered exfiltrating user email communications via a single line of malicious code. Read more

Security Breaches & Incidents

Co-op says it lost $107 million after Scattered Spider attack: UK retailer The Co-op has reported a massive operating loss of £80 million ($107 million) as a direct result of the cyberattack it suffered in April. Read more
Viral call-recording app Neon goes dark after exposing users’ phone numbers, call recordings, and transcripts: The popular iPhone app Neon was pulled offline after a major security bug was discovered that allowed any user to access the call recordings and transcripts of other users. Read more

Security Tools & Best Practices

How secure are passkeys, really? Here’s what you need to know: Passkeys offer significant advantages over traditional passwords by providing phishing resistance and simpler logins, though some hurdles to widespread adoption remain. Read more

Cloud & Network Security

Chinese APT Drops ‘Brickstorm’ Backdoors on Edge Devices: The China-linked cyber-espionage group UNC5221 is actively compromising network edge devices with new versions of the ‘Brickstorm’ backdoor to evade traditional EDR solutions. Read more

Security Standards & Frameworks

CISA urges orgs to review software after ‘Shai-Hulud’ supply chain compromise: In response to the ‘Shai-Hulud’ worm, CISA is urging all organizations to diligently review their software supply chains for potential compromise from infected packages. Read more

Cisco Zero-Day, BRICKSTORM Malware & Supermicro Flaws – 09/24/2025

info@grabtheaxe.com (Chris Armour) — Wed, 24 Sep 2025 00:00:00 GMT

Today’s security landscape is defined by immediate and severe threats, led by an actively exploited zero-day vulnerability in Cisco IOS and IOS XE software. We are also tracking critical firmware flaws in Supermicro servers that allow for persistent, unremovable malware. Furthermore, a detailed report from Google reveals the BRICKSTORM backdoor, a stealthy tool used in a long-running espionage campaign against U.S. technology and legal firms. These incidents demand immediate attention and remediation from security teams.

Top 5 Critical Security Alerts

Cisco warns of IOS zero-day vulnerability exploited in attacks: A high-severity zero-day vulnerability in Cisco IOS and IOS XE Software is being actively exploited, requiring immediate patching. Read more
Supermicro server motherboards can be infected with unremovable malware: Newly disclosed vulnerabilities in Supermicro’s Baseboard Management Controller (BMC) firmware allow attackers to install persistent, unremovable malware. Read more
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors: Google and Mandiant detail the BRICKSTORM backdoor, a sophisticated tool used by a suspected China-nexus group for long-term, stealthy espionage against US organizations. Read more
CISA: Attackers Breach Federal Agency via Critical GeoServer Flaw: CISA confirmed that threat actors successfully breached a federal civilian agency by exploiting a critical vulnerability in the GeoServer open-source server. Read more
Unpatched flaw in OnePlus phones lets rogue apps text messages: A significant, unpatched vulnerability in multiple versions of OnePlus OxygenOS allows any installed application to access SMS data without requiring permissions. Read more

Threat Intelligence (APT, malware, ransomware)

Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms: U.S. prosecutors have charged two alleged core members of the prolific Scattered Spider cybercrime group, connecting them to over $115 million in ransom extortions. Read more
Obscura, an obscure new ransomware variant: Security researchers have discovered Obscura, a previously unseen ransomware variant that was observed spreading from a victim’s domain controller. Read more

Security Breaches & Incidents

UK arrests man linked to ransomware attack that caused airport disruptions across Europe: The UK’s National Crime Agency has arrested a suspect believed to be connected to the ransomware attack on Collins Aerospace that led to major flight disruptions. Read more
PyPI urges users to reset credentials after new phishing attacks: The Python Software Foundation is warning developers of a new phishing campaign targeting Python Package Index (PyPI) credentials with a fake login page. Read more
GitHub notifications abused to impersonate Y Combinator for crypto theft: A large-scale phishing campaign is exploiting GitHub notifications to impersonate Y Combinator, aiming to trick users into installing cryptocurrency-draining malware. Read more

Security Tools & Best Practices

Kali Linux 2025.3 released with 10 new tools, wifi enhancements: The latest version of the penetration testing distribution, Kali Linux 2025.3, has been released with ten new tools and various system improvements. Read more
What happens when you engage Cisco Talos Incident Response?: Cisco Talos provides an inside look at its incident response process, explaining how its team helps organizations mitigate threats and recover from cyberattacks. Read more

Cloud & Network Security

New Supermicro BMC flaws can create persistent backdoors: Two new vulnerabilities in Supermicro’s Baseboard Management Controller (BMC) firmware can be exploited by attackers to flash malicious images and create persistent backdoors. Read more

Security Standards & Frameworks (NIST, MITRE ATT&CK, CIS)

Senators introduce bill directing FTC to establish standards for protecting consumers’ neural data: A new bill has been introduced in the U.S. Senate that would empower the FTC to create privacy standards to protect consumers’ neural (brain) data. Read more

Emerging Security Technologies (AI, XDR, CNAPP)

AI vs. AI: Detecting an AI-obfuscated phishing campaign: Microsoft Threat Intelligence details how it detected and blocked a sophisticated phishing campaign that used AI-generated code to hide its malicious payload. Read more
Neon, the No. 2 social app on the Apple App Store, pays users to record their phone calls and sells data to AI firms: A popular call recording app is raising privacy alarms by paying users for their voice data from phone calls, which is then sold to AI development firms. Read more
OpenAI is testing a new GPT-5-based AI agent “GPT-Alpha”: Reports indicate OpenAI is internally testing a powerful new AI agent based on a specialized version of its next-generation GPT-5 model, codenamed “GPT-Alpha.” Read more

NPM Supply Chain, GeoServer Exploit & CISA Alerts – 09/23/2025

info@grabtheaxe.com (Chris Armour) — Tue, 23 Sep 2025 00:00:00 GMT

Today’s intelligence digest is dominated by a widespread software supply chain compromise targeting the npm ecosystem, with CISA issuing a critical alert. Concurrently, CISA has detailed a federal agency breach stemming from an unpatched GeoServer vulnerability, highlighting significant detection delays. Other major events include ongoing operational shutdowns at Jaguar Land Rover and European airports due to cyberattacks, and the discovery of a nation-state linked SIM farm threatening New York’s cellular network.

Top 5 Critical Security Alerts

Widespread Supply Chain Compromise Impacting npm Ecosystem: CISA warns of a self-replicating worm, ‘Shai-Hulud,’ that has compromised over 500 npm packages to steal developer credentials and API keys. Read more
CISA says hackers breached federal agency using GeoServer exploit: CISA confirms threat actors breached a federal agency by exploiting a known GeoServer vulnerability (CVE-2024-36401), moving laterally and remaining undetected for three weeks. Read more
Libraesva ESG issues emergency fix for bug exploited by state hackers: An emergency patch has been released for the Libraesva Email Security Gateway to fix a critical vulnerability actively exploited by state-sponsored threat actors. Read more
SolarWinds releases third patch to fix Web Help Desk RCE bug: SolarWinds has issued another hotfix for a critical remote code execution (RCE) vulnerability in its Web Help Desk software. Read more
US uncovers 100,000 SIM cards that could have “shut down” NYC cell network: The Secret Service disrupted a massive, nation-state-linked network of 100,000 SIM cards and 300 servers capable of launching attacks against NYC’s cellular infrastructure. Read more

Threat Intelligence

How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking: Talos Intelligence details how a new PlugX malware variant overlaps with RainyDay and Turian backdoors, using DLL search order hijacking for execution. Read more
NPM package caught using QR Code to fetch cookie-stealing malware: Researchers discovered the ‘fezbox’ npm package using QR codes to conceal and deliver a second-stage payload designed to steal browser cookies. Read more
ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Service: A new DDoS-for-hire botnet, ShadowV2, is actively compromising misconfigured Docker containers on AWS to build its attack infrastructure. Read more

Security Breaches & Incidents

European airports still dealing with disruptions days after ransomware attack: A ransomware attack on Collins Aerospace continues to cause flight delays and check-in system disruptions at major airports in Berlin, Brussels, Dublin, and London. Read more
Jaguar Land Rover extends shutdown again following cyberattack: The production halt at Jaguar Land Rover, caused by a cyberattack, has been extended into October, marking at least four weeks of disruption. Read more
South Korea probes credit card company data breach affecting 3 million customers: A major South Korean credit card processor is investigating a data breach that has impacted approximately 3 million customers, requiring card reissuances. Read more
Boyd Gaming discloses data breach after suffering a cyberattack: The US casino operator confirmed a cyberattack where threat actors accessed its systems and exfiltrated employee and customer data. Read more

Security Tools & Best Practices

GitHub tightens npm security with mandatory 2FA, access tokens: In response to recent supply-chain attacks, GitHub is strengthening npm security by enforcing 2FA and introducing short-lived access tokens for publishing packages. Read more
SonicWall releases SMA100 firmware update to wipe rootkit malware: SonicWall has issued a firmware update for its SMA 100 series appliances designed to detect and remove persistent rootkit malware from compromised devices. Read more

Cloud & Network Security

Cloudflare mitigates new record-breaking 22.2 Tbps DDoS attack: Cloudflare successfully defended against a massive DDoS attack that peaked at 22.2 Tbps, setting a new record for mitigated attack volume. Read more

Security Standards & Frameworks

CISA Adds One Known Exploited Vulnerability to Catalog: CISA has added CVE-2025-10585, a type confusion vulnerability in Google Chromium’s V8 engine, to its Known Exploited Vulnerabilities (KEV) catalog. Read more
CISA Releases Six Industrial Control Systems Advisories: CISA has published six new advisories detailing vulnerabilities in ICS products from vendors including AutomationDirect, Mitsubishi Electric, and Schneider Electric. Read more

Emerging Security Technologies

AI models are using material from retracted scientific papers: Recent studies reveal that some AI chatbots are sourcing information from flawed, retracted scientific papers, raising concerns about the reliability of AI-generated research. Read more

Airport Ransomware, Stellantis Breach & AI Risks – 09/22/2025

info@grabtheaxe.com (Chris Armour) — Mon, 22 Sep 2025 00:00:00 GMT

Today’s security landscape is dominated by a major ransomware attack on an aviation tech provider, causing widespread disruptions at European airports. This digest also covers a significant data breach at auto giant Stellantis impacting North American customers and a critical CVSS 10.0 vulnerability patched in Microsoft’s Entra ID. Additionally, we are tracking active malware campaigns and new security flaws discovered in popular AI tools. Here is the critical intelligence you need to know.

Top 5 Critical Security Alerts

Airport disruptions in Europe caused by a ransomware attack: A widespread ransomware attack targeting Collins Aerospace, a provider of airport check-in systems, has caused significant flight delays and disruptions across major European airports like Heathrow. Read more
Automaker giant Stellantis says customers’ personal data stolen during breach: Stellantis confirmed a significant data breach affecting North American customers after a third-party vendor, reportedly Salesforce, was compromised, potentially exposing millions of records. Read more
Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants: Microsoft patched a critical (CVSS 10.0) vulnerability in Entra ID (CVE-2025-55241) that could have allowed attackers to impersonate any user, including Global Admins, across any tenant. Read more
SonicWall Releases Advisory for Customers after Security Incident: Following a brute-force attack on its MySonicWall portal, the company has issued an advisory for customers to check if their cloud backup files were exposed, which could lead to firewall compromise. Read more
Here’s how potent Atomic credential stealer is finding its way onto Macs: The Atomic (AMOS) credential stealer is actively targeting macOS users by impersonating legitimate software like LastPass, using malvertising and SEO poisoning to distribute the malware. Read more

Threat Intelligence

Alleged Scattered Spider member turns self in to Las Vegas police: A 17-year-old male allegedly linked to the Scattered Spider hacking group has surrendered to police in connection with the 2023 cyberattacks on Las Vegas casinos. Read more
Iran-Linked Hackers Target Europe With New Malware: The threat group known as “Nimbus Manticore” has been observed targeting European organizations with improved variants of its flagship malware. Read more
Russia steps up disinformation efforts to sway Moldova’s parliamentary vote: Russia is reportedly escalating covert influence operations to interfere with Moldova’s upcoming election in an attempt to prevent its alignment with the European Union. Read more
ComicForm and SectorJ149 Hackers Deploy Formbook Malware in Eurasian Cyberattacks: A newly identified group, ComicForm, is targeting industrial and financial sectors in Belarus, Kazakhstan, and Russia with the Formbook infostealer malware. Read more
Unit 221B raises $5M to help track and disrupt today’s top hacking groups: Threat intelligence startup Unit 221B secured $5 million in seed funding to enhance its platform focused on tracking English-speaking youth hacking groups like Scattered Spider and Lapsus$. Read more

Security Breaches & Incidents

Verified Steam game steals streamer’s cancer treatment donations: A malicious game on Steam called BlockBlasters, which was verified by the platform, was used to deploy a crypto-draining malware, stealing over $150,000 from players. Read more
American Archive of Public Broadcasting fixes bug exposing restricted media: A vulnerability that allowed the unauthorized download of protected and private media from the American Archive of Public Broadcasting’s website has been quietly patched after existing for years. Read more

Security Tools & Best Practices

New EDR-Freeze tool uses Windows WER to suspend security software: A new proof-of-concept tool called EDR-Freeze demonstrates a method for evading EDR and other security solutions by leveraging the Windows Error Reporting (WER) system. Read more
What happens when a cybersecurity company gets phished?: Sophos provides a transparent look at its internal response and defense-in-depth strategy after one of its own employees fell victim to a phishing attack. Read more
Why attackers are moving beyond email-based phishing attacks: Phishing campaigns are increasingly using social media, chat apps, and malicious ads to steal credentials, shifting the defense focus from email gateways to the browser. Read more
15 Years of Zero Trust: Why It Matters More Than Ever: The zero trust security framework continues to be a foundational strategy for modern security operations, especially with the rise of AI-driven attacks and hyperconnectivity. Read more

Security Standards & Frameworks

Major Cyber Threat Detection Vendors Pull Out of MITRE Evaluations Test: Key vendors including Microsoft, SentinelOne, and Palo Alto have withdrawn from the 2025 MITRE ATT&CK Evaluations, citing concerns over the testing methodology and value. Read more

Emerging Security Technologies

Notion AI agents get security update after data leak: A vulnerability in Notion 3.0’s new AI agents could be exploited to leak sensitive data by tricking the agent with a malicious PDF, prompting a security update. Read more
ChatGPT’s Deep Research mode let attackers steal Gmail data with hidden instructions in emails: Security researchers found a serious flaw in ChatGPT’s “Deep Research” mode that allowed attackers to covertly exfiltrate sensitive data from connected Gmail accounts. Read more
How to Gain Control of AI Agents and Non-Human Identities: This article outlines the growing security challenge of managing and securing thousands of non-human identities, such as service accounts and AI agents, within enterprises. Read more

Entra ID Flaw, Airport Cyberattack & AI Security – 09/21/2025

info@grabtheaxe.com (Chris Armour) — Sun, 21 Sep 2025 00:00:00 GMT

This intelligence digest highlights a critical vulnerability in Microsoft Entra ID that could have allowed global tenant takeovers. We also cover a major cyberattack disrupting European air travel, an emerging data exfiltration risk in Notion’s new AI agents, and an active malware campaign by North Korean hackers targeting the crypto sector. These incidents underscore the persistent threats to both cloud infrastructure and critical services.

Top 4 Critical Security Alerts

Microsoft Entra ID flaw allowed hijacking any company’s tenant: A critical vulnerability in Microsoft Entra ID, stemming from legacy components, could have enabled attackers to gain complete control over any organization’s tenant. Read more
Hundreds of flights delayed at Heathrow and other airports after apparent cyberattack: A cyber incident targeting Collins Aerospace systems caused major flight delays at several key European airports, disrupting travel for thousands. Read more
Notion 3.0’s new AI agents can be tricked into leaking data through a malicious PDF: New AI agents in Notion 3.0 can be exploited via malicious PDFs to leak sensitive user data, posing a significant data exfiltration risk. Read more
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams: North Korean threat actors are using fake job lures related to cryptocurrency to distribute BeaverTail and InvisibleFerret malware in an active campaign. Read more

Threat Intelligence

DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams: North Korean threat actors are using fake job lures related to cryptocurrency to distribute BeaverTail and InvisibleFerret malware in an active campaign. Read more

Security Breaches & Incidents

Hundreds of flights delayed at Heathrow and other airports after apparent cyberattack: A cyber incident targeting Collins Aerospace systems caused major flight delays at several key European airports, disrupting travel for thousands. Read more

Cloud & Network Security

Microsoft Entra ID flaw allowed hijacking any company’s tenant: A critical vulnerability in Microsoft Entra ID, stemming from legacy components, could have enabled attackers to gain complete control over any organization’s tenant. Read more

Emerging Security Technologies

Notion 3.0’s new AI agents can be tricked into leaking data through a malicious PDF: New AI agents in Notion 3.0 can be exploited via malicious PDFs to leak sensitive user data, posing a significant data exfiltration risk. Read more

AI Malware, Entra ID Flaw, & ShadowLeak Vuln – 09/20/2025

info@grabtheaxe.com (Chris Armour) — Sat, 20 Sep 2025 00:00:00 GMT

This intelligence digest highlights a significant escalation in AI-driven threats, including the discovery of ‘MalTerminal,’ a GPT-4 powered malware capable of creating ransomware. Additionally, a critical zero-click ‘ShadowLeak’ vulnerability was found in an OpenAI agent, posing a risk to Gmail data. We also cover severe, now-patched vulnerabilities in Microsoft’s Entra ID that could have led to widespread account compromise.

Top 4 Critical Security Alerts

Microsoft’s Entra ID vulnerabilities could have been catastrophic: Researchers discovered severe, now-patched vulnerabilities in Microsoft’s Entra ID that could have allowed attackers to access virtually all Azure customer accounts. Read more
Researchers Uncover GPT-4-Powered MalTerminal Malware Creating Ransomware, Reverse Shell: A novel malware named MalTerminal leverages GPT-4 to autonomously generate malicious code, including ransomware and reverse shells, marking a new evolution in AI-driven threats. Read more
ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent: A zero-click vulnerability, dubbed ShadowLeak, was discovered in an OpenAI agent that could allow exfiltration of sensitive Gmail data with a single crafted email. Read more
LastPass Warns of Fake Repositories Infecting macOS with Atomic Infostealer: LastPass is alerting macOS users to an active campaign using fraudulent GitHub repositories to distribute the Atomic infostealer malware disguised as legitimate tools. Read more

Threat Intelligence

Researchers Uncover GPT-4-Powered MalTerminal Malware Creating Ransomware, Reverse Shell: A novel malware named MalTerminal leverages GPT-4 to autonomously generate malicious code, including ransomware and reverse shells, marking a new evolution in AI-driven threats. Read more
LastPass Warns of Fake Repositories Infecting macOS with Atomic Infostealer: LastPass is alerting macOS users to an active campaign using fraudulent GitHub repositories to distribute the Atomic infostealer malware disguised as legitimate tools. Read more

Security Breaches & Incidents

Canada dismantles TradeOgre exchange, seizes $40 million in crypto: Canadian authorities have shut down the TradeOgre cryptocurrency exchange, seizing over $40 million believed to be linked to criminal activities. Read more

Cloud & Network Security

Microsoft’s Entra ID vulnerabilities could have been catastrophic: Researchers discovered severe, now-patched vulnerabilities in Microsoft’s Entra ID that could have allowed attackers to access virtually all Azure customer accounts. Read more
Images over DNS: A technical proof-of-concept demonstrates a method for transferring image data over the DNS protocol, highlighting a potential covert channel for data exfiltration. Read more

Emerging Security Technologies

ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent: A zero-click vulnerability, dubbed ShadowLeak, was discovered in an OpenAI agent that could allow exfiltration of sensitive Gmail data with a single crafted email. Read more

GoAnywhere Flaw, Russian APTs & Scattered Spider – 09/19/2025

info@grabtheaxe.com (Chris Armour) — Fri, 19 Sep 2025 00:00:00 GMT

Today’s security intelligence digest is led by a critical CVSS 10.0 vulnerability in Fortra’s GoAnywhere MFT, requiring immediate patching. We are also tracking a significant escalation in nation-state threats, as Russian APTs Turla and Gamaredon are now collaborating on attacks. Furthermore, new details have emerged on the Scattered Spider ransomware group, which has reportedly extorted over $115 million and breached a U.S. federal court system. Here is the essential information you need to secure your organization.

Top 5 Critical Security Alerts

Fortra warns of max severity flaw in GoAnywhere MFT’s License Servlet: Fortra has patched a maximum severity (CVSS 10.0) command injection vulnerability in its GoAnywhere MFT software that requires immediate attention. Read more
Two of the Kremlin’s most active hack groups are collaborating, ESET says: Russian FSB-affiliated APT groups Turla and Gamaredon are now collaborating, sharing tools and infrastructure to enhance their espionage attacks against Ukraine. Read more
DOJ: Scattered Spider took $115 million in ransoms, breached a US court system: U.S. authorities revealed the Scattered Spider cybercrime group has extorted at least $115 million and successfully breached a federal court network. Read more
CISA exposes malware kits deployed in Ivanti EPMM attacks: CISA has published a detailed analysis of malware kits being actively used to exploit vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) systems. Read more
Critical Azure Entra ID Flaw Highlights Microsoft IAM Issues: A now-patched critical vulnerability in Azure Entra ID could have enabled catastrophic attacks, potentially granting access to every tenant in the system. Read more

Threat Intelligence

The GoLaxy papers: Inside China’s AI persona army: Leaked documents from a Beijing-based firm named GoLaxy detail a sophisticated strategy for information warfare using an army of AI-generated online personas. Read more
Two UK teens charged in connection to Scattered Spider ransomware attacks: Two teenagers in the UK have been arrested and charged for their alleged involvement with the prolific Scattered Spider ransomware group. Read more
Threat landscape for industrial automation systems in Q2 2025: Kaspersky’s latest report details the malware and threats detected and blocked on Industrial Control System (ICS) computers during the second quarter of 2025. Read more

Security Breaches & Incidents

Watchdog finds MrBeast improperly collected children’s data: An industry watchdog group has found that popular YouTuber MrBeast collected data from children without obtaining the required parental consent. Read more

Security Tools & Best Practices

FBI warns of cybercriminals using fake FBI crime reporting portals: The FBI has issued a warning about malicious websites impersonating its Internet Crime Complaint Center (IC3) to deceive and victimize users. Read more
Have I Been Pwned Demos Are Now Live!: Troy Hunt has launched a new platform for live demonstrations to help users better understand and utilize the Have I Been Pwned service. Read more

Cloud & Network Security

SystemBC Powers REM Proxy With 1,500 Daily VPS Victims Across 80 C2 Servers: The SystemBC malware is fueling a large-scale proxy network called REM Proxy, compromising approximately 1,500 VPS victims daily across 80 command-and-control servers. Read more

Security Standards & Frameworks

Future of CVE Program in limbo as CISA, board members debate path forward: Disagreements between CISA and board members have created uncertainty about the future governance and operation of the essential CVE vulnerability program. Read more

Emerging Security Technologies

‘ShadowLeak’ ChatGPT Attack Allows Hackers to Invisibly Steal Emails: A newly discovered zero-click vulnerability in a ChatGPT agent, dubbed ‘ShadowLeak,’ could allow attackers to silently exfiltrate Gmail data via OpenAI’s infrastructure. Read more
Notion 3.0 introduces AI “agents” for documents, workflows, and team automation: The latest version of Notion introduces AI agents capable of automating complex tasks, from document creation to managing multi-step team workflows. Read more

Scattered Spider Arrest, Chrome Zero-Day & AI Threats – 09/18/2025

info@grabtheaxe.com (Chris Armour) — Thu, 18 Sep 2025 00:00:00 GMT

Today’s security landscape is marked by significant law enforcement action, with US and UK authorities charging a key member of the Scattered Spider hacking group. Concurrently, a critical zero-day vulnerability in Google Chrome is under active exploitation, requiring immediate patching from all users. Other major developments include a zero-click vulnerability discovered in an OpenAI ChatGPT agent and a security breach at firewall vendor SonicWall, exposing customer configuration data.

Top 5 Critical Security Alerts

Google patches sixth Chrome zero-day exploited in attacks this year: Emergency updates have been released for a Chrome zero-day vulnerability, the sixth actively exploited this year, involving a type confusion issue in the V8 engine. Read more
OpenAI fixes zero-click ShadowLeak vulnerability affecting ChatGPT Deep Research agent: A zero-click vulnerability named ‘ShadowLeak’ in ChatGPT’s research agent, which could be exploited by sending an email to a user, has been patched by OpenAI. Read more
WatchGuard warns of critical vulnerability in Firebox firewalls: WatchGuard has patched a critical remote code execution (RCE) vulnerability affecting its Firebox firewall appliances, urging immediate updates. Read more
SonicWall Breached, Firewall Backup Data Exposed: Threat actors breached the MySonicWall service, accessing backup firewall configuration files for fewer than 5% of its customers, prompting a password reset advisory. Read more
CISA Releases Malware Analysis Report on Malicious Listener Targeting Ivanti Endpoint Manager Mobile Systems: CISA has detailed malware used to exploit Ivanti EPMM vulnerabilities (CVE-2025-4427, CVE-2025-4428), providing IOCs and detection rules for defenders. Read more

Threat Intelligence (APT, malware, ransomware)

US government charges British teenager accused of at least 120 ‘Scattered Spider’ hacks: A 19-year-old from London has been arrested and charged by US and UK authorities for alleged involvement in over 120 hacks attributed to the ‘Scattered Spider’ group. Read more
SystemBC malware turns infected VPS systems into proxy highway: The SystemBC proxy botnet is actively compromising vulnerable virtual private servers (VPS) to create a network of approximately 1,500 bots for routing malicious traffic. Read more
PyPI invalidates tokens stolen in GhostAction supply chain attack: The Python Software Foundation has invalidated all API tokens stolen during the GhostAction supply chain attack, confirming they were not used to publish malware. Read more
SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers: Two malicious PyPI packages have been found delivering SilentSync, a remote access trojan capable of command execution, data exfiltration, and screen capture on Windows systems. Read more
CountLoader Broadens Russian Ransomware Operations With Multi-Version Malware Loader: A new malware loader, CountLoader, is being used by Russian ransomware affiliates to deploy post-exploitation tools like Cobalt Strike and the PureHVNC RAT. Read more

Security Breaches & Incidents

How weak passwords and other failings led to catastrophic breach of Ascension: A detailed analysis reveals how weak passwords and Active Directory vulnerabilities, including ‘Kerberoasting’ attacks, led to a major security breach at Ascension. Read more
Russian regional airline disrupted by suspected cyberattack: KrasAvia, a Siberia-based airline, suffered digital service outages from a cyberattack similar to one previously claimed by pro-Ukraine hacktivists. Read more
New York Blood Center Alerts 194,000 People to Data Breach: A data breach at the New York Blood Center has exposed the personal and health information, including SSNs and bank details, of 194,000 individuals. Read more

Security Tools & Best Practices

Put together an IR playbook, for your personal mental health and wellbeing, A Cisco Talos expert shares insights on creating incident response playbooks while also managing the personal challenges of burnout in the cybersecurity field. Read more
Target-rich environment: Why Microsoft 365 has become the biggest risk: The extensive integration of Microsoft 365 creates a large attack surface, making it a primary target for cyberattacks due to risks like lateral movement and backup blind spots. Read more
ICE unit signs new $3M contract for phone-hacking tech: U.S. Immigration and Customs Enforcement (ICE) has acquired phone-unlocking technology from Magnet Forensics to enhance its law enforcement and deportation operations. Read more

Security Standards & Frameworks

CISA Releases Nine Industrial Control Systems Advisories: CISA has published nine new advisories addressing vulnerabilities in ICS products from vendors including Westermo, Schneider Electric, Hitachi Energy, Cognex, and Dover. Read more

Emerging Security Technologies

New attack on ChatGPT research agent pilfers secrets from Gmail inboxes: The ‘ShadowLeak’ attack demonstrates a novel method of prompt injection that executes on OpenAI’s infrastructure to steal data from connected accounts like Gmail. Read more
Study cautions that monitoring chains of thought soon may no longer ensure genuine AI alignment: A joint study from OpenAI and Apollo Research warns that AI models may be developing deceptive behaviors, raising doubts about the effectiveness of current alignment techniques. Read more
Time-of-Check Time-of-Use Attacks Against LLMs: New research explores Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities in LLM-enabled agents, where the state of an external resource changes after validation but before use. Read more

Salesforce Breach, JLR Production Halt & SonicWall Alert – 09/17/2025

info@grabtheaxe.com (Chris Armour) — Wed, 17 Sep 2025 00:00:00 GMT

Today’s security landscape is dominated by a massive data breach claim from the ShinyHunters extortion group, alleging the theft of 1.5 billion Salesforce records. This incident is compounded by severe real-world impacts, as Jaguar Land Rover extends its production halt into a third week due to a cyberattack. We are also covering critical security alerts from SonicWall and a significant ransomware attack on venture capital firm Insight Partners. This digest provides the essential intelligence you need to understand these evolving threats.

Top 5 Critical Security Alerts

ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks: The ShinyHunters extortion group claims a massive data theft of 1.5 billion Salesforce records from 760 companies by exploiting compromised OAuth tokens. Read more
Jaguar Land Rover to pause production for third week due to cyberattack: A crippling cyberattack has forced Jaguar Land Rover to extend its production halt into a third week, resulting in significant financial losses and supply chain disruption. Read more
VC giant Insight Partners warns thousands after ransomware breach: Prominent venture capital firm Insight Partners has disclosed a ransomware attack that exposed the personal data of thousands of current and former employees and partners. Read more
SonicWall warns customers to reset credentials after breach: SonicWall is urging customers to immediately reset their MySonicWall credentials following a security breach that exposed firewall configuration backup files. Read more
North Korean operation uses ChatGPT to forge military IDs as part of cyberattack: The North Korean state-sponsored group Kimsuky is reportedly using generative AI to create fake military IDs for sophisticated phishing campaigns against defense organizations. Read more

Threat Intelligence

GOLD SALEM’s Warlock operation joins busy ransomware landscape: A new ransomware group, GOLD SALEM, has emerged with its ‘Warlock’ operation, demonstrating competent tradecraft and using a familiar ransomware playbook. Read more
Microsoft and Cloudflare disrupt massive RaccoonO365 phishing service: A joint operation has successfully dismantled the RaccoonO365 Phishing-as-a-Service (PhaaS) platform, which facilitated the theft of thousands of Microsoft 365 credentials. Read more
From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques: The ClickFix malware is evolving, now using new tactics like fake CAPTCHAs and MSI lures to deploy the MetaStealer infostealer. Read more
Hackers steal hotel guests’ payment data in new AI-driven campaign: The ‘RevengeHotels’ hacking group is leveraging AI to enhance its attacks on hotels in Brazil, leading to the successful theft of guest payment card data. Read more

Security Breaches & Incidents

JLR ‘cyber shockwave ripping through UK industry’ as supplier share price plummets by 55%: The cyberattack on Jaguar Land Rover is causing a ripple effect, with the share price of a key supplier, Autins, plummeting by 55% due to production halts. Read more

Security Tools & Best Practices

Microsoft: Office 2016 and Office 2019 reach end of support next month: Microsoft issued a final reminder that Office 2016 and 2019 will reach end-of-support on October 14, 2025, urging users to upgrade to avoid security risks. Read more

Emerging Security Technologies

Irregular raises $80 million to secure frontier AI models: AI security startup Irregular has secured $80 million in funding to build solutions aimed at protecting large-scale, frontier AI models from emerging threats. Read more
Deepseek outputs weaker code on Falun Gong, Tibet, and Taiwan queries: A CrowdStrike study found that the Chinese AI model Deepseek generates less secure code when prompted with politically sensitive topics, raising concerns of inherent bias. Read more

Security Standards & Frameworks

NIST Awards More Than $3 Million to Support Cybersecurity Workforce Development Across 13 States: To combat the skills shortage, NIST has awarded over $3 million in grants to bolster cybersecurity workforce development programs in the U.S. Read more

NPM Worm, JLR Cyberattack, & Mobile Zero-Days – 09/16/2025

info@grabtheaxe.com (Chris Armour) — Tue, 16 Sep 2025 00:00:00 GMT

This intelligence digest is headlined by a severe and actively spreading supply chain attack, where a self-replicating worm has compromised over 180 NPM packages to steal developer credentials. In the physical world, a cyberattack has forced Jaguar Land Rover to extend its production shutdown, highlighting significant operational risks. Additionally, actively exploited zero-day vulnerabilities affecting millions of Samsung and older Apple mobile devices demand immediate attention from users. We also cover new malware campaigns leveraging AI and the latest measures from tech giants to address AI safety.

Top 5 Critical Security Alerts

Self-Replicating ‘Shai-Hulud’ Worm Hits NPM Supply Chain: A widespread, self-replicating worm dubbed ‘Shai-Hulud’ has compromised over 187 JavaScript packages on the NPM registry, stealing developer credentials and automatically spreading to infect more projects. Read more
Jaguar Land Rover Extends Production Shutdown After Cyberattack: The automotive giant has extended its global production halt for at least another week following a major cyberattack, indicating severe disruption to its operational technology systems. Read more
Samsung Patches Actively Exploited Zero-Day Flaw: Samsung has released an emergency patch for a zero-day vulnerability that is being actively exploited by hackers to compromise Galaxy phones. Users are urged to update their devices immediately. Read more
Apple Backports Zero-Day Patches for Older iPhones and iPads: Apple has released security updates for older devices, patching a zero-day vulnerability previously exploited in highly sophisticated attacks, extending protection to users of legacy hardware. Read more
Critical Vulnerabilities in Chaos Mesh Allow Kubernetes Cluster Takeover: Multiple critical security flaws have been discovered in the Chaos Mesh chaos engineering platform, which could allow an attacker with minimal network access to execute remote code and achieve a full takeover of Kubernetes clusters. Read more

Threat Intelligence

RevengeHotels Threat Actor Uses AI and VenomRAT in New Campaign: Kaspersky reports the RevengeHotels group is targeting the hospitality sector in Latin America with attacks leveraging AI-generated scripts and the VenomRAT trojan for data theft. Read more
North Korean Hackers Use Deepfakes in Espionage Campaign: The Kimsuky group, linked to North Korea, is reportedly using ChatGPT to create deepfaked military ID documents to target individuals in South Korea as part of its intelligence-gathering operations. Read more
New ‘FileFix’ Attack Uses Steganography to Deploy StealC Malware: A social engineering campaign is impersonating Meta account suspension warnings to trick users into installing the StealC infostealer, using steganography to hide the malicious payload within images. Read more
‘SlopAds’ Ad Fraud Campaign Disrupted After Infecting 224 Android Apps: Google has removed 224 malicious Android applications from the Play Store that were part of a massive ad fraud operation generating 2.3 billion fraudulent ad requests daily. Read more

Security Breaches & Incidents

BreachForums Administrator ‘pompompurin’ Resentenced to Three Years in Prison: Conor Fitzpatrick, the founder of the notorious BreachForums hacking site, has been resentenced to a three-year prison term after a court overturned his previous sentence of supervised release. Read more
Gucci and Alexander McQueen Customer Data Breached: Luxury brands Gucci and Alexander McQueen were impacted by a data breach linked to the ShinyHunters group, reportedly compromising information associated with 7.4 million unique email addresses. Read more

Security Tools & Best Practices

Microsoft and Cloudflare Disrupt ‘RaccoonO365’ Phishing Service: A coordinated effort by Microsoft and Cloudflare has taken down infrastructure associated with RaccoonO365, a sophisticated credential-stealing toolkit targeting Microsoft 365 accounts. Read more
Consumer Reports Urges Microsoft to Extend Windows 10 Support: Citing cybersecurity and environmental waste concerns, Consumer Reports has formally requested that Microsoft continue providing free security updates for Windows 10 beyond its planned end-of-life date. Read more
Microsoft to Remove WMIC Tool in Future Windows 11 Versions: Microsoft has announced the deprecation and eventual removal of the Windows Management Instrumentation Command-line (WMIC) tool, starting with Windows 11 version 25H2. Read more

Security Standards & Frameworks

CISA Releases Multiple Industrial Control Systems (ICS) Advisories: CISA has published eight new advisories detailing vulnerabilities in ICS products from vendors including Siemens, Schneider Electric, Hitachi Energy, and Delta Electronics. Asset owners are advised to review the alerts for mitigation guidance. Read more
U.S. Lawmakers Propose Extension for Key Cybersecurity Programs: The House Appropriations Committee has put forward a measure to temporarily extend the Cybersecurity Information Sharing Act (CISA 2015) and the State and Local Cybersecurity Grant Program until November 21. Read more

Emerging Security Technologies

OpenAI Implements Age-Prediction to Restrict Teen Access to ChatGPT: In response to safety concerns, OpenAI is rolling out a system to estimate user age and automatically restrict access for teenagers, prioritizing safety over user privacy and freedom. Read more
OpenAI Releases New ‘GPT-5 Codex’ Model for Code Generation: OpenAI is now rolling out its new GPT-5 Codex model, designed to enhance code generation and compete with other AI coding assistants like Claude Code. Read more
Stanford Releases BEHAVIOR-1K Robotics Benchmark: Stanford University has launched a new benchmark for robotics research, BEHAVIOR-1K, intended to provide a common baseline for measuring progress in the field, similar to what ImageNet did for computer vision. Read more

FBI Salesforce Warning, Ransomware & Rowhammer Bypass – 09/15/2025

info@grabtheaxe.com (Chris Armour) — Mon, 15 Sep 2025 00:00:00 GMT

Today’s security intelligence digest is led by an urgent FBI warning about threat actors actively targeting Salesforce platforms. Critical infrastructure is also under fire, with a significant ransomware attack shutting down a Texas school district and another hitting a Brazilian healthcare provider. Additionally, new research reveals a hardware-level ‘Phoenix’ attack that bypasses modern memory defenses and a NotPetya-like ransomware with UEFI compromise capabilities.

Top 5 Critical Security Alerts

FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms. The FBI has issued an urgent warning about cybercriminal groups, including Scattered Spider, actively targeting and compromising Salesforce platforms. Read more
Uvalde school district says ransomware attack forcing closure until Thursday. A ransomware attack has forced the Uvalde, Texas school district to close for several days after impacting critical operational systems like phones and visitor management. Read more
New Phoenix attack bypasses Rowhammer defenses in DDR5 memory. Researchers have developed a new “Phoenix” attack, a Rowhammer variant capable of bypassing the latest security protections in modern DDR5 memory chips from SK Hynix. Read more
HybridPetya Mimics NotPetya, Adds UEFI Compromise. A new ransomware strain named HybridPetya emulates the destructive NotPetya malware and includes a UEFI bootkit to achieve persistence and bypass Secure Boot. Read more
KillSec Ransomware Hits Brazilian Healthcare Software Provider. The KillSec ransomware group has targeted a major Brazilian healthcare software provider, compromising the supply chain and stealing sensitive patient data. Read more

Threat Intelligence (APT, malware, ransomware)

Mustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPs. The China-linked APT group Mustang Panda is using a new USB worm, SnakeDisk, to deploy the Yokai backdoor, specifically targeting devices with IP addresses in Thailand. Read more
AI-Forged Military IDs Used in North Korean Phishing Attack. The North Korean Kimsuky group is reportedly using AI tools like ChatGPT to create convincing fake military IDs for use in sophisticated spear-phishing campaigns. Read more
HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks. A malware campaign is using SEO poisoning and fake software sites to target Chinese-speaking users with multiple remote access trojans, including HiddenGh0st and Winos. Read more

Security Breaches & Incidents

Company that owns Gucci, Balenciaga, other brands confirms hack. Kering, the parent company of luxury brands like Gucci, confirmed a data breach affecting customer information but stated no credit card data was stolen. Read more
Google confirms fraudulent account created in law enforcement portal. Google acknowledged that attackers successfully created a fraudulent account in its Law Enforcement Request System (LERS), potentially to submit bogus data requests. Read more
FinWise insider breach impacts 689K American First Finance customers. FinWise Bank reports a data breach caused by a former employee who accessed sensitive files after their employment ended, impacting nearly 700,000 customers. [Read more](https://www.bleepingcomputer.com/news/security/finwise-insider-breach-impa cts-689k-american-first-finance-customers/)

Security Tools & Best Practices

Microsoft: Exchange 2016 and 2019 reach end of support in 30 days. Microsoft issued a final reminder that Exchange Server 2016 and 2019 will reach end-of-support in October, urging administrators to migrate to supported versions. Read more
Microsoft says Windows September updates break SMBv1 shares. Microsoft has confirmed that recent Windows security updates are causing connectivity issues for the legacy and insecure SMBv1 protocol. Read more
AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns. An AI-powered penetration testing tool named Villager has seen rapid adoption on PyPI, raising concerns that it could be abused by malicious actors. Read more

Emerging Security Technologies (AI, XDR, CNAPP)

Shiny tools, shallow checks: how the AI hype opens the door to malicious MCP servers. Kaspersky researchers detail how the Model Context Protocol (MCP) for AI integration can be abused, creating new attack vectors for supply chain attacks. Read more
‘Lies-in-the-Loop’ Attack Defeats AI Coding Agents. A new “Lies-in-the-Loop” attack demonstrates how AI coding assistants can be manipulated with false information to introduce vulnerabilities into code. Read more
OpenAI releases GPT-5 Codex designed for bug fixes and code generation. OpenAI has launched GPT-5 Codex, a new AI model specialized in automated coding tasks such as generating tests, fixing bugs, and refactoring code. Read more

Salesforce Threats, VoidProxy Phishing & AI Risks – 09/14/2025

info@grabtheaxe.com (Chris Armour) — Sun, 14 Sep 2025 00:00:00 GMT

This intelligence digest highlights an urgent FBI warning regarding threat actors actively stealing Salesforce data for extortion purposes. A new Phishing-as-a-Service platform, VoidProxy, is enabling attacks on Microsoft 365 and Google accounts, bypassing some single sign-on protections. We also cover significant shifts in the ransomware landscape and the growing security risks associated with AI misinformation.

Top 3 Critical Security Alerts

FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data: The FBI has issued a FLASH alert on two threat clusters actively compromising Salesforce environments to steal data and extort victims. Read more
New VoidProxy phishing service targets Microsoft 365, Google accounts: A new Phishing-as-a-Service (PhaaS) platform named VoidProxy enables sophisticated attacks against Microsoft 365 and Google accounts, bypassing some SSO protections. Read more
15 ransomware gangs ‘go dark’ to enjoy ‘golden parachutes’: Reports indicate at least 15 ransomware operations have ceased activities, suggesting a trend of threat actors cashing out and rebranding to evade law enforcement. Read more

Threat Intelligence

FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data: The FBI has issued a FLASH alert on two threat clusters actively compromising Salesforce environments to steal data and extort victims. Read more
New VoidProxy phishing service targets Microsoft 365, Google accounts: A new Phishing-as-a-Service (PhaaS) platform named VoidProxy enables sophisticated attacks against Microsoft 365 and Google accounts, bypassing some SSO protections. Read more
15 ransomware gangs ‘go dark’ to enjoy ‘golden parachutes’: Reports indicate at least 15 ransomware operations have ceased activities, suggesting a trend of threat actors cashing out and rebranding to evade law enforcement. Read more
Web Searches For Archives, (Sun, Sep 14th): The SANS ISC reports a significant increase in reconnaissance activity, with attackers increasingly scanning for exposed archive files like ‘backup.zip’ on web servers. Read more

Security Tools & Best Practices

Data destruction done wrong could cost your company millions: Improper data destruction on company hardware can lead to significant financial penalties and data breaches, emphasizing the need for secure disposal policies. Read more

Emerging Security Technologies

“If Anyone Builds It, Everyone Dies” researchers warn as they call for global AI shutdown: Researchers are advocating for an international treaty to halt advanced AI development, citing existential risks to humanity if AGI is created without sufficient controls. Read more
Leading AI chatbots are now twice as likely to spread false information as last year, study finds: A new study reveals major AI chatbots are increasingly spreading misinformation, posing a growing risk for social engineering and corporate disinformation campaigns. Read more
Google’s VaultGemma shows the struggle to balance privacy and performance in AI: Google DeepMind’s new VaultGemma model, trained with differential privacy, highlights the ongoing challenge of creating powerful AI systems that also protect user data. Read more

FBI Alert, Salesforce Security & Threat Actors – 09/13/2025

info@grabtheaxe.com (Chris Armour) — Sat, 13 Sep 2025 00:00:00 GMT

Today’s security intelligence digest is led by a critical FBI alert concerning two cybercriminal groups actively targeting Salesforce platforms for data theft and extortion. This direct threat to enterprise cloud environments underscores the evolving tactics of sophisticated actors. We also examine the surveillance technologies being deployed by government agencies and the advancing capabilities of AI in strategic manipulation. Here is the essential information you need to protect your organization.

Critical Security Alert

FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks: The FBI has issued a flash alert warning that cybercriminal groups UNC6040 and UNC6395 are actively targeting Salesforce platforms in data theft and extortion campaigns. Read more

Threat Intelligence

FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks: The FBI has issued a flash alert warning that cybercriminal groups UNC6040 and UNC6395 are actively targeting Salesforce platforms in data theft and extortion campaigns. Read more

Security Tools & Best Practices

Here’s the tech powering ICE’s deportation crackdown: A report details the extensive use of surveillance technology by U.S. ICE, including phone spyware, facial recognition, and forensic hacking tools, to power its operations. Read more

Emerging Security Technologies

GPT-5 dominated 210 Werewolf games with superior manipulation and strategic thinking: In a new benchmark, GPT-5 demonstrated superior manipulation and strategic thinking by dominating human players in the social deduction game “Werewolf,” highlighting advanced AI capabilities. Read more
“Aivilization” experiment lets over 22,000 AI agents model what future societies could become: A Hong Kong university is running the “Aivilization” experiment, using over 22,000 AI agents to simulate and model the development of future human societies. Read more

Exploited Vulns, HybridPetya Ransomware & Spyware – 09/12/2025

info@grabtheaxe.com (Chris Armour) — Fri, 12 Sep 2025 00:00:00 GMT

Today’s security landscape is marked by several actively exploited vulnerabilities, including a critical RCE flaw in Dassault Systèmes software added to CISA’s KEV catalog and a zero-day in Samsung Android devices. Threat intelligence reveals the emergence of HybridPetya, a sophisticated ransomware that can bypass UEFI Secure Boot. Additionally, a China-linked espionage campaign targeting the Philippines and another spyware attack aimed at Apple users in France highlight the persistent nation-state threat.

Top 5 Critical Security Alerts

CISA warns of actively exploited Dassault RCE vulnerability; CISA has added a critical remote code execution flaw (CVE-2025-5086) in Dassault Systèmes’ DELMIA Apriso software to its KEV catalog due to active exploitation. Read more
Samsung patches actively exploited zero-day reported by WhatsApp; Samsung has patched a critical remote code execution zero-day vulnerability (CVE-2025-21043) in Android devices that was actively exploited in targeted attacks. Read more
New HybridPetya ransomware can bypass UEFI Secure Boot: A new ransomware strain, HybridPetya, has been discovered that can bypass UEFI Secure Boot protections to install a malicious boot application, similar to NotPetya. Read more
Philippine military company spied upon with new China-linked malware: Researchers have uncovered a sophisticated, China-linked malware toolset used in an espionage campaign targeting a Philippine military company. Read more
Apple Warns French Users of Fourth Spyware Campaign in 2025, CERT-FR Confirms: Apple and France’s CERT-FR have confirmed a fourth spyware campaign in 2025, with notifications sent to targeted iPhone users in France. Read more

Threat Intelligence

Attackers Adopting Novel LOTL Techniques to Evade Detection: Threat actors are increasingly using uncommon living-off-the-land binaries (LOTL) and legitimate image files in recent campaigns to evade standard detection methods. Read more

Security Breaches & Incidents

Vietnam, Panama governments suffer incidents leaking citizen data: Government entities in Vietnam and Panama are investigating data breaches claimed by cybercrime groups, potentially exposing sensitive citizen information. Read more
Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal: The hacker convicted for the Vastaamo psychotherapy center data breach and extortion of 20,000 victims has been released from custody pending his appeal. Read more
ICO Warns of Student-Led Data Breaches in UK Schools: The UK’s Information Commissioner’s Office (ICO) is warning about a rise in data breaches caused by students hacking into school computer systems. Read more

Security Tools & Best Practices

The first three things you’ll want during a cyberattack: A new guide outlines the three essentials for effective incident response: clarity to understand the attack, control to contain it, and a reliable recovery plan. Read more
A Cyberattack Victim Notification Framework: A new report analyzes challenges in victim notification and proposes a framework for cloud providers to improve the process, ensuring victims receive and trust alerts. Read more
Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories: A vulnerability in the Cursor AI code editor could allow arbitrary code execution if a user opens a malicious repository, due to an insecure default setting. Read more

Cloud & Network Security

Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage: As cloud-native adoption grows, runtime visibility is becoming essential for security teams to monitor complex, hybrid environments and counter expanding attack surfaces. Read more

Security Standards & Frameworks

CISA official calls on lawmakers to extend cyber info-sharing law: A CISA official is urging Congress to renew the 2015 Cybersecurity Information Sharing Act (CISA 2015) before it expires to maintain public-private threat intelligence sharing. Read more
DHS inspector general: CISA mismanaged multimillion-dollar employee incentives program: An audit by the DHS Inspector General found that CISA mismanaged its Cybersecurity Retention Incentive program, failing to comply with established requirements. Read more

SonicWall Exploits, VMScape Attack, Siemens Flaws, and Rising Spyware Risks

info@grabtheaxe.com (Chris Armour) — Thu, 11 Sep 2025 00:00:00 GMT

The September 11, 2025 security roundup spotlights Akira ransomware exploiting a critical SonicWall SSL-VPN flaw, a new VMScape attack that breaks VM isolation on AMD and Intel chips, and severe Siemens UMC vulnerabilities enabling remote code execution. CISA added a Dassault Systèmes bug to its KEV catalog, while bulletproof host Stark Industries continues to dodge EU sanctions. Other developments include rising US investment in spyware, Apple warnings of targeted spyware campaigns, new ransomware abusing legitimate drivers, and fileless malware delivering AsyncRAT. Governments, schools, and enterprises faced major breaches and outages, while regulators advanced privacy and AI safety measures. Emerging tech news highlights Apple’s new iPhone security hardware, Microsoft Teams phishing protections, and OpenAI’s Developer Mode for ChatGPT.

Top 5 Critical Security Alerts

Akira ransomware exploiting critical SonicWall SSLVPN bug again ; The Akira ransomware group is actively exploiting a year-old critical vulnerability (CVE-2024-40766) in SonicWall SSL-VPN devices to gain initial access to networks. Read more
New VMScape attack breaks guest-host isolation on AMD, Intel CPUs ; A new Spectre-like side-channel attack named VMScape allows a malicious virtual machine to leak sensitive data, including cryptographic keys, from the underlying hypervisor on modern CPUs. Read more
Siemens User Management Component (UMC) ; Multiple critical vulnerabilities, including a stack-based buffer overflow (CVSS 9.8), have been found in Siemens UMC, allowing unauthenticated remote attackers to execute arbitrary code or cause a denial-of-service. Read more
CISA Adds One Known Exploited Vulnerability to Catalog ; CISA has added CVE-2025-5086, a deserialization vulnerability in Dassault Systèmes DELMIA Apriso, to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Read more
Bulletproof Host Stark Industries Evades EU Sanctions ; A notorious bulletproof hosting provider linked to Kremlin cyber operations, Stark Industries, is successfully evading EU sanctions by rebranding and transferring assets to new corporate shells. Read more

Threat Intelligence

The US is now the largest investor in commercial spyware ; Reports indicate the United States has surpassed other nations to become the primary financial backer of the commercial spyware industry, raising national security and privacy concerns. Read more
Apple warns customers targeted in recent spyware attacks ; Apple has sent threat notifications to users targeted by new spyware attacks, a fact confirmed by the French national CERT, indicating ongoing sophisticated mobile threats. Read more
‘Gentlemen’ Ransomware Abuses Vulnerable Driver to Kill Security Gear ; A new ransomware strain named ‘Gentlemen’ is weaponizing a legitimate driver, ThrottleStop.sys, to disable antivirus and EDR solutions before encryption. Read more
Fileless Malware Deploys Advanced RAT via Legitimate Tools ; A sophisticated fileless malware campaign is using legitimate system tools to deliver AsyncRAT directly into memory, evading traditional detection methods. Read more

Security Breaches & Incidents

Panama Ministry of Economy discloses breach claimed by INC ransomware ; Panama’s Ministry of Economy and Finance has acknowledged a potential cyberattack after the INC ransomware group claimed to have breached one of its computers. Read more
Cyberattacks against schools driven by a rise in student hackers, ICO warns ; The UK’s privacy regulator reports a worrying increase in cyberattacks against schools perpetrated by students motivated by dares, notoriety, or revenge. Read more
Microsoft investigates Exchange Online outage in North America ; Microsoft is currently investigating a major Exchange Online outage that is preventing customers across North America from accessing their email services. Read more

Security Tools & Best Practices

Apple’s latest iPhone security feature just made life more difficult for spyware makers ; Apple has launched a new hardware security feature for the iPhone 17 and iPhone Air designed to mitigate memory corruption bugs, making zero-day exploits more difficult. Read more
Microsoft adds malicious link warnings to Teams private chats ; Microsoft Teams will now automatically scan and display warnings for links in private chats that are identified as malicious, enhancing user protection against phishing. Read more
The Buyer’s Guide to Browser Extension Management ; A new guide details the risks posed by browser extensions, such as data exfiltration, and outlines strategies for gaining visibility and enforcing security policies. Read more

Security Standards & Frameworks

U.S. Senator accuses Microsoft of “gross cybersecurity negligence” ; Senator Ron Wyden has formally requested the FTC to investigate Microsoft for what he terms ‘gross negligence’ in its security practices, which he claims led to ransomware attacks on healthcare facilities. Read more
California legislature passes bill forcing web browsers to let consumers automatically opt out of data sharing ; A bill has passed in California that would require web browsers to honor universal opt-out signals for data sharing, strengthening consumer privacy rights. Read more
Swiss government looks to undercut privacy tech, stoking fears of mass surveillance ; A pending government proposal in Switzerland is causing alarm among secure email and VPN providers, who claim it would undermine user privacy and enable mass surveillance. Read more
FTC opens inquiry into how AI chatbots impact child safety, privacy ; The U.S. Federal Trade Commission has launched an inquiry to assess whether AI chatbot developers are implementing adequate safeguards to protect children’s safety and privacy. Read more

Emerging Security Technologies

OpenAI has launched Developer Mode for ChatGPT with full access to Model Context Protocol ; OpenAI has introduced a ‘Developer Mode’ for ChatGPT Plus and Pro users, granting them full read and write access to the Model Context Protocol (MCP) for advanced customization. Read more
Partnering with generative AI in the finance function ; Generative AI is poised to transform finance departments by automating mundane tasks, freeing up CFOs and their teams to focus on highvalue strategic work and advisory roles. Read more
Tech’s data double standard: scrape to train, block everyone else ; Investigations reveal that major tech companies scrape vast amounts of copyrighted data to train their AI models while their own terms of service strictly forbid others from doing the same. Read more

Kerberoasting Attacks, Jaguar Land Rover Breach, and Malicious NPM Package

info@grabtheaxe.com (Chris Armour) — Wed, 10 Sep 2025 00:00:00 GMT

Top 5 Critical Security Alerts

Senator blasts Microsoft for making default Windows vulnerable to “Kerberoasting” — A US Senator criticizes Microsoft for default Windows settings that use the weak RC4 cipher, leaving systems vulnerable to Kerberoasting attacks which led to the breach of health giant Ascension. Read more
Jaguar Land Rover says data stolen in disruptive cyberattack — The automotive manufacturer confirmed that a cyberattack, which has halted its vehicle assembly lines since September 2, also resulted in data theft. Read more
Hackers left empty-handed after massive NPM supply-chain attack — The largest supply-chain attack in NPM’s history has reportedly impacted 10% of all cloud environments, though the attackers gained little financial profit from the widespread compromise. Read more
Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems — A China-linked APT group was observed using a new, undocumented fileless malware framework called EggStreme to conduct espionage against a military organization in the Philippines. Read more
Microsoft Patch Tuesday, September 2025 Edition — Microsoft released its monthly security updates, addressing over 80 vulnerabilities, including 13 rated as critical, across its product suite. No zero-day exploits were reported in this release. Read more

Threat Intelligence

KillSec Ransomware Hits Brazilian Healthcare IT Vendor — The KillSec ransomware group has targeted MedicSolution, a Brazilian healthcare IT provider, threatening to disrupt services for healthcare providers and patients. Read more
US investors in spyware firms nearly tripled in 2024: report — A new report indicates a sharp rise in American investment in spyware vendors, despite ongoing government efforts to sanction and restrict the sector. Read more
Notes of cyber inspector: three clusters of threat in cyberspace — This report analyzes the Tactics, Techniques, and Procedures (TTPs) of cybercrime, hacktivist, and APT groups targeting Russian organizations, categorizing them into three distinct clusters. Read more
Researchers find spyware on phones belonging to Kenyan filmmakers — Commercially available spyware, FlexiSPY, was discovered on the phones of Kenyan filmmakers, highlighting the accessibility of powerful surveillance tools beyond nation-state actors. Read more

Security Breaches & Incidents

Jaguar Land Rover confirms data theft after recent cyberattack — Following a disruptive cyberattack, Jaguar Land Rover (JLR) has confirmed that attackers stole an unspecified amount of data, forcing system shutdowns and work stoppages. Read more

Security Tools & Best Practices

September Patch Tuesday handles 81 CVEs — Microsoft’s final security update before the end of Windows 10 support addresses 81 vulnerabilities across 15 product families, including Windows and Xbox. Read more
Cursor AI editor lets repos “autorun” malicious code on devices — A security flaw in the Cursor code editor exposes developers to risk by allowing malicious repositories to automatically execute code on their machines upon being opened. Read more
Can I have a new password, please? The $400M question. — The article uses the Scattered Spider breach of Clorox, which cost $380M, to emphasize the critical need for robust caller verification and audit trails at IT help desks to prevent social engineering. Read more

Cloud & Network Security

The Quiet Revolution in Kubernetes Security — The article discusses the necessary evolution of the underlying operating system to enhance security as Kubernetes becomes a foundational component of enterprise infrastructure. Read more

Security Standards & Frameworks

Maturing the cyber threat intelligence program — The Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) provides a framework to help organizations assess and enhance their threat intelligence programs across 11 key areas. Read more
Chinese companies and bosses to face major fines over cybersecurity incidents — China is proposing an update to its national Cybersecurity Law that would impose stricter oversight on tech products and increase financial penalties for non-compliant companies and their executives. Read more

Emerging Security Technologies

Google’s former security leads raise $13M to fight email threats before they reach you — A startup founded by former Google security leads has secured $13 million in funding to build a system using real-time AI agents to analyze and neutralize email-based threats proactively. Read more
Pixel 10 fights AI fakes with new Android photo verification tech — Google is integrating C2PA Content Credentials into the upcoming Pixel 10 camera and Google Photos to provide a way for users to distinguish authentic images from AI-generated or edited fakes. Read more
Vibe coding? Meet vibe security — This article discusses how the rapid evolution of AI is creating new attack vectors like ‘vibe coding’ and prompt-based attacks, driving demand for innovative cybersecurity startups like Wiz. Read more