Threat Library

Levi Strauss & Co. disclosed that attackers used social engineering tactics against three employees to gain unauthorized access to corporate data stored on their machines. The incident resulted in the theft of corporate information, though full scope of the compromised data has not been publicly detailed. This represents a targeted human-layer attack rather than a technical exploit of infrastructure.

Johnson Controls TL280 camera devices running firmware versions below 5.63 contain a vulnerability involving use of a broken or risky cryptographic algorithm, tracked as CVE-2026-27871, which stems from hardcoded credentials embedded in the firmware. Successful exploitation could allow an attacker to access sensitive information on the device, though the attack requires high complexity and privileges. Johnson Controls has released firmware 5.63 to remediate the issue and recommends network segmentation and credential rotation as mitigations.

A heap out-of-bounds write vulnerability (CVE-2026-17264) affects Medixant RadiAnt DICOM Viewer versions 2025.2 and earlier, triggered by opening a maliciously crafted DICOM file with malformed JPEG-compressed pixel data. Successful exploitation could crash the application or potentially allow remote code execution, though built-in exploit mitigations (CFG, DEP, ASLR) reduce practical exploitability. No known public exploitation has been reported to date.

OpenAI disrupted a Cambodia-based scam network operating out of Poipet that used coordinated ChatGPT accounts to generate content for investment fraud, romance scams, illegal gambling promotion, and law enforcement impersonation schemes. The operation leveraged generative AI to scale social engineering content creation and craft convincing fraudulent communications targeting victims across multiple scam categories. OpenAI banned the associated accounts as part of its abuse enforcement efforts.

Google released three Chrome updates (versions 149, 150, and 151) fixing a cumulative total of 1,442 security bugs, far exceeding the combined total of the previous 23 releases. This represents a significant spike in disclosed vulnerabilities, largely attributed to internal discovery efforts rather than active exploitation reports.

Watchfire Controller Software used in digital billboard/LED sign controllers (BC550, BC750, BC760, BC760DC) contains hard-coded, self-signed RSA private keys and X.509 certificates embedded in plaintext firmware patch binaries. Successful exploitation could allow an attacker to intercept or spoof HTTPS/TLS connections to the web management interface and deliver malicious firmware to gain full control of the controller. Watchfire has released patched firmware versions to remediate the issue.

Researchers at Bitsight identified an operation dubbed Fuyao in which cheap Android TV boxes ship with pre-installed apps that spoof device identifiers to impersonate Samsung, Huawei, Xiaomi, or Vivo smartphones, enabling large-scale ad fraud. The same devices are also weaponized to covertly route third-party traffic through owners' home broadband connections, effectively turning them into residential proxy nodes. The operation has been attributed to Zhejiang Fengwo IoT Technology Co., Ltd., a China-based manufacturer.

A wave of malicious actors have been adopting abandoned or orphaned Arch User Repository (AUR) packages and inserting malware into them, prompting Arch Linux to temporarily disable the package adoption feature. This supply-chain attack vector allows attackers to compromise trusted package names that users and automated systems may install without deep scrutiny.

A session-management flaw in MikroTik RouterOS's API allows authenticated users whose permissions have been downgraded to retain their prior access levels, since sessions are not properly invalidated after permission changes or inactivity timeouts. The advisory description also notes a more severe potential consequence: low-privilege API access could be leveraged to extract a router's WireGuard private key in plaintext, enabling full VPN impersonation and decryption of associated traffic. No public exploitation has been reported at this time.

A use-after-free vulnerability has been identified in Apache Traffic Server's intercept plugin functionality, affecting multiple major version branches from 8.0.0 through 10.1.3. The flaw could lead to denial of service or potentially further memory corruption impacts on affected proxy deployments. Patches are available in versions 9.2.15 and 10.1.4.

A widespread analysis of low-cost generic Android TV streaming boxes reveals they covertly enroll users' home internet connections into residential proxy networks and simulate mobile device behavior to commit large-scale ad fraud on AI-generated websites. This scheme defrauds advertisers and online merchants while exposing consumers' networks to third-party abuse without their knowledge or consent.

This is a weekly aggregated security digest covering multiple unrelated stories, including a large batch of Chrome vulnerabilities, ongoing SonicWall device attacks, DNS hijacking incidents, and emerging AI-assisted hacking techniques. The report lacks specific technical depth on any single threat, functioning instead as a curated summary of the week's security news. Organizations should treat this as an index pointing to underlying incidents that require individual investigation rather than a single actionable threat.

South Korea's Personal Information Protection Commission fined KT Corporation KRW 53.979 billion ($39 million) for data protection violations related to a customer data breach. The incident highlights regulatory scrutiny of telecom operators' handling of subscriber personal information and inadequate security controls.

Anthropic experienced a worldwide service disruption affecting Claude and its underlying API, causing requests to fail with '529 Overloaded' errors. This is an availability incident rather than a malicious attack, but it disrupts any downstream applications, agents, or tools that depend on Claude's API for inference.

Tengu is a newly identified Mirai-derived Linux botnet that abuses hardware watchdog timers to force device reboots when its main process is killed, allowing persistence mechanisms to relaunch it. It spreads via Telnet credential brute-forcing and supports 25 DDoS attack methods, posing a risk to internet-facing Linux and IoT devices with weak credentials.

Anthropic reports that its Claude Mythos Preview model assisted researchers in deriving a full key-recovery attack against the post-quantum signature scheme HAWK-256 and a substantially faster attack against 7-round AES-128. This is a research disclosure demonstrating AI-accelerated cryptanalysis rather than an active exploit, but it signals growing capability for AI-assisted discovery of cryptographic weaknesses that could erode confidence in specific PQC candidates and reduced-round symmetric ciphers.

Microsoft confirmed that a bug in its automated network maintenance request system caused a widespread outage affecting Microsoft 365 and Azure services. The bug erroneously removed IP routes from more network devices than intended, disrupting connectivity and service availability. This was a self-inflicted operational failure, not the result of a cyberattack or malicious activity.

SourTrade is a malvertising campaign active since late 2024 that impersonates trusted brands like TradingView, Solana, and Luno to lure retail traders and crypto investors. It uniquely constructs its malicious Windows executable client-side, in the victim's browser, using a legitimate Bun JavaScript runtime as its base, avoiding detection by never serving a single complete malicious binary from a static URL.

Threat actors are leveraging email addresses and personal data leaked by the ShinyHunters extortion group to send mass sextortion emails demanding $2,000 in Bitcoin. The scam uses previously breached data to add false credibility, threatening victims with fake claims of compromising webcam footage or browsing history unless payment is made.

Threat actors are posting fake troubleshooting guides on Steam discussion forums that use the ClickFix social engineering technique to trick gamers into executing malicious commands via the Windows Run dialog. These commands ultimately deploy XMRig cryptominers on victim machines, hijacking system resources for cryptocurrency mining.