All news in category “Incidents and Data Breaches”

🔎 TRM Labs investigators say a 2022 data breach at LastPass enabled sustained thefts that drained millions in cryptocurrency from user wallets over several years. The firm traced approximately $28m stolen from 2024 to early 2025 and a further $7m in September 2025, with funds routed to Russian exchanges and money‑laundering services. Using proprietary demixing techniques, analysts were able to correlate CoinJoin‑mixed transactions to withdrawal clusters tied to Russia‑based infrastructure. The report underscores the long‑tail risk from exposed password vault backups and reiterates the need for MFA and prompt password changes.

🔒 ShinyHunters claims it gained full access to cybersecurity firm Resecurity, publishing Telegram screenshots that allegedly show employee records, internal chats, threat intelligence reports, and client data. Resecurity disputes the account, saying the accessed environment was an isolated honeypot populated with synthetic datasets after researchers detected probes in November 2025. The firm reports the actor generated automated exfiltration activity between December 12–24, collected telemetry on proxy infrastructure and tactics, and shared intelligence with law enforcement while the attacker promises to release more evidence.

🛡️ Threat actors claiming to be the "Scattered Lapsus$ Hunters" published screenshots saying they accessed Resecurity systems and stole employee data, internal communications, threat reports, and client lists. Resecurity disputes the claim, saying the exposed account was a monitored honeypot populated with synthetic datasets to observe attacker behavior. The firm says it collected telemetry, observed OPSEC failures, and shared intelligence with law enforcement.

🚨 Covenant Health disclosed that a May intrusion exposed sensitive patient data for 478,188 individuals after a broader analysis revised the initial July estimate of 7,864. The organization says the breach occurred on May 18 and was discovered on May 26; the ransomware group Qilin later claimed responsibility and said 852 GB of data was taken. Exposed elements may include names, addresses, dates of birth, Social Security numbers, medical record and insurance details, and treatment information. Covenant Health engaged third‑party forensics, reports ongoing review, has strengthened security, and is offering affected patients 12 months of free identity protection.

🔒 Blockchain investigator TRM Labs says a series of cryptocurrency thefts were traced back to the 2022 LastPass breach, where encrypted vault backups containing private keys and seed phrases were stolen. Attackers appear to have slowly decrypted vaults for users with weak or reused master passwords, draining wallets in waves months or years later. TRM also reported that stolen funds were converted to Bitcoin and laundered through Wasabi Wallet CoinJoin mixes before cash‑out via Russian-linked exchanges.

🛡️ Synthient and other researchers describe the explosive growth of the Kimwolf botnet, which has infected more than two million devices globally, concentrated in Vietnam, Brazil, India, Saudi Arabia, Russia and the United States. Kimwolf abuses residential proxy services — notably China-based IPIDEA — to tunnel back into home networks and compromise devices such as unofficial Android TV boxes and digital photo frames. The malware leverages weak proxy DNS handling and factory-enabled Android Debug Bridge (ADB) to gain unauthenticated administrative access, then installs proxy and DDoS-capable payloads. Researchers advise removing suspect TV boxes, isolating guests on a Guest Wi‑Fi network, and preferring reputable brands to reduce exposure.

🔐Trust Wallet attributes a December 24 compromise of its Chrome extension to activity tied to the Sha1‑Hulud campaign after attackers added malicious JavaScript to version 2.68. The injected code harvested sensitive wallet data and enabled unauthorized transactions, resulting in roughly $8.5 million stolen from over 2,500 wallets. Exposed GitHub developer secrets revealed a Chrome Web Store API key that let the attacker publish a trojanized build. Trust Wallet revoked release APIs, had malicious domains suspended, and has begun reimbursing victims while warning of impersonation scams.

🛡️ Transparent Tribe (APT36) has launched a spear-phishing campaign delivering a memory‑resident RAT that grants persistent remote control of compromised hosts. The attack chain leverages weaponized .LNK shortcuts that execute obfuscated HTA scripts via mshta.exe, decrypt payloads into memory, and present decoy PDFs to evade detection. The malware adapts persistence to detected antiviruses and drops a DLL, iinneldc.dll, which supports remote command execution, file exfiltration, screenshot capture, clipboard manipulation, and process control.

🔒 Two cybersecurity professionals, Ryan Goldberg and Kevin Martin, pleaded guilty to conspiring to obstruct, delay, or affect commerce through extortion for their roles in deploying the BlackCat (ALPHV) ransomware against multiple U.S. companies between April and December 2023. They admitted identifying and targeting victims while leveraging ransomware-as-a-service rather than developing the malware themselves, and reached plea agreements in December 2025 that were accepted by the Southern District of Florida. The attacks were tied to more than $9.5 million in losses, though authorities traced roughly $324,123.26 in proceeds to the defendants; both face up to 20 years in prison.

👁 Flock’s exposed livestreams show that its AI-enabled Condor pan-tilt-zoom (PTZ) cameras can automatically zoom in on and track people in public spaces. Reporters observed high-resolution footage capturing individuals on bike paths, in parking lots, at playgrounds, and at stoplights, with cameras following faces and recording close-up detail. These exposures underscore privacy and security risks from networked AI surveillance and inadequate access controls.

📧 Check Point disclosed a large-scale phishing campaign that abused Google Cloud Application Integration to send authentic-looking messages from noreply-application-integration@google[.]com, enabling attackers to bypass SPF and DMARC protections. The emails mimicked routine enterprise notifications to prompt clicks and redirected victims through Google Cloud storage to a fake CAPTCHA and a counterfeit Microsoft login page. Google has blocked the abuse and is implementing further mitigations.

🔍 The ThreatsDay bulletin opens 2026 with a cross-section of active campaigns and emerging tactics that emphasize stealth, precision, and financial motive. Highlights include the GhostAd Android adware drain, macOS supply-chain trojans tied to Open VSX extensions, a large non-KYC proxy network (IPCola), and multiple cloud and contract-exploit incidents. The roundup also details arrests, regulatory action, and evolving Magecart and click-fraud toolkits that collectively signal a shift toward low-noise, high-return operations.

🚨 The fourth wave of the GlassWorm campaign is targeting macOS developers by distributing malicious VS Code/OpenVSX extensions that deliver trojanized cryptocurrency wallet applications. The extensions embed an AES-256-CBC-encrypted payload in compiled JavaScript, execute after a 15-minute delay using AppleScript, and persist via LaunchAgents. The malware harvests developer credentials, browser and Keychain data, supports VNC and SOCKS proxying, and includes a mechanism to replace Ledger Live and Trezor Suite with trojanized versions. Users should remove the identified extensions, reset credentials, revoke tokens, and inspect or reinstall affected macOS systems.

🔒 CloudSEK researchers disclosed a nine‑month campaign that has recruited IoT devices and web servers into the RondoDox botnet by exploiting the critical React2Shell flaw (CVE‑2025‑55182). Actors moved from manual scanning to hourly automated deployments, dropping cryptocurrency miners, a loader/health checker and a Mirai variant. The loader (/nuts/bolts) kills competing malware, enforces persistence and fetches the main bot. Organizations should patch Next.js, segment IoT, deploy WAFs and monitor for suspicious processes.

🔒 Trust Wallet disclosed that a second wave of the Shai‑Hulud supply chain attack exposed developer GitHub secrets, including a Chrome Web Store API key, enabling attackers to upload a trojanized extension build directly. The malicious update (v2.68) pushed a backdoor that harvested wallet mnemonic phrases to a domain registered as metrics-trustwallet[.]com, leading to the theft of about $8.5 million from 2,520 addresses. Trust Wallet urged users to update to v2.69, launched a reimbursement claim process, and said it has implemented additional monitoring and controls to strengthen its release procedures.

🔍 Koi Security links three coordinated browser-extension campaigns — ShadyPanda, GhostPoster, and DarkSpectre — to a Chinese threat actor that collectively compromised millions of users across Chrome, Edge, Opera, and Firefox. The attacks combine affiliate-link hijacking, ad and click fraud, time-delayed logic bombs, and a targeted Zoom Stealer component that exfiltrates meeting links, credentials, and participant data. Many add-ons behaved legitimately for years before being weaponized via malicious updates.

🔓 The decentralized IP platform Unleash Protocol suffered an unauthorized contract upgrade after an external address gained administrative signing power in its multisig governance, enabling withdrawals. The attacker drained roughly $3.9 million in WIP, USDC, WETH, stIP, and vIP, then bridged funds and deposited 1,337 ETH into Tornado Cash. Unleash has paused operations and engaged external security experts; users should avoid interacting with contracts until the team confirms it is safe.

🔥 The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to compromise vulnerable Next.js servers and deploy malware, including coinminers and Mirai-like components. CloudSEK reports scanning began on December 8 with active deployments starting December 11, and Shadowserver counts over 94,000 exposed assets. The botnet also conducts hourly IoT exploitation waves to enroll routers and uses loaders that remove competing malware and enforce persistence.

🔎 Cybersecurity researchers have identified a modified strain of the Shai Hulud npm worm inside the package "@vietmoney/react-big-calendar," updated on December 28, 2025. Aikido and researcher Charlie Eriksen say the code appears obfuscated and likely derived from the original worm source rather than a simple copy. The variant changes filenames and GitHub leakage descriptors, improves error handling and OS-aware publishing, and so far shows limited spread, suggesting the payload may be in testing.

🔒 The European Space Agency (ESA) confirmed a cybersecurity incident affecting a small number of servers located outside its corporate network that supported unclassified collaborative engineering activities. Threat actors claim they accessed JIRA and Bitbucket instances for about a week and exfiltrated over 200GB of data, including source code, CI/CD pipelines, tokens, and configuration files. ESA has initiated forensic analysis, notified relevant stakeholders, and implemented measures to secure potentially affected devices while the investigation continues.