Cybercrime
FBI and Google Disrupt NetNut Residential-Proxy Network Spanning Two Million Devices
A scale-significant proxy-network takedown — law-enforcement coverage and defender awareness this week.
Threat Intelligence
Google Threat Intelligence Group Details Continued Disruption of Malicious Residential-Proxy Networks
Vendor-driven proxy-network disruption continues — defender teams review perimeter-detection posture this week.
Ransomware
FortiBleed-Linked Actors Reportedly Collaborating With INC and Lynx Ransomware Operations
Threat-cluster convergence between FortiBleed and two ransomware families — defender teams stay in credential-verification posture this week.
Threat Intelligence
Kaspersky Details Umbrij, a New ToddyCat Tool Targeting Corporate Gmail via OAuth Tokens
An APT-tooling disclosure with corporate-Gmail implications — defender teams review OAuth-token hygiene this week.
Phishing
Microsoft and Trend Micro Document Blockchain-Abuse Phishing Against EU and Asia Hospitality
Two vendor-documented hospitality-sector phishing campaigns land the same week — sector-advisory work for hotel-industry defenders this week.
Microsoft 365
Huntress Documents 81M+ Azure CLI Password-Spray Attempts Against 78 Microsoft Accounts
A scale-significant Azure CLI credential-attack campaign — defender teams stay in account-hardening posture this week.
Data Breaches
Nissan Oracle PeopleSoft Campaign Reportedly Targeted 100 Organizations
One confirmed victim, a reported 99 more not yet named — Oracle PeopleSoft customers stay in patch-verification posture this week.
Vulnerabilities
SimpleHelp CVE-2026-48558 Exploited to Deliver TaskWeaver and Djinn Stealer
A critical remote monitoring and management vulnerability is under active exploitation to deliver an infostealer that hunts cloud and AI development credentials — and it is now on CISA's KEV list.
Threat Intelligence
Microsoft Removes 119 Edge Extensions That Hid Malicious Content in Images and Fonts
Browser-extension enforcement action at scale from Microsoft. The company pulled 119 Edge add-ons that concealed payloads inside image and font files, with a combined install base reported at up to 2.6 million, and suspended the developer accounts behind them.
Supply Chain Attack
Researchers Disclose "Miasma" Supply-Chain Wave Across 20+ npm Packages and GitHub Actions
Another JavaScript-ecosystem supply-chain disclosure puts developer-secret rotation and GitHub Actions auditing back at the top of the defender to-do list — this time as a fresh wave of the ongoing Miasma cluster.
Nation-State Cyber Threats
Google Publishes Analysis of Turla's New STOCKSTAY Backdoor in Ukraine Espionage
Another Russia-linked backdoor lands on defenders' desks for review. Google Threat Intelligence Group and Mandiant have detailed STOCKSTAY, a .NET implant Turla has deployed against Ukrainian government and military networks since at least 2022.
Cybercrime
Operation Endgame Coordinators Describe Multi-Year "Assembly Line" Disruption
A retrospective frame on the most consequential law-enforcement effort against cybercrime infrastructure, as Operation Endgame's coordinators recast a string of 2026 takedowns as one sustained assault on the criminal supply chain.