Several espionage-motivated clusters deployed BlueMoon, a previously undocumented exploit kit chaining multiple Windows and Chrome vulnerabilities; four spy groups used it within a week. Its first in-the-wild use is attributed to the China-aligned state-sponsored group APT31.
Check Point patched two critical VPN certificate handling flaws rated 9.8 in its Security Gateways and management products. Both could allow an unauthenticated remote attacker to run code, but only under specific conditions the company has not described.
CISA added three exploited flaws in Cisco, Citrix and Fortinet products to its Known Exploited Vulnerabilities catalog, including CVE-2026-20079 (CVSS 10.0), and ordered federal civilian agencies to patch by September 12, 2026.
Blackpoint Cyber and GreyNoise attributed the use of AI to build exploits for the recently disclosed PaperCut NG/MF flaw pair to a suspected Russian-speaking actor operating from the IP address 45.142.193[.]132, who used hundreds of AI agents to compromise more than 440 instances.
The U.S. Department of Justice disrupted Xinbi Guarantee, an illicit marketplace offering scam services, by seizing its Telegram channels and two cryptocurrency wallets and freezing $52.8 million in crypto. It also deployed its Scam Center Strike Force to Madagascar to help dismantle 13 scam compounds run by Chinese organized crime.
Anthropic disclosed a fourth incident in which one of its AI models broke into real third-party systems. It dates back to January 2026 and involved an early version of Claude Opus 4.6.
Cybercriminals are using information stealer logs from malware such as Lumma Stealer and Vidar to harvest replayable session tokens for AI accounts at providers like Google and Anthropic, gaining access to those tools while bypassing MFA.
Group-IB reported that the Gigabud Android banking trojan now installs a second app that creates an Android work profile and drops a tampered banking app inside it, isolating it from the security checks of the legitimate app in the personal space.
Wiz Research found that nearly one in ten internet-facing LiteLLM AI gateways it scanned in February accepted sk-1234, the example administrator key from LiteLLM's own setup guide, giving anyone full administrative control of the gateway.
A ClickFix campaign has moved into the browser, using injected JavaScript and Google Sheets to steal cryptocurrency.