Your browser may not be as helpful as it looks… |
From AI add-ons quietly siphoning data to CRM systems spilling millions of records — and ransomware accelerating behind the scenes — trusted tools are becoming prime attack paths.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
260K Chrome Users Hit by Fake AI Extensions |
More than 260,000 Chrome users installed seemingly legitimate AI productivity extensions that secretly funneled browser data to attacker-controlled servers.
LayerX identified 30 lookalike extensions built on a shared “AiFrame” architecture that loaded remote iframes mimicking tools like ChatGPT and Claude, intercepting API keys, email content, and session data in real time. |
The campaign is still active in the wild.
Enforce an enterprise browser extension allowlist, block high-risk permissions like <all_urls>, and continuously monitor telemetry and DNS egress for signs of DOM scraping or unauthorized data exfiltration.
|
500K VK Users Hit by Stealthy Browser Malware |
More than 500,000 VKontakte accounts were covertly hijacked by Chrome extensions marketed as harmless interface customization tools.
Koi found the extensions delivered multi-stage malware that forced users into attacker-controlled groups, reset settings every 30 days, and manipulated VK’s CSRF protections to legitimize unauthorized API calls. The campaign remains active in the wild.
Implement an enterprise browser extension allowlist, disable sideloading, and continuously monitor for abnormal API calls, token manipulation, and dynamic payload retrieval from trusted platforms like GitHub. |
Odido Breach Exposes 6.2M Customer Records |
An attack against Dutch telecom provider Odido led to unauthorized access to a customer contact database affecting approximately 6.2 million individuals. Odido’s CRM system was breached and personal data extracted, including names, addresses, IBANs, dates of birth, and government ID numbers. Odido is continuing its investigation of the incident and has begun breach notification to those impacted.
Enforce least-privilege CRM access with bulk export approvals, segment customer data systems, and continuously monitor for anomalous query volume or off-hours data access to catch silent exfiltration early. |
|
|
If attackers accessed your customer database today… |
|
|
Yesterday's Pulse Check Results |
If your team’s using public LLMs today… |
|
|
Security Tools You Can Use |
|
|
1,800 IIS Servers Compromised by BADIIS Malware |
Over 1,800 Windows IIS servers have been covertly compromised by BADIIS malware in a global SEO poisoning campaign.
Rather than deploying ransomware or stealing data, attackers embedded a malicious IIS module into the worker process to inspect HTTP traffic and inject spam links when search engine crawlers are detected. |
This is an ongoing issue in the wild. Audit IIS modules for unauthorized components, enforce application allowlisting, and monitor worker processes and outbound traffic for anomalous DLL loads or SEO-style content injection. |
2,000 Ransomware Attacks Reported in Three Months
|
Ransomware groups claimed over 2,000 attacks in the final three months of 2025, contributing to a 52% annual surge to 6,604 incidents worldwide. Monthly attacks have surged from under 200 in early 2023 to nearly 700, with supply chain breaches nearly doubling and expanding downstream impact. Researchers say 2026 is already matching that pace, signaling ransomware operations are scaling, professionalizing, and increasingly exploiting trusted partner ecosystems.
Patch internet-facing systems, segment critical assets, and continuously validate third-party access paths to reduce supply chain blast radius.
|
|
|
Could Your IIS Server Be an Easy Target? |
IIS servers remain a prime target for web shells, SEO poisoning, and stealthy persistence techniques that embed directly into trusted worker processes. As attackers increasingly abuse legitimate server modules to evade detection, proactive IIS hardening is important for reducing blast radius. |
How to harden your Microsoft IIS servers: |
-
Reduce the attack surface by removing unnecessary IIS modules, enforcing application allowlisting, keeping Windows Server and IIS fully patched, and using exposure management tools to continuously identify misconfigurations and unpatched assets.
-
Protect integrity and detect persistence by enabling file integrity monitoring and alerting on unauthorized configuration changes or suspicious DLL loads.
-
Secure administrative pathways by applying MFA, least privilege, just-in-time access, and monitoring IIS worker processes for abnormal outbound connections or HTTP behavior.
|
IIS hardening requires continuous configuration management, strong access controls, and ongoing monitoring to reduce exposure. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
