The attacks never slow down. |
Today's news includes SonicWall flaws under active attack, fake GitHub repos spreading infostealers, and a cyber fraud operation that moved millions before authorities shut it down.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Spanish Police Bust €140M Cyber Fraud Ring |
Spanish authorities, with support from Europol and Interpol, dismantled a €140 million cybercrime and money-laundering network tied to investment fraud. Investigators say the group used hundreds of accounts and money mules to launder funds from CEO fraud and fake invoice scams. |
The operation also resulted in the seizure of computers, smartphones, and the freezing of €3 million for potential victim restitution.
Verify payment change requests through a secondary communication channel, enforce multi-person approval for high-value transfers, and train employees to recognize executive impersonation and invoice fraud tactics. |
SonicWall Patches Actively Exploited Flaws |
SonicWall released hotfixes for multiple vulnerabilities in its SMA1000 appliances that are being actively exploited in the wild.
CVE-2026-15409 and CVE-2026-15410 are being actively exploited in zero-day attacks, with one enabling unauthenticated SSRF and the other allowing authenticated administrators to execute operating system commands. CISA has added both flaws to its KEV catalog, and SonicWall recommends re-imaging affected appliances, rotating credentials, and resetting TOTP tokens if compromise is suspected.
Apply the latest patches and monitor for indicators of compromise on appliances. |
Lidl Incident Hits Three Countries |
A third-party IT provider serving Lidl suffered a breach that exposed customer information belonging to online shoppers in Germany, Belgium, and the Netherlands. Although passwords and payment information were reportedly not exposed, the stolen personal data could enable targeted phishing and identity fraud. The incident remains under investigation and highlights the security and GDPR risks organizations inherit when third-party vendors handle customer data. Conduct continuous third-party risk assessments and review the sensitive data your third-party providers retain. |
|
|
|
How confident are you in your organization's zero-day readiness? |
|
|
|
Yesterday's Pulse Check Results |
What's your biggest concern about a social media account takeover? |
|
|
|
Security Tools You Can Use |
|
|
|
Anthropic Reveals AI Governance Gaps |
Anthropic found attackers leveraged Claude Code to automate much of a cyber campaign, exposing governance gaps that many organizations still face as AI agents move into production.
The research comes as Australian enterprises rapidly adopt autonomous AI, with Deloitte reporting that 69% already use agentic AI while only 22% have mature governance models in place. |
Security leaders should view the incident as a reminder that AI agents require the same oversight as any privileged identity, especially when they can access files, databases, APIs, and sensitive business systems. Inventory every AI agent connected to corporate resources, assign a business owner, enforce least-privilege access with expiring permissions, and regularly test your ability to revoke credentials and disable agent connections during an incident.
|
Fake GitHub Repos Push Infostealer Malware |
Nearly 300 fake GitHub repositories impersonated trusted software to spread infostealers.
The campaign uses fake branding and download pages to trick users into installing malware that steals credentials, cryptocurrency wallet data, messaging tokens, and other sensitive information. Although GitHub has removed many of the repositories at the time of publication, some malicious pages remained active.
Implement application allowlists and configure EDR/XDRs to detect DLL sideloading and flag unexpected downloads from GitHub Pages. |
|
|
|
Are Identity Security Gaps Putting Your Organization at Risk?
SSO and PAM are essential, but they don't secure every application, credential, or user. Download 1Password's guide to discover how to: • Extend identity security beyond traditional access controls • Reduce risk from unmanaged credentials and shadow IT • Strengthen governance across your SaaS environment • Build a more resilient identity security strategy |
|
|
|
Can You Trust Your AI Agents? |
As AI agents gain access to business systems and sensitive data, organizations are rethinking trust by securing them as privileged identities with strong governance and continuous monitoring. |
How to reduce AI agent risk: |
-
Treat AI agents as managed identities by enforcing strong authentication, least-privilege access, and short-lived credentials.
-
Strengthen AI governance by maintaining an inventory of AI agents, regularly reviewing their connected applications and permissions, and assigning clear ownership for oversight and accountability.
-
Continuously monitor and prepare for incidents by logging AI agent activity, detecting anomalous behavior, and routinely testing procedures for revoking credentials, disabling integrations, and responding to AI-related security events.
|
As AI adoption grows, applying identity, governance, and monitoring controls to AI agents helps reduce risk. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
