Multiple reports this week describe threat actors using ClickFix-style social engineering lures to induce victims to run PowerShell commands, leading to browser credential/token and document theft. Microsoft also detailed increased ACR Stealer activity, noting campaigns are successfully harvesting session tokens, passwords, and Microsoft 365-related files. The common thread is that “human-in-the-loop” behaviors (copy/paste, “urgent” instructions) are being weaponized to bypass many traditional controls.
Key takeaway: treat ClickFix lures and “paste-and-run” instructions as high-priority phishing indicators, and tighten controls around browser token theft, endpoint script execution, and risky user workflows.
Source: Microsoft MMPC
Russian “jailbroken” Gemini CLI used to rebuild botnet infrastructure in minutes
A reported Russian-speaking actor leveraged a jailbroken Gemini CLI to deploy and operate command-and-control infrastructure quickly. TrendAI’s findings point to over 200 sessions between March and April 2026, including access to systems inside a dental clinic and interaction with an OpenDental database. This is a notable shift: adversaries are operationalizing AI tools not just for writing code, but for compressing the time-to-compromise.
Key takeaway: assume AI-enabled operators can stand up infrastructure faster than teams can respond, and prioritize rapid detection of suspicious automation, unexpected outbound patterns, and agent-like execution behavior.
Source: Help Net Security
Newly disclosed Zoom Windows flaw (CVE-2026-53412) patched after account takeover risk
Zoom issued updates for a critical Windows vulnerability (CVE-2026-53412, reported CVSS 9.8) that could allow unauthenticated attackers to hijack accounts. Affected areas include Zoom Workplace for Windows, Zoom VDI Client for Windows, and the Zoom Meeting SDK for Windows. The risk model is especially concerning because the exploit can target accounts without authentication.
Key takeaway: patch Zoom immediately and review for suspicious login and session activity, especially on Windows endpoints that run affected clients or SDK components.
Source: Security Affairs
CISA expands Known Exploited Vulnerabilities (KEV) catalog with KNX and Oracle flaws
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities catalog, including an additional KNX Association KNX Protocol option and Oracle-related issues. KEV additions typically increase urgency for affected federal civilian agencies (and often drive broader remediation timelines across industry). This week’s update reinforces how exploitation-driven cataloging is still shaping patch priorities.
Key takeaway: cross-check KEV changes against your asset inventory and patch pipelines, and validate that edge cases (non-standard services, OT/IoT gateways, and vendor-specific deployments) are covered.
Source: Security Affairs
Romania’s ANCPI suffers confirmed cyber attack; cadastre/land data reportedly at risk
Romania’s National Agency for Cadastre and Land Registration (ANCPI) experienced a major disruption affecting its e-Terra service, later confirmed as a cyber attack. While ANCPI stated that administered land data was not compromised, reports indicate data may be for sale, and investigations by state authorities continue. Public-sector disruption like this remains a high-impact scenario because availability and integrity are both at stake.
Key takeaway: for public-facing registry systems and critical national services, ensure incident response plans include resilience testing for downtime, data integrity verification, and threat hunting for exfiltration paths.
Source: Help Net Security
Phishing campaign “The TTF Trap” uses low-detection Lua loader chains
FortiGuard Labs analyzed a global phishing campaign built around obfuscated JScript, disguised .ttf files, and Lua loaders designed for low detection. The chain ultimately delivers RATs and “infostealers,” showing how adversaries are evolving delivery mechanisms to reduce security tooling visibility. Disguise tactics that exploit unexpected file types and multi-stage script execution remain a persistent pattern in modern intrusions.
Key takeaway: strengthen detections for masqueraded file formats (.ttf, document-like payloads), scrutinize script execution behavior (JScript/Lua), and correlate email attachments with subsequent loader and C2 activity.
Source: Fortinet
Patch wars begin: Cisco Talos frames why “the Great Patching” is hard—and urgent
Cisco Talos argues that organizations are finally entering a period where large-scale remediation (“the Great Patching”) must accelerate. The story reflects the operational reality: defenders face alert fatigue, fragile dependencies, and limited bandwidth to fix exposures quickly enough to outrun exploitation. In parallel, threat actors keep shifting tactics to exploit the gap between disclosure, patching, and verification.
Key takeaway: prioritize patching based on exposure + exploitability (not just CVSS), and validate that patches are actually deployed on the systems that matter—through inventory hygiene and continuous verification.
Source: Cisco Talos
You May Also Be Interested In...
F5 Patches Multiple NGINX, BIG-IP Vulnerabilities
The five step plan that cuts security budget waste
Prompt injection is becoming the XSS of the web agent era