Coverage: Last 24 hours
Today’s Highlights
This cycle highlights real-world threat activity: zero-days actively exploited in end-user applications, critical infrastructure and open-source development lifecycle disruptions, large-scale financial theft, and shifts in attacker tradecraft targeting weak SaaS and shadow IT. Defenders must prioritize visibility, aggressive patch management, and configuration hygiene across environments where usability and exposure create new blind spots. The top themes include active exploitation of zero-day vulnerabilities, attacks on supply chain and open-source platforms, abuse of unmonitored SaaS and shadow AI, advanced malware obfuscation, and increased targeting of crypto, e-commerce, and the public sector.
Table of Contents
- Hackers steal $3.6 million from crypto ATM giant Bitcoin Depot
- Microsoft suspends dev accounts for high-profile open source projects
- Hackers use pixel-large SVG trick to hide credit card stealer
- Google: New UNC6783 hackers steal corporate Zendesk support tickets
- 13-year-old bug in ActiveMQ lets hackers remotely execute commands
- Is a $30,000 GPU Good at Password Cracking?
- Hackers exploiting Acrobat Reader zero-day flaw since December
- CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday
- Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
Top Stories
Hackers steal $3.6 million from crypto ATM giant Bitcoin Depot
Source: BleepingComputer | Risk: High | Impacted: Crypto ATM infrastructure, Hot wallet systems, Payment processor backend servers, Finance and treasury operations
Bitcoin Depot, which operates one of the largest Bitcoin ATM networks, says attackers stole $3.665 million worth of Bitcoin from its crypto wallets after breaching its systems last month.
Why it matters: Hackers steal $3.6 million from crypto ATM giant Bitcoin Depot
Practitioner Perspective
The compromise of a major crypto ATM operator’s wallets highlights the ongoing systemic risk from inadequate key management and backend exposure in crypto-financial infrastructure. Financially motivated attackers continue to seek out high-value aggregation points with direct payout potential. Teams responsible for wallets or transaction-layer services need to expect targeted intrusion attempts and review privilege, monitoring, and incident containment for high-value assets. Your business risk is not theoretical: substantial sums continue to be stolen.
Recommended Actions
- Audit hot wallet access paths and rotate exposed keys
- Implement threshold-based transaction monitoring and alerts
Microsoft suspends dev accounts for high-profile open source projects
Source: BleepingComputer | Risk: Medium | Impacted: Windows endpoint fleets, Open-source package consumers, CI/CD pipelines, SBOM/release engineering groups
Microsoft has suspended developer accounts used to maintain multiple high-profile open-source projects without proper notification and no way to quickly reinstate them, effectively blocking them from publishing new software builds and security patches for Windows users.
Why it matters: Microsoft has suspended developer accounts used to maintain multiple high-profile open-source projects without proper notification and no way to quickly reinstate them, effectively blocking them from publishing new software builds and security patches for Windows
Practitioner Perspective
The abrupt suspension of developer accounts hosting critical open-source projects on Microsoft platforms exposes organizations to supply chain risk: you may inherit unexpected risk if you rely on packages unable to ship updates or patches. Defenders need to recognize that even trustworthy dependencies can be disrupted by platform-level decisions. Adjust risk assessments and SBOM reviews accordingly. The critical question: can you rapidly detect and replace dependencies if a project is unexpectedly cut off?
Recommended Actions
- Inventory all externally-sourced software and dependencies
- Monitor for upstream project disruptions or supply chain incidents
Hackers use pixel-large SVG trick to hide credit card stealer
Source: BleepingComputer | Risk: High | Impacted: Magento-based e-commerce stores, Retail websites, Payment processing pages, Web application operators
A massive campaign impacting nearly 100 online stores using the Magento e-commerce platform hides credit card-stealing code in a pixel-sized Scalable Vector Graphics (SVG) image.
Why it matters: Hackers use pixel-large SVG trick to hide credit card stealer
Practitioner Perspective
Magecart operators have evolved web-skimming attacks by hiding credit card stealers in a pixel-sized SVG, evading standard detection controls. E-commerce sites running Magento are likely to be hit first, but the technique will spread wherever client-side injection is viable. Security teams must actively audit for novel obfuscation in front-end code and rigorously monitor for unauthorized changes. Your fraud risk rises sharply if web client code is not under strict integrity control.
Recommended Actions
- Scan public web content for anomalous SVG and inline script references
- Enforce subresource integrity (SRI) and CSP for critical payment pages
Google: New UNC6783 hackers steal corporate Zendesk support tickets
Source: BleepingComputer | Risk: High | Impacted: Zendesk/SaaS support environments, BPO vendor customers, Customer service teams, Organizations with external ticket management
A threat actor tracked as UNC6783 is compromising business process outsourcing (BPO) providers to gain access to high-value companies across multiple sectors.
Why it matters: Google: New UNC6783 hackers steal corporate Zendesk support tickets
Practitioner Perspective
A new threat actor, UNC6783, is breaching BPO providers to compromise Zendesk support ticket data for large organizations. This expands the attack surface well beyond traditional internal controls: customer service and support platforms now pose a direct data exfiltration risk. Review all integrations and identity security around SaaS support portals. Any organization using third-party BPOs should assume ticket data is a potential target and treat it as sensitive.
Recommended Actions
- Audit OAuth and API integrations linked to SaaS support tools
- Limit BPO access to support ticket data by role and necessity
13-year-old bug in ActiveMQ lets hackers remotely execute commands
Source: BleepingComputer | Risk: Critical | Impacted: Legacy middleware platforms, ActiveMQ Classic clusters, Internal app messaging servers, Cloud and hybrid integration services
Security researchers discovered a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that has gone undetected for 13 years and could be exploited to execute arbitrary commands.
Why it matters: 13-year-old bug in ActiveMQ lets hackers remotely execute commands
Practitioner Perspective
A long-lived remote code execution vulnerability in Apache ActiveMQ Classic exposes any unpatched deployments to critical server takeover. Many organizations rely on these legacy message brokers as core infrastructure, often with expansive trust relationships and limited monitoring. RCE bugs in such components see rapid weaponization in botnets and ransomware campaigns. Treat any public-facing or unsegmented ActiveMQ as a probable point of entry until patched.
Recommended Actions
- Identify and patch all ActiveMQ Classic deployments
- Restrict network access to brokers with firewall rules
Is a $30,000 GPU Good at Password Cracking?
Source: BleepingComputer | Risk: Medium | Impacted: Password-based authentication systems, Legacy auth workflows, Environments without MFA
A $30,000 AI GPU doesn’t outperform consumer GPUs at password cracking. Specops explains why attackers don’t need exotic hardware to break weak passwords.
Why it matters: Is a $30,000 GPU Good at Password Cracking?
Practitioner Perspective
Password security is not improved by simply assuming attackers need exotic hardware—mainstream GPUs are sufficient for most hash-cracking attacks. This further emphasizes the ongoing risk from weak passwords and slow adoption of strong authentication. Your password policy and MFA coverage remain far more consequential than hypothetical brute-force hardware. Focusing on the basics is more urgent than ever: make weak credentials unguessable and enforce robust checks.
Recommended Actions
- Mandate minimum password complexity and block common patterns
- Accelerate universal MFA enrollment
Emerging Signals
There are no additional emerging signals to report today.
Exploits & CVEs
Hackers exploiting Acrobat Reader zero-day flaw since December
Source: BleepingComputer | Risk: Critical | Impacted: All Windows and macOS endpoints, Email users receiving PDF attachments, Document processing workflows
Attackers have been exploiting a zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December.
Why it matters: Hackers exploiting Acrobat Reader zero-day flaw since December
Practitioner Perspective
Organizations relying on Adobe Reader are at risk from in-the-wild exploitation of an unpatched zero-day, delivered via malicious PDFs. The extended window of exploitation means advanced threat actors may already have footholds, especially among targets receiving high volumes of inbound attachments. Defenders must treat all PDF attachments as high risk and prioritize deployment of mitigations as soon as available. The most critical control: stop treating PDFs as low risk in end-user environments.
Recommended Actions
- Block known malicious PDFs at email and web gateways
- Accelerate deployment of available patches or mitigations for Adobe Reader
CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday
Source: BleepingComputer | Risk: Critical | Impacted: Federal and public sector IT, Ivanti EPMM (MobileIron) deployments, Enterprises managing large mobile fleets
CISA has given U.S. government agencies four days to secure their systems against a critical-severity vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that has been exploited in attacks since January.
Why it matters: CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday
Practitioner Perspective
Federal agencies face a critical deadline to patch an actively exploited Ivanti EPMM vulnerability that attackers have been abusing since January. The exploitation window suggests broad scanning and potential pre-positioning. Any organization using Ivanti EPMM should treat this as a crisis-level patch event: immediate remediation, validation, and threat hunting are needed. Assume attackers may already have internal access via compromised mobile device management infrastructure.
Recommended Actions
- Patch all Ivanti EPMM systems without delay
- Audit for anomalous administrator logins and configuration changes
Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
Source: The Hacker News | Risk: Critical | Impacted: All Windows and macOS endpoints, Email and messaging workflows, Organizations handling unsolicited documents
Threat actors have been exploiting a previously unknown zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December 2025. The finding, detailed by EXPMON’s Haifei Li, has been described as a highly-sophisticated PDF exploit. The artifact (“Invoice540.pdf”) first appeared on the VirusTotal platform on November 28, 2025. A second
Why it matters: Threat actors have been exploiting a previously unknown zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December 2025. The finding, detailed by EXPMON’s Haifei Li, has been described as a highly-sophisticated PDF
Practitioner Perspective
A sophisticated zero-day in Adobe Reader has been exploited through malicious PDFs since at least late 2025, with widely reported in-the-wild usage. The technical bar for exploitation is low for multifaceted threat groups. Review all PDF attachment handling and internal document flows for potential past exploit attempts, and treat endpoint patching as an emergency. Assume initial access via PDF is an ongoing risk until full patch coverage is established.
Recommended Actions
- Urgently deploy Adobe Reader patches or mitigations
- Block incoming PDFs from untrusted sources at all traffic layers
Defensive Actions
- Deploy SaaS discovery and monitoring solutions for shadow IT/AI
- Review coverage and patch status for Acrobat Reader and Ivanti EPMM across endpoints and mobile infrastructure
- Hunt for suspicious PDF executions since December 2025
- Audit customer data exposure across all booking and support systems
- Inventory all externally-sourced software and dependencies
- Mandate minimum password complexity and block common patterns
- Restrict Script Editor and Terminal access via MDM and endpoint settings
- Scan public web content for anomalous SVG and inline script references
- Identify and patch all ActiveMQ Classic deployments
- Patch all Ivanti EPMM systems without delay
What We’re Watching
Defenders should focus on active exploitation of user-facing applications, patch urgency, and emergent attacker techniques exploiting SaaS, open source, and e-commerce surfaces. Shadow AI adoption, legacy unpatched infrastructure, and ongoing supply chain risks bear continued heightened scrutiny for indicators of compromise and policy enforcement gaps.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply