The second half of March 2026 has been very active from an infosec standpoint, with 124 events (8.27 events/day) and a threat landscape dominated by malware with 40%, (it was 47% in the first half of March), once again ahead of account takeovers (up to 22% from 16%) and ransomware (slightly up to 9% from 8%), confirming the same positions of March H1.
As always, cyber crime led the motivations chart with 65%, slightly up from the previous timeline, when it was 63%; and once again ahead of cyber espionage slightly down at 15% from 16%, followed by Hacktivism, yet another fortnight fueled by the events in the Middle East, with 7%, from 5% of the first fortnight of March, whilst Cyber warfare closes the chart, once again with 3%.
In the second half or March, the initial access techniques saw social engineering on top with 19% (up from 13%), the same value of phishing, which was 14% in the previous timeline. Once again the third place is for supply chain compromises at 10%, slightly up from 9%.
And in this timeline, targets belonging to Public Administration sector took the lead of the Top Targeted Sectors chart with 22% (it was 14%), ahead of Information and Communication down at number two with 20%, (it was 16%), and generic operations against Individuals, which close the podium far with 6%.
Besides these trends, this timeline in particular is rich of interesting events, such as additional mega breaches , so my final suggestion does not change: browse the timeline for the details of all the events collected in this fortnight.
In the first half of March 2026 I collected 95 events (6.34 events/day) with a threat landscape dominated by malware once ahead of account takeovers and
As always bear in mind that the sample refers exclusively to the attacks included in my timelines, available from public sources such as blogs and news sites. Obviously the sample cannot be complete, but only aims to provide an high level overview of the threat landscape.
In the second half of February 2026 I collected 80 events with a threat landscape dominated by malware with 42%, ahead of account takeovers and ransomware.
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new ...
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...
ID
Date Reported
Date Occurred
Date Discovered
Author
Target
Description
Attack
Target Class
Attack Class
Country
Link
Initial Access
1
16/03/2026
Since May 2025
Since May 2025
Unnamed threat actors
Undisclosed organizations
CISA warns U.S. government agencies to secure their Wing FTP Server instances against CVE-2025-47813, an actively exploited vulnerability that may be chained in remote code execution attacks.
Unknown
Public Administration
Unknown
US
Software Vulnerability
2
16/03/2026
13/03/2026
13/03/2026
Ukrainian Cyber Alliance
City of Perm
The Russian city of Perm restores its parking payment system after a cyberattack last week knocked the service offline and temporarily made parking free for several days.
DDoS
Transportation
Hacktivism
RU
N/A
3
16/03/2026
13/03/2026
13/03/2026
Threat actors using the Kratos Phishing-as-a-Service Kit
C-level executive at security firm Outpost24
Researchers at SpecOps reveal the details of a sophisticated multi-chain redirect phishing campaign exploiting legitimate Cisco and Nylas domains to target a C-level executive at its parent company Outpost24
Account Takeover
Information/Communication
Cyber Crime
SE
Social Engineering
4
16/03/2026
Early February 2026
Early February 2026
Unknown
Users of PayPal and Amazon (consumers and employees)
Researchers at Cofense reveal that phishers are weaponizing LiveChat, a legitimate SaaS support platform, to conduct real-time social engineering. Attackers use branded chat windows to impersonate Amazon or PayPal, tricking victims into sharing credentials, credit card details, and MFA codes through what appears to be a genuine customer service session.
Account Takeover
Multiple Industries
Cyber Crime
Global
Phishing Email
5
16/03/2026
Early January 2026
Early January 2026
Warlock (a.k.a. Water Manaul)
Undisclosed organization
Researchers at Trend Micro examine an advanced campaign by the Warlock ransomware group were attackers exploited unpatched SharePoint servers, using Cloudflare tunnels for stealthy C&C, persistent BYOVD techniques to disable EDR, and Rclone for exfiltrating sensitive data before deploying ransomware.
Ransomware
Unknown
Cyber Crime
Unknown
Public-facing app vulnerability
6
17/03/2026
Early 2026
Early 2026
LeakNet (a ransomware-as-a-service or ransomware group)
Multiple organizations including charitable organizations, manufacturing, healthcare, financial services, transportation, business services and consulting, insurance, sports and gaming, education, energy, architectural services, engineering services, and logistics sectors
Researchers at ReliaQuest identify a strategic shift by the LeakNet ransomware group toward self-directed initial access. By deploying "ClickFix" social engineering lures on compromised websites and utilizing a stealthy, in-memory Deno-based loader, the group has scaled its operations to bypass traditional file-based security controls across diverse global industries.
Ransomware
Multiple Industries
Cyber Crime
Global
Social Engineering
7
17/03/2026
17/03/2026
17/03/2026
Unknown
Nordstrom customers and the company's email/communication infrastructure
Attackers abuse Nordstrom's official email system to send cryptocurrency scams to customers. Disguised as a St. Patrick's Day promotion," the emails promised a 200% return on deposits. The breach likely involved compromised Okta and Salesforce credentials, allowing legitimate infrastructure to distribute fraudulent messages.
Ukrainian State Hydrology Agency (under the Ministry of Infrastructure)
Seqrite Labs discovers "Operation GhostMail," a Russian-linked APT campaign exploiting the Zimbra Webmail XSS vulnerability (CVE-2025-66376) to compromise a Ukrainian government agency. The attack uses obfuscated JavaScript embedded in a phishing email to exfiltrate credentials, 2FA codes, and 90 days of mailbox content via DNS and HTTPS.
Malware
Public Administration
Cyber Espionage
UA
Phishing Email
9
17/03/2026
01/03/2026
01/03/2026
Lazarus Group (a.k.a. Guardians of Peace, or Hidden Cobra).
Bitrefill
Bitrefill attributes a recent infrastructure breach to North Korea’s Lazarus Group. After compromising an employee’s laptop, attackers drained hot wallets, exploited gift card inventory, and stole 18,500 purchase records. The company identified the state-sponsored group through malware analysis, on-chain tracing, and reused IP addresses.
Malware
Wholesale/Retail
Cyber Crime
SE
Social Engineering
10
17/03/2026
Unspecified
Unspecified
Konni (an APT group often linked to North Korean interests)
South Korean individuals and organizations, including North Korean human rights activists, lecturers, and psychological counselors.
Researchers at Genians analyze a multi-stage campaign by the Konni APT group targeting South Korean individuals. Using North Korea-themed spear-phishing, the attackers deployed remote access malware via malicious LNK files. They hijacked victims' KakaoTalk accounts to distribute secondary malware to contacts, leveraging established trust to expand the infection.
Malware
Other Service
Cyber Espionage
KR
Phishing Email
11
17/03/2026
Since December 2025
Since December 2025
WaterPlum (part of the Contagious Interview Campaign from North Korea)
Developers and professionals involved in blockchain-related projects.
Researchers from NTT Security Japan discover that WaterPlum shifted to a new modular malware named "StoatWaffle." The group uses deceptive VSCode configurations in repositories to trick users into executing malicious code, which then downloads Node.js modules to steal browser credentials and gain remote access.
Malware
Fintech
Cyber Espionage
Cyber Crime
Global
Social Engineering
12
17/03/2026
21/02/2026
30/10/2025 and 18/11/2025
Unknown
Kaplan
The educational services company Kaplan notifies state regulators that 1.4 million people had Social Security and driver’s license numbers leaked following a cybersecurity incident in the fall of 2025.
Unknown
Education
Cyber Crime
US
Unknown
13
17/03/2026
Between February and March 2026
Between February and March 2026
Unknown
Video gamers seeking "free cheats" for major titles
Researchers at Acronis identify a widespread campaign distributing Vidar Stealer 2.0 through hundreds of fraudulent GitHub repositories and Reddit posts. Masquerading as free game cheats, the malware exfiltrates sensitive browser data, cryptocurrency wallets, and Azure tokens from unsuspecting gamers.
Malware
Arts/Entertainment
Cyber Crime
Global
Social Engineering
14
18/03/2026
Since July 2025
March 2026
UNC6353
Organizations in Ukraine
Researchers at Google Threat Intelligence Group (GTIG) reveal that UNC6353, a suspected Russian espionage actor, has been using the Coruna exploit kit since July 2025, and in December 2025 started leveraging the new DarkSword iOS exploits against Ukrainian targets.
Malware
Public Administration
Cyber Espionage
UA
OS Vulnerability
15
18/03/2026
Since at least November 2025
March 2026
UNC6748
Users in Saudi Arabia
Researchers at Google Threat Intelligence Group (GTIG) reveal that UNC6748 was the first threat actor using the DarkSword iOS exploit kit in attacks targeting Saudi Arabian users via a website impersonating Snapchat.
Malware
Individual
Cyber Crime
SA
OS Vulnerability
16
18/03/2026
Since late November 2025
March 2026
Threat actors associated with PARS Defense
Users in Turkey
Researchers at Google Threat Intelligence Group (GTIG) says that in late November 2025, DarkSword was used in Turkey, in activity associated with PARS Defense, a Turkish commercial surveillance vendor, on devices running iOS 18.4-18.7.
Malware
Individual
Cyber Espionage
TR
OS Vulnerability
17
18/03/2026
During March 2026
March 2026
Threat actors associated with PARS Defense
Users in Malaysia
Researchers at Google Threat Intelligence Group (GTIG) notice the DarkSword being used in Malaysia by another PARS Defense customer delivering the GHOSTSABER backdoor.
Malware
Individual
Cyber Espionage
MY
OS Vulnerability
18
18/03/2026
Since 26/01/2026
Since 26/01/2026
Interlock
Multiple organizations in the Education, Manufacturing, Healthcare, and Public administration
Researchers at Amazon discover a campaign by the Interlock ransomware group exploiting a critical zero-day vulnerability (CVE-2026-20131) in Cisco’s Management Center software.
Ransomware
Multiple Industries
Cyber Crime
Global
Public-facing app vulnerability
19
18/03/2026
Since early November 2025
During March 2026
Unnamed threat actors
U.S. government agencies
CISA orders U.S. government agencies to secure their servers against CVE-2025-66376, an actively exploited vulnerability in the Zimbra Collaboration Suite (ZCS).
Unknown
Public Administration
Unknown
US
Public-facing app vulnerability
20
18/03/2026
Early March 2026
14/03/2026
ShinyHunters
Aura
Identity protection company Aura confirms that an unauthorized party gained access to nearly 900,000 records containing names and email addresses.
Account Takeover
Information/Communication
Cyber Crime
US
Social Engineering
21
18/03/2026
Since January 2026
During March 2026
Unnamed threat actors
U.S. government agencies
CISA warns that CVE-2026-20963, a critical Microsoft SharePoint vulnerability patched in January is now being exploited in attacks.
Unknown
Public Administration
Unknown
US
Software Vulnerability
22
18/03/2026
During March 2026
During March 2026
Threat actors from Iran?
U.S. government agencies
CISA warns U.S. organizations to follow Microsoft guidance to strengthen the Intune endpoint management tool after the cyberattack that exploited it to wipe medical technology giant Stryker's systems.
Malware
Public Administration
Hacktivism
US
Misconfiguration
23
18/03/2026
22/12/2025
23/01/2026
Unknown
Navia Benefit Solutions
Navia Benefit Solutions, Inc. (Navia) informs nearly 2.7 million individuals of a data breach that exposed their sensitive information to attackers.
Unknown
Finance & insurance
Cyber Crime
US
API Vulnerability
24
18/03/2026
During March 2026
During March 2026
Unknown
Developers on GitHub, specifically those who "starred" or interacted with OpenClaw-related repositories
Researchers at OX Security discover a phishing campaign targeting developers with fake token allocations. Attackers created malicious GitHub issues, tagging users to lure them to a cloned openclaw.ai site. The site contained obfuscated JavaScript (eleven.js) designed to connect to and drain various crypto wallets (MetaMask, Trust Wallet, etc.).
Malware
Information/Communication
Cyber Crime
Global
Social Engineering
25
19/03/2026
Early 2026
During March 2026
Unknown
Financial institutions in Turkey and Italy, as well as crypto services
Researchers at ThreatFabric discover "Perseus," an advanced Android malware evolving from the Phoenix and Cerberus families. It specializes in Device Takeover (DTO) by abusing Accessibility Services to perform overlay attacks, keylogging, and a unique "scan_notes" feature that systematically steals sensitive information from note-taking applications like Google Keep and Evernote.
Malware
Multiple Industries
Cyber Crime
IT
TR
Rogue App
26
19/03/2026
Since at least 04/03/2026
Since at least 04/03/2026
Unnamed threat actors
U.S. government agencies
The Cybersecurity and Infrastructure Security Agency (CISA) orders federal agencies to patch a maximum-severity vulnerability, CVE-2026-20131, in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22.
Unknown
Public Administration
Unknown
US
Software Vulnerability
27
19/03/2026
Since mid December 2025
Since mid December 2025
Threat actors using the VoidStealer MaaS (Malware-as-a-Service)
Users of Chromium-based browsers (Google Chrome, Microsoft Edge) on Windows systems
Researchers at Gen Digital discover "VoidStealer," a novel MaaS infostealer that bypasses Google Chrome’s Application-Bound Encryption (ABE).
Malware
Multiple Industries
Cyber Crime
Global
Unspecified
28
19/03/2026
Md-December 2025
Md-December 2025
Unknown
Mazda Motor Corporation
Mazda Motor Corporation (Mazda) announces that information belonging to its employees and business partners had been exposed in a security incident detected last December.
Unknown
Manufacturing
Cyber Crime
JP
Unknown
29
19/03/2026
During March 2026
During March 2026
'Runningcrab'
Organizations and individuals using Cobra DocGuard
Researchers at Symantec and Carbon Black discover "Speagle," a stealthy infostealer targeting users of Cobra DocGuard security software. The malware hijacks legitimate infrastructure for command-and-control, exfiltrating sensitive data, while masking its activity as normal client-server communication to evade detection.
Malware
Multiple Industries
Cyber Espionage
Global
CN
Supply Chain Compromise
30
19/03/2026
Since the week of 09/03/2026
Since the week of 09/03/2026
Unknown
Organizations using Quest KACE Systems Management Appliance (SMA)
Researchers at Arctic Wolf reveal that threat actors are suspected to be exploiting CVE-2025-32975, a maximum-severity security flaw impacting Quest KACE Systems Management Appliance (SMA).
Account Takeover
Unknown
Unknown
Unknown
Security Appliance Vulnerability
31
19/03/2026
Between 05/02/2026 and 06/02/2026
Between 05/02/2026 and 06/02/2026
Unknown
Multiple organizations including financial services, education, information technology (IT), insurance, and healthcare, primarily in the United States
Researchers at Microsoft discover a campaign that was delivering the Energy365 PhaaS phishing kit and used tax and Certified Public Accountant (CPA) lures throughout the attack chain.
Account Takeover
Multiple Industries
Cyber Crime
US
Phishing Email
32
19/03/2026
10/02/2026
10/02/2026
Unknown
Approximately 100 organizations, in the manufacturing, retail, and healthcare primarily in the United States
Researchers at Microsoft discover tax-themed phishing emails containing an attachment redirecting to a phishing page built with the SneakyLog PhaaS platform and mimicking the Microsoft 365 sign-in page to steal credentials.
Account Takeover
Multiple Industries
Cyber Crime
US
Phishing Email
33
19/03/2026
Between 08/02/2026 and 10/02/2026
Between 08/02/2026 and 10/02/2026
Unknown
Wide range of industries primarily in the United States
Researchers at Microsoft discover a campaign with several hundred emails containing a link redirecting to a domain distributing the remote management and monitoring (RMM) tool ScreenConnect.
Remote Management Tool
Multiple Industries
Cyber Crime
US
Phishing Email
34
19/03/2026
Between 23/02/2026 and 27/02/2026
Between 23/02/2026 and 27/02/2026
Unknown
Multiple organizations in the U.S., primarily higher education
Researchers at Microsoft discover a campaign impersonating the US Internal Revenue Service (IRS) with a cryptocurrency lure, and distributing the remote management and monitoring (RMM) tool ScreenConnect.
Remote Management Tool
Multiple Industries
Cyber Crime
US
Phishing Email
35
19/03/2026
09/03/2026
09/03/2026
Unknown
Multiple accounting companies and few related industries such as financial services, legal, and insurance in the U.S.
Researchers at Microsoft discover a campaign targeting CPAs, asking for assistance in filing taxes, asking for a quote, and typically providing a backstory, and distributing the remote management and monitoring (RMM) tool Datto.
Remote Management Tool
Multiple Industries
Cyber Crime
US
Phishing Email
36
19/03/2026
10/02/2026
10/02/2026
Unknown
Multiple organizations in the U.S. including financial services, technology and software, and retail and consumer goods
Researchers at Microsoft observe a large-scale phishing campaign sent to more than 29,000 users across 10,000 organizations, impersonating the the IRS, and distributing the remote management and monitoring (RMM) tool ScreenConnect.
Remote Management Tool
Multiple Industries
Cyber Crime
US
Phishing Email
37
19/03/2026
'Recently'
'Recently'
Unknown
Unspecified organization
Researchers at Blackpoint identify RoadK1ll, a Node.js-based malware designed for internal network pivoting. Using custom WebSocket framing, it establishes a reverse tunnel to attacker-controlled infrastructure.
Malware
Unknown
Unknown
Unknown
Unknown
38
19/03/2026
Since 27/02/2026
27/02/2026
Unknown
Thousands of Magento-based e-commerce sites, including global brands (Toyota, FedEx, ASUS, Lindt), government services, and Trump Organization domains.
Researchers at Netcraft identify a massive campaign defacing approximately 15,000 hostnames on 7,500 Magento domains. Attackers uploaded plaintext files to global brands and government services, primarily to build reputation within the defacement subculture through mass opportunistic exploitation.
Defacement
Wholesale/Retail
Cyber Crime
Global
Public-facing app vulnerability
39
19/03/2026
19/03/2026
19/03/2026
WorldPay
Los Angeles Metro
Los Angeles Metro says it's working to restore access to its internal administrative computers after the agency's security team discovered "unauthorized activity." The WorldPay ransomware group claims responsibility for the attack.
Ransomware
Public Administration
Cyber Crime
US
Unknown
40
19/03/2026
Early 2026
Early 2026
Unknown attacker using the PureLog Stealer Malware-as-a-Service)
Researchers at Trend Micro discover a campaign targeting industries in Germany, Canada, the US, and Australia via social engineering with language-specific legal lures to trick users into executing files that launch a complex, fileless infection chain to steal credentials and crypto-wallets.
Malware
Multiple Industries
Cyber Crime
DE
CA
US
AU
Phishing Email
41
20/03/2026
Unspecified
Unspecified
Russian intelligence-linked threat actors
Individuals of high intelligence value, such as current and former U.S. government officials, military personnel, political figures, and journalists
The FBI issues a public service announcement warning that Russian intelligence-linked threat actors are actively targeting users of encrypted messaging apps such as Signal and WhatsApp in phishing campaigns that have already compromised thousands of accounts.
Account Takeover
Multiple Industries
Cyber Espionage
US
Social Engineering
42
20/03/2026
19/03/2026
19/03/2026
TeamPCP
Users of the Aqua Security Trivy scanner
The Trivy vulnerability scanner is compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-stealing malware through official releases and GitHub Actions.
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
43
20/03/2026
Since December 2025
Since December 2025
Unnamed threat actors
U.S. government agencies
CISA orders U.S. government agencies to patch CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, the three iOS vulnerabilities targeted in cryptocurrency theft and cyberespionage attacks using the DarkSword exploit kit.
Unknown
Public Administration
Cyber Espionage
Cyber Crime
US
OS Vulnerability
44
20/03/2026
Since April 2025
Since April 2025
Unnamed threat actors
U.S. government agencies
CISA orders U.S. government agencies to patch CCVE-2025-54068, a code injection vulnerability in Laravel Livewire, currently exploited in the wild.
Unknown
Public Administration
Unknown
US
Public-facing app vulnerability
45
20/03/2026
Unknown
Unknown
Unnamed threat actors
U.S. government agencies
CISA orders U.S. government agencies to patch CVE-2025-32432, a code injection vulnerability in Craft CMS, currently exploited in the wild.
Unknown
Public Administration
Unknown
US
Public-facing app vulnerability
46
20/03/2026
During March 2026
During March 2026
Iranian-linked and pro-Palestinian Handala hacktivist group
Organizations in the U.S.
The U.S. Federal Bureau of Investigation (FBI) warns that Iranian threat actors linked to the country's Ministry of Intelligence and Security (MOIS) are using Telegram in malware attacks.
Malware
Multiple Industries
Hacktivism
US
Social Engineering
47
20/03/2026
Since 04/03/2026
During March 2026
Operators of the Tycoon2FA Phishing-as-a-Service platform
Users of Microsoft 365 and Google cloud environments globally.
Researchers at CrowdStrike reveal that the Tycoons 2FA, a Phishing-as-a-Service (PhaaS) platform is persisting following the March 2026 law enforcement takedown of 330 domains. Despite the disruption, the platform quickly rebounded, using Adversary-in-the-Middle (AiTM) techniques to bypass MFA and maintaining high volumes of cloud account compromises.
Account Takeover
Multiple Industries
Cyber Crime
Global
Phishing Email
48
20/03/2026
19/03/2026
19/03/2026
Unknown
Foster City
Foster City, California is forced to pause all public services outside of emergency responses in light of a ransomware attack.
Ransomware
Public Administration
Cyber Crime
US
Unknown
49
20/03/2026
11/03/2026
11/03/2026
Unknown
Trio-Tech International
Trio-Tech International, a semiconductor testing company warns regulators that its subsidiary in Singapore suffered a ransomware attack.
Ransomware
Manufacturing
Cyber Crime
SG
Unknown
50
20/03/2026
14/03/2026
14/03/2026
Unknown
Intoxalock
A cyberattack on vehicle breathalyzer company Intoxalock disables backend calibration systems, stranding thousands of US drivers with court-mandated ignition interlocks. The disruption prevents mandatory maintenance, locking vehicles and highlighting the risks of centralized, internet-connected automotive safety infrastructure.
Unknown
Manufacturing
Cyber Crime
US
Unknown
51
20/03/2026
01/03/2026
02/03/2026
Unknown
Heritage Bank
Heritage Bank discloses that threat actors copied files from an internal employee file-sharing server. The stolen data includes employees’ and customers’ private and confidential information, such as names, Social Security numbers, account numbers, dates of birth, and addresses.
Account Takeover
Finance & insurance
Cyber Crime
US
Unknown
52
21/03/2026
During March 2026
During March 2026
Unknown
Microsoft Azure users
A "callback phishing" campaign abuses Microsoft’s Azure Monitor alert system. Attackers create malicious alert rules in Azure tenants to send legitimate-looking notification emails. These messages bypass security filters to deliver fraudulent billing lures, ultimately tricking victims into calling attacker-controlled phone numbers for social engineering.
Callback Phishing
Information/Communication
Cyber Crime
Global
Phishing Email
53
22/03/2026
22/03/2026
22/03/2026
TeamPCP
Users of the Aqua Security Trivy scanner
Researchers at Aikido Security identify a destructive TeamPCP campaign using "CanisterWorm" malware to target Kubernetes clusters. The malware fingerprints systems; those identified as Iranian via timezone or locale are wiped using a "kamikaze" DaemonSet, while others receive a persistent backdoor disguised as PostgreSQL monitoring tools.
Malware
Information/Communication
Cyber Warfare
Cyber Crime
Global
IR
Misconfiguration
54
22/03/2026
During March 2026
During March 2026
TeamPCP
Kubernetes clusters and Docker APIs, specifically targeting systems located in Iran for destruction.
Researchers at Check Point reveal a surge in attempts to compromise internet-connected surveillance cameras across the Middle East during the ongoing regional conflict, with activity attributed to infrastructure linked to Iranian threat actors.
Unknown
Information/Communication
Cyber Warfare
IL
QA
BH
KW
AE
LB
IoT Vulnerability
55
22/03/2026
22/03/2026
22/03/2026
TeamPCP
Aqua Security (specifically their Trivy container scanning tool and GitHub organization).
Researchers at Socket reveal that compromised Trivy Docker images (0.69.4–0.69.6) were pushed to Docker Hub, bypassing GitHub releases. These images contained "TeamPCP" infostealer malware, utilizing a typosquatted C2 domain for exfiltration. The breach targeted Aqua Security’s supply chain, potentially affecting numerous downstream CI/CD pipelines and third-party integrations using automated updates.
Malware
Information/Communication
Cyber Crime
US
Supply Chain Compromise
56
22/03/2026
22/03/2026
22/03/2026
Unknown
Resolv Digital Assets
Decentralized finance platform Resolv reveals that a cyberattack allowed a threat actor to compromise the company’s infrastructure and illicitly create $80 million worth of its USR stablecoin.
Account Takeover
Fintech
Cyber Crime
US
Compromised Private Key
57
23/03/2026
12/03/2026
19/03/2026
Unknown
Crunchyroll
Popular anime streaming platform Crunchyroll is investigating a breach after hackers claimed to have stolen personal information for approximately 6.8 million people.
Account Takeover
Information/Communication
Cyber Crime
US
Supply Chain Compromise
58
23/03/2026
19/03/2026
19/03/2026
Unknown
Dutch Ministry of Finance
The Dutch Ministry of Finance confirms that some of its systems were breached in a cyberattack detected last week.
Unknown
Public Administration
Cyber Crime
NL
Unknown
59
23/03/2026
22/12/2025
23/01/2026
Unknown
HackerOne
Bug bounty platform HackerOne notifies hundreds of employees that their data was stolen after attackers hacked Navia, one of its U.S. benefits administrators.
Account Takeover
Information/Communication
Cyber Crime
US
Supply Chain Compromise
60
23/03/2026
23/03/2026
23/03/2026
TeamPCP
Checkmarx GitHub Actions
Researchers at Sysdig discover that TeamPCP expanded its supply chain attack from Aqua Security’s Trivy to Checkmarx’s GitHub Actions. By harvesting credentials from CI/CD runner memory, the actor poisoned multiple trusted actions, exfiltrating encrypted secrets to vendor-specific typosquatted domains.
Malware
Information/Communication
Cyber Crime
US
Supply Chain Compromise
61
23/03/2026
19/02/2026 and 24/02/2026
19/02/2026
EvilTokens Phishing as a Service
Microsoft 365 identities across 340+ organizations.
Researchers at Huntress discover a large-scale campaign where attackers use Railway.com’s infrastructure to conduct device code phishing. Victims are tricked into entering authentication codes on legitimate Microsoft endpoints, allowing attackers to harvest OAuth tokens, bypass MFA, and maintain persistent access to corporate environments.
Account Takeover
Multiple Industries
Cyber Crime
US
CA
AU
NZ
DE
Social Engineering
62
23/03/2026
08/01/2026
09/01/2026
Unknown
Hightower Holding
Hightower Holding, the parent company of financial management services provider Hightower Advisors, notifies over 130,000 individuals of a data breach.
Account Takeover
Finance & insurance
Cyber Crime
US
Compromised Credentials
63
23/03/2026
During March 2026
During March 2026
LAPSUS$
AstraZeneca
The LAPSUS$ group claims to have breached AstraZeneca, leaking nearly 3GB of internal data including source code, cloud infrastructure details (AWS/Azure), and employee records. Initially offered for sale, the archive was later released for free.
Account Takeover
Human Health
Cyber Crime
US
Compromised Credentials
64
23/03/2026
Since 05/10/2025
13/03/2026
Nasir Security
Dubai Petroleum
Researchers at Resecurity discover a relatively new cybercriminal group called Nasir Security, presumably associated with Iran, that is targeting energy organizations in the Middle East.
Unknown
Electricity/Gas
Hacktivism
AE
Supply Chain Compromise
65
23/03/2026
Since 05/10/2025
15/03/2026
Nasir Security
Oman CC Energy Development
Researchers at Resecurity discover a relatively new cybercriminal group called Nasir Security, presumably associated with Iran, that is targeting energy organizations in the Middle East.
Unknown
Electricity/Gas
Hacktivism
OM
Supply Chain Compromise
66
23/03/2026
Since 05/10/2025
21/03/2026
Nasir Security
Al-Safi Oil Company (PURE IN)
Researchers at Resecurity discover a relatively new cybercriminal group called Nasir Security, presumably associated with Iran, that is targeting energy organizations in the Middle East.
Researchers at Netskope identify a massive "malware factory" using AI-generated lures to target developers and gamers. The campaign distributes trojanized GitHub repositories and 300+ packages, employing a two-component LuaJIT design to evade sandboxes and exfiltrate desktop screenshots and credentials.
Malware
Multiple Industries
Cyber Crime
Global
Social Engineering
68
24/03/2026
18/03/2026
23/03/2026
ShinyHunters
Infinite Campus
Infinite Campus, a widely used K-12 student information system, warns customers of a data breach following an extortion attempt by the threat actor ShinyHunters. The threat actor compromised an employee’s Salesforce account via a sophisticated "vishing" campaign, exfiltrating staff contact details and directory information. The company refused ransom demands.
Account Takeover
Information/Communication
Cyber Crime
US
Social Engineering
69
24/03/2026
24/03/2026
24/03/2026
TeamPCP
Users of the litellm library
Researchers at Endor Labs discover a supply chain attack by "TeamPCP" targeting the litellm Python library. Attackers published backdoored versions (1.82.7, 1.82.8) to PyPI containing a credential harvester, Kubernetes lateral movement toolkit, and a persistent systemd backdoor, targeting developers and cloud environments to exfiltrate secrets and SSH keys.
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
70
24/03/2026
Since December 2025
Early February 2026
Russian-speaking threat actor
General internet users, specifically targeting those using cryptocurrency wallets (728 extensions) and password managers (103 extensions)
Researchers at Gen Digital researchers unmask "Torg Grabber," a sophisticated information-stealing malware-as-a-service. Initially disguised as Vidar malware, it evolved rapidly from Telegram-based exfiltration to a professional REST API infrastructure. It employs multi-layered obfuscation and "ClickFix" lures to steal credentials from over 850 browser extensions, focusing heavily on cryptocurrency wallets.
Malware
Multiple Industries
Cyber Crime
Global
Social Engineering
71
24/03/2026
Unspecified
Unspecified
Unknown
Employees and organizations using Microsoft services
Researchers at Kaspersky identify a phishing campaign leveraging the "Bubble" no-code app builder to create malicious web applications. These apps, hosted on legitimate Bubble servers, bypass security filters by using complex, auto-generated code to redirect users to fraudulent Microsoft sign-in pages designed to steal corporate credentials.
Account Takeover
Multiple Industries
Cyber Crime
Global
Phishing Email
72
24/03/2026
21/03/2026
21/03/2026
Unknown
An unnamed multinational car manufacturer, along with other e-commerce stores using Adobe Commerce/Magento.
Researchers at Sansec discover a payment skimmer targeting the ‘PolyShell’ vulnerability in version 2 of Magento Open Source and Adobe Commerce installations. It bypasses Content Security Policy (CSP) and traditional HTTP-based defenses by using WebRTC DataChannel, to load its malicious payload and exfiltrate stolen credit card data directly to the attacker's server.
Malicious Script Injection
Multiple Industries
Cyber Crime
Global
Public-facing app vulnerability
73
24/03/2026
Beginning of February 2026
Beginning of February 2026
'mikilanjillo'
Software developers (specifically those using React and crypto-related tools) and cryptocurrency wallets
Researchers at ReversingLabs discover the "Ghost campaign". The attack employs malicious npm packages that display fake installation logs to hide activity and phish for sudo passwords. Once obtained, these passwords are used to install a RAT that steals sensitive data and crypto assets.
Malware
Fintech
Cyber Crime
Global
Supply Chain Compromise
74
24/03/2026
Early 2026
Early 2026
Unnamed financially-motivated threat actor
French-speaking corporate and enterprise environments (specifically HR and recruitment staff).
Researchers at Securonix uncover "FAUX#ELEVATE," a campaign targeting French enterprises with fake CV-themed VBScript droppers. Using extreme obfuscation and domain-join checks, it deploys a multi-purpose toolkit including XMRig cryptominers and infostealers. The attack exploits legitimate services like Dropbox and compromised WordPress sites to exfiltrate credentials and maximize illicit profits.
Malware
Professional/Scientific
Cyber Crime
FR
Phishing Email
75
24/03/2026
Late February 2026
Late February 2026
Pay2Key
Unnamed U.S. healthcare organization
A U.S. healthcare organization is targeted by Pay2Key, an Iranian ransomware gang with ties to the country’s government.
Ransomware
Human Health
Hacktivism
US
Unknown
76
24/03/2026
23/12/2025
24/12/2025
Unknown
QualDerm Partners
Healthcare management services provider QualDerm Partners notifies more than 3.1 million people that their personal, medical, and health insurance information was stolen in a December 2025 data breach.
Unknown
Human Health
Cyber Crime
US
Unknown
77
24/03/2026
Since August 2025
Since August 2025
Unknown
Senior-level professionals
Researchers at Palo Alto Networks reveal the details of sophisticated phishing campaigns where attackers impersonate Palo Alto Networks talent acquisition staff. These attacks specifically target senior-level professionals by leveraging scraped LinkedIn data to craft highly personalized lures.
Scam
Information/Communication
Cyber Crime
Global
Phishing Email
78
25/03/2026
Since 19/03/2026
Since 19/03/2026
Unnamed threat actors
U.S. government agencies
The Cybersecurity and Infrastructure Security Agency (CISA) warns that threat actors are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents.
Unknown
Public Administration
Unknown
US
Software Vulnerability
79
25/03/2026
'Recently'
'Recently'
Unknown
AFC Ajax
Dutch professional football club Ajax Amsterdam (AFC Ajax) discloses that a threat actor exploited vulnerabilities in its IT systems and accessed data belonging to a few hundred people.
Account Takeover
Arts/Entertainment
Cyber Crime
NL
API Vulnerability
80
25/03/2026
Unspecified
Unspecified
Unknown
Dutch National Police (Politie)
The Dutch National Police (Politie) says a security breach resulting from a successful phishing attack has had a limited impact and hasn't affected citizens' data.
Account Takeover
Public Administration
Cyber Crime
NL
Phishing Email
81
25/03/2026
During March 2026
During March 2026
Unknown
Software developers and maintainers on GitHub, specifically those using Visual Studio Code
Researchers at Socket identify a massive phishing campaign using fake GitHub Discussions to broadcast "critical" Visual Studio Code vulnerability alerts. Attackers trick developers into downloading malicious "updates" from external links, using a redirection chain to fingerprint user systems and deliver follow-on malware or exploit kits.
Malware
Information/Communication
Cyber Crime
Global
Social Engineering
82
25/03/2026
Since January 2025
Since January 2025
Bearlyfy (a.k.a Labubu)
Organizations in Russia, including large-scale enterprises
Researchers at F6 detail the evolution of the pro-Ukrainian hacking group "Bearlyfy" (also known as Labubu). Since January 2025, they have executed over 70 attacks on Russian businesses, transitioning from using leaked ransomware like LockBit 3 to developing their own custom malware, "GenieLocker," to maximize financial and operational damage.
Ransomware
Professional/Scientific
Cyber Crime
Hacktivism
RU
Unknown
83
25/03/2026
Since 27/10/2025
During March 2026
Silver Fox (a.k.a. Void Arachne or SwimSnake)
Chinese-speaking users, specifically those seeking VPNs, encrypted messengers (Signal, Telegram), and cryptocurrency tools.
Researchers at Hexastrike reveal that the Chinese-nexus threat actor Silver Fox (Void Arachne) deployed the AtlasCross RAT by impersonating trusted software like VPNs and messengers. Using typosquatted domains and stolen EV code-signing certificates, the multi-stage campaign employs fileless execution and the PowerChell framework to exfiltrate data and hijack RDP sessions while evading security products.
Malware
Information/Communication
Cyber Espionage
Cyber Crime
CN
Social Engineering
84
25/03/2026
24/03/2026
24/03/2026
Unknown
Puerto Rico’s Department of Transportation
Puerto Rico’s Department of Transportation is forced to cancel all upcoming appointments at the agency that handles driver’s licenses, permits and vehicle registrations due to a cyberattack.
Malware
Public Administration
Cyber Crime
US
Unknown
85
25/03/2026
24/03/2026
24/03/2026
Unknown
Port of Vigo
A ransomware attack disrupts digital systems at Spain’s Port of Vigo, forcing authorities to disconnect parts of its network and temporarily manage cargo operations manually.
Ransomware
Transportation
Cyber Crime
ES
Unknown
86
25/03/2026
During March 2026
During March 2026
North Korean APT groups (overlapping with "Contagious Interview")
Undisclosed organizations in the retail industry
Researchers at eSentire’s discover EtherRAT, a Node.js-based backdoor linked to North Korean actors. The malware uses "EtherHiding" via Ethereum smart contracts to secure C2 addresses, targeting the retail sector through ClickFix and IT support scams to exfiltrate data.
Malware
Wholesale/Retail
Cyber Espionage
Cyber Crime
Unknown
Social Engineering
87
26/03/2026
During March 2026
During March 2026
Infiniti Stealer
macOS users
Researchers at Malwarebytes identify "Infiniti Stealer," a novel macOS infostealer, employing "ClickFix" social engineering, tricking users into pasting malicious Terminal commands from fake CAPTCHA pages. The malware is written in Python and compiled with Nuitka into a native binary to evade detection while exfiltrating credentials, crypto wallets, and keychain data.
Malware
Individual
Cyber Crime
Global
Social Engineering
88
26/03/2026
Since at least 2021
Unspecified 'months-long'
Red Menshen (a.k.a. Earth Bluecrow, DecisiveArchitect, and Red Dev 18)
Global Telecommunications networks (specifically mobile operators and signaling systems) and Government entities
Researchers at Rapid7 Labs discover a long-term espionage campaign by a China-linked threat actor using the BPFDoor malware. "Digital sleeper cells" are embedded within global telecommunications backbones to monitor government communications, track subscriber data, and maintain persistent, kernel-level access across 4G and 5G networks.
Malware
Information/Communication
Cyber Espionage
Multiple countries (primarily targets in the Middle East and Asia)
Public-facing app vulnerability
89
26/03/2026
24/03/2026
24/03/2026
Unknown
Marketing teams and business users managing TikTok for Business and Google Ad Manager accounts
Researchers at Push Security discover a sophisticated phishing campaign targeting "TikTok for Business" and Google accounts. Attackers use "Adversary-in-the-Middle" (AITM) kits to steal session tokens, bypassing MFA. These compromised accounts are typically exploited for malvertising scams, ad fraud, and distributing further malware via trusted business profiles.
Account Takeover
Professional/Scientific
Cyber Crime
Global
Phishing Email
90
26/03/2026
Between 01/06/2025 and 15/08/2025
Between 01/06/2025 and 15/08/2025
Stately Taurus (a.k.a. Mustang Panda)
Undisclosed government organization in Southeast Asia
Researchers at Palo Alto Networks reveal the details of cyber espionage campaign by the Chinese threat actor Stately Taurus targeting a government organization in Southeast Asia via the USB-propagated malware called USBFect (aka HIUPAN), which deploys a PUBLOAD backdoor.
Malware
Public Administration
Cyber Espionage
Undisclosed
USB Stick
91
26/03/2026
During August 2025
09/08/2025
CL-STA-1048 (overlapping with Earth Estries and those behind the Crimson Palace)
Undisclosed government organization in Southeast Asia
During the same activity, researchers at Palo Alto Networks discover an additional campaign against the same organization using a toolkit of espionage payloads, deploying multiple RATs like MasolRAT and the RawCookie backdoor.
Malware
Public Administration
Cyber Espionage
Undisclosed
Unknown
92
26/03/2026
During August 2025
01/08/2025
CL-STA-1049 (overlapping with Unfading Sea Haze)
Undisclosed government organization in Southeast Asia
During the same activity, researchers at Palo Alto Networks discover an additional campaign against the same organization showing stealth and persistence, with attackers using the novel Hypnosis loader to deploy the FluffyGh0st RAT. This activity overlaps with the China-aligned group known as Unfading Sea Haze.
Malware
Public Administration
Cyber Espionage
Undisclosed
Unknown
93
26/03/2026
26/03/2026
26/03/2026
TA446 (a.k.a. Star Blizzard, Callisto, ColdRiver, SeaBorgium)
Undisclosed organizations
Researchers at Proofpoint reveal that the Russian state-sponsored group tracked as Star Blizzard has adopted the DarkSword iOS exploit kit in an ongoing campaign.
Malware
Unknown
Cyber Espionage
Undisclosed
Phishing Email
94
27/03/2026
24/03/2026
24/03/2026
ShinyHunters
European Commission
The European Commission is investigating a data breach after a threat actor compromised an Amazon Web Services account. The threat actor claimed to exfiltrate over 350 GB of data, including employee information and databases. Few days later the European Commission confirms the breach claimed by the ShinyHunters group.
Unknown
Extraterritorial orgs and bodies
Cyber Crime
BE
Unknown
95
27/03/2026
27/03/2026
27/03/2026
TeamPCP
Developers and organizations using the Telnyx Python SDK
Attackers from TeamPCP hijack the popular Telnyx Python SDK on PyPI to distribute credential-stealing malware. The attack utilized steganography to hide malicious code within WAV audio files. The malware targets SSH keys, cloud tokens, and Kubernetes secrets across Linux, macOS, and Windows systems.
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
96
27/03/2026
End of March 2026
End of March 2026
Unnamed threat actors
U.S. government agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2025-53521, a critical security flaw impacting F5 BIG-IP Access Policy Manager (APM) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Unknown
Public Administration
Unknown
US
Security Appliance Vulnerability
97
27/03/2026
27/03/2026
27/03/2026
Unknown
Multiple organizations
Security researchers from multiple company observe massive reconnaissance activity for CVE-2026-3055, a recently disclosed critical security flaw impacting Citrix NetScaler ADC and NetScaler Gateway. Few days later the U.S. Cybersecurity and Infrastructure Security Agency (CISA) orders government agencies to patch their Citrix NetScaler appliances.
Unknown
Multiple Industries
Unknown
Global
Security Appliance Vulnerability
98
27/03/2026
26/03/2026
26/03/2026
Qilin (a.k.a. Agenda)
Die Linke
The German political party Die Linke suffers a severe cyberattack targeting its IT infrastructure. Upon discovery, the party isolates systems to prevent data theft. The incident was later linked to the Qilin ransomware group.
Ransomware
Other Service
Cyber Crime
DE
Unknown
99
27/03/2026
16/03/2026
16/03/2026
Unknown
CareCloud
Healthcare IT firm CareCloud discloses a data breach incident that exposed sensitive data and caused a network disruption lasting approximately eight hours.
Unknown
Human Health
Cyber Crime
US
Unknown
100
27/03/2026
During March 2026
During March 2026
Russia
Public opinion in Latvia, Lithuania and Estonia
Latvia’s Defense Ministry says that Russia is carrying out a coordinated disinformation campaign against Latvia, Lithuania and Estonia, falsely claiming that the Baltic states are allowing their territories to be used for Ukrainian attacks on Russia.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
LV
LT
EE
N/A
101
28/03/2026
26/03/2026
26/03/2026
UAC-0255
State organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies in Ukraine
The Computer Emergency Response Team of Ukraine (CERT-UA) discloses details of a new phishing campaign in which the cybersecurity agency itself was impersonated to distribute a remote administration tool known as AGEWHEEZE.
Malware
Multiple Industries
Cyber Espionage
UA
Phishing Email
102
28/03/2026
Since 24/03/2026
24/03/2026
Unknown
Organizations using Forticlient EMS
Researchers at Defused warn that threat actors are now actively exploiting CVE-2026-21643, a critical vulnerability in Fortinet's FortiClient EMS platform.
Unknown
Multiple Industries
Unknown
Unknown
Software Vulnerability
103
29/03/2026
During March 2026
27/03/2026
Handala
Personal email account of FBI Director Kash Patel
The Handala threat actors associated with Iran breach the personal email account of FBI Director Kash Patel and publish photos and documents. The FBI has confirmed the compromise, saying that the stolen data was not recent and did not include any government data.
Account Takeover
Public Administration
Hacktivism
US
Unknown
104
30/03/2026
Early to late March 2026
During March 2026
Unknown
General enterprise environments and corporate users
Researchers at ReliaQuest identify "DeepLoad," a malware using AI-generated obfuscation and "ClickFix" social engineering to compromise enterprise environments.
Malware
Multiple Industries
Cyber Crime
Global
Social Engineering
105
30/03/2026
30/03/2026
30/03/2026
UNC1069
The Axios npm package (and by extension, the millions of developers and automated CI/CD systems that download it)
Researchers at StepSecurity reveal that attackers compromised the Axios npm package by hijacking the lead maintainer's account to publish malicious versions 1.14.1 and 0.30.4. Few days later Google formally attributes the supply chain compromise to a financially motivated North Korean threat activity cluster tracked as UNC1069.
Malware
Information/Communication
Cyber Crime
Global
Compromised Credentials
106
30/03/2026
Since mid-February 2026
During March 2026
'eviltokensadmin'
Users of Microsoft 365
Researchers at Sekoia uncover "EvilTokens," a sophisticated Phishing-as-a-Service (PhaaS) kit targeting Microsoft 365. It uses device code phishing to bypass MFA, harvesting access/refresh tokens. The platform includes AI-powered automation for email harvesting and reconnaissance, enabling large-scale Business Email Compromise (BEC) attacks across various sectors.
Account Takeover
Information/Communication
Cyber Crime
Global
Social Engineering
107
30/03/2026
Since at least 19/03/2026
19/03/2026
TeamPCP
Users of Trivy (Aqua Security), KICS (Checkmarx), LiteLLM, and Telnyx projects/packages
TeamPCP leveraged credentials stolen from Trivy, KICS, and LiteLLM supply chain attacks to infiltrate cloud environments. They rapidly validated secrets using TruffleHog, conducted AWS/GitHub reconnaissance, and exfiltrated massive datasets.
Account Takeover
Information/Communication
Cyber Crime
Global
Compromised Credentials
108
30/03/2026
Unspecified
Unspecified
Qilin (a.k.a. Agenda)
Dow Inc
The Qilin ransomware group claims to have breached the chemical manufacturing giant Dow Inc, after adding the company to its Tor data leak site.
Ransomware
Manufacturing
Cyber Crime
US
Unknown
109
30/03/2026
05/02/2026
05/02/2026
Unknown
Taxpayers in the U.S.
Researchers at Proofpoint observe a campaign impersonating the U.S. IRS. The lure purported to relate to the target’s recent IRS filing.
Remote Management Tool
Individual
Cyber Crime
US
Phishing Email
110
30/03/2026
Early February 2026
Early February 2026
TA4922
Organizations in Japan
Researchers at Proofpoint discover a TA4922 campaign targeting organizations in Japan with emails impersonating national tax authorities and claiming the recipient had unresolved tax obligations.
Malware
Multiple Industries
Cyber Crime
JP
Social Engineering
111
30/03/2026
Early March 2026
Early March 2026
TA4922
Organizations in Japan
Researchers at Proofpoint discover another TA4922 campaign targeting Japan and purporting to be from the "Inland Revenue Department." Messages include a URL which downloaded an executable, which, if executed, installed an information stealer
Malware
Multiple Industries
Cyber Crime
JP
Phishing Email
112
30/03/2026
During February 2026
During February 2026
TA2730
Customers of financial institutions
Researchers at Proofpoint reveal the details of a campaign carried out by the threat actor TA2730, targeting Switzerland and Canada.
Account Takeover
Finance & insurance
Cyber Crime
CA
CH
Phishing Email
113
30/03/2026
09/03/2026
09/03/2026
Unknown
Undisclosed organization(s)
Researchers at Proofpoint reveal the details of a campaign impersonating company executives, human resources, or vendor/supplier contacts in attempts to steal financial and personal data, likely with a goal of leveraging it for follow-on fraud.
Scam
Unknown
Cyber Crime
US
Social Engineering
114
31/03/2026
Early 2026
Early 2026
Chinese-nexus threat actor (linked to aliases/frameworks like Amaranth Dragon and ShadowPad)
Government entities in Southeast Asia
Check Point Research identify "Operation TrueChaos," a targeted espionage campaign exploiting a zero-day vulnerability (CVE-2026-3502) in the TrueConf video conferencing platform. Attackers compromised on-premises servers to distribute malicious updates to government entities in Southeast Asia, ultimately deploying the Havoc post-exploitation framework for reconnaissance and data theft.
Malware
Public Administration
Cyber Espionage
South Eastern Asian countries
Software Vulnerability
115
31/03/2026
Unspecified
Unspecified
Unknown
Unspecified organization(s)
Google releases security updates for its Chrome web browser to address 21 vulnerabilities, including CVE-2026-5281, a zero-day flaw that it said has been exploited in the wild.
Unknown
Unknown
Unknown
Unspecified
Software Vulnerability
116
31/03/2026
Since September 2025
During March 2026
Augmented Marauder (a.k.a. Water Saci)
Spanish-speaking users in organizations across Latin America and Europe
Researchers at BlueVoyant reveal that the Brazilian e-crime group Augmented Marauder launched a sophisticated campaign targeting Spanish-speaking organizations with Casbaneiro and Horabot malware.
Malware
Finance & insurance
Cyber Crime
Latin America
Social Engineering
117
31/03/2026
Since late February 2026
During March 2026
Unknown
General users and enterprise employees using WhatsApp on Windows systems.
Researchers at Elastic Security Labs identify a long-running, financially motivated operation (REF1695) active since late 2023. Using fake software installers as lures, the attacker deploys RATs, cryptominers, and custom implants like CNB Bot. Profits are generated via Monero mining and CPA fraud, utilizing advanced packing and evasion techniques to bypass defenses.
Malware
Information/Communication
Cyber Crime
Global
Rogue App
118
31/03/2026
Since at least late 2023
Since at least late 2023
REF1695
General Windows users seeking software installers
Researchers at Sophos discover a campaign targeting Belgium, India, and parts of North and South America that distributed a new variant of MacSync delivered through ClickFix lures. The latest iteration supports dynamic AppleScript payloads and in-memory execution to evade static analysis, bypass behavioral detections, and complicate incident response.
Malware
Multiple Industries
Cyber Crime
BE
IN
North America
South America
Social Engineering
119
31/03/2026
03/03/2026, 13/03/2026, and 23/03/2026
03/03/2026, 13/03/2026, and 23/03/2026
Iran-nexus threat actor with similarities to Gray Sandstorm nd Peach Sandstorm
Over 300 organizations in Israel and 25 in the UAE, primarily municipalities and government entities.
Researchers at Check Point reveal that an Iran-linked threat actor launched a large-scale password-spraying campaign targeting Microsoft 365 environments, primarily focusing on Israeli and UAE municipalities.
Account Takeover
Public Administration
Cyber Espionage
Cyber Warfare
AE
IL
Password-spraying
120
31/03/2026
Unspecified
Unspecified
NoVoice (Linked to the Android.Triada family)
Android mobile device users (specifically those using older/unpatched OS versions)
Researchers at McAfee discover "Operation NoVoice," an Android rootkit campaign infecting 2.3 million devices via 50+ Google Play apps. The malware uses polyglot images and hardware-specific exploits to gain root access, inject code into apps like WhatsApp, and survive factory resets. It primarily targets older, unpatched Android versions in developing regions.
Malware
Individual
Cyber Crime
NG
ET
DZ
IN
KE
Rogue App
121
31/03/2026
End of March 2026
End of March 2026
Unknown
Cisco
Cisco suffers a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to the company and its customers.
Account Takeover
Information/Communication
Cyber Crime
US
Compromised Credentials
122
31/03/2026
15/01/2026
31/01/2026
Unknown
Nacogdoches Memorial Hospital
Nacogdoches Memorial Hospital (NMH) notifies 250,000 people that their personal and health information was compromised in a data breach.
Unknown
Human Health
Cyber Crime
US
Unknown
123
31/03/2026
Between November 2025 and January 2026
Between November 2025 and January 2026
Unknown
European logistics, manufacturing, and technology organizations
Researchers at Group-IB’s Business Email detect a sustained Phantom Stealer delivery campaign targeting European logistics, manufacturing, and technology organizations.
Malware
Multiple Industries
Cyber Crime
EU
Phishing Email
124
31/03/2026
Unspecified
Unspecified
Russia-based threat actors
High-risk individuals working in government and politics, academia, journalism and the legal profession
The UK’s National Cyber Security Centre (NCSC) warns about an increase in targeted attacks against individuals using messaging apps including WhatsApp, Facebook Messenger and Signal.