Major Breaches and Takedowns
Today’s cybersecurity update outlines major data breaches, coordinated law enforcement operations, and renewed malware activity across multiple regions.
Authorities confirmed a large breach at Coupang, the takedown of the Cryptomixer laundering service, and reports of widespread malicious browser extensions and Android malware campaigns.
Today’s cybersecurity briefing also details the Coupang customer data exposure, the European action against Cryptomixer, and new findings on ShadyPanda extensions and Albiriox malware circulating on dark-web markets.
Tomiris expands toolkit with multi-language implants: new modules use Telegram and Discord for command-and-control and support broader post-exploitation workflows, with operations focused on diplomatic and governmental targets.
New Android RAT targets global banking and crypto apps: Albiriox combines remote control, accessibility abuse, and overlays, with over 400 hardcoded financial targets and early campaigns delivered through fake retail apps and phishing sites.
Police dismantle Cryptomixer laundering service: Swiss and German authorities seized infrastructure linked to over €1.3 billion in Bitcoin laundering, disrupting a mixer used by ransomware groups and wider criminal networks.
Coupang breach exposes data of millions in South Korea: 33.7 million accounts were compromised, and investigators are examining server logs pointing to a former employee amid renewed scrutiny of national data-protection controls.
Codex CLI bug allowed silent command execution via local config: CVE-2025-61260 let attackers embed malicious MCP entries in project repositories to trigger unprompted command execution, patched in version 0.23.0.
Seven-year browser extension campaign hits 4.3 million users: ShadyPanda-linked Chrome and Edge extensions deployed backdoors and surveillance modules, with some activated after years of legitimate behaviour.
SmartTube breach pushes malicious Android TV update: stolen signing keys enabled a tampered release containing a hidden library that fingerprinted devices and communicated with a remote backend.
Fake developer extensions deliver malware in ongoing campaign: at least 23 cloned or manipulated code-editor extensions used inflated statistics and evolving implants to deliver malware across major marketplaces.