Originally reported by Security Affairs, The Record
TL;DR
Weekly roundup covering Chrome's first 2026 zero-day, DNS-based ClickFix variants, major data breaches, and Russian tactical adaptations.
Includes actively exploited Chrome zero-day CVE-2026-2441, DNS-based ClickFix malware delivery, major data breaches (600K+ Canada Goose records, DavaIndia), and 500K+ VKontakte account hijacking via malicious extensions. Multiple active exploitation vectors.
Google released emergency patches for CVE-2026-2441, a high-severity use-after-free vulnerability in Chrome's CSS component actively exploited in the wild. The flaw represents the first zero-day exploitation targeting Chrome in 2026, continuing the browser's consistent position as a primary attack vector for sophisticated threat actors.
The CSS use-after-free bug allows attackers to execute arbitrary code through crafted web content, providing a reliable entry point for initial access campaigns. Google's Chrome security team has provided limited technical details, following their standard practice of restricting information until patch deployment reaches critical mass.
Microsoft's threat intelligence team identified a sophisticated ClickFix variant leveraging DNS infrastructure to deliver second-stage payloads. The technique deceives users into executing malicious nslookup commands through Windows Run dialog, retrieving malware through DNS TXT record queries.
This DNS-based approach represents tactical evolution beyond traditional ClickFix campaigns that relied on fake CAPTCHA prompts and error messages. The technique exploits trusted DNS resolution mechanisms while bypassing traditional web-based security controls, demonstrating adversary adaptation to defensive countermeasures.
DavaIndia Pharmacy, operated by Zota Health Care Ltd., suffered a critical security breach exposing customer data and providing full administrative system access to unauthorized actors. The incident affects one of India's largest pharmacy retail chains, specializing in affordable generic medicines across the subcontinent.
The breach scope includes customer personal information, transaction records, and potentially sensitive health data. Full administrative access suggests comprehensive system compromise, indicating either credential theft, privilege escalation, or fundamental access control failures.
Data extortion group ShinyHunters published over 600,000 Canada Goose customer records on their leak platform, though the luxury outerwear manufacturer disputes suffering a direct system breach. The discrepancy highlights ongoing challenges in breach attribution and third-party supply chain security.
Canada Goose's denial suggests potential exposure through partner systems, payment processors, or customer service platforms rather than core infrastructure compromise. The incident demonstrates how threat actors increasingly target peripheral systems to access primary target data.
Researchers identified a coordinated campaign using five malicious Chrome extensions to compromise over 500,000 VKontakte accounts. The extensions masqueraded as legitimate VK enhancement tools, providing theme customization and user experience improvements while secretly hijacking account access.
The campaign represents sophisticated social engineering combined with browser extension abuse, targeting Russia's dominant social media platform. Account takeover operations at this scale suggest either criminal monetization schemes or potential information operations targeting Russian social media discourse.
Ukraine's security service reported Russian forces attempting to recruit local assets for restoring access to blocked Starlink terminals, indicating significant tactical impact from SpaceX's geofencing restrictions. The recruitment efforts suggest Russian military units depend heavily on commercial satellite internet for operational communications.
The development highlights how commercial technology restrictions can create tactical vulnerabilities, forcing adversary adaptation through human intelligence networks rather than technical solutions. Russian efforts to circumvent Starlink blocks demonstrate the strategic value of commercial satellite internet in modern military operations.
TENG Co., Ltd., a Tokyo-based sexual wellness company, disclosed unauthorized access to employee email accounts potentially exposing customer names, email addresses, and order details. The incident affects a company with 125-200 employees worldwide, operating in sensitive consumer markets requiring enhanced privacy protections.
Email account compromise suggests either credential stuffing, phishing, or insider threat scenarios. The adult industry faces heightened targeting due to sensitive customer data that enables extortion and blackmail campaigns.
Originally reported by Security Affairs, The Record
