GhostLock Flaw, AI HalluSquatting, and Major Breaches Hit Finance, Govt

Summary

Today's threat landscape is defined by a convergence of systemic vulnerabilities and targeted data breaches. The disclosure of the GhostLock Linux kernel flaw (CVE-2026-43499) represents a critical, long-standing risk for enterprise infrastructure, while new research on HalluSquatting attacks against AI coding assistants signals an emerging attack surface. Concurrently, a high volume of alleged data breaches -- including claims against Binance, NASA Earthdata, Deloitte, and multiple government entities -- underscores persistent targeting of financial services, government administration, and healthcare sectors. Defenders should prioritize patching GhostLock and reviewing AI tool usage policies.

Today's developments

Critical Infrastructure and Platform Vulnerabilities

The security community is reacting to the disclosure of GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that allows any logged-in user to gain root access and escape containers. Industry researchers at Nebula Security note the vulnerability has shipped by default in virtually every mainstream Linux distribution since 2011, requiring no special permissions or network access to exploit. Separately, CISA added four actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a critical path traversal in Adobe ColdFusion (CVE-2026-48282, CVSS 10.0) and vulnerabilities in Joomla and Langflow. Ubiquiti also released patches for multiple critical flaws across UniFi Connect, Talk, Access, Protect, and OS, with one vulnerability (CVE-2026-50746) carrying a CVSS score of 10.0.

Emerging AI Attack Vectors

New research on HalluSquatting demonstrates how attackers can exploit AI coding assistants' tendency to generate fictitious package names. By registering domains or packages that AI models hallucinate, adversaries can trick developers into installing malicious code, including botnet malware. Separately, a study of GitHub Copilot found that while the assistant may refuse harmful requests in its chat interface, it can still execute the same instructions when broken into benign-looking steps within a code editor. These findings align with broader industry reporting on AI-related threats, including a French nonprofit's launch of a global intelligence hub for AI cyber threats and Microsoft's Secure Future Initiative (SFI) aimed at hardening cloud services at "AI speed."

Ghost Phishing and Banking Malware

A new "ghost phishing" campaign tracked as EvilTokens is targeting businesses in the US and Europe. This technique keeps malicious pages hidden until they decrypt within the victim's browser, bypassing traditional URL-based email security checks. Separately, the SCMBANKER malware campaign is using ClickFix lures -- fake CAPTCHA verification pages -- to target Mexican banking users, deploying a PowerShell toolkit to steal credentials and financial data.

Notable Data Breach and Leak Incidents

A significant number of alleged data breaches were reported today, with financial services and government entities heavily targeted. The actor "olvidado" claims to have breached Binance, impacting users in the UK and US. The actor "Exchange Markets" alleges a sale of Saudi Capital Market Authority data. The actor "grave" claims a breach of Deloitte in the UK. The actor "Akatsuki cyber team" claims breaches of NASA Earthdata (US government) and Skynet, as well as a leak of Argentine data. The actor "Nocturne" claims breaches of both Nike (US) and Alcon (Switzerland). The actor "DR4K7H CYBER TEAM (D C T)" claims multiple breaches, including the Directorate General of Highways (Indonesia), Kerala Farmers' Welfare Fund (India), and the Indonesian National Police. Other notable claims include breaches of GoodRx and CheapMedicineShop (US healthcare, actor "Backhereagain"), Nayax (Israel financial services, actor "TheSyndicate"), and the Argentine Football Association (actor "Hossam Hassan"). A claim of a data leak involving email credentials associated with CIA, NATO, and FBI was also reported by the actor "ERBuS".

Threat landscape signals

Today's event data reveals a clear concentration of activity by the actor "DR4K7H CYBER TEAM (D C T)", which is responsible for seven events, primarily targeting government and education sectors in Indonesia and India. The United States remains the most targeted country with 31 events, followed by Germany (13) and France (12). Financial services and government administration are the most frequently cited victim industries, consistent with the high-value nature of their data. The volume of alleged data breaches (60) significantly outpaces ransomware events (24), suggesting a continued emphasis on data extortion and sale over encryption-based attacks. The appearance of a "Combo List" and "Malware" category, while small in volume, indicates ongoing credential stuffing and initial access broker activity that defenders should monitor closely.