General
Critical
29 Apr
A sophisticated, memory-resident phishing campaign named BlobPhish is actively exploiting browser Blob URL APIs to silently steal user credentials. This attack, active since October 2024, targets Microsoft 365 users and major financial platforms. BlobPhish is particularly dangerous as it remains almost completely invisible to traditional security tools, fundamentally changing phishing page delivery. Source: Cybersecurity News
Why it matters: Indian organizations, especially those utilizing Microsoft 365 and online financial services, must be aware of this advanced phishing technique that bypasses conventional security measures.
General
Medium
29 Apr
New data from cyber insurance providers is empowering CISOs to better justify cybersecurity budgets. This data directly links security gaps to potential financial losses, a language boards understand. By presenting clear financial impact, CISOs can secure necessary resources to mitigate risks effectively. Source: Security Week
Why it matters: Indian organizations can leverage cyber insurance data to strengthen their cybersecurity investment proposals and improve overall resilience.
Government
High
29 Apr
US Cyber Command and NSA chief General Joshua Rudd warned that foreign adversaries are likely to target upcoming midterm elections. Gen. Rudd assured lawmakers of their readiness to support and safeguard these electoral processes. This emphasizes the persistent threat of state-sponsored cyber interference in democratic systems. Source: The Record
Why it matters: Indian organizations, especially government and election-related entities, should note this global trend of election interference and strengthen their own cyber defenses against similar threats.
General
High
28 Apr
A member of the alleged Chinese state-sponsored hacking group Silk Typhoon, Xu Zewei, has been extradited to the United States. He faces charges for orchestrating cyberattacks targeting US universities. This development underscores the persistent threat posed by state-backed actors to critical institutions globally. Source: Security Week
Why it matters: Indian organizations, particularly those in critical infrastructure and research, should remain vigilant against sophisticated state-sponsored cyber threats and enhance their defensive postures.
General
High
28 Apr
A vulnerability within Robinhood's systems was exploited, enabling attackers to send legitimate-looking emails that directed recipients to malicious phishing websites. Source: Security Week
Why it matters: Indian organizations must enhance their email security and user awareness training to defend against similar sophisticated phishing campaigns leveraging system vulnerabilities.
General
High
28 Apr
Threat actors are now documenting and sharing structured operational security (OPSEC) playbooks. These guides detail sophisticated techniques for maintaining anonymity and avoiding detection over long periods. Key strategies include layered infrastructure, strict identity separation, and advanced evasion tactics. Source: BleepingComputer
Why it matters: Indian critical infrastructure operators must understand these evolving threat actor OPSEC strategies to enhance their detection capabilities and strengthen defensive postures.
General
High
28 Apr
A 19-year-old dual US and Estonian citizen has been federally charged in the U.S. He was arrested in Finland earlier this month. The charges allege he was a prolific member of the notorious Scattered Spider hacking collective. Source: BleepingComputer
Why it matters: Indian organizations must remain vigilant against sophisticated threat actors like Scattered Spider, whose global activities can impact critical infrastructure and various sectors.
General
Medium
28 Apr
New research highlights secure data movement as a critical, often overlooked, bottleneck in Zero Trust program implementation. Many security programs incorrectly assume system connection solves the problem, leading to stalled initiatives. A recent report, 'Cyber360: Defending the Digital Battlespace,' details these challenges based on a survey of 500 security professionals. Source: The Hacker News
Why it matters: Indian organizations implementing or planning Zero Trust must address secure data movement challenges to avoid common pitfalls and ensure effective cybersecurity posture.
General
Critical
28 Apr
Threat hunters are warning about VECT 2.0 ransomware, which acts more like a wiper due to a critical flaw in its encryption implementation. This flaw renders recovery impossible across Windows, Linux, and ESXi variants, even for the threat actors themselves. The ransomware permanently destroys files larger than 131KB, making data unrecoverable for victims. Source: The […]
Why it matters: Indian critical infrastructure operators must update their defenses and backup strategies to counter VECT 2.0's irreversible file destruction capability across common platforms.
General
Critical
28 Apr
The state-sponsored Sandworm APT group has upgraded its intrusion tactics, now employing SSH-over-Tor tunnels for long-term, hidden access within victim networks. This new tradecraft represents a shift from simpler malware callbacks to a more anonymous and encrypted persistence mechanism. Security teams must enhance their detection capabilities to identify this sophisticated tunneling technique. Source: Cybersecurity News
Why it matters: Indian critical infrastructure operators must update their threat intelligence and enhance network monitoring to detect sophisticated SSH-over-Tor tunneling used by advanced persistent threat groups for stealthy, long-term access.
General
High
28 Apr
Chinese-backed services are orchestrating large-scale smishing campaigns globally. These operations leverage everyday messaging apps and SMS to steal personal and financial credentials. Recognized as highly organized and active, these phishing-as-a-service threats pose a significant risk in the current cyber landscape. Source: Cybersecurity News
Why it matters: Indian organizations must enhance employee awareness and implement robust technical controls against sophisticated smishing attacks targeting credentials via messaging platforms.
General
High
28 Apr
The China-based Silver Fox threat group is conducting a new campaign targeting Asian businesses and individuals. They employ fake tax audit notifications and counterfeit software update alerts to distribute dangerous malware. This campaign highlights a significant increase in social engineering attacks exploiting trust in official-looking communications. Source: Cybersecurity News
Why it matters: Indian organizations must educate employees on social engineering tactics, verify official communications, and maintain updated security software to defend against similar malware delivery campaigns.
General
High
28 Apr
A newly discovered PhantomRPC technique allows privilege escalation to System on Windows. This method involves a fake RPC server impersonating target services to elevate access. Currently, there is no official patch available to address this critical vulnerability. Source: Security Week
Why it matters: Indian organizations using Windows systems must be aware of this unpatched privilege escalation risk and monitor for potential exploitation or mitigation strategies.
General
High
28 Apr
Vulnerabilities have been identified in Zero Motorcycles electric motorcycles and Yadea electric scooters. These flaws expose the vehicles to hacking risks, potentially compromising physical security. Such exploits could lead to significant safety concerns for riders. Source: Security Week
Why it matters: Indian organizations, particularly those in the transport sector or involved with connected vehicles, must be aware of these emerging risks to ensure future safety and security.
General
High
28 Apr
AI advancements, exemplified by Anthropic's Claude Mythos, are rapidly closing the traditional exploit window for vulnerabilities. This means organizations have less time to patch and protect systems after a vulnerability disclosure before exploits emerge. Network Detection and Response (NDR) solutions are becoming crucial to contain threats when patching alone is insufficient. Source: The Hacker News
Why it matters: Indian organizations must adapt their cybersecurity strategies to this shrinking exploit window, prioritizing faster response and advanced detection like NDR to counter AI-accelerated threats.
General
Critical
28 Apr
Cybersecurity researchers have revealed a critical unpatched vulnerability in Hugging Face's open-source LeRobot robotics platform. Tracked as CVE-2026-25874 with a CVSS score of 9.3, this flaw allows unauthenticated remote code execution due to untrusted data deserialization. The platform, with nearly 24,000 GitHub stars, remains vulnerable to potential exploitation. Source: The Hacker News
Why it matters: Indian organizations utilizing the Hugging Face LeRobot platform or similar open-source robotics solutions must identify their exposure and prepare to apply patches immediately upon release to prevent critical remote code execution.
General
Critical
28 Apr
A significant software supply chain attack compromised the popular Python package elementary-data on PyPI. Threat actors pushed a malicious version (0.23.3) and poisoned matching Docker images, exposing thousands of developers to credential theft. This widely used package, with over one million monthly downloads, poses a substantial risk to users. Source: Cybersecurity News
Why it matters: Indian organizations using Python and PyPI packages must audit their environments for elementary-data and related Docker images to prevent credential theft and supply chain compromise.
General
High
28 Apr
The Indian government, through CERT-In, has cautioned MSMEs and other organizations to prepare for advanced AI-driven cyber threats. CERT-In highlighted that powerful AI systems significantly reduce the barrier for malicious actors, enabling faster, cheaper, and more automated attacks. This advisory underscores the urgent need for organizations to adapt their cybersecurity strategies to counter these evolving […]
Why it matters: Indian organizations must proactively enhance their cybersecurity defenses and strategies to counter the increasing sophistication of AI-enabled cyber threats highlighted by CERT-In.
General
High
28 Apr
CERT-In has issued an advisory (CIAD-2026-0020) highlighting significant cybersecurity risks posed by advanced 'frontier AI' models. The national agency warns that these emerging AI technologies are capable of creating new and complex cyber threats. The advisory urges organizations to be vigilant and prepare for potential high-severity incidents stemming from AI vulnerabilities. Source: Zeebiz
Why it matters: Indian organizations must heed CERT-In's warning, assess their exposure to AI-related cyber risks, and implement robust security measures to protect critical infrastructure.
General
High
28 Apr
A new GlassWorm malware campaign is actively targeting the OpenVSX ecosystem. This campaign leverages 73 'sleeper' extensions designed to become malicious after an update. Organizations using OpenVSX should immediately review their installed extensions for potential compromise. Source: BleepingComputer
Why it matters: Indian organizations utilizing OpenVSX or similar development environments must audit their extensions to prevent supply chain attacks from this evolving threat.