Security researchers have identified PCPJack, a successor malware to the TeamPCP threat, actively stealing cloud secrets and credentials from organizations across financial services, software development, email platforms, and cryptocurrency operations.

Security researchers have identified a large-scale malware campaign distributing fake call history applications through the Google Play Store that compromised over 7.3 million users. The campaign, attributed to GoldFactory, leverages multiple malware variants including Gigabud RAT, MMRat, and Taotie to exfiltrate financial data and payment credentials from infected devices.

A comprehensive analysis of 25 million security alerts across professional service firms reveals a critical detection gap: organizations miss approximately one significant threat per week. The research identifies persistent blind spots in identifying Cobalt Strike, Meterpreter, Mimikatz, and StrelaStealer activity—tools favored by both criminal and nation-state threat actors.

Recent penetration testing campaigns have uncovered a critical gap in enterprise security strategies. AI systems are exhibiting security flaws that exceed the severity and exploitability of traditional software vulnerabilities. These findings challenge conventional risk assessment frameworks and demand immediate attention from security teams and business leaders responsible for AI deployments.

The Australian Cyber Security Center has issued a warning regarding ClickFix attack campaigns that distribute Vidar Stealer malware to Australian infrastructure organizations. ClickFix, also tracked as GlassWorm and associated with Infinity Stealer variants, uses social engineering and malicious redirects to compromise systems and exfiltrate credentials.

The threat landscape in 2026 demands a fundamental shift in how organizations approach security. Continuous Threat and Exposure Management at scale has evolved from an advanced practice to a baseline requirement for regulated firms in medical, legal, and accounting sectors.