This Week in Cybersecurity #31

CyberHub Podcast Weekly Roundup: The Third-Party Risk Apocalypse, From French Soccer to Financial Institutions - Vendor Breaches, Nation-State Operations, and the Week That Proved Trust Is Dead

Good morning, Security Gang!

If there was ever a week that definitively proved trust without verification is just negligence with better marketing, this was it. From sports federations to financial institutions, from beer manufacturers to crypto exchanges, from educational platforms to aerospace systems—every sector took hits this week, and the common denominator is unmistakable: third-party vendor risk. We witnessed 74 U.S. banks compromised through a single marketing vendor (Marquis), Salesforce cutting off Gainsight mid-integration after detecting suspicious API activity, Comcast paying $15 million for a breach at a vendor they’d stopped working with two years prior, and developer ecosystems bleeding 400,000 secrets through supply chain malware.

Meanwhile, North Korea demonstrated that crypto exchanges remain ATMs for weapons programs, state actors tried to weaponize AI platforms for automated fraud campaigns, and the largest DDoS attack in history peaked at 29.7 terabytes per second. This isn’t just another bad week in cybersecurity—it’s a referendum on how we’ve fundamentally misunderstood where our attack surface actually exists.

Let’s break down the carnage, the lessons, and what you need to do right now—coffee ready, Security Gang, because this one’s a marathon.

🚨 MAJOR DATA BREACHES & RANSOMWARE

Marquis Breach Impacts 74 U.S. Financial Institutions

In what may be the most significant vendor breach of the year, Marquis, a marketing and analytics vendor serving financial institutions, confirmed unauthorized access that exposed customer data across 74 U.S. banks and credit unions. First discovered in August 2025, the breach exposed names, contact information, account metadata, and partial Social Security numbers—a perfect recipe for identity theft, account takeover, and wire fraud.

Marquis delayed disclosure for months while cooperating with law enforcement and notifying regulators across multiple states. Early reports suggest the Akira ransomware gang may have been involved, though this hasn’t been officially confirmed. What makes this breach particularly alarming is that Community First Credit Union briefly posted—then deleted—a filing indicating Marquis had paid a ransom to prevent data leaks. Even when you’re not the direct victim, your vendor decisions define your risk exposure.

James’s warning is stark: “In the financial sector, zero room for error — your weakest vendor is your biggest exposure.”

Coupang Breach Impacts 33.7 Million Customers

South Korea’s largest online retailer, Coupang (a U.S.-based firm with nearly $30 billion in annual revenue), disclosed a breach impacting 33.7 million customers—not the initially feared 337 million, but still catastrophic. Attackers accessed customer identifiers including names, emails, phone numbers, and order metadata. Payment card details were reportedly not compromised.

The incident occurred in June 2025 but wasn’t fully confirmed until November 18th, after what initially seemed like 4,500 compromised accounts ballooned into tens of millions. The timing—right before the holiday shopping season—amplifies business disruption through fraud waves, refund scams, and loyalty theft.

As James noted: “This one’s not just another breach. It’s a case study in how digital retail operations become national infrastructure, and how poor timing before the holidays can amplify business disruption.”

Asahi Beer Breach Affects 1.5 Million Customers

Japanese beverage giant Asahi Group Holdings disclosed a massive data breach following the Kalinin ransomware campaign that impacted 1.5 million customers, partners, and employees. While payment data wasn’t exfiltrated, attackers leaked personal contact details and internal communications on dark web forums. The breach also included employee and family records, highlighting how supply chain attacks spill beyond core business systems.

Two months after the initial compromise, Asahi is still struggling to restore systems—proof that manufacturing and production environments are painfully slow to recover after ransomware events. If you’re in manufacturing, this is your wake-up call: lock down shared credentials, segment production systems aggressively, and deploy immutable backups that ransomware operators can’t overwrite.

University of Pennsylvania Oracle EBS Breach

The University of Pennsylvania (UPenn) confirmed it was affected by the Oracle E-Business Suite (EBS) exploit—the same attack chain behind recent corporate extortion waves. Attackers exploited an unpatched Oracle EBS instance to exfiltrate employee, vendor, and payment data, creating potential for invoice fraud and spear phishing.

James called this “legacy system fatigue“—systems too critical to decommission but too old to defend easily. When elite universities keep getting compromised, it signals a fundamental problem with how we manage enterprise resource planning (ERP) security.

Freedom Mobile Confirms Customer Data Breach

Canada’s Freedom Mobile, the nation’s fourth-largest carrier with over 2.2 million customers, confirmed unauthorized access exposing contact and billing information. While no payment card data was confirmed stolen, the real risk lies in SIM-swapping and account takeover—attackers can use this information to impersonate customers and bypass two-factor authentication at banks and fintech apps.

This is Freedom’s second data breach, following a 2019 vendor incident. In a competitive telecom market, another misstep could send customers—and revenue—fleeing permanently.

Leroy Merlin, Askul, and French Soccer Federation

• Leroy Merlin (French home improvement retailer) exposed customer contact and loyalty data across multiple countries, though decent data segmentation limited the blast radius

• Askul (Japanese office supply giant) is slowly recovering from October ransomware that forced customers to submit orders by fax, creating permanent customer loss as buyers switched to competitors

• French Soccer Federation (FFF) suffered a breach exposing member registration data and contact details through an exposed administrative system used by regional clubs—data that can be weaponized for match-fixing and insider betting ahead of the 2026 World Cup

James emphasized: “Sports organizations aren’t just games — they’re billion-dollar data operations, and hackers know it.”

💼 VENDOR RISK & THIRD-PARTY COMPROMISES

Salesforce Restricts Gainsight Access After Suspicious Activity

Salesforce revoked access for Gainsight applications following detection of anomalous API activity tied to customer integrations. The move disrupted data synchronization for multiple organizations as both companies jointly investigate possible data exfiltration via connected apps.

This incident exposes a larger SaaS-to-SaaS supply chain issue—integrations between platforms often carry excessive OAuth permissions, creating silent exposure points. Gainsight confirmed that several partner integrations, including Gong and HubSpot, temporarily disabled API connections as a precaution.

CISOs must audit all Salesforce-connected apps, remove unused integrations, and monitor for mass API exports or report downloads. Supply chain trust ends where visibility ends.

Comcast Fined $15 Million Over Vendor Breach

Comcast will pay a $15 million regulatory fine after third-party debt collection vendor Financial Business and Consumer Solutions (FBCS) exposed data belonging to 270,000 customers. Here’s the kicker: Comcast had stopped working with FBCS two years before the compromise, but the vendor retained old customer data.

James’s assessment: “Third-party vendors are the soft underbelly of modern enterprise security — and regulators are catching up fast.”

Despite FBCS filing for bankruptcy after the breach, regulators fined Comcast for failing to enforce vendor data retention and deletion obligations. This is the latest warning shot emphasizing that organizations must ensure contracts include data destruction clauses, 72-hour breach reporting, and right-to-audit provisions for all third-party data processors.

OpenAI Mixpanel Analytics Exposure

OpenAI disclosed that a Mixpanel analytics integration inadvertently exposed user metadata, including API keys, email addresses, and usage logs. No model weights or chat histories were compromised, but leaked telemetry could be used to target specific organizations using OpenAI’s enterprise API.

This breach highlights the blind spot in AI stack security—telemetry data often reveals who is using AI, how, and for what purpose, creating intelligence value for attackers. Companies should scrub sensitive data from analytics streams and restrict egress traffic to vendor endpoints.

Illuminate Education FTC Consent Order

Illuminate Education (EdTech vendor that suffered a 2021 breach) agreed to an FTC consent order following a multiyear investigation. The FTC found the company failed to address known vulnerabilities reported as early as 2020, leading to exposure of student data including emails, birth dates, and health records.

While no financial penalty was issued, the settlement imposes strict data retention/deletion policies, mandates a comprehensive information security program, and requires FTC notification of any future breaches. This reinforces that data security negligence in K-12 and EdTech isn’t just bad PR—it’s regulatory liability.

💰 FINANCIAL CRIMES & CRYPTOCURRENCY

North Korea’s $30M Upbit Exchange Hack

South Korean authorities confirmed that North Korea’s Lazarus Group stole $30 million from the Upbit cryptocurrency exchange. The attack used social engineering, seed phrase theft, and rapid laundering through OTC channels—coming just one day after Korean tech giant Naver finalized a $10 billion crypto platform acquisition.

Investigators say the operation matches the revenue-generation model North Korea relies on to fund weapons programs. Upbit promised to reimburse all losses, but this continues the trend of crypto confidence erosion.

James warned: “If you’re in the crypto world, you’re already on North Korea’s radar — this isn’t random theft, it’s a state-run revenue stream.”

$29 Million Bitcoin Seized from Crypto Mixer

In Operation Olympia, authorities in Germany and Switzerland, supported by Europol, dismantled a crypto mixing service allegedly used to launder €1.3 billion ($1.5 billion) in illicit funds. Officials seized three servers, 12 terabytes of data, and $29 million in Bitcoin, along with the mixer’s web domain.

While the seizure represents only a fraction of laundered funds, the real value is the transaction data and patterns investigators now control—expect follow-on arrests as agencies trace money trails through other mixers and wallets.

🕵️ SUPPLY CHAIN & DEVELOPER SECURITY

Shai Hulud 2.0 Exposes 400,000 Developer Secrets

The Shai Hulud 2.0 malware campaign unleashed chaos across the developer ecosystem, compromising over 30,000 GitHub repositories and leaking 400,000 secrets—including SSH keys, tokens, and cloud credentials. The malware propagated through malicious NPM packages using typosquatting and impersonation to infiltrate CI/CD pipelines.

Once installed, it harvested environment variables, GitHub credentials, and private package data—some still valid. This attack shows how quickly supply-chain malware evolves and how little margin for error exists in developer ecosystems.

GlassWorm Returns in Third Wave

The GlassWorm malware campaign resurfaced for a third wave, deploying malicious Visual Studio Code extensions disguised as legitimate utilities. Once installed, these extensions steal credentials, inject scripts, and plant post-installation payloads.

With developer workstations and CI/CD pipelines being prime targets, teams should disable marketplace installs, maintain internal mirrors of vetted extensions, and rotate Personal Access Tokens (PATs) regularly. The goal isn’t quick disruption—it’s infiltration of developer supply chains for long-term persistence.

ShadyPanda Browser Extensions Hijack 4.3 Million Users

The ShadyPanda campaign infected over 4.3 million users through malicious Chrome extensions masquerading as utilities like “Clean Master” or “File Helper.” These extensions exfiltrate data, harvest cookies, and inject ads, targeting primarily finance and sales professionals.

The extensions’ near-perfect 4.8-star ratings helped them evade detection—a reminder that user trust is the easiest exploit vector. Companies should implement managed browser policies, block unknown publishers, and enforce extension allowlists.

GitLab Leak Reveals 17,000 Active Secrets

A public scan of GitLab repositories uncovered over 17,000 live secrets, including API keys, database passwords, and cloud credentials for AWS, Slack, Google Cloud, MongoDB, and Telegram bots—many still valid.

Enterprises must immediately deploy automated secret scanning, rotate all discovered credentials, and move secrets into managed vault systems with short TTLs.

Zendesk Phishing Campaign

A sophisticated phishing campaign is exploiting Zendesk customer support environments to steal data and hijack agent sessions. Attackers infiltrate ticketing portals, inserting malware links and malicious scripts into legitimate threads.

Compromised agent accounts can send malicious auto-replies, spreading infections and tarnishing brand trust. Security teams should enforce SSO with MFA, IP allowlisting for admin access, and file attachment scanning.

🔥 CRITICAL VULNERABILITIES & EXPLOITATION

Android December Patch: Two Active Zero-Days

Google’s December 2025 Android security update patched two actively exploited zero-days:

• CVE-2025-48633 (privilege escalation in Framework)

• CVE-2025-48572 (WebView/Chromium drive-by exploit)

Both were added to CISA’s KEV catalog within hours of disclosure. Fun fact: Israel recently banned Android devices for all military leadership due to ongoing Iranian targeting campaigns—showing how serious these exploits have become in nation-state espionage.

Fortinet FortiWeb Under Active Exploitation

Researchers confirmed that two critical FortiWeb flaws—CVE-2025-64446 and CVE-2025-58034—are being actively exploited in the wild. These bugs allow unauthenticated command injection and bypass of administrative authentication, enabling attackers to hijack devices, steal credentials, and pivot internally.

Internet-facing FortiWeb appliances should be immediately upgraded or segmented behind firewalls.

Microsoft LNK Exploit (CVE-2025-9491)

Microsoft quietly mitigated an actively exploited LNK vulnerability that allowed malicious shortcut files to execute arbitrary code through simple user interaction. The flaw, exploited for years by multiple APTs, was identified by Trend Micro’s ZDI.

Attackers used specially crafted .lnk files to execute malware while displaying harmless properties to users. Monitor for script execution events linked to shortcut files.

CISA Adds PLC SCADA Vulnerability to KEV

CISA added a 2021 cross-site scripting vulnerability (CVE-2021-26829) in OpenPLC SCADA BR systems to its KEV catalog after observing active exploitation by pro-Russian hacktivist group Tunet targeting critical infrastructure honeypots. The vulnerability affects both Windows and Linux builds, allowing remote configuration alterations.

Chrome 143 High-Severity Fixes

Google released Chrome version 143, patching several high-severity vulnerabilities including a V8 JavaScript engine type confusion bug (CVE-2025-13630). Organizations should push updates immediately, as remote code execution through browser exploits remains one of the easiest endpoint compromise methods.

🤖 AI SECURITY & EMERGING THREATS

Factory AI Platform Disrupted in State-Linked Attack

AI startup Factory, which provides AI-driven campaign management tools, suspended operations after identifying a state-linked intrusion on its software development environment. Attackers reportedly tried to repurpose Factory’s platform to run automated fraud and misinformation campaigns.

The company says at least one China-based state actor used AI agents to modify Factory’s defenses in real-time, essentially turning the system into a self-defending botnet controller. This is another reminder that AI infrastructure itself is becoming a strategic cyber weapon.

AI-Powered Phishing Targets Google and Facebook Ads

Threat actors are exploiting Calendly meeting invites and OAuth SSO flows to steal credentials for Google and Meta ad manager accounts. The phishing emails—crafted with ChatGPT and AI code generation tools—impersonate over 75 global brands and redirect users to adversary-in-the-middle (AitM) pages that harvest authentication tokens.

This is a high-value pivot: attackers aren’t just stealing access; they’re running scam ad campaigns using victims’ budgets. Defenders should enforce browser isolation for OAuth workflows and restrict third-party calendar integrations.

AI Cloud Skills Exploited for Ransomware

Researchers discovered that AI workflow platforms, such as Anthropic’s Cloud Skills, can be abused as ransomware delivery mechanisms. Attackers create booby-trapped AI integrations that exfiltrate data or trigger unintended account actions when granted broad permissions.

These malicious AI automations—essentially “rogue agents”—can act as data exfil bots or internal disruptors once embedded in enterprise systems. Review AI skill permissions, restrict API access, and enforce scoped OAuth grants.

🌍 NATION-STATE OPERATIONS & GEOPOLITICS

Iranian MuddyViper Malware Targets Israel and Egypt

Researchers at ESET uncovered a long-term Iranian phishing campaign targeting Israel and Egypt’s tech, local government, and manufacturing sectors. The group, linked to Iran’s Ministry of Intelligence, deployed a new backdoor called MuddyViper that steals credentials, exfiltrates files, and executes shell commands.

What’s notable: they used Telegram and Discord for command-and-control—proof that consumer apps have become covert channels for cyber operations. The campaign lasted nearly six months, blending fake document decoys with precision social engineering.

North Korea’s IT Worker Identity Scam

North Korean hackers are renting Western engineer identities to secure remote jobs at major tech companies. In exchange for 20-35% of contract payments, “identity brokers” allow DPRK operatives to pass verification checks and gain legitimate employment under fake names.

Once hired, they access source code, infrastructure credentials, and client networks. These actors use AI-generated deepfake interviews and voice synthesis to evade detection.

James’s warning: “Warning: you will get found, you will get arrested, you will go to jail. Not worth it. Don’t do it. And don’t hire someone who doesn’t show up on camera. Also, kind of important.”

Ukraine-Aligned Hackers Breach Russian Aerospace

Pro-Ukrainian groups claim to have infiltrated multiple Russian aerospace organizations, exfiltrating sensitive engineering data. These operations mix hack-and-leak tactics with denial-of-service attacks designed to cripple production lines—viewed as “pre-ceasefire leverage” to force favorable negotiations.

Chinese Front Companies in Cyber Operations

Investigations revealed that Chinese front companies—posing as private firms—are being used to buy infrastructure, hire contractors, and fund cyber operations linked to the Ministry of State Security (MSS). These entities act as intermediaries, allowing the MSS to conduct espionage under commercial covers.

This should push enterprises to enhance vendor intelligence and payment flow monitoring, especially when engaging “research” firms or subcontractors in China. Remember: in China, there’s no such thing as a truly private company—everything ultimately serves the state.

U.S. Offers $10M Bounty for Iranian Operatives

The U.S. Department of State is offering $10 million rewards for the capture of two Iranian cyber operators tied to the IRGC’s Shahid Shustari Unit—accused of targeting U.S. elections, energy infrastructure, and businesses. The bounty is part of a broader push to deter state-sponsored hacking through public exposure and financial incentives.

🏛️ REGULATORY & LEGAL DEVELOPMENTS

California Browser Privacy Law

California passed a new amendment to the California Consumer Privacy Act (CCPA) mandating web browsers provide a single-click opt-out control for all state residents. The law takes effect in January 2027, effectively forcing nationwide adoption as most companies will apply changes universally.

This is expected to create a new baseline standard for digital privacy, pushing other states to harmonize compliance frameworks and potentially triggering federal privacy debates.

Arizona Sues Temu for Alleged Spyware Behavior

The Arizona Attorney General filed a landmark lawsuit against Temu, alleging its shopping app acts as spyware, collecting far more data than needed for legitimate business purposes—including location, contacts, and sensor data.

According to the complaint, Temu can “detect when a user visits a doctor’s office, a church, or a political event,” calling it the gravest violation of Arizona’s Consumer Fraud Act in history. For CISOs managing BYOD environments, this raises red flags about banning high-risk foreign apps from devices accessing corporate data.

India Drops Cybersecurity App Mandate

India’s government reversed its decision to mandate installation of the Sanchaar Sathi cybersecurity app on all new smartphones after backlash from privacy advocates and foreign manufacturers. The app, which allowed government tracking and remote device disabling, was framed as anti-fraud but drew criticism for state surveillance risks.

Multinationals operating in India avoid immediate compliance headaches, but the whiplash highlights a volatile regulatory environment that could resurface with quieter implementation later.

Russia Expands WhatsApp Restrictions

Russia introduced new limits on WhatsApp’s features, reportedly degrading or blocking access to push users toward state-approved alternatives. This is part of Russia’s broader effort to build a “sovereign internet”—a national network detached from Western infrastructure.

For global firms still operating in Russia, these restrictions disrupt workforce and supplier communications, increase BYOD risks, and fuel shadow IT adoption.

Vanity Fair France GDPR Fine

The French privacy regulator CNIL fined Vanity Fair France €750,000 for violating cookie consent and data transparency rules under GDPR. The fine was relatively small but represents renewed focus on ad tracking and consent banner enforcement, with CNIL signaling escalating actions in 2026.

💥 INFRASTRUCTURE & OPERATIONAL IMPACTS

Largest DDoS Attack in History: 29.7 Tbps

Cloudflare confirmed the largest-ever distributed denial-of-service (DDoS) attack—a 29.7 terabit-per-second onslaught driven by the Asiyra botnet. The attack combined UDP amplification and reflection, hitting 15,000 destination ports simultaneously while generating 14 billion packets per second.

The scale dwarfs the previous 22 Tbps record. Cloudflare mitigated the event without customer downtime, but the message is clear: DDoS volumes are escalating exponentially, and botnets composed of millions of IoT devices are the new digital artillery.

Airbus A320 Software Recall

Airbus initiated a software retrofit for its A320 family after a mid-air incident involving a JetBlue flight prompted safety concerns. The recall involved reverting flight software governing the nose angle system to an earlier stable version.

What makes this significant from a cyber perspective: the retrofit required physical installation using data loader devices to ensure no network interference—a textbook example of secure OT patch management in mission-critical environments. Each aircraft had to be updated individually, creating huge operational bottlenecks during busy travel periods.

As James noted: “If you ever need to explain why patching isn’t as easy as ‘just push an update,’ this Airbus retrofit is your analogy. It’s aviation’s version of a CVE with real-world consequences.”

Australian “Evil Twin” Wi-Fi Hacker Sentenced

An Australian man dubbed the “Evil Twin Wi-Fi Operator” was sentenced to seven years in prison for setting up rogue access points on airplanes and in airports using Wi-Fi Pineapple devices. He cloned legitimate SSIDs like “Qantas Wi-Fi” and “Airport Free Wi-Fi” to intercept passenger traffic and capture credentials.

The arrest underscores the growing threat of man-in-the-middle attacks in transient networks. Travelers should avoid unverified Wi-Fi, use VPNs, and disable auto-connect features.

🎯 MALWARE & ATTACK TECHNIQUES

Google Meet ClickFix Attacks

A new ClickFix attack campaign is spreading malware using fake Google Meet or Docs update prompts. Victims see realistic full-screen browser overlays asking them to “update Google security settings,” which then triggers PowerShell payloads.

The attack combines social engineering, credential theft, and local privilege escalation. Organizations should block unsigned installers, enforce non-admin privileges, and enable AMSI script logging to detect malicious browser-initiated scripts.

✅ YOUR COMPREHENSIVE ACTION LIST

IMMEDIATE VENDOR RISK ACTIONS (This Weekend):

• 🏦 Financial institutions - If using Marquis, treat all data as exposed; rotate API keys and SFTP credentials; increase velocity limits for wire transfers

• ☁️ Salesforce users - Audit ALL connected apps; remove unused integrations; monitor for mass API exports; review OAuth permissions for Gainsight, Gong, HubSpot

• 📜 All organizations - Add mandatory data destruction clauses, 72-hour breach reporting, and right-to-audit provisions in ALL vendor contracts

• 🔍 Conduct vendor security assessments - Don’t rely solely on SOC 2 reports; validate controls actively

• 🧱 Segment vendor access - Use dedicated environments, APIs, or data feeds that limit exposure if vendor compromised

BREACH RESPONSE & MONITORING:

• 🛍️ Retail/E-commerce - Monitor for refund scams, loyalty theft, account takeover attempts (Coupang, Leroy Merlin patterns)

• 📱 Telecom/Mobile - Enforce port-out PINs; disable remote SIM swaps without MFA confirmation (Freedom Mobile lesson)

• ⚽ Sports organizations - Enforce MFA; reset admin credentials; block lookalike domains (FFF breach)

• 🏫 Education sector - Review EdTech vendor compliance; implement FTC-mandated security programs (Illuminate case)

• 🍺 Manufacturing - Lock down shared credentials; segment production systems; deploy immutable backups (Asahi recovery)

DEVELOPER & SUPPLY CHAIN SECURITY:

• 💻 Quarantine compromised systems - Any that downloaded Shai Hulud 2.0, GlassWorm, or ShadyPanda packages

• 🔑 Rotate ALL developer secrets - SSH keys, tokens, PATs, cloud credentials from GitLab leak

• 🧩 Implement secret scanning - Automated scanning with commit hooks preventing secrets from being pushed

• 🛡️ VS Code security - Disable marketplace installs; maintain internal mirrors; enforce publisher provenance

• 🌐 Browser extensions - Implement managed policies; block unknown publishers; enforce allowlists

• 📊 Dependency management - Pin versions; restrict installs to vetted mirrors; scan for typosquatting

CRITICAL VULNERABILITY PATCHING:

• 📱 Android devices - Push December patches IMMEDIATELY (CVE-2025-48633, CVE-2025-48572 actively exploited)

• 🧱 Fortinet FortiWeb - Patch CVE-2025-64446/CVE-2025-58034 or segment behind firewalls URGENTLY

• 🪟 Windows systems - Deploy LNK exploit patches (CVE-2025-9491); monitor script execution events

• 🌐 Chrome browsers - Update to version 143 org-wide for V8 engine fixes

• 🏭 SCADA/ICS - Patch OpenPLC BR CVE-2021-26829; restrict to internal networks only

• 🧠 Oracle EBS - If not already patched, prioritize immediately; restrict via VPN/IP allowlists

CRYPTOCURRENCY & FINANCIAL CONTROLS:

• 💰 Crypto exchanges - Strengthen seed phrase security; monitor for North Korean Lazarus TTPs

• 🔐 Multi-sig enforcement - Require multiple approvals for large transfers

• 📊 Transaction monitoring - Watch for laundering patterns through mixers

• 🚨 Incident response - Prepare for rapid asset freezing and law enforcement coordination

AI SECURITY GOVERNANCE:

• 🤖 Audit AI integrations - Review all AI skill permissions; restrict API access; enforce scoped OAuth

• 🧠 Monitor AI systems - Watch for autonomous agent modification; isolate training environments

• 📊 Scrub analytics streams - Remove sensitive data from telemetry to prevent intelligence gathering (OpenAI Mixpanel lesson)

• 🔒 Code-signing pipelines - Enforce for all AI platform deployments

IDENTITY & ACCESS MANAGEMENT:

• 🎯 Phishing-resistant MFA - Enforce FIDO2/app-based everywhere, especially financial and support systems

• 🔐 Credential rotation - Rotate all credentials shared with compromised vendors

• 👤 Video verification - Require video for ALL remote hires to prevent North Korean IT worker scams

• 📲 SIM swap protection - Implement port-out PINs; verify identity changes via multiple channels

• 🚪 Least privilege - Review and restrict vendor access to absolute minimum necessary

NETWORK & INFRASTRUCTURE:

• 🌊 DDoS preparedness - Review mitigation SLAs; ensure DNS redundancy; validate upstream filtering

• 🛡️ Segment aggressively - Separate production, OT, and vendor access zones

• 🔒 VPN enforcement - Require VPN + MFA for all remote access, especially ERP systems

• ✈️ Travel security - Ban unverified Wi-Fi; enforce always-on VPNs for traveling employees

COMPLIANCE & REGULATORY PREPARATION:

• 🌐 California browser opt-out - Begin implementing privacy-by-design ahead of January 2027 deadline

• 🧒 Child data compliance - Review COPPA requirements if operating in education or youth sectors

• 📋 GDPR cookie consent - Verify implementation; ensure explicit opt-in is functional

• 🇮🇳 India operations - Monitor for MDM compliance changes despite app mandate reversal

• 🇷🇺 Russia communications - Transition to managed secure messaging; prepare for further WhatsApp restrictions

THREAT HUNTING & DETECTION:

• 🕵️ Hunt for nation-state TTPs - Iranian MuddyViper, North Korean Lazarus, Chinese MSS front companies

• 🔍 Monitor support systems - Zendesk, ticketing platforms for malicious thread injection

• 📡 Watch OAuth flows - Adversary-in-the-middle attacks on calendar/meeting invites

• 🧱 SCADA/ICS monitoring - Pro-Russian Tunet group targeting critical infrastructure

• 💻 LNK file execution - Hunt for malicious shortcut abuse patterns

MOBILE & ENDPOINT SECURITY:

• 📱 BYOD risk assessment - Ban high-risk apps like Temu from corporate devices

• 🔒 MDM enforcement - Isolate business data from personal use; implement device attestation

• 🚫 Block suspicious apps - Implement app reputation and app store vetting

USER EDUCATION & AWARENESS:

• 🎣 ClickFix training - Educate on fake update prompts (Google Meet, browser updates)

• 💻 AI-crafted phishing - Train staff to recognize ChatGPT-generated lures

• 📧 Calendly/OAuth phishing - Brief teams on meeting invite and SSO exploitation

• 🌍 Evil Twin Wi-Fi - Educate travelers on rogue access point risks

STRATEGIC GOVERNANCE:

• 📊 Board briefings - Use Marquis, Comcast cases to educate on vendor risk materiality

• 💼 Insurance review - Ensure cyber liability covers vendor-related incidents

• 🤝 Vendor accountability - Renegotiate contracts; establish clear breach notification SLAs

• 📈 Metrics evolution - Track vendor risk exposure, not just internal vulnerabilities

• 💰 Budget advocacy - Reference James’s “How ARR Became King” article series at cyberhubpodcast.com to explain subscription model impacts on security budgets

🧠 JAMES AZAR’S CISO TAKE

What ties all of today’s stories together is the complete dissolution of trust boundaries in modern digital operations. From the Marquis vendor breach impacting 74 financial institutions to Salesforce cutting off Gainsight mid-integration, from Comcast paying $15 million for a vendor they’d stopped working with years ago to developers bleeding 400,000 secrets through supply chain malware—every story this week proves the same fundamental truth: your security perimeter is defined by your weakest vendor relationship, not your strongest firewall. The Marquis breach is particularly instructive because it demonstrates how a single marketing analytics vendor can become a systemic risk across an entire industry sector. Community First Credit Union’s deleted filing suggesting ransom payment shows that even when you’re not directly breached, vendor decisions can force impossible choices. Meanwhile, regulatory bodies are catching up fast—Comcast’s $15 million fine establishes that you remain liable for vendor data handling even after contracts end, fundamentally changing how we must think about data lifecycle management and vendor offboarding.

The second major theme is the fusion of human trust exploitation with machine-scale automation. North Korea isn’t just stealing crypto—they’re renting Western identities to infiltrate tech companies as legitimate employees, using AI-generated deepfakes for interviews. Iranian operators are weaponizing Telegram and Discord for command-and-control while targeting critical sectors with six-month persistence campaigns. Chinese front companies masquerade as private research firms while funneling intelligence to the Ministry of State Security. And attackers are deploying 4.3 million infected browser extensions with near-perfect user ratings to harvest credentials at scale. The pattern is clear: adversaries are industrializing deception while we’re still defending with manual verification processes built for a slower era. For CISOs, this means visibility is the new perimeter—you can’t defend what you can’t see, and attackers are thriving in the blind spots between integrations, analytics tools, forgotten vendors, and identity verification gaps. The best security leaders in 2026 won’t just be technical experts—they’ll be ecosystem architects who understand that resilience is built through continuous vendor validation, aggressive segmentation, rapid detection at machine speed, and the willingness to walk away from relationships that don’t meet security standards. The subscription model that James exposes in his “How ARR Became King” series has created budget constraints that force impossible trade-offs, but the vendor risk apocalypse we witnessed this week proves that cutting corners on third-party security isn’t cost savings—it’s deferred liability that regulators will eventually force you to pay with interest.

This week proved that trust without verification isn’t just bad security—it’s negligence that regulators will punish and adversaries will exploit. The vendor risk apocalypse has arrived, and it’s not slowing down.

Stay sharp, stay caffeinated, demand vendor accountability, and as always—stay cyber safe, Security Gang!

Thanks for tuning in. We’ll be back Monday at 9 AM Eastern Live. Saturday, check out part two of James’s article series “How ARR Became King and How It Affected CISO Budgets”— exposing how the subscription model is throwing CISOs out of whack and causing budget headaches.