THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
Citizen Lab reports a Pegasus infection in University of Belgrade rector Vladan Đokić's phone and separate spyware targeting of prosecutorial associate Rade Bajić. The disclosure raises institutional concerns before Serbia's election, but does not identify who ordered the attacks.
Cybersecurity
AT A GLANCE
Semperis says 37% of organizations surveyed after experiencing a successful ransomware attack reported threats against employees’ family members or friends. In the survey of 1,200 IT and security professionals, 23% reported swatting and a quarter said employees or relatives needed medical or psychological treatment because of threats. The report also says 69% experienced multiple successful ransomware attacks in the previous year and 87% reported attackers targeting or exploiting identity systems.
Why it matters For affected employers, incident response can become a staff-safety and retention problem as well as a systems-recovery task: respondents reported treatment needs, protective security and job changes.
HelpNet Security ↗DataDome’s Q3 2026 report says AI-agent traffic across its network rose 41.5% quarter over quarter to nearly 25 billion requests. Meta-ExternalAgent and Meta-WebIndexer together accounted for 49.7% of that traffic, while agentic-browser traffic in the dataset rose from 12.5 million requests in August to 58.2 million in September. In a sample of Meta Muse requests, 8.9% reached sensitive endpoints, including forms, login, payment and account pages.
What changed Agentic-browser requests in the dataset rose from 12.5 million in August to 58.2 million in September. The increase was not solely attributable to Muse: excluding it, requests still more than tripled.
Why it matters Website operators cannot assume that allowing or blocking named AI crawlers also governs browser-driven agents. That leaves a concrete coverage gap in policies intended to separate permitted AI access from unwanted activity.
HelpNet Security ↗Check Point Research found Microsoft accounted for 33% of brand impersonation attempts it tracked in Q3 2026, up from 23% in the prior quarter; Apple and Google each had 8%. The report also describes recent scams using Claude, Google Antigravity, Apple and DocuSign branding, including lures designed to steal credentials or payment details and a spoofed DocuSign site that delivered a FleetDeck installer.
What changed Microsoft’s share of tracked brand impersonation attempts increased by 10 percentage points, from 23% in the previous quarter to 33% in Q3 2026. This measures a change in share, not necessarily in attack volume.
LESS NOISE. MORE CONTEXT.
Why it matters For organizations using Microsoft services, a successful credential lure can expose multiple workplace resources rather than a single personal account, widening the potential impact of one employee’s compromise.
A Help Net Security weekly roundup reports that Bloom Security researchers found npm Trusted Publishing could let an attacker publish new versions of packages by registering a GitHub repository name a maintainer had left behind, without stealing a credential. Bloom counted more than 1,500 potentially exposed packages, and GitHub said it had shipped fixes.
What changed Researchers identified more than 1,500 exposed packages; GitHub subsequently reported shipping fixes. This is a vendor-reported remediation state, not evidence that packages were actually compromised.
Why it matters For package maintainers, protecting publishing credentials alone would not have blocked this route: acquiring an abandoned repository name could confer the ability to issue unauthorized package versions.
HelpNet Security ↗