In partnership with
⏱️ ≈ 7-minute read
Editor’s Note: One of the internet’s most infamous cybercrime forums got breached, and threat actors everywhere were reminded that incident response is not just for enterprises. At the same time, cyber operations are being openly discussed alongside military action, AI tools continue to introduce risk faster than they remove it, and CES once again proved that innovation without restraint is still a thing. Let’s take a look.
📜 Table of Contents
📌 Big News
BreachForums gets breached; Cyber operations enter the military chat🚨 Can’t Miss
Botnets, quishing, APTs, exploited routers, congressional inboxes, and Instagram panic🤖 AI in Cyber
Malicious AI extensions, weak AI defaults, crisis-response models, and automation risk🧪 Strange Cyber Story
CES 2026’s worst AI ideas, ranked by how uncomfortable they make us
🚨 Big Stories
🧑💻 BreachForums Breached, Exposing 324K Cybercriminals
Intro
In an outcome few security professionals will find surprising, one of the world’s most notorious cybercrime forums suffered the same kind of exposure its users have inflicted on countless victims.
What Happened
A massive database tied to BreachForums was leaked online, exposing usernames, email addresses, IP addresses, and registration data for nearly 324,000 forum members. Researchers verified the authenticity of the data, which was allegedly released by an actor claiming ties to ShinyHunters.
Why It’s Important
This is not just embarrassing. It is operationally damaging for a criminal ecosystem built on anonymity. Exposed identities and metadata may give law enforcement new attribution paths, disrupt active criminal schemes, and introduce real consequences for actors who have spent years profiting off of similar tactics with their victims.
The Other Side
Some users likely relied on throwaway infrastructure and anonymization tools, which may limit immediate attribution. That does not change the fact that trust inside the forum has been fundamentally broken.
👉 Takeaway
Cybercriminals depend on secrecy. When that secrecy fails, accountability becomes possible.
TL;DR
BreachForums was breached, and the people who built careers on exploiting others are now facing a fraction of the exposure they created.
Further Reading: Dark Reading
The first recorded cyberattack dates back to 1834 when attackers sabotaged France’s optical telegraph system to commit financial fraud. (Source: Smithsonian Magazine)🪖 Cyberattacks Likely Part of Military Operation in Venezuela
Intro
Cyber operations are no longer a quiet prelude to conflict, they’re increasingly part of the headline.
What Happened
Experts believe cyber effects likely supported recent U.S. military actions in Venezuela, potentially disrupting communications and infrastructure ahead of a kinetic operation that resulted in Nicolás Maduro’s capture. While official confirmation is limited, analysts say the timing and nature of outages point to coordinated cyber involvement.
Why It’s Important
This marks a notable shift in how openly cyber capabilities are discussed alongside traditional military operations, reinforcing cyber’s role as a core element of modern warfare.
The Other Side
Without public attribution or technical details, conclusions remain speculative and governments are unlikely to confirm specifics anytime soon.
👉 Takeaway
Cyber operations are no longer just a supporting act; they’re becoming a visible component of military strategy.
TL;DR
Cyber may have helped set the stage for real-world military action.
Further Reading: Dark Reading
Why AI Isn’t Replacing Affiliate Marketing After All
“AI will make affiliate marketing irrelevant.”
Our new research shows the opposite.
Levanta surveyed 1,000 US consumers to understand how AI is influencing the buying journey. The findings reveal a clear pattern: shoppers use AI tools to explore options, but they continue to rely on human-driven content before making a purchase.
Here is what the data shows:
Less than 10% of shoppers click AI-recommended links
Nearly 87% discover products on social platforms or blogs before purchasing on marketplaces
Review sites rank higher in trust than AI assistants
🔥 Can’t Miss
🛡️ GoBruteforcer Botnet Targets 50K+ Linux Servers
A rapidly expanding botnet is brute-forcing its way into tens of thousands of Linux servers by exploiting weak and reused credentials. Compromised systems are then used to scan and attack additional targets, creating a fast-moving infection loop.
👉 Weak credentials at scale are still one of the internet’s biggest problems.🧭 FBI Flags Quishing Attacks From North Korean APT
The FBI warns that North Korean threat actors are embedding malicious QR codes into phishing emails to bypass traditional security controls. Victims scanning the codes are redirected to credential-harvesting sites optimized for mobile devices.
👉 QR codes are now a first-class phishing vector.🏛️ China Hacked Email Systems of US Congressional Committee Staffers
Reuters reports that China-linked hackers compromised email systems used by U.S. congressional staff, expanding espionage targets beyond executive agencies. The activity underscores persistent interest in legislative intelligence.
👉 Government inboxes remain prime espionage targets.🪪 Russia-Linked APT28 Runs Credential-Stealing Campaign
APT28 has launched a new credential-harvesting operation targeting energy, policy, and government-adjacent organizations. The campaign relies on familiar tradecraft but remains effective due to poor identity hygiene.
👉 Credential theft remains effective because basic identity controls continue to lag.📱 Instagram Fixes Password Reset Bug Amid Reset Email Panic
Instagram patched a bug that allowed attackers to trigger mass password reset emails, creating confusion and opening the door to follow-on phishing attacks. Meta says there was no breach, but the incident caused widespread alarm.
👉 Even "just a bug" can become a social-engineering weapon.
AI that actually handles customer service. Not just chat.
Most AI tools chat. Gladly actually resolves. Returns processed. Tickets routed. Orders tracked. FAQs answered. All while freeing up your team to focus on what matters most — building relationships. See the difference.
🤖 AI in Cyber
🧩 Fake AI Chrome Extensions Steal Data From 900K Users
Malicious browser extensions posing as AI productivity tools siphoned browsing data and chat logs from nearly a million users. Some even appeared in featured listings, lending them credibility.
👉 AI branding is now a trust exploit.📉 Generative AI Data Violations More Than Doubled Last Year
Organizations are seeing a sharp increase in sensitive data being shared with generative AI tools, often through unmanaged or personal accounts. Researchers warn that source code, credentials, and regulated data are increasingly exposed through shadow AI usage.
👉 AI adoption without governance is creating a new insider risk category.🧪 IBM’s AI ‘Bob’ Could Be Manipulated to Download and Execute Malware
Researchers demonstrated that IBM’s generative AI assistant could be abused through prompt injection to perform harmful actions, including downloading and executing malware. The issue highlights the risks of granting AI tools broad system permissions.
👉 AI tools can become attack paths when security boundaries are weak.👻 Shadow AI Use Is a Persistent Security Risk
Nearly half of enterprise users access generative AI through personal accounts, bypassing corporate controls and increasing the likelihood of sensitive data exposure. Security teams report growing difficulty tracking how AI tools are used across organizations.
👉 You cannot secure what you cannot see.🚑 iDisaster: AI-Driven Crisis and Disaster Simulation
AI-powered disaster modeling tools promise faster emergency response and infrastructure planning, but they also raise concerns around reliability, bias, and accountability when outputs influence real-world decisions.
👉 AI in defense still requires human oversight and clear guardrails.
🧟♂️ Strange Cyber
😐 ‘Worst in Show’ CES 2026 AI Gadgets That Shouldn’t Exist
Intro
CES rarely disappoints especially when it comes to tech that feels like a privacy impact assessment waiting to happen.
What Happened
At CES 2026, privacy advocates highlighted a slate of AI-powered gadgets that push the boundaries of necessity and common sense. Voice-listening appliances, emotion-tracking companions, and always-on smart devices raised eyebrows and concerns in equal measure.
Why It’s Important
Many of these products normalize surveillance, data collection, and opaque AI decision-making in everyday life often without clear security controls or user consent.
The Other Side
Manufacturers argue these tools improve convenience and personalization, and that users can opt out if they’re uncomfortable.
👉 Takeaway
The future of AI isn’t just about capability it’s about restraint.
TL;DR
CES showcased AI gadgets that raise real questions about privacy, security, and restraint.
Further Reading: Alaska Dispatch News
Enjoying Exzec Cyber? Forward this to one person who cares about staying ahead of attacks
Hate everything you see or have other feedback? Reply back to this email!