Cyber Briefing: 2026.03.06
China-linked hackers target telecoms, ClickFix spreads Lumma Stealer, CISA flags exploited flaws, breaches surface, and major fraud and crypto theft cases unfold.
👉 What's happening in cybersecurity today
Welcome to Cyber Briefing, the newsletter that informs you about the latest cybersecurity advisories, alerts, incidents and news every weekday.
First time seeing this? Please Subscribe
🚨 Cyber Alerts
1. China Hackers Target SA Telecom Networks
A China-linked threat actor identified as UAT-9244 has been targeting South American telecommunications infrastructure since late 2024 using specialized malware for Windows, Linux, and edge devices. While the group shares tactical similarities with the espionage cluster Salt Typhoon, researchers have not yet found definitive proof that the two entities are the same.
2. ClickFix Campaign Deploys Lumma Stealer
Microsoft has identified a sophisticated social engineering campaign that uses bogus CAPTCHA pages to trick users into executing malicious commands within the Windows Terminal. By bypassing traditional Run dialog detections, the attack successfully deploys the Lumma Stealer malware to harvest sensitive browser data and credentials.
3. CISA Adds Critical Hikvision, Rockwell Flaws
CISA recently expanded its Known Exploited Vulnerabilities catalog to include two critical flaws affecting products from Hikvision and Rockwell Automation. Because these vulnerabilities are being actively targeted by attackers, federal agencies must update their systems by March 26, 2026, to prevent unauthorized access or system manipulation.
For more alerts click here!
💥 Cyber Incidents
4. Evoke Wellness Updates Breach Notice
OCAT, LLC, doing business as Evoke Wellness at Hilliard, recently notified the Maine Attorney General regarding a data breach involving 261 individuals. The disclosure reveals a significant gap between the reported July 2024 insider-wrongdoing incident and its eventual discovery in August 2025.
5. Murata Investigates IT System Breach
Murata Manufacturing recently disclosed a security breach after a third party gained unauthorized access to its IT environment. The company is currently investigating the extent of the data compromise and assessing any potential impact on its business operations or financial performance.
6. WCSO Probes Cyber Attack On Network
The Warren County Sheriff’s Office is currently investigating a cyber attack that resulted in the unauthorized access and theft of personal data belonging to employees and their relatives. In response to the breach, the agency has coordinated with federal authorities and cybersecurity experts to secure their network and provide credit monitoring resources to those affected.
For more incidents click here!
📢 Cyber News
7. Ghanaian Man Pleads Guilty In Fraud
A Ghanaian citizen has admitted his involvement in a criminal organization that defrauded American victims of more than $100 million through romance scams and business email schemes. Derrick Van Yeboah pleaded guilty to conspiracy to commit wire fraud and has been ordered to pay over $10 million in restitution for his specific role in the operation.
8. FBI Probes Surveillance System Breach
The FBI is currently investigating a security breach involving systems dedicated to managing surveillance and wiretap warrants, though the agency maintains the issue has been resolved. While official details remain limited, the incident highlights ongoing vulnerabilities within sensitive federal networks responsible for handling foreign intelligence and court-authorized monitoring.
9. FBI Arrests Suspect In $46M Crypto Theft
A United States government contractor was apprehended on the island of Saint Martin following allegations that he embezzled over $46 million in cryptocurrency from the U.S. Marshals Service. The arrest involved a coordinated effort between the FBI and France’s elite tactical unit after the suspect was identified through his father’s firm, which manages seized digital assets for the government.
For more news click here!
📈Cyber Stocks
Cybersecurity stocks on Friday, 6 March 2026 traded with mixed pressure across pure-play names, as broader technology volatility and rotation persisted while structural demand for cloud security and identity protection continued to support interest.
CrowdStrike Holdings Inc finished near 371.98 dollars and was mixed, as cloud-native endpoint and identity protection trends supported valuations despite rotation pressures.
Okta Inc closed at 72.50 dollars and was softer, with identity and access management stocks tracking uneven tech sentiment.
Zscaler Inc finished at 146.99 dollars and was modestly lower, reflecting mixed flows in cloud zero-trust security equities.
Fortinet Inc closed at 79.03 dollars and was slightly softer, with network security names under broader sector pressure.
Check Point Software Technologies Ltd. closed around 152.07 dollars and was modestly lower, with defensive firewall and threat prevention demand steady but affected by rotation.
💡 Cyber Tip
🖥️ ClickFix Campaign Deploys Lumma Stealer
Microsoft has identified a ClickFix campaign that uses fake CAPTCHA or troubleshooting pages to trick users into pasting malicious commands into Windows Terminal. Once executed, the command launches a multi-stage infection that installs Lumma Stealer to harvest browser credentials and sensitive data.
🛠️ What You Should Do
Never paste commands from websites into Terminal or PowerShell
Treat CAPTCHA or troubleshooting prompts asking for commands as malicious
Monitor for unusual PowerShell or terminal activity on endpoints
Review scheduled tasks and Defender exclusions for unauthorized changes
Use endpoint security that detects script-based and in-memory attacks
⚠️ Why This Matters
This attack bypasses many traditional detections by abusing trusted system tools. Once Lumma Stealer is installed, attackers can capture browser passwords, session data, and credentials that may lead to wider account compromise.
📚 Cyber Book
The Complete Parents’ Guide to Roblox by Tim Higdem
Copyright © 2026 CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium
really nice update here. i appreciate the no fluff approach to keep us up to date.