Big Tech Challenges Canada Encryption Bill as Security Roundup Covers Breaches, AI and Android Defenses
Summary
SecurityWeek’s roundup covers a confirmed GeForce NOW partner data breach, infostealer and Seedworm activity, Audi platform flaws, Android 17 defenses, Canada’s encryption bill debate, and new AI-security initiatives.
Key points
- Nvidia confirmed a breach of user data at its regional GeForce NOW partner in Armenia; exposed details included names and contact information, but not passwords. A ShinyHunters claim was attributed to a possible impersonator.
- Ontinue reported an active infostealer campaign using fake Claude Code installers promoted in sponsored search results. Malicious PowerShell commands steal browser data by abusing Chrome’s App-Bound Encryption.
- Seedworm, also known as MuddyWater, reportedly breached a South Korean electronics manufacturer in February 2026 as part of a campaign affecting at least nine organizations across four continents.
- A researcher said vulnerabilities in Audi’s myAudi platform could let someone with a vehicle VIN access sensitive data. CARIAD patched one issue; the remaining findings were still under evaluation.
- Android 17 adds security features including verified financial calls, expanded real-time threat detection, stronger lost-device protections, and post-quantum cryptography.
- Apple and Meta oppose Canada’s Bill C-22, warning its broad lawful-access powers could lead to encryption backdoors or government spyware; Public Safety Canada says the bill would not require systemic vulnerabilities.
- Cisco released Foundry Security Spec, an open-source blueprint for structured, auditable AI-driven vulnerability evaluation. OpenAI is also discussing access to a cyber-focused model with EU officials.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering data breaches, an active infostealer campaign, a reported intrusion campaign, vulnerability disclosures, product security updates, and cybersecurity policy developments.
- Impact
- The reported incidents include exposure of GeForce NOW partner users’ personal information, a campaign targeting developers to steal browser data, a breach of a South Korean electronics manufacturer, and disruption to educational institutions using Canvas. The article also describes exposed data in the myAudi platform and security changes, policy debates, and new security tools or specifications. ShinyHunters’ responsibility for the GeForce NOW partner breach is described as a claim believed to come from an impersonator; the group has also claimed the Canvas attack.
MITRE ATT&CK
T1059.001 · PowerShellThe fake Claude Code installer campaign tricked developers into running malicious PowerShell commands.T1539 · Steal Web Session CookieThe infostealer campaign extracted decrypted browser cookies.T1555.003 · Credentials from Web BrowsersThe infostealer campaign extracted saved passwords and payment data from Chromium-based browsers.T1574.002 · DLL Side-LoadingAttackers reportedly used DLL sideloading via legitimately signed binaries to deploy malicious payloads.
Threat Actors
MuddyWaterThe article identifies MuddyWater as another name for Seedworm, the Iran-linked group reported to have breached a South Korean electronics manufacturer and targeted organizations across four continents.SeedwormIran-linked group reported to have breached a South Korean electronics manufacturer in February 2026 and to have targeted organizations across four continents.ShinyHuntersClaimed responsibility for the GFN.am data breach, but the article says the claim was believed to be from an impersonator. ShinyHunters also claimed responsibility for the attack on Instructure’s Canvas system.
Vendors
AnthropicThe offer came after EU cybersecurity and AI officials spent weeks unable to gain access to Anthropic’s comparable model, Mythos, which has been limited to a few dozen organizations.AppleApple and Meta are opposing Bill C-22, a Canadian lawful-access bill they warn could force tech companies to build encryption backdoors or install government spyware on their systems.AudiAudi’s connected car platform exposed owner data CARIADCARIAD, the VW Group’s software arm, has patched one issue, but the researcher says the remaining findings are still under evaluation.CiscoCisco open-sources blueprint for AI-driven vulnerability evaluationGoogleGoogle’s Android 17 introduces a broad set of security upgrades, including verified financial calls (automatically drops spoofed calls impersonating participating banks) and expanded Live Threat Detection, which nowGrego AIGrego AI and Secludy announce launch and fundingInstructureShinyHunters has claimed responsibility for an attack on Instructure’s Canvas system, which disrupted service to educational institutions across the US, and the FBI is now warning that affected students and facultyMetaApple and Meta are opposing Bill C-22, a Canadian lawful-access bill they warn could force tech companies to build encryption backdoors or install government spyware on their systems.NvidiaNvidia cloud gaming partner suffers data breachOpenAIOpenAI moves to give EU regulators a look at its cyber AISecludyGrego AI and Secludy announce launch and funding
Products
Android 17Android 17 brings AI-driven defenses BraveCOM interface, extracting decrypted cookies, saved passwords, and payment data from Chrome, Edge, Brave, and other Chromium-based browsers, before exfiltrating the data to attacker-controlled infrastructure.CanvasFBI issues warning after ShinyHunters hacks CanvasClaude CodeDevelopers targeted with fake Claude Code installerEdgethe IElevator2 COM interface, extracting decrypted cookies, saved passwords, and payment data from Chrome, Edge, Brave, and other Chromium-based browsers, before exfiltrating the data to attacker-controlledFoundry Security SpecCisco has released Foundry Security Spec, an open source specification for building agentic security evaluation systems that use frontier AI models to find and validate vulnerabilities in a structured, auditable way.GeForce NOWNvidia has confirmed that a breach of GeForce NOW user data occurred through GFN.am, its regional Alliance partner operating the service in Armenia, with no impact on Nvidia’s own infrastructure.Google ChromeThe payload uses a small native helper to abuse Chrome’s App-Bound Encryption via the IElevator2 COM interface, extracting decrypted cookies, saved passwords, and payment data from Chrome, Edge, Brave, and otherGPT-5.5OpenAI is in talks with the European Commission to provide access to a cyber-focused variant of GPT-5.5 that can identify and exploit software vulnerabilities.myAudiA security researcher discovered several vulnerabilities in the myAudi connected car platform, finding that anyone who knows a vehicle’s VIN can add it to their account as a guest and access sensitive data.MythosThe offer came after EU cybersecurity and AI officials spent weeks unable to gain access to Anthropic’s comparable model, Mythos, which has been limited to a few dozen organizations.
Countries
ArmeniaNvidia has confirmed that a breach of GeForce NOW user data occurred through GFN.am, its regional Alliance partner operating the service in Armenia, with no impact on Nvidia’s own infrastructure.IranIran-linked group Seedworm (also known as MuddyWater) breached a major South Korean electronics manufacturer in February 2026 as part of a broader campaign hitting at least nine organizations across four continents,United Statesan attack on Instructure’s Canvas system, which disrupted service to educational institutions across the US, and the FBI is now warning that affected students and faculty could be targets for extortion and
Industries
Financial Servicesnine organizations across four continents, including government agencies, industrial manufacturers, financial services firms, and educational institutions.Governmentas part of a broader campaign hitting at least nine organizations across four continents, including government agencies, industrial manufacturers, financial services firms, and educational institutions.