Date
Victim
Summary
Threat Actor
Business Impact
Source Link
May 1, 2026
Canonical (Ubuntu)
Ubuntu and Canonical services disrupted by DDoS attack claimed by hacktivists
313 Team (Islamic Cyber Resistance in Iraq)
A sustained DDoS attack disrupted Ubuntu and Canonical’s public-facing infrastructure, taking down key web services and security-related resources, which temporarily blocked users from accessing updates, documentation, and developer tools.
May 4, 2026
DigiCert
DigiCert revokes certificates after support portal hack
Unknown
DigiCert was hit in a social engineering attack that compromised its internal support portal, allowing attackers to fraudulently obtain code-signing certificates that were later used to sign malware, forcing the company to revoke affected certificates and contain the breach.
Source: Security Week
May 5, 2026
Taiwan High Speed Rail Corporation (THSRC)
Student hacked Taiwan high-speed rail to trigger emergency brakes
Lin (23-year-old university student)
A student breached Taiwan’s rail communication system and triggered false emergency alarms, forcing four high-speed trains to stop for 48 minutes, disrupting operations and exposing critical weaknesses in the railway’s radio security infrastructure.
Source: Bleeping Computer
May 6, 2026
Unnamed organisation
MuddyWater hackers use Chaos ransomware as a decoy in attacks
MuddyWater (Iran-linked APT)
MuddyWater infiltrated an organisation through Microsoft Teams social engineering, stole credentials and sensitive data, established long-term access, and used Chaos ransomware as a distraction to mask its espionage activity, increasing both data exposure and operational disruption risks.
Source: Bleeping Computer
May 6, 2026
DAEMON Tools (Disc Soft Limited)
DAEMON Tools devs confirm breach, release malware-free version
Unknown
DAEMON Tools confirmed that hackers had compromised its software build environment and distributed trojanized installers to thousands of users in over 100 countries, exposing infected systems to information theft, remote backdoor access, and deeper malware deployment through a supply-chain attack.
Source: Bleeping Computer
May 7, 2026
Multiple cloud infrastructure operators and exposed cloud service users
New PCPJack worm steals credentials, cleans TeamPCP infections
PCPJack operators (suspected former TeamPCP affiliate)
The PCPJack worm breached exposed cloud environments, stole sensitive credentials from services like Docker, Kubernetes, Redis, and MongoDB, moved laterally across networks, and established persistent access, increasing the risk of fraud, account takeover, and wider infrastructure compromise.
Source: Bleeping Computer
May 9, 2026
Hugging Face users and AI developers
Fake OpenAI repository on Hugging Face pushes infostealer malware
Unknown
Attackers used a fake OpenAI-themed repository on Hugging Face to distribute infostealer malware that stole browser credentials, crypto wallets, VPN logins, and developer secrets from infected systems, putting AI developers and researchers at risk of account compromise and financial theft.
Source: Bleeping Computer
May 13, 2026
Unnamed major South Korean electronics manufacturer
Iranian hackers targeted major South Korean electronics maker
MuddyWater (Seedworm / Static Kitten)
Iran-linked MuddyWater hackers infiltrated a major South Korean electronics manufacturer for nearly a week, stealing credentials and sensitive corporate data while establishing persistent access through stealthy espionage techniques that raised concerns over intellectual property theft and downstream supply-chain compromise.
Source: Bleeping Computer
May 14, 2026
OpenAI
OpenAI confirms security breach in TanStack supply chain attack
TeamPCP
OpenAI confirmed that a TanStack supply-chain attack compromised two employee devices and exposed limited internal credentials from source code repositories, forcing the company to rotate code-signing certificates and tighten deployment workflows, although no customer data or core systems were impacted.
Source: Bleeping Computer
May 17, 2026
Microsoft 365 users and organisations
Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
Tycoon2FA phishing-as-a-service operators
Tycoon2FA operators hijacked Microsoft 365 accounts by abusing legitimate device-code authentication flows and Trustifi tracking links, allowing attackers to gain persistent access to victims’ emails, calendars, and cloud files without directly stealing passwords, which significantly increased the risk of business email compromise, espionage, and data theft across targeted organisations.
Source: Bleeping Computer
May 17, 2026
Grafana Labs customers
Grafana GitHub Token breach led to code injection attempts on customer repositories
Unknown
A compromised Grafana GitHub token was abused to attempt malicious code injections into customer repositories, creating serious supply-chain security risks that could have enabled attackers to distribute backdoored software, steal developer credentials, and compromise downstream enterprise environments.
May 19, 2026
Fox Tempest
Microsoft disrupts Fox Tempest malware signing service
Organisations targeted by Fox Tempest malware operations
Microsoft disrupted the Fox Tempest cybercrime operation that had been providing digitally signed malware to attackers, a tactic that helped malicious software bypass security defenses and enabled wider deployment of ransomware, credential theft, and other advanced cyber attacks against organisations worldwide.
Microsoft disrupted the Fox Tempest cyber crime disrupted by Microsoft
May 20, 2026
GitHub
GitHub confirms TeamPCP hack, says customers unaffected
TeamPCP
GitHub confirmed that TeamPCP hackers breached a limited internal environment connected to the broader TanStack supply-chain campaign, but said customer repositories and production systems remained secure, while the incident still heightened concerns over software supply-chain integrity and developer platform security.
Source: The Record
May 21, 2026
City of Aurora
Aurora lost $1.1M from city bank accounts after employee fell for phone scam, officials say
Unknown scam operators
The City of Aurora lost approximately $1.1 million after an employee was deceived through a phone-based social engineering scam that enabled attackers to gain access to city bank account information and fraudulently transfer public funds.
May 22, 2026
ZServers / criminal cyber infrastructure users
Netherlands seizes 800 servers of hosting firm enabling cyber attacks
Multiple cybercriminal groups using the hosting platform
Dutch authorities seized more than 800 servers linked to a bulletproof hosting provider that had allegedly supported ransomware gangs, malware operators, phishing campaigns, and other large-scale cybercriminal operations, disrupting infrastructure used to launch attacks worldwide and cutting off services relied upon by multiple threat actors.
Source: Bleeping Computer
May 23, 2026
Laravel developers and users of compromised lang packages
Laravel lang packages hijacked to deploy credential-stealing malware
Unknown
Attackers hijacked popular Laravel language packages to distribute credential-stealing malware, putting developers and organisations at risk of compromised systems, stolen authentication data, unauthorized cloud access, and broader software supply-chain attacks through infected development environments.
Source: Bleeping Computer
May 25, 2026
GitHub developers and repository users
Megalodon cyber attack on GitHub repositories spread malware to developers
Megalodon
The Megalodon cyber attack compromised GitHub repositories with malware-laced code and fake developer tools, exposing software developers to credential theft, device compromise, and potential downstream supply-chain attacks that could have impacted thousands of users and organisations.
May 25, 2026
Software developers and organisations using compromised open-source packages
Supply Chain Trapdoor Malware Infects Developers Through Fake Open Source Packages
Unknown
Attackers distributed trapdoor malware through malicious open-source software packages, silently infecting developer environments and enabling credential theft, remote access, and potential supply-chain compromises that could have spread malware into enterprise applications and customer systems.
Source: Cybersecurity News
May 25, 2026
South Africa’s State Information Technology Agency (SITA)
SITA dismisses cyber attack claims after hacktivist group targets government systems
Anonymous Sudan-linked hacktivist group
A hacktivist group claimed responsibility for cyber attacks targeting South African government systems linked to SITA, raising concerns over potential service disruptions and national digital infrastructure security, although officials stated that core government systems remained operational and uncompromised.
Source: news24.com/southafrica
May 25, 2026
Laravel developers and users of compromised lang packages
Laravel lang packages hijacked to deploy credential-stealing malware
Unknown
Attackers hijacked popular Laravel language packages to distribute credential-stealing malware, putting developers and organisations at risk of compromised systems, stolen authentication data, unauthorised cloud access, and broader software supply-chain attacks through infected development environments.
Source: Security Week
May 27, 2026
Internet users and organisations searching for software tools online
GPU mining malware spreads via SEO poisoning, AI chatbots
Unknown
Attackers spread GPU mining malware through SEO poisoning campaigns and manipulated AI chatbot search results, tricking users into downloading malicious software that hijacked system resources for cryptocurrency mining and exposed infected devices to further compromise and unauthorized access.
Source: Bleeping Computer
May 28, 2026
Android users and mobile banking customers
BTMOB Android malware service generates custom phishing payloads
BTMOB Operators
The BTMOB malware-as-a-service platform enabled cybercriminals to generate custom Android phishing payloads that stole banking credentials, intercepted SMS messages, and compromised mobile devices, increasing the risk of financial fraud and large-scale credential theft campaigns targeting Android users.
Source: Bleeping Computer
May 28, 2026
Organisations and users targeted by GreyVibe campaigns
GreyVibe hackers use ChatGPT, Gemini to power cyber attacks
GreyVibe
The GreyVibe hacking group leveraged AI tools such as ChatGPT and Gemini to automate phishing, malware development, and social engineering attacks, increasing the speed, scale, and sophistication of cyber campaigns targeting organisations and online users.
Source: Bleeping Computer
May 30, 2026
CBSE revaluation portal
CBSE revaluation portal hit by cyber attack; around 50 students affected
Unknown
A cyber attack on the CBSE revaluation portal disrupted student access and allegedly altered revaluation related records affecting around 50 students and causing confusion during the answer sheet review process.
Source: Bleeping Computer
Stephan is the sports journalist for the Maple Grove Report.
