The Signal
Must Know
Manchester Airports Group breach disclosure
What happened
Manchester Airports Group disclosed that an unauthorised third party accessed data belonging to approximately 8.7 million customers across Manchester, London Stansted and East Midlands airports. [1]
The affected information related to car-park, lounge, fast-track and airport Wi-Fi services and included email addresses, phone numbers, vehicle registration numbers and postcodes; payment details were not stored. [1]
Why it matters
The exposed contact and booking-related information could provide a convincing starting point for targeted phishing or impersonation attempts, according to the article’s analysis. [1]
Watch
No group had claimed responsibility, and investigators had not publicly linked the attack to a specific actor. [1]
BlueDelta and HOOKEDGE campaign report
What happened
Recorded Future’s Insikt Group documented BlueDelta, which overlaps with APT28, conducting an espionage campaign against European government and diplomatic targets in Romania, Spain, and Türkiye from late September 2025 through early April 2026. [2]
The campaign delivered the HOOKEDGE Windows batch-script backdoor through macro-enabled Word documents using diplomatic-themed lures, including material impersonating a Spanish ministry. [2]
Why it matters
The report states that using msedge.exe for tasking and exfiltration makes the malware’s communications resemble normal enterprise browsing activity. [2]
North Korean worker recruitment beyond IT
What happened
Huntress reports that suspected DPRK remote workers are expanding job searches beyond IT, with investigations identifying workers in sales, marketing, and the medical profession. [3]
Why it matters
Huntress characterizes DPRK remote workers as a detection challenge because they may be remotely hired through deception rather than by compromising accounts or exploiting organizational gaps, while still performing legitimate assigned work. [3]
Android 17 wireless and web privacy protections
What happened
Google introduced network-security changes planned for Android 17 to make it harder for network operators, snoops, and scammers to track phone activity. [4]
The source states that domain names visited through websites or apps remain visible to network operators and eavesdroppers even when connections use HTTPS. [4]
Why it matters
The source says this unencrypted domain data can be used to build user profiles. [4]
Also Worth Knowing
AI mathematics capability assessment
What happened
The authors argue that, in the short term, AI models remain far less capable than experienced academic mathematicians, despite producing notable results at roughly PhD-researcher level. [5]
The assessment is a useful corrective to treating notable research outputs as equivalent to broad expert capability. [5]