Russians are posing as Signal support to launch phishing attacks

The feed compiles multiple high-impact security developments: US agencies warn that Russia-linked actors are impersonating customer support on messaging apps (e.g., Signal) to phish and take over accounts; unknown actors are actively exploiting a critical Microsoft SharePoint vulnerability; ransomware groups abused CVE-2026-20131 in Cisco Secure Firewall before public patching; and the US disrupted massive IoT botnets behind record DDoS traffic. Other notable items include an Iran-linked attack that abused Microsoft Intune against Stryker, a new iOS exploit kit called Darksword used by spyware