LeakWatch 2026, Security Incidents, Data Breaches and IT Situation for the Current Calendar Week 21 – Pentecost, Fake Voices and the Question of Whom to Still Trust

Key Takeaways

• Phishing spikes before Pentecost, targeting PayPal, banks, Deutschlandticket
• Storm‑2949 hijacks password resets, steals Azure Key Vault secrets
• GitHub breach affected ~3,800 internal repos via malicious VS Code extension
• First VPN takedown removed 33 servers; KimWolf botnet linked to $1 M losses

Pulse Analysis

The surge of holiday‑timed phishing illustrates how attackers exploit human urgency. By mimicking familiar brands and imposing short deadlines, they bypass traditional technical defenses, making user education and direct‑app verification essential. This pattern is a reminder that security awareness programs must adapt to calendar events that lower vigilance, especially when email and SMS channels are flooded with urgent‑tone messages.

Beyond social engineering, the Storm‑2949 campaign reveals a dangerous convergence of identity management and cloud privileges. Abuse of Self‑Service Password Reset and MFA enrollment allowed attackers to commandeer high‑value Azure resources, extract secrets from Key Vault, and mass‑download files from OneDrive and SharePoint. Organizations should implement strict monitoring of password‑reset chains, enforce MFA‑resistant recovery workflows, and set automated alerts for concurrent credential‑change events to stop breaches before data exfiltration.

Supply‑chain risk has moved from open‑source libraries to developer workstations. GitHub’s disclosure of a VS Code extension compromise affecting thousands of internal repositories highlights how a single malicious tool can cascade into credential theft and further package poisoning. New npm features such as Staged Publishing and granular install‑time controls are steps toward containment, but firms must also enforce extension vetting, limit CI token exposure, and treat developer environments as production assets. Combined with recent takedowns of criminal VPN services and the indictment of the KimWolf botnet—responsible for over 30 Tbps of attacks and $1 M in losses—the landscape demands a holistic, trust‑centric security posture.