--- title: "Critical Infrastructure Attacks, PhantomSub WhatsApp Infiltration, Denmark Data Breach | DMARC Report" description: "Explore the latest cybersecurity threats, including critical vulnerabilities, data breaches, malware, zero-days, and cybercrime arrests." image: "https://dmarcreport.com/og/blog/critical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach.png" canonical: "https://dmarcreport.com/blog/critical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach/" --- Quick Answer The latest cybersecurity news highlights critical vulnerabilities, major data breaches, malware campaigns, zero-day exploits, and cybercriminal arrests, emphasizing the need for strong security, email authentication, proactive threat detection, timely patching, and effective incident response. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Critical%20Infrastructure%20Attacks%2C%20PhantomSub%20WhatsApp%20Infiltration%2C%20Denmark%20Data%20Breach%20&url=undefined%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F&title=Critical%20Infrastructure%20Attacks%2C%20PhantomSub%20WhatsApp%20Infiltration%2C%20Denmark%20Data%20Breach%20 "Share on Reddit") [ ](mailto:?subject=Critical%20Infrastructure%20Attacks%2C%20PhantomSub%20WhatsApp%20Infiltration%2C%20Denmark%20Data%20Breach%20&body=Check out this article: undefined%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F "Share via Email") ![Critical Infrastructure Cybersecurity Threats](https://media.mailhop.org/dmarcreport/dmarc-check-9901-1791281093425.jpg) ## Critical Infrastructure Under Siege: Multiple Zero-Days Rock Security World Last week saw an unprecedented wave of critical security incidents affecting enterprise infrastructure, cloud platforms, and personal data. From a third consecutive [Citrix NetScaler zero-day exploit](https://www.csoonline.com/article/4230642/citrix-warns-of-actively-exploited-netscaler-flaw-days-after-zero-day-patch-rush.html) hitting organizations within days to the arrest of a major extortion group leader and the exposure of millions of **government records** across Europe, this week underscored how quickly threats can cascade across interconnected systems. These incidents highlight the urgent need for advanced [email authentication](https://dmarcreport.com/blog/why-email-authentication-matters-for-businesses/) and [threat detection](https://industrialcyber.co/news/marlink-and-norma-cyber-link-maritime-threat-detection-with-incident-response-across-vessel-fleets/) across all organizational layers. ## PhantomSub campaign secretly adds developers to WhatsApp groups via 101 malicious npm packages The OX Research team identified **101 npm packages** as part of a malicious WhatsApp group subscriber campaign dubbed PhantomSub. The malicious packages abuse the “Baileys” WhatsApp open source project to add the victims to groups without their consent. Most packages in this report were first published in August and September 2026, and most are still live on npm. [101 npm packages in PhantomSub](https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/) abuse Baileys to add WhatsApp users to groups without consent, with 490,000 downloads in total. _Three variants of malware were identified: one fetches channel IDs from GitHub at runtime, another embeds them in cleartext within its source code, and the third uses encoded and obfuscated channel IDs._ [PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels - OX Security +2](https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/) ## Denmark suffers massive data breach exposing 8.8 million citizens’ personal records ![Dmarc Record Generator 9764](https://media.mailhop.org/dmarcreport/dmarc-record-generator-9764-1791281145324.jpg) **Denmark** has confirmed a major data breach involving its [Central Population Register](https://www.wathim.com/glossary/cpr), known as CPR, after unauthorized parties accessed personal records belonging to about [8.8 million people](https://cybersecuritynews.com/denmark-data-breach/). The exposed information includes names, addresses, and CPR numbers (personal identification numbers). Christina Egelund, Danish digitalisation minister, has described the breach as a “serious incident”. The CPR administration became aware of unusual system behavior on Friday evening, October 2. Over the following weekend, officials established that unauthorized parties had accessed information covering approximately 8.8 million registered people. _The breach occurred after unidentified individuals misused a private Danish company’s legitimate access to search the Central Person Register, known as CPR._ [Denmark Data Breach Exposes Personal Records of 8.8 Million People +3](https://cybersecuritynews.com/denmark-data-breach/) ## Hackers claim to have millions of Airbnb, Uber, and Google records for sale A hacker called [Marx claims to sell 54 million records](https://cybernews.com/security/airbnb-uber-google-data-breach-claims/) tied to Airbnb, Uber, PayPal, Booking.com, and Google. The attackers boast of live access to a trove of data. Marx’s earliest known forum activity dates back to the beginning of this October, when the actor advertised 11 million records allegedly connected to **Mastercard transaction data**. _The number of records correlates to the number of SMS messages, with longer messages split across multiple database records, meaning that a claim involving millions of “records” does not necessarily translate into millions of individual customers._ [Third-party SMS provider breach may expose Airbnb, Uber, PayPal users +2](https://cybernews.com/security/airbnb-uber-google-data-breach-claims/) ## OpenSSL patches high-severity DTLS flaw that can leak heap memory unencrypted A High-severity [OpenSSL flaw can leak heap memory](https://thehackernews.com/2026/09/openssl-fixes-high-severity-dtls-flaw.html) to the other side of a DTLS connection or crash the program. _The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8._ The wrongly labeled message can carry heap memory to the other side as unencrypted handshake data. If the read reaches unmapped memory, the program crashes. The weakness is classified as **CWE-125**, an out-of-bounds read, and its main security impact is unintended disclosure of heap memory to the remote [DTLS](https://en.wikipedia.org/wiki/Datagram%5FTransport%5FLayer%5FSecurity) peer. [openssl fixes high severity dtls flaw +2](https://thehackernews.com/2026/09/openssl-fixes-high-severity-dtls-flaw.html) ![Dmarc Record 8221](https://media.mailhop.org/dmarcreport/dmarc-record-8221-1791281689561.jpg) ## Google suspends open-source bug bounty program amid flood of AI-generated submissions Google has paused its **Open Source Vulnerability Rewards Program** due to a flood of AI submissions. The temporary suspension came as researchers began submitting numerous [AI-generated vulnerability reports](https://www.infosecurity-magazine.com/news/google-suspends-opensource-bug/) that did not meet the program’s standards. Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports as the company temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP). [infosecurity-magazine](https://www.infosecurity-magazine.com/news/)[helpnetsecurity](https://www.helpnetsecurity.com/) ## ClingSTUN malware turns unpatched IoT devices into proxy nodes ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes. [ClingSTUN exploits](https://www.darkreading.com/iot/clingstun-vulnerable-iot-devices-proxy-nodes) known IoT flaws and abuses **public STUN servers** to keep proxy access to devices. The malware leverages existing vulnerabilities in [IoT](https://www.ibm.com/think/topics/internet-of-things) systems rather than relying on zero-days, making patching and vulnerability management critical for IoT deployments. [infosecurity-magazine](https://www.infosecurity-magazine.com/news/) ## Minecraft players’ personal data surfaces in alleged 18-million record breach _Records allegedly belonging to 18 million Minecraft players have surfaced online this week, with attackers claiming access to user accounts, email addresses, and related personal information._ The incident highlights continued security challenges in the gaming and **online entertainment sectors**. ## US federal government arrests tech executive over alleged $300 million GPU diversion to China US arrests tech executive over alleged [$300M GPU diversion to China](https://arstechnica.com/tech-policy/2026/10/us-arrests-tech-ceo-accused-of-smuggling-300m-in-nvidia-chips-into-china/), highlighting ongoing concerns about technology **supply chain security** and illegal export controls violations. [cybernews](https://cybernews.com/security/) ## Frontline Education breach impacts K-12 school district staff A breach at school software provider [Frontline Education](https://www.bleepingcomputer.com/news/security/frontline-education-data-breach-impacts-school-district-employees/) has exposed employee data at multiple **K-12 school districts**. The incident raises concerns about the security of educational technology platforms that handle sensitive school and staff information. [infosecurity-magazine](https://www.infosecurity-magazine.com/news/) ![Dmarc Lookup 3370](https://media.mailhop.org/dmarcreport/dmarc-lookup-3370-1791281117826.jpg) ## Apple tightens macOS disk access controls as AI agents become increasingly powerful Apple tightens [macOS disk access as AI agents become more powerful](https://www.helpnetsecurity.com/2026/10/05/macos-full-disk-access-updates/), implementing enhanced security controls to prevent autonomous AI systems from accessing sensitive disk resources without proper authorization. [helpnetsecurity](https://www.helpnetsecurity.com/) ## Researcher demonstrates critical zero-day allowing VM escape and root access on KVM hosts A cyber professionabreacl has discovered a critical [KVM guest-to-host escape vulnerability](https://tech-insider.org/vercel-kvm-zero-day-vm-escape-sandbox-2026/), breaking out of a virtual machine and gaining root access on the host system. _This type of vulnerability is particularly dangerous for cloud infrastructure and virtualized environments._ [cybernews](https://cybernews.com/security/critical-kvm-zero-day-vulnerability-allows-vm-escape/) ## Dutch police arrest 24-year-old in connection with ShinyHunters cybercriminal group Following up on the Jordan arrest of **Rey, Dutch authorities** have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the [ShinyHunters group](https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/). This shows ongoing international law enforcement coordination against major cybercriminal organizations. [Wiu](https://www.wiu.edu/cybersecuritycenter/cybernews.php) These incidents reinforce the importance of strong cybersecurity practices, including [DMARC](https://dmarcreport.com/), [SPF](https://dmarcreport.com/what-is-spf/), and [DKIM](https://dmarcreport.com/what-is-dkim/), to help protect organizations from phishing, email spoofing, and other evolving cyber threats. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F) [ ](https://twitter.com/intent/tweet?text=Critical%20Infrastructure%20Attacks%2C%20PhantomSub%20WhatsApp%20Infiltration%2C%20Denmark%20Data%20Breach%20&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fcritical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) - [ ![Cybersecurity ransomware news](https://media.mailhop.org/dmarcreport/dmarc-report-3120-1788259786008.jpg) Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Intermediate ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)[ Intermediate Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Sep 1, 2026 ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Critical Infrastructure Attacks, PhantomSub WhatsApp Infiltration, Denmark Data Breach ","description":"Explore the latest cybersecurity threats, including critical vulnerabilities, data breaches, malware, zero-days, and cybercrime arrests.","url":"https://dmarcreport.com/blog/critical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach/","datePublished":"2026-10-06T00:00:00.000Z","dateModified":"2026-10-06T00:00:00.000Z","dateCreated":"2026-10-06T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/critical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-check-9901-1791281093425.jpg","caption":"Critical Infrastructure Cybersecurity Threats"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Critical Infrastructure Attacks, PhantomSub WhatsApp Infiltration, Denmark Data Breach ","item":"https://dmarcreport.com/blog/critical-infrastructure-attacks-phantomsub-whatsapp-infiltration-denmark-data-breach/"}]} ```