Welcome to the latest edition of the “Bi-Weekly Cyber Roundup” by Canary Trap. At Canary Trap, it is our mission to keep you up-to-date with the most crucial news in the world of cybersecurity and this bi-weekly publication is your gateway to the latest news.

This week’s cybersecurity roundup highlights a series of high-impact incidents spanning data breaches, nation-state concerns, and evolving attack techniques. We cover the Navia breach affecting HackerOne employee data, new FCC restrictions on foreign-made routers, and a large-scale device code phishing campaign targeting Microsoft 365 environments. We also examine a critical TP-Link router vulnerability and review claims from Lapsus$ regarding a potential breach of AstraZeneca.

Recent Navia Data Breach Impacts HackerOne Employee Data

A data breach at U.S.-based benefits provider Navia Benefit Solutions has exposed the personal information of nearly 300 employees of HackerOne, underscoring the ongoing risks associated with third-party service providers. The incident is part of a broader compromise affecting approximately 2.7 million individuals whose data was managed by Navia.

According to Navia, unauthorized access to its systems occurred between December 22, 2025, and January 15, 2026, with suspicious activity detected on January 23. The breach has been attributed to a likely Broken Object Level Authorization (BOLA) vulnerability, which allowed attackers to access sensitive records. Exposed data may include names, dates of birth, Social Security numbers, contact details, and information related to employee benefit programs such as FSAs, HRAs, and COBRA enrollment. While Navia stated that no financial or claims data was compromised, the nature of the exposed information presents a heightened risk for phishing and social engineering attacks.

HackerOne confirmed that 287 of its employees were impacted. However, the company raised concerns about delayed notification, noting that although Navia issued breach notices dated February 20, they were not received until March. This lag has drawn attention to gaps in incident communication and transparency, particularly critical when downstream organizations must respond quickly to protect affected individuals.

In response, HackerOne has initiated its own investigation and is working with Navia to better understand the root cause and scope of the breach. The company is also reassessing Navia’s security posture and evaluating whether to continue the relationship, signaling a broader need for stricter vendor risk management practices.

Navia has reported the incident to federal law enforcement, enhanced its internal security controls, and is offering 12 months of identity protection and credit monitoring services to those affected. While the company stated there is currently no evidence of misuse of the stolen data, such assurances are often preliminary and do not eliminate future risk.

This incident highlights a persistent challenge in cybersecurity: even organizations with mature security programs remain exposed through third-party dependencies. It reinforces the importance of continuous monitoring, vendor due diligence, and timely breach disclosure to mitigate downstream impact.

FCC Bans New Routers Made Outside the U.S. Over National Security Risks

The U.S. Federal Communications Commission (FCC) has expanded its “Covered List” to include all foreign-manufactured consumer-grade routers, effectively prohibiting the authorization and future import of such devices into the United States. The move follows a determination by an Executive Branch, which concluded that routers produced outside the U.S. present significant national security and cybersecurity risks.

At the core of this decision is concern over supply chain integrity. The assessment highlights that the overwhelming reliance on foreign-made routers in American homes introduces systemic vulnerabilities, including the potential for embedded backdoors, unauthorized access, and large-scale surveillance. Compromised devices could enable threat actors to conduct data exfiltration, launch botnet attacks, or gain footholds in sensitive networks, including those tied to government and critical infrastructure.

The report also references activity from state-sponsored threat groups such as Flax Typhoon, Volt Typhoon, and Salt Typhoon, which have previously targeted U.S. sectors including energy, communications, transportation, and water systems. These campaigns underscore the strategic risk posed by insecure networking hardware at scale.

Importantly, the FCC’s action is forward-looking. Devices already approved and currently in use are not affected. However, any new foreign-made consumer routers will no longer be eligible for FCC authorization, effectively barring their legal sale and import moving forward.

There is a limited pathway for exceptions. Specific router models may still receive approval if vetted and cleared by agencies such as the Department of Homeland Security (DHS) or the Department of Defense, provided they meet stringent security requirements and are deemed not to pose unacceptable risks.

Overall, the decision reflects a broader shift toward securing technology supply chains and reducing dependency on potentially untrusted foreign hardware, particularly in areas that underpin national infrastructure and digital resilience.

Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse

Cybersecurity researchers have identified a large-scale device code phishing campaign targeting Microsoft 365 accounts across more than 340 organizations in the United States, Canada, Australia, New Zealand, and Germany. First observed on February 19, 2026, the activity has rapidly intensified, reflecting both the scalability and effectiveness of the technique.

At the core of the campaign is the abuse of Microsoft’s OAuth device authorization flow. Unlike traditional credential phishing, this method tricks users into entering a legitimate device code on Microsoft’s official authentication page. Once the victim completes the login process, including multi-factor authentication, the attacker gains access and refresh tokens tied to the session. Critically, these tokens can remain valid even after a password reset, allowing persistent access to compromised accounts.

Attackers are leveraging Cloudflare Workers to host intermediary phishing infrastructure and redirect victims through multiple layers of legitimate services, including Cisco, Trend Micro, and Mimecast redirect links, to evade detection. Ultimately, captured sessions are funneled to attacker-controlled infrastructure hosted on Railway, a platform-as-a-service provider, effectively transforming it into a credential harvesting backend.

Victims are lured through a variety of pretexts, including construction bids, DocuSign-themed messages, voicemail alerts, and Microsoft Forms pages. Notably, instead of requiring users to manually enter a code provided in an email, some phishing pages dynamically generate and display the device code directly, streamlining the attack flow and increasing the likelihood of success.

The campaign has impacted a broad range of sectors, including construction, financial services, healthcare, government, and legal organizations, suggesting opportunistic targeting rather than a focus on a specific industry. A significant portion of the malicious activity has been traced to a small cluster of Railway-hosted IP addresses, which account for the majority of observed authentication events.

Researchers have linked this activity to a phishing-as-a-service (PhaaS) platform known as EvilTokens, which recently emerged on Telegram. The platform offers tooling to automate phishing campaigns, generate redirect links, and bypass spam filters, alongside operational support for affiliates, highlighting the continued commoditization of advanced attack techniques.

This campaign aligns with a broader trend observed since early 2025, where threat actors, including several Russia-aligned groups, have increasingly adopted device code phishing due to its ability to exploit trusted authentication workflows.

Given the use of legitimate Microsoft infrastructure and trusted cloud services, detection remains challenging. Organizations are advised to monitor authentication logs for suspicious sign-ins, particularly from Railway-associated IP addresses, revoke compromised tokens, and implement stricter access controls to mitigate risk.

TP-Link Warns Users to Patch Critical Router Authentication Bypass Flaw

TP-Link has released security updates addressing multiple vulnerabilities in its Archer NX router series, including a critical flaw that could allow attackers to bypass authentica...

Canary Trap

Message History

Delivery option(s)