Daily Briefing for 03.22.26

Top stories.

• White House unveils its national legislative framework for AI.
• Threat actors compromise the Trivy vulnerability scanner.
• Tycoon2FA phishing platform recovers following law enforcement disruption.

White House unveils its national legislative framework for AI.

The White House on Friday released its national legislative framework for AI, outlining six key objectives: Implementing stronger safeguards for children, strengthening small businesses, respecting intellectual property rights, preventing censorship, boosting innovation by removing cumbersome regulations, and furthering workforce development and AI skills training programs.

Notably, the framework calls for the Federal government to set a national framework that supersedes state laws, stating that Congress should "preempt state AI laws that impose undue burdens to ensure a minimally burdensome national standard consistent with these recommendations, not fifty discordant ones."

Axios notes that it will be difficult to implement these objectives with bipartisan support, but the framework seems designed to "set the contours of the legislative debate" rather than serve as a bill meant for passage.

Threat actors compromise the Trivy vulnerability scanner.

A threat actor tracked as "TeamPCP" inserted credential-stealing code into the GitHub build environment of the open-source vulnerability scanner Trivy, BleepingComputer reports. Aqua Security, which maintains Trivy, has since removed the malicious code, but urges users to audit their environments and search for exfiltration artifacts if they installed one of the Trojanized versions.

Aqua said in an advisory, "This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have used a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack."

Tycoon2FA phishing platform recovers following law enforcement disruption.

CrowdStrike warns that the Tycoon2FA commodity phishing platform is still operational following a law enforcement disruption effort earlier this month. CrowdStrike observed a short-term decrease in Tycoon2FA activity following the infrastructure takedown, but activity has since returned to normal levels.

The researchers note that "law enforcement bodies and their industry partners often go into these technically complicated efforts knowing full well that adversaries are resilient and will likely ultimately overcome or circumvent technical disruptions and reemerge as threats once again." CrowdStrike says it "nonetheless applauds the efforts by Europol and its partners to disrupt this threat actor's operations," adding that "infrastructure disruption — even if only temporary — can serve to frustrate, slow down, and confuse adversaries."