Daily Briefing for 03.25.26

Top stories.

• UK police make over 500 arrests in anti-fraud operation.
• Threat actors compromise a popular PyPI package.
• Business news: Consumer privacy company Cloaked raises $375 million in a Series B round.

UK police make over 500 arrests in anti-fraud operation.

UK police have arrested 557 suspects as part of Operation Henhouse 5, the fifth year of a country-wide anti-fraud campaign, Infosecurity Magazine reports. The operation also resulted in 249 cease-and-desist notices, account-freezing orders against £9 million (US$12 million), and seizures of cash and assets worth £18.1 million (US$24.2 million). The UK's National Crime Agency (NCA) stated, "2026 is the most successful intensification period yet, with every single UK police force and Regional Organised Crime Unit taking part in the operation. They were joined by national agencies including the Serious Fraud Office, National Crime Agency and National Trading Standards, and supported by the Financial Conduct Authority."

Separately, the UK's National Cyber Security Centre (NCSC) CEO Richard Horne said in a keynote speech at RSAC that governments and the private sector need to mount a coordinated effort to combat cyber threats, the Record reports. Horne warned that cyber risks now carry greater consequences, driven by cooperation between state and criminal actors, and no single measure will suffice to defend against these threats. Framing the response in basketball terms, Horne called for a "full court press" to apply pressure on adversaries.

Threat actors compromise a popular PyPI package.

FutureSearch discovered a supply-chain attack affecting a PyPI release belonging to LiteLLM, a popular library that allows apps to interact with various LLMs. FutureSearch stated, "At 10:52 UTC on March 24, 2026, litellm version 1.82.8 was published to PyPI. The release contains a malicious .pth file (litellm_init.pth) that executes automatically on every Python process startup when litellm is installed in the environment." The purpose of the malware is to establish persistence, then harvest and exfiltrate sensitive files.

The malicious release has since been removed. Sonatype noted in its own report, "The compromised versions were available on PyPI for at least two hours. Given the package's three million daily downloads, the compromised litellm could have seen significant exposure during that short time span."

The attack may be tied to the TeamPCP threat actor, but attribution is still under investigation.

Business news: Consumer privacy company Cloaked raises $375 million in a Series B round.

Massachusetts-based consumer privacy company Cloaked has raised $375 million in a Series B round led by General Catalyst and Liberty City Ventures, with participation from Lux Capital, Human Capital, Marquee Ventures, Fifth Growth Fund, NFL Players Association, LG Technology Ventures, Assurant Ventures, and DuckDuckGo. TechCrunch says the Cloaked "aims to expand the team in different areas like product, engineering, enterprise sales, and international expansion." The company previously secured $25 million in Series A funding in 2022.

Read more in the Business Briefing at 4pm ET.