GreyVibe on DanSec Daily

Cybersecurity Brief – 2026-05-30

Sat, 30 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach affecting 4.9 million accounts, with the ShinyHunters extortion group responsible for stealing and leaking personal information from the US telecom giant in early April ^[16]^[25].
Dutch authorities disrupted a malware botnet comprising 17 million infected devices and seized over 200 servers supporting the operation ^[12].
23andMe, now Chrome Holding Co., is facing a lawsuit from the California Attorney General over a 2023 breach that exposed sensitive customer genetic and personal information ^[10]^[28].
Trump Mobile reportedly exposed customer data in a recent breach ^[24].

Newly Discovered Vulnerabilities

Palo Alto Networks reported that CVE-2026-0257, a medium-severity authentication bypass vulnerability in PAN-OS and Prisma Access, is under active exploitation ^[3].
Researchers disclosed a vulnerability in OpenAI ChatGPT that exploits trust in Markdown links and images, potentially enabling phishing attacks via web summaries ^[4].
A critical argument injection flaw in Gogs, a Git server, allows authenticated attackers to achieve remote code execution via malicious pull requests. The vulnerability has a CVSS score of 9.4 and is considered a zero-day ^[27].
Google Chrome version 148 update addresses 151 vulnerabilities, including critical-severity issues that could lead to remote code execution ^[29].
An exploit chain in a popular cloud automation service combined over-permissioned roles, secrets discovery, and non-human identities, exposing the risk of major compromise in complex cloud integrations ^[19].

Notable Threat Actor Activity

The ShinyHunters extortion gang was responsible for the Charter Communications breach, leaking over 42 million records ^[16]^[25].
A previously undocumented Russia-linked threat actor, GREYVIBE, has been carrying out persistent AI-powered cyberattacks against Ukraine and related entities since at least August 2025 ^[6].
Threat actors are abusing ChatGPT’s content-sharing feature to host fake outage pages, tricking users into downloading malware disguised as a desktop application ^[9].
An unknown threat actor used a large language model (LLM) agent for post-compromise actions after exploiting the Marimo CVE-2026-39987 vulnerability ^[5].
Cybercriminals are impersonating Signal Support in phishing campaigns to steal backup recovery keys, enabling access to victims’ entire message archives ^[30].
Malicious NuGet packages masquerading as a Sicoob SDK were discovered stealing banking credentials, while npm packages targeted cloud secrets ^[8].
Phishing campaigns are targeting the 2026 FIFA World Cup, leveraging event interest for malicious activity ^[24].
The criminal gang known as “The Com” is conducting cyberattacks to financially support violence and sexual exploitation ^[20].

Trends, Tools, or Tactics of Interest

DDoS attacks are increasingly being offered as subscription-based services, featuring pricing tiers, support, and reseller programs, reflecting the professionalization of the DDoS-as-a-Service market ^[11].
The rise of “shadow AI” is evidenced by employees developing and deploying full AI-powered applications into production systems without adequate oversight, resulting in increased exposure and risk ^[7].
There is a trend toward attackers leveraging LLM agents for post-exploitation activities, as seen in the Marimo CVE-2026-39987 incident ^[5].
Attackers are exploiting cloud integration misconfigurations, particularly through over-permissioned roles and secrets exposure, to compromise automation services ^[19].
MokN raised $15 million for a “phish-back” platform that uses decoy access points to lure attackers and capture compromised credentials ^[26].

Regulatory or Policy Developments Affecting the Security Industry

The California Attorney General has initiated legal action against 23andMe (now Chrome Holding Co.) for failing to protect customer data in the wake of its 2023 breach ^[10]^[28].
Google Chrome has rolled out Device Bound Session Credentials (DBSC) to all users, providing enhanced protection against session cookie theft and account takeover ^[13].
Asia’s cyber insurance market is showing signs of increased activity and growth after historically slow uptake ^[18].
The US Cybersecurity and Infrastructure Security Agency (CISA) has responded to recent supply chain attacks, highlighting ongoing government engagement in addressing such threats ^[24].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Charter Communications Data Breach Could Impact Nearly 5 Million - securityweek.com
Dutch govt disrupts malware botnet with 17 million infected devices - bleepingcomputer.com
California AG sues 23andMe over 2023 breach exposing health data - bleepingcomputer.com
California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach - securityweek.com
In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks - securityweek.com
PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation - thehackernews.com
ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface - thehackernews.com
Gogs Zero-Day Exposes Servers to Remote Code Execution - securityweek.com
Chrome 148 Update Patches 151 Vulnerabilities - securityweek.com
With Complex Cloud Integrations, Small Errors Lead to Major Compromises - darkreading.com
New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks - thehackernews.com
ChatGPT share links abused to host fake outage pages to deliver malware - bleepingcomputer.com
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit - thehackernews.com
Signal users targeted in backup-stealing phishing attacks - malwarebytes.com
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets - thehackernews.com
'The Com' Cyberattacks Support Violence & Sexploitation - darkreading.com
From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market - bleepingcomputer.com
What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks - thehackernews.com
MokN Raises $15 Million for Phish-Back Platform - securityweek.com
Google Chrome adds session cookie theft protection for all users - bleepingcomputer.com
Asia's Cyber Insurance Market Shows Signs of Life - darkreading.com

Cybersecurity Brief – 2026-05-29

Fri, 29 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach impacting 4.9 million accounts, with the ShinyHunters extortion group claiming responsibility for stealing personal information in early April ^[10].
Carnival Corporation confirmed a data breach affecting nearly 6 million people, also attributed to the ShinyHunters group, with exposed data including personal details of customers ^[20]^[34]^[42].
Customer data from more than 350 hotels worldwide was accessed as part of reservation-hijacking spear-phishing scams, enabling realistic phishing attacks against hotel guests ^[29].

Newly Discovered Vulnerabilities

A critical, unpatched zero-day vulnerability in Gogs, a self-hosted Git service, allows authenticated users to execute arbitrary code on affected instances. This vulnerability is accessible on Internet-facing deployments ^[5]^[16].
A critical authentication bypass vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) has been actively exploited by threat actors to deploy credential-stealing malware. Fortinet released hotfixes in April after zero-day exploitation was detected ^[6]^[15]^[36].
A security flaw in Gitea exposed 30,000 deployments to attacks, allowing attackers to pull private container images and potentially access source code, credentials, and infrastructure ^[39].

Notable Threat Actor Activity

The North Korean state-sponsored group Kimsuky deployed new tools, including HTTPSpy, HelloDoor, and VS Code Tunnels, in attacks targeting South Korean military and corporate entities ^[4].
The Russian-linked threat cluster GreyVibe has been targeting Ukrainian organizations using AI-generated lures and custom malware, leveraging tools such as ChatGPT and Gemini to enhance their operations ^[12]^[32].
The ShinyHunters extortion gang claimed responsibility for large-scale breaches at Charter Communications and Carnival Corporation, stealing millions of customer records ^[10]^[20]^[34]^[42].

Trends, Tools, or Tactics of Interest

The BTMOB Android remote access trojan is being distributed via a malware-as-a-service model, offering a builder interface for custom phishing payloads and enabling full device takeover, financial theft, data exfiltration, and remote access. It is spreading across Brazil and Latin America ^[13]^[26]^[35].
AI is increasingly being used by both defenders and attackers. GreyVibe uses ChatGPT and Gemini for attack lures, while new security tools such as Google’s AI Threat Defense platform and Edamame’s AI agent monitoring platform are being launched to counter AI-powered threats and monitor AI coding agents for intent drift and secret theft ^[12]^[32]^[38]^[41].
Fake ChatGPT download sites are distributing malware to both Windows and Mac users, with payloads tailored to each platform ^[44].
The FBI issued a warning about fake FIFA websites ahead of the 2026 World Cup, which are being used for fraud schemes including stealing personal and financial information and selling fake tickets ^[14].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft publicly advocated for Coordinated Vulnerability Disclosure (CVD), urging security researchers to work with vendors before publicizing zero-day vulnerabilities ^[7].
IBM and Red Hat announced a $5 billion investment in Project Lightwell, aiming to secure open source software supply chains and address vulnerabilities without disrupting production systems ^[37].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Carnival Cruise confirms data breach affecting nearly 6 million people - bleepingcomputer.com
Carnival Data Breach Exposed 6 Million People - securityweek.com
Carnival confirms data breach impacting nearly 6 million - malwarebytes.com
Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks - wired.com
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code - thehackernews.com
New Gogs zero-day flaw lets hackers get remote code execution - bleepingcomputer.com
Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer - thehackernews.com
Hackers exploit FortiClient EMS flaw to push infostealer malware - bleepingcomputer.com
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks - securityweek.com
Gitea Vulnerability Exposed 30,000 Deployments to Attacks - securityweek.com
Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels - thehackernews.com
GreyVibe hackers use ChatGPT, Gemini to power cyberattacks - bleepingcomputer.com
Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks - securityweek.com
BTMOB Android malware service generates custom phishing payloads - bleepingcomputer.com
BTMOB RAT Spreads Across Brazil, LatAm via MaaS Model - darkreading.com
New BTMOB Android Malware Enables Full Device Takeover - securityweek.com
New Edamame Platform Aims to Catch AI Coding Agents Going Off the Rails - securityweek.com
Google Unveils AI Threat Defense Platform to Fight AI-Powered Cyberattacks - securityweek.com
Fake ChatGPT download site infects Windows and Mac users with malware - malwarebytes.com
FBI warns of fake FIFA websites running World Cup fraud schemes - bleepingcomputer.com
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal - thehackernews.com
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell” - securityweek.com