Megalodon on DanSec Daily

Cybersecurity Brief – 2026-05-27

Wed, 27 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid ^[13].
Information allegedly stolen from 7-Eleven has been leaked, impacting approximately 185,000 individuals and exposing email addresses, names, addresses, and dates of birth ^[33].
Over 5,500 GitHub repositories were compromised in a campaign using Megalodon malware, resulting in theft of credentials and developer secrets ^[18].
More than 700 education and tech websites were hijacked in a large-scale ClickFix malware campaign, exploiting a Ghost CMS flaw to serve malicious Cloudflare verification pages ^[40].

Newly Discovered Vulnerabilities

Microsoft released patches for a critical remote code execution vulnerability in SharePoint (CVE-2026-45659), which could be exploited without specialized conditions ^[8]^[20].
A critical zero-day vulnerability in the KnowledgeDeliver learning management system was exploited to deploy the Godzilla web shell; the flaw involved hardcoded machineKey values that enabled ViewState deserialization attacks ^[12]^[35].
CISA ordered immediate patching of an actively exploited SQL injection vulnerability in Drupal CMS for US government agencies ^[17].
CISA urged urgent patching of a zero-day vulnerability in the LiteSpeed cPanel plugin that was exploited in the wild to execute scripts with root privileges ^[29].

Notable Threat Actor Activity

The ShinyHunters extortion group was responsible for threats and data leaks targeting Charter Communications and 7-Eleven ^[13]^[33].
The Iranian APT group MuddyWater conducted a new espionage campaign targeting organizations across nine countries, employing DLL side-loading techniques ^[6].
The Iranian APT known as Nimbus Manticore continued targeting aviation and software companies using updated tools ^[32].
The FBI warned that the Silent Ransom Group is sending operatives in person to law firms to physically insert USB drives and steal data ^[28].
Fake installers and plugins for popular software such as ChatGPT and Claude, distributed via GitHub and SourceForge, were found to deliver Deno RAT, granting attackers full device control ^[39].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly augmenting attacks with AI tools, including real-time operational deployment of AI in offensive operations, smarter AI-driven DDoS attacks, and use of AI to generate plain-English remediation guidance for vulnerabilities ^[2]^[7]^[38]^[37].
AI chatbot recommendations are being abused to redirect users to cryptojacking malware sites in active campaigns ^[5].
Multi-factor authentication (MFA) prompt bombing remains a prevalent tactic to bypass second-factor protections ^[9].
Remote access trojans such as BTMOB are leveraging ready-made campaign tools to lower barriers for full device compromise on Android devices ^[4].
Microsoft Defender is testing automatic endpoint isolation to prevent lateral movement after compromise ^[15].
AppOmni’s Marlin AI and Varonis Atlas are leveraging AI for autonomous SaaS security investigation and AI governance, respectively ^[31]^[14].
Anthropic released a Claude Sandbox security plugin to assist developers in identifying vulnerabilities during coding and expanded Claude’s enterprise security governance with 28 new integrations, including major security vendors ^[30]^[34].

Regulatory or Policy Developments Affecting the Security Industry

The Indian Computer Emergency Response Team (CERT-In) issued guidelines mandating that critical vulnerabilities in internet-facing systems be patched within 12 hours of detection amid increased AI-assisted attacks ^[10].
CISA announced a revised schedule for town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure ^[27].

Sources

Charter confirms data breach after ShinyHunters extortion threat - bleepingcomputer.com
185,000 Likely Impacted by 7-Eleven Data Breach - securityweek.com
Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos - darkreading.com
700+ education and tech websites hijacked in huge ClickFix malware campaign - malwarebytes.com
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions - thehackernews.com
Microsoft Issues Out-of-Band SharePoint Patch - darkreading.com
KnowledgeDeliver flaw exploited as a zero-day to install web shells - bleepingcomputer.com
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment - securityweek.com
CISA orders feds to patch actively exploited Drupal vulnerability - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day - securityweek.com
MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries - thehackernews.com
Iranian APT Targets Aviation, Software Companies With Updated Tools - securityweek.com
FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data - securityweek.com
Fake software on GitHub and SourceForge distribute Deno RAT - malwarebytes.com
Report: Adversarial Use of AI is Evolving - blog.knowbe4.com
[THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back - thehackernews.com
AI Threat Landscape Digest March-April 2026 - research.checkpoint.com
Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images - securityweek.com
AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites - thehackernews.com
MFA Prompt Bombing: Why Your Second Factor Isn't Saving You - thehackernews.com
BTMOB: A stealthy RAT burrowing deep into Android devices - welivesecurity.com
Microsoft Defender can now automatically isolate hacked endpoints - bleepingcomputer.com
AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security - securityweek.com
How Varonis Atlas integrates Claude Compliance API for AI governance - bleepingcomputer.com
Anthropic Releases New Claude Sandbox, Security Guidance Plugin - securityweek.com
Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations - securityweek.com
CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks - thehackernews.com
CISA Announces Revised Town Hall Schedule to Engage with Stakeholders on Cyber Incident Reporting for Critical Infrastructure - cisa.gov

Cybersecurity Brief – 2026-05-23

Sat, 23 May 2026 00:00:00 +0000

Major Incidents or Breaches

Cloud Atlas has targeted public sector and diplomatic entities in Russia and Belarus, employing new tools including PowerCloud, and leveraging ReverseSocks, SSH, and Tor for persistence on infected systems ^[1].
The Belarus-aligned threat actor Ghostwriter has conducted phishing campaigns against Ukrainian government entities using lures associated with the Prometheus online learning platform ^[10].
The Megalodon automated attack campaign pushed over 5,700 malicious commits to more than 5,500 GitHub repositories within six hours, exploiting CI/CD workflows ^[11].
Authorities in Europe and North America dismantled the “First VPN” criminal VPN service, which was used by at least 25 ransomware groups to facilitate attacks and obscure their origins ^[9]^[30].
Dutch authorities seized 800 servers belonging to a hosting provider that enabled cyberattacks, interference operations, and disinformation campaigns, arresting two individuals ^[14].
A Canadian man was arrested and charged in connection with operating the Kimwolf DDoS botnet, which infected nearly two million devices globally and was used for DDoS-for-hire attacks ^[13]^[20]^[29].
Former US executives pleaded guilty to concealing a tech support fraud scheme that impacted victims worldwide ^[15].

Newly Discovered Vulnerabilities

A maximum-severity vulnerability (CVE-2026-48172, CVSS 10.0) in the LiteSpeed User-End cPanel Plugin is under active exploitation, allowing attackers to execute scripts as root ^[7].
A critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities catalog ^[8]^[17]^[27].
Trend Micro patched a zero-day directory traversal vulnerability (CVE-2026-34926) in Apex One, which has been exploited in attacks targeting Windows systems ^[16]^[31].
Ubiquiti released updates to address three maximum severity vulnerabilities in UniFi OS, which could be exploited by remote, unauthenticated attackers ^[19].
Google released security updates for Chrome to address critical vulnerabilities that could allow remote code execution via malicious websites ^[33].

Notable Threat Actor Activity

Cloud Atlas has updated its toolkit, incorporating PowerCloud and using ReverseSocks, SSH, and Tor for persistence, targeting government and diplomatic organizations in Russia and Belarus ^[1].
Ghostwriter (UAC-0057/UNC1151), aligned with Belarus, is using Prometheus-themed phishing to target Ukrainian governmental bodies ^[10].
Multiple Iran-nexus threat actors, including Nimbus Manticore, have been active during recent Middle East geopolitical tensions, advancing Iran’s strategic cyber objectives ^[32].

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing-as-a-service platform has evolved to leverage OAuth device code phishing, enabling compromise of accounts protected by multifactor authentication ^[2].
Automated malicious commit campaigns, exemplified by Megalodon, are targeting thousands of GitHub repositories by exploiting CI/CD workflows ^[11].
There is an observed trend of threat actors making Windows kernel drivers exploitable from user mode without requiring the original hardware, broadening the attack surface for Bring Your Own Vulnerable Driver (BYOVD) attacks ^[12].
Fake FIFA World Cup websites are targeting soccer fans with phishing schemes designed to steal money and personal data by mimicking official ticketing and merchandise flows ^[6].
Social engineering attacks against the healthcare sector are increasing in sophistication and frequency, as highlighted in Verizon’s 2026 Data Breach Investigations Report ^[22].

Regulatory or Policy Developments Affecting the Security Industry

Lawmakers in the US are demanding answers from CISA following a contractor-related data leak, raising questions about oversight and data security practices within the agency ^[25]^[28].
The addition of the Drupal Core SQL injection vulnerability to the CISA Known Exploited Vulnerabilities catalog mandates accelerated patching timelines for US federal agencies ^[8].

Sources

Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload - securelist.com
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware - thehackernews.com
Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows - thehackernews.com
First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups - thehackernews.com
‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested - securityweek.com
Netherlands seizes 800 servers of hosting firm enabling cyberattacks - bleepingcomputer.com
Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks - thehackernews.com
US and Canada arrest and charge suspected Kimwolf botnet admin - bleepingcomputer.com
Canadian Man Arrested for Operating Kimwolf Botnet - securityweek.com
Former US execs plead guilty to aiding tech support scammers - bleepingcomputer.com
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root - thehackernews.com
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV - thehackernews.com
Drupal: Critical SQL injection flaw now targeted in attacks - bleepingcomputer.com
Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure - securityweek.com
Trend Micro warns of Apex One zero-day exploited in the wild - bleepingcomputer.com
TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
Ubiquiti patches three max severity UniFi OS vulnerabilities - bleepingcomputer.com
Update Chrome now: Critical bugs could let attackers run code - malwarebytes.com
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict - research.checkpoint.com
Report: The Tycoon 2FA Phishing Kit Has Evolved - blog.knowbe4.com
Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective - thehackernews.com
Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise - welivesecurity.com
Verizon DBIR: Healthcare Fends Off Increased Social Engineering Attacks - darkreading.com
Lawmakers Demand Answers as CISA Tries to Contain Data Leak - krebsonsecurity.com
In Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking - securityweek.com