SocGholish on DanSec Daily

Cybersecurity Brief – 2026-06-24

Wed, 24 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17]^[19].
The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released ^[3]^[10]^[28].
Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps ^[31].
An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks ^[32].
The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library ^[35].
Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) ^[9].
A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction ^[14].

Notable Threat Actor Activity

The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer ^[4]^[22].
A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors ^[2].
Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems ^[15]^[24].
SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks ^[1].
Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion ^[5].
There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public ^[16].
GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines ^[7].
Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black ^[20].
Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset ^[30].
OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships ^[36].

Regulatory or Policy Developments Affecting the Security Industry

A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections ^[6].

Sources

Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
Dragos Unveils AI for OT Security - securityweek.com
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com

Cybersecurity Brief – 2026-06-20

Sat, 20 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers exploited a vulnerability in the Klue Battlecards app integration to steal OAuth tokens, allowing unauthorized access to Salesforce customer data. The breach impacted several organizations, including cybersecurity firms such as Huntress and Recorded Future. The Icarus threat group has claimed responsibility for the attack, and Salesforce has disabled the Klue integration in response ^[9]^[10]^[24].
The Texas Parks and Wildlife Department disclosed a data breach at its license system vendor, exposing personal information for over three million individuals, including driver’s license data ^[12].
A large-scale credential theft campaign known as FortiBleed compromised credentials for approximately 86,000 Fortinet firewalls and VPN devices, representing about half of all internet-accessible Fortinet devices. CISA has issued warnings to Fortinet customers regarding ongoing malicious activity targeting FortiGate appliances ^[6]^[23].
Operation Endgame, involving law enforcement agencies from the Netherlands, Canada, Germany, and the US, disrupted infrastructure associated with the SocGholish malware network and remediated nearly 15,000 infected WordPress sites ^[5]^[25].

Newly Discovered Vulnerabilities

Researchers disclosed an unpatchable exploit, usbliter8, which achieves arbitrary code execution within the SecureROM of Apple A12 and A13 chips. This exploit cannot be addressed via software updates as the affected code is burned into hardware ^[2].
Microsoft researchers identified an exploit chain named AutoJack, which enables a single malicious web page to hijack an AI agent and achieve remote code execution on the host system ^[4].
A critical vulnerability in Splunk Enterprise is being actively exploited in the wild. CISA has urged US federal agencies to apply patches by Sunday to mitigate risk ^[16].
A vulnerability in the Gravity SMTP WordPress plugin is being actively exploited in the wild, allowing unauthenticated attackers to access sensitive information on over 100,000 websites ^[11].
Apple patched a Bluetooth vulnerability in Beats Studio Buds that allowed nearby attackers to eavesdrop via the device’s microphone ^[26].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service (RaaS) operation is distributing the GentleKiller EDR framework to affiliates, targeting and disabling over 400 security processes on victim systems ^[3].
The Icarus threat actor group has claimed responsibility for the OAuth token theft and subsequent data breach affecting Klue and its customers ^[10].
Threat actors are delivering eBanking phishing emails using IPv4-mapped IPv6 addresses to evade detection and target major financial institutions ^[19].
CryptoBandits malware has been observed functioning both as a backdoor and for data theft, leveraging a local SOCKS5 proxy and the Tor network for traffic routing and remote code execution ^[22].

Trends, Tools, or Tactics of Interest

AI-powered scams resulted in nearly $900 million in losses in the US last year, according to the FBI, demonstrating increasing use of generative AI in fraud operations ^[1].
The shift from assistive to agentic AI is changing threat management, with AI agents increasingly capable of autonomous actions across enterprise environments ^[7].
Security concerns are shifting from data leakage to access control as “shadow AI” tools proliferate in organizations, often with insufficient oversight ^[8].
AI agents are increasingly recognized as unique identities within organizations, capable of accessing sensitive data and triggering workflows, yet are often not managed with appropriate security controls ^[13].
Modern phishing attacks are bypassing multi-factor authentication (MFA) protections, including through techniques such as Device Code phishing, prompting a need for advanced behavioral detection and response ^[14].
The Burp Suite Extension Awards highlighted advancements in recon, authentication, workflow, and API testing tools for web security professionals ^[20].
CISOs report that the proliferation of threats and the adoption of AI are increasing stress and driving changes in cybersecurity team structures, with a growing demand for specialist expertise ^[18].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued directives and warnings to US federal agencies and Fortinet customers regarding the need to patch critical vulnerabilities and secure devices against ongoing exploitation campaigns ^[6]^[16]^[23].
Law enforcement collaboration in Operation Endgame demonstrates ongoing international efforts to disrupt malware infrastructure and remediate large-scale website compromises ^[5]^[25].

Sources

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data - thehackernews.com
Klue OAuth breach victim list grows as Icarus hackers claim attack - bleepingcomputer.com
Cybersecurity Firms Impacted by Klue Supply Chain Attack - securityweek.com
Texas govt data breach exposes over 3 million driver’s licenses - bleepingcomputer.com
CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices - thehackernews.com
FortiBleed: 86,000 Fortinet Device Credentials Compromised - securityweek.com
Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites - thehackernews.com
Nearly 15,000 infected websites cleaned in SocGholish crackdown - malwarebytes.com
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain - thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution - thehackernews.com
CISA: Splunk Enterprise flaw actively exploited, patch by Sunday - bleepingcomputer.com
Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin - bleepingcomputer.com
Apple patches Beats Studio Buds flaw that could turn earbuds into a wiretap - malwarebytes.com
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes - thehackernews.com
eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th) - isc.sans.edu
CryptoBandits Malware Doubles as a Backdoor, Abuses Tor - securityweek.com
Americans Lost $900 Million to AI-Powered Scams Last Year - blog.knowbe4.com
From Assistive to Agentic: The AI Shift That's Redefining Threat Management - thehackernews.com
Forget Data Leakage: Shadow AI's Real Threat Is Access Control - thehackernews.com
Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way - bleepingcomputer.com
Webinar: How attackers bypass MFA and how defenders can respond - bleepingcomputer.com
Burp Extensibility 2026: Awards, Talks, and Highlights - portswigger.net
Stressors, AI Forcing Changes to Cybersecurity Teams - darkreading.com

Cybersecurity Brief – 2026-06-19

Fri, 19 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17]^[29].
Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13]^[21].
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19]^[36].
Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations ^[4]^[22].
F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems ^[5]^[24].
Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies ^[42].
Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation ^[44].
Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix ^[45].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite ^[3]^[14].
The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays ^[11].
The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations ^[17]^[29].
A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities ^[8]^[16].
Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp ^[19]^[36].
The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes ^[33].
The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 ^[9].

Trends, Tools, or Tactics of Interest

There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise ^[20].
Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted ^[7].
Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked ^[6].
The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion ^[3]^[14].
The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data ^[43].
Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles ^[46].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials ^[13].
CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 ^[37].
New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements ^[10].

Sources

Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com

Cybersecurity Brief – 2025-08-08

Fri, 08 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Bouygues Telecom confirmed a data breach affecting 6.4 million customers, exposing personal information.
Air France and KLM disclosed a breach via a third-party customer service platform, compromising customer names, email addresses, phone numbers, and other non-financial data.
Chanel notified clients of a third-party breach impacting customer data, joining other luxury brands affected by similar incidents.
Google, Adidas, and other organisations suffered breaches after employees were tricked via phone calls into granting access to Salesforce data, attributed to ShinyHunters.
Mozilla’s Firefox add-on store was targeted by the “GreedyBear” campaign, which uploaded 150 malicious extensions that drained cryptocurrency wallets, stealing an estimated $1 million.
TeaOnHer, a dating advice app, was found leaking user personal data.
Recent ransomware attacks against SonicWall Gen 7 firewalls with SSL VPN enabled were linked to exploitation of an older, patched vulnerability, not a zero-day.

Newly Discovered Vulnerabilities

Microsoft disclosed CVE-2025-53786, a high-severity privilege escalation flaw in on-premise Exchange Server hybrid deployments, allowing attackers to gain elevated privileges in Exchange Online. Both Microsoft and CISA have issued advisories; CISA mandated emergency patching for US federal agencies.
Security flaws were reported in Axis Communications video surveillance products, exposing over 6,500 servers to potential remote takeover.
Researchers discovered a privilege escalation issue in Amazon ECS, allowing IAM hijacking and cross-resource access via an undocumented protocol.
New HTTP request smuggling/desync attacks exploiting HTTP/1.1 vulnerabilities impacted major CDNs and millions of websites.
Two malicious npm packages masquerading as WhatsApp developer tools were discovered, containing destructive data-wiping code targeting developer systems.
Researchers found that encryption algorithms used in law enforcement and military radios may be easily cracked, potentially allowing eavesdropping.

Notable Threat Actor Activity

SocGholish malware operators are utilising Traffic Distribution Systems (Parrot TDS, Keitaro TDS) to redirect users to malicious content, delivering access to ransomware groups including LockBit and Evil Corp.
ShinyHunters resurfaced, conducting low-tech social engineering attacks to breach Salesforce data at major corporations.
The Silver Fox APT group demonstrated operations blending espionage and cybercrime, attributed to Chinese threat actors.
North Korean IT scammers’ operational details were leaked, revealing structured targeting and internal surveillance.
Eight ransomware groups, including RansomHub, have adopted a new EDR killer tool, an evolution of EDRKillShifter, to disable endpoint detection and response solutions during attacks.
Akira ransomware attacks targeting SonicWall firewalls exploited a known vulnerability, not a zero-day.

Trends, Tools, or Tactics of Interest

The FBI warned of attackers sending physical packages containing malicious QR codes (“quishing”) to initiate phishing campaigns via postal mail.
Surge in vishing scams, where attackers impersonate service providers offering discounts in exchange for upfront fees.
Rise in Python and Go supply chain attacks, with malicious packages discovered that deliver cross-platform malware and trigger remote data wipes.
Increased use of AI in both offensive and defensive cloud security operations, with AI now central to evolving attack and defence strategies.
150+ malicious Firefox extensions highlight the ongoing risk in browser extension ecosystems.
Clickjacking campaigns on adult sites are being used to manipulate Facebook user engagement.
EDR killer tools are being actively distributed across multiple ransomware operations for disabling security controls.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring all US Federal Civilian Executive Branch agencies to patch Microsoft Exchange Server CVE-2025-53786 by Monday.
The founders of Samourai Wallet pleaded guilty to laundering over $200 million for cybercriminals and agreed to forfeit the proceeds.
A court found Meta accessed sensitive health data from the Flo app without user consent.
The Alliance for Creativity and Entertainment (ACE) took offline Rare Breed TV, a major illegal IPTV service, following a financial settlement.