Major Incidents or Breaches

  • The Windows version of Hola Browser was compromised in a supply chain attack, resulting in the delivery of an undeclared cryptocurrency miner to users [15].
  • DentaQuest, a dental benefits administrator, suffered a data breach exposing sensitive information of 2.6 million accounts [17].
  • The United Nations World Food Programme disclosed a breach of its self-registration application for Palestine, affecting 600,000 Gaza households [18].
  • Nightclub operator RCI reported a data breach after detecting a network intrusion in March, with files containing information on 40,000 individuals stolen [32].
  • Unknown attackers maintained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange for at least five months, exfiltrating inbox data in small batches [12].
  • Meta’s AI support bot was manipulated by attackers to hand over control of Instagram accounts by changing recovery email addresses [42].

Newly Discovered Vulnerabilities

  • Cisco patched a critical vulnerability (CVE-2026-20230) in Unified Communications Manager that allowed unauthenticated attackers to write files and escalate privileges to root. Proof-of-concept exploit code is public [5][23].
  • Cisco warned of an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245), enabling root privilege escalation. This is the seventh SD-WAN zero-day exploited in 2026 [13][33].
  • A flaw in Anthropic’s Claude Code GitHub Action allowed attackers to hijack public repositories by submitting a single malicious GitHub issue [6].
  • A vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento can be exploited without authentication to execute code on Magento servers using serialized PHP object payloads [38].
  • Researchers identified a hijack method for Google’s Gemini voice assistant via messaging notifications, enabling attackers to control smart home devices and initiate Zoom calls [37].

Notable Threat Actor Activity

  • The threat actor PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create a covert SMTP relay network for email-based attacks [4].
  • The China-linked cybercrime group TA4922 expanded its phishing and malware campaigns to target organizations in the UK, Germany, Italy, and South Africa, leveraging credential phishing, malware distribution, and fraud [9][25][39].
  • A new Magecart campaign is abusing Stripe’s API infrastructure to host credit card-stealing payloads and exfiltrate stolen payment data from checkout pages [16].
  • Researchers and the FBI warned of a surge in FIFA World Cup 2026 scams, including fake sites, banking malware, and credential theft targeting fans ahead of the event [3].
  • Operation FlutterBridge is distributing the FlutterShell backdoor to macOS users via malicious Google and YouTube ads [10].
  • A supply chain attack infected 36 npm packages with infostealer malware named IronWorm, targeting developers and propagating via compromised credentials [19][24].

Trends, Tools, or Tactics of Interest

  • Chinese-language phishing kits are becoming more advanced, with phishing-as-a-service offerings proliferating in Chinese cybercriminal circles [2].
  • Large-scale operations are impersonating open-source and freeware tools using Traffic Distribution Systems (TDS) to deliver malware through highly ranked fake sites in Google search results [11].
  • Attackers are increasingly exploiting gaps in vulnerability management programs, with underground tutorials teaching newcomers how to identify and profit from unpatched systems [20].
  • The use of MSI-branded background payloads embedded in JPEG images for malware delivery has re-emerged, indicating continued evolution of steganographic techniques [30].
  • Law enforcement and technology companies disrupted infrastructure linked to scammers across Southeast Asia, impacting over 1.4 million accounts [40].

Regulatory or Policy Developments Affecting the Security Industry

  • Bugcrowd launched a European Union data residency option to address evolving data sovereignty requirements amid growing geopolitical tensions [27].

[3]: FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins
[4]: PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network
[5]: Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
[6]: Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
[9]: China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa
[10]: FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads
[11]: Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS
[12]: Hackers Spied on a Stock Exchange Executive’s Outlook Mailbox for Five Months
[13]: Cisco warns of unpatched SD-WAN zero-day exploited in attacks
[15]: Hola Browser for Windows compromised to deliver cryptominer
[16]: Credit card theft campaign abuses Stripe to host stolen payment info
[17]: DentaQuest data breach exposed info of 2.6 million accounts
[18]: UN food agency discloses breach affecting 600,000 Gaza households
[19]: New IronWorm malware hits 36 packages in npm supply-chain attack
[20]: Hackers Are After the Gaps in Your Vulnerability Program: Here’s Their Playbook
[23]: Cisco warns of critical Unified CM flaw with PoC exploit code
[24]: Rust-Written IronWorm Hits NPM Supply Chain
[25]: China’s TA4922 Expands Cybercrime Attacks Globally
[27]: Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs
[30]: The Evil MSI Background is Back
[32]: Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals
[33]: Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026
[37]: Gemini Voice Assistant Hijacked via Messaging Notifications
[38]: Mirasvit Vulnerability Exploited to Execute Code on Magento Servers
[39]: Chinese Cybercrime Group in Spotlight for Record Campaign Pace
[40]: Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown
[42]: Meta’s AI support bot happily handed Instagram accounts to hackers

Sources#

  1. Hola Browser for Windows compromised to deliver cryptominer - bleepingcomputer.com
  2. DentaQuest data breach exposed info of 2.6 million accounts - bleepingcomputer.com
  3. UN food agency discloses breach affecting 600,000 Gaza households - bleepingcomputer.com
  4. Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals - securityweek.com
  5. Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months - thehackernews.com
  6. Meta’s AI support bot happily handed Instagram accounts to hackers - malwarebytes.com
  7. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - thehackernews.com
  8. Cisco warns of critical Unified CM flaw with PoC exploit code - bleepingcomputer.com
  9. Cisco warns of unpatched SD-WAN zero-day exploited in attacks - bleepingcomputer.com
  10. Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 - securityweek.com
  11. Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories - thehackernews.com
  12. Mirasvit Vulnerability Exploited to Execute Code on Magento Servers - securityweek.com
  13. Gemini Voice Assistant Hijacked via Messaging Notifications - securityweek.com
  14. PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network - thehackernews.com
  15. China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa - thehackernews.com
  16. China's TA4922 Expands Cybercrime Attacks Globally - darkreading.com
  17. Chinese Cybercrime Group in Spotlight for Record Campaign Pace - securityweek.com
  18. Credit card theft campaign abuses Stripe to host stolen payment info - bleepingcomputer.com
  19. FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins - thehackernews.com
  20. FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads - thehackernews.com
  21. New IronWorm malware hits 36 packages in npm supply-chain attack - bleepingcomputer.com
  22. Rust-Written IronWorm Hits NPM Supply Chain - darkreading.com
  23. Chinese-Language Phishing Kits Are Growing More Advanced - blog.knowbe4.com
  24. Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS - thehackernews.com
  25. Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook - bleepingcomputer.com
  26. The Evil MSI Background is Back!, (Fri, Jun 5th) - isc.sans.edu
  27. Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown - securityweek.com
  28. Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs - darkreading.com