DanSec

Cybersecurity Brief

Monday 15 June 2026

In this brief Infinite Campus, Salesforce, Novo Nordisk, Palo Alto Networks, Microsoft, Google, +10 more
Vendors
Infinite Campus, Salesforce, Novo Nordisk, Palo Alto Networks, Microsoft, Google, WordPress, Anthropic, PushEngage, OptinMonster, TrustPulse
Threat actors
ShinyHunters, Misere, Outsider Enterprise, Conti, Sniper Dz

Major Incidents or Breaches

  • The ShinyHunters extortion group stole personal information from over 137,000 school staff accounts via a Salesforce data theft attack targeting the Infinite Campus K-12 student information system [8].
  • The pharmaceutical company Novo Nordisk confirmed attackers breached its IT systems and accessed personal data stored on compromised infrastructure [17].
  • The French government’s Tchap messaging platform was breached by a threat actor known as “Misere,” affecting approximately 73,000 government accounts. The attacker claims to have stolen messages and user data [18].
  • ShinyHunters claimed responsibility for a breach of the Council of Europe, threatening to leak 297 GB of allegedly stolen data, including employee personal information [19].
  • The state of Maine disabled its public data breach portal after fake VRChat and Discord data breach reports were submitted to the system [21].

Newly Discovered Vulnerabilities

  • Palo Alto Networks reported active exploitation of a recently disclosed PAN-OS vulnerability impacting GlobalProtect VPN portals and gateways, allowing unauthorized access [6].
  • Researchers disclosed a critical vulnerability chain, “SearchLeak,” in Microsoft 365 Copilot Enterprise that enables attackers to steal sensitive data from mailboxes, OneDrive, or SharePoint accounts via a single-click attack [7].

Notable Threat Actor Activity

  • The ShinyHunters extortion gang was identified as responsible for the Infinite Campus data breach and claimed the Council of Europe hack [8][19].
  • The “Misere” hacker breached the French government’s Tchap messaging platform, claiming theft of messages and user data [18].
  • The FBI, in coordination with Google and Black Lotus Labs, dismantled the Outsider Enterprise phishing-as-a-service operation, which used over 9,000 phishing sites, stole nearly 4 million credit cards, and caused approximately $1.9 billion in losses. The service was operated by a Chinese group and leveraged AI to power its phishing campaigns [10][20].
  • A Ukrainian national pleaded guilty in the US to charges related to developing a loader for the Conti ransomware gang [16].
  • Researchers uncovered a network of 152 Chrome wallpaper extensions distributing adware and generating fake traffic, with over 105,000 installations [3].
  • An attacker tampered with JavaScript files of popular WordPress plugins (PushEngage, OptinMonster, TrustPulse) to plant hidden backdoors on websites [4].
  • The Sniper Dz group targeted users in the Middle East and North Africa with scams using fake Facebook accounts and deceptive browser alerts [5].
  • Organizations are increasingly deploying autonomous and semi-autonomous AI agents that interact directly with systems and make decisions without constant human oversight, raising new security concerns [1].
  • Modern phishing, business email compromise, and account takeover attacks are increasingly bypassing traditional email defenses, prompting interest in behavioral AI-based detection [9].
  • The Outsider Enterprise phishing platform leveraged AI to automate and scale phishing operations, using a million URLs and sophisticated evasion techniques [10][20].
  • There is ongoing abuse of onboarding processes, with IT teams sharing temporary passwords insecurely, introducing unnecessary risk [2].
  • Malicious MSI files using obfuscated or steganographic payloads continue to be observed in the wild [13].

Regulatory or Policy Developments Affecting the Security Industry

  • The US government issued an export control directive resulting in Anthropic suspending all access to its Fable 5 and Mythos 5 AI models for foreign nationals [11].

Sources

  1. Infinite Campus data breach affects 137,000 school staff accounts - bleepingcomputer.com
  2. Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems - securityweek.com
  3. French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker - securityweek.com
  4. ShinyHunters Claims Council of Europe Hack - securityweek.com
  5. Maine Disables Data Breach Portal Due to Fake Submissions - securityweek.com
  6. Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw - thehackernews.com
  7. New attack turned Microsoft 365 Copilot into 1-click data theft tool - bleepingcomputer.com
  8. FBI disrupts massive AI-powered phishing service using a million URLs - bleepingcomputer.com
  9. FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service - securityweek.com
  10. Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges - securityweek.com
  11. 152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic - thehackernews.com
  12. Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites - thehackernews.com
  13. Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts - thehackernews.com
  14. Agentic AI Security in 2026: What to Know - blog.knowbe4.com
  15. Webinar: How behavioral AI stops phishing and account takeovers - bleepingcomputer.com
  16. The Onboarding Password Mistake That Creates Unnecessary Risk - thehackernews.com
  17. Evil MSI Background: BASE64 Statistical Analysis, (Mon, Jun 15th) - isc.sans.edu
  18. US Cracks Down on Anthropic AI Models Amid Abuse Concerns - darkreading.com