Wednesday 17 June 2026

Major Incidents or Breaches

• Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
• iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35][42].
• The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
• More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

• Three recently patched vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, exposing up to 30,000 devices to compromise. At least one of the flaws was only patched last week ^[9][21][34].
• CISA has warned of an actively exploited maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) that allows PHP code execution ^[4][33].
• A critical vulnerability in a cPanel plugin (CVE-2026-54420) is being actively exploited, with CISA mandating US government agencies to secure affected servers within three days ^[19].
• A flaw in the Google Cloud Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute code in Google’s infrastructure via bucket squatting ^[5].
• Chrome and Firefox have received updates to patch multiple critical and high-severity memory safety vulnerabilities that could lead to remote code execution ^[32].
• Oracle released its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple product lines ^[31].
• Microsoft is working on a patch for a Defender zero-day vulnerability named “RoguePlanet,” which was disclosed a week ago ^[11].

Notable Threat Actor Activity

• The ShinyHunters extortion gang is implicated in the Kodak breach ^[12].
• The ransomware and data extortion group Vice Society may be linked to the ClickFix campaign, which is delivering malware loaders such as BabaDeda Loader, Lorem Ipsum Loader, and Potemkin via compromised WordPress sites ^[6][27].
• DragonForce ransomware operators have used a custom malware, ‘Backdoor.Turn,’ to conceal command-and-control traffic within Microsoft Teams relay infrastructure ^[20].
• FishMonger, a China-nexus threat group, has deployed a Windows variant of the SprySOCKS backdoor, previously observed only on Linux, against government targets in Honduras, Taiwan, Thailand, and Pakistan ^[10][25].
• At least 15 malicious plugins on the JetBrains Marketplace were designed to steal AI API keys from developers ^[13].

Trends, Tools, or Tactics of Interest

• The new Rokarolla Android banking trojan targets 217 banking and cryptocurrency applications, utilizes 137 remote commands, and achieves full device control and persistence. It is distributed via fake TikTok and Chrome downloads ^[7][14][26].
• GhostTree attack uses recursive NTFS junctions to create numerous valid Windows file paths, causing Microsoft Defender folder scans to never complete and enabling malware to evade detection ^[17].
• The Phantom Stealer malware executes entirely in memory and incorporates anti-analysis techniques to target browser credentials ^[23].
• Steam Workshop, via the Wallpaper Engine app, is being abused to distribute malware hidden in wallpaper packages ^[15].
• Fileless and evasive malware techniques, as seen in both Phantom Stealer and GhostTree, are increasingly being leveraged to avoid detection by endpoint security tools ^[17][23].
• 144 npm packages associated with the Mastra namespace were compromised via a hijacked contributor account, impacting open-source AI development ecosystems ^[3].
• ClickFix campaigns are expanding malware delivery with new loaders and fake update lures, exploiting compromised WordPress sites ^[6][27].
• 94 percent of security incidents involve anonymized infrastructure, and security teams remain largely reactive despite increased access to enrichment and threat intelligence data ^[8].

Regulatory or Policy Developments Affecting the Security Industry

• The UK government will require individuals to verify their age with an ID upload or facial scan before creating new social media accounts, effectively banning under-16s from user-to-user social media platforms from spring 2027. Privacy and security experts have raised concerns about age-verification and privacy implications ^[16][22].
• The US government has imposed export restrictions on Anthropic’s Claude Fable 5 and Mythos 5 AI models, drawing criticism from the security community ^[24][29].
• US federal authorities have taken down sites hosting nonconsensual deepfake images of famous women ^[43].

Sources

1. Kodak confirms data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
2. iRhythm Confirms Data Stolen in Hack - securityweek.com
3. Cardiac patients’ medical data stolen and held to ransom - malwarebytes.com
4. Cybercrime Group Claims Novo Nordisk Hack - securityweek.com
5. Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society - wired.com
6. Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - thehackernews.com
7. Critical Fortinet FortiSandbox flaws now exploited in attacks - bleepingcomputer.com
8. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - securityweek.com
9. CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution - thehackernews.com
10. Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - securityweek.com
11. CISA warns of another cPanel plugin flaw exploited in attacks - bleepingcomputer.com
12. Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - thehackernews.com
13. Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities - securityweek.com
14. Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
15. Microsoft working on Defender patch for RoguePlanet zero-day - bleepingcomputer.com
16. ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures - thehackernews.com
17. 'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading.com
18. Ransomware gang abuses Microsoft Teams relays to hide malicious traffic - bleepingcomputer.com
19. China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - thehackernews.com
20. SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading.com
21. Malicious JetBrains Marketplace plugins steal AI API keys from developers - bleepingcomputer.com
22. New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - thehackernews.com
23. New Rokarolla Android malware targets 217 banking, crypto apps - bleepingcomputer.com
24. Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading.com
25. GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - bleepingcomputer.com
26. Fileless Phantom Stealer Targets Browser Credentials - darkreading.com
27. Steam Workshop abused to spread malware via Wallpaper Engine app - bleepingcomputer.com
28. 144 Mastra npm Packages Compromised via Hijacked Contributor Account - thehackernews.com
29. Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive - thehackernews.com
30. UK to require ID or face scan before you can make social media accounts - bleepingcomputer.com
31. UK Social Media Ban for Minors Has Privacy Experts Worried - darkreading.com
32. Security Community Slams US Ban on Exporting Mythos, Fable - darkreading.com
33. ‘Dangerous’ AI Models Are Coming No Matter What - wired.com
34. Deepfake posting sites depicting famous women taken down by feds - malwarebytes.com