Major Incidents or Breaches

  • Threat actors gained access to personal and protected health information affecting 1.4 million individuals in a breach at Xsolis, impacting data received from its clients [27].
  • The JaredFromSubway Ethereum MEV bot suffered a $15 million theft after an attacker manipulated its opportunity-detection logic using fake cryptocurrency trading opportunities [15].
  • Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed impact from the Klue hack [34].
  • A large-scale credential harvesting campaign, dubbed FortiBleed, targeted Fortinet FortiGate devices using custom sniffers to steal authentication secrets, resulting in a database of over 86,000 confirmed working credentials [17][33].
  • Thousands of outdated D-Link routers have been compromised and are now under the control of the AryStinger botnet, with no available security updates [36].

Newly Discovered Vulnerabilities

  • A critical heap over-read vulnerability in the Squid web proxy, dubbed Squidbleed, can leak cleartext HTTP requests including credentials or session tokens to anyone allowed to send traffic through the same proxy. The flaw has existed for 29 years and is described as Heartbleed-style in its impact [8][28].
  • Four vulnerabilities in Dify, an open-source agentic workflow platform, could allow attackers to stealthily access AI chat data across tenants [7].
  • A newly disclosed flaw in FFmpeg, called PixelSmash, could allow remote code execution on Jellyfin servers and trigger denial-of-service conditions in other applications [16].
  • Microsoft addressed a vulnerability chain named AutoJack in AutoGen Studio, which could let attackers manipulate AI agents to execute arbitrary commands on host systems [19].
  • A new exploit, Usbliter8, can bypass Apple’s boot defenses on millions of iPhones. The vulnerability is unpatchable, and a proof-of-concept exploit has been released [32].
  • Vulnerable iterations of the Gravity SMTP WordPress plugin are being exploited to leak API keys, secrets, tokens, server information, and other sensitive data [29].

Notable Threat Actor Activity

  • A global malicious campaign is distributing VBScript files via WhatsApp messages, leading to the installation of a legitimate Remote Monitoring and Management (RMM) tool, specifically the UEMS RMM agent, through a multi-stage infection chain. The campaign leverages fake business documents as lures [1][4][14].
  • Unknown threat actors compromised multiple ShapedPlugin WordPress plugins in a supply chain attack, injecting backdoor code through tampered official release channels [6].
  • North Korean state-affiliated hackers are attributed to a supply chain attack on Mastra NPM packages, where a malicious dependency in over 140 packages fetches payloads targeting cryptocurrency browser extensions [30].
  • A new campaign utilizes the OXLOADER malware loader, delivered via malicious Google Ads, to install CastleStealer on victim systems [9].
  • Attackers are using an elaborate fake reputation-boosting campaign across GitHub, YouTube, and VirusTotal to distribute a cross-platform clipboard hijacker targeting cryptocurrency assets [21].

Trends, Tools, or Tactics of Interest

  • The Anti-Phishing Working Group (APWG) reports a surge in phishing scams across social media platforms in Q1 2026 [2].
  • Attackers are increasingly exploiting document delivery scams, leveraging seemingly official voicemails and messages to trick recipients into interacting with malicious content [37].
  • The underground market for stolen credentials is evolving, with attackers now paying others to search large credential dumps for specific targets, streamlining credential abuse [20].
  • Webshells continue to be a persistent tool for attackers, remaining popular for maintaining unauthorized access to compromised systems [26].
  • Ransomware crews are actively attempting to disable security tools, including EDR solutions, as part of ongoing attack campaigns [12].
  • AI is being leveraged to amplify online scams, including sophisticated World Cup-related fraud involving fake tickets and cloned websites [23].
  • OpenAI has expanded its Daybreak initiative with the release of the GPT-5.5-Cyber model and a “Patch the Planet” campaign aimed at helping defenders patch security flaws, with a particular focus on open-source software vulnerabilities [5][22].

Regulatory or Policy Developments Affecting the Security Industry

  • Google has announced that, starting September 30, 2026, Android developer verification will be enforced in four countries, with major device-maker app stores participating from the outset [10].
  • Canada’s spy agency used a first-of-its-kind judicial warrant to access and clean botnet-infected devices, including servers, home routers, and IoT equipment located within Canadian territory [13].

[1]: A VBScript campaign distributed through WhatsApp deploying RMM software
[2]: APWG Report: Social Media Phishing is Surging
[4]: WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
[5]: OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws
[6]: ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
[7]: Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants
[8]: 29-Year-Old Squid Proxy Bug ‘Squidbleed’ Can Leak Cleartext HTTP Requests
[9]: New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
[10]: Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries
[12]: ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
[13]: Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
[14]: WhatsApp phishing attack uses fake business docs to hack PCs
[15]: JaredFromSubway MEV bot hacked in $15 million crypto theft
[16]: FFmpeg fixes PixelSmash flaw in widely used video decoder
[17]: FortiBleed campaign used custom FortiGate sniffer to steal credentials
[19]: Microsoft fixes AutoGen Studio flaw that enabled code execution
[20]: A Glimpse into the “Search Your Target” Market for Stolen Credentials
[21]: Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign
[22]: OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos
[26]: Webshells Remain Popular, (Mon, Jun 22nd)
[27]: Xsolis Data Breach Affects 1.4 Million Individuals
[28]: Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data
[29]: Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data
[30]: North Korean Hackers Blamed for Mastra NPM Supply Chain Attack
[32]: New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones
[33]: Fortinet Responds to FortiBleed Campaign
[34]: More Cybersecurity Firms Disclose Impact From Klue Hack
[36]: Thousands of D-Link routers under control of AryStinger botnet
[37]: Document delivery scams: What are they and what’s their goal

Sources#

  1. Xsolis Data Breach Affects 1.4 Million Individuals - securityweek.com
  2. JaredFromSubway MEV bot hacked in $15 million crypto theft - bleepingcomputer.com
  3. More Cybersecurity Firms Disclose Impact From Klue Hack - securityweek.com
  4. FortiBleed campaign used custom FortiGate sniffer to steal credentials - bleepingcomputer.com
  5. Fortinet Responds to FortiBleed Campaign - securityweek.com
  6. Thousands of D-Link routers under control of AryStinger botnet - malwarebytes.com
  7. 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests - thehackernews.com
  8. Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data - securityweek.com
  9. Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants - thehackernews.com
  10. FFmpeg fixes PixelSmash flaw in widely used video decoder - bleepingcomputer.com
  11. Microsoft fixes AutoGen Studio flaw that enabled code execution - bleepingcomputer.com
  12. New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones - securityweek.com
  13. Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data - securityweek.com
  14. A VBScript campaign distributed through WhatsApp deploying RMM software - securelist.com
  15. WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool - thehackernews.com
  16. WhatsApp phishing attack uses fake business docs to hack PCs - bleepingcomputer.com
  17. ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack - thehackernews.com
  18. North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - securityweek.com
  19. New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer - thehackernews.com
  20. Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign - darkreading.com
  21. APWG Report: Social Media Phishing is Surging - blog.knowbe4.com
  22. Document delivery scams: What are they and what’s their goal? - malwarebytes.com
  23. A Glimpse into the “Search Your Target” Market for Stolen Credentials - bleepingcomputer.com
  24. Webshells Remain Popular, (Mon, Jun 22nd) - isc.sans.edu
  25. ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More - thehackernews.com
  26. World Cup Scams Are Getting Harder to Spot - wired.com
  27. OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws - thehackernews.com
  28. OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos - wired.com
  29. Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries - thehackernews.com
  30. Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices - thehackernews.com