Cybersecurity Brief – 2026-06-04

Thu, 04 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

IMA Diligence Services suffered a data breach impacting 525,000 individuals, with personal information stolen from a legacy server managed by a third party ^[43].
A global stock exchange was compromised through a months-long email campaign, granting attackers access to a senior executive’s inbox for 150 days and enabling prolonged data exfiltration ^[31]^[42].

Newly Discovered Vulnerabilities

Two maximum-severity zero-day vulnerabilities affecting Acer Wave 7 mesh routers have been disclosed and are pending patches ^[22].
A critical remote code execution flaw (CVE-2026-45247) in the Mirasvit Cache Warmer extension for Magento has been added to CISA’s Known Exploited Vulnerabilities catalog ^[6].
A vulnerability in Microsoft 365 Android apps, caused by a leftover debug flag, allowed any app on the same device to steal account tokens, bypassing authentication restrictions ^[11]^[29].
A prompt injection vulnerability in Google Gemini’s voice assistant on Android enabled malicious notifications from apps such as WhatsApp or Slack to hijack the assistant and execute commands ^[8]^[30].
A one-click attack in Microsoft Visual Studio Code allowed attackers to steal users’ GitHub OAuth tokens simply by tricking them into clicking a link ^[13]^[38].
An unpatched Windows Search URI issue could allow attackers to steal users’ NTLMv2 hashes, similar to the previously reported CVE-2026-33829 ^[15].
Redis patched a two-year-old use-after-free vulnerability (CVE-2026-23479) that allowed authenticated users to execute arbitrary OS commands, discovered by an autonomous AI tool ^[12].
A new denial-of-service attack, dubbed the HTTP/2 Bomb, can crash web servers within seconds by exploiting the default configuration of major HTTP/2 servers ^[19]^[45].
CISA and other agencies warned of active exploitation of vulnerabilities in the Linux kernel and Android operating system, including a Linux kernel bug that allows privilege escalation and container escape ^[20]^[44].
Cisco warned about the availability of a proof-of-concept exploit for a critical Unified Communications Manager (Unified CM) vulnerability that allows unauthenticated remote server-side request forgery ^[37].

Notable Threat Actor Activity

Chinese-speaking cybercriminals have expanded operations into Europe, deploying the previously undocumented Atlas RAT malware in targeted attacks ^[16].
China-linked espionage groups have conducted cyber operations against at least a dozen Latin American nations, targeting sectors such as maritime shipping and oil production ^[27].
Pakistani threat actors used the Xeno RAT in espionage operations against Afghanistan’s Finance Ministry ^[25].
A new campaign abuses Google DoubleClick in malspam to deliver the DesckVB RAT, leveraging trusted domains to bypass detection ^[9].
Kaspersky researchers identified the Argamal RAT being distributed via infected hentai games, providing remote access to compromised machines ^[1].
Threat actors are actively exploiting vulnerabilities in WordPress plugins Kirki and Burst Statistics to escalate privileges and take over websites ^[40].
A malware distribution ecosystem was detailed involving impersonation, click hijacking, and traffic distribution systems (TDS) to deliver malicious payloads, often leveraging search engine results ^[47].
Infostealers are increasingly used as phishing payloads due to their scalability and availability, becoming a preferred method for cybercriminals ^[50].
Scammers are using legitimate hotel reservation information to craft highly targeted phishing attacks against travelers ^[2].
Scammers are exploiting geopolitical unrest, such as conflicts in the Middle East and Ukraine, to run charity scams ^[3].
Athletes and sports teams are increasingly targeted by advanced social engineering attacks ^[4].
A fake-invoice campaign was observed in its early stages, using social engineering and fear tactics to extract money and devices from victims ^[48].

Trends, Tools, or Tactics of Interest

Attackers are using Python scripts and AI to automate testing of malware against endpoint detection and response (EDR) solutions, improving evasion capabilities ^[26].
Continuous security testing is highlighted as essential, as traditional periodic penetration tests leave organizations exposed for long periods between assessments ^[21].
Enterprise identity and access management (IAM) is becoming increasingly fragmented, raising the need for identity visibility and intelligence platforms to reduce attack surfaces ^[14].
The AI Risk Quadrant has been introduced as a framework to evaluate the security of AI agents based on compromise vulnerability, impact, and defense strength ^[41].
Google is adding Android protections against AI deepfake scam calls, aiming to detect and flag calls using AI-generated voices for impersonation ^[24].
Social engineering attacks, such as those leveraging infostealers and fake invoices, remain prevalent and are being adapted to new vectors and payloads ^[48]^[50].
Scam Number Check tools are emerging to help users verify if a phone number is associated with scams before responding ^[49].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Nobitex, Iran’s largest cryptocurrency exchange, for facilitating ransomware-related and terrorist payments ^[17].
The US Department of Justice disrupted Southeast Asia-based cryptocurrency fraud networks, freezing 3.8 million dollars in assets ^[7].
European and international law enforcement agencies dismantled nine organized crime groups and arrested 29 suspects in a coordinated crackdown on illegal streaming operations ^[23].
CISA, the FBI, NSA, and Department of Energy issued a joint alert on cyberattacks targeting internet-exposed automatic tank gauge systems used in fuel and logistics sectors ^[18].
Microsoft responded to criticism regarding legal threats against security researchers who publicly disclose zero-day vulnerabilities, seeking to address concerns over responsible disclosure practices ^[46].
Cyber insurance rates are reportedly dropping, but policy exclusions are widening, particularly regarding coverage for social engineering attacks ^[28].

Sources

IMA Diligence Services Data Breach Impacts 525,000 People - securityweek.com
Global Stock Exchange Hit by Monthslong Email Campaign - darkreading.com
Hackers Target Global Stock Exchange in Espionage Operation - securityweek.com
Acer working to patch max severity zero-days in Wave 7 routers - bleepingcomputer.com
CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog - thehackernews.com
Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag - thehackernews.com
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover - darkreading.com
WhatsApp, Slack Notifications Could Hijack Google Gemini on Android - thehackernews.com
Malicious Notifications Could Trick Google Gemini Users - darkreading.com
One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens - thehackernews.com
VS Code Vulnerability Allows One-Click GitHub Token Theft - securityweek.com
Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes - thehackernews.com
Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) - thehackernews.com
New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute - bleepingcomputer.com
‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds - securityweek.com
CISA warns of active attacks exploiting Android, Linux bugs - bleepingcomputer.com
Organizations Warned of Exploited Linux Kernel Vulnerability - securityweek.com
Cisco Warns of Available PoC for Critical Unified CM Vulnerability - securityweek.com
Chinese hackers use new Atlas RAT malware in European cyberattacks - bleepingcomputer.com
Tropical Blend: Cyber & Politics Ramp Up Across Latin America - darkreading.com
Pakistan Spies on Afghan Finance Ministry With Xeno RAT - darkreading.com
Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT - thehackernews.com
Argamal: Malware hidden in hentai games - securelist.com
Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs - securityweek.com
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - research.checkpoint.com
Infostealers are becoming the go-to phishing payload - malwarebytes.com
Phishing Attacks Are Using Real Hotel Reservation Info to Target Travelers - blog.knowbe4.com
Warning: Scammers are Exploiting Geopolitical Unrest - blog.knowbe4.com
Athletes Are Increasingly Targeted by Social Engineering Attacks - blog.knowbe4.com
We found this fake-invoice campaign while scammers were still building it - malwarebytes.com
Attackers Use AI to Automate EDR Evasion Testing - darkreading.com
What 345 Days of Untested Exposure Looks Like at a Bank - bleepingcomputer.com
Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP) - thehackernews.com
Security of 100 AI Agents Tested and Ranked – What You Need to Know - securityweek.com
Google adds Android protection against AI deepfake scam calls - bleepingcomputer.com
Keep getting calls from questionable numbers? Meet Scam Number Check - malwarebytes.com
U.S. sanctions Nobitex crypto exchange used by Iranian ransomware actors - bleepingcomputer.com
DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets - thehackernews.com
Police dismantles 9 crime groups in illegal streaming crackdown - bleepingcomputer.com
CISA warns of cyberattacks targeting fuel tank monitoring systems - bleepingcomputer.com
Microsoft Tries to Calm Legal Threat Fears After Zero-Day Disclosure Backlash - securityweek.com
Cyber Insurance Rates Are Dropping, but Exclusions Widen - darkreading.com

Acer on DanSec Daily

Cybersecurity Brief – 2026-06-04

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources