Carnival Corporation on DanSec Daily

Cybersecurity Brief – 2026-06-02

Tue, 02 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Dashlane, a password manager, disclosed a brute-force attack resulting in the download of encrypted vaults for fewer than 20 personal users. Affected accounts were automatically locked to prevent further compromise. Users also reported account lockouts due to login attempts from unfamiliar locations and devices ^[3]^[12]^[30].
Over 30 npm packages under Red Hat’s @redhat-cloud-services namespace were compromised in a supply chain attack dubbed “Miasma,” distributing a variant of the Shai-Hulud malware to steal developer credentials and secrets ^[4]^[10].
A malicious supply chain campaign targeted developers using OpenAI Codex via a fraudulent npm package, codexui-android, which was designed to steal authentication tokens ^[8].
Dutch police dismantled a botnet comprising 17 million devices that was used as a residential proxy network and facilitated various cybercrimes ^[33].
Nearly 2,000 WordPress websites were infected with malware that uses Steam Community profile comments to hide command-and-control data ^[13].
A fake BlueWallet application targeting Mac users was observed stealing passwords, crypto wallet information, and clipboard data ^[40].
Threat actor DriveSurge hijacked thousands of websites to distribute malware via ClickFix and FakeUpdate campaigns ^[9].
The Spanish National Police arrested an individual responsible for leaking sensitive data of government employees, including those from the National Cybersecurity Institute (INCIBE) ^[11].
The Instagram accounts of high-profile individuals and organisations were compromised via Meta’s AI support bot, allowing attackers to seize and deface accounts with pro-Iranian content ^[27].

Newly Discovered Vulnerabilities

A critical Windows Netlogon remote code execution vulnerability (CVE-2026-41089) is now being actively exploited. Organisations are urged to patch immediately ^[16]^[34].
A new Linux kernel vulnerability, known as CIFSwitch and present for 19 years, allows low-privileged users to escalate to root. Proof-of-concept exploit code has been released ^[5]^[37].
A vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) is being exploited to allow unauthenticated attackers to create administrative accounts on affected sites ^[32].
Palo Alto Networks PAN-OS authentication bypass vulnerability (CVE-2026-0257) has been under active exploitation since four days after its public disclosure, with at least two observed attack waves ^[5]^[22]^[38].

Notable Threat Actor Activity

China-aligned threat groups launched Operation Dragon Weave, targeting officials and citizens in the Czech Republic and Taiwan with the AdaptixC2 agent for cyber espionage ^[6].
Recent campaigns have seen attackers leveraging SVG files in phishing emails, bypassing traditional detection methods ^[28].
Carnival Corporation, a major cruise line operator, was named among top targets in recent cyber incidents ^[39].

Trends, Tools, or Tactics of Interest

Attack vectors in containerised environments remain focused on exposed secrets, privilege misconfigurations, API compromise, and supply chain attacks ^[1].
Malware campaigns are increasingly using unconventional channels for command-and-control, such as hiding payloads in Steam Community profiles ^[13].
There is a trend towards faster exploitation of vulnerabilities following public disclosure, underscoring the importance of rapid patch management ^[15]^[38].
A new browser-based technique, FROST, enables websites to infer user activity on SSDs using JavaScript, raising concerns over novel tracking vectors ^[26].
MSPs are moving beyond traditional vCISO tools, seeking integrated security growth platforms for broader service delivery ^[7].

Regulatory or Policy Developments Affecting the Security Industry

Anthropic will open its Mythos AI system to the EU’s ENISA as part of Project Glasswing, reflecting deepening cooperation between the European Commission and AI vendors ^[20].
Microsoft’s legal threats against researchers disclosing zero-day exploits have sparked backlash, raising concerns about the chilling effect on vulnerability research ^[21].
Oracle has shifted to a monthly patch cadence, with its first rollout addressing 77 vulnerabilities ^[31].

Sources

Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded - thehackernews.com
Dashlane password manager users locked out by brute force attacks - bleepingcomputer.com
Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads - securityweek.com
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm - thehackernews.com
Red Hat npm packages compromised to steal developer credentials - bleepingcomputer.com
OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack - thehackernews.com
Dutch Police Dismantle Massive 17-Million-Device Botnet - securityweek.com
WordPress malware campaign hides payloads in Steam profiles - bleepingcomputer.com
Fake BlueWallet steals passwords, accounts, and crypto from Macs - malwarebytes.com
Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks - bleepingcomputer.com
Spain arrests doxer leaking sensitive data of govt employees - bleepingcomputer.com
Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts - krebsonsecurity.com
Critical Windows Netlogon RCE flaw now exploited in attacks - bleepingcomputer.com
Critical Windows Netlogon Vulnerability in Attackers’ Crosshairs - securityweek.com
⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More - thehackernews.com
19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access - securityweek.com
WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites - securityweek.com
Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit - darkreading.com
Recent Palo Alto Networks Vulnerability Exploited for Weeks - securityweek.com
China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan - thehackernews.com
New Wave Of Phishing Emails with SVG Files, (Tue, Jun 2nd) - isc.sans.edu
1st June – Threat Intelligence Report - research.checkpoint.com
Containers on fire: from container escapes to supply chain attacks - securelist.com
Race Against Time: Why Faster Vulnerability Alerts Matter - bleepingcomputer.com
Websites Can Now Spy on You Through Your Hard Drive - wired.com
The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools - thehackernews.com
Anthropic to Open Mythos AI to EU's ENISA - darkreading.com
Microsoft's Zero-Day Legal Threats Spark Backlash - darkreading.com
Oracle’s First Monthly Patches Resolve 77 Vulnerabilities - securityweek.com

Cybersecurity Brief – 2026-05-29

Fri, 29 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach impacting 4.9 million accounts, with the ShinyHunters extortion group claiming responsibility for stealing personal information in early April ^[10].
Carnival Corporation confirmed a data breach affecting nearly 6 million people, also attributed to the ShinyHunters group, with exposed data including personal details of customers ^[20]^[34]^[42].
Customer data from more than 350 hotels worldwide was accessed as part of reservation-hijacking spear-phishing scams, enabling realistic phishing attacks against hotel guests ^[29].

Newly Discovered Vulnerabilities

A critical, unpatched zero-day vulnerability in Gogs, a self-hosted Git service, allows authenticated users to execute arbitrary code on affected instances. This vulnerability is accessible on Internet-facing deployments ^[5]^[16].
A critical authentication bypass vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) has been actively exploited by threat actors to deploy credential-stealing malware. Fortinet released hotfixes in April after zero-day exploitation was detected ^[6]^[15]^[36].
A security flaw in Gitea exposed 30,000 deployments to attacks, allowing attackers to pull private container images and potentially access source code, credentials, and infrastructure ^[39].

Notable Threat Actor Activity

The North Korean state-sponsored group Kimsuky deployed new tools, including HTTPSpy, HelloDoor, and VS Code Tunnels, in attacks targeting South Korean military and corporate entities ^[4].
The Russian-linked threat cluster GreyVibe has been targeting Ukrainian organizations using AI-generated lures and custom malware, leveraging tools such as ChatGPT and Gemini to enhance their operations ^[12]^[32].
The ShinyHunters extortion gang claimed responsibility for large-scale breaches at Charter Communications and Carnival Corporation, stealing millions of customer records ^[10]^[20]^[34]^[42].

Trends, Tools, or Tactics of Interest

The BTMOB Android remote access trojan is being distributed via a malware-as-a-service model, offering a builder interface for custom phishing payloads and enabling full device takeover, financial theft, data exfiltration, and remote access. It is spreading across Brazil and Latin America ^[13]^[26]^[35].
AI is increasingly being used by both defenders and attackers. GreyVibe uses ChatGPT and Gemini for attack lures, while new security tools such as Google’s AI Threat Defense platform and Edamame’s AI agent monitoring platform are being launched to counter AI-powered threats and monitor AI coding agents for intent drift and secret theft ^[12]^[32]^[38]^[41].
Fake ChatGPT download sites are distributing malware to both Windows and Mac users, with payloads tailored to each platform ^[44].
The FBI issued a warning about fake FIFA websites ahead of the 2026 World Cup, which are being used for fraud schemes including stealing personal and financial information and selling fake tickets ^[14].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft publicly advocated for Coordinated Vulnerability Disclosure (CVD), urging security researchers to work with vendors before publicizing zero-day vulnerabilities ^[7].
IBM and Red Hat announced a $5 billion investment in Project Lightwell, aiming to secure open source software supply chains and address vulnerabilities without disrupting production systems ^[37].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Carnival Cruise confirms data breach affecting nearly 6 million people - bleepingcomputer.com
Carnival Data Breach Exposed 6 Million People - securityweek.com
Carnival confirms data breach impacting nearly 6 million - malwarebytes.com
Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks - wired.com
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code - thehackernews.com
New Gogs zero-day flaw lets hackers get remote code execution - bleepingcomputer.com
Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer - thehackernews.com
Hackers exploit FortiClient EMS flaw to push infostealer malware - bleepingcomputer.com
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks - securityweek.com
Gitea Vulnerability Exposed 30,000 Deployments to Attacks - securityweek.com
Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels - thehackernews.com
GreyVibe hackers use ChatGPT, Gemini to power cyberattacks - bleepingcomputer.com
Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks - securityweek.com
BTMOB Android malware service generates custom phishing payloads - bleepingcomputer.com
BTMOB RAT Spreads Across Brazil, LatAm via MaaS Model - darkreading.com
New BTMOB Android Malware Enables Full Device Takeover - securityweek.com
New Edamame Platform Aims to Catch AI Coding Agents Going Off the Rails - securityweek.com
Google Unveils AI Threat Defense Platform to Fight AI-Powered Cyberattacks - securityweek.com
Fake ChatGPT download site infects Windows and Mac users with malware - malwarebytes.com
FBI warns of fake FIFA websites running World Cup fraud schemes - bleepingcomputer.com
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal - thehackernews.com
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell” - securityweek.com