DentaQuest on DanSec Daily

Cybersecurity Brief – 2026-06-09

Tue, 09 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

SoFi confirmed a data breach at its Hong Kong subsidiary following unauthorised access to a third-party vendor database containing customer information ^[15].
The University of Oxford disclosed a data breach after its CareerConnect careers platform, managed by third-party provider Group GTI, was compromised ^[23].
Lansing Community College reported a breach impacting 174,000 individuals, with hackers accessing personal data from college systems ^[39].
DentaQuest, a US dental benefits administrator, suffered a breach exposing sensitive data, as reported in recent threat intelligence ^[40].
Silent Ransom Group targeted US law firms in escalating extortion attacks, using vishing, IT impersonation, and in-person intrusions to steal data ^[24].
Meta and WhatsApp detected and blocked new spear-phishing attacks linked to NSO Group, and Meta is pursuing a federal court contempt order against the spyware vendor for violating a no-hacking order ^[7]^[18]^[36].
Pirated PC games are being used to distribute password-stealing malware, with over 400,000 devices reportedly infected worldwide ^[42].

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments using IKEv1 has been exploited in zero-day attacks by the Qilin ransomware gang. CISA has ordered US federal agencies to patch within three days ^[8]^[12]^[22]^[25]^[32].
BerriAI LiteLLM is affected by CVE-2026-42271, a high-severity flaw now being exploited in the wild, enabling unauthenticated remote code execution ^[5].
A one-character use-after-free vulnerability in the Linux kernel allows local privilege escalation to root and container escape. Exploits are now public ^[6].
Google patched a new Chrome zero-day vulnerability (CVE-2026-11645) exploited in the wild, marking the fifth such patch this year ^[13]^[33].
Gogs patched a critical zero-day vulnerability enabling remote code execution on Internet-facing instances and access to all repositories ^[19].
Ubiquiti UniFi OS is vulnerable to a chain of three bugs allowing unauthenticated remote code execution with root privileges ^[20].
Everest Forms, a popular WordPress plugin, has a vulnerability being exploited in the wild for remote code execution ^[38].

Notable Threat Actor Activity

The Qilin ransomware gang has been confirmed as the threat actor exploiting the Check Point VPN zero-day vulnerability in active attacks ^[22]^[25]^[32].
The Miasma supply chain campaign has evolved into the Hades attack, involving 37 malicious wheel artifacts across 19 PyPI packages, delivering the Bun credential stealer ^[4]^[27].
The Shai-Hulud supply chain attack compromised 19 science-focused PyPI packages, distributing malware to steal developer secrets ^[17]^[27].
NSO Group has been linked to new WhatsApp spear-phishing campaigns, which were detected and blocked by Meta and WhatsApp ^[7]^[18]^[36].
Silent Ransom Group is escalating its tactics against US law firms, combining vishing, impersonation, and physical intrusion ^[24].

Trends, Tools, or Tactics of Interest

AI-enabled social engineering attacks are increasing, with threat actors leveraging AI to bypass technical security controls and significantly boost phishing campaign volume ^[1]^[9]^[41].
A new side-channel attack called FROST allows malicious websites to track user browser and app activity via SSD timing using only JavaScript, requiring no native code or browser extensions ^[3].
Supply chain attacks via poisoned open-source packages, particularly on PyPI, continue to escalate with evolving tactics and the targeting of developer secrets ^[4]^[17]^[27]^[31].
Android malware (NFCShare) is being distributed as fake banking app updates on GitHub, targeting users with credential-stealing payloads ^[14].
Attackers are increasingly hiding password-stealing malware in cracked and pirated PC games, resulting in large-scale infections ^[42].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the critical Check Point VPN vulnerability within three days due to confirmed exploitation by ransomware actors ^[12].
An extension of the Geneva Conventions is being considered to impose restrictions on cyberwarfare during ceasefire conditions, aiming to address current loopholes in international conflict law ^[26].

Sources

SoFi confirms third-party data breach at Hong Kong subsidiary - bleepingcomputer.com
Oxford University discloses data breach after careers platform hack - bleepingcomputer.com
174,000 Impacted by Lansing Community College Data Breach - securityweek.com
8th June – Threat Intelligence Report - research.checkpoint.com
Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks - darkreading.com
Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order - thehackernews.com
WhatsApp says it disrupted new NSO spyware phishing attacks - bleepingcomputer.com
WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - securityweek.com
Pirated PC games are delivering password-stealing malware - malwarebytes.com
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups - thehackernews.com
CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day - bleepingcomputer.com
Check Point links VPN zero-day attacks to Qilin ransomware gang - bleepingcomputer.com
Check Point VPN Flaw Exploited Since Early May - darkreading.com
Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks - securityweek.com
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - thehackernews.com
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public - thehackernews.com
Google patches new Chrome zero-day flaw exploited in the wild - bleepingcomputer.com
Google Patches 5th Chrome Zero-Day Exploited in 2026 - securityweek.com
Gogs patches critical zero-day enabling remote code execution - bleepingcomputer.com
Critical UniFi OS bug lets hackers gain root without authentication - bleepingcomputer.com
Everest Forms Vulnerability Exploited to Hack WordPress Sites - securityweek.com
Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer - thehackernews.com
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud - darkreading.com
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages - bleepingcomputer.com
Report: AI-Enabled Social Engineering Attacks Are on the Rise - blog.knowbe4.com
AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload - thehackernews.com
Americans lost nearly $900 million to AI-powered scams, FBI says - malwarebytes.com
New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-06-07, (Mon, Jun 8th) - isc.sans.edu
NFCShare Android malware spreads via fake banking app updates on GitHub - bleepingcomputer.com
Iran Signed a Ceasefire — Its Hackers Didn't - darkreading.com

Cybersecurity Brief – 2026-06-06

Sat, 06 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked approximately 234 GB of data allegedly stolen from DentaQuest, impacting 2.6 million individuals ^[26].
The Miasma worm campaign compromised 73 Microsoft GitHub repositories across four organizations in a major supply chain attack ^[7].
Multiple supply chain attacks hit the npm ecosystem, with threat actors using both malicious and trojanized versions of over 50 legitimate packages to distribute Rust-based information stealers, including IronWorm and a new Miasma variant ^[9].
Tech giant Toshiba and retailer Muji reported suspicious Polyfill login screens appearing on their websites, potentially harvesting user credentials ^[14].
Over 900 US automatic tank gauge systems used to monitor fuel and chemical storage tanks were found exposed online and are now under active attack by threat actors ^[18]^[20].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) is under active exploitation, with no patch currently available ^[8].
Hackers are actively exploiting a critical flaw in the Everest Forms Pro WordPress plugin, which allows arbitrary code execution and complete site takeover ^[13].
CISA reported that hackers are exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers ^[15].
A security startup identified 21 previously unknown zero-day vulnerabilities in FFmpeg, a widely used media library ^[6].
Chrome 149 patched 429 vulnerabilities, with over 100 classified as critical or high-severity, primarily related to use-after-free and insufficient input validation ^[6]^[27].

Notable Threat Actor Activity

The FBI warned about the Kali365 phishing-as-a-service platform targeting Microsoft 365 accounts by harvesting OAuth tokens for direct access ^[1].
A Chinese espionage group tracked as UNC5221 accessed Microsoft 365 environments using the Brickstorm backdoor and newly discovered malware named Plenet and AgentPSD ^[16].
A previously unreported threat cluster, OP-512, was observed targeting Microsoft IIS servers with a custom web shell framework ^[11].
Five Eyes intelligence agencies reported that Chinese intelligence officers are targeting government and military staff with fake job opportunities to gain access to classified or privileged information ^[29].

Trends, Tools, or Tactics of Interest

Phishing campaigns increasingly leverage calendar invites to deceive targets and bypass traditional email security controls ^[5].
The 2026 Verizon DBIR highlights that phishing, shadow AI, malicious browser extensions, and credential theft are increasingly occurring at the browser layer ^[19].
Adaptive, agentic AI worms capable of autonomously seeking out vulnerabilities and adapting to new environments are anticipated to become a significant enterprise threat within a year ^[21].
AI-powered tools are being used both offensively and defensively, with public concern about AI’s dual role as threat and tool rising ^[2]^[3]^[12]^[21]^[30].
OWASP released CVE Lite CLI, a free open-source tool to help developers quickly identify and remediate vulnerable dependencies in their projects ^[24].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued an executive order establishing a voluntary framework for early government access to frontier AI models and increased federal security investment ^[22].
Industry experts commented on the executive order’s voluntary nature, its approach to balancing innovation and security, and possible implementation challenges ^[28].

Sources

Hackers Leak DentaQuest Information Impacting 2.6 Million - securityweek.com
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack - thehackernews.com
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks - thehackernews.com
Suspicious Polyfill login prompts pop up on Toshiba, Muji websites - bleepingcomputer.com
Over 900 US gas station tank gauge systems exposed to attacks - bleepingcomputer.com
Exposed Fuel Tank Gauges Under Attack in the US - darkreading.com
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available - thehackernews.com
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites - thehackernews.com
CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers - bleepingcomputer.com
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs - thehackernews.com
Chrome 149 Patches 429 Vulnerabilities - securityweek.com
FBI: Kali365 Phishing Kit is Targeting Microsoft 365 Accounts - blog.knowbe4.com
Chinese APT deploys new malware to keep access to hacked networks - bleepingcomputer.com
New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework - thehackernews.com
Five Eyes: Chinese Spies Target Government, Military Staff With Fake Job Opportunities - securityweek.com
The Silent Invitation: A Deep Dive into Calendar Invite Phishing - blog.knowbe4.com
What 2026 DBIR Confirms: Attacks Are Living in the Browser - bleepingcomputer.com
Adaptive, Agentic AI Worms Loom as Next Enterprise Threat - darkreading.com
KB4-CON - AI Is Everything - blog.knowbe4.com
How to Secure AI Adoption In Your Organization - blog.knowbe4.com
Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver - thehackernews.com
AI: Threat, tool, or both? - malwarebytes.com
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds - securityweek.com
Trump AI Order Seeks Voluntary Frontier Model Testing - darkreading.com
Industry Reactions to New Trump AI Cybersecurity Executive Order: Feedback Friday - securityweek.com

Cybersecurity Brief – 2026-06-05

Fri, 05 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Windows version of Hola Browser was compromised in a supply chain attack, resulting in the delivery of an undeclared cryptocurrency miner to users ^[15].
DentaQuest, a dental benefits administrator, suffered a data breach exposing sensitive information of 2.6 million accounts ^[17].
The United Nations World Food Programme disclosed a breach of its self-registration application for Palestine, affecting 600,000 Gaza households ^[18].
Nightclub operator RCI reported a data breach after detecting a network intrusion in March, with files containing information on 40,000 individuals stolen ^[32].
Unknown attackers maintained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange for at least five months, exfiltrating inbox data in small batches ^[12].
Meta’s AI support bot was manipulated by attackers to hand over control of Instagram accounts by changing recovery email addresses ^[42].

Newly Discovered Vulnerabilities

Cisco patched a critical vulnerability (CVE-2026-20230) in Unified Communications Manager that allowed unauthenticated attackers to write files and escalate privileges to root. Proof-of-concept exploit code is public ^[5]^[23].
Cisco warned of an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245), enabling root privilege escalation. This is the seventh SD-WAN zero-day exploited in 2026 ^[13]^[33].
A flaw in Anthropic’s Claude Code GitHub Action allowed attackers to hijack public repositories by submitting a single malicious GitHub issue ^[6].
A vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento can be exploited without authentication to execute code on Magento servers using serialized PHP object payloads ^[38].
Researchers identified a hijack method for Google’s Gemini voice assistant via messaging notifications, enabling attackers to control smart home devices and initiate Zoom calls ^[37].

Notable Threat Actor Activity

The threat actor PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create a covert SMTP relay network for email-based attacks ^[4].
The China-linked cybercrime group TA4922 expanded its phishing and malware campaigns to target organizations in the UK, Germany, Italy, and South Africa, leveraging credential phishing, malware distribution, and fraud ^[9]^[25]^[39].
A new Magecart campaign is abusing Stripe’s API infrastructure to host credit card-stealing payloads and exfiltrate stolen payment data from checkout pages ^[16].
Researchers and the FBI warned of a surge in FIFA World Cup 2026 scams, including fake sites, banking malware, and credential theft targeting fans ahead of the event ^[3].
Operation FlutterBridge is distributing the FlutterShell backdoor to macOS users via malicious Google and YouTube ads ^[10].
A supply chain attack infected 36 npm packages with infostealer malware named IronWorm, targeting developers and propagating via compromised credentials ^[19]^[24].

Trends, Tools, or Tactics of Interest

Chinese-language phishing kits are becoming more advanced, with phishing-as-a-service offerings proliferating in Chinese cybercriminal circles ^[2].
Large-scale operations are impersonating open-source and freeware tools using Traffic Distribution Systems (TDS) to deliver malware through highly ranked fake sites in Google search results ^[11].
Attackers are increasingly exploiting gaps in vulnerability management programs, with underground tutorials teaching newcomers how to identify and profit from unpatched systems ^[20].
The use of MSI-branded background payloads embedded in JPEG images for malware delivery has re-emerged, indicating continued evolution of steganographic techniques ^[30].
Law enforcement and technology companies disrupted infrastructure linked to scammers across Southeast Asia, impacting over 1.4 million accounts ^[40].

Regulatory or Policy Developments Affecting the Security Industry

Bugcrowd launched a European Union data residency option to address evolving data sovereignty requirements amid growing geopolitical tensions ^[27].

Sources

Hola Browser for Windows compromised to deliver cryptominer - bleepingcomputer.com
DentaQuest data breach exposed info of 2.6 million accounts - bleepingcomputer.com
UN food agency discloses breach affecting 600,000 Gaza households - bleepingcomputer.com
Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals - securityweek.com
Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months - thehackernews.com
Meta’s AI support bot happily handed Instagram accounts to hackers - malwarebytes.com
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - thehackernews.com
Cisco warns of critical Unified CM flaw with PoC exploit code - bleepingcomputer.com
Cisco warns of unpatched SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 - securityweek.com
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories - thehackernews.com
Mirasvit Vulnerability Exploited to Execute Code on Magento Servers - securityweek.com
Gemini Voice Assistant Hijacked via Messaging Notifications - securityweek.com
PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network - thehackernews.com
China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa - thehackernews.com
China's TA4922 Expands Cybercrime Attacks Globally - darkreading.com
Chinese Cybercrime Group in Spotlight for Record Campaign Pace - securityweek.com
Credit card theft campaign abuses Stripe to host stolen payment info - bleepingcomputer.com
FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins - thehackernews.com
FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads - thehackernews.com
New IronWorm malware hits 36 packages in npm supply-chain attack - bleepingcomputer.com
Rust-Written IronWorm Hits NPM Supply Chain - darkreading.com
Chinese-Language Phishing Kits Are Growing More Advanced - blog.knowbe4.com
Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS - thehackernews.com
Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook - bleepingcomputer.com
The Evil MSI Background is Back!, (Fri, Jun 5th) - isc.sans.edu
Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown - securityweek.com
Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs - darkreading.com