Dragos on DanSec Daily

Cybersecurity Brief – 2026-06-24

Wed, 24 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17]^[19].
The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released ^[3]^[10]^[28].
Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps ^[31].
An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks ^[32].
The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library ^[35].
Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) ^[9].
A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction ^[14].

Notable Threat Actor Activity

The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer ^[4]^[22].
A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors ^[2].
Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems ^[15]^[24].
SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks ^[1].
Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion ^[5].
There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public ^[16].
GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines ^[7].
Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black ^[20].
Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset ^[30].
OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships ^[36].

Regulatory or Policy Developments Affecting the Security Industry

A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections ^[6].

Sources

Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
Dragos Unveils AI for OT Security - securityweek.com
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com

Cybersecurity Brief – 2026-05-07

Thu, 07 May 2026 00:00:00 +0000

Major Incidents or Breaches

Instructure (Canvas) Breach: ShinyHunters claimed responsibility for a breach impacting Instructure, the provider of the Canvas learning management system. The incident exposed personal data of up to 275 million students across educational institutions, highlighting significant vendor risk for schools.
DAEMON Tools Supply Chain Attack: Disc Soft Limited confirmed a supply chain compromise in DAEMON Tools Lite, with trojanized versions distributed globally. A sophisticated backdoor was selectively deployed on a dozen systems, including government and scientific entities. A clean version has since been released.
Claude AI Used in Water Utility Intrusion: Dragos reported that threat actors leveraged Claude AI to facilitate access to operational technology (OT) assets during an intrusion at a Mexican water and drainage utility.
ManageWP Phishing via Google Ads: Attackers used Google-sponsored ads to deliver phishing pages targeting credentials for GoDaddy’s ManageWP platform, affecting WordPress management operations.
Windows Phone Link Exploited: Multiple reports detail hackers abusing Microsoft’s Windows Phone Link feature with the CloudZ RAT and a plugin called Pheno to steal credentials, text messages, and one-time passwords, enabling multi-factor authentication bypass.
Google Chrome AI Model Download Issue: Google Chrome was found to silently download and reinstall a 4GB AI model on users’ devices without explicit consent.

Newly Discovered Vulnerabilities

Palo Alto Networks PAN-OS Zero-Day: A critical, actively exploited, unpatched vulnerability in the PAN-OS User-ID Authentication Portal allows remote code execution on firewalls. The vendor has issued a warning and is working on a fix.
vm2 Node.js Library: A dozen critical vulnerabilities in the vm2 sandboxing library for Node.js were disclosed, enabling sandbox escape and arbitrary code execution. Exploitation could compromise hosts running affected applications.
Cisco DoS Vulnerability: Cisco patched a denial-of-service flaw in Crosswork Network Controller and Network Services Orchestrator products. Exploited systems require a manual reboot to restore operations.

Notable Threat Actor Activity

OceanLotus (APT32): Kaspersky attributed a campaign to OceanLotus involving malicious Python wheel packages uploaded to PyPI, targeting both Windows and Linux users with the ZiChatBot malware.
MuddyWater (Iranian APT): MuddyWater was linked to a campaign masquerading as a Chaos ransomware attack. The group used Microsoft Teams for social engineering, credential harvesting, persistence, and data theft, deploying ransomware as a decoy.
Mirai-Based xlabs_v1 Botnet: Researchers identified a new Mirai variant, xlabs_v1, exploiting Android Debug Bridge (ADB) on exposed devices to conscript them into a DDoS botnet.
NWHStealer via Bun Runtime: Attackers are leveraging the Bun JavaScript runtime to distribute the NWHStealer infostealer, utilizing legitimate developer tools to evade detection.
Quasar Linux RAT Campaign: A sophisticated Quasar Linux RAT campaign is targeting software developers, offering remote access, surveillance, and credential exfiltration capabilities.

Trends, Tools, or Tactics of Interest

Social Engineering via Help Desk Impersonation: Google Threat Intelligence Group (GTIG) is tracking a new threat actor impersonating help desks to trick users into installing malware, indicating continued reliance on social engineering.
Supply Chain and Developer Platform Abuse: Multiple incidents (DAEMON Tools, PyPI, Bun runtime, Google Ads phishing) illustrate ongoing abuse of software supply chains and developer ecosystems for malware distribution.
Infostealer Evasion Techniques: VoidStealer authors have found new methods to bypass Google Chrome’s App-Bound Encryption, facilitating the theft of sensitive data.
AI Governance and Security: Reports highlight the rapid deployment of AI agents within enterprise environments, often outpacing governance and oversight. Additionally, cybercriminal forums are reporting issues with low-quality AI-generated content (“AI slop”).
Ransomware Targeting Backups: Analysis shows ransomware groups increasingly target and destroy backup systems prior to encryption, negating recovery options even when backups exist.

Regulatory or Policy Developments

CISA ‘CI Fortify’ Initiative: The US CISA launched new guidance (“CI Fortify”) urging critical infrastructure operators to invest in resilient OT environments capable of withstanding extended isolation and cyber compromise.
Google Android Binary Transparency: Google announced expanded Binary Transparency for Android apps, introducing a public ledger to verify app authenticity and mitigate supply chain risks.