Klue on DanSec Daily

Cybersecurity Brief – 2026-06-27

Sat, 27 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Polymarket customers lost approximately $3 million after hackers injected a malicious script into the platform’s frontend via a third-party vendor compromise. Polymarket has stated it will fully reimburse affected customers ^[16]^[31].
The Klue-Salesforce breach has impacted roughly two dozen companies, with affected organizations notifying their customers of the incident ^[27].
Exposed records from the Dialog group included personal information of a senior White House intelligence official and an active-duty special operations officer, prompting a Pentagon review ^[25].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Amazon Q Developer allowed malicious repositories to execute code and steal developers’ cloud credentials. AWS has patched the flaw and issued an advisory ^[7]^[26].
CVE-2026-46331, also known as “pedit COW,” is an out-of-bounds write flaw in the Linux kernel’s traffic-control subsystem that enables local privilege escalation to root ^[6].
DirtyClone is a newly disclosed Linux kernel privilege escalation vulnerability in the DirtyFrag family. Researchers have published a working exploit for the flaw ^[9].
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM to its Known Exploited Vulnerabilities (KEV) catalog, as web shell attacks exploiting this flaw continue ^[8].
CISA has set an urgent deadline for federal agencies to patch an actively exploited vulnerability in Cisco Unified Communications Manager Server ^[15].

Notable Threat Actor Activity

Russian intelligence-linked hackers have evolved their phishing campaign targeting Signal users. The latest tactics involve tricking victims into providing Signal Backup Recovery Keys, granting attackers access to message histories ^[3]^[14].
The Turla group, a Russian APT, has deployed the StockStay backdoor in espionage operations against Ukrainian government and military targets ^[32].
A Chinese-speaking APT has been linked to the deployment of a new custom backdoor, TinyRCT, in attacks against government entities and critical infrastructure in Southeast Asia ^[5].
A newly observed campaign is delivering SharkLoader malware, which acts as a loader for deploying Cobalt Strike Beacon on compromised systems ^[4].
Cybersecurity researchers have detected a supply chain attack involving the Miasma malware family, which targeted npm packages and GitHub Actions ^[11].
Microsoft reported a phishing campaign targeting hotels and hospitality organizations in Europe and Asia, using photo-themed ZIP files to deliver a Node.js implant ^[12].
Threat actors are impersonating legitimate companies by creating fraudulent OpenAI tenants and inviting cybersecurity firm employees, aiming to collect sensitive corporate information ^[17].
Malware campaigns are installing malicious Chrome extensions via phishing to steal Chrome session cookies and hijack user accounts on Windows devices ^[33].
Russian authorities used Cellebrite forensic tools to extract data from an opposition activist’s iPhone, despite Cellebrite’s earlier claims of halting sales to Russia ^[13]^[28].

Trends, Tools, or Tactics of Interest

There is a continued rise in supply chain attacks, as evidenced by recent incidents involving npm packages, GitHub Actions, and third-party vendor compromises ^[11]^[16]^[31].
Attackers are increasingly targeting backup and recovery mechanisms within secure messaging platforms, as seen in the Signal phishing campaigns ^[3]^[14].
The use of Cobalt Strike Beacon remains prevalent in new malware loader campaigns, such as those involving SharkLoader ^[4].
AI agents are being integrated into enterprise identity governance, inheriting permissions and traversing systems with minimal oversight ^[10].
Confidence in autonomous penetration testing tools powered by AI is declining, with organizations experimenting but relying less on these technologies ^[19].
The Open Source Sustainability Initiative has launched to help enterprises manage and secure aging open source projects and maintain regulatory compliance ^[21].
The Linux Foundation has announced Akrites, a new open source security project to support vulnerability reporting, patching, and disclosure in open source software ^[30].

Regulatory or Policy Developments Affecting the Security Industry

CISA continues to mandate urgent patching of actively exploited vulnerabilities in widely used enterprise products, including Cisco Unified Communications Manager Server and PTC Windchill ^[8]^[15].
The Open Source Sustainability Initiative aims to address regulatory compliance challenges related to end-of-life open source software ^[21].

Sources

Polymarket customers lose $3 million in supply-chain attack - bleepingcomputer.com
$3 Million Reportedly Stolen in Polymarket Hack - securityweek.com
More Klue Breach Victims Identified as Hackers Get Hacked - securityweek.com
The Pentagon Is Looking Into the Dialog Data Exposure for Unmasking National Security Officials - wired.com
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs - thehackernews.com
Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories - securityweek.com
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries - thehackernews.com
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets - thehackernews.com
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue - thehackernews.com
CISA sets urgent deadline to fix Cisco flaw exploited in attacks - bleepingcomputer.com
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys - thehackernews.com
FBI: Russian hackers now target Signal backup recovery keys - bleepingcomputer.com
Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets - securityweek.com
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign - thehackernews.com
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - thehackernews.com
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack - thehackernews.com
Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant - thehackernews.com
Cybersecurity firms targeted by fraudulent OpenAI organization invites - bleepingcomputer.com
Malware steals Chrome session cookies to take over your accounts - malwarebytes.com
Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff - thehackernews.com
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs - securityweek.com
Guardian Agents: The Next Layer of Identity Governance - thehackernews.com
AI Decline? Confidence in Autonomous Penetration Testing Falls - darkreading.com
New Initiative Tackles Security for End-of-Life Open Source Software - darkreading.com
Linux Foundation Unveils New Open Source Security Project Akrites - securityweek.com

Cybersecurity Brief – 2026-06-24

Wed, 24 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17]^[19].
The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released ^[3]^[10]^[28].
Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps ^[31].
An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks ^[32].
The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library ^[35].
Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) ^[9].
A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction ^[14].

Notable Threat Actor Activity

The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer ^[4]^[22].
A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors ^[2].
Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems ^[15]^[24].
SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks ^[1].
Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion ^[5].
There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public ^[16].
GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines ^[7].
Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black ^[20].
Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset ^[30].
OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships ^[36].

Regulatory or Policy Developments Affecting the Security Industry

A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections ^[6].

Sources

Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
Dragos Unveils AI for OT Security - securityweek.com
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com

Cybersecurity Brief – 2026-06-23

Tue, 23 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Threat actors gained access to personal and protected health information affecting 1.4 million individuals in a breach at Xsolis, impacting data received from its clients ^[27].
The JaredFromSubway Ethereum MEV bot suffered a $15 million theft after an attacker manipulated its opportunity-detection logic using fake cryptocurrency trading opportunities ^[15].
Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed impact from the Klue hack ^[34].
A large-scale credential harvesting campaign, dubbed FortiBleed, targeted Fortinet FortiGate devices using custom sniffers to steal authentication secrets, resulting in a database of over 86,000 confirmed working credentials ^[17]^[33].
Thousands of outdated D-Link routers have been compromised and are now under the control of the AryStinger botnet, with no available security updates ^[36].

Newly Discovered Vulnerabilities

A critical heap over-read vulnerability in the Squid web proxy, dubbed Squidbleed, can leak cleartext HTTP requests including credentials or session tokens to anyone allowed to send traffic through the same proxy. The flaw has existed for 29 years and is described as Heartbleed-style in its impact ^[8]^[28].
Four vulnerabilities in Dify, an open-source agentic workflow platform, could allow attackers to stealthily access AI chat data across tenants ^[7].
A newly disclosed flaw in FFmpeg, called PixelSmash, could allow remote code execution on Jellyfin servers and trigger denial-of-service conditions in other applications ^[16].
Microsoft addressed a vulnerability chain named AutoJack in AutoGen Studio, which could let attackers manipulate AI agents to execute arbitrary commands on host systems ^[19].
A new exploit, Usbliter8, can bypass Apple’s boot defenses on millions of iPhones. The vulnerability is unpatchable, and a proof-of-concept exploit has been released ^[32].
Vulnerable iterations of the Gravity SMTP WordPress plugin are being exploited to leak API keys, secrets, tokens, server information, and other sensitive data ^[29].

Notable Threat Actor Activity

A global malicious campaign is distributing VBScript files via WhatsApp messages, leading to the installation of a legitimate Remote Monitoring and Management (RMM) tool, specifically the UEMS RMM agent, through a multi-stage infection chain. The campaign leverages fake business documents as lures ^[1]^[4]^[14].
Unknown threat actors compromised multiple ShapedPlugin WordPress plugins in a supply chain attack, injecting backdoor code through tampered official release channels ^[6].
North Korean state-affiliated hackers are attributed to a supply chain attack on Mastra NPM packages, where a malicious dependency in over 140 packages fetches payloads targeting cryptocurrency browser extensions ^[30].
A new campaign utilizes the OXLOADER malware loader, delivered via malicious Google Ads, to install CastleStealer on victim systems ^[9].
Attackers are using an elaborate fake reputation-boosting campaign across GitHub, YouTube, and VirusTotal to distribute a cross-platform clipboard hijacker targeting cryptocurrency assets ^[21].

Trends, Tools, or Tactics of Interest

The Anti-Phishing Working Group (APWG) reports a surge in phishing scams across social media platforms in Q1 2026 ^[2].
Attackers are increasingly exploiting document delivery scams, leveraging seemingly official voicemails and messages to trick recipients into interacting with malicious content ^[37].
The underground market for stolen credentials is evolving, with attackers now paying others to search large credential dumps for specific targets, streamlining credential abuse ^[20].
Webshells continue to be a persistent tool for attackers, remaining popular for maintaining unauthorized access to compromised systems ^[26].
Ransomware crews are actively attempting to disable security tools, including EDR solutions, as part of ongoing attack campaigns ^[12].
AI is being leveraged to amplify online scams, including sophisticated World Cup-related fraud involving fake tickets and cloned websites ^[23].
OpenAI has expanded its Daybreak initiative with the release of the GPT-5.5-Cyber model and a “Patch the Planet” campaign aimed at helping defenders patch security flaws, with a particular focus on open-source software vulnerabilities ^[5]^[22].

Regulatory or Policy Developments Affecting the Security Industry

Google has announced that, starting September 30, 2026, Android developer verification will be enforced in four countries, with major device-maker app stores participating from the outset ^[10].
Canada’s spy agency used a first-of-its-kind judicial warrant to access and clean botnet-infected devices, including servers, home routers, and IoT equipment located within Canadian territory ^[13].

Sources

Xsolis Data Breach Affects 1.4 Million Individuals - securityweek.com
JaredFromSubway MEV bot hacked in $15 million crypto theft - bleepingcomputer.com
More Cybersecurity Firms Disclose Impact From Klue Hack - securityweek.com
FortiBleed campaign used custom FortiGate sniffer to steal credentials - bleepingcomputer.com
Fortinet Responds to FortiBleed Campaign - securityweek.com
Thousands of D-Link routers under control of AryStinger botnet - malwarebytes.com
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests - thehackernews.com
Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data - securityweek.com
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants - thehackernews.com
FFmpeg fixes PixelSmash flaw in widely used video decoder - bleepingcomputer.com
Microsoft fixes AutoGen Studio flaw that enabled code execution - bleepingcomputer.com
New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones - securityweek.com
Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data - securityweek.com
A VBScript campaign distributed through WhatsApp deploying RMM software - securelist.com
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool - thehackernews.com
WhatsApp phishing attack uses fake business docs to hack PCs - bleepingcomputer.com
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack - thehackernews.com
North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - securityweek.com
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer - thehackernews.com
Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign - darkreading.com
APWG Report: Social Media Phishing is Surging - blog.knowbe4.com
Document delivery scams: What are they and what’s their goal? - malwarebytes.com
A Glimpse into the “Search Your Target” Market for Stolen Credentials - bleepingcomputer.com
Webshells Remain Popular, (Mon, Jun 22nd) - isc.sans.edu
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More - thehackernews.com
World Cup Scams Are Getting Harder to Spot - wired.com
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws - thehackernews.com
OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos - wired.com
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries - thehackernews.com
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices - thehackernews.com

Cybersecurity Brief – 2026-06-22

Mon, 22 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed they were impacted by the Klue hack, which affected customers of the Klue platform ^[5].
A data breach at Texas Parks & Wildlife, resulting from a compromise of a third-party license vendor, exposed personal information of approximately 3 million individuals ^[6].

Notable Threat Actor Activity

The AryStinger malware was identified as infecting over 4,300 legacy routers globally, primarily D-Link models, to create a distributed reconnaissance and proxy network rather than a traditional DDoS botnet ^[1]^[3].

Trends, Tools, or Tactics of Interest

INTERPOL reported a significant rise in phishing, ransomware, and AI-driven scams across the Asia-Pacific region, attributing the increase to expanding digitalization, greater internet access, and the adoption of new technologies by organized criminal networks ^[2].
The AryStinger campaign demonstrates a shift in the use of compromised routers, leveraging them for proxy and reconnaissance purposes rather than for DDoS attacks ^[1]^[3].

Sources

More Cybersecurity Firms Disclose Impact From Klue Hack - securityweek.com
Texas Parks & Wildlife Data Breach Affects 3 Million Individuals - securityweek.com
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network - thehackernews.com
AryStinger botnet infected thousands of D-Link routers worldwide - bleepingcomputer.com
INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific - thehackernews.com

Cybersecurity Brief – 2026-06-20

Sat, 20 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers exploited a vulnerability in the Klue Battlecards app integration to steal OAuth tokens, allowing unauthorized access to Salesforce customer data. The breach impacted several organizations, including cybersecurity firms such as Huntress and Recorded Future. The Icarus threat group has claimed responsibility for the attack, and Salesforce has disabled the Klue integration in response ^[9]^[10]^[24].
The Texas Parks and Wildlife Department disclosed a data breach at its license system vendor, exposing personal information for over three million individuals, including driver’s license data ^[12].
A large-scale credential theft campaign known as FortiBleed compromised credentials for approximately 86,000 Fortinet firewalls and VPN devices, representing about half of all internet-accessible Fortinet devices. CISA has issued warnings to Fortinet customers regarding ongoing malicious activity targeting FortiGate appliances ^[6]^[23].
Operation Endgame, involving law enforcement agencies from the Netherlands, Canada, Germany, and the US, disrupted infrastructure associated with the SocGholish malware network and remediated nearly 15,000 infected WordPress sites ^[5]^[25].

Newly Discovered Vulnerabilities

Researchers disclosed an unpatchable exploit, usbliter8, which achieves arbitrary code execution within the SecureROM of Apple A12 and A13 chips. This exploit cannot be addressed via software updates as the affected code is burned into hardware ^[2].
Microsoft researchers identified an exploit chain named AutoJack, which enables a single malicious web page to hijack an AI agent and achieve remote code execution on the host system ^[4].
A critical vulnerability in Splunk Enterprise is being actively exploited in the wild. CISA has urged US federal agencies to apply patches by Sunday to mitigate risk ^[16].
A vulnerability in the Gravity SMTP WordPress plugin is being actively exploited in the wild, allowing unauthenticated attackers to access sensitive information on over 100,000 websites ^[11].
Apple patched a Bluetooth vulnerability in Beats Studio Buds that allowed nearby attackers to eavesdrop via the device’s microphone ^[26].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service (RaaS) operation is distributing the GentleKiller EDR framework to affiliates, targeting and disabling over 400 security processes on victim systems ^[3].
The Icarus threat actor group has claimed responsibility for the OAuth token theft and subsequent data breach affecting Klue and its customers ^[10].
Threat actors are delivering eBanking phishing emails using IPv4-mapped IPv6 addresses to evade detection and target major financial institutions ^[19].
CryptoBandits malware has been observed functioning both as a backdoor and for data theft, leveraging a local SOCKS5 proxy and the Tor network for traffic routing and remote code execution ^[22].

Trends, Tools, or Tactics of Interest

AI-powered scams resulted in nearly $900 million in losses in the US last year, according to the FBI, demonstrating increasing use of generative AI in fraud operations ^[1].
The shift from assistive to agentic AI is changing threat management, with AI agents increasingly capable of autonomous actions across enterprise environments ^[7].
Security concerns are shifting from data leakage to access control as “shadow AI” tools proliferate in organizations, often with insufficient oversight ^[8].
AI agents are increasingly recognized as unique identities within organizations, capable of accessing sensitive data and triggering workflows, yet are often not managed with appropriate security controls ^[13].
Modern phishing attacks are bypassing multi-factor authentication (MFA) protections, including through techniques such as Device Code phishing, prompting a need for advanced behavioral detection and response ^[14].
The Burp Suite Extension Awards highlighted advancements in recon, authentication, workflow, and API testing tools for web security professionals ^[20].
CISOs report that the proliferation of threats and the adoption of AI are increasing stress and driving changes in cybersecurity team structures, with a growing demand for specialist expertise ^[18].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued directives and warnings to US federal agencies and Fortinet customers regarding the need to patch critical vulnerabilities and secure devices against ongoing exploitation campaigns ^[6]^[16]^[23].
Law enforcement collaboration in Operation Endgame demonstrates ongoing international efforts to disrupt malware infrastructure and remediate large-scale website compromises ^[5]^[25].

Sources

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data - thehackernews.com
Klue OAuth breach victim list grows as Icarus hackers claim attack - bleepingcomputer.com
Cybersecurity Firms Impacted by Klue Supply Chain Attack - securityweek.com
Texas govt data breach exposes over 3 million driver’s licenses - bleepingcomputer.com
CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices - thehackernews.com
FortiBleed: 86,000 Fortinet Device Credentials Compromised - securityweek.com
Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites - thehackernews.com
Nearly 15,000 infected websites cleaned in SocGholish crackdown - malwarebytes.com
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain - thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution - thehackernews.com
CISA: Splunk Enterprise flaw actively exploited, patch by Sunday - bleepingcomputer.com
Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin - bleepingcomputer.com
Apple patches Beats Studio Buds flaw that could turn earbuds into a wiretap - malwarebytes.com
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes - thehackernews.com
eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th) - isc.sans.edu
CryptoBandits Malware Doubles as a Backdoor, Abuses Tor - securityweek.com
Americans Lost $900 Million to AI-Powered Scams Last Year - blog.knowbe4.com
From Assistive to Agentic: The AI Shift That's Redefining Threat Management - thehackernews.com
Forget Data Leakage: Shadow AI's Real Threat Is Access Control - thehackernews.com
Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way - bleepingcomputer.com
Webinar: How attackers bypass MFA and how defenders can respond - bleepingcomputer.com
Burp Extensibility 2026: Awards, Talks, and Highlights - portswigger.net
Stressors, AI Forcing Changes to Cybersecurity Teams - darkreading.com

Cybersecurity Brief – 2026-06-19

Fri, 19 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17]^[29].
Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13]^[21].
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19]^[36].
Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations ^[4]^[22].
F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems ^[5]^[24].
Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies ^[42].
Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation ^[44].
Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix ^[45].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite ^[3]^[14].
The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays ^[11].
The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations ^[17]^[29].
A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities ^[8]^[16].
Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp ^[19]^[36].
The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes ^[33].
The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 ^[9].

Trends, Tools, or Tactics of Interest

There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise ^[20].
Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted ^[7].
Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked ^[6].
The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion ^[3]^[14].
The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data ^[43].
Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles ^[46].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials ^[13].
CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 ^[37].
New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements ^[10].

Sources

Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com