Cybersecurity Brief – 2026-05-27

Wed, 27 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid ^[13].
Information allegedly stolen from 7-Eleven has been leaked, impacting approximately 185,000 individuals and exposing email addresses, names, addresses, and dates of birth ^[33].
Over 5,500 GitHub repositories were compromised in a campaign using Megalodon malware, resulting in theft of credentials and developer secrets ^[18].
More than 700 education and tech websites were hijacked in a large-scale ClickFix malware campaign, exploiting a Ghost CMS flaw to serve malicious Cloudflare verification pages ^[40].

Newly Discovered Vulnerabilities

Microsoft released patches for a critical remote code execution vulnerability in SharePoint (CVE-2026-45659), which could be exploited without specialized conditions ^[8]^[20].
A critical zero-day vulnerability in the KnowledgeDeliver learning management system was exploited to deploy the Godzilla web shell; the flaw involved hardcoded machineKey values that enabled ViewState deserialization attacks ^[12]^[35].
CISA ordered immediate patching of an actively exploited SQL injection vulnerability in Drupal CMS for US government agencies ^[17].
CISA urged urgent patching of a zero-day vulnerability in the LiteSpeed cPanel plugin that was exploited in the wild to execute scripts with root privileges ^[29].

Notable Threat Actor Activity

The ShinyHunters extortion group was responsible for threats and data leaks targeting Charter Communications and 7-Eleven ^[13]^[33].
The Iranian APT group MuddyWater conducted a new espionage campaign targeting organizations across nine countries, employing DLL side-loading techniques ^[6].
The Iranian APT known as Nimbus Manticore continued targeting aviation and software companies using updated tools ^[32].
The FBI warned that the Silent Ransom Group is sending operatives in person to law firms to physically insert USB drives and steal data ^[28].
Fake installers and plugins for popular software such as ChatGPT and Claude, distributed via GitHub and SourceForge, were found to deliver Deno RAT, granting attackers full device control ^[39].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly augmenting attacks with AI tools, including real-time operational deployment of AI in offensive operations, smarter AI-driven DDoS attacks, and use of AI to generate plain-English remediation guidance for vulnerabilities ^[2]^[7]^[38]^[37].
AI chatbot recommendations are being abused to redirect users to cryptojacking malware sites in active campaigns ^[5].
Multi-factor authentication (MFA) prompt bombing remains a prevalent tactic to bypass second-factor protections ^[9].
Remote access trojans such as BTMOB are leveraging ready-made campaign tools to lower barriers for full device compromise on Android devices ^[4].
Microsoft Defender is testing automatic endpoint isolation to prevent lateral movement after compromise ^[15].
AppOmni’s Marlin AI and Varonis Atlas are leveraging AI for autonomous SaaS security investigation and AI governance, respectively ^[31]^[14].
Anthropic released a Claude Sandbox security plugin to assist developers in identifying vulnerabilities during coding and expanded Claude’s enterprise security governance with 28 new integrations, including major security vendors ^[30]^[34].

Regulatory or Policy Developments Affecting the Security Industry

The Indian Computer Emergency Response Team (CERT-In) issued guidelines mandating that critical vulnerabilities in internet-facing systems be patched within 12 hours of detection amid increased AI-assisted attacks ^[10].
CISA announced a revised schedule for town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure ^[27].

Sources

Charter confirms data breach after ShinyHunters extortion threat - bleepingcomputer.com
185,000 Likely Impacted by 7-Eleven Data Breach - securityweek.com
Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos - darkreading.com
700+ education and tech websites hijacked in huge ClickFix malware campaign - malwarebytes.com
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions - thehackernews.com
Microsoft Issues Out-of-Band SharePoint Patch - darkreading.com
KnowledgeDeliver flaw exploited as a zero-day to install web shells - bleepingcomputer.com
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment - securityweek.com
CISA orders feds to patch actively exploited Drupal vulnerability - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day - securityweek.com
MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries - thehackernews.com
Iranian APT Targets Aviation, Software Companies With Updated Tools - securityweek.com
FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data - securityweek.com
Fake software on GitHub and SourceForge distribute Deno RAT - malwarebytes.com
Report: Adversarial Use of AI is Evolving - blog.knowbe4.com
[THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back - thehackernews.com
AI Threat Landscape Digest March-April 2026 - research.checkpoint.com
Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images - securityweek.com
AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites - thehackernews.com
MFA Prompt Bombing: Why Your Second Factor Isn't Saving You - thehackernews.com
BTMOB: A stealthy RAT burrowing deep into Android devices - welivesecurity.com
Microsoft Defender can now automatically isolate hacked endpoints - bleepingcomputer.com
AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security - securityweek.com
How Varonis Atlas integrates Claude Compliance API for AI governance - bleepingcomputer.com
Anthropic Releases New Claude Sandbox, Security Guidance Plugin - securityweek.com
Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations - securityweek.com
CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks - thehackernews.com
CISA Announces Revised Town Hall Schedule to Engage with Stakeholders on Cyber Incident Reporting for Critical Infrastructure - cisa.gov

KnowledgeDeliver on DanSec Daily

Cybersecurity Brief – 2026-05-27

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources