Kodak on DanSec Daily

Cybersecurity Brief – 2026-06-19

Fri, 19 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17]^[29].
Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13]^[21].
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19]^[36].
Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations ^[4]^[22].
F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems ^[5]^[24].
Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies ^[42].
Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation ^[44].
Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix ^[45].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite ^[3]^[14].
The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays ^[11].
The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations ^[17]^[29].
A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities ^[8]^[16].
Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp ^[19]^[36].
The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes ^[33].
The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 ^[9].

Trends, Tools, or Tactics of Interest

There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise ^[20].
Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted ^[7].
Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked ^[6].
The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion ^[3]^[14].
The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data ^[43].
Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles ^[46].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials ^[13].
CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 ^[37].
New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements ^[10].

Sources

Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com

Cybersecurity Brief – 2026-06-18

Thu, 18 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

A data leak dubbed “FortiBleed” has exposed VPN credentials for 73,932 Fortinet and FortiGate firewall URLs at organizations worldwide. Attackers have compiled working credentials for tens of thousands of compromised devices across nearly 200 countries, actively targeting various sectors ^[11]^[18].
Kodak has confirmed a data breach following claims by the ShinyHunters hacking group. The company states there is no threat to its systems or operations as a result of the incident ^[24].
Researchers discovered an exposed collection of 24 billion stolen records online, including usernames, passwords, and other sensitive account data ^[34].
Roblox developers have been targeted by attackers using fake job offers and malware to steal accounts, Robux, and entire Roblox games ^[32].

Newly Discovered Vulnerabilities

Microsoft has confirmed a zero-day vulnerability in Defender, codenamed RoguePlanet, which allows privilege escalation via a race condition. A patch is in development and public proof-of-concept code is available. The vulnerability is tracked as CVE-2026-50656 ^[4]^[30].
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited ^[15].
Rockwell Automation has released patches for vulnerabilities affecting Logix, CompactLogix, Flex, RSLinx, and FactoryTalk industrial control system products ^[28].
Oracle has issued its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple products, including Communications, EBS, and Enterprise Manager ^[31].

Notable Threat Actor Activity

A coordinated malware campaign has published at least 15 malicious plugins on the JetBrains Marketplace, exfiltrating AI API keys and other sensitive data. Additionally, malicious Chrome extensions are capturing chatbot conversations ^[7].
An unknown threat actor is leveraging paid or promoted posts on legitimate news websites, fake reviews, AI narrators, and comments on VirusTotal to promote a crypto clipper malware campaign ^[3].
A French-speaking attacker compromised a small French automotive business, planted a keylogger, and maintained persistence using Tailscale and OpenSSH after their command-and-control infrastructure went offline ^[5].
The DragonForce ransomware group deployed a Go-based backdoor that uses Microsoft Teams relay servers for command-and-control in a recent attack ^[29].
The INC ransomware group continues to target sectors where operational disruption puts immediate pressure on victims to pay, such as healthcare ^[17].

Trends, Tools, or Tactics of Interest

85.8 percent of phishing attacks in the past 12 months were AI-driven, with threat actors increasingly using AI agents to automate social engineering ^[1].
Enterprise adoption of AI agents is creating security blind spots, with 83 percent of organizations lacking visibility into their AI agents’ activities and 86 percent lacking visibility into AI data flows ^[2].
There is a rise in account takeovers as attackers bypass traditional defenses using phishing, session hijacking, and MFA fatigue attacks ^[12].
Attackers are increasingly exploiting exposed admin panels, credential reuse, and non-zero-day vulnerabilities to gain initial access, as seen in recent attack surface exposure reports ^[8].
Coordinated SSH brute-force attacks remain prevalent, with attackers adapting their tactics over recent months ^[21].
Security researchers highlight that browser-based attacks may evade detection by traditional security tools, creating a “browser blind spot” ^[22].
Adversarial exposure validation is emerging as a method to help security teams prioritize which vulnerabilities to address, moving beyond simple visibility to actual validation of risk ^[6].
New Android malware, Rokarolla, can take full control of infected devices and targets over 200 banking and cryptocurrency apps to steal credentials ^[33].
Attackers are using fake job offers as a vector to deliver malware and compromise developer accounts in gaming platforms ^[32].

Regulatory or Policy Developments Affecting the Security Industry

From August 3, 2026, Google will use IP addresses from UK, EEA, and Switzerland users for ad measurement and personalization, as the UK Information Commissioner’s Office (ICO) considers new consent rules ^[10].
The EU has initiated the “Shield-6G” project to develop security measures for 6G networks, incorporating AI threat detection, digital twins, and honeypots ^[16].
The UK Home Office will implement facial age estimation technology for asylum-seeker age checks despite internal tests showing high risks of errors ^[19].

Sources

FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices - darkreading.com
Kodak Admits Data Breach After ShinyHunters Hack Claims - securityweek.com
24 billion stolen records exposed online. Here’s what to do - malwarebytes.com
Roblox developers are losing entire games to malware attacks - malwarebytes.com
Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development - thehackernews.com
Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day - securityweek.com
CISA orders feds to patch max severity Joomla plugin flaw by Friday - bleepingcomputer.com
Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats - thehackernews.com
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments - thehackernews.com
Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - thehackernews.com
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack - securityweek.com
INC Ransomware Thrives by Mastering the Basics - darkreading.com
From 1% to 26%: How AIDA Orchestration Fixes the Remedial Training Gap - blog.knowbe4.com
Best AI Agent Security Tools for SMB and Enterprise in 2026 - blog.knowbe4.com
Why Account Takeovers Are Rising and How to Stop Them - bleepingcomputer.com
The Top 10 Attack Surface Exposures in 2026 - thehackernews.com
The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization - thehackernews.com
Rokarolla Android malware can take over your phone and steal banking logins - malwarebytes.com
Google to use UK and EU user IP addresses for ad personalization - bleepingcomputer.com
EU Gets a Head Start in Developing 6G Network Security - darkreading.com
The UK Will Scan Asylum-Seekers’ Faces for Age Checks—Despite Knowing the Tech Is Flawed - wired.com

Cybersecurity Brief – 2026-06-17

Wed, 17 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35]^[42].
The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

Three recently patched vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, exposing up to 30,000 devices to compromise. At least one of the flaws was only patched last week ^[9]^[21]^[34].
CISA has warned of an actively exploited maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) that allows PHP code execution ^[4]^[33].
A critical vulnerability in a cPanel plugin (CVE-2026-54420) is being actively exploited, with CISA mandating US government agencies to secure affected servers within three days ^[19].
A flaw in the Google Cloud Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute code in Google’s infrastructure via bucket squatting ^[5].
Chrome and Firefox have received updates to patch multiple critical and high-severity memory safety vulnerabilities that could lead to remote code execution ^[32].
Oracle released its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple product lines ^[31].
Microsoft is working on a patch for a Defender zero-day vulnerability named “RoguePlanet,” which was disclosed a week ago ^[11].

Notable Threat Actor Activity

The ShinyHunters extortion gang is implicated in the Kodak breach ^[12].
The ransomware and data extortion group Vice Society may be linked to the ClickFix campaign, which is delivering malware loaders such as BabaDeda Loader, Lorem Ipsum Loader, and Potemkin via compromised WordPress sites ^[6]^[27].
DragonForce ransomware operators have used a custom malware, ‘Backdoor.Turn,’ to conceal command-and-control traffic within Microsoft Teams relay infrastructure ^[20].
FishMonger, a China-nexus threat group, has deployed a Windows variant of the SprySOCKS backdoor, previously observed only on Linux, against government targets in Honduras, Taiwan, Thailand, and Pakistan ^[10]^[25].
At least 15 malicious plugins on the JetBrains Marketplace were designed to steal AI API keys from developers ^[13].

Trends, Tools, or Tactics of Interest

The new Rokarolla Android banking trojan targets 217 banking and cryptocurrency applications, utilizes 137 remote commands, and achieves full device control and persistence. It is distributed via fake TikTok and Chrome downloads ^[7]^[14]^[26].
GhostTree attack uses recursive NTFS junctions to create numerous valid Windows file paths, causing Microsoft Defender folder scans to never complete and enabling malware to evade detection ^[17].
The Phantom Stealer malware executes entirely in memory and incorporates anti-analysis techniques to target browser credentials ^[23].
Steam Workshop, via the Wallpaper Engine app, is being abused to distribute malware hidden in wallpaper packages ^[15].
Fileless and evasive malware techniques, as seen in both Phantom Stealer and GhostTree, are increasingly being leveraged to avoid detection by endpoint security tools ^[17]^[23].
144 npm packages associated with the Mastra namespace were compromised via a hijacked contributor account, impacting open-source AI development ecosystems ^[3].
ClickFix campaigns are expanding malware delivery with new loaders and fake update lures, exploiting compromised WordPress sites ^[6]^[27].
94 percent of security incidents involve anonymized infrastructure, and security teams remain largely reactive despite increased access to enrichment and threat intelligence data ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government will require individuals to verify their age with an ID upload or facial scan before creating new social media accounts, effectively banning under-16s from user-to-user social media platforms from spring 2027. Privacy and security experts have raised concerns about age-verification and privacy implications ^[16]^[22].
The US government has imposed export restrictions on Anthropic’s Claude Fable 5 and Mythos 5 AI models, drawing criticism from the security community ^[24]^[29].
US federal authorities have taken down sites hosting nonconsensual deepfake images of famous women ^[43].

Sources

Kodak confirms data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
iRhythm Confirms Data Stolen in Hack - securityweek.com
Cardiac patients’ medical data stolen and held to ransom - malwarebytes.com
Cybercrime Group Claims Novo Nordisk Hack - securityweek.com
Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society - wired.com
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - thehackernews.com
Critical Fortinet FortiSandbox flaws now exploited in attacks - bleepingcomputer.com
3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - securityweek.com
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution - thehackernews.com
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - securityweek.com
CISA warns of another cPanel plugin flaw exploited in attacks - bleepingcomputer.com
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - thehackernews.com
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Microsoft working on Defender patch for RoguePlanet zero-day - bleepingcomputer.com
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures - thehackernews.com
'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading.com
Ransomware gang abuses Microsoft Teams relays to hide malicious traffic - bleepingcomputer.com
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - thehackernews.com
SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading.com
Malicious JetBrains Marketplace plugins steal AI API keys from developers - bleepingcomputer.com
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - thehackernews.com
New Rokarolla Android malware targets 217 banking, crypto apps - bleepingcomputer.com
Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading.com
GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - bleepingcomputer.com
Fileless Phantom Stealer Targets Browser Credentials - darkreading.com
Steam Workshop abused to spread malware via Wallpaper Engine app - bleepingcomputer.com
144 Mastra npm Packages Compromised via Hijacked Contributor Account - thehackernews.com
Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive - thehackernews.com
UK to require ID or face scan before you can make social media accounts - bleepingcomputer.com
UK Social Media Ban for Minors Has Privacy Experts Worried - darkreading.com
Security Community Slams US Ban on Exporting Mythos, Fable - darkreading.com
‘Dangerous’ AI Models Are Coming No Matter What - wired.com
Deepfake posting sites depicting famous women taken down by feds - malwarebytes.com