Mastra on DanSec Daily

Cybersecurity Brief – 2026-06-23

Tue, 23 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Threat actors gained access to personal and protected health information affecting 1.4 million individuals in a breach at Xsolis, impacting data received from its clients ^[27].
The JaredFromSubway Ethereum MEV bot suffered a $15 million theft after an attacker manipulated its opportunity-detection logic using fake cryptocurrency trading opportunities ^[15].
Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed impact from the Klue hack ^[34].
A large-scale credential harvesting campaign, dubbed FortiBleed, targeted Fortinet FortiGate devices using custom sniffers to steal authentication secrets, resulting in a database of over 86,000 confirmed working credentials ^[17]^[33].
Thousands of outdated D-Link routers have been compromised and are now under the control of the AryStinger botnet, with no available security updates ^[36].

Newly Discovered Vulnerabilities

A critical heap over-read vulnerability in the Squid web proxy, dubbed Squidbleed, can leak cleartext HTTP requests including credentials or session tokens to anyone allowed to send traffic through the same proxy. The flaw has existed for 29 years and is described as Heartbleed-style in its impact ^[8]^[28].
Four vulnerabilities in Dify, an open-source agentic workflow platform, could allow attackers to stealthily access AI chat data across tenants ^[7].
A newly disclosed flaw in FFmpeg, called PixelSmash, could allow remote code execution on Jellyfin servers and trigger denial-of-service conditions in other applications ^[16].
Microsoft addressed a vulnerability chain named AutoJack in AutoGen Studio, which could let attackers manipulate AI agents to execute arbitrary commands on host systems ^[19].
A new exploit, Usbliter8, can bypass Apple’s boot defenses on millions of iPhones. The vulnerability is unpatchable, and a proof-of-concept exploit has been released ^[32].
Vulnerable iterations of the Gravity SMTP WordPress plugin are being exploited to leak API keys, secrets, tokens, server information, and other sensitive data ^[29].

Notable Threat Actor Activity

A global malicious campaign is distributing VBScript files via WhatsApp messages, leading to the installation of a legitimate Remote Monitoring and Management (RMM) tool, specifically the UEMS RMM agent, through a multi-stage infection chain. The campaign leverages fake business documents as lures ^[1]^[4]^[14].
Unknown threat actors compromised multiple ShapedPlugin WordPress plugins in a supply chain attack, injecting backdoor code through tampered official release channels ^[6].
North Korean state-affiliated hackers are attributed to a supply chain attack on Mastra NPM packages, where a malicious dependency in over 140 packages fetches payloads targeting cryptocurrency browser extensions ^[30].
A new campaign utilizes the OXLOADER malware loader, delivered via malicious Google Ads, to install CastleStealer on victim systems ^[9].
Attackers are using an elaborate fake reputation-boosting campaign across GitHub, YouTube, and VirusTotal to distribute a cross-platform clipboard hijacker targeting cryptocurrency assets ^[21].

Trends, Tools, or Tactics of Interest

The Anti-Phishing Working Group (APWG) reports a surge in phishing scams across social media platforms in Q1 2026 ^[2].
Attackers are increasingly exploiting document delivery scams, leveraging seemingly official voicemails and messages to trick recipients into interacting with malicious content ^[37].
The underground market for stolen credentials is evolving, with attackers now paying others to search large credential dumps for specific targets, streamlining credential abuse ^[20].
Webshells continue to be a persistent tool for attackers, remaining popular for maintaining unauthorized access to compromised systems ^[26].
Ransomware crews are actively attempting to disable security tools, including EDR solutions, as part of ongoing attack campaigns ^[12].
AI is being leveraged to amplify online scams, including sophisticated World Cup-related fraud involving fake tickets and cloned websites ^[23].
OpenAI has expanded its Daybreak initiative with the release of the GPT-5.5-Cyber model and a “Patch the Planet” campaign aimed at helping defenders patch security flaws, with a particular focus on open-source software vulnerabilities ^[5]^[22].

Regulatory or Policy Developments Affecting the Security Industry

Google has announced that, starting September 30, 2026, Android developer verification will be enforced in four countries, with major device-maker app stores participating from the outset ^[10].
Canada’s spy agency used a first-of-its-kind judicial warrant to access and clean botnet-infected devices, including servers, home routers, and IoT equipment located within Canadian territory ^[13].

Sources

Xsolis Data Breach Affects 1.4 Million Individuals - securityweek.com
JaredFromSubway MEV bot hacked in $15 million crypto theft - bleepingcomputer.com
More Cybersecurity Firms Disclose Impact From Klue Hack - securityweek.com
FortiBleed campaign used custom FortiGate sniffer to steal credentials - bleepingcomputer.com
Fortinet Responds to FortiBleed Campaign - securityweek.com
Thousands of D-Link routers under control of AryStinger botnet - malwarebytes.com
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests - thehackernews.com
Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data - securityweek.com
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants - thehackernews.com
FFmpeg fixes PixelSmash flaw in widely used video decoder - bleepingcomputer.com
Microsoft fixes AutoGen Studio flaw that enabled code execution - bleepingcomputer.com
New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones - securityweek.com
Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data - securityweek.com
A VBScript campaign distributed through WhatsApp deploying RMM software - securelist.com
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool - thehackernews.com
WhatsApp phishing attack uses fake business docs to hack PCs - bleepingcomputer.com
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack - thehackernews.com
North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - securityweek.com
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer - thehackernews.com
Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign - darkreading.com
APWG Report: Social Media Phishing is Surging - blog.knowbe4.com
Document delivery scams: What are they and what’s their goal? - malwarebytes.com
A Glimpse into the “Search Your Target” Market for Stolen Credentials - bleepingcomputer.com
Webshells Remain Popular, (Mon, Jun 22nd) - isc.sans.edu
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More - thehackernews.com
World Cup Scams Are Getting Harder to Spot - wired.com
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws - thehackernews.com
OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos - wired.com
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries - thehackernews.com
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices - thehackernews.com

Cybersecurity Brief – 2026-06-21

Sun, 21 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Threat actors are exploiting a recently patched vulnerability in the Gravity SMTP WordPress plugin, which has approximately 100,000 installations. The flaw, tracked as CVE-2026-4020, allows attackers to expose API keys used for email delivery services, potentially leading to further compromise of affected sites ^[1].
Hackers claim to have leaked stolen data from Madison Square Garden, indicating a potential data breach affecting the venue’s systems ^[4].

Newly Discovered Vulnerabilities

A security flaw in the Gravity SMTP WordPress plugin, identified as CVE-2026-4020, has been actively exploited. The vulnerability enables attackers to access sensitive API keys from plugin configurations ^[1].

Notable Threat Actor Activity

Microsoft has attributed the recent Mastra AI supply chain attack, which compromised over 140 npm packages, to the North Korean hacking group Sapphire Sleet (BlueNoroff) ^[3].

Trends, Tools, or Tactics of Interest

The newly identified Prinz Eugen ransomware operation is notable for prioritizing the encryption of recently modified files and for not leaving a ransom note on infected systems, which may hinder victim response and detection ^[2].

Regulatory or Policy Developments Affecting the Security Industry

The French President has called for cooperation among wealthy democracies to regulate advanced AI systems, urging the United States to share cutting-edge AI technologies and align on regulatory approaches ^[5].

Sources

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys - thehackernews.com
Hackers Claim to Leak Stolen Madison Square Garden Data - wired.com
Microsoft links Mastra AI supply chain attack to North Korean hackers - bleepingcomputer.com
New Prinz Eugen ransomware prioritizes recent files for encryption - bleepingcomputer.com
French President Urges US to Share Cutting-Edge AI and Democracies to Cooperate on Regulation - securityweek.com

Cybersecurity Brief – 2026-06-17

Wed, 17 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35]^[42].
The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

Three recently patched vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, exposing up to 30,000 devices to compromise. At least one of the flaws was only patched last week ^[9]^[21]^[34].
CISA has warned of an actively exploited maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) that allows PHP code execution ^[4]^[33].
A critical vulnerability in a cPanel plugin (CVE-2026-54420) is being actively exploited, with CISA mandating US government agencies to secure affected servers within three days ^[19].
A flaw in the Google Cloud Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute code in Google’s infrastructure via bucket squatting ^[5].
Chrome and Firefox have received updates to patch multiple critical and high-severity memory safety vulnerabilities that could lead to remote code execution ^[32].
Oracle released its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple product lines ^[31].
Microsoft is working on a patch for a Defender zero-day vulnerability named “RoguePlanet,” which was disclosed a week ago ^[11].

Notable Threat Actor Activity

The ShinyHunters extortion gang is implicated in the Kodak breach ^[12].
The ransomware and data extortion group Vice Society may be linked to the ClickFix campaign, which is delivering malware loaders such as BabaDeda Loader, Lorem Ipsum Loader, and Potemkin via compromised WordPress sites ^[6]^[27].
DragonForce ransomware operators have used a custom malware, ‘Backdoor.Turn,’ to conceal command-and-control traffic within Microsoft Teams relay infrastructure ^[20].
FishMonger, a China-nexus threat group, has deployed a Windows variant of the SprySOCKS backdoor, previously observed only on Linux, against government targets in Honduras, Taiwan, Thailand, and Pakistan ^[10]^[25].
At least 15 malicious plugins on the JetBrains Marketplace were designed to steal AI API keys from developers ^[13].

Trends, Tools, or Tactics of Interest

The new Rokarolla Android banking trojan targets 217 banking and cryptocurrency applications, utilizes 137 remote commands, and achieves full device control and persistence. It is distributed via fake TikTok and Chrome downloads ^[7]^[14]^[26].
GhostTree attack uses recursive NTFS junctions to create numerous valid Windows file paths, causing Microsoft Defender folder scans to never complete and enabling malware to evade detection ^[17].
The Phantom Stealer malware executes entirely in memory and incorporates anti-analysis techniques to target browser credentials ^[23].
Steam Workshop, via the Wallpaper Engine app, is being abused to distribute malware hidden in wallpaper packages ^[15].
Fileless and evasive malware techniques, as seen in both Phantom Stealer and GhostTree, are increasingly being leveraged to avoid detection by endpoint security tools ^[17]^[23].
144 npm packages associated with the Mastra namespace were compromised via a hijacked contributor account, impacting open-source AI development ecosystems ^[3].
ClickFix campaigns are expanding malware delivery with new loaders and fake update lures, exploiting compromised WordPress sites ^[6]^[27].
94 percent of security incidents involve anonymized infrastructure, and security teams remain largely reactive despite increased access to enrichment and threat intelligence data ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government will require individuals to verify their age with an ID upload or facial scan before creating new social media accounts, effectively banning under-16s from user-to-user social media platforms from spring 2027. Privacy and security experts have raised concerns about age-verification and privacy implications ^[16]^[22].
The US government has imposed export restrictions on Anthropic’s Claude Fable 5 and Mythos 5 AI models, drawing criticism from the security community ^[24]^[29].
US federal authorities have taken down sites hosting nonconsensual deepfake images of famous women ^[43].

Sources

Kodak confirms data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
iRhythm Confirms Data Stolen in Hack - securityweek.com
Cardiac patients’ medical data stolen and held to ransom - malwarebytes.com
Cybercrime Group Claims Novo Nordisk Hack - securityweek.com
Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society - wired.com
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - thehackernews.com
Critical Fortinet FortiSandbox flaws now exploited in attacks - bleepingcomputer.com
3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - securityweek.com
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution - thehackernews.com
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - securityweek.com
CISA warns of another cPanel plugin flaw exploited in attacks - bleepingcomputer.com
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - thehackernews.com
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Microsoft working on Defender patch for RoguePlanet zero-day - bleepingcomputer.com
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures - thehackernews.com
'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading.com
Ransomware gang abuses Microsoft Teams relays to hide malicious traffic - bleepingcomputer.com
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - thehackernews.com
SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading.com
Malicious JetBrains Marketplace plugins steal AI API keys from developers - bleepingcomputer.com
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - thehackernews.com
New Rokarolla Android malware targets 217 banking, crypto apps - bleepingcomputer.com
Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading.com
GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - bleepingcomputer.com
Fileless Phantom Stealer Targets Browser Credentials - darkreading.com
Steam Workshop abused to spread malware via Wallpaper Engine app - bleepingcomputer.com
144 Mastra npm Packages Compromised via Hijacked Contributor Account - thehackernews.com
Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive - thehackernews.com
UK to require ID or face scan before you can make social media accounts - bleepingcomputer.com
UK Social Media Ban for Minors Has Privacy Experts Worried - darkreading.com
Security Community Slams US Ban on Exporting Mythos, Fable - darkreading.com
‘Dangerous’ AI Models Are Coming No Matter What - wired.com
Deepfake posting sites depicting famous women taken down by feds - malwarebytes.com