Novo Nordisk on DanSec Daily

Cybersecurity Brief – 2026-06-19

Fri, 19 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17]^[29].
Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13]^[21].
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19]^[36].
Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations ^[4]^[22].
F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems ^[5]^[24].
Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies ^[42].
Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation ^[44].
Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix ^[45].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite ^[3]^[14].
The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays ^[11].
The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations ^[17]^[29].
A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities ^[8]^[16].
Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp ^[19]^[36].
The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes ^[33].
The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 ^[9].

Trends, Tools, or Tactics of Interest

There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise ^[20].
Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted ^[7].
Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked ^[6].
The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion ^[3]^[14].
The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data ^[43].
Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles ^[46].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials ^[13].
CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 ^[37].
New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements ^[10].

Sources

Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com

Cybersecurity Brief – 2026-06-17

Wed, 17 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35]^[42].
The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

Three recently patched vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, exposing up to 30,000 devices to compromise. At least one of the flaws was only patched last week ^[9]^[21]^[34].
CISA has warned of an actively exploited maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) that allows PHP code execution ^[4]^[33].
A critical vulnerability in a cPanel plugin (CVE-2026-54420) is being actively exploited, with CISA mandating US government agencies to secure affected servers within three days ^[19].
A flaw in the Google Cloud Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute code in Google’s infrastructure via bucket squatting ^[5].
Chrome and Firefox have received updates to patch multiple critical and high-severity memory safety vulnerabilities that could lead to remote code execution ^[32].
Oracle released its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple product lines ^[31].
Microsoft is working on a patch for a Defender zero-day vulnerability named “RoguePlanet,” which was disclosed a week ago ^[11].

Notable Threat Actor Activity

The ShinyHunters extortion gang is implicated in the Kodak breach ^[12].
The ransomware and data extortion group Vice Society may be linked to the ClickFix campaign, which is delivering malware loaders such as BabaDeda Loader, Lorem Ipsum Loader, and Potemkin via compromised WordPress sites ^[6]^[27].
DragonForce ransomware operators have used a custom malware, ‘Backdoor.Turn,’ to conceal command-and-control traffic within Microsoft Teams relay infrastructure ^[20].
FishMonger, a China-nexus threat group, has deployed a Windows variant of the SprySOCKS backdoor, previously observed only on Linux, against government targets in Honduras, Taiwan, Thailand, and Pakistan ^[10]^[25].
At least 15 malicious plugins on the JetBrains Marketplace were designed to steal AI API keys from developers ^[13].

Trends, Tools, or Tactics of Interest

The new Rokarolla Android banking trojan targets 217 banking and cryptocurrency applications, utilizes 137 remote commands, and achieves full device control and persistence. It is distributed via fake TikTok and Chrome downloads ^[7]^[14]^[26].
GhostTree attack uses recursive NTFS junctions to create numerous valid Windows file paths, causing Microsoft Defender folder scans to never complete and enabling malware to evade detection ^[17].
The Phantom Stealer malware executes entirely in memory and incorporates anti-analysis techniques to target browser credentials ^[23].
Steam Workshop, via the Wallpaper Engine app, is being abused to distribute malware hidden in wallpaper packages ^[15].
Fileless and evasive malware techniques, as seen in both Phantom Stealer and GhostTree, are increasingly being leveraged to avoid detection by endpoint security tools ^[17]^[23].
144 npm packages associated with the Mastra namespace were compromised via a hijacked contributor account, impacting open-source AI development ecosystems ^[3].
ClickFix campaigns are expanding malware delivery with new loaders and fake update lures, exploiting compromised WordPress sites ^[6]^[27].
94 percent of security incidents involve anonymized infrastructure, and security teams remain largely reactive despite increased access to enrichment and threat intelligence data ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government will require individuals to verify their age with an ID upload or facial scan before creating new social media accounts, effectively banning under-16s from user-to-user social media platforms from spring 2027. Privacy and security experts have raised concerns about age-verification and privacy implications ^[16]^[22].
The US government has imposed export restrictions on Anthropic’s Claude Fable 5 and Mythos 5 AI models, drawing criticism from the security community ^[24]^[29].
US federal authorities have taken down sites hosting nonconsensual deepfake images of famous women ^[43].

Sources

Kodak confirms data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
iRhythm Confirms Data Stolen in Hack - securityweek.com
Cardiac patients’ medical data stolen and held to ransom - malwarebytes.com
Cybercrime Group Claims Novo Nordisk Hack - securityweek.com
Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society - wired.com
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - thehackernews.com
Critical Fortinet FortiSandbox flaws now exploited in attacks - bleepingcomputer.com
3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - securityweek.com
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution - thehackernews.com
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - securityweek.com
CISA warns of another cPanel plugin flaw exploited in attacks - bleepingcomputer.com
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - thehackernews.com
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Microsoft working on Defender patch for RoguePlanet zero-day - bleepingcomputer.com
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures - thehackernews.com
'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading.com
Ransomware gang abuses Microsoft Teams relays to hide malicious traffic - bleepingcomputer.com
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - thehackernews.com
SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading.com
Malicious JetBrains Marketplace plugins steal AI API keys from developers - bleepingcomputer.com
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - thehackernews.com
New Rokarolla Android malware targets 217 banking, crypto apps - bleepingcomputer.com
Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading.com
GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - bleepingcomputer.com
Fileless Phantom Stealer Targets Browser Credentials - darkreading.com
Steam Workshop abused to spread malware via Wallpaper Engine app - bleepingcomputer.com
144 Mastra npm Packages Compromised via Hijacked Contributor Account - thehackernews.com
Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive - thehackernews.com
UK to require ID or face scan before you can make social media accounts - bleepingcomputer.com
UK Social Media Ban for Minors Has Privacy Experts Worried - darkreading.com
Security Community Slams US Ban on Exporting Mythos, Fable - darkreading.com
‘Dangerous’ AI Models Are Coming No Matter What - wired.com
Deepfake posting sites depicting famous women taken down by feds - malwarebytes.com

Cybersecurity Brief – 2026-06-16

Tue, 16 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Council of Europe is investigating claims by the ShinyHunters extortion group that it has stolen and is threatening to leak 297 GB of data, including employee personal information ^[21]^[42].
The Infinite Campus K-12 student information system suffered a data breach by ShinyHunters, resulting in the theft of personal information from more than 137,000 school staff accounts ^[26].
Novo Nordisk, the pharmaceutical company behind Ozempic, disclosed that hackers breached its IT systems and accessed personal data ^[40].
French government officials confirmed a breach of the Tchap messaging platform, affecting approximately 73,000 government accounts, with the attacker claiming theft of messages and user data ^[41].
iRhythm Holdings, a digital healthcare company, reported a data breach in which hackers stole patients’ personal and health information from third-party-hosted business applications ^[16].
Chinese espionage actors breached REDCap servers at a North American medical institution, deploying InfiniteRed malware to steal sensitive research data ^[24]^[29]^[37].
Mackay Sugar, Australia’s second-largest sugar producer, was forced to shut down mills following a ransomware attack attributed to the group “The Gentlemen” ^[36].
The University of Nottingham, a UK research university, experienced a cyber incident, as noted in a threat intelligence bulletin ^[44].

Newly Discovered Vulnerabilities

Cisco released security updates for a vulnerability in Catalyst SD-WAN Manager (CVE-2026-20262), which was actively exploited in the wild to escalate privileges and perform arbitrary file writes ^[5]^[20]^[35].
The US CISA added a LiteSpeed cPanel Plugin vulnerability to its Known Exploited Vulnerabilities catalog, as it allows root privilege escalation and is being actively exploited ^[6].
A vulnerability chain in LiteLLM, an AI gateway, allows a default low-privilege account to escalate to admin and execute code on the server by chaining three flaws ^[9].
A critical vulnerability chain dubbed “SearchLeak” in Microsoft 365 Copilot Enterprise allowed attackers to steal emails, files, and MFA codes in a single click via a trusted Microsoft link. The vulnerability has been patched ^[10]^[25]^[28].
The SimpleHelp remote management software contains a vulnerability in the OpenID Connect authentication protocol that enables unauthenticated attackers to create privileged technician accounts ^[18].

Notable Threat Actor Activity

The North Korean ScarCruft (APT37) group used spear-phishing emails impersonating Microsoft Account security notifications to deliver the NarwhalRAT malware ^[4].
North Korean threat actors are leveraging developer tools as malware delivery channels in campaigns attributed to the Contagious Interview (Famous Chollima, Hexagon Geometry) cluster ^[8].
Chinese state-linked espionage group UNC6508 conducted a year-long campaign targeting North American medical, academic, and defense research networks, stealing sensitive emails and research data by abusing Google Workspace and exploiting REDCap credentials ^[7]^[24]^[29]^[37].
The ShinyHunters extortion group claimed responsibility for data breaches at the Council of Europe and Infinite Campus ^[21]^[26]^[42].
Ransomware group “The Gentlemen” was identified as responsible for the attack on Mackay Sugar in Australia ^[36].
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, pleaded guilty in the US to charges related to the development of a loader for the Conti ransomware gang ^[39].
The FBI and Google dismantled the “Outsider Enterprise” phishing service, which used over 9,000 phishing sites and stole nearly 4 million credit cards, causing approximately $1.9 billion in losses ^[43].

Trends, Tools, or Tactics of Interest

Malware is being distributed through dozens of malicious wallpapers on Steam Workshop, putting gamers’ accounts at risk ^[1].
A network of 152 Chrome wallpaper extensions with over 105,000 installs was found distributing adware and generating fake traffic ^[13].
Trusted JavaScript files in popular WordPress plugins (PushEngage, OptinMonster, TrustPulse) were tampered with in a CDN supply-chain attack to plant hidden backdoors on sites ^[14]^[19].
A malicious infrastructure was uncovered delivering EtherRAT, phishing pages, and various malware via a vast network of sites ^[45].
There is an increasing trend of employees developing automations and apps with AI tools outside traditional security oversight, leading to code sprawl and shadow tooling concerns for CISOs ^[23].
The Windows variant of the SprySOCKS Linux malware is being used in attacks against government organizations in at least four countries ^[15].
The FBI warned that fraudsters are using couriers in cryptocurrency investment scams to physically collect money from victims ^[22].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Justice seized the CFAKE.com and SOCFAKE.com deepfake nude sites under the TAKE IT DOWN Act, targeting nonconsensual AI-generated content ^[17].
The US government ordered Anthropic to suspend access to its Claude Fable 5 and Mythos 5 AI models for foreign nationals due to export control concerns and fears of abuse ^[32]^[46].

Sources

Council of Europe investigates ShinyHunters data breach claims - bleepingcomputer.com
ShinyHunters Claims Council of Europe Hack - securityweek.com
Infinite Campus data breach affects 137,000 school staff accounts - bleepingcomputer.com
Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems - securityweek.com
French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker - securityweek.com
iRhythm discloses data breach, says hackers stole patient info - bleepingcomputer.com
Chinese hackers breach REDCap servers, steal medical research - bleepingcomputer.com
China-Nexus Actor Spy on US Researchers Undetected for a Year - darkreading.com
Chinese Hackers Target Medical, Military, and AI Research in North America - securityweek.com
Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer - securityweek.com
15th June – Threat Intelligence Report - research.checkpoint.com
Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw - thehackernews.com
Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks - bleepingcomputer.com
Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks - securityweek.com
CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation - thehackernews.com
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers - thehackernews.com
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes - thehackernews.com
New attack turned Microsoft 365 Copilot into 1-click data theft tool - bleepingcomputer.com
Copilot 'SearchLeak' Attack Allows 1-Click Data Theft - darkreading.com
SimpleHelp bug lets hackers create rogue remote support accounts - bleepingcomputer.com
Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware - thehackernews.com
North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels - thehackernews.com
Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails - thehackernews.com
Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges - securityweek.com
FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service - securityweek.com
Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk - securelist.com
152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic - thehackernews.com
Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites - thehackernews.com
OptinMonster WordPress plugin hacked in CDN supply-chain attack - bleepingcomputer.com
Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software - malwarebytes.com
Vibe coders are gonna vibe code: How CISOs are tackling code sprawl - bleepingcomputer.com
Windows version of SprySOCKS Linux malware used to attack govt orgs - bleepingcomputer.com
FBI: Fraudsters use couriers to steal money in crypto scams - bleepingcomputer.com
DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act - bleepingcomputer.com
US Cracks Down on Anthropic AI Models Amid Abuse Concerns - darkreading.com
Claude Fable 5 and Mythos 5 “abruptly disabled” after US gov. ban - malwarebytes.com

Cybersecurity Brief – 2026-06-15

Mon, 15 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group stole personal information from over 137,000 school staff accounts via a Salesforce data theft attack targeting the Infinite Campus K-12 student information system ^[8].
The pharmaceutical company Novo Nordisk confirmed attackers breached its IT systems and accessed personal data stored on compromised infrastructure ^[17].
The French government’s Tchap messaging platform was breached by a threat actor known as “Misere,” affecting approximately 73,000 government accounts. The attacker claims to have stolen messages and user data ^[18].
ShinyHunters claimed responsibility for a breach of the Council of Europe, threatening to leak 297 GB of allegedly stolen data, including employee personal information ^[19].
The state of Maine disabled its public data breach portal after fake VRChat and Discord data breach reports were submitted to the system ^[21].

Newly Discovered Vulnerabilities

Palo Alto Networks reported active exploitation of a recently disclosed PAN-OS vulnerability impacting GlobalProtect VPN portals and gateways, allowing unauthorized access ^[6].
Researchers disclosed a critical vulnerability chain, “SearchLeak,” in Microsoft 365 Copilot Enterprise that enables attackers to steal sensitive data from mailboxes, OneDrive, or SharePoint accounts via a single-click attack ^[7].

Notable Threat Actor Activity

The ShinyHunters extortion gang was identified as responsible for the Infinite Campus data breach and claimed the Council of Europe hack ^[8]^[19].
The “Misere” hacker breached the French government’s Tchap messaging platform, claiming theft of messages and user data ^[18].
The FBI, in coordination with Google and Black Lotus Labs, dismantled the Outsider Enterprise phishing-as-a-service operation, which used over 9,000 phishing sites, stole nearly 4 million credit cards, and caused approximately $1.9 billion in losses. The service was operated by a Chinese group and leveraged AI to power its phishing campaigns ^[10]^[20].
A Ukrainian national pleaded guilty in the US to charges related to developing a loader for the Conti ransomware gang ^[16].
Researchers uncovered a network of 152 Chrome wallpaper extensions distributing adware and generating fake traffic, with over 105,000 installations ^[3].
An attacker tampered with JavaScript files of popular WordPress plugins (PushEngage, OptinMonster, TrustPulse) to plant hidden backdoors on websites ^[4].
The Sniper Dz group targeted users in the Middle East and North Africa with scams using fake Facebook accounts and deceptive browser alerts ^[5].

Trends, Tools, or Tactics of Interest

Organizations are increasingly deploying autonomous and semi-autonomous AI agents that interact directly with systems and make decisions without constant human oversight, raising new security concerns ^[1].
Modern phishing, business email compromise, and account takeover attacks are increasingly bypassing traditional email defenses, prompting interest in behavioral AI-based detection ^[9].
The Outsider Enterprise phishing platform leveraged AI to automate and scale phishing operations, using a million URLs and sophisticated evasion techniques ^[10]^[20].
There is ongoing abuse of onboarding processes, with IT teams sharing temporary passwords insecurely, introducing unnecessary risk ^[2].
Malicious MSI files using obfuscated or steganographic payloads continue to be observed in the wild ^[13].

Regulatory or Policy Developments Affecting the Security Industry

The US government issued an export control directive resulting in Anthropic suspending all access to its Fable 5 and Mythos 5 AI models for foreign nationals ^[11].

Sources

Infinite Campus data breach affects 137,000 school staff accounts - bleepingcomputer.com
Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems - securityweek.com
French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker - securityweek.com
ShinyHunters Claims Council of Europe Hack - securityweek.com
Maine Disables Data Breach Portal Due to Fake Submissions - securityweek.com
Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw - thehackernews.com
New attack turned Microsoft 365 Copilot into 1-click data theft tool - bleepingcomputer.com
FBI disrupts massive AI-powered phishing service using a million URLs - bleepingcomputer.com
FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service - securityweek.com
Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges - securityweek.com
152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic - thehackernews.com
Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites - thehackernews.com
Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts - thehackernews.com
Agentic AI Security in 2026: What to Know - blog.knowbe4.com
Webinar: How behavioral AI stops phishing and account takeovers - bleepingcomputer.com
The Onboarding Password Mistake That Creates Unnecessary Risk - thehackernews.com
Evil MSI Background: BASE64 Statistical Analysis, (Mon, Jun 15th) - isc.sans.edu
US Cracks Down on Anthropic AI Models Amid Abuse Concerns - darkreading.com

Cybersecurity Brief – 2026-06-13

Sat, 13 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers compromised over 400 packages in the Arch Linux User Repository (AUR), modifying build scripts to distribute an infostealer and eBPF-based rootkit capable of stealing credentials and access tokens from affected systems ^[5]^[14].
Danish pharmaceutical company Novo Nordisk disclosed a data breach impacting patient information from clinical trials ^[17].
The state of Maine disabled its public data breach reporting portal after fraudulent breach disclosures were published on the site, prompting a procedural review ^[11].
Iranian cyber group Handala claimed responsibility for hacking Cal Water, publishing 5GB of data including customer personal information and RTKBase platform credentials ^[25].

Newly Discovered Vulnerabilities

Researchers identified a 10-year-old authentication bypass vulnerability in phpBB forum software that allowed attackers to log in as any user, including administrators ^[12].
A major bug in Oracle ERP software was exploited by the ShinyHunters group, leading to significant data theft from American universities ^[18].

Notable Threat Actor Activity

A China-linked threat actor, tracked as Velvet Ant, maintained a backdoor in Linux login software for nearly a decade, enabling persistent access to compromised systems ^[7].
Google initiated legal action against a Chinese cybercrime network accused of using Gemini AI to send phishing SMS messages targeting American users ^[6].
A Ukrainian national pleaded guilty in the United States to conspiracy charges related to the Conti ransomware operation ^[13].

Trends, Tools, or Tactics of Interest

AI-generated and AI-assisted fraud schemes have surpassed physical forgery as the dominant type of fraud, facilitated by advanced tools that allow attackers to create highly convincing forgeries ^[3].
Researchers described a new class of attack called “Agentjacking,” which tricks AI coding agents into executing malicious code on developer machines ^[8].
Early warning signs of supply-chain attacks, such as GitHub access sales, leaked repositories, and stolen API keys, are increasingly being identified on dark web forums ^[15].
Collaboration between Apple and the Metropolitan Police aims to make stolen iPhones more difficult to reset, resell, and profit from, potentially reducing the incentive for device theft ^[26].

Regulatory or Policy Developments Affecting the Security Industry

The US government ordered Anthropic to suspend access to its advanced AI models, Fable 5 and Mythos 5, for all foreign nationals, resulting in the models being taken offline globally to comply with new export controls ^[4]^[10]^[19]^[22]^[24].

Sources

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit - thehackernews.com
Over 400 Arch Linux packages compromised to push rootkit, infostealer - bleepingcomputer.com
Pharma giant Novo Nordisk discloses breach of clinical trials data - bleepingcomputer.com
Maine disables data breach notification portal after fake disclosures - bleepingcomputer.com
Iranian Cyber Group Handala Claims Cal Water Hack - securityweek.com
phpBB forum fixes auth bypass bug lurking for a decade - bleepingcomputer.com
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed - darkreading.com
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade - thehackernews.com
Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing - thehackernews.com
Ukrainian national pleads guilty to role in Conti ransomware operation - bleepingcomputer.com
Report: AI-Assisted Fraud is Surging - blog.knowbe4.com
Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code - thehackernews.com
Early Warning Signs of Supply-Chain Attacks Live in the Dark Web - bleepingcomputer.com
Stolen iPhones could soon be worth a lot less to thieves - malwarebytes.com
U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals - thehackernews.com
US Gov asks Anthropic to ban 'foreign national' access to Fable, Mythos - bleepingcomputer.com
Claude Fable 5 Doesn't Change the Mythos Security Story - darkreading.com
Anthropic Says It Has Taken Its Latest AI Models Offline to Comply With New Export Controls - securityweek.com
Industry Reactions to Claude Fable 5: Feedback Friday - securityweek.com

Cybersecurity Brief – 2026-06-12

Fri, 12 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Danish pharmaceutical company Novo Nordisk disclosed a data breach impacting patient information from certain clinical trials^[13].
The French government confirmed a breach of its encrypted Tchap messaging platform, affecting over 73,000 public sector employee accounts^[15].
Kyushu Electric Power in Japan reported a physical security incident involving the loss of a drive containing personal data of 10.9 million clients^[16].
South Korean e-commerce firm Coupang was fined a record $409 million by the Personal Information Protection Commission following a massive data breach^[21].
Fake breach disclosures were submitted to Maine’s official breach portal and published publicly before verification, constituting a misinformation campaign^[17].

Newly Discovered Vulnerabilities

Oracle PeopleSoft Suite was found to contain a critical zero-day vulnerability (CVE-2026-35273) allowing unauthenticated remote code execution, exploited in the wild by the ShinyHunters group. Oracle has released mitigations^[6]^[18]^[33]^[34].
Three security flaws in LangGraph, including a critical chain enabling remote code execution, have been disclosed and patched^[3].
Researchers demonstrated that OpenClaw, a self-hosted AI agent, can be manipulated to execute attacker-controlled code or leak sensitive data^[7].
A new BitLocker bypass exploit for Windows, dubbed GreatXML, has been released, enabling attackers to circumvent BitLocker protections via recovery partition XML files^[8].
Google Chrome 149 update addressed 28 vulnerabilities, including several critical and high-severity issues such as use-after-free bugs^[31].
Hackers are exploiting a Langflow vulnerability that allows unauthenticated file writes and potential remote code execution^[38].

Notable Threat Actor Activity

The ShinyHunters extortion group exploited the Oracle PeopleSoft zero-day to breach enterprise and university systems, steal data, and extort victims^[6]^[18]^[33]^[34].
The Gentlemen ransomware group has claimed 478 victims and is capable of worm-like propagation, conducting double extortion attacks^[9].
The OnyxC2 stealer malware is being marketed to cybercriminals for $250 per month, targeting over 200 applications and using evasion techniques such as encrypted payloads, DLL sideloading, and in-memory execution^[37].
Attackers are using a spoofed ChatGPT download site, leveraging sponsored search results and SEO manipulation, to deliver malware^[1].
Fake FACEIT verification pages are being used to steal Steam accounts via convincing phishing attacks^[40].

Trends, Tools, or Tactics of Interest

Phishing attack volume has decreased by 20 percent, but attackers are focusing on more sophisticated, AI-enhanced campaigns, increasing overall risk^[23].
AI-driven attacks are challenging the effectiveness of traditional MSP security stacks, highlighting the need for integrated security, automation, and rapid response^[20].
Alert fatigue is becoming a significant risk, with organisations turning to AI and automation to better triage and respond to security alerts^[35].
Device-Bound Session Credentials, recently released by Google, provide enhanced protection against local cookie theft but remain susceptible to phishing and hacking^[2].
There is a growing trend among CISOs to shift budgets from traditional vulnerability management to breach and attack simulation (BAS) solutions due to the speed at which AI is enabling vulnerability weaponisation^[12].

Regulatory or Policy Developments Affecting the Security Industry

The US Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, requiring federal agencies to prioritise and patch actively exploited vulnerabilities, with a specific three-day deadline for critical flaws such as those in Ivanti Sentry^[14]^[22]^[24]^[30]^[36].
A German court has ruled that Google can be held liable for false or defamatory content generated by its AI Overviews, rejecting the defence that “AI can make mistakes”^[41].
Authorities in Europe dismantled the AudiA6 cryptocurrency laundering service, which was used by ransomware groups and criminal networks to launder over $380 million^[5]^[19].
INTERPOL, through Operation Ramz, took down the Sniper Dz phishing-as-a-service platform and arrested its administrator^[4].

Sources

Pharma giant Novo Nordisk discloses breach of clinical trials data - bleepingcomputer.com
Over 73,000 French govt employees affected in Tchap messenger breach - bleepingcomputer.com
Japanese energy firm loses drive with data of 10.9 million clients - bleepingcomputer.com
Coupang hit with record $409 million data breach fine in Korea - bleepingcomputer.com
Maine breach portal abused to publish fake data breach disclosures - bleepingcomputer.com
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities - thehackernews.com
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks - bleepingcomputer.com
Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters - securityweek.com
Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks - securityweek.com
LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution - thehackernews.com
New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets - thehackernews.com
New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files - thehackernews.com
Chrome 149 Update Patches 28 Vulnerabilities - securityweek.com
Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm - thehackernews.com
OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month - securityweek.com
Attackers Use Spoofed ChatGPT Site to Deliver Malware - blog.knowbe4.com
Fake verification pages are stealing Steam accounts from players - malwarebytes.com
Phishing Attack Volume Down 20%, but Risk Still Rising - darkreading.com
Why AI-driven threats are exposing the limits of MSP security stacks - bleepingcomputer.com
Alert Fatigue Is Becoming a Security Threat of Its Own - securityweek.com
I Love Device-Bound Session Credentials, But They Are Still Phishable and Hackable - blog.knowbe4.com
AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
CISA orders feds to patch actively exploited Ivanti flaw by Sunday - bleepingcomputer.com
CISA tells govt agencies to patch critical exploited flaws in 3 days - bleepingcomputer.com
Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure - darkreading.com
Ivanti Sentry Exploitation Attempts Hitting Honeypots - securityweek.com
CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk - securityweek.com
Google can be liable for false AI Overviews, court rules - malwarebytes.com
Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs - thehackernews.com
Authorities dismantle 'AudiA6' ransomware crypto-laundering service - bleepingcomputer.com
INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator - thehackernews.com