Cybersecurity Brief – 2026-06-23

Tue, 23 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Threat actors gained access to personal and protected health information affecting 1.4 million individuals in a breach at Xsolis, impacting data received from its clients ^[27].
The JaredFromSubway Ethereum MEV bot suffered a $15 million theft after an attacker manipulated its opportunity-detection logic using fake cryptocurrency trading opportunities ^[15].
Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed impact from the Klue hack ^[34].
A large-scale credential harvesting campaign, dubbed FortiBleed, targeted Fortinet FortiGate devices using custom sniffers to steal authentication secrets, resulting in a database of over 86,000 confirmed working credentials ^[17]^[33].
Thousands of outdated D-Link routers have been compromised and are now under the control of the AryStinger botnet, with no available security updates ^[36].

Newly Discovered Vulnerabilities

A critical heap over-read vulnerability in the Squid web proxy, dubbed Squidbleed, can leak cleartext HTTP requests including credentials or session tokens to anyone allowed to send traffic through the same proxy. The flaw has existed for 29 years and is described as Heartbleed-style in its impact ^[8]^[28].
Four vulnerabilities in Dify, an open-source agentic workflow platform, could allow attackers to stealthily access AI chat data across tenants ^[7].
A newly disclosed flaw in FFmpeg, called PixelSmash, could allow remote code execution on Jellyfin servers and trigger denial-of-service conditions in other applications ^[16].
Microsoft addressed a vulnerability chain named AutoJack in AutoGen Studio, which could let attackers manipulate AI agents to execute arbitrary commands on host systems ^[19].
A new exploit, Usbliter8, can bypass Apple’s boot defenses on millions of iPhones. The vulnerability is unpatchable, and a proof-of-concept exploit has been released ^[32].
Vulnerable iterations of the Gravity SMTP WordPress plugin are being exploited to leak API keys, secrets, tokens, server information, and other sensitive data ^[29].

Notable Threat Actor Activity

A global malicious campaign is distributing VBScript files via WhatsApp messages, leading to the installation of a legitimate Remote Monitoring and Management (RMM) tool, specifically the UEMS RMM agent, through a multi-stage infection chain. The campaign leverages fake business documents as lures ^[1]^[4]^[14].
Unknown threat actors compromised multiple ShapedPlugin WordPress plugins in a supply chain attack, injecting backdoor code through tampered official release channels ^[6].
North Korean state-affiliated hackers are attributed to a supply chain attack on Mastra NPM packages, where a malicious dependency in over 140 packages fetches payloads targeting cryptocurrency browser extensions ^[30].
A new campaign utilizes the OXLOADER malware loader, delivered via malicious Google Ads, to install CastleStealer on victim systems ^[9].
Attackers are using an elaborate fake reputation-boosting campaign across GitHub, YouTube, and VirusTotal to distribute a cross-platform clipboard hijacker targeting cryptocurrency assets ^[21].

Trends, Tools, or Tactics of Interest

The Anti-Phishing Working Group (APWG) reports a surge in phishing scams across social media platforms in Q1 2026 ^[2].
Attackers are increasingly exploiting document delivery scams, leveraging seemingly official voicemails and messages to trick recipients into interacting with malicious content ^[37].
The underground market for stolen credentials is evolving, with attackers now paying others to search large credential dumps for specific targets, streamlining credential abuse ^[20].
Webshells continue to be a persistent tool for attackers, remaining popular for maintaining unauthorized access to compromised systems ^[26].
Ransomware crews are actively attempting to disable security tools, including EDR solutions, as part of ongoing attack campaigns ^[12].
AI is being leveraged to amplify online scams, including sophisticated World Cup-related fraud involving fake tickets and cloned websites ^[23].
OpenAI has expanded its Daybreak initiative with the release of the GPT-5.5-Cyber model and a “Patch the Planet” campaign aimed at helping defenders patch security flaws, with a particular focus on open-source software vulnerabilities ^[5]^[22].

Regulatory or Policy Developments Affecting the Security Industry

Google has announced that, starting September 30, 2026, Android developer verification will be enforced in four countries, with major device-maker app stores participating from the outset ^[10].
Canada’s spy agency used a first-of-its-kind judicial warrant to access and clean botnet-infected devices, including servers, home routers, and IoT equipment located within Canadian territory ^[13].

Sources

Xsolis Data Breach Affects 1.4 Million Individuals - securityweek.com
JaredFromSubway MEV bot hacked in $15 million crypto theft - bleepingcomputer.com
More Cybersecurity Firms Disclose Impact From Klue Hack - securityweek.com
FortiBleed campaign used custom FortiGate sniffer to steal credentials - bleepingcomputer.com
Fortinet Responds to FortiBleed Campaign - securityweek.com
Thousands of D-Link routers under control of AryStinger botnet - malwarebytes.com
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests - thehackernews.com
Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data - securityweek.com
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants - thehackernews.com
FFmpeg fixes PixelSmash flaw in widely used video decoder - bleepingcomputer.com
Microsoft fixes AutoGen Studio flaw that enabled code execution - bleepingcomputer.com
New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones - securityweek.com
Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data - securityweek.com
A VBScript campaign distributed through WhatsApp deploying RMM software - securelist.com
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool - thehackernews.com
WhatsApp phishing attack uses fake business docs to hack PCs - bleepingcomputer.com
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack - thehackernews.com
North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - securityweek.com
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer - thehackernews.com
Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign - darkreading.com
APWG Report: Social Media Phishing is Surging - blog.knowbe4.com
Document delivery scams: What are they and what’s their goal? - malwarebytes.com
A Glimpse into the “Search Your Target” Market for Stolen Credentials - bleepingcomputer.com
Webshells Remain Popular, (Mon, Jun 22nd) - isc.sans.edu
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More - thehackernews.com
World Cup Scams Are Getting Harder to Spot - wired.com
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws - thehackernews.com
OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos - wired.com
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries - thehackernews.com
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices - thehackernews.com

Squid on DanSec Daily

Cybersecurity Brief – 2026-06-23

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources