Weekly Review, 2026-06-22
Weekly Review - June 22, 2026
Covers 7 daily digests (2026-06-16 to 2026-06-22).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. UNC6508 Exploited Outdated REDCap Servers Targeting US and Canada Research Organizations
6 outlets, 2026-06-16 to 2026-06-19 - severity 4/5
The China-linked threat actor UNC6508 conducted a multiyear espionage campaign targeting medical, academic, and military research organizations across the United States and Canada by exploiting outdated REDCap servers. Beginning in September 2023, the attackers compromised web-facing instances of the software to deploy InfiniteRed malware, which trojanized system files to harvest credentials and establish backdoors via shell command execution and SQL queries. The campaign leveraged Google Workspace content compliance rules to exfiltrate sensitive data, including research on the Chikungunya virus, advanced AI technologies, and military strategy. While approximately 8,500 REDCap instances are globally accessible, only 1.18% were running the most recent patched version as of June 2026, leaving many organizations vulnerable to the actor's use of legacy software features. Google Threat Intelligence Group eventually identified and disrupted the activity, which had remained undetected within some networks for over a year.
Sources
- Chinese hackers breach REDCap servers, steal medical research - BleepingComputer, 2026-06-15 (quality: 19/21)
- Google exposes China espionage group that’s been lurking in networks undetected since 2023 - CyberScoop, 2026-06-15 (quality: 20/21)
- China-nexus group linked to multiyear campaign targeting US, Canadian medical research - Cybersecurity Dive - Latest News, 2026-06-15 (quality: 20/21)
- Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails - The Hacker News, 2026-06-15 (quality: 20/21)
- Chinese Hackers Target Medical, Military, and AI Research in North America - SecurityWeek, 2026-06-15 (quality: 10/21)
- China-Nexus Actor Spy on US Researchers Undetected for a Year - darkreading, 2026-06-15 (quality: 10/21)
- Majority of Internet-Accessible REDCap Servers Outdated - SecurityWeek, 2026-06-18 (quality: 19/21)
2. Russian-speaking threat actors target Fortinet firewalls in FortiBleed credential-harvesting campaign
4 outlets, 2026-06-18 to 2026-06-22 - severity 4/5
Russian-speaking threat actors conducted a large-scale credential-harvesting campaign, known as FortiBleed, targeting internet-facing Fortinet firewalls and VPN gateways across nearly 200 countries. The attack chain involved approximately 1.16 billion credential attempts against over 320,000 targets to intercept SSL VPN authentication hashes, which were then cracked using a 45-GPU cluster to facilitate pivots into internal Active Directory environments. The scope of the compromise grew from an initial estimate of 30,000 devices to between 73,932 and over 86,000 identified devices, with leaked data including usernames, email addresses, and plaintext passwords. While the campaign utilized brute-force and password spraying techniques rather than new vulnerabilities, the attackers leveraged credentials obtained from previous exploits of CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858. Impacted sectors include telecommunications, government, and education, with notable victims including major global corporations such as Samsung, Toyota, and AT&T. In response, CISA issued an alert urging device hardening, and Fortinet began notifying impacted customers while recommending the implementation of multi-factor authentication and credential rotation.
Sources
- Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices - darkreading, 2026-06-17 (quality: 12/21)
- CISA warns Fortinet users to secure devices after FortiBleed leak - BleepingComputer, 2026-06-19 (quality: 20/21)
- FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - BleepingComputer, 2026-06-18 (quality: 20/21)
- FortiBleed: 86,000 Fortinet Device Credentials Compromised - SecurityWeek, 2026-06-19 (quality: 20/21)
- CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices - The Hacker News, 2026-06-19 (quality: 20/21)
- Fortinet Responds to FortiBleed Campaign - SecurityWeek, 2026-06-22 (quality: 18/21)
3. Icarus executes supply chain attack against Klue using compromised legacy credentials
4 outlets, 2026-06-19 to 2026-06-22 - severity 4/5
The threat actor Icarus executed a supply chain attack against the market intelligence platform Klue by using compromised legacy credentials to push malicious code updates to its backend servers. Between June 11 and June 12, 2026, this unauthorized code harvested OAuth tokens, allowing attackers to use automated Python scripts to query the Salesforce REST API of various Klue customers. The breach impacted at least nine organizations, including cybersecurity firms such as Huntress, Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity, resulting in the exfiltration of CRM data including business contacts, sales communications, and pricing information. In response, Klue deactivated affected tokens and integrations, while Salesforce disabled the Klue Battlecards app integration to prevent further unauthorized access. As of late June 2026, Icarus had added Klue to its Tor-based leak site and threatened to publish stolen data if extortion demands were not met.
Sources
- Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - BleepingComputer, 2026-06-18 (quality: 20/21)
- Cybersecurity Firms Impacted by Klue Supply Chain Attack - SecurityWeek, 2026-06-19 (quality: 20/21)
- Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data - The Hacker News, 2026-06-19 (quality: 20/21)
- Salesforce Data Thefts Continue via Klue App Compromise - darkreading, 2026-06-18 (quality: 10/21)
- Klue OAuth breach victim list grows as Icarus hackers claim attack - BleepingComputer, 2026-06-19 (quality: 19/21)
- More Cybersecurity Firms Disclose Impact From Klue Hack - SecurityWeek, 2026-06-22 (quality: 19/21)
4. U.S. Department of Commerce Targets Anthropic Models With Export-Control Directive
6 outlets, 2026-06-16 to 2026-06-19 - severity 3/5
The U.S. Department of Commerce issued an export-control directive targeting Anthropic’s Fable 5 and Mythos 5 models, classifying them as dangerous munitions due to their ability to exploit software vulnerabilities and achieve complex goals with minimal human prompting. In response to the order prohibiting foreign nationals from accessing these models, Anthropic disabled access to both models for all users globally to avoid the technical difficulty of verifying user nationality. The administration's decision followed reports that Fable 5 could be jailbroken to bypass anti-hacking guardrails, though researchers noted that similar capabilities exist in other models like those from OpenAI when paired with sophisticated interfaces. While the Trump administration cited national security risks, members of Congress and cybersecurity experts criticized the move as politically motivated and ineffective at addressing the broader trend of advancing AI capabilities. As of mid-June 2026, access to the Fable 5 and Mythos 5 models remains suspended, while older Claude variants continue to be available to the public.
Sources
- Cybersecurity experts don’t think Anthropic’s Fable 5 presents a unique threat - CyberScoop, 2026-06-15 (quality: 20/21)
- Cybersecurity experts blast US government for restricting Anthropic’s AI models - Cybersecurity Dive - Latest News, 2026-06-15 (quality: 18/21)
- Claude Fable 5 and Mythos 5 “abruptly disabled” after US gov. ban - Malwarebytes, 2026-06-15 (quality: 16/21)
- Cybersecurity Executives Urge the Trump Administration to Ease Restrictions on Anthropic AI Models - SecurityWeek, 2026-06-16 (quality: 10/21)
- Lawmakers leary about Trump administration’s Anthropic order - CyberScoop, 2026-06-16 (quality: 17/21)
- Security Community Slams US Ban on Exporting Mythos, Fable - darkreading, 2026-06-16 (quality: 10/21)
- Anthropic’s Fable and the State of AI - Schneier on Security, 2026-06-19 (quality: 17/21)
5. Law Enforcement Dismantles Evil Corp SocGholish Botnet Infrastructure via Operation Endgame
2 outlets, 2026-06-20 to 2026-06-22 - severity 4/5
International law enforcement agencies, including the FBI, Europol, and the Dutch National High Tech Crime Unit, executed Operation Endgame to dismantle the SocGholish botnet infrastructure. The operation targeted servers and domains used by threat actors such as Evil Corp to infect visitors to legitimate websites via malicious redirects. Authorities seized 106 servers and cleaned 14,971 infected WordPress sites, removing malware and backdoors from the compromised systems. This crackdown followed previous observations of SocGholish being utilized by groups like RomCom to deliver the Mythic Agent. The takedown effectively disrupted the distribution mechanism used by the botnet to facilitate subsequent attacks by various ransomware families.
Sources
- Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites - The Hacker News, 2026-06-19 (quality: 20/21)
- Nearly 15,000 infected websites cleaned in SocGholish crackdown - Malwarebytes, 2026-06-19 (quality: 15/21)
- A week in security (June 15 – June 21) - Malwarebytes, 2026-06-22 (quality: 8/21)
6. Sapphire Sleet executed a software supply chain attack against Mastra NPM ecosystem
3 outlets, 2026-06-17 to 2026-06-22 - severity 4/5
The North Korean threat actor Sapphire Sleet (also known as BlueNoroff) executed a software supply chain attack against the Mastra NPM ecosystem by hijacking the "ehindero" maintainer account. The attackers used this access to inject a malicious dependency named easy-day-js into 141 packages within the @mastra/* namespace, which collectively receive approximately 8 million weekly downloads. The attack chain utilized an obfuscated postinstall hook in the typosquatted library to disable TLS certificate validation and download a second-stage payload from attacker-controlled infrastructure. This cross-platform information stealer targeted Windows, macOS, and Linux systems to harvest browser histories, system information, and data from over 160 cryptocurrency wallet browser extensions. Microsoft and Google Threat Intelligence Group attributed the activity to Sapphire Sleet, noting that any developer workstation or CI/CD pipeline running installation commands on the affected versions was potentially compromised.
Sources
- Microsoft links Mastra AI supply chain attack to North Korean hackers - BleepingComputer, 2026-06-20 (quality: 20/21)
- North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - SecurityWeek, 2026-06-22 (quality: 20/21)
- 144 Mastra npm Packages Compromised via Hijacked Contributor Account - The Hacker News, 2026-06-17 (quality: 20/21)
7. Rokarolla Android malware targets users via fake applications and malicious websites
5 outlets, 2026-06-17 to 2026-06-18 - severity 3/5
The Rokarolla Android malware targets users by distributing fake versions of popular applications, such as Google Chrome and TikTok, through malicious websites. Once installed via sideloading, the malware impersonates Google Play Protect to deliver its payload and requests high-level permissions, including Accessibility Services, SMS access, and notification access. The attack chain involves sending device profiles to a command-and-control server to identify targets among 217 specific banking and cryptocurrency applications. Once an infection is established, the malware uses screen overlays, keylogging, and clipboard manipulation to capture credentials, intercept one-time passwords (OTPs), and redirect cryptocurrency payments by replacing addresses in the clipboard. The malware also possesses the capability to capture lock-screen PINs, record on-screen content, and disable security features like Google Play Protect to evade detection. Researchers from Zimperium and Malwarebytes have identified these capabilities, which allow the threat actor near-complete administrative control over infected Android devices.
Sources
- New Rokarolla Android malware targets 217 banking, crypto apps - BleepingComputer, 2026-06-16 (quality: 16/21)
- New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - The Hacker News, 2026-06-16 (quality: 11/21)
- Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading, 2026-06-16 (quality: 10/21)
- Rokarolla Banking Trojan Targets 200 Applications - SecurityWeek, 2026-06-18 (quality: 17/21)
- Rokarolla Android malware can take over your phone and steal banking logins - Malwarebytes, 2026-06-17 (quality: 13/21)
8. Malicious JetBrains Marketplace plugins steal AI API keys from developers
2 outlets, 2026-06-17 to 2026-06-18 - severity 4/5
A coordinated malware campaign involving at least 15 malicious plugins on the JetBrains Marketplace has been identified stealing AI API keys from developers. Published under seven different vendor accounts between October 2025 and June 2026, these plugins masquerade as legitimate AI coding assistants, code-review tools, and Git utilities. The attack chain occurs when a user enters an API key into the plugin settings and clicks "Apply," triggering the exfiltration of credentials for services such as OpenAI, DeepSeek, and SiliconFlow to a hardcoded server at 39.107.60[.]51 via HTTP. The campaign has reached approximately 70,000 installations, with the DeepSeek AI Assist and CodeGPT AI Assistant plugins being among the most downloaded. Some of these plugins also feature a built-in donation wall that provides users with an API key for model calls after a fee is paid.
Sources
- Malicious JetBrains Marketplace plugins steal AI API keys from developers - BleepingComputer, 2026-06-16 (quality: 18/21)
- Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats - The Hacker News, 2026-06-17 (quality: 20/21)
Under the Radar
High-severity stories that received limited coverage this period.
Volt Typhoon prepositioning within critical infrastructure to enable mass disruption
2 outlets, 2026-06-18 - severity 4/5
Nation-state actors, specifically the threat actor Volt Typhoon, are prepositioning within critical infrastructure to enable mass disruption during future conflicts. The National Cyber Security Centre (NCSC) reported that approximately 75% of over 200 incidents involving critical infrastructure and its supporting ecosystem in the year leading up to May were attributed to state actors. These adversaries establish footholds within technology systems to facilitate rapid exploitation, with officials expecting further disruptions to telecommunications and the use of artificial intelligence to exploit aging technology by 2028. The current environment is characterized by a shift toward managing inevitable disruptions in contested infrastructures.
Why it matters: Confirmed widespread exploitation by Volt Typhoon for prepositioning within critical infrastructure to enable future mass disruption and operational impact.
Sources
- Hostile states behind three-quarters of attacks on Britain's critical infrastructure, cyber chief warns - The Record from Recorded Future News, 2026-06-17 (quality: 20/21)
- Major critical infrastructure disruptions are inevitable, acting CISA chief says - Cybersecurity Dive - Latest News, 2026-06-17 (quality: 18/21)
FishMonger deployed SprySOCKS malware against government organizations in multiple countries
3 outlets, 2026-06-16 to 2026-06-17 - severity 4/5
The China-nexus threat actor FishMonger (also known as Earth Lusca) deployed Windows variants of the SprySOCKS malware against government organizations in Taiwan, Thailand, Pakistan, and Honduras between 2023 and 2024. The attack chain utilizes two primary Windows variants, WIN_DRV and WIN_PLUS, to establish backdoors and evade security measures. The WIN_DRV variant employs kernel drivers such as 'RawWNPF' and 'DriverLoader' (fsdiskbit.sys) to manipulate the Windows API for hiding processes, files, registry keys, and network connections. Alternatively, the WIN_PLUS variant abuses the Windows Print Spooler service to execute a first-stage loader via a print processor known as VSPMsg. Both variants support SOCKS proxy functionality and communicate over TCP, UDP, and WebSocket using over 30 C2 commands for system information collection and file operations.
Why it matters: Confirmed widespread exploitation of government organizations across multiple countries using advanced malware with kernel-level stealth capabilities.
Sources
- Windows version of SprySOCKS Linux malware used to attack govt orgs - BleepingComputer, 2026-06-16 (quality: 18/21)
- China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - The Hacker News, 2026-06-16 (quality: 20/21)
- SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading, 2026-06-16 (quality: 10/21)
Volt Typhoon and APT28 Botnets Target Canadian Energy Sector Infrastructure
1 outlet, 2026-06-22 - severity 4/5
The Canadian Security Intelligence Service (CSIS) utilized threat reduction warrant powers to access and neutralize two foreign-run botnets targeting Canadian infrastructure. The operation involved altering, degrading, and destroying malware data on infected servers, SOHO routers, and IoT devices—including Ring doorbells, security cameras, and smart appliances—to prevent adversaries like Volt Typhoon and APT28 from probing the energy sector. While the operation successfully disconnected compromised hardware from the botnet networks, the underlying vulnerabilities in unpatched or end-of-life Cisco, NetGear, and Ubiquiti devices remained a persistent risk for reinfection.
Why it matters: The operation neutralized active botnets used by nation-state actors (Volt Typhoon/APT28) to target Canadian critical infrastructure.
Sources
- Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices - The Hacker News, 2026-06-22 (quality: 20/21)
INC ransomware targets healthcare and manufacturing by exploiting Citrix Netscaler vulnerabilities
2 outlets, 2026-06-18 to 2026-06-19 - severity 4/5
INC ransomware has claimed at least 830 victims since August 2023, targeting sectors such as healthcare, manufacturing, and legal services to maximize operational pressure for ransom payments. The group expanded its operations by absorbing affiliates from disrupted ransomware families including LockBit, BlackCat, Qilin, Akira, and The Gentlemen. The attack chain involves exploiting vulnerabilities in public-facing applications, specifically Citrix Netscaler (CVE-2023-3519, CVE-2025-5777), Fortinet EMS (CVE-2023-48788), and SimpleHelp (CVE-2024-57727). Technical execution utilizes rewritten Rust-based encryptors for Windows and Linux/ESXi, a credential dumper targeting Veeam backup deployments via salted DPAPI encryption, and the Bring Your Own Vulnerable Driver (BYOVD) technique using filwfp.sys, filnk.sys, and fildds.sys to disable system defenses. As of early 2026, INC has emerged as a prominent threat actor, accounting for over 120 incidents in Q1 2026, with more than 65% of listed victims located in the United States.
Why it matters: Widespread exploitation of critical vulnerabilities by a major ransomware group targeting over 830 victims across multiple essential sectors.
Sources
- INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - The Hacker News, 2026-06-18 (quality: 20/21)
- INC Ransomware Thrives by Mastering the Basics - darkreading, 2026-06-17 (quality: 9/21)
All Stories by Category
Vulnerabilities & Patches
- Shai-Hulud worm exploits GitHub design flaws to hide malicious activity (2026-06-17, 1 outlet, severity 4/5)
- GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say - The Record from Recorded Future News
- Chrome 0-Day, UniFi Exploits, and macOS Infostealers Highlight Weekly Threats (2026-06-16, 1 outlet, severity 4/5)
- OpenBSD Bypass, SiderAI Flaws, and New Malware Campaigns Detailed (2026-06-22, 1 outlet, severity 3/5)
- Apple Patches Beats Eavesdropping Flaw via CVE-2025-20701 Update (2026-06-20, 1 outlet, severity 3/5)
- Athena Coalition Launches Initiative to Remediate Open-Source Software Vulnerabilities (2026-06-16, 1 outlet, severity 2/5)
- Reduce Security Debt by Prioritizing Vulnerability Exposure Duration (2026-06-19, 1 outlet, severity 1/5)
Data Breaches
- ShinyHunters claims responsibility for Council of Europe and Infinite Campus breaches (2026-06-16, 1 outlet, severity 4/5)
- Council of Europe investigates ShinyHunters data breach claims - BleepingComputer
- Infinite Campus data breach affects 137,000 school staff accounts - BleepingComputer
- ShinyHunters Breach Nottingham University and Mackay Sugar Operations Disrupted (2026-06-16, 1 outlet, severity 4/5)
- 15th June – Threat Intelligence Report - Check Point Research
- ShinyHunters claims responsibility for data breach at Eastman Kodak Company (2026-06-17 to 2026-06-18, 3 outlets, severity 3/5)
- Kodak confirms data breach claimed by ShinyHunters extortion gang - BleepingComputer
- Kodak Admits Data Breach After ShinyHunters Hack Claims - SecurityWeek
- Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - Malwarebytes
- Handala claims responsibility for a breach targeting California Water Service (2026-06-16 to 2026-06-18, 2 outlets, severity 3/5)
- Cal Water Investigating Iranian Hackers’ Claims - SecurityWeek
- California water utility probes breach claim by Iran-linked actor - Cybersecurity Dive - Latest News
- Shadowbyt3$ steals Nintendo employee survey data via TinyPulse breach (2026-06-19, 1 outlet, severity 3/5)
- Nintendo confirms data stolen in WebMD subsidiary cyberattack - BleepingComputer
- Cybernews Researchers Find 24 Billion Stolen Records in Exposed Database (2026-06-17, 1 outlet, severity 3/5)
- Fraudulent breach disclosures targeting Discord and VRChat caused Maine portal abuse (2026-06-16, 2 outlets, severity 2/5)
- Maine forced to take down data breach portal after fake notices filed with authorities - GRAHAM CLULEY
- Maine closes data breach portal to the public after fake reports - The Record from Recorded Future News
Ransomware
- DragonForce targeted U.S. services firm using SQL vulnerabilities and ransomware (2026-06-16 to 2026-06-19, 3 outlets, severity 3/5)
- The Gentlemen attack Mackay Sugar using GentleKiller toolkit for ransomware (2026-06-16 to 2026-06-19, 3 outlets, severity 3/5)
- Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer - SecurityWeek
- Gentlemen ransomware uses multiple EDR killers to disable defenses - BleepingComputer
- Australian sugar producer works to restore operations as ransomware group claims attack - The Record from Recorded Future News
- The Gentlemen Use GentleKiller Framework to Disable Security Processes (2026-06-20, 1 outlet, severity 3/5)
- Prinz Eugen Ransomware Targets Recent Files Using ChaCha20 Encryption (2026-06-21, 1 outlet, severity 3/5)
- New Prinz Eugen ransomware prioritizes recent files for encryption - BleepingComputer
- Unit 42 Report: RansomHub Attacks Complete in Just 72 Minutes (2026-06-16, 1 outlet, severity 3/5)
Supply Chain Attacks
- TeamPCP Compromises 1,000 Open-Source Packages Using Mini Shai-Hulud Malware (2026-06-19, 1 outlet, severity 4/5)
- OptinMonster and TrustPulse hit by Awesome Motive CDN attack (2026-06-16, 1 outlet, severity 4/5)
- OptinMonster WordPress plugin hacked in CDN supply-chain attack - BleepingComputer
- ShapedPlugin update flow compromised in WordPress supply chain attack (2026-06-19, 1 outlet, severity 4/5)
- ShapedPlugin update flow hacked to infect WordPress sites - BleepingComputer
- Third-party vendor intrusion exposes Texas Parks and Wildlife Department customer data (2026-06-20 to 2026-06-22, 2 outlets, severity 3/5)
- Texas govt data breach exposes over 3 million driver’s licenses - BleepingComputer
- Texas Parks & Wildlife Data Breach Affects 3 Million Individuals - SecurityWeek
- Atomic Arch Attack Compromises 1,500 Arch User Repository Packages (2026-06-16, 1 outlet, severity 3/5)
- Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages - SecurityWeek
- Novo Nordisk GitHub Token Leak Exposes Software Pipeline Vulnerabilities (2026-06-19, 1 outlet, severity 2/5)
Nation-State / APT
- Bulgaria Licensed Circles Surveillance Tech for Use in Repressive Regimes (2026-06-19, 1 outlet, severity 3/5)
- Bulgaria allowed surveillance tech firm to sell products to repressive regimes, report says - The Record from Recorded Future News
- North Korean Hackers Use Developer Tools to Spread Overlord Malware (2026-06-16, 1 outlet, severity 3/5)
- Kaluga Astral Cyberattack Disrupts Russian Business and Government Services (2026-06-16, 1 outlet, severity 3/5)
- Cyberattack on Russian tech firm Astral disrupts business, government services for week - The Record from Recorded Future News
- Estonia to Quarantine All Incoming .ru Emails for Government Officials (2026-06-16, 1 outlet, severity 2/5)
- Estonia to quarantine emails sent from Russian .ru domain before they reach government officials - The Record from Recorded Future News
Malware & Botnets
- Threat actors use Steam Workshop wallpapers to distribute malware to users (2026-06-16 to 2026-06-17, 2 outlets, severity 3/5)
- AryStinger malware campaign compromises D-Link, Linksys, and QNAP devices (2026-06-22, 2 outlets, severity 3/5)
- AryStinger botnet infected thousands of D-Link routers worldwide - BleepingComputer
- AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network - The Hacker News
- Windows Clipper malware campaign targets cryptocurrency users via USB LNK files (2026-06-19, 2 outlets, severity 3/5)
- Unknown threat actor conducts Crypto clipboard hijacker campaign via fake bots (2026-06-18, 2 outlets, severity 3/5)
- From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker - Check Point Research
- Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments - The Hacker News
- Popa Botnet Linked to Alarum Technologies’ NetNut Proxy Service (2026-06-19, 1 outlet, severity 3/5)
- ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - Krebs on Security
- CryptoBandits Malware Uses Tor for Backdoor Access and Theft (2026-06-19, 1 outlet, severity 3/5)
- CryptoBandits Malware Doubles as a Backdoor, Abuses Tor - SecurityWeek
- EtherRAT Malware Uses Ethereum Blockchain to Evade Infrastructure Takedowns (2026-06-16, 1 outlet, severity 3/5)
- Remcos RAT delivered via malicious VHDX files in new campaign (2026-06-16, 1 outlet, severity 3/5)
- From a VHDX File to a Remcos RAT, (Tue, Jun 16th) - SANS Internet Storm Center, InfoCON: green
- Roblox developers targeted by Robase malware to steal game assets (2026-06-18, 1 outlet, severity 3/5)
- Roblox developers are losing entire games to malware attacks - Malwarebytes
- EQVita GitHub Repositories Distribute SmartLoader and Lumma Stealer Malware (2026-06-18, 1 outlet, severity 3/5)
- Retro gaming fans are the new target for fake GitHub malware - Malwarebytes
- GhostTree Attack Uses Recursive Junctions to Bypass Windows Security Tools (2026-06-17, 1 outlet, severity 3/5)
- GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - BleepingComputer
- World Cup streaming sites distribute malware via deceptive ad networks (2026-06-17, 1 outlet, severity 3/5)
- ClickFix Campaigns Use Fake Updates to Deploy BabaDeda Loader (2026-06-17, 1 outlet, severity 3/5)
- Vice Society Uses ClickFix to Deliver Lorem Ipsum Malware (2026-06-17, 1 outlet, severity 3/5)
- 'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading
- Operation Escaneo Reveals New Intelligence and Monetization Tactics in LatAm (2026-06-19, 1 outlet, severity 2/5)
- Phantom Stealer Malware Uses Fileless Techniques to Steal Browser Credentials (2026-06-17, 1 outlet, severity 2/5)
- Fileless Phantom Stealer Targets Browser Credentials - darkreading
Phishing & Social Engineering
- Unnamed threat actor uses social engineering to steal iRhythm Holdings data (2026-06-16 to 2026-06-17, 3 outlets, severity 3/5)
- iRhythm discloses data breach, says hackers stole patient info - BleepingComputer
- iRhythm Confirms Data Stolen in Hack - SecurityWeek
- Cardiac patients’ medical data stolen and held to ransom - Malwarebytes
- Fraudsters use bank impersonation to cost American consumers billions in 2025 (2026-06-17 to 2026-06-20, 2 outlets, severity 3/5)
- FTC warns of record $3.5 billion losses to imposter scams in 2025 - BleepingComputer
- Imposter scams cost Americans $3.5 billion in 2025 – and it’s getting worse - GRAHAM CLULEY
- ScarCruft Uses Fake Microsoft Alerts to Deploy NarwhalRAT Malware (2026-06-16, 1 outlet, severity 3/5)
- Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware - The Hacker News
- WhatsApp VBScript Campaign Deploys ManageEngine RMM via Social Engineering (2026-06-22, 1 outlet, severity 3/5)
- Belgian Bank Targeted by Phishing Using IPv4-Mapped IPv6 Addresses (2026-06-19, 1 outlet, severity 3/5)
- eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th) - SANS Internet Storm Center, InfoCON: green
Cloud & Infrastructure Security
- QUIC Protocol Use May Bypass CASB Security Controls (2026-06-18, 1 outlet, severity 3/5)
- The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th) - SANS Internet Storm Center, InfoCON: green
- Telegram BGP Hijack Causes Service Disruptions in UAE and India (2026-06-18, 1 outlet, severity 3/5)
- India's Telegram ban hit the UAE too. Here's how to get around it - BleepingComputer
- Intruder Study Reveals Critical HTTP Panels and Database Exposures (2026-06-17, 1 outlet, severity 3/5)
- The Top 10 Attack Surface Exposures in 2026 - The Hacker News
- DShield Logs Reveal 20 Million Recent SSH Brute-Force Attempts (2026-06-18, 1 outlet, severity 2/5)
- The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary], (Wed, Jun 17th) - SANS Internet Storm Center, InfoCON: green
- Spur Intelligence Report: Anonymized Infrastructure Drives 94% of Incidents (2026-06-16, 1 outlet, severity 2/5)
- Infrastructure Downtime Costs $50k Hourly, Demanding Faster Response Workflows (2026-06-22, 1 outlet, severity 1/5)
- Infrastructure downtime has a $50k-per-hour price tag. It’s time to turn hours into minutes. - Cybersecurity Dive - Latest News
Identity & Access Management
- ShinyHunters Use Identity-Centric Attacks to Breach Major Global Organizations (2026-06-22, 1 outlet, severity 4/5)
- Autonomous AI Agents Create Access Control Vulnerabilities Within Enterprise Systems (2026-06-19, 1 outlet, severity 3/5)
- Forget Data Leakage: Shadow AI's Real Threat Is Access Control - The Hacker News
- Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - The Hacker News
- Account Takeover Attacks Surge Amid Complex Cloud Identity Management (2026-06-18, 1 outlet, severity 3/5)
- Why Account Takeovers Are Rising and How to Stop Them - BleepingComputer
- Tailscale and OpenSSH Used for Persistent Access in Automotive Breach (2026-06-18, 1 outlet, severity 2/5)
- 1Password Announces Acquisition of Apono to Extend Identity Security Platform (2026-06-18, 1 outlet, severity 1/5)
- Dream Raises $260 Million at $3 Billion Valuation - SecurityWeek
- 1Password Acquires Apono in Reported $250M-$300M Deal - SecurityWeek
- SailPoint to Acquire Entro in Reported $200 Million Deal (2026-06-18, 1 outlet, severity 1/5)
- SailPoint to Acquire Entro in Reported $200 Million Deal - SecurityWeek
- Cisco Acquires WideField Security to Enhance Splunk’s Identity Monitoring Capabilities (2026-06-19, 1 outlet, severity 1/5)
- NewCore Secures $66 Million to Launch Identity Protection Platform (2026-06-16, 1 outlet, severity 1/5)
AI & Machine Learning Security
- Claude Chat Abuse and NastyC2 npm Packages Threaten Users (2026-06-19, 1 outlet, severity 4/5)
- Nightmare Eclipse reveals BitLocker bypass and AI-driven data theft risks (2026-06-18, 1 outlet, severity 4/5)
- Claude Code security patches reveal risks in rapid AI updates (2026-06-17, 1 outlet, severity 3/5)
- CVE-2025-24813 Exploits Legacy Infrastructure to Compromise AI Agents (2026-06-22, 1 outlet, severity 3/5)
- Stop Your Legacy Infrastructure from Hijacking Your AI Agents - The Hacker News
- Datadog and Jamf CISOs Address AI-Driven Code Sprawl Risks (2026-06-16, 1 outlet, severity 3/5)
- Vibe coders are gonna vibe code: How CISOs are tackling code sprawl - BleepingComputer
- Token Security Survey: Treat AI Agents as Distinct Digital Identities (2026-06-20, 1 outlet, severity 3/5)
- Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way - BleepingComputer
- AutoJack Vulnerability Enables Web Page Hijacking of AI Agents (2026-06-20, 1 outlet, severity 3/5)
- Shadow AI and Agentic AI Present Significant Governance Risks for Enterprises (2026-06-17, 1 outlet, severity 2/5)
- Out of Your Technological Depth? It’s Your Duty to Say So. - Corporate Compliance Insights
- Meet Your New Colleague. It’s Already Making Decisions. - Corporate Compliance Insights
- Institute for Security and Technology Proposes New AI Bill of Materials (2026-06-17, 1 outlet, severity 2/5)
- OMB Reports 70% Surge in US Federal AI Use Cases (2026-06-17, 1 outlet, severity 2/5)
- AI Use by the US Government - Schneier on Security
- Spyware Developers Use Forbidden Text to Evade AI Malware Scanners (2026-06-18, 1 outlet, severity 2/5)
- Embedding Forbidden Text in Spyware to Discourage AI Analysis - Schneier on Security
- vbdec Uses COM Objects to Enable AI-Driven Reverse Engineering (2026-06-18, 1 outlet, severity 2/5)
- AI Adoption Linked to Higher Security Incident Frequency, Survey Finds (2026-06-17, 1 outlet, severity 2/5)
- AI adoption correlates with incident frequency, underscoring need for governance - Cybersecurity Dive - Latest News
- Security Leaders Adopt Three Key Strategies to Manage AI Risks (2026-06-22, 1 outlet, severity 1/5)
- AI is transforming enterprise data risk. Here’s how security leaders are responding. - Cybersecurity Dive - Latest News
- AI-Native Operating Systems Automate Defense Against Social Engineering Attacks (2026-06-16, 1 outlet, severity 1/5)
- The Beginning of the End of Social Engineering - darkreading
Legal & Law Enforcement
- DOJ Seizes CFake.com Domains Hosting Nonconsensual AI-Generated Nude Images of Women (2026-06-16, 2 outlets, severity 3/5)
- DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act - BleepingComputer
- Deepfake posting sites depicting famous women taken down by feds - Malwarebytes
- Supreme Court Permits SEC Disgorgement Without Proving Investor Losses (2026-06-19, 1 outlet, severity 3/5)
- Supreme Court Rules SEC May Claw Back Ill-Gotten Gains Regardless of Investor Loss - Corporate Compliance Insights
- INTERPOL Warns of Rising AI Scams and Ransomware in Asia-Pacific (2026-06-22, 1 outlet, severity 3/5)
- FBI Warns of Couriers Collecting Cash in Crypto Scams (2026-06-16, 1 outlet, severity 3/5)
- FBI: Fraudsters use couriers to steal money in crypto scams - BleepingComputer
- Fitburg officers charged in Finland for damaging Baltic subsea cables (2026-06-16, 1 outlet, severity 3/5)
- Finland brings charges against cargo ship officers for cutting submarine cables - The Record from Recorded Future News
- San Francisco shuts down 10 deepfake porn websites via settlement (2026-06-16, 1 outlet, severity 3/5)
- Flock Cameras Used by Officers for Illegal Stalking Cases (2026-06-16, 1 outlet, severity 3/5)
- Flock Cameras Are Being Used for Stalking - Schneier on Security
- UK Information Commissioner John Edwards Resigns Following Conduct Investigation (2026-06-19, 1 outlet, severity 2/5)
- UK's information commissioner resigns over ‘inappropriate humour’ - The Record from Recorded Future News
- Anthony Belford charged with cyberstalking using AI-generated nude images (2026-06-19, 1 outlet, severity 2/5)
- NY man charged after harassing college student with AI-generated nudes - BleepingComputer
Policy & Regulation
- Indian authorities restrict Telegram to prevent leaked NEET-UG exam materials distribution (2026-06-17 to 2026-06-18, 2 outlets, severity 3/5)
- India's Telegram ban draws criticism from Durov as company challenges order in court - The Record from Recorded Future News
- India temporarily blocks Telegram over medical exam cheating fears - The Record from Recorded Future News
- Telegram admits it couldn't police exam-leak channels, India tells court - BleepingComputer
- Senate Committee Approves NO FAKES Act to Combat Deepfakes (2026-06-19, 1 outlet, severity 3/5)
- Senator Warner Warns CISA of Critical Budget and Staffing Gaps (2026-06-17, 1 outlet, severity 3/5)
- Warner warns of CISA cuts, staffing gaps in letter to acting chief - The Record from Recorded Future News
- Macron Urges US and G7 Cooperation on AI Regulation (2026-06-20, 1 outlet, severity 3/5)
- UAE Law No. 10 Imposes Personal Liability for AML Compliance (2026-06-16, 1 outlet, severity 3/5)
- The Day My Job Description Changed: Compliance & Personal Liability - Corporate Compliance Insights
- Corporate Directors Use Generative AI Lacking Specific Board Policies (2026-06-19, 1 outlet, severity 3/5)
- Majority of Directors Using AI Without Board-Specific Policies - Corporate Compliance Insights
- PCI DSS v4.0.1 Mandates New Script Monitoring for Payment Pages (2026-06-19, 1 outlet, severity 3/5)
- The Scripts on Your Checkout Page Are Now a PCI DSS Problem - The Hacker News
- White House Memo NSPM-12 Mandates Stronger National Security Cybersecurity Governance (2026-06-16, 1 outlet, severity 3/5)
- White House Issues Memo to Bolster NSS Cybersecurity - SecurityWeek
- UK Government Implements Social Media Access Ban For Children Under 16 (2026-06-16 to 2026-06-17, 2 outlets, severity 2/5)
- UK to ban social media access for children under 16 - The Record from Recorded Future News
- UK to require ID or face scan before you can make social media accounts - BleepingComputer
- EU Cybersecurity Reserve Now Open to Support Ukraine’s Defenses (2026-06-18, 1 outlet, severity 2/5)
- EU grants Ukraine access to cybersecurity reserve for major attacks - The Record from Recorded Future News
- Google to Use EU/UK IP Addresses for Ad Personalization (2026-06-18, 1 outlet, severity 2/5)
- Google to use UK and EU user IP addresses for ad personalization - BleepingComputer
- Cybersecurity and data privacy drive increased litigation exposure for corporate counsel (2026-06-18, 1 outlet, severity 2/5)
- 2026 Board Effectiveness Survey - Corporate Compliance Insights
- 2026 Litigation Trends Survey: Midyear Pulse - Corporate Compliance Insights
- Apple’s New Hide My Email Domain Sparks Privacy Concerns (2026-06-20, 1 outlet, severity 2/5)
- Apple’s Hide My Email tweak leaves privacy fans fuming - GRAHAM CLULEY
- Canadian Laws and Regulations Must Guide Organizational Change Management (2026-06-19, 1 outlet, severity 2/5)
- How Canadian Laws, Regulations Should Inform Change Management Processes - Corporate Compliance Insights
- UK Social Media Ban Sparks Privacy Expert Concerns (2026-06-17, 1 outlet, severity 2/5)
- EU Advances Security Frameworks for Future 6G Network Development (2026-06-18, 1 outlet, severity 2/5)
- EU Gets a Head Start in Developing 6G Network Security - darkreading
- Compliance Officers Should Delete Obsolete Controls to Improve Effectiveness (2026-06-22, 1 outlet, severity 1/5)
- The Most Radical Act a Compliance Officer Can Do? Delete a Pointless Control - Corporate Compliance Insights
Other Cybersecurity
- Nitazenes Surge Across US Amid Growing Fentanyl Crisis (2026-06-18, 1 outlet, severity 3/5)
- TCP/IP Network Design Drives Initial Access More Than Exploits (2026-06-18, 1 outlet, severity 3/5)
- No Exploits Required - SecurityWeek
- CISOs Face Corporate Pressure to Withhold Negative Security News (2026-06-16, 1 outlet, severity 3/5)
- Most CISOs Report Pressure to Bury Bad Security News - darkreading
- AI Adoption and Shadow Risks Drive Shift Toward Fractional CISOs (2026-06-20, 1 outlet, severity 2/5)
- Stressors, AI Forcing Changes to Cybersecurity Teams - darkreading
- Kearney Proposes New Trade Compliance Models for Geopolitical Disruption (2026-06-22, 1 outlet, severity 2/5)
- Redesigning the Trade Compliance Operating Model for an Era of Structural Disruption - Corporate Compliance Insights
- Tenet Security Secures $6 Million Seed Funding to Combat Agentjacking (2026-06-17, 1 outlet, severity 2/5)
- Cybersecurity Professionals Exit Industry as AI Fails to Fill Gaps (2026-06-18, 1 outlet, severity 2/5)
- AI isn’t solving cybersecurity workforce woes - Cybersecurity Dive - Latest News
- Accenture acquires majority stake in Dragos plus runZero and NetRise (2026-06-19, 2 outlets, severity 1/5)
- Isira Adithya: From Childhood Game Hacking to Professional Bug Bounty Hunter (2026-06-17, 1 outlet, severity 1/5)
- Adversarial Exposure Validation Transforms Security Visibility Into Risk Prioritization (2026-06-18, 1 outlet, severity 1/5)
- Malwarebytes Wins AV-TEST Top Product Award for Superior Security (2026-06-17, 1 outlet, severity 1/5)
- Kalshi and StarCompliance Launch New Prediction Market Monitoring Solution (2026-06-19, 1 outlet, severity 1/5)
- GRC News Roundup: Kalshi, StarCompliance, VinciWorks, Deel & More - Corporate Compliance Insights
- OpenAI tests ChatGPT for Science subscription tier for researchers (2026-06-18, 1 outlet, severity 1/5)
- Leak confirms OpenAI is testing a ChatGPT for Science subscription - BleepingComputer
- ISC Stormcast Podcast Features Daily Security Updates for June 18 (2026-06-18, 1 outlet, severity 1/5)
- ISC Stormcast For Thursday, June 18th, 2026 https://isc.sans.edu/podcastdetail/9978, (Thu, Jun 18th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Delivers Daily Cybersecurity Threat Intelligence Updates (2026-06-17, 1 outlet, severity 1/5)
- ISC Stormcast For Wednesday, June 17th, 2026 https://isc.sans.edu/podcastdetail/9976, (Wed, Jun 17th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Podcast Delivers Daily Cybersecurity Updates for June 16 (2026-06-16, 1 outlet, severity 1/5)
- ISC Stormcast For Tuesday, June 16th, 2026 https://isc.sans.edu/podcastdetail/9974, (Tue, Jun 16th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Podcast Covers Cybersecurity Updates for June 22nd (2026-06-22, 1 outlet, severity 1/5)
- ISC Stormcast For Monday, June 22nd, 2026 https://isc.sans.edu/podcastdetail/9980, (Mon, Jun 22nd) - SANS Internet Storm Center, InfoCON: green
- Unregulated Squid Fishing Fleets Threaten Marine Life and Workers (2026-06-20, 1 outlet, severity 1/5)
- Friday Squid Blogging: Victims of Unregulated Squid Fishing - Schneier on Security
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.
- ShinyHunters Breach Exposes 368,000 JCPenney Employee Records via Oracle Vulnerability (2026-06-20)
- Ralph Lauren suffers data breach affecting 139,903 customer accounts (2026-06-19)
- Law Enforcement Disrupts SocGholish Malware Operation Targeting Infected WordPress Websites (2026-06-19)
- CFGI Breach Exposes Over 248,000 User Accounts (2026-06-18)
- 56 Million Accounts Exposed in Massive June 2026 Stealer Log Leak (2026-06-16)