Weekly Review, 2026-06-29
Weekly Review - June 29, 2026
Covers 7 daily digests (2026-06-23 to 2026-06-29).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. Russian-speaking broker targets FortiGate firewalls in FortiBleed credential-harvesting campaign
6 outlets, 2026-06-23 to 2026-06-27 - severity 4/5
A Russian-speaking initial access broker conducted a large-scale credential-harvesting campaign known as FortiBleed, targeting over 430,000 FortiGate firewalls and various other services including Sophos SSL-VPNs and MSSQL servers. The attack chain began with internet-wide scanning, password spraying, and brute-force attacks to gain administrative access to network appliances. Once inside, the actors deployed a custom Golang-based tool called FortigateSniffer to abuse the "diagnose sniffer packet" command, capturing authentication traffic across 24 protocols such as Kerberos, RADIUS, and LDAP. The attackers then used a distributed GPU cluster to perform offline password cracking on extracted configuration files and captured hashes, resulting in the compromise of over 86,600 confirmed credentials across 194 countries and the identification of over 110 million total credentials. The scope of the impact included the targeted exfiltration of DFS backup data from a NATO-aligned defense contractor and widespread targeting of small to medium businesses in the United States and India. Fortinet and CISA responded by advising organizations to upgrade appliances, reset credentials, and implement multi-factor authentication, while researchers identified that the campaign continues to utilize harvested credentials for ongoing access.
Sources
- CISA urges device hardening after thousands of Fortinet credentials compromised - Cybersecurity Dive - Latest News, 2026-06-22 (quality: 19/21)
- FortiBleed campaign used custom FortiGate sniffer to steal credentials - BleepingComputer, 2026-06-22 (quality: 20/21)
- Russian Initial Access Broker Behind FortiBleed Campaign - SecurityWeek, 2026-06-23 (quality: 19/21)
- FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - The Hacker News, 2026-06-23 (quality: 20/21)
- FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading, 2026-06-23 (quality: 12/21)
- Threat Brief: Mitigating Large-Scale Credential Attacks - Unit 42, 2026-06-26 (quality: 15/21)
2. Operation Endgame dismantled Amadey, StealC, and SocGholish malware infrastructure operations
5 outlets, 2026-06-25 - severity 4/5
Europol, Microsoft, and an international coalition of cybersecurity vendors executed Operation Endgame to dismantle the command-and-control infrastructure used by Amadey, StealC, and SocGholish malware operations. The coordinated action disrupted 326 servers and 142 domains, resulting in the recovery of approximately 27 million stolen credentials from over 385,000 compromised systems and the securing of 18,000 infected computers. Investigators identified a vulnerability in a StealC command-and-control panel that allowed for web shell uploads and linked SocGholish activities to the threat actor Evil Corp. The operation also uncovered more than €41 million in cryptocurrency tied to criminal activity and identified nearly 15,000 infected retail websites.
Sources
- Amadey, StealC malware operations disrupted in Operation Endgame action - BleepingComputer, 2026-06-24 (quality: 19/21)
- Three ‘cybercrime as a service’ operations undercut by Microsoft, law enforcement - The Record from Recorded Future News, 2026-06-24 (quality: 19/21)
- Microsoft, Europol lead international takedown against infostealer malware - Cybersecurity Dive - Latest News, 2026-06-24 (quality: 19/21)
- Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - SecurityWeek, 2026-06-24 (quality: 20/21)
- Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - The Hacker News, 2026-06-24 (quality: 14/21)
3. Malicious actors exploited Cisco SD-WAN zero-day to target communications service provider
4 outlets, 2026-06-25 - severity 4/5
Malicious actors exploited a zero-day vulnerability in Cisco SD-WAN software to gain root-level access within a communications service provider's network. The attackers utilized the flaw to compromise systems for approximately two months before the vulnerability was disclosed and patched. Mandiant's investigation into the attack chain revealed that the exploit allowed for the highest level of administrative privileges on affected devices. While the specific identity of the threat actor remains unconfirmed, the breach targeted critical networking infrastructure used by the service provider.
Sources
- Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - BleepingComputer, 2026-06-24 (quality: 20/21)
- Malicious hackers exploit Cisco zero-day for highest access level at communications service provider - CyberScoop, 2026-06-24 (quality: 20/21)
- Cisco SD-WAN Zero-Day Exploited Months Before Patching - SecurityWeek, 2026-06-25 (quality: 19/21)
- Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading, 2026-06-24 (quality: 20/21)
4. Mythos AI model identifies vulnerabilities across classified U.S. government computer systems
1 outlet, 2026-06-24 to 2026-06-29 - severity 5/5
Anthropic’s Mythos AI model identified vulnerabilities across nearly all classified U.S. government computer systems within hours during a testing exercise under Project Glasswing. Conducted in collaboration with the National Security Agency and U.S. Cyber Command, the testing demonstrated the model's ability to identify software flaws and weaponize exploits against highly sensitive infrastructure. In response to these findings and a new executive order regarding AI national security risks, the Trump administration issued a directive restricting foreign national access to the Fable 5 and Mythos 5 models. Anthropic subsequently disabled these specific models for all customers to comply with the federal mandate.
Sources
- Anthropic’s Mythos Model Found Vulnerabilities in Classified US Government Systems, Official Says - SecurityWeek, 2026-06-24 (quality: 18/21)
5. Adversaries target federal agencies with harvest now decrypt later attacks
7 outlets, 2026-06-23 to 2026-06-29 - severity 3/5
President Donald Trump signed Executive Order 14409 in June 2026 to mandate that federal agencies and contractors transition to post-quantum cryptography (PQC) to mitigate "harvest now, decrypt later" attacks. These attacks involve adversaries capturing encrypted data today for decryption once cryptographically relevant quantum computers become available. The order establishes specific deadlines, including a requirement for federal high-value systems to transition key establishment to PQC by December 31, 2030, and digital signatures by December 31, 2031. Key regulatory bodies overseeing this transition include the National Institute of Standards and Technology (NIST), the Office of Management and Budget (OMB), and the Cybersecurity and Infrastructure Security Agency (CISA). While industry players like Google, Cloudflare, and Keeper Security are implementing or researching quantum-resistant algorithms, the transition faces significant challenges regarding cost and technical complexity. The long-term roadmap includes the eventual deprecation of RSA-2048 and ECC P-256 by NIST following the implementation of new standards such as ML-KEM and ML-DSA.
Sources
- Trump executive orders speed up post-quantum migration, boost industry - CyberScoop, 2026-06-22 (quality: 18/21)
- Trump Signs Executive Order Accelerating Post-Quantum Cryptography Migration - SecurityWeek, 2026-06-23 (quality: 19/21)
- The post-quantum EO is an important milestone. Now it’s time to get to work - The Cloudflare Blog, 2026-06-23 (quality: 15/21)
- Trump sets new deadlines for agencies and contractors to adopt post-quantum cryptography - Cybersecurity Dive - Latest News, 2026-06-23 (quality: 19/21)
- Trump directs federal agencies to protect US data from quantum threats - The Record from Recorded Future News, 2026-06-23 (quality: 18/21)
- Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - The Hacker News, 2026-06-23 (quality: 17/21)
- What the post-quantum executive order really demands of CISOs - CyberScoop, 2026-06-29 (quality: 16/21)
- Why Post-Quantum Cryptography Starts With Credentials - The Hacker News, 2026-06-29 (quality: 15/21)
- Meeting Trump's 2030 Quantum Deadline Will be Expensive, Complex - darkreading, 2026-06-26 (quality: 9/21)
6. Icarus executed supply chain attack against Klue using compromised legacy credentials
3 outlets, 2026-06-24 to 2026-06-27 - severity 4/5
The threat actor Icarus executed a supply chain attack against the market intelligence platform Klue by using compromised legacy credentials for an integration service to gain access to its infrastructure. By leveraging this access, the attackers obtained OAuth tokens that allowed them to bypass authentication and access the Salesforce environments of approximately 195 Klue customers. The breach resulted in the bulk exfiltration of CRM and business contact data, including customer names, email addresses, phone numbers, and support case information from organizations such as LastPass, BeyondTrust, and Snyk. In response to the incident, Salesforce disabled the Klue integration on June 17, and Klue engaged with Icarus, which reportedly led the actor to begin deleting some stolen data. The situation evolved when Klue reported that Icarus itself was subsequently hacked by a second threat actor, who is now conducting a separate extortion campaign using samples of the stolen data.
Sources
- LastPass confirms data breach in Klue supply chain attack - BleepingComputer, 2026-06-23 (quality: 16/21)
- BeyondTrust, LastPass Impacted by Klue-Salesforce Incident - SecurityWeek, 2026-06-24 (quality: 19/21)
- Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading, 2026-06-23 (quality: 10/21)
- More Klue Breach Victims Identified as Hackers Get Hacked - SecurityWeek, 2026-06-26 (quality: 15/21)
7. Turla deploys STOCKSTAY backdoor against government and military organizations in Ukraine
3 outlets, 2026-06-26 to 2026-06-27 - severity 4/5
The Russian state-sponsored threat actor Turla, also known as Venomous Bear or Secret Blizzard, has deployed a new .NET backdoor named STOCKSTAY against government and military organizations in Ukraine, as well as entities in Italy, the Netherlands, Poland, and Germany. The attack chain involves phishing emails using academic or diplomatic themes, specifically employing malicious RDP configuration files and RAR archives exploiting CVE-2025-8088 to execute payloads. Once active, the multi-component STOCKSTAY malware—which includes modules for downloading, tunneling, and orchestration—performs system reconnaissance, directory enumeration, screen capture, and registry manipulation via secure WebSocket connections. The malware's disguise has evolved from appearing as a stock market application to masquerading as legitimate software like PDF readers or calculators. This campaign represents the development of a redundant malware ecosystem by Turla, sharing significant code with their existing Kazuar framework to maintain persistent access during espionage operations.
Sources
- Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks - The Hacker News, 2026-06-26 (quality: 20/21)
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets - SecurityWeek, 2026-06-26 (quality: 19/21)
- Turla group adds more malware to Russia’s espionage efforts against Ukraine - The Record from Recorded Future News, 2026-06-26 (quality: 20/21)
8. Gamaredon targets Ukrainian institutions using spear-phishing and WinRAR vulnerability CVE-2025-8088
2 outlets, 2026-06-26 to 2026-06-29 - severity 4/5
The Russian threat actor Gamaredon conducted at least 35 spear-phishing campaigns throughout 2025 targeting Ukrainian governmental and military institutions to exfiltrate sensitive information. The attack chain utilized archive attachments, HTML smuggling, and the WinRAR vulnerability CVE-2025-8088 to deliver HTA downloaders and establish persistence in the Windows Startup folder. To execute payloads and manage command-and-control (C2) infrastructure, the group deployed a suite of specialized tools including PteroSand, PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy, and PteroPaste. Gamaredon further obscured its operations by using legitimate cloud services such as Microsoft, Cloudflare, Amazon S3, Dropbox, and GoFile to hide C2 addresses and host stolen data. During the second half of 2025, the group also provided initial access for Turla's Kazuar exploitation framework.
Sources
- Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses - darkreading, 2026-06-25 (quality: 20/21)
- Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse - The Hacker News, 2026-06-29 (quality: 20/21)
Under the Radar
High-severity stories that received limited coverage this period.
Shai-Hulud uses breached LeoPlatform account to distribute Miasma malware via npm
1 outlet, 2026-06-26 - severity 4/5
The threat actor Shai-Hulud utilized a breached LeoPlatform developer account to distribute Miasma malware through trojanized npm packages and compromised GitHub Actions. The attack chain involved pushing malicious commits to the codfish/semantic-release-action repository and using a "Run Copilot" workflow to capture CI/CD environment secrets, such as GitHub OIDC tokens and Personal Access Tokens, from runner memory. Malicious packages leveraged binding.gyp files to execute a JavaScript loader that installs the Bun runtime for payload execution, while also utilizing a dead-drop infrastructure on GitHub to retrieve the Hades malware variant. The compromise of the Leo/RStreams package set potentially exposes developer workstations, AWS-backed applications, and publishing credentials across various CI/CD systems and repositories.
Why it matters: This is a confirmed supply chain attack exploiting npm and GitHub Actions to steal critical CI/CD credentials and environment secrets.
Sources
- Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack - The Hacker News, 2026-06-26 (quality: 20/21)
Adblock for YouTube Chrome extension vulnerability allows arbitrary JavaScript injection
1 outlet, 2026-06-26 - severity 4/5
Researchers from Palo Alto Networks Unit 42 discovered that the Adblock for YouTube Chrome extension contains a dormant "trusted-create-element" rule capable of arbitrary JavaScript injection via server-side configuration changes. This architectural vulnerability allows an attacker to execute code on any website without requiring an extension update or Chrome Web Store review, provided the URL contains the string "youtube.com" due to a flawed permission check. The extension, which has over 10 million installs, could potentially be used to read web pages, steal sensitive data, or perform unauthorized actions within personal and work accounts. While no malicious payloads have been observed being distributed through this method, the extension's history includes ties to other extensions previously removed from the Chrome Web Store for containing malware.
Why it matters: The extension has 10M+ installs and a server-side mechanism for arbitrary code execution that bypasses origin checks on sensitive sites.
Sources
- Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability - The Hacker News, 2026-06-25 (quality: 20/21)
TA569 compromised WordPress websites using password-spraying attacks during Operation Endgame
1 outlet, 2026-06-24 - severity 4/5
International law enforcement agencies, including the FBI and the National Police Corps of the Netherlands, disrupted the SocGholish malware infrastructure through Operation Endgame, seizing 106 servers and numerous domains. The threat actor TA569 compromised approximately 14,971 WordPress-based websites using password-spraying attacks and leaked credentials to redirect users via traffic distribution systems like Keitaro to malicious JavaScript payloads. This operation remediated thousands of websites and uncovered 1.4 million leaked WordPress credentials used to facilitate initial access for ransomware campaigns and espionage. The disruption targeted the infrastructure used by groups such as Evil Corp to target enterprise environments across the government, healthcare, and banking sectors.
Why it matters: Large-scale law enforcement disruption of a major malware framework used for widespread ransomware access and initial infection.
Sources
- SocGholish Takedown Highlights Malicious TDS Threats - darkreading, 2026-06-23 (quality: 20/21)
Unauthenticated attackers exploit Cordyceps vulnerabilities in GitHub Actions to hijack repositories
1 outlet, 2026-06-24 - severity 4/5
Researcher Novee identified a class of CI/CD vulnerabilities, termed "Cordyceps," within GitHub Actions YAML files that allow unauthenticated attackers to hijack developer workflows and gain control over repositories. The attack chain exploits insecure patterns in automatically generated workflows—often produced by agentic coding tools—where untrusted data crosses trust boundaries to enable command injection, authentication logic errors, artifact poisoning, and privilege escalation. A single scan confirmed 300 fully exploitable repositories among 654 flagged, impacting major software components including Microsoft’s Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and the Python Software Foundation’s Black formatter. Successful exploitation enables attackers to forge approvals, exfiltrate credentials for AWS, GCP, and Netlify, and execute supply chain attacks via malicious packages on NPM, PyPI, Crates.io, Docker/GHCR, and Helm.
Why it matters: Confirmed widespread exploitation of CI/CD workflows enables supply chain compromise and credential theft across major software ecosystems like NPM and PyPI.
Sources
- Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking - SecurityWeek, 2026-06-24 (quality: 20/21)
All Stories by Category
Vulnerabilities & Patches
- SonicWall CVE Exploitation Risks Persist Despite Recent Security Patches (2026-06-23, 1 outlet, severity 4/5)
- CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd) - SANS Internet Storm Center, InfoCON: green
- Texas Parks and Wildlife, ShapedPlugin, and Major Software Vulnerabilities Reported (2026-06-23, 1 outlet, severity 4/5)
- 22nd June – Threat Intelligence Report - Check Point Research
- OpenAI Launches GPT-5.5-Cyber to Automate Software Vulnerability Patching (2026-06-23, 1 outlet, severity 3/5)
- Windows COM Interfaces Leveraged by Threat Actors for Malware Operations (2026-06-25, 1 outlet, severity 3/5)
- Introduction to COM usage by Windows threats - Cisco Talos Blog
- MCP 2026-07-28 Update Introduces New Enterprise Security Risks (2026-06-26, 1 outlet, severity 2/5)
- FIFA World Cup Broadcast Controls Vulnerable to Potential Rickrolling (2026-06-25, 1 outlet, severity 2/5)
- Microsoft Extends Free Windows 10 Security Updates Until October 2027 (2026-06-26, 1 outlet, severity 1/5)
- Microsoft quietly extends free Windows 10 ESU support to October 2027 - BleepingComputer
- Microsoft Announces Upcoming Windows 11 26H2 Update and Upgrade Details (2026-06-23, 1 outlet, severity 1/5)
- Microsoft says Windows 11 26H2 is coming soon, details upgrade process - BleepingComputer
Data Breaches
- Dialog members' personal data exposed in major network hack (2026-06-25, 1 outlet, severity 4/5)
- Texas Parks and Wildlife Breach Exposes 3 Million Texans' Data (2026-06-23, 1 outlet, severity 4/5)
- KDDI Breach Exposes 14.2 Million Email Logins at Six ISPs (2026-06-29, 1 outlet, severity 4/5)
- Data breach exposes up to 14.2 million email logins at six ISPs - BleepingComputer
- World Leaks targets Tata Electronics with sensitive manufacturing data theft (2026-06-24 to 2026-06-27, 2 outlets, severity 3/5)
- Tata Electronics confirms cyberattack as hackers leak data - BleepingComputer
- In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs - SecurityWeek
- Meta pauses MCI program after security review reveals data exposure (2026-06-24, 1 outlet, severity 3/5)
- London Hydro Investigating Data Breach Exposing Customer Account Details (2026-06-23, 1 outlet, severity 3/5)
Ransomware
- Bitsight Report: Ransomware Attacks Surge While Data Breaches Decline (2026-06-25, 1 outlet, severity 3/5)
- Ransomware attacks grew in 2025 as traditional data breaches fell - Cybersecurity Dive - Latest News
- Ufagormolzavod Dairy Company Hit by Disruptive Cyberattack in Russia (2026-06-26, 1 outlet, severity 3/5)
- Another Russian dairy company reportedly disrupted by cyberattack - The Record from Recorded Future News
- Bajaj Auto hit by ransomware attack affecting company operations (2026-06-25, 1 outlet, severity 3/5)
- Indian auto giant Bajaj Auto hit by ransomware incident - The Record from Recorded Future News
- EU Organizations and Supply Chains Become Primary Ransomware Targets (2026-06-25, 1 outlet, severity 3/5)
- Europe Evolves Into Ransomware's Favorite Region - darkreading
- Cal Water Finds No Operational Impact After Handala Cyberattack (2026-06-25, 1 outlet, severity 2/5)
Supply Chain Attacks
- ShapedPlugin WordPress Pro Plugins Compromised in Supply Chain Attack (2026-06-23, 1 outlet, severity 4/5)
- ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack - The Hacker News
- Hackers use supply-chain attack on Polymarket to steal $3 million pUSD (2026-06-26 to 2026-06-27, 2 outlets, severity 3/5)
- $3 Million Reportedly Stolen in Polymarket Hack - SecurityWeek
- Polymarket customers lose $3 million in supply-chain attack - BleepingComputer
- npm and Go Packages Deploy InvisibleFerret via VS Code Tasks (2026-06-29, 1 outlet, severity 3/5)
- New Cybersecurity Threats Targeting Developers and Software Supply Chains (2026-06-24, 1 outlet, severity 3/5)
- EdTech Hackers Target Software Suppliers Instead of Schools (2026-06-26, 1 outlet, severity 3/5)
- AIVEX and SRIL Models Aim to Secure AI Supply Chains (2026-06-25, 1 outlet, severity 2/5)
- OpenClaw Removes Malicious Packages From ClawHub Skills Marketplace (2026-06-25, 1 outlet, severity 2/5)
- More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading
Nation-State / APT
- Russian intelligence services target Signal users with multi-stage phishing campaign (2026-06-27, 3 outlets, severity 4/5)
- FBI: Russian hackers now target Signal backup recovery keys - BleepingComputer
- Russia used social engineering to breach prominent messaging accounts, Ukraine says - The Record from Recorded Future News
- FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys - The Hacker News
- US Offers $10M Bounty for Russian Hackers UNC5792 and UNC4221 (2026-06-29, 1 outlet, severity 4/5)
- The Gentlemen use custom Go backdoors to target critical infrastructure (2026-06-29, 1 outlet, severity 4/5)
- CL-STA-1062 Uses TinyRCT Backdoor to Target Southeast Asian Infrastructure (2026-06-26, 1 outlet, severity 4/5)
- North Korean-aligned threat actors deploy Gaslight macOS malware to steal data (2026-06-25 to 2026-06-26, 2 outlets, severity 3/5)
- New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis - The Hacker News
- New macOS malware embeds fake errors to confuse AI analysis tools - BleepingComputer
- IT Army of Russia targets Ukrposhta in mobile app cyberattack (2026-06-25, 1 outlet, severity 3/5)
- Ukraine's state postal operator reports app disruption after cyberattack - The Record from Recorded Future News
- TinyRCT Backdoor Deployed by Chinese-Speaking APT in Southeast Asia (2026-06-27, 1 outlet, severity 3/5)
- Schellman’s Avani Desai on Countering Non-Financial Geopolitical Threat Actors (2026-06-29, 1 outlet, severity 2/5)
- How Do You Counter a Threat Actor Who Just Wants to Fight? - Corporate Compliance Insights
Malware & Botnets
- KongTuke deploys Mistic RAT and ModeloRAT to target various sectors (2026-06-24 to 2026-06-25, 3 outlets, severity 4/5)
- Stealthy Mistic backdoor linked to ransomware access broker KongTuke - BleepingComputer
- New ‘Mistic’ RAT Opens Door to Several Ransomware Families - SecurityWeek
- New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns - The Hacker News
- StrikeShark deploys SharkLoader to deliver Cobalt Strike Beacon to organizations (2026-06-24 to 2026-06-27, 2 outlets, severity 4/5)
- AryStinger botnet compromises D-Link routers and NAS devices via vulnerabilities (2026-06-23 to 2026-06-29, 1 outlet, severity 3/5)
- Thousands of D-Link routers under control of AryStinger botnet - Malwarebytes
- A week in security (June 22 – June 28) - Malwarebytes
- WhatsApp VBScript campaign installs ManageEngine software to target Windows computers (2026-06-23, 2 outlets, severity 3/5)
- WhatsApp phishing attack uses fake business docs to hack PCs - BleepingComputer
- WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool - The Hacker News
- Check Point Uncovers Global Malware Campaign Targeting Cryptocurrency Users (2026-06-23, 1 outlet, severity 3/5)
- abdrizak npm packages and Google Ads deliver RAT and CastleStealer (2026-06-23, 1 outlet, severity 3/5)
- Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - The Hacker News
- Microsoft Purges 119 Edge Extensions Linked to StegoAd Malware Campaign (2026-06-29, 1 outlet, severity 3/5)
- Edgecution extension uses Native Messaging to deploy Python backdoors (2026-06-25, 1 outlet, severity 3/5)
- Malicious Edge extension abuses Native Messaging as bridge to malware - BleepingComputer
- Terrabot and r00ts3c Botnets Target Vulnerable IoT Network Devices (2026-06-25, 1 outlet, severity 3/5)
- What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th) - SANS Internet Storm Center, InfoCON: green
- STORM malware and cheap stolen identities fuel dark web economy (2026-06-24, 1 outlet, severity 3/5)
- Velvet Ant Malware Uses Linux Process Name Masquerading Techniques (2026-06-24, 1 outlet, severity 2/5)
- Linux Process Name Masquerading, (Wed, Jun 24th) - SANS Internet Storm Center, InfoCON: green
- ZypeerShell PHP Webshell Discovered on GitHub With Obfuscated Features (2026-06-23, 1 outlet, severity 2/5)
- Webshells Remain Popular, (Mon, Jun 22nd) - SANS Internet Storm Center, InfoCON: green
- YARA-X Releases Versions 1.18.0 and 1.19.0 With New Features (2026-06-28, 1 outlet, severity 1/5)
- YARA-X 1.18.0 and 1.19.0 Release, (Sun, Jun 28th) - SANS Internet Storm Center, InfoCON: green
Phishing & Social Engineering
- Abdellah Belmili Operated Marketplaces Selling Phishing Kits Targeting Major Financial Institutions (2026-06-23 to 2026-06-24, 2 outlets, severity 4/5)
- Scattered Spider Uses Social Engineering to Bypass MFA at Corporations (2026-06-25, 1 outlet, severity 4/5)
- Securing the service desk: Why social engineering attacks keep succeeding - BleepingComputer
- Phishing attack against Xsolis, Inc. compromises personal and health information (2026-06-23 to 2026-06-24, 2 outlets, severity 3/5)
- Xsolis Data Breach Affects 1.4 Million Individuals - SecurityWeek
- Healthtech firm Xolis suffers data breach impacting 1.4 million people - BleepingComputer
- Uni-App Framework Powers 200,000 Fraudulent Scam and Phishing Sites (2026-06-27, 1 outlet, severity 3/5)
- Chinese Framework Powers 200,000 Scam Sites - SecurityWeek
- OpenAI organization invites used in "Poisoned Tenant" phishing campaign (2026-06-27, 1 outlet, severity 3/5)
- Cybersecurity firms targeted by fraudulent OpenAI organization invites - BleepingComputer
- TonRAT Node.js Implant Targets Hotels via Photo ZIP Phishing (2026-06-26, 1 outlet, severity 3/5)
- Bluekit Phishing Kit Uses Browser-in-the-Middle to Steal Session Tokens (2026-06-26, 1 outlet, severity 3/5)
- Bluekit phishing kit adopts browser-in-the-middle for login theft - BleepingComputer
- Shop app used for fake receipt callback phishing attacks (2026-06-26, 1 outlet, severity 3/5)
- Order-tracking app Shop abused to push callback phishing attacks - BleepingComputer
- Renovarix fake emails trick website owners into paying scammers (2026-06-25, 1 outlet, severity 2/5)
- Sextortion Scammers Demand Bitcoin Using Fake Webcam Recording Threats (2026-06-24, 1 outlet, severity 2/5)
- GTA 6 Early Access Scams Target Users With Crypto Fraud (2026-06-23, 1 outlet, severity 2/5)
- GTA 6 early access is nothing but a scam - Malwarebytes
- Parcel Expert' Job Offers Used to Recruit Package Mules (2026-06-26, 1 outlet, severity 2/5)
- Malwarebytes Renewal Scams Use Fake Invoices to Steal Banking Details (2026-06-25, 1 outlet, severity 2/5)
- Watch out for renewal scams pretending to be Malwarebytes - Malwarebytes
- Document Delivery Scams Use Fake Legal Threats to Steal Data (2026-06-23, 1 outlet, severity 2/5)
Cloud & Infrastructure Security
- Universal Bucket Hijacking Exploits Cloud Namespace for Data Exfiltration (2026-06-23, 1 outlet, severity 3/5)
- 2026 FIFA World Cup Faces Rising Cyberattack and Infrastructure Threats (2026-06-25, 1 outlet, severity 2/5)
- 2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading
- AWS Launches AWS Continuum and Context to Secure AI Agents (2026-06-26, 1 outlet, severity 1/5)
- AWS unveils agent security, data access tools - Cybersecurity Dive - Latest News
- Richard Bejtlich’s New Guide Advocates for NDR in Modern Security (2026-06-25, 1 outlet, severity 1/5)
- Surviving the Mythos Era: Richard Bejtlich on the Case for NDR - The Hacker News
Identity & Access Management
- Nathan Austad executed a credential stuffing attack against DraftKings accounts (2026-06-25 to 2026-06-26, 2 outlets, severity 3/5)
- DraftKings hacker 'Snoopy' sentenced to 18 months in prison - BleepingComputer
- Minnesota man known as ‘Snoopy’ sentenced in DraftKings hack - CyberScoop
- Google Mandates Android Developer Verification in Four Countries by September (2026-06-23, 1 outlet, severity 3/5)
- Infostealer Data Market Enables Targeted Searches for Stolen Credentials (2026-06-23, 1 outlet, severity 3/5)
- A Glimpse into the “Search Your Target” Market for Stolen Credentials - BleepingComputer
- Malicious Chrome Extension Steals Session Cookies to Bypass MFA (2026-06-27, 1 outlet, severity 3/5)
- NIST Releases New Remote-Access Security Guidance for Water Utilities (2026-06-26, 1 outlet, severity 2/5)
- NIST offers security guidance for water utilities using remote-access tools - Cybersecurity Dive - Latest News
- Cisco Acquires Astrix and WideField to Boost Non-Human Identity Security (2026-06-27, 1 outlet, severity 1/5)
- Philip Martin Named New Chief Information Security Officer at Uber (2026-06-26, 1 outlet, severity 1/5)
AI & Machine Learning Security
- Storm-2460 Uses AI to Weaponize CVE-2025-29824 via RansomEXX Malware (2026-06-24, 1 outlet, severity 4/5)
- The Exploit Doesn't Exist. You Can Still Prove It Works Against You - BleepingComputer
- Frontier AI Models Accelerating Vulnerability Exploitation Targeting Unpatched Software and Legacy Systems (2026-06-23 to 2026-06-24, 3 outlets, severity 3/5)
- Intel agencies: Frontier AI models will reshape cybersecurity faster than expected - CyberScoop
- Looming AI-fueled threats require urgent cybersecurity improvements, Five Eyes members say - Cybersecurity Dive - Latest News
- Five Eyes agencies sound alarm about AI’s threat to cybersecurity - The Record from Recorded Future News
- 0DIN Researchers Show How GitHub Repos Can Infect AI Agents (2026-06-28, 1 outlet, severity 3/5)
- Clean GitHub repo tricks AI coding agents into running malware - BleepingComputer
- AI Agent Traps: New Vulnerabilities Enable Malicious Information Injection (2026-06-25, 1 outlet, severity 3/5)
- Fake AI Skill Bypassed Scanners to Reach 26,000 Agents (2026-06-24, 1 outlet, severity 3/5)
- Kaspersky Report: Fake AI Tools Drive 2026 SMB Cyberattacks (2026-06-25, 1 outlet, severity 3/5)
- AI-Enabled Threat Intelligence Enhances Detection Beyond Traditional IOCs (2026-06-26, 1 outlet, severity 3/5)
- Beyond IOCs: AI-enabled threat intelligence - Cisco Talos Blog
- Akrites aims to prevent adversaries from using AI-driven reverse engineering exploits (2026-06-26 to 2026-06-27, 2 outlets, severity 2/5)
- Linux Foundation Unveils New Open Source Security Project Akrites - SecurityWeek
- Software, AI companies form alliance to tackle open-source security flaws - Cybersecurity Dive - Latest News
- Cobalt Report: Confidence in Autonomous AI Penetration Testing Plummets (2026-06-27, 1 outlet, severity 2/5)
- Agentic AI Risks: Incorrect Context Drives Flawed Autonomous Decisions (2026-06-24, 1 outlet, severity 2/5)
- Guardian Agents: Securing Autonomous AI Identity in Enterprise Environments (2026-06-26, 1 outlet, severity 2/5)
- Guardian Agents: The Next Layer of Identity Governance - The Hacker News
- Agentic AI Automates Social Engineering and Exploit Development in Cyberattacks (2026-06-23, 1 outlet, severity 2/5)
- Agentic AI: The Weapon That No Longer Needs a Warrior - The Hacker News
- OpenAI Debuts GPT-5.6 Sol Model With Enhanced Cyber Protections (2026-06-27, 1 outlet, severity 1/5)
- Nebulock raises $25 million for AI-native contextual security platform expansion (2026-06-27, 2 outlets, severity 1/5)
- Nebulock Raises $25 Million for AI-Native Contextual Security - SecurityWeek
- Kalipso Raises $3.2M Seed Round - Corporate Compliance Insights
- ISC2 Survey: AI Automates Tasks but Preserves Entry-Level Cyber Jobs (2026-06-27, 1 outlet, severity 1/5)
- AI Won't Wipe-Out Entry-Level Cybersecurity Jobs - darkreading
- Runlayer Secures $30 Million for AI Security and Control Platform (2026-06-26, 1 outlet, severity 1/5)
- Runlayer Raises $30 Million in Series A Funding - SecurityWeek
Legal & Law Enforcement
- DOJ Seizes Huione Group Cloud Account Used for Cyber Scams (2026-06-24, 3 outlets, severity 4/5)
- Feds seize alleged cyber-scam infrastructure connected to Southeast Asian company - The Record from Recorded Future News
- Justice Department seizes infrastructure used by cyber scam and criminal marketplace - CyberScoop
- DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - The Hacker News
- Scattered Spider members plead guilty to Transport for London cyberattack (2026-06-24, 3 outlets, severity 4/5)
- Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Krebs on Security
- Scattered Spider members plead guilty to hacking Transport for London - BleepingComputer
- Two Scattered Spider members plead guilty over cyberattack that crippled London transit - The Record from Recorded Future News
- Russian authorities used Cellebrite UFED to access Andrey Pivovarov’s devices (2026-06-25 to 2026-06-26, 3 outlets, severity 3/5)
- Russia used Cellebrite phone-hacking tool to crack down on dissident after firm cut off country - The Record from Recorded Future News
- Russia uses Cellebrite to break into human rights activist’s phone, even after cancellation of contract - CyberScoop
- Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff - The Hacker News
- ACE and DOJ Seize PirloTV Domains to Stop Sports Piracy Networks (2026-06-26 to 2026-06-29, 1 outlet, severity 3/5)
- PirloTV sports piracy network disrupted as 44 domains seized - BleepingComputer
- US seizes hundreds of FIFA World Cup illegal streaming domains - BleepingComputer
- Sanctioned Kinahan Lieutenant Ian Thomas Dixon Spotted Playing Padel in Dubai (2026-06-28, 1 outlet, severity 3/5)
- Cambodian Police Collusion Protects Asian Cybercrime Scam Centers (2026-06-26, 1 outlet, severity 3/5)
- Court Orders Dismantling of Illegal Trump Administration SAVE Database (2026-06-23, 1 outlet, severity 3/5)
- Polish SIM-swapping gang arrested for stealing millions in crypto (2026-06-26, 1 outlet, severity 3/5)
- Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer
- DHS Chief Announces Plans to Hire 600 New CISA Staff (2026-06-26, 1 outlet, severity 2/5)
- DHS chief says president has met with potential CISA nominee; agency plans to hire 600 - The Record from Recorded Future News
- BarkerGilmore Survey Shows Rising Compensation for Chief Compliance Officers (2026-06-26, 1 outlet, severity 2/5)
- CCO Compensation on the Rise - Corporate Compliance Insights
- INTERPOL and Europol Renew Pact to Combat Global Cybercrime (2026-06-23, 1 outlet, severity 2/5)
- INTERPOL, Europol renew agreement to combat hackers and other criminals - Cybersecurity Dive - Latest News
Policy & Regulation
- FCC Implements New Regulations Against Salt Typhoon Threats to EAS Infrastructure (2026-06-26 to 2026-06-27, 3 outlets, severity 3/5)
- FCC votes to toughen rules in bid to better protect undersea cables - The Record from Recorded Future News
- FCC passes new cybersecurity rules for emergency systems, undersea cables - CyberScoop
- FCC requires emergency alert distributors to secure their systems - Cybersecurity Dive - Latest News
- ATF Cancels Penlink Webloc Contract Following Congressional Scrutiny (2026-06-27, 1 outlet, severity 3/5)
- Trump administration restricts OpenAI and Anthropic AI model releases (2026-06-29, 1 outlet, severity 3/5)
- Cyber Insurers Demand Strict Security Controls to Mitigate Systemic Risk (2026-06-26, 1 outlet, severity 3/5)
- As cyber risk evolves, the insurance industry tightens guardrails - Cybersecurity Dive - Latest News
- House Leaders Unveil Compromise Kids Online Safety Bill Without Duty-of-Care (2026-06-24, 1 outlet, severity 3/5)
- Compromise kids online safety bill unveiled by House leaders, with key omission - The Record from Recorded Future News
- Trump administration executive order targets state voter lists and mail-in ballots (2026-06-26, 2 outlets, severity 2/5)
- Federal court rules Trump election-focused executive order illegal - CyberScoop
- New DEI Rule Puts Federal Contractors on the Compliance Clock - Corporate Compliance Insights
- White House Cybersecurity Pilot Program Lacks State Agency Engagement (2026-06-25, 1 outlet, severity 2/5)
- White House’s state infrastructure cybersecurity initiative stalled - Cybersecurity Dive - Latest News
- NIST Seeks Public Input on Updated IoT Security Guidelines (2026-06-25, 1 outlet, severity 2/5)
- NIST Opens Updated IoT Security Guidance to Public Review - SecurityWeek
- Florida’s E-Verify Mandate: Compliance Risks and Tax Penalty Realities (2026-06-25, 1 outlet, severity 2/5)
- Navigating Florida’s E-Verify Mandate: Compliance, Tax Certification & Audit Realities - Corporate Compliance Insights
- Google Updates Privacy Controls for Search and Google Play (2026-06-25, 1 outlet, severity 1/5)
- Google releases new privacy controls for activity history, personalization - BleepingComputer
- Robert Hansen Proposes Formal Code of Ethics for CISOs (2026-06-25, 1 outlet, severity 1/5)
- Do CISOs Need a Code of Ethics? - darkreading
- Kroll’s Emanuel Batista Advocates for Systems-Based Corporate Governance Models (2026-06-29, 1 outlet, severity 1/5)
- From the Pitch to the Boardroom: Building a Championship-Level Compliance & Governance System - Corporate Compliance Insights
- Anecdotes Agent Studio: Automating GRC Workflows with Agentic AI (2026-06-27, 1 outlet, severity 1/5)
- Your First GRC Agent: A Red Teamer's Walkthrough - BleepingComputer
- Bitdefender, EQS, and Oversight Announce New GRC Technology Updates (2026-06-26, 1 outlet, severity 1/5)
- GRC News Roundup: Bitdefender, Traliant, Darktrace, Casepoint & More - Corporate Compliance Insights
Other Cybersecurity
- Brazil's Emergency Alert System Targeted in Suspected Cyberattack (2026-06-23, 1 outlet, severity 4/5)
- Suspected cyberattack triggers false emergency alerts across parts of Brazil - The Record from Recorded Future News
- Open-Source Security Risks Grow Amid Declining Government Support (2026-06-24, 1 outlet, severity 3/5)
- Apple Removes VK Apps, Sparking Russian Accusations of Political Censorship (2026-06-27, 1 outlet, severity 3/5)
- Russia accuses Apple of ‘political censorship’ after VK apps removed from App Store - The Record from Recorded Future News
- Managing Corporate Risks From Kalshi and Polymarket Prediction Markets (2026-06-25, 1 outlet, severity 3/5)
- Congratulations, You Have a Prediction Market Policy; Now What? - Corporate Compliance Insights
- JaredFromSubway MEV Bot Loses $15 Million in Exploitation Hack (2026-06-23, 1 outlet, severity 3/5)
- JaredFromSubway MEV bot hacked in $15 million crypto theft - BleepingComputer
- ABLE Project Advocates Bystander Training Over Simple Reporting Hotlines (2026-06-23, 1 outlet, severity 2/5)
- ‘Why Didn’t Anyone Do Anything?’ Teaching Employees to Step In, Not Just Speak Up - Corporate Compliance Insights
- Deutsche Bahn restores rail services after GSM-R network failure (2026-06-25, 1 outlet, severity 2/5)
- German rail services resume after wireless communications outage - The Record from Recorded Future News
- Bellingcat Uses Machine Learning to Detect Civilian Harm on Telegram (2026-06-26, 1 outlet, severity 2/5)
- How to Use AI to Help Find Civilian Harm - bellingcat
- Automating Host Reconnaissance Using Favicon MurmurHash3 and Shodan API (2026-06-29, 1 outlet, severity 2/5)
- Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) - SANS Internet Storm Center, InfoCON: green
- White Law Group Outlines Five Ways to Prevent Mis-Selling (2026-06-26, 1 outlet, severity 2/5)
- Root Causes of Mis-Selling: 5 Control Failures & How to Remediate Them - Corporate Compliance Insights
- Four-Level Framework Enhances Fraud Prevention Across Transaction and Network Layers (2026-06-26, 1 outlet, severity 2/5)
- The Four Elevations of Effective Fraud Prevention - BleepingComputer
- Jaqueline Oliveira-Cella Proposes Behavioral Metrics for Corporate Performance Reviews (2026-06-23, 1 outlet, severity 1/5)
- Put Behavior on the Scorecard - Corporate Compliance Insights
- OpenAI Launches Patch the Planet Initiative to Secure Open Source (2026-06-23, 1 outlet, severity 1/5)
- HICX Secures £15M Funding From HSBC and Wavecrest Growth Partners (2026-06-27, 1 outlet, severity 1/5)
- HICX Secures £15M Funding Package From HSBC, Wavecrest - Corporate Compliance Insights
- Norton Rose Fulbright Report Shows Rising Global M&A Sentiment (2026-06-27, 1 outlet, severity 1/5)
- 2026 Global M&A Trends - Corporate Compliance Insights
- ZRG Acquires Fortium to Expand Interim Technology Leadership Services (2026-06-27, 1 outlet, severity 1/5)
- ZRG Acquires Technology Leadership Firm Fortium - Corporate Compliance Insights
- Dark Reading Requests Human-Written Content Amid Submission Backlog (2026-06-27, 1 outlet, severity 1/5)
- Anthropic Tests Claude Cowork Mobile Support for Remote Task Management (2026-06-26, 1 outlet, severity 1/5)
- Anthropic is testing desktop-like Claude Cowork for mobile - BleepingComputer
- ISC Stormcast Delivers Daily Cybersecurity Trends and Threat Intelligence (2026-06-29, 1 outlet, severity 1/5)
- ISC Stormcast For Monday, June 29th, 2026 https://isc.sans.edu/podcastdetail/9986, (Mon, Jun 29th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Podcast Delivers Daily Cybersecurity Threat Intelligence Updates (2026-06-24, 1 outlet, severity 1/5)
- ISC Stormcast For Wednesday, June 24th, 2026 https://isc.sans.edu/podcastdetail/9984, (Wed, Jun 24th) - SANS Internet Storm Center, InfoCON: green
- Home Cinema Expansion Plans Drive New Audiovisual Tech Interest (2026-06-24, 1 outlet, severity 1/5)
- Weekly Update 509 - Troy Hunt
- ISC Stormcast Podcast Update for June 23, 2026 (2026-06-23, 1 outlet, severity 1/5)
- ISC Stormcast For Tuesday, June 23rd, 2026 https://isc.sans.edu/podcastdetail/9982, (Tue, Jun 23rd) - SANS Internet Storm Center, InfoCON: green
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.