Rankteo Cyber Security Incidents

Tata Group and Apple: Apple Strengthens Cooperation with Tata Following Cyber-Attack on Supplier

Rankiteo.com — Sun, 28 Jun 2026 00:00:00 +0000

Apple and Tata Group Respond to Cyberattack on Supply Chain Partner California-based Apple is deepening its collaboration with India’s Tata Group after a cyberattack on a Tata subsidiary exposed sensitive internal files. The breach, which targeted a company within Apple’s supply chain, prompted immediate investigations by cybersecurity teams to assess the scope of compromised data. Apple is working closely with Tata Group and authorities to contain the incident, though no disruptions to manufacturing or shipping operations have been reported. The attack underscores growing cybersecurity risks in global supply chains, particularly as Apple expands its production footprint in India. The partnership between Apple and Tata covering device assembly, manufacturing, and after-sales services is a cornerstone of Apple’s strategy to diversify its supply chain beyond traditional hubs. The incident highlights the need for heightened security measures as the company scales operations in new markets.

PayPal, Shopify, McAfee, Norton and Apple: Scammers Abuse Shopify to Send Fake Invoices and Steal Credentials via Fake Support Calls

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Scammers Exploit Shopify’s Shop App to Deliver Fake Invoices in Phishing Scheme Security researchers Luis Corrons and Jakub Vavra from Gen have uncovered a rising trend of scammers abusing Shopify’s Shop order-tracking app to distribute fraudulent invoices directly within users’ purchase histories. Unlike traditional email phishing, this tactic leverages in-app social engineering, exploiting trust in a platform typically used for legitimate order tracking. The scam involves fake receipts appearing in the Shop app, impersonating well-known brands such as Norton, McAfee, Apple, and PayPal. These fraudulent entries often labeled under generic seller names like “My Store” feature high-value items like antivirus subscriptions, smartphones, or gift cards to create urgency. Attackers embed fake support phone numbers in unusual fields, such as product descriptions or shipping addresses, where legitimate receipts would never include them. When victims call the listed number, the attack escalates into voice phishing (vishing), with scammers posing as customer support to extract sensitive data including login credentials, payment details, or one-time passcodes. Some victims are also tricked into installing remote access software, granting attackers control over their devices. The Shop app aggregates order data from sources like Gmail, Outlook, and Shop Pay, automatically scanning connected email accounts for shipping-related keywords. While the exact method of injecting fake orders remains unclear, potential vectors include email parsing manipulation, merchant workflow abuse, or loosely validated input fields. Importantly, there is no evidence of a breach in Shopify, the Shop app, or the impersonated brands this is an abuse of legitimate platform features rather than a direct compromise. This campaign reflects a broader shift in phishing tactics, where attackers exploit contextual trust in familiar digital environments. Similar schemes have been observed in calendar invite scams and collaboration platform abuse, where the delivery channel itself lends credibility to the scam. The emergence of in-app invoice fraud highlights the growing challenge for cybersecurity defenses, as malicious content becomes harder to detect when embedded within trusted ecosystems.

Qualcomm and Tata Electronics: Tata Electronics Tightens Systems After Major Data Breach

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Tata Electronics Restricts Access After Ransomware Group Leaks 200,000 Files Tata Electronics, a critical supplier to Apple and other major tech firms, has tightened internal security protocols following a ransomware attack that exposed over 200,000 sensitive files. The breach, attributed to the group World Leaks, included proprietary data belonging to global clients such as Apple, Tesla, TSMC, and Qualcomm. In response, the company has launched a forensic audit with a global cybersecurity consultant and notified affected clients and government authorities. While operations remain unaffected, Tata Electronics has restricted remote access to key systems, including purchase order management tools, limiting permissions to a select group of employees. The incident poses significant reputational and operational risks, particularly as Tata Electronics plays a pivotal role in India’s push to become a global electronics manufacturing hub. Apple’s security team is reportedly collaborating on remediation efforts, given the company’s importance in Apple’s strategy to diversify production outside China. This breach highlights the cybersecurity challenges faced by rapidly expanding high-tech manufacturers. Past incidents within the Tata Group have underscored the difficulties of securing large-scale operations, with potential delays or client concerns threatening long-term growth plans in the semiconductor and electronics sectors. Investors are closely monitoring the forensic audit’s findings, client responses, and any impact on production timelines or security spending. Regulatory compliance and the stability of key partnerships will be critical in assessing Tata Electronics’ recovery from the incident.

Amazon: Amazon Q VS Code Flaw Lets Malicious Repositories Steal Cloud Credentials

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Critical Amazon Q Developer Flaws Exposed Cloud Credentials to Remote Attacks Security researchers uncovered two high-severity vulnerabilities in the Amazon Q Developer Extension for Visual Studio Code (VS Code), allowing attackers to execute arbitrary code and steal cloud credentials without user interaction. The flaws, tracked as CVE-2026-12957 and CVE-2026-12958, were patched in Language Servers for AWS version 1.69.0 and corresponding IDE plugins. The vulnerabilities stemmed from Amazon Q’s automatic loading of MCP (Model Context Protocol) server configurations from `.amazonq/mcp.json` files in workspace directories without user consent, trust verification, or warnings. MCP servers, designed to extend AI assistants’ capabilities, could interact with databases, APIs, and system resources. However, the extension’s auto-execution of untrusted configurations violated security boundaries, enabling attackers to inherit the victim’s environment, including AWS credentials, CLI tokens, API keys, and SSH agent sockets. Exploitation required only a malicious `.amazonq/mcp.json` file embedded in a repository. When a developer opened the folder in VS Code with Amazon Q active, the extension silently executed the payload. In a proof-of-concept by Wiz, the attack exfiltrated AWS session data to an attacker-controlled server using a single bash command (`aws sts get-caller-identity`). Further risks included IAM backdooring, cloud persistence, and lateral movement via inherited VPN contexts. Delivery vectors mirrored known threat tactics, such as typosquatted packages, malicious pull requests, compromised dependencies, and fake coding tests a method previously linked to DPRK threat actors. ### Affected Versions & Timeline - CVE-2026-12957: Improper trust boundary enforcement; auto-executes commands from untrusted config files. - CVE-2026-12958: Missing symlink validation; allows malicious symlinks to bypass workspace trust. Vulnerable Products & Versions: - Language Servers for AWS (< 1.69.0) - Amazon Q Developer for VS Code (< 2.20) - Amazon Q Developer for JetBrains (< 4.3) - Amazon Q Developer for Eclipse (< 2.7.4) - AWS Toolkit with Amazon Q for Visual Studio (< 1.94.0.0) Discovery & Disclosure: - April 17, 2026: Wiz researcher Maor Dokhanian identified the flaw. - April 20, 2026: Reported to Amazon Security; acknowledged same day. - May 12, 2026: Initial fix deployed via language server update. - June 23, 2026: CVEs assigned. - June 26, 2026: Public disclosure. Amazon fully remediated the issues, with updates automatically applied in most configurations. The disclosure coincided with similar MCP auto-execution flaws in Claude Code, Cursor, and Windsurf, highlighting broader industry risks in AI-assisted development environments.

AKAOLIFE, Tchap and France Travail: Hackers Claim French Employment Leak Exposes Over 1M Records, Health Data

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Massive Data Leak Exposes Over 1 Million French Employment Records Hackers operating under the aliases misere and ChimeraZ claim to have stolen more than 1 million sensitive records from France Travail’s employment-related applications, including HR, mobility, and workplace health systems. The breach, linked to platforms AKAOLIFE and FILDIRECT-RH, involves nearly 60GB of data across 39 databases and over 10,000 source files. The leaked data includes: - 966,816 HR files and 1,003,047 professional mobility records - 38,138 workplace health monitoring files and 3,747 disability-related documents - 26,684 accounts with plaintext passwords, alongside application code, security keys, and Windows login credentials Exposed details extend beyond basic contact information, revealing French social security numbers, employee IDs, job histories, internal mobility requests, and recruiter comments enough to craft highly convincing phishing scams. The breach also raises concerns about further system exploitation due to exposed configuration files. Both hackers have been active in recent incidents: ChimeraZ was linked to a breach at optical retailer Krys, while misere was tied to a leak of 650,000 messages from France’s Tchap secure messaging platform. The primary risk for affected workers is impersonation, with attackers potentially posing as HR, recruiters, or public service officials to extract sensitive documents or credentials. The inclusion of plaintext passwords compounds the threat, particularly for those who reuse passwords across services.

Challenge Manufacturing: Challenge Manufacturing Data Breach Exposes Social Security Numbers

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Challenge Manufacturing Data Breach Exposes Sensitive Information of 1,661 Texas Residents On May 17, 2026, the ransomware group Chaos announced on the dark web via the Tor network that it had stolen 270 gigabytes of data from Challenge Manufacturing (formerly Challenge Mfg. Company LLC). The group threatened to publish the stolen data within three days. The breach exposed names, Social Security numbers, and medical information of affected individuals. While the exact timeline of the attack remains unclear including when the intrusion began or when Challenge Manufacturing detected it the company reported the incident to the Texas Attorney General on June 26, 2026. So far, 1,661 Texas residents have been confirmed as impacted, though the total number of affected individuals across the U.S. has not been disclosed. In response, Challenge Manufacturing is notifying affected individuals via U.S. Mail, providing details about the breach and potential protective measures. The company has not publicly shared further specifics on the duration of the attackers' access or additional response efforts.

Microsoft: New Bluekit Phishing-as-a-Service Bypasses MFA to Steal Microsoft Login Credentials

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Bluekit Phishing-as-a-Service Platform Bypasses MFA with Browser-in-the-Middle Technique Cybersecurity firm Netcraft has identified a fully operational Phishing-as-a-Service (PhaaS) platform called Bluekit, which has rapidly scaled its operations, with approximately 70 live hostnames detected in a single week. Originally documented by Varonis Threat Labs as an emerging tool, Bluekit has evolved into a sophisticated threat capable of bypassing multi-factor authentication (MFA) and harvesting Microsoft login credentials in real time. Unlike traditional adversary-in-the-middle (AitM) tools like Evilginx, which intercept traffic between victims and legitimate sites, Bluekit employs a Browser-in-the-Middle (BitM) technique. The platform loads the real Microsoft login page inside an attacker-controlled browser and streams it to victims using rrweb, an open-source JavaScript library for session replay. Victims interact with the authentic login page, but their actions execute in the attacker’s browser, granting threat actors a fully authenticated session. ### Attack Architecture & Evasion Tactics Bluekit operates in two phases before capturing credentials: 1. Victim Qualification – Before displaying phishing content, the platform conducts layered anti-analysis checks, including: - Randomized CSS filters to defeat pixel-hash detection. - Custom CAPTCHAs impersonating brands like Cloudflare. - Obfuscated JavaScript bundles (exceeding 1MB) that rotate periodically. - Browser fingerprinting (RAM, CPU, screen resolution, headless browser detection). - WebRTC-based IP mismatch detection to identify security analysts. 2. BitM Delivery – Qualified victims receive a live DOM stream of the Microsoft login page via WebSocket, rendering a pixel-perfect, interactive interface. Keystrokes and mouse movements are relayed to the attacker’s browser, which executes them against the real Microsoft site. The attacker’s administration panel provides real-time visibility into victim sessions, including post-authentication activity. ### Why Bluekit Evades Detection A key advantage over tools like Evilginx is session consistency the stolen session is created and used in the same browser, eliminating fingerprint mismatches that detection systems might flag. Traditional MFA (SMS, authenticator apps, push approvals) offers no protection, as victims complete the entire login flow including MFA verification inside the attacker’s browser. ### Detection & Defense Considerations Security teams should monitor for: - WebSocket connections transmitting encrypted/binary data on login pages. - Proxy API endpoints handling asset fetching instead of direct requests. - rrweb library presence outside known analytics contexts. - Custom CAPTCHAs with randomized HTML structures. - Large, obfuscated JavaScript bundles (over 1MB) with periodic rotation. - WebRTC IP mismatch detection on landing pages. Bluekit’s abuse of rrweb, a legitimate open-source tool, follows a growing trend of threat actors exploiting trusted developer infrastructure to bypass security controls. While rrweb’s presence alone is not an indicator of compromise, its use in this context underscores the need for session-level protections and behavioral detection in phishing defense strategies.

Amazon: Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Critical Amazon Q Developer Vulnerabilities Exposed: Arbitrary Code Execution and Credential Theft Risks Security researchers at Wiz Research disclosed two high-severity vulnerabilities in Amazon Q Developer, the AI-powered coding assistant for Visual Studio Code (VS Code), JetBrains, Eclipse, and Visual Studio. Tracked as CVE-2026-12957 and CVE-2026-12958, the flaws enabled arbitrary code execution and cloud credential theft when developers opened malicious repositories without user interaction or warnings. ### Root Cause & Exploitation The vulnerabilities stemmed from Amazon Q’s automatic execution of MCP (Model Context Protocol) server configurations from `.amazonq/mcp.json` files in untrusted workspaces. Since spawned processes inherited the developer’s full environment, attackers could access: - AWS credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`) - Cloud CLI authentication tokens - API keys and secrets - SSH agent sockets A proof-of-concept demonstrated that a single malicious `.amazonq/mcp.json` file could exfiltrate AWS session credentials to an attacker-controlled server no clicks, prompts, or warnings required. ### Assigned CVEs & Affected Versions - CVE-2026-12957: Improper trust boundary enforcement MCP configs executed without consent. - CVE-2026-12958: Missing symlink validation, enabling path traversal outside workspace boundaries. Affected products and versions: - Language Servers for AWS < 1.69.0 - Amazon Q Developer for VS Code < 2.20 - Amazon Q Developer for JetBrains < 4.3 - Amazon Q Developer for Eclipse < 2.7.4 - AWS Toolkit with Amazon Q for Visual Studio < 1.94.0.0 ### Attack Vectors Researchers highlighted targeted exploitation methods, including: - Malicious pull requests in popular open-source repositories - Typosquatted packages embedding hidden `.amazonq/` configurations - Fake job interview coding tests (a tactic previously used by DPRK-linked threat actors) ### Patch & Disclosure Timeline - April 20, 2026: Vulnerability discovered by Maor Dokhanian (Wiz Research) and responsibly disclosed to Amazon. - May 12, 2026: Amazon deployed an initial fix in Language Servers for AWS 1.69.0. - June 26, 2026: Full public disclosure via Security Bulletin 2026-047-AWS. The patch is automatically applied for most users upon IDE reload. No further action is required for those on updated versions. ### Broader Industry Risk This vulnerability reflects a systemic issue in AI-powered coding tools. Similar flaws have been identified in: - Claude Code (CVE-2025-59536, CVE-2026-21852 – Check Point Research) - Windsurf (CVE-2026-30615 – OX Security) All stem from auto-execution risks in untrusted configurations, underscoring the need for coordinated industry mitigation.

Third-party software provider: France Statistics Department Insee Reports Cyberattack on Staff Data

Rankiteo.com — Fri, 26 Jun 2026 00:00:00 +0000

Cyberattack Targets Major Financial Institutions in Coordinated Ransomware Strike A sophisticated ransomware attack has disrupted operations at multiple global financial institutions, marking one of the most significant cybersecurity incidents in the sector this year. The attack, detected earlier this week, targeted banks, insurance firms, and fintech companies across North America and Europe, exploiting vulnerabilities in third-party software widely used for financial transactions. Security researchers attribute the breach to a well-known ransomware group, which deployed encrypted payloads to lock critical systems and exfiltrate sensitive data. Early reports indicate that the attackers demanded multi-million-dollar ransoms in cryptocurrency, though no payments have been publicly confirmed. Affected organizations have activated incident response protocols, with some temporarily suspending online services to contain the damage. The attack underscores the growing threat of supply chain vulnerabilities in the financial sector, as cybercriminals increasingly target interconnected software providers to maximize impact. Regulatory bodies in the U.S. and EU have issued alerts, urging institutions to review third-party risk management practices. While the full extent of the breach remains under investigation, initial assessments suggest potential exposure of customer data, though no large-scale leaks have been reported. The incident follows a recent surge in ransomware attacks against financial services, with attackers leveraging double-extortion tactics threatening to publish stolen data if demands are not met. Industry analysts warn that the financial sector remains a prime target due to its high-value data and reliance on legacy systems. Recovery efforts are ongoing, with affected firms collaborating with cybersecurity firms to restore operations and mitigate further risks.

Polymarket and Third-party service provider: Polymarket Platform Hit by Cyberattack: Hackers Steal User Funds

Rankiteo.com — Thu, 25 Jun 2026 19:59:34 +0000

Polymarket Hit by $3M Cyberattack Following Third-Party Security Flaw Polymarket, the world’s largest prediction market, confirmed a cyberattack that resulted in the theft of approximately $3 million in cryptocurrency. The breach stemmed from a security vulnerability in a third-party service provider, which allowed attackers to inject malicious scripts into the platform’s code. The incident, first reported by TechCrunch, targeted a specific segment of users rather than the entire user base. Blockchain security firm PeckShield and independent analysts revealed that the attack employed a phishing campaign, tricking users into approving fake transactions that drained funds from their wallets. At least 11 major investors were affected, with stolen assets transferred to hacker-controlled addresses. Polymarket has since regained control of the situation, pledging to fully refund all lost funds and directly contacting impacted users. The breach compounds recent reputational damage for Polymarket, which faced scrutiny earlier this week over deceptive marketing practices. Investigations uncovered that the platform paid social media influencers to promote fake winning videos, misleading users into believing they could replicate such gains. In response, Polymarket committed to an audit of its advertising content, though the cyberattack has further eroded trust in its security and ethical standards. As prediction markets gain traction ahead of high-profile events, the incident underscores the risks of third-party dependencies and the need for heightened vigilance in cryptocurrency transactions.

Microsoft and Europol: Europol, Microsoft Hit Malware Network Behind 27M Stolen Logins, 140,000 Infected Computers

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Global Malware Network Disrupted in Operation Endgame Europol, Microsoft, and international law enforcement partners have dismantled a vast malware network responsible for stealing 27 million login credentials and infecting over 140,000 computers worldwide. The operation, part of Operation Endgame, targeted cybercrime infrastructure used to deploy ransomware and other large-scale attacks. Authorities seized 326 servers and 142 domains linked to the malware distribution network, while freezing €41 million ($47 million) in suspected criminal crypto assets. The effort involved coordination with Eurojust, Microsoft, and agencies from Germany, the Netherlands, Denmark, the UK, Canada, and the US. The malware tools disrupted included: - SocGholish/FakeUpdates: Spread via fake browser or software updates on compromised websites. - Amadey: Provided initial access to systems, enabling further malware installation. - StealC: Extracted passwords, digital identities, and other sensitive data from infected devices. Microsoft’s Digital Crimes Unit used AI to uncover connections between Amadey and StealC, which were operated by separate groups but shared infrastructure. This allowed the company to dismantle 200 command-and-control servers and free 18,000 victim computers from criminal control. Europol also remediated 14,971 infected websites, including those of small businesses like restaurants and auto repair shops. While the takedown disrupted the network, stolen credentials may still pose risks, as they can be exploited long after the initial breach. The operation highlights the global reach of cybercrime, with infrastructure spanning multiple countries to evade detection.

KongTuke: Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

New Self-Destructing Backdoor "Mistic" Linked to Ransomware Access Brokers Security researchers have identified a novel self-destructing backdoor, dubbed Mistic (also tracked as MLTBackdoor), deployed in cyber intrusions since April. The malware is suspected to be tied to KongTuke (aka Woodgnat), a financially motivated initial access broker (IAB) that compromises corporate networks and sells access to ransomware groups. According to Zscaler, Symantec, and Carbon Black, Mistic has been used to breach organizations across insurance, education, IT, and professional services. The backdoor is designed for stealthy lateral movement, enabling attackers to maintain persistence while evading detection. Mistic’s functionality includes file manipulation (upload, download, delete, rename), folder creation, and in-memory execution of remote payloads avoiding disk-based detection. Once its objectives are complete, the malware self-terminates and deletes itself, further reducing forensic traces. Researchers found low-confidence links between Mistic and ModeloRAT, a Python-based remote access trojan (RAT) also developed by KongTuke. Previous attacks involving ModeloRAT have been connected to ransomware operations by groups like Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. In one observed attack, Mistic was side-loaded via a legitimate executable (MpExtMs.exe) and a malicious DLL (EndpointDlp.dll), blending into normal system processes. Zscaler also noted its delivery through the ClickFix infection chain, a technique previously associated with KongTuke. The backdoor’s in-memory execution and self-destruct mechanism make it particularly difficult to detect, allowing attackers to maintain long-term access while minimizing exposure. Its use in ransomware-linked intrusions underscores the growing threat posed by IABs in the cybercriminal ecosystem.

Klue: Klue Hit by Double Extortion as Second Hacker Group Emerges

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Klue Faces Unprecedented Dual Extortion Attack After Data Breach Vancouver-based market intelligence platform Klue has disclosed a rare and escalating cybersecurity crisis, involving two criminal groups with conflicting extortion demands following a data breach. The incident, first reported by TechCrunch, marks an unusual case of competing threats targeting the same victim highlighting evolving tactics in cyber extortion. The breach initially involved a hacking group that stole sensitive customer data, including proprietary market research, competitive analysis, and strategic planning materials used by enterprise clients to track rivals. In a surprising turn, the original attackers later claimed they were deleting the stolen files, though Klue’s customers were warned not to assume the threat had passed. Before any relief could set in, a second criminal group emerged, demanding ransom for the same compromised data. The situation leaves Klue’s enterprise clients including sales and marketing teams at major corporations in limbo, uncertain whether their highly sensitive business intelligence has been destroyed, leaked, or is now in the hands of multiple threat actors. The competitive intelligence sector handles particularly valuable data, such as go-to-market strategies and product roadmaps, which could cause significant damage if exposed. Security researchers note that while secondary markets for stolen data are not new, the simultaneous, opposing claims from two criminal groups are highly unusual. The first group’s alleged data deletion could be a face-saving exit or genuine reversal, while the second group’s demands suggest they either independently accessed Klue’s systems or acquired the data from the original attackers. Klue has not disclosed technical details of the breach, the scope of compromised data, or the number of affected customers. The incident underscores the cascading risks of B2B SaaS breaches, where third-party vendors handling critical business intelligence become high-value targets. It also arrives amid growing enterprise concerns over vendor security postures, following high-profile breaches at platforms like Okta and LastPass.

SendGrid, Nimbu and Amazon Web Services: AiTM Phishing Kits Steal Console Credentials and MFA Codes from AWS Environments

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

New AiTM Phishing Kit Targets AWS Users in Real-Time Credential Theft A sophisticated phishing campaign targeting Amazon Web Services (AWS) users emerged between June 19 and 23, 2026, leveraging an adversary-in-the-middle (AiTM) technique to steal login credentials and multi-factor authentication (MFA) codes in real time. Unlike traditional phishing tools that capture data for later use, this kit intercepts and relays credentials instantly, allowing attackers to access victims’ AWS consoles before they detect the breach rendering MFA protections ineffective. Researchers at Datadog Security Labs uncovered the operation, identifying three phishing domains registered within a 24-hour window via NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on Cloudflare. The domains served near-identical clones of the AWS login page, designed to evade detection. Attackers distributed phishing emails through trusted platforms like SendGrid and Nimbu, bypassing email authentication filters. The messages impersonated AWS Support, citing a fabricated "bandwidth throttling" issue to create urgency and prompt quick clicks. The campaign stood out for its precision targeting: the phishing kit only displayed the fake login page for pre-verified email addresses, with fewer than 50 victims identified primarily software engineers and engineering leaders in the U.S. The attack relied on a JavaScript-based relay embedded in the phishing page, which validated victims against an encrypted URL parameter before rendering the login form. This mechanism also blocked security sandboxes from analyzing the page’s behavior. Once credentials were entered, the kit forwarded them to the attacker’s server, which relayed them to the legitimate AWS site in real time. The server dynamically determined the MFA challenge type (SMS, email, or TOTP) by interacting with AWS, then captured and replayed the victim’s session before it expired. This live relay distinguishes AiTM attacks from conventional phishing, significantly increasing their success rate. The investigation revealed ties to a broader phishing operation, with three additional domains impersonating SendGrid registered through the same registrar. The kit’s infrastructure including a React-based app structure, encrypted email gating, and MFA support matched earlier campaigns dating back to July 2023, including attacks on cryptocurrency wallets and Salesforce logins. A shared input_24 URL parameter served as a fingerprint linking these incidents to the same threat actor. Security teams can detect potential breaches by monitoring DNS queries to the known phishing domains and reviewing AWS CloudTrail logs for ConsoleLogin events following interactions with those domains. A successful login immediately after phishing site access strongly indicates session hijacking. The campaign underscores the growing threat of real-time AiTM attacks against cloud services, particularly when combined with social engineering and targeted reconnaissance.

OpenAI and Claude: Agentic Red-Team Tools Flaws Let Hackers Steal API Keys, Escape Sandboxes, and Compromise Hosts

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Agentic Red-Team Tools Found Vulnerable to "Agent-Phishing" Attacks in New Study A recent academic study published on arXiv reveals critical security flaws in agentic red-team tools autonomous offensive security platforms designed to simulate cyberattacks. Researchers analyzed 12 widely used systems and found that most contain systemic design weaknesses, allowing attackers to hijack these tools, steal API keys, escape sandboxes, and fully compromise the hosts running them. ### How the Attack Works Agentic red-team platforms typically consist of three components: an orchestrator (managing the agent’s operations, memory, and guardrails), worker nodes (executing commands in isolated environments like Kali Linux containers), and a front-end interface for human operators. The orchestrator often stores sensitive data, such as LLM API keys, while workers interact directly with target systems. The study introduces "agent-phishing", a novel attack method that manipulates red-team agents without relying on traditional prompt injection. Attackers deploy realistic but malicious artifacts such as a fake password vault utility (pwcrypt) or a database restore tool on a honeypot target. When the agent encounters these, it downloads and executes them, believing they are necessary for the penetration test. The payloads are designed to appear benign but contain hidden vulnerabilities. For example, a crafted pwcrypt file triggers an out-of-bounds write, leading to arbitrary command execution such as a reverse shell without obvious signs of malware. Static and dynamic analysis tools fail to detect these attacks because they focus on implementation bugs rather than malicious intent. ### High Success Rate & Escalation Path Using an automated testbed, researchers demonstrated that agent-phishing achieves remote code execution (RCE) in 97.8% of successful runs across ten red-team tools and six advanced LLMs, including Claude Opus 4.8, GPT-5.5, and Gemini 3.1 Pro. Failures occurred only when safety mechanisms blocked penetration testing entirely; once initiated, agents almost always executed the malicious payloads. The attack follows a five-stage kill chain: 1. Worker Compromise – Initial RCE on the worker node. 2. Orchestrator Escalation – Exploiting weak isolation (shared volumes, unauthenticated APIs) to move from worker to orchestrator. 3. Persistence – Embedding backdoors in source code, configurations, or long-lived inputs (e.g., skills, memory). 4. Sandbox Escape – Leveraging excessive container privileges (e.g., `--privileged`, Docker socket access). 5. Full Host Compromise – Taking control of the underlying system. ### Guardrails Proven Ineffective Existing security measures, such as blocking traffic to .gov domains, are enforced at the orchestrator level but fail to monitor worker behavior. Once compromised, a worker can bypass these restrictions, generating unrestricted network traffic and executing commands outside the orchestrator’s visibility. ### Mitigation Recommendations The study advises treating LLM-controlled workers as untrusted and minimizing their potential impact. Key defenses include: - Strict worker-orchestrator separation - Keeping secrets out of workers - Enforcing OS-level guardrails via external egress proxies - Avoiding tool execution on the orchestrator - Using least-privileged, scoped workers with hardened APIs The findings underscore the need for stronger isolation and monitoring in autonomous offensive security tools to prevent them from becoming attack vectors.

Microsoft: Edge users beware — this malicious extension can break out of the sandbox and install ransomware

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Malicious Edge Extension "Edgecution" Exploits Teams Phishing to Deploy Backdoor Security researchers at Zscaler have identified a sophisticated cyberattack campaign dubbed "Edgecution", leveraging a malicious Microsoft Edge extension to establish a backdoor on targeted systems. The attack begins with Microsoft Teams phishing, where threat actors impersonate IT support, urging victims to install a fake "Outlook update" or "spam filter" via a fraudulent "Outlook Updates Management Console" website. Victims are tricked into downloading a ZIP archive containing a Python-based backdoor and an embedded Python runtime. Upon execution, the archive creates a scheduled task that launches Edge in headless mode (invisible to the user) and installs the malicious extension, officially named "Edge Monitoring Agent" but referred to by Zscaler as "Edgecution." The extension bypasses Edge’s sandbox by generating a Native Messaging manifest, enabling direct communication between the browser and the Python backdoor. This allows attackers to execute shell commands, PowerShell scripts, arbitrary Python code, write files, enumerate processes, and exfiltrate system data. Zscaler attributes the campaign to Initial Access Brokers (IABs) with suspected ties to the ransomware group Payout Kings, highlighting the growing sophistication of access-for-sale operations. The attack demonstrates an innovative evasion technique, combining browser extensions with native host execution to avoid traditional endpoint detection. Indicators of Compromise (IoCs) for the campaign have been published by Zscaler. The incident was first reported by BleepingComputer.

Humanitix: Report: Aussie journalists & human rights orgs coming under increasing cyber attack

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Cloudflare’s Project Galileo Report Highlights Surge in Attacks on Civil Society, Including Australian Targets Cloudflare’s Project Galileo launched in 2014 to protect journalists, activists, and minority groups from cyber threats has revealed a sharp rise in attacks against civil society organizations, with Australian entities increasingly in the crosshairs. The latest report, covering February 1, 2025, to January 31, 2026, found that groups worldwide faced relentless targeting, with distributed denial-of-service (DDoS) attacks accounting for over 80% of incidents. Globally, Cloudflare blocked 38.5 billion malicious requests against protected organizations, with 18% (6.9 billion) originating in the Asia-Pacific region an average of 18.9 million attacks per day. Despite representing only 12% of Project Galileo’s global beneficiaries, APAC organizations, including Australian groups like Humanitix and Activist Rights, faced disproportionate targeting, making up 4% of protected entities. The report underscores that civil society groups endure seven times more website vulnerability exploit attempts than other Cloudflare customers. While most DDoS attacks on general users last minutes, those against civil society often persist for days or weeks, aligning with prior findings that nonprofits, religious institutions, and civic groups are among the most targeted. Beyond DDoS, attackers employed multilayered tactics, such as using high-volume attacks to conceal vulnerability scans exemplified by a campaign against a global environmental organization during a climate conference in Brazil. Journalists bore a particularly heavy burden, suffering 40.5% of website vulnerability attacks despite comprising just 22.7% of protected users. The findings highlight an escalating threat landscape where malicious actors, including hostile governments, intensify efforts to disrupt vulnerable groups through both brute-force and stealthy cyber operations.

California Water Service: Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Iranian Hacker Group Handala Targets California Water Service in Cyberattack California Water Service (Cal Water), one of the largest investor-owned water utilities in the U.S., recently investigated a cyberattack claimed by the Iranian hacker group Handala. While the group widely suspected to be a front for Iranian state-backed operations alleged deep access to industrial control systems (ICS) and threatened potential disruptions to water supply, Cal Water’s investigation found no evidence of intrusion in its operational technology (OT) environment. The threat actors leaked 5 GB of stolen data, which cybersecurity analysts confirmed included personal information and indications that a customer billing system and an internal application may have been compromised. However, Cal Water’s forensic analysis, conducted with assistance from Google’s Mandiant, determined that the breach was limited to unauthorized access to a small number of user accounts within two third-party service provider platforms. The investigation revealed that the hackers accessed one active customer account using stolen credentials but did not compromise payment information or the billing system. They also breached an external third-party GPS correction tool website, though it contained no sensitive data. Cal Water acknowledged support from state and federal government partners during the investigation and reiterated its commitment to securing its systems. The incident underscores the water sector’s vulnerability to cyber threats, particularly due to legacy systems and insufficient cybersecurity measures. The attack follows a broader trend of increased targeting of critical infrastructure, with threat actors exploiting weaknesses in both IT and OT environments.

Ministry of Health: Cybercriminals say they hacked New South Wales Rural Fire Service

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Nova Ransomware Group Claims Attack on New South Wales Rural Fire Service A cybersecurity incident at the New South Wales Rural Fire Service (NSW RFS) has been attributed to the ransomware group Nova, which today claimed responsibility for stealing 300 GB of data from the organization. The NSW RFS, Australia’s largest volunteer firefighting agency, first reported the breach on June 24, 2026, confirming an attack on its IT systems but stating that emergency response operations remained unaffected. In an email from the commissioner, the RFS acknowledged the incident but downplayed its severity, noting that many affected files were historical and that there was no evidence of sensitive personal data being accessed. However, the agency has not verified Nova’s claim, and key details including the nature of the compromised data, the number of affected individuals, and whether a ransom was demanded or paid remain undisclosed. Nova (also known as RALord), a ransomware-as-a-service (RaaS) group active since early 2025, operates by both encrypting systems and exfiltrating data, demanding payment for decryption and to prevent leaks. The group has claimed 143 attacks, with 12 confirmed by victims, including recent breaches at Universitat de València (Spain), LTI Services and Larick Towing (USA), and Aspire Hospitals (India). The NSW RFS attack marks Nova’s second targeting of a government entity, following a $2 million ransom demand against Italy’s Comune di Pisa in May 2025. The incident is Australia’s first confirmed ransomware attack on a government agency in 2026, part of a broader surge in such threats. Globally, 78 ransomware attacks on government bodies have been recorded this year, with 10 confirmed in June alone, including breaches at Germany’s Allensbach Fire Department, Pakistan’s Capital Development Authority, and Croatia’s Ministry of Health. These attacks can disrupt critical services, from emergency dispatch to public records, forcing agencies to weigh ransom payments against prolonged downtime and data exposure risks. The NSW RFS, responsible for 95% of New South Wales’ land area and comprising over 70,000 volunteers, remains under investigation as authorities assess the full scope of the breach.

Microsoft: Microsoft WinRE Vulnerability Allows Hackers to Bypass UEFI/BIOS Password Enforcement

Rankiteo.com — Thu, 25 Jun 2026 00:00:00 +0000

Microsoft WinRE Vulnerability Exposes Systems to Firmware Bypass Attacks A newly disclosed vulnerability in Microsoft’s Windows Recovery Environment (WinRE) allows attackers to bypass UEFI and BIOS password protections, granting unauthorized access to systems even with active firmware-level security controls. Tracked as CVE-2026-45585 and CERT/CC VU#226679, the flaw affects Windows 10 and Windows 11 systems utilizing WinRE for recovery and troubleshooting. WinRE, a built-in tool for system restoration and repair, includes features like the F11 recovery menu and "Reset this PC" option. However, researchers found that under certain firmware implementations, WinRE may trigger an alternate boot path that fails to enforce UEFI or BIOS authentication consistently. This inconsistency enables attackers with physical or administrative access to circumvent firmware protections, potentially altering boot settings or accessing sensitive data. The vulnerability is particularly concerning in "Evil Maid" attack scenarios, where an adversary gains temporary physical access to a device. By exploiting WinRE, attackers can bypass administrator-set BIOS or UEFI passwords, leveraging weaknesses in pre-boot authentication. The core issue stems from the UEFI BootNext variable, which allows systems to specify a one-time boot target in non-volatile memory (NVRAM). While intended for legitimate recovery operations, BootNext lacks cryptographic authentication and overrides standard BootOrder settings during the next boot cycle. This behavior can be abused to redirect systems into WinRE without triggering expected firmware-level checks. Though Secure Boot ensures only signed bootloaders execute, it does not fully mitigate the flaw, as it does not enforce consistent user authentication across all boot paths. Attackers may still access recovery environments, potentially weakening protections like BitLocker, especially if additional authentication (e.g., TPM + PIN) is not configured. Microsoft has acknowledged the issue and released guidance on hardening recovery environments and Secure Boot configurations. The vulnerability underscores the limitations of relying solely on firmware-level protections, highlighting the need for defense-in-depth strategies that address both physical and logical attack vectors.

Rockstar Games: GTA 6 Early Access Scam Uses Fake VIP Pages to Steal Cryptocurrency Payments

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

GTA VI Hype Fuels Surge in Cryptocurrency Scam Websites Scammers are capitalizing on the anticipation surrounding Grand Theft Auto VI by luring victims with fake "VIP early access" offers in exchange for cryptocurrency payments. These fraudulent websites mimic official branding with polished designs, neon Vice City-style visuals, and luxury car imagery, then instruct users to pay hundreds of dollars in Bitcoin, USDT, or Ethereum only to vanish without delivering the game. The scams exploit two key vulnerabilities: irreversible cryptocurrency transactions and the absence of any legitimate early access program. Rockstar Games, the sole authorized distributor of GTA VI, has not approved any pre-release sales outside official channels. The game’s confirmed release date of November 19, 2026, and the upcoming pre-order window (beginning June 25) have intensified demand, creating an ideal environment for fraudsters to exploit urgency and exclusivity. Social engineering tactics amplify the deception. Scam sites use familiar gaming terminology "VIP," "exclusive preview," "early access" alongside countdown timers and limited-quantity claims to pressure victims. High-quality visuals and seamless payment flows further lower suspicion, while the requirement to pay in cryptocurrency a major red flag is often overlooked. With GTA being one of the highest-grossing entertainment franchises (over 100 million copies sold for GTA V alone) and a 13-year gap since the last mainline release, pent-up demand has made these scams highly profitable. Victims are not merely careless; they are targeted by persuasive design and strategic timing. Legitimate purchases will only be available through authorized storefronts (Steam, PlayStation Store, Xbox Store, Epic Games Store) and verified retailers listed on Rockstar’s official website. Any site offering pre-release copies before Rockstar’s announcements is fraudulent. While recovery of lost funds is unlikely due to the irreversible nature of cryptocurrency transactions, victims are advised to report incidents to their wallet providers and local cybercrime authorities. The scams remain lucrative due to their low-effort, high-reward nature, underscoring the need for vigilance when encountering crypto-only offers for unreleased software.

France: German businesses face growing Bankruptcy risks from Ransomware Attacks

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

Germany Tops Europe in Ransomware Attacks, HPI Warns of Growing Threat Germany has become the most targeted country in Europe for ransomware attacks, according to cybersecurity expert Christian Dörr of the Hasso Plattner Institute (HPI) in Potsdam. Ahead of the National Cybersecurity Conference in Potsdam, Dörr highlighted the escalating risk posed by cybercriminals to businesses, government entities, and critical infrastructure across the region. Ransomware has emerged as one of the most disruptive forms of cybercrime, capable of crippling operations and inflicting severe financial damage. Germany currently leads the European Union in reported incidents, with France ranking second, reflecting the continent-wide surge in attacks. These attacks typically involve hackers infiltrating networks, encrypting vital data, and demanding payment for its release. Many threat actors also exfiltrate sensitive information, threatening to leak it if ransom demands often amounting to thousands of euros are not met. Beyond the immediate financial burden, organizations face additional costs, including system recovery, forensic investigations, legal compliance, and upgraded security measures. The most devastating impact, however, is operational downtime. When critical systems are locked, businesses may lose the ability to serve customers, process transactions, or maintain production. For small and medium-sized enterprises, even brief disruptions can lead to significant losses, with prolonged outages potentially forcing companies into insolvency. HPI’s research underscores the urgent need for organizations to bolster their defenses, as ransomware continues to evolve as a persistent and costly threat.

curl: PoC Exploit Released for libssh2 Remote Code Execution Vulnerability

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

Critical libssh2 RCE Vulnerability (CVE-2026-55200) Exploitable via Public PoC A proof-of-concept (PoC) exploit for CVE-2026-55200, a critical remote code execution (RCE) vulnerability in libssh2, has been released, heightening the risk of attacks against unpatched systems. The flaw affects libssh2 versions up to and including 1.11.1, stemming from an unchecked `packet_length` field in the `ssh2_transport_read()` function. This oversight allows attackers to trigger a 32-bit integer wrap, leading to undersized heap allocations and out-of-bounds writes during packet processing. The PoC, published under the exploitarium repository, includes a C11 verifier demonstrating how a crafted `packet_length` (e.g., `0xffffffff`) can force a tiny memory allocation while retaining a large logical packet size. This mismatch enables subsequent operations to overflow the buffer, corrupting adjacent heap structures. The repository also provides a malicious Python-based SSH server that delivers a malformed packet to exploit vulnerable libssh2 clients without authentication or user interaction, aligning with the vulnerability’s CVSS 9.2 severity rating. Given libssh2’s integration into tools like curl, backup agents, firmware updaters, and embedded appliances, any software linking the library and connecting to untrusted SSH endpoints is at risk. The PoC includes a local RCE harness that models the exploit’s allocation-to-control pattern, confirming code execution feasibility though real-world exploitation depends on target-specific factors like binary layout and mitigations. The upstream fix, introduced in commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, enforces a strict guard against oversized `packet_length` values. However, no new libssh2 release containing the patch has been widely announced, and downstream projects are still backporting fixes. Organizations are advised to identify and patch affected software while restricting connections to untrusted SSH servers.

curl: 25-Year-Old Vulnerability in cURL Used by 30 Billion Devices Finally Patched

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

25-Year-Old Critical Flaw in curl Patched in Record-Breaking Security Release A historic security update for curl, the ubiquitous data transfer tool and library, patched 18 CVEs the most ever addressed in a single release including a 25-year-old critical vulnerability (CVE-2026-8932) that had persisted since March 2001. The flaws were disclosed in curl 8.21.0, released on June 24, 2026, following an unprecedented surge in vulnerability reports triggered by an initial AI-driven discovery. ### The Flaws & Their Impact The vulnerabilities span authentication bypasses, memory corruption, credential leaks, and improper host validation, with many affecting libcurl the embedded engine powering billions of devices, from IoT systems to CI/CD pipelines. Key issues include: - CVE-2026-8932 (mTLS connection reuse): A 25-year-old flaw allowing authentication bypass when client certificates change. - CVE-2026-8925 (SASL double-free): Memory corruption in SASL protocol flows. - CVE-2026-9547 (SSH host validation): Improper validation of rejected server keys via libssh. - CVE-2026-9080 (HTTP/2 use-after-free): Crashes when resetting HTTP/2 dependency handles. Most CVEs were rated Medium or Low severity, but their reach is vast libcurl’s embedded nature means many flaws are invisible to end users, leaving enterprise and IoT environments particularly exposed. ### AI’s Role in Discovery The wave of disclosures began on May 11, 2026, when Anthropic’s Mythos AI identified an initial CVE. This prompted a flood of reports, with AISLE, an AI-powered security platform, uncovering 6 of the 18 CVEs more than any other contributor. Other AI models (Anthropic, OpenAI) and researchers contributed additional findings. ### Broader Fixes & Future Changes Beyond security patches, curl 8.21.0 introduces: - Named globs for file uploads and HTTP/3 proxy enhancements. - Deprecation of outdated features, including HTTP/2 stream dependency tracking and NTLM/SMB/TLS-SRP (slated for removal). The release includes 276 bug fixes and 500+ commits from over 100 developers, reflecting the project’s ongoing maintenance challenges. ### Why It Matters With curl running on over 30 billion devices, these flaws especially those in libcurl pose systemic risks. Many embedded systems lack direct patching mechanisms, amplifying the urgency for organizations to update. The incident underscores the growing role of AI in vulnerability discovery and the long-tail risks of foundational software.

Equifax and Apache: Closing the ‘risk window’: Why real-time remediation is the new security standard

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

Equifax Breach: A Decade-Old Lesson in Broken Security Handoffs On March 7, 2017, Apache disclosed a critical vulnerability in its Struts web application framework. Three days later, Equifax suffered one of the most devastating data breaches in history, exposing the personal data of 147 million Americans and resulting in a $700 million settlement. The breach wasn’t caused by a lack of awareness or available patches Equifax had both. The failure lay in the "connective tissue" between detection and remediation. A US-CERT alert about the Struts vulnerability was sent to an outdated recipient list, never reaching the team responsible for patching. Despite internal playbooks and processes, the breakdown in communication left the vulnerability unaddressed. Nearly a decade later, organizations continue to struggle with the same inefficiencies. A 2019 study found that 88% of security teams required cross-team coordination to patch vulnerabilities, delaying remediation by an average of 12 days. Even worse, 60% of breached organizations had a patch available for the exploited flaw. By 2025, little had improved: while 85% of organizations believed in strong collaboration, communication failures remained the leading cause of delays. The median time to remediate vulnerabilities in edge devices was 32 days, extending to 94 days when developers were involved and 267 days when third parties were required. The issue isn’t just patching speed it’s the entire lifecycle. Vulnerability management relies on seamless coordination across scanning, triage, ticketing, and follow-ups. Tools like SOAR, RMM, and GRC can automate parts of the process, but without end-to-end integration, gaps persist. Equifax’s downfall wasn’t a lack of tools but a failure to connect them, leaving critical vulnerabilities unresolved for weeks. The solution lies in full-cycle automation where discovery triggers immediate, autonomous remediation without manual handoffs. Attackers exploit weaknesses at machine speed; defenders must match that efficiency. While the technology exists, organizations must adopt it before the next preventable breach occurs.

LastPass: Looking for a New Password Manager After the LastPass Data Breach? Here's the Best Way to Switch

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

LastPass Breach Prompts Password Manager Migration Concerns LastPass recently revealed that subscriber data may have been compromised due to a breach at a third-party service provider, raising security concerns among users. For those considering a switch, transitioning to a new password manager requires careful planning to ensure a seamless transfer of credentials. Before migrating, users should evaluate alternative password managers for key features such as secure credential storage, password generation, auto-fill capabilities for web and mobile apps, multi-factor authentication (MFA), digital legacy options, and additional security tools like VPNs. Many services offer free trials, allowing users to test functionality before committing. Two primary methods exist for transferring passwords: 1. Export and Import – Users can export their existing passwords and form-filling data into a file (often a CSV or service-specific format) and import it into the new manager. However, CSV files may not retain all stored data, such as addresses or payment details, and some managers have limited import compatibility. 2. Dual-Manager Transition – Since most password managers can run simultaneously, users can install a new service while keeping the old one active. The new manager will capture login credentials as they are used, though this method may miss infrequently accessed passwords. The breach highlights the importance of secure password management and the growing adoption of passkeys a passwordless authentication method supported by leading password managers and platforms like Apple and Google. Users seeking alternatives can explore options tailored for personal or business use, prioritizing security, usability, and feature depth.

curl project: curl Patches 18 Vulnerabilities Including Password Leak and WebSocket Memory Bugs

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

curl 8.21.0 Patches Record 18 Vulnerabilities in Single Release On June 24, 2026, the curl project released version 8.21.0, addressing a record 18 security vulnerabilities the highest number fixed in a single update for the widely used data transfer tool. This milestone brings the total number of publicly disclosed curl vulnerabilities to 206 since the project’s inception. The update includes fixes for critical issues such as credential leakage, memory corruption in WebSocket handling, and use-after-free (UAF) vulnerabilities in HTTP/2 and socket callbacks. Among the patched flaws, four were rated Medium severity, including: - CVE-2026-8925: A SASL double-free bug leading to memory corruption during authentication. - CVE-2026-8927: An environment-set cross-proxy Digest auth state leak exposing credentials. - CVE-2026-9079: A stale proxy password leak risking unintended credential reuse. - CVE-2026-11856: A cross-origin Digest authentication state leak allowing unauthorized access. The remaining 14 vulnerabilities were classified as Low severity but still pose risks, such as denial-of-service (DoS) via WebSocket memory exhaustion (CVE-2026-11586), SSH host verification bypasses (CVE-2026-9547), and HTTP/3 data exposure (CVE-2026-9545). Other fixes address connection reuse flaws, QUIC UDP datagram loops, and persistent CA trust issues. Despite the security focus, the release introduces new features, including named glob support for URL patterns, HTTP/3 proxy CONNECT, and SHA-256 host public key support via libssh. It also deprecates HTTP/2 stream dependency tracking, NTLM, SMB, and TLS-SRP support, with plans to remove them in future versions. The next curl release is scheduled for September 2, 2026, following a two-week extension to the development cycle. Organizations relying on curl or libcurl are advised to upgrade immediately to mitigate risks from credential exposure and memory corruption.

npm: Fake npm Packages Impersonate PostCSS Tool to Steal Chrome Passwords

Rankiteo.com — Wed, 24 Jun 2026 00:00:00 +0000

Cybercriminals Exploit npm Packages to Deploy RATs Targeting Developers Cybersecurity firm JFrog uncovered a sophisticated attack campaign leveraging package impersonation to distribute remote access trojans (RATs) via the npm registry. Attackers uploaded three malicious packages postcss-minify-selector-parser, postcss-minify-selector, and aes-decode-runner-pro designed to mimic legitimate tools and deceive developers. The primary malicious package, postcss-minify-selector-parser, closely resembles the widely used postcss-selector-parser (150M+ weekly downloads), sharing similar keywords and listing the genuine package as a dependency. Published by an npm user named abdrizak, the fake package evades detection by appearing as a routine build utility. ### Multi-Stage Infection Chain When installed, the package executes an AES-256-GCM-encrypted payload from a defaults file, triggering a JavaScript dropper that runs a PowerShell script (settings.ps1). This script downloads a ZIP archive from nvidiadriver.net, a spoofed domain impersonating an official graphics driver site. The archive, disguised as a Windows patch, extracts to the temporary directory and launches a VBScript (update.vbs), which activates a hidden Python environment running compiled modules (audiodriver.pyd, command.pyd). The final payload a RAT establishes persistence via the Windows Registry run key (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`), checks for virtual machines to evade analysis, and executes background commands. A module (auto.pyd) specifically targets Google Chrome, bypassing app-bound encryption to extract stored usernames and passwords from saved login databases. JFrog’s findings highlight how attackers exploit trusted dependency ecosystems to deliver malware under the guise of legitimate tools. The incident underscores the risks of lookalike packages in open-source registries, where even minor naming similarities can serve as effective delivery vectors.

Stryker, Fortinet, Ivanti, Salesforce, Cisco, Carnival Corporation, Telus Digital, LexisNexis, OpenAI and Charter Communications: 10 Major Cyberattacks And Data Breaches In 2026 (So Far)

Rankiteo.com — Tue, 23 Jun 2026 14:00:00 +0000

2026 Mid-Year Cybersecurity Roundup: AI-Powered Attacks and High-Profile Breaches Dominate The first half of 2026 has seen a sharp rise in cyberattacks, many leveraging AI-driven techniques to accelerate exploitation and evade defenses. From zero-day vulnerabilities to data-wiping campaigns, threat actors have targeted critical infrastructure, healthcare, education, and enterprise systems often with devastating consequences. Below are 10 major incidents that defined the cybersecurity landscape in early 2026. ### Critical Infrastructure Under Fire - Cisco SD-WAN Zero-Day Attacks (February): The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive after attackers exploited a critical authentication bypass flaw in Cisco’s Catalyst SD-WAN systems, allowing unauthenticated remote access with administrative privileges. Cisco’s Talos team confirmed the campaign had been active since at least 2023. - Ivanti EPMM Exploits (April): CISA mandated federal agencies to patch a critical code injection vulnerability in Ivanti’s Endpoint Manager Mobile (EPMM) within four days, as attackers exploited the flaw for unauthenticated remote code execution. Ivanti reported limited customer impact but warned of active exploitation. - Fortinet FortiClient EMS Vulnerability (April): Fortinet released an emergency patch for a critical privilege escalation flaw (CVE-2026-35616) in its FortiClient EMS platform, rated 9.1/10 in severity. The company confirmed in-the-wild exploitation, urging immediate updates. ### Healthcare and Data Extortion Surge - Stryker Data-Wiping Attack (March): Medical technology giant Stryker suffered a destructive attack by the Iran-linked Handala group, which compromised a Windows domain administrator account to wipe devices and steal data. CISA later warned organizations to harden endpoint management systems. Stryker restored operations within three weeks. - ShinyHunters’ Rampage: The data-extortion group dominated early 2026, accounting for 14 of 37 "mega-breaches" (January–May), per Hackmageddon. Key incidents included: - Canvas LMS Breach (May): Instructure confirmed a compromise of its Free-For-Teacher program, exposing names, emails, student IDs, and private messages for 275 million users across schools and universities. Some colleges faced disruptions during finals season. - Salesforce, Charter, Carnival, and More: ShinyHunters exploited misconfigured Salesforce Experience Cloud sites, gaining excessive guest access, and breached Charter Communications, Carnival Corporation, Telus Digital, and the Council of Europe. ### Legacy Systems and Supply Chain Risks - LexisNexis Breach (March): Hackers accessed legacy servers containing pre-2020 customer data, including names, contact details, IP addresses, and support tickets. Threat actor FulcrumSec claimed access via an unpatched React frontend vulnerability (React2Shell) in LexisNexis’ AWS infrastructure. - Dashlane 2FA Brute-Force Attack (June): Password manager Dashlane disclosed a brute-force attack targeting six-digit 2FA codes, allowing attackers to register new devices on user accounts. Fewer than 20 customers had encrypted vaults downloaded, though Dashlane’s systems remained uncompromised. - OpenAI & Anthropic Supply Chain Incidents: - Anthropic (April): Unauthorized access to its unreleased vulnerability tool, Claude Mythos Preview, occurred via a third-party vendor, not a direct breach. - OpenAI (May): Two employee devices were compromised in the TanStack "Mini Shai-Hulud" supply-chain attack, though customer data and production systems remained unaffected. ### AI and the Acceleration of Threats Cybersecurity leaders warned that AI-driven attacks are shrinking response windows from days to seconds, overwhelming traditional patching strategies. Microsoft’s June "Patch Tuesday" set a record with 208 vulnerabilities, underscoring the growing challenge of vulnerability management. Experts emphasized the need for automated, AI-powered defenses to counter machine-speed threats a shift already underway as attackers weaponize generative AI for reconnaissance, phishing, and exploit development.

Cloudflare, Python Software Foundation, Apache and Google: Cordyceps Supply chain Vulnerability Impacting Code Repositories at thousands of Organizations

Rankiteo.com — Tue, 23 Jun 2026 00:00:00 +0000

Critical CI/CD Vulnerability "Cordyceps" Exposes Supply Chain Risks in GitHub Workflows A newly identified vulnerability pattern, dubbed Cordyceps, reveals systemic flaws in GitHub Actions workflows that allow unauthenticated attackers to hijack software supply chains. Unlike a single bug, this issue stems from insecure workflow compositions combining command injection, broken authentication, and cross-workflow privilege escalation creating multi-step exploit chains accessible from free GitHub accounts. Security firm Novee scanned 30,000 high-impact repositories, identifying 654 instances of the vulnerability and validating over 300 fully exploitable chains. Major organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, confirmed fixes after disclosures. The flaw’s scale suggests millions of repositories could be affected. At its core, Cordyceps exploits the misclassification of GitHub Actions YAML files as "configuration" rather than code. Despite executing shell commands, managing tokens, and publishing releases, these workflows often bypass the security scrutiny applied to application code. This oversight enables seemingly harmless steps like outputs or environment variables to carry untrusted data into high-privilege workflows, leading to credential theft, artifact poisoning, or malicious releases. Novee’s research uncovered high-impact examples: - Microsoft’s Azure Sentinel: A pull request comment executed attacker code, stealing a non-expiring GitHub App key with persistent write access to customer deployments. - Google’s AI Agent Development Kit: A single PR triggered CI code with owner-level Google Cloud permissions. - Apache Doris: Two zero-click attack paths exfiltrated CI credentials and tokens with broad repository write access. - Cloudflare’s Workers SDK: PR branch names could execute arbitrary commands on CI runners. - Python’s Black project: A malicious PR ran on build systems, hijacked automation tokens, and approved pull requests as the project bot, risking tainted releases for millions of users. Traditional security tools fail to detect Cordyceps because they analyze workflows in isolation, missing cross-workflow attack paths. Novee’s approach combined large-scale scanning with AI-driven validation to simulate end-to-end exploits. The vulnerability is exacerbated by modern development practices, where AI-generated CI/CD templates propagate insecure patterns rapidly across projects. Mitigation requires treating workflows as code enforcing least privilege, sanitizing inputs, isolating untrusted workflows, and testing for malicious PRs. The findings underscore that supply chain security now hinges on CI/CD rigor, demanding the same scrutiny as application code.