Loading story…
Check Point Research reported multiple notable incidents and disclosures, led by RansomHub claiming a ransomware attack on Luxshare (a major electronics manufacturer in the Apple/Nvidia/LG/Tesla supply chain) and alleging theft of sensitive IP such as 3D CAD models, circuit board designs, and engineering documentation; Luxshare had not confirmed the breach at the time of reporting. The bulletin also cited an alleged Under Armour customer database leak affecting 72 million records following a prior ransomware attack, a Raaga music-streaming breach involving 10.2 million users with passwords stored as unsalted MD5 hashes, and a confirmed disruptive cyberattack on Germany’s Dresden State Art Collections (SKD) that impacted ticketing and visitor services without reported data theft; it additionally highlighted an indirect prompt-injection issue in Gemini’s Google Calendar assistant that could bypass privacy controls via malicious invite content.
The Hacker News’ weekly recap focused on active exploitation risk tied to Fortinet firewalls, where Fortinet said it is working to fully address a FortiCloud SSO authentication bypass that has been exploited even on “fully patched” devices, indicating an incomplete fix and a new attack path. The activity was linked to incomplete patches for CVE-2025-59718 and CVE-2025-59719, enabling unauthenticated SSO login bypass via crafted SAML messages when FortiCloud SSO is enabled; mitigations recommended included restricting administrative access and disabling FortiCloud SSO logins (e.g., turning off admin-forticloud-sso-login) until a complete fix is available.
See which actors are running it and whether you're in range.
20 events from the most recent confirmed update back to the earliest known activity.
Researchers reported widespread abuse of browser extensions, including cases involving theft of OpenAI API keys. The activity emphasized the security risks posed by trusted browser add-ons.
The weekly recap noted vishing campaigns focused on identity providers that used bespoke panels to intercept credentials in real time. The activity showed increasing sophistication in social-engineering operations.
The report said advanced AI models were observed producing functional exploit code for a purported QuickJS zero-day. This highlighted concerns about LLMs lowering the barrier to exploit development.
Researchers described web pages with hidden prompts that use LLM APIs to generate polymorphic malicious JavaScript. The technique demonstrated a new way to automate evasive payload creation.
A reported attack showed that indirect prompt injection could manipulate Gemini’s Google Calendar assistant. The finding illustrated how AI assistants can be influenced through untrusted content.
Researchers reported a new Osiris ransomware family that uses a malicious 'Poortry' driver and Rclone for data exfiltration. The disclosure added technical details on the group’s tooling and tradecraft.
Threat intelligence reporting identified a large phishing wave abusing Microsoft Teams guest invitations. The campaign used trusted collaboration workflows to target users.
Researchers observed KONNI-linked phishing activity in the Asia-Pacific region using AI-generated PowerShell backdoors. The campaign reflected the operational use of AI to speed malware creation.
Threat intelligence reporting also described a North Korea-linked operation using VS Code tunnels in South Korea. The activity showed continued abuse of developer tooling for intrusion and persistence.
Researchers said the North Korea-linked Contagious Interview activity evolved to abuse VS Code workspace tasks so malware runs automatically when a folder is opened. The campaign used code-repository lures aimed at developers and delivered a new backdoor.
Security researchers reported on VoidLink, a Linux malware framework said to have been built largely with AI assistance. The disclosure underscored the growing use of generative AI in malware development.
Researchers detailed a malvertising-driven 'CrashFix' scheme that tricks users into installing a browser extension and executing a ClickFix-style workflow. The campaign ultimately delivers ModeloRAT.
Fortinet said attackers were exploiting FortiGate devices even when fully updated because fixes for two FortiCloud SSO authentication-bypass CVEs were incomplete. The company advised disabling FortiCloud SSO admin login and restricting administrative access until a complete fix is available.
Researchers highlighted a long-standing critical authentication-bypass flaw in GNU InetUtils telnetd. A public proof-of-concept was available, increasing the risk of exploitation.
A critical command-injection vulnerability affecting Zoom’s Node Multimedia Router was disclosed. The report states the issue had been patched.
Newly disclosed vulnerabilities in Anthropic’s mcp-server-git showed that prompt injection could lead to path traversal and argument injection. The issues were also reported as patched.
The RansomHub ransomware group allegedly claimed responsibility for an attack on Luxshare. The reference presents this as a claimed victim disclosure in threat reporting.
A large-scale leak of Raaga user data was reported, with passwords allegedly protected using weak MD5 hashing. The disclosure highlighted the scale of exposed user information and poor password security.
A customer database leak affecting Under Armour was reported and linked to a prior ransomware incident. The reference frames this as an alleged leak rather than a newly confirmed breach.
Germany’s Dresden State Art Collections (SKD) suffered a confirmed cyberattack that disrupted operations. The report says no data theft was reported.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A weekly threat-intelligence roundup highlighted **Microsoft’s January Patch Tuesday** release addressing **112 vulnerabilities** across Windows and *Microsoft Edge*, spanning multiple classes including elevation of privilege, remote code execution, and information disclosure. The same briefing reported active interest in **CVE-2025-64155**, a **critical FortiSIEM** vulnerability, with observed exploitation activity against honeypot environments following an out-of-band alert from Kroll Threat Intelligence—an indicator of likely broader scanning and attempted exploitation. The update also covered multiple threat developments: Check Point research described **VOIDLINK**, a Linux-focused malware framework (implants/rootkits/loaders) designed for long-term access, including in cloud environments; **North Korean-linked KTA082 (Kimsuky/APT43)** was reported using **QR-code phishing (“quishing”)** to target government, education, and think tanks; and **Iran-linked KTA060 (MuddyWater)** was associated with development of the **RUSTYWATER RAT**. Separately, detection-engineering updates noted new and refined rules for **OAuth/Entra ID consent phishing** patterns (including *ConsentFix*-style authorization flows), correlations between Entra ID risk events and privileged actions (e.g., PIM elevation/device-code auth), Windows persistence/defense-evasion behaviors (e.g., scheduled tasks by unsigned executables, Chrome security feature tampering), and updated YARA/behavioral detections for malware families (e.g., **Agent Tesla**, **MintsLoader**) and **Cobalt Strike** TTPs; the briefing also referenced a leak of a database purportedly containing ~**324,000 BreachForums** user records posted to `shinyhunte[.]rs`.
Jun 29, 2026
Multiple weekly threat roundups and research posts reported a mix of active exploitation, new malware tradecraft, and breach claims. Ukraine’s CERT reported **APT28** rapidly weaponized a Microsoft Office zero-day (**CVE-2026-21509**) within roughly a day of Microsoft’s disclosure, using spearphishing emails with malicious DOC lures to deliver **Covenant** backdoors against Ukrainian government targets and EU-related entities. Separately, researchers described **ShadowHS**, a stealthy **fileless Linux** post-exploitation framework that runs in-memory (e.g., via `memfd`-style execution), uses encrypted multi-stage loading (AES-256-CBC), fingerprints defensive tooling (including major EDR agents), and retains operator-driven capabilities such as credential theft, lateral movement, and covert tunneling for exfiltration. Other reporting highlighted incident and exposure claims and defensive takeaways. Check Point described a **supply-chain compromise** affecting *eScan* (MicroWorld Technologies) in which malicious updates were pushed through the legitimate updater, prompting an emergency shutdown of global update services; it also noted **Crunchbase** confirmed a breach affecting **2M+ records** claimed by **ShinyHunters**, and cited extortion/leak claims involving **Qilin** (Tulsa International Airport) and **WorldLeaks** (Nike). Google’s legal/technical disruption of the **IPIDEA** residential proxy network was also cited as reducing available proxy nodes by millions and cutting off C2 domains used to route attacker traffic. Additional coverage described a phishing chain using a fake DHL invoice to abuse a signed Java utility via **DLL sideloading** (malicious `jli.dll`) and **process hollowing** into `AddInProcess32.exe` to run **Phantom Stealer**; detection-engineering updates emphasized new rules for Windows defense-evasion (e.g., tampering with Credential Guard/HVCI, disabling AMSI and the vulnerable driver blocklist) and expanded Kubernetes and Linux post-exploitation detections.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026