From BleepingComputer · 40 stories
Arch Linux Disables AUR Package Adoption and Pushes Due to Malware Influx
Arch Linux has disabled package adoption and pushes in its Arch User Repository (AUR) following an increase in malicious package adoptions and commits. This measure was taken to prevent the spread of malware, including remote-access trojans (RATs) and info-stealers, which attempt to upload user data and spread laterally across systems. The disablement is temporary while the Arch Linux DevOps team addresses the security situation.
Coordinated Cyberattack Impacts Over 30 Minnesota Water Systems
A coordinated cyberattack targeted the operational technology of more than 30 community water systems in Minnesota on July 26 and 27. The attack caused outages and communication failures, with Braham's water plant going offline and other cities like Plymouth, South St. Paul, and Maple Plain experiencing affected automated controls or cellular communication issues. The incident prompted a statewide cybersecurity response involving Minnesota IT Services (MNIT).
CISA and ACSC Release Guidance for Isolating Critical Infrastructure OT Systems During Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Cyber Security Centre (ACSC) have issued joint guidance, "CI Fortify – Advice for isolating vital systems," for critical infrastructure organizations. This guidance advises preparing to isolate operational technology (OT) systems from less trusted networks to maintain essential services during cyberattacks or other disruptions, addressing threats from state-sponsored actors.
Dysphoria IoT Botnet Uses Blockchain for C2 After JackSkid Disruption
The Dysphoria IoT botnet has adopted blockchain-based name services and infected-device relays for command-and-control (C2) following a March law enforcement operation against its predecessor, JackSkid. Researchers from CNCERT and Qi'anxin's XLab estimate the botnet to have over 200,000 bots, using them for distributed denial of service (DDoS) attacks and traffic relay operations. This architectural change makes the botnet more resilient to disruption by obscuring the location of its controllers.
Dolphin X Malware Uses AI Profiling to Rank High-Value Targets
A new remote access trojan named Dolphin X incorporates an "AI Profiler" feature to score and rank infected users, helping cybercriminals prioritize victims. This development allows attackers to automate the identification of high-value targets from a large pool of compromised accounts, potentially increasing the efficiency of cyberattacks.
Chick-fil-A reports data breach from credential stuffing attacks
Chick-fil-A has alerted customers about a data breach caused by credential stuffing attacks affecting accounts. The breach may involve sensitive information like names, email addresses, and partial credit card numbers.
Upbound Group discloses $13M fraud in Acima leases following data breach
Upbound Group reported a cybersecurity incident where threat actors stole non-sensitive customer information and documents, leading to $13 million in fraudulent Acima lease-to-own agreements. The stolen data was used to obtain goods, resulting in financial losses for the company when fraudsters failed to make payments. Upbound has implemented enhanced security measures and notified federal law enforcement.
Swiss rail manufacturer Stadler rejects $12.3M ransom demand after cyberattack
Swiss rail vehicle manufacturer Stadler Rail rejected a $12.3 million ransom demand from the Everest ransomware gang following a data breach on a platform shared with a supplier. The company reported no impact on its IT systems or production operations, and stated only non-security-relevant technical information was stolen, demonstrating a firm stance against cyber extortion.
South Korea's diplomat training system breached by hackers for 9 months
Hackers compromised South Korea's diplomatic academy's e-learning platform for nine months, exposing employee data. This breach raises serious cybersecurity concerns, especially given the country's past experiences with North Korean cyberattacks.
Authorities Shut Down Kratos Phishing-as-a-Service Platform, Arrest Developer
German and U.S. authorities dismantled the Kratos phishing-as-a-service platform, used for Microsoft 365 phishing campaigns, and arrested its developer in Indonesia. The platform had 1,800 users running 15,000 campaigns monthly, significantly affecting global cybersecurity due to its ability to bypass multifactor authentication.
23andMe Settles $18 Million Data Breach Case Across 42 States
23andMe will pay $18 million to settle claims from 42 states over a data breach affecting 6.9 million users, including genetic data. The settlement requires enhanced cybersecurity measures and accountability going forward. This settlement follows issues of inadequate data protection and significant delays in breach notifications.
Qilin Ransomware Gang Exploits Patched PAN-OS VPN Vulnerability
The Qilin ransomware gang is exploiting a critical flaw (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect to gain unauthorized access and deploy ransomware. Despite the vulnerability being patched on May 13, 2026, attacks have led to network breaches and data encryption. The U.S. CISA has urged federal agencies to secure their GlobalProtect instances immediately.
Estée Lauder Data Breach Exposes Sensitive Details Through Oracle E-Business Vulnerability
Estée Lauder disclosed a significant data breach resulting from the exploitation of a zero-day vulnerability in Oracle E-Business Suite. The attack occurred in August 2025 and was revealed in June 2026, impacting personal data including Social Security numbers, financial, and health information of employees. The breach was connected to the Cl0p cybercrime group and affected multiple companies.
7-Zip Version 26.02 Fixes High-Severity RCE Flaw in XZ Archive Processing
7-Zip released version 26.02 to address a remote code execution (RCE) vulnerability linked to XZ-compressed data. Discovered by Lunbun researcher Landon Peng, the flaw could be exploited if a user opened a specially crafted archive. This highlights the need for manual updates due to 7-Zip's lack of an automatic update feature, emphasizing user awareness and action.
OkoBot Malware Targets Cryptocurrency Wallets via Seed Phrase Phishing
OkoBot, a malware framework active since April 2025, targets cryptocurrency wallet users by injecting phishing pages into legitimate wallet apps like Ledger and Trezor. Kaspersky reports hundreds of victims globally, particularly in Brazil, Vietnam, Canada, Mexico, and Türkiye. The malware delivers over 20 payloads to steal credentials and sensitive data, posing a significant threat.
Dutch Police Uncover Global Crypto Scam, Arrest Alleged Leader
Dutch police dismantled a large-scale international crypto scam, arresting the alleged mastermind and several associates. The scheme, operating through 20 call centers, swindled tens of thousands, making over €100 million monthly. The main suspect is a 46-year-old Israeli-Polish known in the cyberworld, caught in Poland and extradited to the Netherlands.
Lidl Data Breach Affects Customers in Germany, Belgium, and Netherlands
Lidl, a European supermarket chain, suffered a data breach affecting online customers in Germany, Belgium, and the Netherlands. Attackers accessed customer data stored by a third-party service provider. Although no payment information was compromised, affected customers have been advised to be cautious of potential phishing scams.
Forg365 Phishing-as-a-Service Targets Microsoft 365 with Sophisticated Methods
Forg365, a new phishing-as-a-service platform, targets Microsoft 365 accounts with advanced techniques such as adversary-in-the-middle attacks, AI-generated lures, and device code phishing. This operation is notable for its complexity and capability to execute persistent access while leveraging legitimate email services for delivery.
Six Vulnerabilities Found in U-Boot Bootloader Threaten Device Security at Boot
Six vulnerabilities in the U-Boot bootloader, used in devices from routers to servers, have been identified. These flaws enable attackers to execute arbitrary code or crash devices during boot, compromising security before the operating system verifies software. This poses significant risks due to U-Boot's widespread deployment in various embedded systems.
Armenian Man Pleads Guilty to Involvement in Ryuk Ransomware Attacks
Karen Serobovich Vardanyan, a 34-year-old Armenian national, pleaded guilty in the US to charges related to deploying Ryuk ransomware. Extradited from Ukraine, Vardanyan facilitated attacks from November 2019 to April 2020, securing approximately $15 million in ransoms. His case underscores ongoing cybersecurity threats impacting various sectors.
Injective SDK npm Package Compromised to Steal Cryptocurrency Keys
A version of the Injective SDK npm package was compromised, leading to the theft of cryptocurrency wallet private keys via a malicious version. Hackers accessed Injective Labs' GitHub to publish the harmful package, affecting developers in the decentralized finance space.
Dutch Police Probe Local Hackers in Odido Telecom Data Breach
The Dutch police are investigating local hackers in the February Odido data breach affecting 6.2 million customers. A suspect impersonated an Odido IT employee, facilitating unauthorized access through a customer contact system. Authorities are requesting public assistance to identify the caller.
AI Agents Expose Gaps in Enterprise Identity Governance Systems
AI agents are increasing machine identities in enterprises, highlighting gaps in identity governance. Traditional identity access management (IAM) systems were not designed for autonomous AI, often causing security risks due to over-privileged access. Addressing this issue is critical for secure enterprise operations.
Mount Royal University Hit by Ransomware Attack, Data Stolen and Deleted
Mount Royal University in Calgary experienced a ransomware attack that led to the theft and deletion of student and employee data from its 'H drive' file storage systems. The CMD Organization, the group responsible for the attack, demanded a $1.9 million ransom for over 10 terabytes of data. This incident, impacting various university systems, emphasizes the ongoing risk of ransomware threats in the education sector.
AssuranceAmerica Data Breach Exposes 6.9 Million Driver Records
AssuranceAmerica has suffered a data breach affecting 6.9 million individuals' driver’s license information, names, and contact details. Discovered on March 17, the breach is the largest known exposure of U.S. driver's license data this year, significantly impacting personal data security and prompting potential fraud concerns.
Suspected China-Linked Hackers Target Roundcube Vulnerabilities in U.S. and Canadian Universities
A China-linked threat group named UNK_MassTraction has exploited a critical Roundcube webmail vulnerability to infiltrate physics and engineering departments in U.S. and Canadian universities, stealing credentials and deploying malware. The targeted campaign, identified by Proofpoint, has significant implications for national security and academic research.
Accenture Confirms Data Breach as Hacker Offers Source Code for Sale
Accenture has confirmed a data breach involving the theft of 35 GB of sensitive data, including source code and Azure credentials. A hacker is offering the data for sale, raising concerns about potential future exploitation. Accenture stated there is no impact on their operations and they have addressed the breach's source.
Ubiquiti Releases Critical Security Patch Updates for UniFi OS Suite
Ubiquiti has issued patches for seven critical vulnerabilities in its UniFi OS software suite, affecting applications like UniFi Connect, Talk, Access, and Protect. These security flaws, including CVE-2026-50746, allow command injection and privilege escalation attacks. Users are strongly advised to update their systems to secure versions to mitigate potential breaches.
Spanish Police Arrest Suspected Member of Pro-Russian Hacktivist Groups
Spanish authorities arrested a man in Palencia linked to pro-Russian hacktivist groups CARR and Z-Pentest following an FBI tip. The suspect is accused of aiding a hacker's escape and supporting cyber activities against Ukraine. The arrest could impact international investigations into cyber threats.
Microsoft Tests Cloud Rebuild for Remote Windows 11 Recovery
Microsoft is testing Cloud Rebuild for Windows 11, allowing remote OS reinstalls from the cloud. This feature, in Insider Preview, provides a clean reinstall, handling device drivers and updates automatically without USB media, even if the OS won't boot. It enhances recovery options beyond 'Reset this PC', crucial for fixing persistent system issues.
Cordyceps Vulnerability Exposes Over 300 GitHub Repositories to Supply-Chain Attacks
Researchers from Novee Security have identified a CI/CD vulnerability, named Cordyceps, affecting over 300 GitHub repositories. This issue allows unauthenticated users to execute harmful code, potentially impacting major organizations like Microsoft, Google, Apache, and Cloudflare. The flaw, due to weak CI/CD configurations, raises significant supply chain security concerns.
BeyondTrust Patches Critical Vulnerabilities in Remote Support Products
BeyondTrust has patched critical vulnerabilities in its Remote Support and Privileged Remote Access software. These flaws, identified as CVE-2026-40138 and CVE-2026-40139, could allow unauthenticated attackers to bypass authentication controls and gain unauthorized access, risking elevated privilege accounts. The company urges users to apply the patches promptly.
DHS Investigates Cyber Breach on Homeland Security Information Network
The Department of Homeland Security is investigating a recent cyberattack on the Homeland Security Information Network (HSIN). The breach, suspected to occur between late May and early June, affected both HSIN servers and a SharePoint system, key for information sharing among government entities. The attack raises concerns over national security and vulnerabilities in government cybersecurity infrastructure.
Cisco Acknowledges Exploitation of Unified CM Vulnerability CVE-2026-20230
Cisco has confirmed active exploitation of a critical vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM). This flaw, found in systems with the WebDialer service enabled, allows attackers to execute server-side request forgery attacks and potentially gain root access. Cisco urges users to upgrade to patched versions immediately.
ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized PoC Exploits
ChocoPoC, a Python-based remote access trojan, is being distributed through trojanized proof-of-concept (PoC) exploit repositories on GitHub. The malware targets cybersecurity researchers by installing malicious dependencies from PyPI, enabling attackers to execute commands and steal sensitive data. This highlights security risks associated with using unofficial PoCs in vulnerability research.
Password Spray Attack Targets Microsoft Azure CLI, Compromising 78 Accounts
An automated password spray attack on Microsoft's Azure CLI attempted over 81 million logins, affecting 78 accounts across 64 organizations. The attackers exploited a deprecated OAuth flow, bypassing security measures like Conditional Access policies and multi-factor authentication (MFA). This incident underscores vulnerabilities in prevalent security configurations within cloud environments.
Shell investigates potential data theft after Clop ransomware gang claims 89GB stolen
Shell is investigating a potential security incident after the Clop ransomware gang claimed to have stolen 89GB of data, including engineering drawings and project plans. This incident is linked to the exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM instances, a vulnerability that CISA has confirmed is actively exploited.
Threema secure messaging service disrupted by large-scale DDoS attacks
The Threema secure messaging service experienced severe disruptions due to multiple large-scale distributed denial-of-service (DDoS) attacks. The attacks were difficult to mitigate because the threat actor constantly changed patterns and targeted both Threema and its colocation partner. This incident highlights the persistent challenge of defending against sophisticated DDoS campaigns, even for services focused on security.
Ukraine Shuts Down 94 Fraudulent Call Centers, Seizes Millions in Cash and Assets
Ukrainian authorities, in collaboration with German police, shut down 94 fraudulent call centers that engaged in investment scams and attempted to gain access to bank accounts. This operation led to the seizure of millions in cash, computer equipment, and the identification of 26 suspects, significantly disrupting a widespread cybercrime network.
Akira Ransomware Affiliate Bypasses EDR by Booting into Safe Mode, Steals Data
An Akira ransomware affiliate disabled endpoint detection and response (EDR) by restarting a compromised system into Safe Mode with Networking, allowing data exfiltration. Although the ransomware payload failed to execute due to low virtual memory, the attackers successfully stole credentials and files. This incident highlights a known tactic, previously seen with other ransomware families, now observed in an Akira attack.