All news in category “Incidents and Data Breaches”

🔒 The 2026 Klue compromise began as a SaaS supply‑chain breach and escalated when a second criminal group claimed to have stolen data from the initial extortion crew. Attackers exploited a forgotten service account and harvested OAuth tokens, enabling broad Salesforce API access and extensive data extraction. The incident underscores how identity and delegated application permissions now constitute the primary attack surface, challenging traditional perimeter defenses and ransom decision models.

🛡️ Zscaler ThreatLabz has detected an East Asia–linked campaign targeting Middle Eastern government entities that deploys three previously unreported malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The attack begins with an ISO that sideloads a rogue DLL to run a 32‑bit backdoor (TELESHIM) which uses the Telegram API for command-and-control, then stages additional payloads via DLL side‑loading and a reflective loader (MIXEDKEY). TELESHIM and MIXEDKEY employ heavy obfuscation and anti-analysis checks, while the final 64‑bit implant BINDCLOAK communicates with an external C2 server; observed activity occurred between July 7–9, 2026.

🛡️ Threat actors are abusing Steam discussion forums with ClickFix social engineering posts that instruct users to run PowerShell commands purportedly to fix game or system issues. The commands download and run an XMRig cryptominer disguised as a Windows optimization utility named msf utility \ PC Opt, which fakes maintenance progress while installing a miner as C:\Windows\Background\system.exe and persisting via a scheduled task. Victims are advised to check for the Background folder, Defender exclusions, and scheduled tasks named 'XMRig-[computer name]' and to run antivirus scans or consider OS reinstall.

🛡️ A widespread malvertising campaign uses fake Solana, Luno, and TradingView pages with malicious JavaScript that assembles malware directly in the browser's memory. The operation, active since late 2024 across 12 countries, filters out researchers and scanners while delivering customized payloads to retail traders and crypto investors. Confiant found the pages register service and shared workers to piece together a unique executable from remote components and local bytes, avoiding transmission of a finished file to evade detection.

📧 Threat actors are using email addresses exposed in data leaks attributed to ShinyHunters to send sextortion messages demanding $2,000 in Bitcoin. The campaign reuses leaked emails and breached company names to make threats appear credible, though there is no evidence recipients’ devices were actually compromised. BleepingComputer confirmed the use of data from multiple ShinyHunters incidents and observed messages falsely claiming remote access to cameras and files to coerce payment.

🔒 Threat actors tied to the Cl0p group are exploiting internet-exposed PTC Windchill and FlexPLM deployments to achieve unauthenticated remote code execution and deploy JSP web shells. According to a coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED, attackers chain a FlexPLM WSDL information disclosure with a Windchill login servlet flaw (CVE-2026-12569) to stage data theft and double extortion. Targets include manufacturing, automotive, aerospace, and retail organizations, with multiple IoCs published by PTC.

🛡️ Swiss firm PRODAFT reports that the DevMan ransomware-as-a-service operation runs a centralized affiliate portal enabling payload builds, victim management, finance tracking, and team coordination. The platform evolved to v3 in January 2026 with structured victim records, deadlines, and shared access, while affiliates follow strict rules and an 80-20 revenue split. The locker targets Windows, ESXi, and Linux and uses ChaCha20-Poly1305 encryption.

🛡️ Security researcher depthfirst published a working exploit on July 24 for a GitLab flaw patched by GitLab on June 10, enabling command execution as the git user on self-managed 18.11.3 servers that haven't updated. The chain abuses two memory-corruption bugs in the Oj Ruby JSON parser via GitLab's notebook diff renderer, allowing authenticated users who can push a project to leak a heap pointer and trigger a payload without admin or CI access. GitLab listed the Oj 3.17.3 bump under bug fixes rather than as a security fix, leaving operators unaware of the urgency; no CVE or CVSS score has been published yet.

🔒 OnTrac has disclosed a network intrusion detected on March 23 after attackers accessed certain files between March 20 and 22. The company says customer names may have been exposed but redacted details in the notification leave the extent unclear. OnTrac engaged a third-party specialist, offered 12 months of free credit monitoring via CyberScout, and recommends affected customers review credit reports and consider fraud alerts or freezes.

🔧 Microsoft attributed the large July 23 outage to a bug in its automated network maintenance request system that removed IP routes from more devices than intended, disrupting Azure and Microsoft 365 services, especially for customers routed through the West US region. The incident began at 10:44 AM ET and was resolved after a rollback completed at 2:26 PM ET, with full recovery of all services by 3:41 PM ET. Microsoft is conducting a full internal review and will publish a final post-incident report.

🔐 Chick‑fil‑A confirmed that more than 13,000 customers were impacted by credential stuffing attacks targeting its website and mobile app between June 17 and June 19. The attackers used credentials obtained from a third‑party source and accessed names, emails, membership numbers, Chick‑fil‑A credit amounts, mobile pay numbers, and card last four digits; some accounts may have also exposed birth dates, phone numbers, and addresses. The company logged out affected accounts, removed payment methods, restored balances, added rewards, and urged users to change passwords.

🔎 Europol coordinated multi-week Referral Action Days in June–July 2026, identifying 4,340 URLs tied to "The Com," a diffuse network of nihilistic violent extremist groups. Investigators from nine EU countries participated to disrupt online propaganda and generate investigative leads, focusing on content that includes violent imagery, self-harm encouragement, and child sexual abuse material. The operation, run by the EU IRU and Spain's CITCO, supports the European Commission's ProtectEU agenda and builds on earlier Project Compass efforts.

🛡️ Cybersecurity researchers disclosed a critical vulnerability, codenamed AgentForger, in OpenAI's ChatGPT Workspace Agents that allowed a single phishing link to create, authorize, and deploy an autonomous AI agent inside a victim's organization. The flaw—an instance of cross-site request forgery—let an attacker embed an executable prompt in a URL that auto-executes when clicked by an authenticated user with Workspace Agents and connectors. OpenAI patched the issue on June 8, 2026, and has deprecated the Agent Builder, urging a migration to the Agents SDK.

🔒 An Illinois man received a 76-month prison sentence and three years supervised release after admitting to social engineering attacks that compromised over 750 women's Snapchat accounts to steal and trade nude photos. Between May 2020 and February 2021, he targeted thousands of users while impersonating Snap Inc., accessed at least 517 accounts to download explicit images, and enabled two-factor authentication to lock victims out. Investigators also found hundreds of CSAM files in his cloud storage, and he advertised hacking services online, using Kik to communicate with clients including a former coach who was separately convicted for hiring hacks.

🔍 Analysis shows ransomware attacks against higher education rose in H1 2026, driven largely by The Gentlemen operation. Comparitech’s report records 104 attacks on the education sector, 36 confirmed as ransomware, with US institutions the most affected. The median ransom demand jumped to $420,620 and the largest demand reached $1.9m after the Mount Royal University incident.

🔒 Origin Energy has confirmed a data breach by an unknown threat actor that may have exposed customers' personally identifiable information. The company, which serves 4.8 million customers across Australia, is investigating the extent of the impact and notifying affected individuals. Reported exposed fields include names, addresses, dates of birth, phone numbers, partial payment details, and account information. Origin says incomplete financial details cannot be used to hijack accounts and has engaged authorities while offering support to impacted clients.

🔍 A new Windows infostealer and RAT named Dolphin X uses an AI-powered profiling system to help operators rank infected machines and identify high-value victims. Advertised on cybercrime forums, it targets over 300 applications to steal credentials, wallets, SSH keys, cloud tokens and DevOps secrets. Varonis Threat Labs analyzed the operator panel and found a scoring system that summarizes daily rankings to streamline attacker triage. Researchers advise defenders to keep long-lived credentials off disk and focus detection on behavior rather than file signatures.

🔒 South Korea's National Diplomatic Academy's online education system was breached after an exploited server vulnerability, allowing unauthorized access from April 2025 through February 2026. At least 6,000 individuals were affected, including around 350 current overseas attachés; Korean media suggests the number may be higher. Leaked fields reportedly include IDs, names, email addresses, and encrypted passwords, while sensitive identifiers and contact details were not exposed. The MFA has taken the system offline, strengthened security, and urged affected individuals to report suspicious communications.

🚆 Swiss rail manufacturer Stadler Rail says the Everest ransomware gang demanded 10 million Swiss francs (~$12.3M) after breaching a shared data exchange platform with a supplier. Stadler declared it will not pay the ransom, filed a criminal complaint with Thurgau cantonal police, and stated that its IT and production operations were unaffected. The company says only non-security-relevant technical supplier data was taken and no personal data or rail systems were compromised.

🛡️ Fortinet researchers uncovered a TrickBot variant that abandons HTTP for a custom DNS tunneling C2 channel, embedding encrypted commands and payloads within malformed DNS queries. The modular malware uses single-byte XOR encoding, hex-encoding and 63-character domain chunking for outbound beacons, while inbound data hides in multiple IPv4 addresses returned by resolvers. Persistence relies on Windows Task Scheduler with NTFS ADS, and command handling retains prior modular capabilities for executing modules, DLLs, PowerShell and shellcode.