The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports.

Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines. It offers integrations for major LLM providers, MCP servers, and cloud deployments.

The supply chain attack occurred on June 17. During a 45-minute window, the hackers published 141 packages that contained the malicious dependency easy-day-js, a typosquat of the legitimate dayjs date library.

The affected Mastra packages have approximately 8 million weekly downloads. All users who installed a @mastra package during the attack window on June 17 should consider their systems affected.

As part of the attack, the hackers compromised the ‘ehindero’ NPM maintainer account, which has publishing rights across the Mastra ecosystem. One day before the account takeover, the attackers published a clean version of easy-day-js to a separate account, ‘sergey2016’.

The threat actor used the compromised maintainer account to add easy-day-js as a dependency to 141 NPM packages across the Mastra ecosystem, in such a manner that the latest version of the library would always be installed, and then published the modified packages to NPM.

Simultaneously, they published a new, malicious version of the easy-day-js library to their account.

An obfuscated postinstall dropper in the dependency would fetch a second-stage payload from the attackers’ servers, write it to the temp directory, execute it as a detached, hidden background process, and then delete itself to hide its tracks.

“Because the payload executes during installation, any developer workstation or continuous integration and continuous delivery (CI/CD) pipeline that ran npm install or npm update after the compromised versions were published was potentially exposed, regardless of whether the package was imported in application code,” Microsoft says.

Targeting Windows, macOS, and Linux, the malware was designed to masquerade as node-related tools while collecting system information and targeting more than 160 cryptocurrency-related browser extensions.

Microsoft has attributed the attack to the financially motivated North Korean group Sapphire Sleet, also known as BlueNoroff, CageyChameleon, Copernicium, and Stardust Chollima, which was also blamed for the Axios supply chain attack.

In April, hackers published modified versions of the Axios NPM library that were pointing to a phantom dependency designed to download and execute a cross-platform RAT. Google’s Threat Intelligence Group attributed the attack to UNC1069.

Mastra users are advised to remove the affected package versions, check their systems for malware, rotate credentials, tokens, and other secrets, and harden access to their crypto-wallets.

Cybersecurity firms Aikido, Ox, Socket, Sonatype, and StepSecurity have published technical details and indicators of compromise (IoCs) associated with the Mastra supply chain attack.

Related: More Cybersecurity Firms Disclose Impact From Klue Hack

Related: CryptoBandits Malware Doubles as a Backdoor, Abuses Tor

Related: NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks

Related: Supply Chain Attack Hits 32 Red Hat NPM Packages

https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/

The latest wave of breaches attributed to the ShinyHunters cybercrime collective (e.g., University of Nottingham, DentaQuest, 7-Eleven, Medtronic, and Wynn Resorts), reinforces a hard truth security leaders can no longer ignore: attackers are increasingly bypassing traditional perimeter defenses and targeting identities, authentication workflows, SaaS integrations, and trusted access paths instead of exploiting software vulnerabilities directly.

Over the past several months, ShinyHunters has been linked to attacks involving Salesforce environments, Snowflake customers, SaaS integrations, and identity platforms such as Okta. Researchers and incident responders have consistently observed the same pattern: stolen credentials, compromised OAuth tokens, social engineering, vishing, and abuse of legitimate access privileges.

This is not merely another breach trend. It is evidence that identity has become the primary battleground in enterprise security.

The Evolution of the ShinyHunters Playbook

Historically, attackers focused on exploiting unpatched systems or deploying malware to gain persistence. Today’s identity-centric threat actors operate differently. Instead of “breaking in,” they log in.

Recent investigations into ShinyHunters-related campaigns reveal repeated use of:

• Infostealer-harvested credentials
• Multi-factor authentication (MFA) fatigue and vishing attacks
• Compromised SaaS integrations
• OAuth token abuse
• Excessive permissions in cloud applications
• Misconfigured identity and guest-access settings
• Third-party trust exploitation
• Help desk impersonation

In the Salesforce Experience Cloud campaign disclosed earlier this year, attackers reportedly exploited overly permissive guest-user configurations to extract CRM data from public-facing portals. Salesforce emphasized that the issue stemmed from identity and access misconfigurations rather than a platform vulnerability.

Similarly, the Snowflake-related attacks associated with ShinyHunters leveraged stolen credentials and third-party integrations rather than weaknesses in Snowflake’s infrastructure itself. Investigators noted that many affected organizations lacked strong MFA enforcement and visibility into abnormal authentication behavior.

The same pattern has appeared across attacks targeting SaaS ecosystems, analytics providers, and cloud-connected applications. Once attackers obtain a valid identity or session token, they can often move laterally and access sensitive data without triggering traditional security controls.

Why Traditional Security Controls Are Failing

These attacks expose a growing gap in many enterprise security architectures.

Traditional tools such as firewalls, endpoint protection, and signature-based detection were designed to identify malicious code or anomalous network activity. But identity-based attacks frequently appear legitimate because attackers use valid credentials, approved APIs, and authorized applications.

To many security systems, a compromised employee account accessing Salesforce from a browser session looks indistinguishable from normal business activity.

That is exactly why identity has become the preferred attack vector.

Modern enterprises now operate in highly distributed environments spanning cloud platforms, SaaS applications, contractors, partners, and remote workforces. Every identity — human or machine — can serve as a gateway for attackers.

Attackers understand this reality better than most organizations do.

Identity Threat Detection Changes the Equation

The shift toward identity-driven attacks requires a corresponding shift in defense strategy.

Identity threat detection and risk mitigation has emerged as a critical capability for organizations seeking to detect and stop attacks that bypass conventional defenses. Unlike point-in-time identity verification, identity threat detection analyzes the full pattern of interactions associated with a credential, as well as activity across other identities and credentials within the environment, to identify indicators of compromise and malicious behavior. Rather than focusing solely on endpoints or network traffic, identity threat detection continuously monitors identity systems, authentication activity, privilege escalation, and access behavior across hybrid environments to detect and mitigate identity-based threats.

This approach enables organizations to identify suspicious activity such as:

• Impossible travel or anomalous login behavior
• MFA manipulation attempts
• Bot-based attacks
• Deepfake attacks
• SIM swap
• OAuth token abuse
• Privilege escalation
• Dormant or orphaned accounts being activated
• Lateral movement across access channels
• Suspicious authentication patterns tied to social engineering

More importantly, identity threat detection provides context.

Security teams need to understand not only who authenticated, but whether the behavior aligns with expected patterns, what resources were accessed, whether the identity was recently elevated, and whether downstream SaaS applications or integrations create additional risk exposure.

In the case of the ShinyHunters campaigns, many attacks likely could have been disrupted earlier through better detection of identity anomalies, token misuse, or unusual privilege behavior before large-scale data exfiltration occurred.

The Rise of Trust Exploitation

One of the most concerning aspects of recent ShinyHunters operations is the abuse of trusted relationships.

Threat actors increasingly target vendors, integrations, support workflows, and identity providers because compromise at one point can cascade across multiple organizations. Researchers analyzing recent campaigns observed attackers leveraging third-party SaaS providers and integration platforms to gain access into downstream customer environments. This creates a dangerous multiplier effect.

A single compromised identity, contractor account, or OAuth integration can provide attackers with legitimate access to hundreds of connected systems. Traditional network segmentation offers limited protection in these scenarios because trust relationships themselves become the attack path.

Organizations therefore need visibility not only into employee identities, but also into non-human identities, API connections, service accounts, and federated access relationships across their ecosystems.

Security Leaders Must Rethink Identity Protection

The lesson from the latest ShinyHunters breaches is not simply that attackers are becoming more sophisticated. It is that enterprise security strategies must evolve beyond the assumption that authenticated users are inherently trustworthy.

Identity can no longer be treated solely as an access management function. It must become a core security discipline.

That means organizations should prioritize:

• Continuous identity monitoring
• Risk-based authentication
• Strong phishing-resistant MFA
• Least-privilege access enforcement
• OAuth and token governance
• Detection of abnormal identity behavior

Conclusion

The modern attack chain increasingly begins and ends with identity.

Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage. In many cases, all they need is a trusted login, an overlooked permission, or a compromised token.

The organizations that recognize this shift — and invest accordingly in identity threat detection and response — will be far better positioned to stop the next generation of attacks before they become the next headline.

Related: Kodak Admits Data Breach After ShinyHunters Hack Claims

Related: ShinyHunters Claims Council of Europe Hack

Related: University of Nottingham Confirms Breach After Hackers Leak Data

Related: Hackers Leak DentaQuest Information Impacting 2.6 Million

https://www.securityweek.com/what-the-latest-shinyhunters-breaches-reveal-about-modern-cyberattacks/

European cybersecurity research firm Paradigm Shift has disclosed details of a new BootROM exploit that affects millions of iPhones and cannot be patched with a software update.

Dubbed Usbliter8, the exploit targets Apple’s SecureROM. Baked permanently into the device’s SoC, SecureROM is the first code an iPhone runs on startup and the foundation of Apple’s entire secure boot chain.

Usbliter8 chains a USB controller bug and a device firmware configuration weakness. The exploit, which requires physical USB access to the targeted device, works against iPhones with A12 and A13 chips — including iPhone XS, XR, and 11 — and Apple Watches with S4 and S5 chips. It’s worth noting that the affected chips were released in 2018 and 2019. 

Conducting a Usbliter8 attack involves the attacker connecting a special USB device (eg, Raspberry Pi Pico 2 or similar microcontroller board) to the targeted iPhone and sending it crafted USB setup packets. 

The attack triggers an out-of-bounds write, allowing the attacker to overwrite critical data in memory and ultimately take control of the processor, escalate privileges, and execute arbitrary code with full system privileges. 

Apple’s signature checks are bypassed, allowing a hacker to achieve full code execution at the device’s lowest level before the OS ever loads. The attacker can load unsigned firmware or lower the device’s security level. 

However, the exploit cannot directly be used to access user data. The researchers noted in their disclosure that Apple’s Secure Enclave Processor (SEP), a separate security processor that protects user data, is not directly compromised by the exploit. 

“Although usbliter8 doesn’t affect SEP itself, it opens up wider attack vectors to compromise the Secure Enclave,” Paradigm Shift researchers explained.  

While an attack cannot be launched remotely, such an exploit could be highly useful to forensics vendors.

The impact of Usbliter8 is similar to that of Checkm8, the 2019 BootROM exploit that left an entire generation of iPhones permanently vulnerable to jailbreak.

Paradigm Shift said it reported the findings to Apple before disclosure, but the tech giant has not publicly responded to the research. SecurityWeek has contacted Apple for comment and will update this article if the company responds.

The security firm has released PoC code for the Usbliter8 exploit.

“By publishing this research and the accompanying proof of concept, we aim to document the real-world impact of this class of hardware vulnerabilities, contribute to the broader understanding of modern BootROM security, and demonstrate that even recent SecureROM generations remain susceptible to subtle hardware flaws,” the company’s researchers noted.

Related: Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention

Related: Apple Patches Dozens of Vulnerabilities in macOS, iOS

Related: Apple Patches iOS Flaw Allowing Recovery of Deleted Chats

https://www.securityweek.com/new-exploit-bypasses-apples-boot-defenses-affects-millions-of-iphones/

Fortinet says the large-scale credential-harvesting campaign currently targeting its customers’ firewalls and VPNs does not exploit new vulnerabilities.

As part of the campaign, tracked as FortiBleed, threat actors have compiled a database of over 86,000 confirmed working credentials for Fortinet devices in 194 countries.

“Based on our initial analysis, we believe the activity involves threat actors reusing credentials from previous incidents and employing brute-force techniques against devices with weak password hygiene and no multi-factor authentication (MFA),” the company says.

The prior incidents Fortinet refers to involved the exploitation of three FortiCloud SSO login authentication bypass security defects: CVE-2026-24858, patched in January, and CVE-2025-59718 and CVE-2025-59719, addressed in December.

“Fortinet provided detailed guidance at the time of these advisories, and we continue to strongly encourage all customers to ensure these remediation steps have been completed,” the company notes.

In March, the vendor warned of threat actors’ use of AI to automate target identification and password spraying in large-scale attacks targeting poorly protected edge devices.

FortiBleed, it notes, leverages the same techniques, not a new Fortinet vulnerability. “This activity is not related to any recent incident or advisory,” Fortinet says.

The company noted that it has identified the potentially compromised systems, started notifying the impacted customers, and has been working with law enforcement to investigate the attacks.

Customers with compromised FortiGate instances are advised to terminate admin and VPN sessions, rotate their credentials, implement MFA on all administrator and VPN user accounts, and upgrade to software releases that support PBKDF2 hashing of administrator credentials.

Additionally, they should review firewall and VPN user accounts and configurations for unauthorized changes, check logs for unexpected admin access, and restrict external management to trusted hosts to reduce attack surface.

Related: CryptoBandits Malware Doubles as a Backdoor, Abuses Tor

Related: Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

Related: Critical Vulnerabilities Patched in Fortinet, Ivanti Products

Related: Majority of Internet-Accessible REDCap Servers Outdated

https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/

At least nine organizations have publicly acknowledged the impact of the supply chain attack on market intelligence platform Klue.

The incident occurred on June 11-12 and affected Klue’s integration with Salesforce, resulting in data being exfiltrated from the Salesforce instances of multiple Klue customers, including several cybersecurity firms.

On Friday, Klue confirmed previous security reports that the attackers used compromised legacy credentials to access its systems and compromise Salesforce integrations.

“The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments,” Klue said.

The company revoked the affected credentials and tokens, disabled the integrations across multiple services, and has been investigating the attack together with CrowdStrike and law enforcement.

“Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted,” the company said.

To date, at least nine Klue customers have disclosed impact from the incident, including cybersecurity firms HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium. Insurity and Sprout Social also notified their customers of the incident.

All the affected companies pointed out that the intrusion was limited to the Salesforce instances and did not involve their systems, as Klue said in its incident notice.

Across the board, the hackers stole business information from the affected organizations’ Salesforce CRMs, including sales account data and business contact information, such as names, email addresses, job titles, phone numbers, and business addresses.

Salesforce disabled the Klue integration in the wake of the incident, and revenue intelligence platform Gong did the same on Friday, warning that the hackers exploited its Klue integration to access internal licensed user data.

“We can confirm no direct impact on call recordings or customer transcripts. Examples of data accessed included user names, user business titles, and user emails,” Gong said.

In its analysis of the incident, Huntress suggested that a threat actor named Icarus might have been responsible for the attack.

Since then, Icarus has added Klue to its Tor-based leak site, claiming responsibility for the attack and threatening to publish the information stolen from Klue customers’ Salesforce instances.

Per the threat actor’s posts, the data would be released on June 22, unless Klue and the affected organizations engage in negotiations.

Related: Cybersecurity Firms Impacted by Klue Supply Chain Attack

Related: Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

Related: ‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems

Related: Laravel-Lang Packages Poisoned for Malware Delivery

https://www.securityweek.com/more-cybersecurity-firms-disclose-impact-from-klue-hack/

The Texas Parks and Wildlife Department (TPWD) has disclosed a data breach affecting roughly 3 million individuals.

TPWD is a state agency responsible for conserving Texas’s natural resources, managing wildlife and state parks, and overseeing hunting and fishing programs.

The organization learned from the Texas Cyber Command that a third-party vendor responsible for selling hunting and fishing licenses had suffered a cybersecurity incident.

According to TPWD, the hackers may have stolen the information of more than 3 million individuals who acquired hunting and fishing licenses, including email addresses, physical addresses, phone numbers, driver’s license information, and passport numbers. 

“Social Security numbers, dates of birth and financial information, including credit card details were not obtained from this incident,” TPWD said. “There is no evidence that customers under the age of 18 were involved or that any specific group was targeted.”

License sales are not impacted by the incident and the government organization says it’s working with the license system vendor to boost its cybersecurity. 

“Immediate steps were taken to strengthen access controls for customer profile data, and additional security features will be added in the future,” TPWD noted.

The name of the targeted vendor has not been disclosed, and it’s unclear who is behind the attack. 

SecurityWeek has reached out to TPWD for information on who was behind the attack and this article will be updated if the organization responds. 

Related: Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000

Related: 377,000 Impacted by Data Breach at Texas Gas Station Firm

Related: Hackers Stole 300,000 Crash Reports From Texas Department of Transportation

https://www.securityweek.com/texas-parks-wildlife-data-breach-affects-3-million-individuals/

Giu 21, 2026 Redazione Attacchi, In evidenza, News, RSS 0

---

La rapida diffusione degli Agenti AI sta creando un ecosistema sempre più complesso nel quale modelli linguistici, strumenti esterni e componenti aggiuntivi collaborano per svolgere attività operative. Questa architettura modulare, però, sta aprendo una nuova superficie di attacco che ricorda da vicino le vulnerabilità già viste nel mondo open source e nei marketplace di applicazioni.

Un caso recente evidenziato dai ricercatori ha mostrato come una falsa skill per agenti AI sia riuscita a superare i controlli automatici di sicurezza e a raggiungere oltre 26.000 agenti, dimostrando quanto siano ancora immature molte delle difese implementate nei marketplace dedicati agli agenti intelligenti.

Quando il problema non è il modello ma l’estensione

Molte piattaforme agentiche consentono agli utenti di installare componenti aggiuntivi, spesso chiamati skill, tool o plug-in. Questi moduli permettono all’agente di accedere a nuove funzionalità, interagire con servizi esterni o automatizzare processi complessi.

Il problema è che la sicurezza di questi ecosistemi non dipende soltanto dal modello AI utilizzato, ma anche dall’affidabilità delle estensioni installate. Se una skill malevola riesce a superare i controlli preliminari, può ottenere accesso a dati sensibili, credenziali e processi aziendali eseguiti dall’agente.

Secondo una recente analisi su quasi 4.000 skill distribuite in diversi marketplace, i ricercatori hanno identificato 76 payload malevoli confermati, mentre il 13,4% delle skill analizzate presentava almeno una vulnerabilità classificata come critica.

Come è stata aggirata la scansione automatica

L’aspetto più interessante della vicenda riguarda il modo in cui la falsa skill è riuscita a sfuggire agli strumenti di verifica.

Gli scanner automatici utilizzati da molte piattaforme si concentrano prevalentemente sull’analisi statica del codice e sulla ricerca di pattern noti. Gli autori della skill hanno invece sfruttato tecniche di offuscamento e comportamenti attivati solo in determinate condizioni operative, rendendo difficile individuare la componente malevola durante le verifiche preliminari.

Il rischio per le aziende

La vicenda evidenzia un problema destinato a crescere nei prossimi anni. Sempre più aziende concedono agli agenti AI accesso a repository di codice, documentazione interna, strumenti di produttività, piattaforme cloud e una skill compromessa potrebbe diventare un vettore privilegiato per attività di esfiltrazione dati, raccolta di credenziali, installazione di backdoor o manipolazione dei workflow aziendali. I ricercatori hanno già osservato casi reali di skill progettate per sottrarre informazioni sensibili o modificare il comportamento degli agenti ospitanti. La criticità è amplificata dal fatto che molti agenti operano con privilegi elevati e possono accedere direttamente a servizi interni o risorse normalmente non esposte a utenti esterni.

Verso una nuova generazione di controlli

La diffusione degli AI Agent sta riproponendo dinamiche già note nel mondo del software tradizionale. Così come repository open source e store di applicazioni sono diventati obiettivi privilegiati degli attacchi supply chain, anche i marketplace delle skill stanno emergendo come un nuovo bersaglio.

Per le aziende che intendono adottare agenti autonomi sarà quindi fondamentale introdurre processi di validazione indipendenti, sandbox dedicate, monitoraggio continuo e controlli granulari sui privilegi concessi alle estensioni installate.

---

---

---

https://www.securityinfo.it/2026/06/21/una-falsa-skill-elude-gli-scanner-e-a-raggiunge-piu-di-26-000-agenti-ai/?utm_source=rss&utm_medium=rss&utm_campaign=una-falsa-skill-elude-gli-scanner-e-a-raggiunge-piu-di-26-000-agenti-ai

French President Emmanuel Macron on Wednesday urged the world’s wealthy democracies to work together on regulating advanced artificial intelligence systems, speaking at a high-level meeting that included top AI executives.

OpenAI CEO Sam Altman issued a similar plea at the Group of Seven summit of major industrialized nations in France, saying an “international forum” is needed for countries to draw up AI guardrails. He said the task of AI safety should not be left to tech companies.

Overshadowing the discussion on AI was President Donald Trump’s administration’s directive last week, preventing foreign nationals from using Anthropic’s newest and most powerful artificial intelligence models.

Macron said it was a “good thing” that U.S. officials recognize that so-called frontier AI models could be dangerous, but he also criticized it as a “strictly nationalist” reaction.

The remarks followed a G7 working lunch that brought together AI industry figures, including leaders of three of the most powerful AI companies — Altman, Google DeepMind CEO Demis Hassabis and Anthropic CEO Dario Amodei — on the theme of “ensuring a safe, rapid and effective deployment of artificial intelligence.”

Trump’s feud with Anthropic has unsettled many outside the US

Ahead of the meeting, the White House’s dispute with Anthropic fueled distrust in Europe about American dominance of AI and tech ecosystems.

The company was forced on Friday to take its latest artificial intelligence models, known as Fable 5 and Mythos 5, offline to comply with the directive. The AI giant said it did not believe the steps taken by the government were warranted by the concern it flagged about a potential security issue.

When asked by a reporter whether France and other G7 countries had asked Trump to permit access to Anthropic’s latest AI models, Macron said he made a forceful plea for the U.S. not to keep cutting-edge AI to itself.

Macron warned of a possible drop in value for U.S. firms pioneering the disruptive technology if they switch off access like a light switch. Macron backed his appeal for partnership among key democracies with an insurance policy: France, he said, will boost funding for its own AI industry, so it’s not left behind if international cooperation breaks down.

Democratic countries ultimately want to prevent authoritarian regimes from getting access to advanced AI systems, Macron said.

“So let us move forward together,” he said. “Our relevant agencies must first cooperate so that, in the areas of security and cybersecurity, we have a smooth government-to-government relationship.”

Altman said in his lunch speech, attended by the G7 leaders and more than a dozen AI bosses, that the technology’s future must be shaped by people, democratic institutions and society as a whole, “not just by the companies building the most capable systems.”

“We need an international forum for discussion that establishes globally accepted standards for testing, provides expert and impartial analysis of capabilities and risks, and serves as a venue for cooperation among nations,” he said.

Europeans have sought checks on American AI dominance

Even before the Anthropic episode, there was growing distrust of American companies dominating AI and other tech ecosystems. In Brussels, the European Commission unveiled a tech sovereignty package this month with plans to boost homegrown AI, and at the Vatican, the pope last month called for robust regulation of artificial intelligence.

Trump’s intervention with Anthropic highlighted how Europe, Canada or other countries “can be put in an extremely vulnerable position” if they are cut off from advanced AI models, said Zach Meyers, director of research at CERRE, a Brussels-based think tank.

“There is a general anxiety about the state of Europe, the fact that we’re relying on other countries for quite important strategic infrastructure and a desire to do something about it, whatever that is,” Meyers said.

At the G7, Aidan Gomez, CEO of Canada’s Cohere AI, said a “number of proposals” were discussed on working together on AI governance and regulation.

“I think the consensus was we need something,” he told The Associated Press.

He said he told the gathering that democracies should focus their efforts on making sure the G7 “doesn’t just produce the most capable AI, but also the second most capable AI,” a reference to the U.S. and China being the world’s only two major AI powers.

Meta’s chief AI officer, Alexandr Wang, also attended the meeting, along with the heads of smaller AI labs, including France’s Mistral, Germany’s Black Forest Labs, Italy’s Domyn, Sakana AI of Japan and United Kingdom-based Synthesia.

The G7 comprises France, the United States, Canada, Germany, Italy, Japan and the UK. Brazil, India, Kenya and South Korea were among guest nations invited to participate in some discussions.

Related: AI and Cybersecurity – Everything You Wanted to Know, But Were Afraid to Ask

Related: Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation

Related: Industry Reactions to Claude Fable 5: Feedback Friday

https://www.securityweek.com/french-president-urges-us-to-share-cutting-edge-ai-and-democracies-to-cooperate-on-regulation/

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape.

This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment.

Here are this week’s highlights:

10-year-old phpBB flaw enables session hijacking

Researchers uncovered a critical authentication bypass in phpBB versions up to 3.3.16 and 4.0.0-a2. A single unauthenticated HTTP request can impersonate any user, including admins, exposing private messages and forum content, and providing full administrative control. phpBB users should upgrade immediately to 3.3.17 or the latest master branch. The issue, reported via HackerOne, received a patch within days, but thousands of active forums remain exposed.

Velvet Ant maintained decade-long stealth in air-gapped critical infrastructure

China-nexus actor Velvet Ant compromised an organization’s segregated network starting around 2016. It chained internet-facing footholds, Nginx/FastCGI proxies, and backdoored PAM/OpenSSH components for credential theft and persistent access. The group deployed variants of GS-Netcat, SOCKS5 proxies, and nine pam_unix.so backdoors across hosts. Remediation proved complex.

MaXSS and Spyder flaws expose 10 million Chrome users to hacking

Critical vulnerabilities in SiderAI (Spyder) and MaxAI (MaXSS) agentic side-panel Chrome extensions can allow malicious websites to trigger arbitrary extension actions, including hidden tab screenshots, AI memory dumps, and potential file access. With over 10 million combined installs and no vendor response, the issues enable full browser session compromise and account takeovers without user interaction. Users should remove the extensions until fixed.

AWS unveils Continuum

AWS has announced a new AI-powered tool designed to help organizations discover, prioritize, validate, and resolve vulnerabilities. Available in gated preview, Continuum takes findings from existing tools and its own scanning, prioritizing them based on exploitability in the user’s own environment.

1.2 million WordPress sites compromised in OptinMonster supply chain attack

Attackers injected malicious JavaScript into Awesome Motive’s OptinMonster, TrustPulse, and PushEngage WordPress plugin CDN scripts. The payload activates for logged-in admins, creating rogue administrator accounts and a hidden backdoor plugin. The breach stemmed from a compromised UpdraftPlus instance and CDN key. The supply chain attack is believed to have hit more than 1.2 million WordPress sites.

FTC says imposter scams cost Americans $3.5 billion in 2025 

The FTC reported imposter scams as the most common fraud category, with losses nearly tripling since 2020. Bank and government impersonation schemes drove the bulk of the damage, often via fake security alerts urging money transfers. Overall fraud losses hit a record $16 billion. The agency continues enforcement under its Impersonation Rule and supports public awareness campaigns.

US DOT closes investigation into Delta’s 2024 CrowdStrike outage response

The Department of Transportation ended its probe into Delta’s prolonged recovery from the global CrowdStrike incident without penalties. Investigators found the airline provided adequate refunds, baggage help, and support for passengers with disabilities. This aligns with the current administration’s shift away from certain Biden-era consumer protection enforcement approaches.

JetBrains Marketplace plugins steal developer AI keys

At least 15 malicious AI coding assistant plugins, published in the JetBrains Marketplace under various vendor accounts, exfiltrate OpenAI, DeepSeek, and similar API keys. The plugins have racked up nearly 70,000 installs while functioning as advertised. Keys are sent in plaintext to a hardcoded attacker server. The plugins also appear to resell stolen access to paying users.

Apple releases Beats firmware fixing unauthenticated mic access

Beats Studio Buds firmware update 1B211 patches CVE-2025-20701, which allowed nearby attackers to listen via the microphone on unpaired devices actively seeking connections. Updates apply automatically when paired with Apple devices. CVE-2025-20701 is one of three Bluetooth security issues disclosed last year, which have been found to impact devices from several major vendors.

Popa botnet tied to Israeli proxy provider 

Researchers linked the large Popa Android TV box botnet — used for residential proxy traffic in ad fraud and scraping — to NetNut, operated by publicly traded Israeli company Alarum Technologies. Researchers said an SDK turns compromised streaming devices into persistent proxies. The operation involves millions of IPs daily and raises concerns about local network exposure and ties to data scraping. NetNut and Alarum have disputed the allegations calling them “demonstrably inaccurate assertions and flawed deductions rather than verified facts.”

GCP Config Connector enables org-wide IAM owner takeover

A confused deputy vulnerability in Config Connector lets any Kubernetes namespace user escalate to GCP Organization Owner by submitting a malicious IAMPolicyMember. Google acknowledged the issue internally as P1/S1 but later classified it as “working as intended” and left it unpatched. The bypass affects organizations using the service for organization-level management.

ShinyHunters leaks Knicks and MSG talent and customer data

Hackers published Madison Square Garden data, including details on Knicks-related “talent” (players, coaches, celebrities) with risk assessments, addresses, and contact info, along with customer correspondence. The dump follows a June 5 breach. ShinyHunters continues its pattern of public leaks to pressure victims.

Related: In Other News: Google Security Layoffs, AudiA6 Takedown, $400 Million Coupang Fine

Related: In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA

https://www.securityweek.com/in-other-news-apple-patches-beats-eavesdropping-flaw-dot-closes-delta-crowdstrike-probe-aws-continuum/

Microsoft warns of a Windows-based cryptocurrency clipper that establishes a lightweight backdoor blending data exfiltration and remote code execution (RCE) capabilities.

Dubbed CryptoBandits, the malware has been used in attacks since February 2026, deploying a portable Tor client on the infected systems and routing traffic through a local SOCKS5 proxy.

“The clipper in this campaign relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C&C server. It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution,” Microsoft explains.

CryptoBandits is distributed through malicious shortcut (.lnk) payloads. On the infected systems, it deploys two components: a worm for propagation and a clipper/stealer to steal cryptocurrency wallet information. 

For propagation, the malware scans connected USB devices and creates additional malicious shortcuts of legitimate files. It can also deliver file-based payloads that it excludes from Defender scanning.

The clipper is a script that interacts with the system via WScript and ActiveXObject, and checks whether Task Manager is running as an anti-analysis defense. Persistence is achieved through scheduled tasks.

CryptoBandits launches a renamed Tor binary to establish command-and-control (C&C) communication and register the victim device, and then enters a continuous loop, polling the C&C for instructions every 500 milliseconds.

The malware can extract seed phrases and private keys associated with cryptocurrency wallets, and can replace cryptocurrency addresses in the clipboard with attacker-provided ones to hijack them.

According to Microsoft, the malware employs multi-layered obfuscation, decrypting all components at runtime. Both the Python script that handles installation and its JavaScript payloads are also obfuscated.

The central component of the threat is the bundled Tor client, which routes communication over localhost:9050 and resolves destination domains to reduce DNS visibility and hide its C&C location.

“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking. Organizations should focus on hardening script execution paths, monitoring local SOCKS proxy abuse, and using behavioral hunting to connect script activity with network, clipboard, and process signals,” Microsoft notes.

Related: Rokarolla Banking Trojan Targets 200 Applications

Related: Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack

Related: OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month

Related: Infostealers Turn Millions of Devices Into Credential Theft Machines

https://www.securityweek.com/cryptobandits-malware-doubles-as-a-backdoor-abuses-tor/