It’s chaos in the wild once more.
This week carries that all-too-familiar scent of production systems ablaze and nobody eager to fess up about who left the gate ajar — legacy credentials still functioning, trusted applications pulling shady stunts, browser-based tricks leaping past defenses, and so-called “normal” workflows morphing into phishing conduits because apparently email alone wasn’t a sufficient nightmare.
The most frustrating aspect is how low-cost some of these attacks feel. Nothing sophisticated. Nothing straight out of a movie. Just recycled secrets, counterfeit updates, careless trust, and unmonitored machines quietly being repurposed as someone else’s computing power. Same internet, brand-new migraine. Let’s break it down.
-
Privacy-first bot defense
Cloudflare has joined forces with Google Chrome, Microsoft Edge, and Mozilla Firefox to develop a privacy-focused protocol that websites can adopt to distinguish legitimate human web traffic from unwanted network requests. This initiative leverages Private Access Control Tokens (PACT), which enable websites to issue anonymous tokens confirming that a particular browsing session is being operated by an actual person. “A user’s browser can then present these tokens to other sites to verify that a human is behind the interaction, cutting down on the need for frustrating and cumbersome captchas or intrusive tracking mechanisms,” Cloudflare explained. “PACT is architected so that sites cannot exploit it to track or identify users or their browsing behavior.”
-
Six curl CVEs
AISLE reported that it uncovered six vulnerabilities in curl, spanning “classic memory-lifetime flaws to logic errors in how libcurl determines whether a connection, credential, or host identity remains valid.” Among the notable findings is CVE-2026-8932, which permits the library to “reuse an already-established connection even when certain mTLS configuration-related settings had been altered in a way that should have prevented reuse.” AISLE characterized it as the oldest curl vulnerability documented to date, noting that it has been present in releases since curl version 7.7, which debuted on March 22, 2001. The identified issues have been resolved in version 8.21.0.
-
Unauthenticated takeover
A severe security vulnerability has been revealed in self-hosted deployments of Hoppscotch (CVE-2026-50160, CVSS score: 10.0), an open-source API platform, that can lead to total system compromise. Offgrid Security’s autonomous AI security agent, Kiro, has been acknowledged for discovering the flaw. “The POST /v1/onboarding/config endpoint permits an unauthenticated adversary to inject arbitrary InfraConfig keys — including JWT_SECRET and SESSION_SECRET — into the database via mass assignment,” the project maintainers stated. “These keys are absent from the SaveOnboardingConfigRequest DTO definition, but because the NestJS ValidationPipe does not strip extraneous properties, they travel through to the service layer, where Object.entries(dto) iterates over all keys without restriction.” Successful exploitation results in complete server takeover and persistent access that endures even after password resets. OffGrid Security informed The Hacker News that four independent vulnerabilities work in concert to allow an unauthenticated attacker to overwrite the JWT signing key in a single HTTP request, with the attack requiring no credentials whatsoever. The flaw has been patched in hoppscotch-backend version 2026.5.0.
-
Proxyware in smart TVs
A fresh report from Spur Intelligence has exposed that over one-third of LG and Samsung smart TV applications it examined include proxyware capable of relaying third-party traffic through the TV owner’s internet connection with users’ permission. The firm disclosed that it scanned 6,038 apps across LG webOS and Samsung Tizen and identified 2,058 that harbor residential proxy software. This encompasses clocks, screensavers, games, virtual fish tanks, and other low-utility applications. On LG webOS, 42.5% of apps carried such code. On Samsung Tizen, the figure stood at 26.9%. Across both platforms, the combined rate hit 34.1%. Bright Data, Massive, and Oxylabs rank as the top three SDK providers for webOS and Tizen. “Smart TVs are nearly perfect proxy hosts. They reside on the same home network as every other device, yet they don’t register as computers, so people seldom scrutinize them the way they would a computer,” Spur noted. “There’s no battery drain to catch attention, no cellular bill to spike, no app switcher filled with suspicious background activity. A television can remain powered in, logged in, and online for years while its owner treats it as mere furniture.” The threat intelligence company noted that this dynamic also reshapes the consent landscape, as users may not grasp what it truly means to sell access to their residential IP address. “From a technical standpoint, these applications comply with obtaining consent based on how they notify the user,” Spur CTO Alastair Parr told The Hacker News. “However, there is frequently no verification that the user is of legal age or authorized to grant consent on the device. The reality is that there are likely many smart TVs scattered across office environments and private homes, quietly participating in these networks, without the knowledge or approval of the responsible owners.” Amazon’s Device and System Abuse Policy explicitly prohibits apps that facilitate proxy services for third parties. Similar safeguards have been enacted by Roku as well. Nevertheless, LG and Samsung have yet to implement a comparable policy.
-
Edgecution via Teams
An initial access broker (IAB) connected to Payouts King ransomware has been detected posing as IT staff in social engineering campaigns carried out through Microsoft Teams to distribute a malicious Microsoft Edge browser extension codenamed Edgecution. “The method employs a malicious Microsoft Edge browser extension that exploits the Chrome native messaging protocol to interface with host-native applications beyond the boundaries of the browser sandbox,” Zscaler ThreatLabz explained. “By abusing this interface, the attackers secure direct host access, empowering them to tamper with the local filesystem, initiate processes, and run arbitrary code on the compromised machine.” The malware comprises two elements: a Microsoft Edge browser extension dubbed “Edge Monitoring Agent” that communicates with a command-and-control (C2) server and relays host-issued commands to a Python-based backdoor, which is capable of harvesting system data, listing active processes, providing filesystem access, and executing arbitrary Python code and shell commands. The extension remains invisible to the user because it operates within a headless Microsoft Edge browser session. A comparable attack sequence
The use of artificial intelligence in cybercrime is on the rise, with threat actors leveraging the technology to create more convincing phishing lures, automate attacks, and evade detection. This trend is expected to continue as AI tools become more accessible and sophisticated.
-
Legacy credential breach
Competitive intelligence firm Klue disclosed that a credential from a 2022 pilot program was exploited by the Icarus extortion group to steal Salesforce data from its corporate clients, several of which are cybersecurity companies. Klue stated the credential was “originally provided to a third-party in 2022, for a limited pilot,” but did not elaborate on the pilot’s purpose, duration, or the third party’s identity. It remains unclear why the credential wasn’t revoked after the pilot ended or how attackers initially obtained it. Multiple companies, including 8×8, BeyondTrust, Gong, Jamf, HackerOne, Insurity, LastPass, OneTrust, Pendo, Recorded Future, Snyk, Sprout Social, and Tanium, have confirmed limited Salesforce data theft.
-
State-crime convergence
NCC Group reports growing evidence of nation-state actors increasingly using tools and tactics typical of financially motivated cybercrime to mask espionage and intelligence-gathering, blurring the lines between these activities. “Historically, organizations could draw a relatively clear distinction between ransomware attacks driven by financial gain and nation-state operations designed to support strategic objectives. That distinction is becoming increasingly difficult to make,” said Matt Hull, VP of Cyber Intelligence and Response at NCC Group. “What we’re seeing is a convergence of criminal and state-backed activity. Threat actors are sharing infrastructure, adopting common tooling, and, in some cases, deliberately operating behind established ransomware brands to obscure attribution and delay response efforts.”
-
Admin reset alerts
Google is expanding its “Super Admin password reset” alert in Alert Center to a broader Admin password reset alert. “Previously, this rule only triggered alerts when a super admin’s password was changed,” the company explained. “With this update, the alert will now cover password resets for all administrator roles within your organization. This update provides admins with better visibility and control over the security of their organization’s privileged accounts. Monitoring password changes for all admin roles provides a higher level of oversight to respond more quickly to potential account compromises or unauthorized changes.” This change applies to all Google Workspace customers.
-
ClickFix targets macOS
A new ClickFix campaign tricks users into copying malicious commands and pasting them into the Terminal app, which silently downloads and mounts a malicious DMG file. The disk image contains a self-signed information stealer capable of harvesting system passwords, browser data, wallet information, messaging app data, and Keychain contents, exfiltrating the data, establishing LaunchAgent persistence, and tampering with Ledger Live and Trezor Suite installations by replacing legitimate components to hijack cryptocurrency wallet data. According to Palo Alto Networks Unit 42, this stealer belongs to the Atomic macOS Stealer (AMOS) lineage, specifically a variant called Odyssey. This development follows the cybersecurity firm’s report on another multi-step ClickFix attack using techniques like brandsquatting to deliver a cross-platform trojan with capabilities including browser credential theft, remote shell access, live screen streaming, keylogging, file management, and SSH tunneling.
-
TfL hackers convicted
Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, were convicted in the U.K. for orchestrating a 2024 cyber attack on Transport for London (TfL) that caused $38.2 million in losses. The two, members of the online criminal group Scattered Spider, were arrested last September but pleaded not guilty during a November 2025 court appearance. Sentencing is scheduled for July 16, 2026. “Scattered Spider is a prolific criminal group that engages in data extortion and other criminal activities, utilizing social engineering techniques and SIM swap attacks, to obtain credentials, install remote access tools, and/or bypass multi-factor authentication,” the U.S. Federal Bureau of Investigation (FBI) stated.
-
Marketplace admin extradited
Abdellah Belmili (aka Dila Belmili or SPOX), a 26-year-old Algerian national, has been arrested, charged, and extradited from Spain to the U.S. on conspiracy to commit bank fraud charges. SPOX allegedly administered a cybercrime marketplace (“www.market0day[.]com”) and created phishing kits used to compromise major U.S. financial institutions. “Between September and November 2020, Belmili advertised the marketplace and facilitated some of the customer support for the marketplace on his personal Telegram channel @SpoxCoder,” the U.S. Justice Department said. “In late December 2020, after several customers complained that they had not received their purchases from www.market0day[.]com, Belmili replied that he was no longer the administrator, and instead had opened up a new marketplace – www.spoxy[.]us, advertising the new marketplace as a ‘new store for bulk SMS.’ ‘Bulk SMS’ typically refers to sending phishing or other fraudulent messages via text message.” Approximately 5,600 U.S. and international victims have been identified.
-
Collaboration phishing
A new phishing campaign abuses Outlook Groups and Microsoft 365 collaboration features to “make malicious activity appear routine,” according to Fortra. The attack involves adding targets to an attacker-controlled Microsoft 365 group, then using the group mailbox, shared files, or fake calendar invites (CalPhishing) to facilitate credential theft, token capture, or malware delivery. “The technique shifts malicious intent away from a single phishing email into a trusted productivity workflow,” the company explained. “A user may see what looks like a normal group addition, internal update, shared resource, or calendar item before being pushed toward an action.”
-
AI in cybercrime
The use of artificial intelligence in cybercrime is increasing, with threat actors using the technology to craft more convincing phishing lures, automate attacks, and evade detection. This trend is expected to persist as AI tools become more accessible and advanced.
-
AI in the cybercrime underground
A fresh report from Sophos shows that artificial intelligence has become a fiercely debated subject in hacker forums, with cybercriminals weighing its usefulness for building malware and attack tools, while others worry it could shrink job opportunities in their illicit trade. The discussions range from listings selling API keys for generative AI platforms, to services advertising AI-powered social engineering boosts, to AI-driven malware families such as ApexAI, Metatron, and PolyEngine. Actors are also sharing methods to jailbreak publicly available AI models — using role-play framing, multi-turn prompting, and contextual manipulation to sidestep content filters and other protections — along with recruitment offers for prompt engineers. Underground users have additionally talked about leveraging public AI assistants for intrusion operations, and have promoted a tool dubbed Leak Bazaar that allegedly uses AI to sort through massive volumes of stolen data before it gets packaged and traded to other threat actors. Still, adoption isn’t universal; some have voiced doubt and anxiety that AI could “reshape roles, pricing, and competitive advantage within the cybercrime economy.”
-
8,500 REDCap instances exposed
Censys identified slightly more than 8,500 internet-facing REDCap instances worldwide as of June 16, 2026, with the largest concentrations in the U.S., the U.K., Germany, and Australia. REDCap — which stands for Research Electronic Data Capture — is a web-based platform widely used by research organizations to manage clinical trial data, participant records, and other sensitive study information. Last week, Google’s Threat Intelligence Group (GTIG) linked a espionage campaign lasting over a year — targeting academic, medical, and military research entities across North America — to a China-connected group tracked as UNC6508. The attackers used publicly accessible REDCap servers as their entry point to drop a backdoor named INFINITERED, designed to siphon sensitive data. The precise method of compromise remains unconfirmed, with the earliest known breach traced back to September 2023.
-
Surveillance export gaps
A Human Rights Watch investigation has exposed that Circles, a Bulgaria-based surveillance technology company, sold its products to governments likely to deploy them for repression or serious human rights abuses. Export licensing records show authorizations for Circles’ technology sent to Azerbaijan, Bahrain, Brazil, the Dominican Republic, El Salvador, Ghana, Guatemala, Israel, Jordan, Malaysia, Mexico, Morocco, Panama, Serbia, and the U.A.E. Buyers included intelligence agencies, military and police organizations, regional authorities, and private-sector firms, according to the watchdog. It remains unclear whether the technology was actually shipped. “Nonetheless, issuing the licenses demonstrates a major flaw in how individual governments implement E.U. export controls for surveillance technology,” the organization stated. “The controls are intended to limit exports of surveillance technology to destinations where there is a likelihood it could be used to violate rights, and to provide transparency about what exports take place.”
-
BitB phishing lures
An ongoing campaign impersonating well-known software brands has adopted the Browser-in-the-Browser (BitB) technique to deliver malicious payloads through a reusable phishing kit. The attack employs a draggable pop-up window with a forged URL to display a counterfeit software update alert. “The campaign uses social engineering to trick victims into downloading and manually executing a malicious installer (e.g., an .exe payload),” Unit 42 explained. “The pages simulate a stalled document load and present an ‘out of date’ software error.” Earlier this month, Unit 42 revealed a second BitB campaign spanning at least 10 distinct domains that harvested Microsoft 365 credentials via a draggable, OS- and browser-fingerprinted pop-up featuring a spoofed OAuth URL. In that scheme, victims who clicked a Microsoft sign-in button were shown what looked like a standard login portal built to capture their credentials.
If there’s a unifying theme, it’s that attackers don’t need sophisticated exploits when the basics still work — forgotten credentials, blind trust, fake update prompts, exposed admin paths, and users being coaxed into doing the dangerous part themselves. The future is here, somehow, and it still smells like a neglected staging server.
Apply patches wherever possible. Revoke what you’ve overlooked. Maybe take a second look at the devices you’ve been treating like furniture. See you next ThreatsDay — assuming the internet hasn’t found an even more absurd way to set itself on fire by then.
