Category: Cyber Security News

Medtronic has notified affected customers after a breach exposed personal data from its corporate IT systems to an unauthorized third party, with ShinyHunters claiming responsibility for the attack. The incident may involve millions of records containing PII and health-related information, and Medtronic says its devices remain safe to use. #Medtronic #ShinyHunters

ReliaQuest says ClickFix has rapidly become a leading malware delivery technique, driving both initial access and defense evasion by tricking users into pasting malicious commands into Windows and macOS tools. The tactic has evolved with variants like CrashFix, AMOS delivery on macOS, and loaders for Deepload, while attackers increasingly target developers through malvertising and emailed lures. #ClickFix #AtomicmacOSStealer #AMOS #Deepload #ReliaQuest #GoogleAds #Bitbucket #npm

Threat actors are using platform-aware phishing campaigns that fingerprint victims’ devices and operating systems to deliver tailored payloads after a click. Cofense found these attacks can serve different malware, disguise landing pages as trusted services, and increase attacker profits by adapting to Windows, macOS, Android, and other environments. #Cofense #FleetDeck #TifluxRAT #Telegram #Cloudflare #FIDO2 #ConnectWise

Sekoia uncovered weaponized GitHub proof-of-concept repositories that deliver the ChocoPoC Python RAT by hiding malicious behavior inside PyPI dependencies like frint and skytext. The campaign appears aimed at cybersecurity researchers and testers, and it abuses compromised accounts, multiple vulnerable products, and even Mapbox datasets to deploy and exfiltrate data. #ChocoPoC #Sekoia #GitHub #PyPI #frint #skytext #Mapbox #FortiWeb #React2Shell #MongoBleed #PANOS #IvantiSentry #CheckPointVPN #JoomlaSPPageBuilder

Kubota North America Corporation said unauthorized actors accessed parts of its network between March 16 and April 20 and may have exposed employee and dependent personal information. The company is notifying affected individuals and offering Kroll identity protection while warning them to monitor bank accounts and healthcare statements. #KubotaNorthAmerica #Kroll

The FortiBleed campaign, which stole credentials from more than 73,000 Fortinet devices, has now been linked to the INC and Lynx ransomware operations. Investigators say the stolen Fortinet access data, traffic-sniffing tools, and exposed infrastructure were used to support broader intrusions and ransomware negotiations. #FortiBleed #Fortinet #INC #Lynx #FortiGate

A cybercriminal began exploiting CVE-2026-46817, a critical flaw in Oracle E-Business Suite’s payments processing feature, with researchers observing six attacks in a two-hour window. The activity may be an early sign of broader targeting against Oracle customers, following earlier campaigns tied to Clop ransomware and ShinyHunters. #CVE-2026-46817 #OracleE-BusinessSuite #Clop #ShinyHunters

Over 900 Oracle E-Business Suite instances are exposed online while attackers actively exploit a critical flaw in the Oracle Payments File Transmission component, tracked as CVE-2026-46817. Oracle has issued a May 2026 security update, and Defused, Shadowserver, and CISA-related reporting highlights a broader pattern of Oracle product flaws being targeted in real-world attacks. #OracleEBusinessSuite #CVE2026-46817 #Defused #Shadowserver #CISA

Criminal IP integration with OpenCTI enriches IP addresses, domains, and URLs with contextual intelligence such as reputation scores, infrastructure data, vulnerability details, and phishing analysis. This helps security teams investigate connected assets, prioritize risky indicators, and strengthen threat hunting and SOC triage. #OpenCTI #CriminalIP

An aggressive password-spraying campaign against Microsoft 365 produced more than 81 million login attempts in two weeks and compromised 78 Microsoft accounts across 64 organizations. The attacker used valid credentials exposed in past breaches to abuse Azure CLI and the ROPC flow, bypassing MFA where Conditional Access policies were misconfigured. #Microsoft365 #AzureCLI #ROPC #Huntress #LSHIY

Modern email threats are increasingly using trusted identities, legitimate workflows, and compromised accounts to bypass secure email gateways and reputation-based defenses. A BleepingComputer webinar on July 8, 2026 will show how behavioral AI can help detect, investigate, and remediate phishing, BEC, and ATO attacks more efficiently. #BleepingComputer #AbnormalAI #NovantHealth #DeviceCodePhishing

The Department of Homeland Security is investigating a recent cyber incident that affected the Homeland Security Information Network (HSIN) and a SharePoint collaboration system used by government and private-sector partners. DHS says it isolated the affected systems and found no indication that classified networks were impacted, while the origin of the intrusion and any data theft remain unclear. #HomelandSecurityInformationNetwork #HSIN #SharePoint #DepartmentofHomelandSecurity

A teenager accused of being part of Scattered Spider has been extradited from Finland to the U.S. to face charges of conspiracy, computer intrusion, and fraud. The case adds to a wider crackdown on the group, which has been tied to major intrusions against MGM Resorts, Caesars Entertainment, Marks & Spencer,…

Synacktiv disclosed an unpatched Argo CD repo-server flaw that can let an unauthenticated attacker execute code and potentially take over a Kubernetes cluster if the internal port is reachable. The issue affects common Helm-based deployments with network policies disabled, and defenders are urged to isolate repo-server and Redis immediately. #ArgoCD #Synacktiv…

Microsoft has introduced a new Teams admin policy to give organizations better visibility and control over external bots joining meetings. The update adds bot detection, lobby grouping, organizer confirmation, and ISV bot registration to reduce privacy and security risks in meetings. #MicrosoftTeams #Microsoft #TeamsAdminCenter…