Breaches
A class action says a June 2026 breach exposed 2.4 billion TikTok users. TikTok denies any compromise, researchers found no markers tying the data to TikTok, and the samples look like repackaged infostealer logs. The claim is shaky - the complaint's negligence checklist still matters to defenders.
Threats
A former Qilin affiliate turned RaaS is now 2026's second most active ransomware operation. The Gentlemen pay affiliates an unprecedented 90%, run a custom EDR killer dubbed GentleKiller, and have claimed 580 victims across 77 countries. Patch these five CVEs and hunt these behaviours now.
Threats
Google, the FBI, and industry partners have disrupted NetNut, a residential proxy network built on at least 2 million hijacked home devices. In one June week, 316 threat clusters rode its exit nodes. Why the takedown matters, and why defenders should expect churn rather than extinction.
Threats
Apple's Hide My Email is supposed to keep your real address secret. A researcher found any alias can be traced back to your Apple account, reported it over a year ago, and it still is not fixed. As of this week, it still works.
Threats
Britain's costliest cyberattack was claimed by a Telegram crew. Investigators now point to Russian operators: novel ransomware, no ransom demand, encrypted backups. The defensive lessons that hold regardless of who was really at the keyboard.
Threats
Backdoor.Mistic (Zscaler: MLTBackdoor), used since April 2026 by the access broker Woodgnat/KongTuke, is a fileless RAT that establishes durable remote access and sells it to ransomware crews including Qilin, Akira, and Black Basta. It spreads via fake IT-helpdesk lures on Microsoft Teams.
Threats
Miasma/Shai-Hulud trojanized 20+ Leo Platform and RStreams npm packages in a sub-three-second burst on June 24, hiding its install hook in binding.gyp. It reads CI runner memory for masked secrets and exfiltrates via the victim's own GitHub token, beating egress blocklists.
Alerts
A high-severity flaw in Amazon Q Developer (CVE-2026-12957, CVSS 8.5) let a single config file in a cloned repo run commands and steal live AWS credentials. Amazon patched it in Language Servers for AWS 1.65.0. Update to 1.69.0.
Alerts
Lantronix EDS5000 serial-to-IP converters are under active attack via CVE-2025-67038, a CVSS 9.8 unauthenticated command-injection flaw that yields root code execution. Forescout saw it exploited before public details existed, and CISA has added it to KEV with a 26 June federal deadline.
Threats
SentinelOne has detailed Gaslight, a Rust-based macOS implant tied to North Korea-aligned actors that embeds 38 fake system messages to trick AI-assisted triage tools into aborting analysis. It runs a Telegram-based C2 shell and drops a Python stealer that lifts browser data and the Keychain.
Threats
FulcrumSec is a financially motivated data-extortion group that breaches large organizations, loots plaintext cloud secrets and over-privileged IAM roles, exfiltrates at scale, then publishes detailed breakdowns to extort. Confirmed victims include LexisNexis and Arup Group.
Threats
Elastic Security Labs has uncovered OXLOADER, a previously undocumented Windows loader delivering the CASTLESTEALER infostealer through malicious Google Ads impersonating Node.js. It abuses the PE .reloc section to stage shellcode and evades static engines and sandboxes.