27 Million Stolen Passwords Just Got Rescued

In a two-week operation, Europol and law enforcement from the Netherlands, Canada, Germany, and the United States have dismantled the criminal infrastructure behind two of the internet's most active malware tools, according to The Hacker News.

Amadey and StealC were both sold as malware-as-a-service (MaaS) — a subscription-based criminal model where anyone can rent ready-made hacking tools, the same way a business might rent software. Amadey worked as a loader, quietly installing additional malicious software onto victims' machines. StealC was the harvester: once inside, it grabbed passwords, browser cookies, credit card numbers, and session data.

Authorities tore down 326 servers and 142 domains. They also identified and froze over $47 million in cryptocurrency tied to criminal activity, and recovered 27 million stolen login credentials — credentials that could have been used for fraud, ransomware, or selling on dark web markets.

The timing is notable. Days before this operation concluded, a separate action cleaned up nearly 15,000 compromised WordPress websites that were being used to spread another loader called SocGholish.

If your email address appears in any data breach notification over the coming weeks, take it seriously — these recovered credentials may surface through services like Have I Been Pwned.

What to do: Visit haveibeenpwned.com today, enter your email address, and check whether your credentials have been caught up in any known breach. If they have, change those passwords immediately and turn on two-factor authentication where possible.

Researchers at SentinelOne have uncovered a new piece of macOS malware, named Gaslight, attributed with high confidence to North Korea-aligned attackers, as detailed in The Hacker News.

Gaslight steals credentials, browser data, and system information in the usual way. What makes it unusual is a built-in attack against AI-assisted security analysis. Hidden inside the malware is a block of fake system error messages — fabricated warnings about memory failures, disk errors, and token expiry — designed to confuse an AI triage tool into thinking analysis has crashed or should stop. It targets the analyst's AI assistant, not the sandbox it runs in.

Think of it as a malicious footnote that whispers to the reader: "nothing to see here, the document is corrupted."

macOS users should ensure their security software is current, and security teams using AI-assisted tools should treat unexpected analysis failures as a reason to investigate further, not a reason to move on.

What Lantronix EDS5000 is: A serial-to-IP converter — a piece of hardware that connects older serial devices (like industrial sensors or legacy equipment) to a modern network, often found in factories, hospitals, and infrastructure environments.

What it is: This flaw allows an attacker to inject arbitrary operating system commands through the device's login username field. The device runs those commands with full root privileges — the highest level of system access possible.

Who's at risk: Any organisation running an EDS5000 device on firmware 2.1.0.0R3 or earlier. CISA has confirmed active exploitation and ordered US federal agencies to patch by 26 June 2026, per the CISA advisory.

CVSS: 9.8 — Critical. Patch today. Stop reading, go patch.

Root cause: The HTTP RPC module logs failed login attempts by building a shell command that includes the submitted username. That username is pasted directly into the command with no sanitisation (no filtering or validation of what characters are allowed). This means any input — including malicious commands — is treated as legitimate instructions by the system.

Attack vector: An attacker sends a login request to the device's HTTP interface with a username field containing injected shell commands rather than a real username. The device's logging routine picks up that input and executes it as a root-level system command. No prior authentication is needed. The attacker walks away with full control of the device — and potentially a foothold into the broader network it sits on.

Detection strategies:

1. Review HTTP authentication logs for usernames containing shell metacharacters such as semicolons, pipes, or backticks.
2. Monitor for unexpected outbound network connections from EDS5000 devices, particularly to unfamiliar external IPs.
3. Check for new or modified system files and configuration changes on the device that no administrator initiated.

Recommended actions:

1. Upgrade all EDS5000 devices to firmware version 2.2.0.0R1 immediately.
2. Place EDS5000 devices behind a firewall and restrict HTTP access to trusted management IPs only.
3. If patching is not immediately possible, isolate affected devices from the wider network until the upgrade is complete.

Social engineering (manipulating people through deception rather than breaking through technical defences) is behind some of the most damaging breaches of recent years. In 2025, the hacking group Scattered Spider hit UK retailers Marks & Spencer, Co-op, and Harrods by impersonating employees and convincing service desk agents to reset credentials and disable multi-factor authentication, according to Bleeping Computer.

If you manage or work at an organisation with an IT help desk, one change matters most: require staff to verify identity through a second channel before any password reset or MFA change. A callback to a verified internal number — not the number the caller provides — breaks the most common attack chain entirely.

For individuals: if your workplace IT desk ever contacts you unexpectedly, call them back on a number you looked up yourself, not one they gave you.

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities catalogue and ordered US federal civilian agencies to patch within three days under the BOD 26-04 directive, per Bleeping Computer. Three flaws affect Ubiquiti UniFi OS devices: CVE-2026-34908 (access control bypass), CVE-2026-34909 (path traversal), and CVE-2026-34910 (improper input validation allowing command injection). The fourth is the Lantronix flaw covered above.

While the mandate targets federal agencies, any organisation running these devices should treat the same deadline as their own.