SharkLoader Is Hunting Diplomats Across 9 Countries

Kaspersky has uncovered a broad espionage campaign, according to The Hacker News, targeting diplomatic and government organisations across Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.

The attackers, believed to be Chinese-speaking based on their tooling choices, are calling their loader SharkLoader. The campaign itself is tracked as StrikeShark. The goal is to deliver Cobalt Strike Beacon, a popular post-compromise tool that gives attackers full remote control of an infected machine.

Getting in is the first step, and the group is not picky about how. They are exploiting a long list of known vulnerabilities in widely used software including Microsoft Exchange Server, Cisco IOS XE Web UI, F5 BIG-IP, and Fortinet FortiOS, using publicly available proof-of-concept exploit code. Once inside, they plant web shells (hidden scripts on a compromised server that give attackers ongoing remote access) or disguise their malware as familiar applications like Google Update or Cisco AnyConnect.

SharkLoader then loads a chain of components that ultimately delivers Cobalt Strike into memory in a way designed to dodge security tools. One technique involves hooking the Sleep function — a standard Windows operation — to copy malicious code into memory only when a scanner is not actively looking. Think of it like a burglar who freezes the moment a security camera pans their way, then moves the moment it turns back.

No specific victim count has been published, but the campaign spans at least nine countries across four continents.

What you should do: If your organisation runs any of the software listed above, check whether all patches are current. Start with Exchange Server, Fortinet, and Cisco IOS XE. If you run web-facing software and have not reviewed your server logs recently, now is the time.

A detailed analysis published on The Hacker News this week puts into words a problem that security teams are quietly watching get worse: AI agents are operating inside corporate systems with inherited access that was never designed for them.

Here is the mechanism. An AI agent assigned to a task does not have its own tightly scoped permissions. It borrows the identity and access tokens of the human or service account it operates on behalf of. A sales director's AI assistant carries that director's credentials — including years of accumulated access from old roles — and can traverse a CRM, a code repository, and internal APIs in a single session, all without triggering a standard authentication checkpoint.

Traditional identity systems log the moment someone logs in. They do not track what happens inside the session. AI agents authenticate once, then move continuously through systems and data without a governance layer ever checking whether a specific action was actually authorised. That is the gap.

If your organisation is deploying AI agents, now is the moment to ask what identity and permissions they are inheriting, and whether your logging actually captures what they are doing after login.

What Amazon Q Developer is: Amazon Q Developer is an AI-powered coding assistant, built as a Visual Studio Code extension, that offers code suggestions, automated refactoring, and the ability to connect to external tools and services.

What it is: A high-severity flaw in how the extension handled Model Context Protocol (MCP) servers — local processes an AI assistant can spawn to reach databases, APIs, or build tools. The extension would automatically read and act on an MCP configuration file found inside an open workspace, without asking the user for permission first.

Who's at risk: Any developer who opens a repository containing a malicious .amazonq/mcp.json file in an unpatched version of the extension. No special privileges are needed on the attacker's side — just getting a developer to open the repo.

CVSS: 8.5 (High — patch this week.)

Root cause: The extension trusted configuration files found in an open workspace without first confirming the user wanted to run what those files defined. Treating a file dropped into a folder as an instruction to execute, rather than as untrusted input to review, is the entire flaw.

Attack vector: An attacker plants a .amazonq/mcp.json file inside a public or shared repository. When a developer opens that repository in VS Code with Amazon Q Developer installed, the extension reads the file and launches the MCP server it defines — as a local process that inherits the developer's full environment, including AWS keys and other cloud credentials loaded in that session. From git clone to cloud compromise takes a single workspace open, no further clicks required.

Detection strategies:

1. Review any repository opened recently for an unexpected .amazonq/mcp.json file, especially one not committed by a known contributor.
2. Audit AWS CloudTrail logs for API calls made shortly after a developer's IDE session began, particularly from credentials tied to a workstation rather than a service role.
3. Check Amazon Q Developer's extension version against AWS's patched release — anything before May 12, 2026 is exposed.

Recommended actions:

1. Update the Amazon Q Developer extension to the patched version immediately.
2. Rotate any AWS credentials that were active in a VS Code session where an untrusted repository was opened.
3. Treat any repository-supplied configuration file as untrusted input — review it before opening the workspace in an editor with AI-assistant integrations enabled.

Russian intelligence groups are actively phishing Signal users out of their Backup Recovery Keys, according to an updated FBI and CISA advisory covered by The Hacker News. Hand that key to an attacker and they can restore your entire message history and take over the account. The old key keeps working even after you change devices.

The fix is fast. Open Signal, go to Settings > Linked Devices, and remove anything unfamiliar. Then go to Settings > Account > Backups and generate a new Recovery Key. That kills the old one.

One firm rule: Signal support does not message you inside the app. Any message asking for your Recovery Key, a PIN, or a verification code is an attack. Treat it as one.

This applies to high-profile targets first, but the tactics will broaden. Anyone using Signal for sensitive conversations should do this today.

CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and given federal agencies until June 28 to patch both, per Bleeping Computer.

The first is CVE-2026-20230, a server-side request forgery (SSRF) flaw (where an attacker tricks a server into making requests on their behalf) in Cisco Unified Communications Manager. The second is CVE-2026-12569, a critical flaw in PTC Windchill, a product lifecycle management platform used by manufacturers. Both are under active exploitation right now. Federal agencies must act by Sunday. Private organisations using either product should treat that deadline as their own.