Breach of the Day

North Korea-linked hackers have been quietly contaminating the tools developers use every day, according to The Hacker News.

The campaign, called PolinRider, is tied to a group known as Contagious Interview. These attackers impersonate recruiters on LinkedIn and GitHub, building fake companies with AI-generated employee profiles to appear legitimate. Developers who take the bait are tricked into running malicious code during fake job assessments.

What makes this campaign different is scale. As of April 2026, attackers had compromised 1,951 public GitHub repositories across 1,047 separate owners. They have also published 108 malicious packages across npm, Go, Composer, and one Google Chrome extension.

Here is how the infection spreads. A developer installs an infected package or opens a compromised repository in VS Code or Cursor (popular code editing tools). A hidden task file runs automatically when the folder opens. The malware then searches the developer's machine for common configuration files and injects more malicious code into them. It rewrites Git history to make those changes look like they came from the original author, so nothing appears suspicious at a glance.

The final payload delivers DEV#POPPER RAT (a remote access trojan, a tool that gives attackers control over an infected machine) and OmniStealer, which targets credentials for cloud platforms, crypto wallets, and developer tools.

If you are a developer, treat unsolicited job outreach with real scepticism. Audit any VS Code task files in your projects. Check repository activity logs, not just the visible commit history.

Stelios Kouloglou sat on the European Parliament's PEGA Committee — the body set up specifically to investigate how Pegasus spyware was being misused across Europe. According to a new Citizen Lab report, his iPhone was infected with Pegasus at least three times while he served on that very committee.

Pegasus is a commercial surveillance tool made by Israeli firm NSO Group. Once on a phone, it can silently read messages, listen through the microphone, access documents, and monitor calls. The attacker used a zero-click exploit (a method requiring no action from the target — no tap, no link, nothing) in Apple's HomeKit smart home software, codenamed PWNYOURHOME. Kouloglou's phone was running iOS 15.5 at the time of each infection; Apple patched the exploit in iOS 16.3.1.

The infections occurred on October 21, 2022, and again on March 6 and 7, 2023 — the second set coinciding with final drafting discussions for the committee's report. Citizen Lab found evidence that confidential documents and committee deliberations may have been exposed.

No government has been formally attributed. However, Citizen Lab noted an overlap between the first infection and a separate campaign targeting Russian and Belarusian-speaking journalists and activists in Europe, suggesting a single Pegasus operator with reach across multiple EU countries.

Kouloglou received Apple's mercenary spyware threat notifications on three separate occasions. He is the first confirmed PEGA Committee member publicly identified as a Pegasus target while serving.

What you should do: Enable Lockdown Mode on your iPhone if you are a journalist, activist, or work in any politically sensitive role. Go to Settings → Privacy & Security → Lockdown Mode. It restricts some functionality but blocks the class of exploits used here.

Google's Threat Intelligence Group, working alongside the FBI and networking firm Lumen, has significantly disrupted NetNut — a residential proxy network (a service that rents out real home internet addresses so that other people's traffic can be disguised as ordinary household browsing) that had quietly embedded itself into at least 2 million home devices, including smart TVs and streaming boxes, according to The Hacker News.

Here is what that means in practice: once NetNut's software lands on your device, it becomes an "exit node" — a doorway that other people's internet traffic flows through. Your home IP address gets credited for whatever that traffic does, whether it is credential stuffing (automated password-guessing attacks run against thousands of accounts at once) or hiding the location of espionage groups. In a single week last June, Google counted 316 distinct threat groups using suspected NetNut exit nodes.

The software arrives two ways: pre-installed on cheap off-brand hardware, or bundled into free apps that never clearly ask for your consent. Researchers tested over 20 apps carrying this software and found that not one of them showed users a consent prompt. NetNut's parent company, Israeli firm Alarum Technologies, rejects the botnet label and calls the research inaccurate. The researchers' testing tells a different story.

Google describes this as degradation, not elimination. NetNut runs a reseller program, so its network lives inside dozens of brands that look independent but draw from the same pool.

What you should do: Check your home network's device list for anything unfamiliar — especially cheap streaming sticks or off-brand smart TVs. If you bought a no-name streaming device cheaply, consider replacing it with a trusted brand. Running your router's connected-devices list monthly is a good habit regardless.

Security firm Sysdig has documented what it believes is the first ransomware attack run entirely by an AI agent, according to The Hacker News. The attacker group, tracked as JADEPUFFER, handed the job to a large language model, which handled every step without a human at the keyboard.

The way in was a known vulnerability in Langflow, an open-source tool used to build AI-powered app workflows. The flaw, CVE-2025-3248, allowed anyone to run code on an exposed server without logging in first — no credentials required. Many servers were still running the unfixed version despite a patch being available since 2025.

Once inside, the agent swept the machine for useful secrets: API keys for OpenAI, Anthropic, and cloud platforms including AWS and Azure, plus database credentials. It also walked straight into a connected storage server using the factory-default password that had never been changed.

The agent then pivoted to a production database, took control of the service directory through a separate 2021 authentication bypass, and encrypted 1,342 configuration records before dropping tables entirely. It left a ransom note demanding Bitcoin payment.

Here is the problem: the agent generated a random encryption key, printed it once to the terminal, and never stored or sent it anywhere. There is no key. Paying would accomplish nothing.

The clearest evidence that an AI was driving? The attack code was full of plain-English comments explaining each step as it ran — exactly what a language model produces by default, and exactly what a human attacker never bothers to write.

What to do: Search your systems for exposed Langflow servers and confirm they are running version 1.3.0 or later. Change every default credential on every service you operate — factory passwords like minioadmin:minioadmin are a standing invitation.

Between 12 and 26 June 2026, attackers launched a massive automated password spray attack against Microsoft's Azure CLI (command-line interface, a tool used by developers and IT teams to manage cloud services), according to Huntress. The result: 78 accounts compromised across 64 organisations, with 30 of those accounts falling in a single day on 22 June.

What makes this unusual is how the attackers got past MFA (multi-factor authentication, the extra verification step beyond your password). They used a deprecated OAuth flow called ROPC (Resource Owner Password Credentials), a legacy login method that sends usernames and passwords directly to Microsoft's servers without triggering the usual MFA checks. Think of it like a side door that was supposed to be locked but still opens if you know the old key.

Many of the targeted organisations had MFA enabled, but their policies had gaps: MFA was only enforced for specific apps, specific user groups, or specific locations, leaving Azure CLI logins uncovered. Eight organisations had no MFA at all.

The attack drew on previously leaked password lists, so accounts that had never had their old passwords rotated were especially exposed.

What you should do: Check that your Microsoft MFA policies cover all cloud apps, not just selected ones. If you manage Azure accounts, disable the ROPC authentication flow entirely. Huntress recommends reviewing your Conditional Access policies for gaps.

Oracle E-Business Suite — enterprise software used by large organisations to manage finance, procurement, and operations — has a critical flaw in its Payments module that attackers are already exploiting, according to The Hacker News.

The vulnerability, CVE-2026-46817, carries a CVSS score of 9.8 (Critical). It allows anyone on a network to take full control of the Oracle Payments system without logging in first. Think of it like a bank vault where the lock mechanism responds to any key — including one the attacker made themselves five minutes ago.

What makes this notable is that no public proof-of-concept (a working demonstration of how the exploit works) exists. Researchers at Defused Cyber spotted the attacks over the weekend on systems set up specifically to attract attackers. Whoever is doing this worked it out independently.

Oracle issued a patch last month as part of its Critical Security Patch Update. That patch exists. The organisations being hit simply have not applied it.

This follows a pattern with Oracle's enterprise products. An earlier flaw in Oracle PeopleSoft Suite was exploited by the ShinyHunters group to steal employee records from Nissan — including payroll data, bank details, and Social Security numbers for workers across four countries.

What you should do: If your organisation runs Oracle E-Business Suite versions 12.2.3 through 12.2.15, confirm with your IT team that last month's Critical Security Patch Update has been applied. If you are unsure, assume it has not been and escalate today.

KDDI Corporation, one of Japan's largest telecoms operators, has confirmed a breach of its email systems affecting up to 14.22 million accounts across five partner ISPs, according to Bleeping Computer.

The attackers got in by exploiting a vulnerability in unnamed third-party software running on KDDI's email platform. Once inside, they had potential access to email addresses and passwords belonging to customers of STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE — past and present. Inactive accounts were also caught in the net.

KDDI discovered the intrusion on June 17 and moved quickly to block the attacker and notify Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications. The investigation is still ongoing.

There is some partial good news: a portion of passwords were stored in hashed or encrypted form, which adds a layer of protection even if the data was lifted. The problem is KDDI has not confirmed what percentage were stored that way, nor the strength of the encryption used. Some may have been stored in plaintext. That is the kind of vagueness that should worry you.

What the attacker wanted is not difficult to guess. Fresh email credentials are valuable for account takeovers, spam campaigns, and credential stuffing (where stolen username and password pairs are tried automatically across other services — think banking, shopping, anything you reuse that password on).

What you should do: If you are a customer of STNet, JCOM, Chubu Telecommunications, NIFTY, or BIGLOBE, reset your email password now. Then check every account where you used that same password and change those too. Enable two-factor authentication (2FA) on your email if it is available — it means a stolen password alone is no longer enough to break in.

According to The Hacker News, Ukraine's Security Service (SSU) and the FBI have jointly uncovered a sustained Russian intelligence campaign targeting messaging accounts belonging to government officials, military personnel, politicians, and activists across Ukraine, Europe, and the US.

The method is straightforward and effective. Attackers send SMS messages pretending to be the official support team for platforms like Signal and WhatsApp. The messages pressure targets into handing over account credentials, confirmation codes, or recovery keys.

This is social engineering (manipulating people rather than software to gain access) at its most targeted. The SSU linked similar campaigns to Russian threat groups including Star Blizzard and UNC5792, though it stopped short of attributing this specific operation to a named group.

If an attacker gets your recovery key, they can clone your messaging account to a device you have never seen. Every message you send or receive from that point forward goes to them too.

The FBI separately confirmed Russian intelligence is running a parallel phishing campaign aimed at tricking high-value targets into surrendering their backup recovery keys for commercial messaging apps.

What you should do: Open your Signal or WhatsApp settings and review all active linked devices right now. Remove anything you do not recognise. Enable two-factor authentication if you have not already, and never share confirmation codes, PINs, or recovery keys with anyone claiming to be platform support — the real support team will never ask for them.

Kaspersky has uncovered a broad espionage campaign, according to The Hacker News, targeting diplomatic and government organisations across Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.

The attackers, believed to be Chinese-speaking based on their tooling choices, are calling their loader SharkLoader. The campaign itself is tracked as StrikeShark. The goal is to deliver Cobalt Strike Beacon, a popular post-compromise tool that gives attackers full remote control of an infected machine.

Getting in is the first step, and the group is not picky about how. They are exploiting a long list of known vulnerabilities in widely used software including Microsoft Exchange Server, Cisco IOS XE Web UI, F5 BIG-IP, and Fortinet FortiOS, using publicly available proof-of-concept exploit code. Once inside, they plant web shells (hidden scripts on a compromised server that give attackers ongoing remote access) or disguise their malware as familiar applications like Google Update or Cisco AnyConnect.

SharkLoader then loads a chain of components that ultimately delivers Cobalt Strike into memory in a way designed to dodge security tools. One technique involves hooking the Sleep function — a standard Windows operation — to copy malicious code into memory only when a scanner is not actively looking. Think of it like a burglar who freezes the moment a security camera pans their way, then moves the moment it turns back.

No specific victim count has been published, but the campaign spans at least nine countries across four continents.

What you should do: If your organisation runs any of the software listed above, check whether all patches are current. Start with Exchange Server, Fortinet, and Cisco IOS XE. If you run web-facing software and have not reviewed your server logs recently, now is the time.

Since April 2026, hotel front-desk staff across Europe and Asia have been receiving emails that look like legitimate guest complaints, according to Microsoft's threat intelligence team. The emails mention bedbug reports, health inspections, and stay reviews — exactly the kind of thing a hotel worker feels pressure to click on immediately. The sender display name reads "Booking Manager (via Calendly)", and the messages have arrived in Japanese, Danish, and Dutch.

Here is what makes this one harder to catch than most. The attackers route their emails through Calendly's notification system and Google's redirect service, so standard email authentication checks — the kind your mail server runs automatically to verify a sender is legitimate — actually pass. The email really did come from Calendly's servers. Those checks cannot tell you what the message is for.

Click the link, and you land on a fresh domain hiding behind Cloudflare's bot-detection system. That challenge also blocks automated security scanners from analysing the page. Pass the challenge and you download a ZIP file. Inside is a file disguised as a photo — but opening it fires PowerShell, which quietly installs a legitimate Node.js runtime and runs a JavaScript implant called TonRAT. The implant uses the TON blockchain to look up its command server on the fly, making it harder to block with static lists.

No confirmed data theft has been reported yet, but the access is persistent and the attacker's intent is still unknown. That combination is worth taking seriously.

What to do: If you work in hospitality, or know someone who does, treat any email referencing guest complaints or inspections as suspicious — especially ones with ZIP attachments. Do not open files from unexpected booking-related emails, even if the sender looks familiar.