Breach of the Day

In a two-week operation, Europol and law enforcement from the Netherlands, Canada, Germany, and the United States have dismantled the criminal infrastructure behind two of the internet's most active malware tools, according to The Hacker News.

Amadey and StealC were both sold as malware-as-a-service (MaaS) — a subscription-based criminal model where anyone can rent ready-made hacking tools, the same way a business might rent software. Amadey worked as a loader, quietly installing additional malicious software onto victims' machines. StealC was the harvester: once inside, it grabbed passwords, browser cookies, credit card numbers, and session data.

Authorities tore down 326 servers and 142 domains. They also identified and froze over $47 million in cryptocurrency tied to criminal activity, and recovered 27 million stolen login credentials — credentials that could have been used for fraud, ransomware, or selling on dark web markets.

The timing is notable. Days before this operation concluded, a separate action cleaned up nearly 15,000 compromised WordPress websites that were being used to spread another loader called SocGholish.

If your email address appears in any data breach notification over the coming weeks, take it seriously — these recovered credentials may surface through services like Have I Been Pwned.

What to do: Visit haveibeenpwned.com today, enter your email address, and check whether your credentials have been caught up in any known breach. If they have, change those passwords immediately and turn on two-factor authentication where possible.

A financially motivated Russian-speaking group has been running one of the most methodical credential-harvesting operations seen this year, according to SOCRadar's full report via The Hacker News. The campaign, active since February 2026, has compromised over 430,000 FortiGate firewalls worldwide.

The attack follows a ruthless five-step playbook. First, the group scanned the internet for exposed FortiGate devices using tools like Masscan and Shodan. Then, they forced their way in through credential stuffing (trying stolen username and password combinations across many targets) and dictionary attacks against admin panels and VPN portals.

Once inside, they deployed a Golang-based (Google's programming language, often used to build fast, cross-platform tools) tool called FortigateSniffer. It exploits a built-in FortiOS diagnostic command to passively intercept live authentication traffic, like slipping a tap onto a telephone wire. The sniffer captured credentials across 24 protocols — everything from LDAP to RDP to MySQL.

The haul was staggering in its precision: 110 million credentials total, including 14.8 million RADIUS credentials, 924,000 NTLM hashes, 130,000 Kerberos hashes, and 89 million MySQL authentication tokens. Password hashes were cracked and fed into lateral movement (moving deeper through a network after initial access) across Active Directory environments.

Small and medium businesses with under 200 employees were the primary targets, particularly in IT services, the US, and India. Breaching IT service providers gives attackers a shortcut into their clients' systems.

What to do: If your organisation uses FortiGate devices, check for unrecognised SSH sessions or unexpected sniffer processes running on your firewall. Rotate all administrative credentials immediately. Enable multi-factor authentication on every exposed admin panel and VPN portal.

If you paid for a ShapedPlugin Pro plugin and updated it recently, you may have installed a backdoor alongside it.

Attackers broke into ShapedPlugin's build and distribution pipeline — the system responsible for packaging and delivering software updates — and quietly injected malicious code into three Pro plugin releases: Product Slider Pro for WooCommerce (versions before 3.5.4), Real Testimonials Pro (version 3.2.5), and Smart Post Show Pro (versions before 4.0.2). Free versions on WordPress.org were not affected.

The attack carries CVE-2026-49777 (CVSS 10.0 — the maximum possible score) for the Product Slider Pro compromise specifically, and CVE-2026-10735 (CVSS 9.8 — Critical) covering the wider incident.

Once a compromised plugin was installed, it silently fetched a payload from a remote server, activated it as a fake plugin hidden from the WordPress admin panel, then erased itself to cover its tracks. What it left behind was considerably worse: a persistent backdoor capable of writing arbitrary files, a web shell (a remote command-execution tool embedded in the server), and a credential harvester that captured login details and two-factor authentication codes in plain text.

Before deleting itself, it also extracted the full contents of your site's configuration file — including database credentials and encryption keys — all administrator account details, email plugin credentials, and three months of WooCommerce order data.

ShapedPlugin has confirmed the breach. New versions are expected to be released pending full security reviews, though no release dates have been confirmed.

What to do:

1. Check if you're running Product Slider Pro for WooCommerce (before 3.5.4), Real Testimonials Pro (3.2.5), or Smart Post Show Pro (before 4.0.2). If yes, treat your site as compromised.
2. Reset every password — WordPress admin accounts, database, hosting panel, and email credentials.
3. Revoke and regenerate 2FA secrets for all users.
4. Audit your administrator accounts list for any accounts you did not create.
5. Check your mail plugin settings for modified SMTP credentials.
6. Once clean, update to patched versions as soon as ShapedPlugin releases them.

Researchers at Elastic Security Labs have uncovered a new malware campaign, codenamed REF8372, that uses purchased Google Ads to direct victims to a fake website impersonating the Node.js download page. Node.js is a widely used software runtime that developers install to build and run web applications.

Here is how it works. Someone searches for something ordinary — like the latest version of Node.js — and a sponsored result appears at the top. It looks legitimate. They click it, land on a convincing fake site, and download what appears to be a setup file. That file silently installs a loader called OXLOADER, which in turn drops CastleStealer, a password-stealing program that targets saved browser credentials, cookies, and other sensitive data.

The campaign is believed to be run by a financially motivated, Russian-speaking group. The attackers deliberately excluded machines in CIS (Commonwealth of Independent States — former Soviet states) to avoid infecting their own region, a common pattern in financially motivated operations based there.

OXLOADER is built to be hard to catch. It uses heavy code obfuscation (techniques that make code deliberately confusing to analyse), anti-sandbox measures, and self-modifying decryption to slip past automated security tools. Early detection rates are low.

The advertiser account was removed by Google on 14 May 2026, but the campaign machinery — fake sites, payloads, the full infrastructure — is still being studied.

What you should do: If you recently downloaded Node.js or any developer tool via a search engine result, verify the download came from the official site at nodejs.org. If you are unsure, run a scan with your antivirus software immediately.

A new ransomware operation called Prinz Eugen is hitting victims without ever explaining why. According to researchers at ThreatDown (Malwarebytes' enterprise security arm), the group leaves no ransom note at all — victims discover the attack only after their most recently modified files are already encrypted.

The group works hands-on-keyboard rather than relying on automated tools. Initial access starts with stolen RDP (Remote Desktop Protocol — remote login access to a computer) credentials. Once inside, an operator manually downloads and runs the main payload, a file named servertool.exe, rather than letting malware spread on its own. In one investigated case, the attackers installed RemotePC, a legitimate remote-access tool, and created a hidden backdoor administrator account to maintain access even if the original entry point closed.

Unlike most modern ransomware crews, Prinz Eugen does not run as a ransomware-as-a-service (RaaS — a model where developers rent their ransomware out to other criminals) operation. There is no affiliate program, no recruitment drive, just a small group working directly.

The file-prioritisation detail matters: encrypting your newest files first means the most current, most valuable work is gone before older backups even register as a target.

What to do: Disable RDP entirely if you do not need remote access, or lock it behind multi-factor authentication if you do. Treat any RemotePC installation you did not set up yourself as a compromise indicator, and audit your administrator account list for anything unfamiliar.

According to Bleeping Computer, Microsoft has confirmed that the North Korean hacking group Sapphire Sleet — also known as BlueNoroff — carried out a supply chain attack (where attackers tamper with software before it reaches the end user, rather than hacking users directly) against Mastra AI, a framework developers use to build AI-powered applications.

The attackers first compromised a legitimate npm account — npm being the package registry where JavaScript developers download code libraries. With that account's publishing rights in hand, they pushed malicious updates to more than 140 packages. Each poisoned package quietly installed a fake dependency called easy-day-js, designed to look like the real and widely-trusted dayjs date library. It is the software equivalent of swapping out a jar of coffee for one laced with something worse, then putting it back on the shelf.

Once a developer installed any of the affected packages, the malicious code ran automatically during setup, disabled security certificate checks, contacted attacker-controlled servers, and dropped a second-stage payload. That payload ran invisibly in the background and went hunting: browser history, installed apps, running processes, and 166 cryptocurrency wallet browser extensions including MetaMask, Coinbase Wallet, and Binance Wallet.

The malware targeted Windows, macOS, and Linux. On compromised machines, Microsoft also observed a PowerShell backdoor and a malicious Windows service granting the highest level of system access. Microsoft attributes this attack to Sapphire Sleet with high confidence, noting the same group carried out a separate npm supply chain attack against the Axios HTTP client in April 2026.

What to do: If you work with JavaScript or AI development tools, audit your recent npm installs for any @mastra scoped packages. Rotate any API keys, authentication tokens, or credentials stored on affected machines. Check whether Microsoft Defender has had any exclusions added that you did not authorise.

CISA is urging Fortinet customers to lock down their FortiGate firewalls and VPNs after a credential-harvesting campaign, dubbed FortiBleed, compiled a working database of more than 86,644 logins across 194 countries, according to SecurityWeek. That's roughly half of all internet-facing Fortinet devices worldwide.

The campaign, believed to involve Russian-speaking attackers, didn't need anything fancy. Per BleepingComputer, generic admin accounts made up 35% of stolen credentials and built-in factory accounts made up another 28%. Translation: more than six in ten compromised logins existed because someone never bothered to change the default password or rotate it after setup. The rest came from accounts created by individual organizations, meaning attackers got in some other way too.

Security researcher Kevin Beaumont confirmed with affected organizations that the stolen logins still work and are fairly recent. With valid credentials to a firewall or VPN, an attacker effectively has the keys to the building's front gate.

What to do: If your organization runs a FortiGate device, assume your credentials are in that database. Rotate every password tied to it today, disable any default or factory accounts you haven't touched, and check your login logs for sign-ins from unfamiliar locations.

A security researcher discovered an exposed database containing login credentials for more than 73,000 Fortinet and FortiGate VPN devices, in plaintext, according to BleepingComputer. Big names show up in the data, including Chevron, Samsung, Toyota, and AT&T.

The attackers reportedly ran billions of password-guessing attempts against FortiGate VPNs, the boxes companies use to let employees connect securely from outside the office. Once a password worked, they grabbed login session data, cracked it with a cluster of graphics cards, and used the credentials to move deeper into company networks. They also left behind details on each victim's industry, revenue, and headcount, information that reads like a target list for follow-up attacks.

This is not a new software flaw. It is the result of weak or reused passwords being ground down at industrial scale, then the spoils left sitting on an open server for anyone to find.

What to do: If your organization uses a FortiGate VPN, assume your credentials may already be in this leak. Reset every VPN password today and require MFA, a second verification step beyond a password, for all VPN logins. If you are an individual employee, change your VPN password now and report any suspicious login alerts to your IT team immediately.

iRhythm Holdings, a digital health company that makes wearable cardiac monitoring patches, has disclosed a data breach after attackers broke into third-party-hosted business applications and made off with patient personal and health information. According to a filing with the U.S. Securities and Exchange Commission, the company discovered the intrusion on June 15 — one day after receiving a ransom demand from the attackers, who had first made contact on June 9 threatening to publish the stolen data online. iRhythm has not attributed the attack to a specific threat actor or extortion group.

The scale of the potential exposure is significant. iRhythm's cardiac monitoring service has processed data from over 12 million patients, representing more than 2 billion hours of heartbeat recordings. The company has not confirmed exactly how many patients are affected or precisely what data was taken, but the attackers claim it includes sensitive proprietary and patient information.

iRhythm says external cybersecurity experts are now involved and its incident response plan has been activated.

What you should do: If you have ever used an iRhythm cardiac monitoring device, watch for a notification letter from the company. Be alert to phishing attempts (scam messages designed to look like official communications) using your health information as bait — attackers who hold medical data often use it to make follow-up scams appear more convincing. Do not respond to any unsolicited contact claiming to be from iRhythm until you have verified it through their official website.

PushEngage, OptinMonster, and TrustPulse are three widely-used WordPress plugins — tools that add functionality to WordPress sites, the platform that powers a large share of the internet — all run by one company, Awesome Motive. They handle push notifications, lead capture forms, and trust badges for millions of sites.

An attacker tampered with the JavaScript files these plugins load from external servers. The malicious code had one specific trigger: it only activated when a site administrator was logged in at the moment the script loaded. When that condition was met, the code quietly created a new admin account under the attacker's control and installed a backdoor (a concealed access point that allows re-entry even after the original intrusion is discovered).

Ordinary visitors never triggered it. Only the site's own admin did — unknowingly, just by doing their job.

Security firm Sansec uncovered the campaign on June 13, finding identical malicious code across all three plugins. PushEngage confirmed the incident the following day. As of June 15, Awesome Motive had not publicly addressed OptinMonster or TrustPulse.

Any site that ran these plugins during the window of compromise should be treated as fully compromised.

What to do:

1. Open your WordPress admin panel and review every listed admin account. Remove any you did not create.
2. Check your installed plugins for anything unfamiliar and delete it.
3. Update all three plugins to their latest versions immediately.
4. Ask your hosting provider to run a malware scan if you have any doubt.