https://omniware.org/threat-intel Auto-summarized cybersecurity advisories for compliance-driven teams. https://omniware.org/threat-intel/bleeping-fake-it-support-calls-on-microsoft-teams-push-etherrat-malware https://omniware.org/threat-intel/bleeping-fake-it-support-calls-on-microsoft-teams-push-etherrat-malware general Tue, 07 Jul 2026 06:13:40 GMT Threat actors are conducting social engineering campaigns using Microsoft Teams to distribute EtherRAT, a Node.js-based remote access trojan. According to Palo Alto Networks' Unit 42, the attack chain begins with phishing emails containing malicious PDF attachments labeled as "Employee Survey." Afte https://omniware.org/threat-intel/bleeping-phishing-poses-as-big-brand-job-interview-to-steal-google-accounts https://omniware.org/threat-intel/bleeping-phishing-poses-as-big-brand-job-interview-to-steal-google-accounts general Tue, 07 Jul 2026 06:13:28 GMT A phishing campaign is impersonating over 30 major brands—including Adobe, Netflix, Coca-Cola, and OpenAI—to steal Google account credentials from marketing professionals. The attackers pose as recruiters conducting fake job interviews, using real names and pictures of legitimate company staff to bu https://omniware.org/threat-intel/thn-weekly-recap-proxy-botnets-browser-ransomware-ai-agent-tricks-fake-poc-malwa https://omniware.org/threat-intel/thn-weekly-recap-proxy-botnets-browser-ransomware-ai-agent-tricks-fake-poc-malwa general Tue, 07 Jul 2026 06:13:16 GMT The weekly threat recap highlights multiple attack vectors exploiting trust mechanisms across consumer and enterprise systems. Google and the FBI disrupted the NetNut residential proxy botnet, which compromised an estimated 2 million devices globally—primarily smart TVs and streaming boxes—by distri https://omniware.org/threat-intel/cve-cve-2026-14622-a-vulnerability-was-found-in-jairiidriss-restaurant-website-p https://omniware.org/threat-intel/cve-cve-2026-14622-a-vulnerability-was-found-in-jairiidriss-restaurant-website-p compliance Mon, 06 Jul 2026 06:59:35 GMT A missing authentication vulnerability was identified in jairiidriss restaurant-website-php-mysql affecting the AJAX Endpoint component at the /admin/ajax_files file. According to MITRE's National Vulnerability Database, the vulnerability allows remote manipulation without authentication. The produc https://omniware.org/threat-intel/thn-fortibleed-credential-theft-linked-to-inc-and-lynx-ransomware-operations https://omniware.org/threat-intel/thn-fortibleed-credential-theft-linked-to-inc-and-lynx-ransomware-operations defense Mon, 06 Jul 2026 06:59:22 GMT Security researchers at SOCRadar have attributed the FortiBleed credential-theft campaign to operators working with INC Ransom and Lynx ransomware groups. The campaign scanned approximately 11,250 FortiGate portals across 150+ countries, achieving admin-level access on 409 targets and completing the https://omniware.org/threat-intel/bleeping-jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack https://omniware.org/threat-intel/bleeping-jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack general Mon, 06 Jul 2026 06:59:10 GMT Researchers have documented what appears to be the first ransomware operation conducted entirely by an LLM agent. The attack, attributed to JadePuffer, reportedly used an AI agent to automate the full attack lifecycle—from initial reconnaissance through encryption and ransom demands. The operation d https://omniware.org/threat-intel/cve-cve-2026-20896-gitea-docker-image-versions-up-to-and-including-1-26-2-use-re https://omniware.org/threat-intel/cve-cve-2026-20896-gitea-docker-image-versions-up-to-and-including-1-26-2-use-re general Sun, 05 Jul 2026 17:21:45 GMT Gitea Docker image versions up to and including 1.26.2 contain a misconfiguration where REVERSE_PROXY_TRUSTED_PROXIES is set to * by default. This allows any source IP to impersonate users when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled. According to the CVE record, the https://omniware.org/threat-intel/cve-cve-2026-12481-a-vulnerability-in-keras-team-keras-version-3-14-0-allows-for https://omniware.org/threat-intel/cve-cve-2026-12481-a-vulnerability-in-keras-team-keras-version-3-14-0-allows-for general Sun, 05 Jul 2026 17:21:35 GMT A vulnerability in keras-team/keras version 3.14.0 allows arbitrary code execution through improper deserialization handling in the Lambda layer. The `_raise_for_lambda_deserialization()` function fails to enforce safe-mode protections when `safe_mode` is set to `None` (its default value), conflatin https://omniware.org/threat-intel/thn-u-s-government-entity-paid-kairos-1-million-in-data-theft-extortion-case https://omniware.org/threat-intel/thn-u-s-government-entity-paid-kairos-1-million-in-data-theft-extortion-case general Sun, 05 Jul 2026 17:21:20 GMT A U.S. government entity paid approximately $1 million to the group Kairos to prevent the publication of stolen files, according to a case study by Rakesh Krishnan published by Ransom-ISAC. The analysis, based on leaked negotiation chat logs and blockchain records, indicates the victim was Union Cou https://omniware.org/threat-intel/thn-threatsday-ai-compute-hijacking-apple-email-flaw-bluehammer-ransomware-14-st https://omniware.org/threat-intel/thn-threatsday-ai-compute-hijacking-apple-email-flaw-bluehammer-ransomware-14-st general Sat, 04 Jul 2026 06:46:15 GMT TheHackerNews reported on multiple security findings this week spanning AI systems, email services, and ransomware campaigns. A phishing campaign targets small businesses globally with fake law enforcement investigation emails, directing victims to password-protected archives hosted on Proton Drive https://omniware.org/threat-intel/thn-unpatched-flaws-disclosed-in-filesystem-bundled-into-millions-of-embedded-de https://omniware.org/threat-intel/thn-unpatched-flaws-disclosed-in-filesystem-bundled-into-millions-of-embedded-de defense Sat, 04 Jul 2026 06:46:02 GMT Security firm runZero has disclosed seven vulnerabilities in FatFs, a filesystem library used in millions of embedded devices including security cameras, drones, industrial controllers, hardware crypto wallets, and real-time operating systems. The flaws range from CVSS 4.6 to 7.6 (Medium to High sev https://omniware.org/threat-intel/bleeping-netnut-proxy-network-disrupted-2-million-infected-devices-cut-off https://omniware.org/threat-intel/bleeping-netnut-proxy-network-disrupted-2-million-infected-devices-cut-off general Sat, 04 Jul 2026 06:45:51 GMT Google and law enforcement, including the FBI, disrupted NetNut (also known as Popa), a residential proxy botnet estimated to control at least two million compromised devices globally, including smart TVs and streaming boxes. The network was powered by trojanized applications and botnets such as Bad https://omniware.org/threat-intel/bleeping-dhs-confirms-hackers-breached-hsin-info-sharing-platform https://omniware.org/threat-intel/bleeping-dhs-confirms-hackers-breached-hsin-info-sharing-platform defense Fri, 03 Jul 2026 15:33:32 GMT The Department of Homeland Security confirmed a cyberattack on the Homeland Security Information Network (HSIN), an unclassified information-sharing platform used by federal, state, local, and private-sector partners. According to DHS and reporting by Nextgov, the intrusion occurred between late May https://omniware.org/threat-intel/thn-google-disrupts-netnut-residential-proxy-network-spanning-2-million-home-dev https://omniware.org/threat-intel/thn-google-disrupts-netnut-residential-proxy-network-spanning-2-million-home-dev general Fri, 03 Jul 2026 15:33:22 GMT Google's Threat Intelligence Group, working with the FBI, Lumen, and others, has significantly degraded NetNut (also tracked as Popa), a residential proxy network estimated to span at least 2 million compromised home devices including smart TVs and streaming boxes. The network allows attackers to re https://omniware.org/threat-intel/thn-ransomware-groups-turn-to-citrix-bleed-2-byovd-and-supply-chain-credentials https://omniware.org/threat-intel/thn-ransomware-groups-turn-to-citrix-bleed-2-byovd-and-supply-chain-credentials general Fri, 03 Jul 2026 15:33:01 GMT Threat actors affiliated with the Anubis ransomware-as-a-service operation have been observed exploiting Citrix Bleed 2 (CVE-2025-5777, CVSS 9.3) to gain initial access to target environments, according to Arctic Wolf. The attackers combine this vulnerability with valid VPN credentials—sourced throu https://omniware.org/threat-intel/bleeping-cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited https://omniware.org/threat-intel/bleeping-cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited defense Thu, 02 Jul 2026 16:53:31 GMT The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that a high-severity Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659) is now being actively exploited in the wild. The flaw stems from unsafe deserialization of untrusted data and allows authenticated https://omniware.org/threat-intel/bleeping-fortibleed-credential-theft-campaign-linked-to-lynx-ransomware https://omniware.org/threat-intel/bleeping-fortibleed-credential-theft-campaign-linked-to-lynx-ransomware general Thu, 02 Jul 2026 16:53:23 GMT A credential-theft campaign dubbed "FortiBleed" has been linked to members of the INC and Lynx ransomware-as-a-service groups. Researchers discovered an exposed server containing credentials stolen from more than 73,000 Fortinet devices, along with downloaded FortiGate configuration files and infras https://omniware.org/threat-intel/bleeping-medtronic-notifies-customers-impacted-by-shinyhunters-data-breach https://omniware.org/threat-intel/bleeping-medtronic-notifies-customers-impacted-by-shinyhunters-data-breach healthcare Thu, 02 Jul 2026 16:53:12 GMT Medtronic, a global medical device manufacturer, is notifying customers of a data breach affecting its corporate IT systems. According to the company's notification, unauthorized actors accessed certain systems between April 13 and April 19, 2026, after the company discovered unusual activity on Apr https://omniware.org/threat-intel/thn-citrix-patches-six-netscaler-flaws-allowing-file-read-and-denial-of-service https://omniware.org/threat-intel/thn-citrix-patches-six-netscaler-flaws-allowing-file-read-and-denial-of-service defense Wed, 01 Jul 2026 09:42:35 GMT Citrix released security updates addressing six vulnerabilities in NetScaler ADC and NetScaler Gateway. The flaws range from CVSS 6.9 to 8.8 and include memory overflow issues, insufficient input validation, and file-read vulnerabilities. Affected configurations include SAML IDP, gateway/AAA virtual https://omniware.org/threat-intel/thn-oracle-e-business-suite-flaw-cve-2026-46817-actively-exploited-in-the-wild https://omniware.org/threat-intel/thn-oracle-e-business-suite-flaw-cve-2026-46817-actively-exploited-in-the-wild defense Wed, 01 Jul 2026 09:42:23 GMT Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected by CVE-2026-46817, a critical privilege management and authentication flaw in Oracle Payments (CVSS 9.8). According to Defused Cyber, the vulnerability allows unauthenticated attackers with network access via HTTP to compromise Ora https://omniware.org/threat-intel/bleeping-insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack https://omniware.org/threat-intel/bleeping-insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack fintech Wed, 01 Jul 2026 09:42:12 GMT Aflac, a Fortune 500 supplemental insurance provider, disclosed a data breach affecting its Japan subsidiary on June 30, 2026. Threat actors gained unauthorized access to Aflac Japan's systems between June 15 and June 25, 2026, affecting 4.38 million customers. The attackers accessed files containin https://omniware.org/threat-intel/bleeping-naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach https://omniware.org/threat-intel/bleeping-naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach compliance Tue, 30 Jun 2026 18:36:51 GMT The National Association of Insurance Commissioners (NAIC) confirmed that the ShinyHunters extortion group breached its Oracle PeopleSoft systems by exploiting a zero-day vulnerability (CVE-2026-35273). The unauthorized access occurred in June 2026. NAIC states that the stolen data consisted of publ https://omniware.org/threat-intel/bleeping-nissan-discloses-employee-data-breach-linked-to-oracle-zero-day-attacks https://omniware.org/threat-intel/bleeping-nissan-discloses-employee-data-breach-linked-to-oracle-zero-day-attacks general Tue, 30 Jun 2026 18:36:43 GMT Nissan disclosed a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft zero-day vulnerability. According to breach notifications filed with the California Attorney General's Office, the attack was part of a broader campaign attributed to the ShinyHun https://omniware.org/threat-intel/bleeping-cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs https://omniware.org/threat-intel/bleeping-cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs defense Tue, 30 Jun 2026 18:36:35 GMT CISA confirmed that ransomware gangs have begun exploiting CVE-2026-33825, a high-severity Microsoft Defender privilege escalation vulnerability dubbed BlueHammer. The flaw allows an authorized local attacker to escalate privileges and access the Security Account Manager (SAM) database containing pa https://omniware.org/threat-intel/cve-cve-2026-13486-a-vulnerability-was-determined-in-sourcecodester-class-and-ex https://omniware.org/threat-intel/cve-cve-2026-13486-a-vulnerability-was-determined-in-sourcecodester-class-and-ex general Mon, 29 Jun 2026 11:46:59 GMT A SQL injection vulnerability was identified in SourceCodester's Class and Exam Timetabling System version 1.0, affecting the /preview6.php file. The vulnerability exists in the course_year_section parameter and can be exploited remotely without authentication or user interaction. The exploit has be https://omniware.org/threat-intel/cve-cve-2026-13485-a-vulnerability-was-found-in-sourcecodester-class-and-exam-ti https://omniware.org/threat-intel/cve-cve-2026-13485-a-vulnerability-was-found-in-sourcecodester-class-and-exam-ti general Mon, 29 Jun 2026 11:46:55 GMT SourceCodester Class and Exam Timetabling System version 1.0 contains a SQL injection vulnerability in the /preview.php file. The flaw allows remote attackers to manipulate the course_year_section parameter to inject arbitrary SQL commands. According to the NVD record, a public exploit is available, https://omniware.org/threat-intel/cve-cve-2026-8095-the-frontend-file-manager-plugin-plugin-for-wordpress-is-vulne https://omniware.org/threat-intel/cve-cve-2026-8095-the-frontend-file-manager-plugin-plugin-for-wordpress-is-vulne saas Mon, 29 Jun 2026 11:46:42 GMT The Frontend File Manager Plugin for WordPress (versions up to 23.6) contains an authenticated arbitrary file deletion vulnerability. The flaw stems from a case-sensitive bypass in the wpfm_dir_path parameter sanitization within the wpfm_file_meta_update AJAX handler. An attacker supplying the param https://omniware.org/threat-intel/thn-the-gentlemen-raas-uses-gentlekiller-edr-framework-targeting-400-security-pr https://omniware.org/threat-intel/thn-the-gentlemen-raas-uses-gentlekiller-edr-framework-targeting-400-security-pr defense Sun, 28 Jun 2026 07:42:37 GMT The Gentlemen ransomware-as-a-service operation has developed and distributed a suite of endpoint detection and response (EDR) killer tools to its affiliates, centered on a framework called GentleKiller. According to ESET research, GentleKiller exists in eight variants that target 400 processes asso https://omniware.org/threat-intel/thn-openai-previews-gpt-5-6-sol-with-restricted-access-and-stronger-cyber-safegu https://omniware.org/threat-intel/thn-openai-previews-gpt-5-6-sol-with-restricted-access-and-stronger-cyber-safegu general Sun, 28 Jun 2026 07:42:24 GMT OpenAI released three versions of GPT-5.6—Sol, Terra, and Luna—as a limited preview to a small group of government-approved partners. Sol is the flagship model and is positioned as the most capable for cybersecurity tasks, including vulnerability research and code review. According to OpenAI, the mo https://omniware.org/threat-intel/bleeping-clean-github-repo-tricks-ai-coding-agents-into-running-malware https://omniware.org/threat-intel/bleeping-clean-github-repo-tricks-ai-coding-agents-into-running-malware general Sun, 28 Jun 2026 07:42:12 GMT Researchers at Mozilla's Zero Day Investigative Network demonstrated a technique where AI coding agents (specifically Claude Code) can be tricked into executing malicious payloads from seemingly benign GitHub repositories. The attack chains three innocuous components: a clean repository with standar https://omniware.org/threat-intel/bleeping-polymarket-customers-lose-3-million-in-supply-chain-attack https://omniware.org/threat-intel/bleeping-polymarket-customers-lose-3-million-in-supply-chain-attack fintech Sat, 27 Jun 2026 08:15:06 GMT Polymarket, a cryptocurrency prediction market platform, experienced a supply-chain attack in which malicious JavaScript was injected into its frontend through a compromised third-party vendor dependency. The injected code tricked users into approving fraudulent transactions on the official website. https://omniware.org/threat-intel/thn-miasma-malware-targets-npm-packages-and-github-actions-in-supply-chain-attac https://omniware.org/threat-intel/thn-miasma-malware-targets-npm-packages-and-github-actions-in-supply-chain-attac saas Sat, 27 Jun 2026 08:14:56 GMT Cybersecurity researchers have identified a new wave of supply chain attacks targeting npm packages and GitHub Actions, attributed to the Mini Shai-Hulud/Miasma/Hades malware family. The campaign compromised multiple npm packages associated with LeoPlatform and RStreams, as well as a Go module belon https://omniware.org/threat-intel/bleeping-cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks https://omniware.org/threat-intel/bleeping-cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks defense Sat, 27 Jun 2026 08:14:21 GMT The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has set an urgent deadline of June 28 for federal agencies to patch two critical vulnerabilities. CVE-2026-20230 affects Cisco Unified Communications Manager Server and is a server-side request forgery (SSRF) flaw exploitable remotely https://omniware.org/threat-intel/thn-google-details-turla-s-new-stockstay-backdoor-used-in-ukraine-espionage-atta https://omniware.org/threat-intel/thn-google-details-turla-s-new-stockstay-backdoor-used-in-ukraine-espionage-atta defense Fri, 26 Jun 2026 09:32:13 GMT Google Threat Intelligence Group has documented a previously unknown .NET backdoor called STOCKSTAY attributed to Russian state-sponsored actor Turla. The malware targets government and military organizations in Ukraine, as well as entities with interests in Italian foreign policy. Development activ https://omniware.org/threat-intel/thn-amadey-and-stealc-malware-network-disrupted-27m-stolen-credentials-recovered https://omniware.org/threat-intel/thn-amadey-and-stealc-malware-network-disrupted-27m-stolen-credentials-recovered general Fri, 26 Jun 2026 09:32:02 GMT Law enforcement agencies from the Netherlands, Canada, Germany, and the U.S., working with Bitdefender, Bitsight, ESET, and Microsoft, disrupted criminal infrastructure supporting Amadey and StealC malware. The operation dismantled 326 servers and 142 domains, recovered approximately 27 million stol https://omniware.org/threat-intel/bleeping-poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft https://omniware.org/threat-intel/bleeping-poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft fintech Fri, 26 Jun 2026 09:31:49 GMT Polish authorities arrested four members of an organized cybercrime group accused of conducting SIM-swapping attacks that resulted in millions of dollars in cryptocurrency theft. The Polish Cybercrime Bureau (CBZC), working with the FBI and Homeland Security Investigations, found that the suspects b https://omniware.org/threat-intel/bleeping-malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware https://omniware.org/threat-intel/bleeping-malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware general Thu, 25 Jun 2026 16:23:13 GMT A malicious Microsoft Edge extension called "Edgecution" has been used to deploy a Python-based backdoor by exploiting Chrome's Native Messaging protocol, which allows browser extensions to communicate with native desktop applications. According to Zscaler researchers, the attack begins with social https://omniware.org/threat-intel/thn-cisco-catalyst-sd-wan-zero-day-cve-2026-20245-exploited-to-gain-root-access https://omniware.org/threat-intel/thn-cisco-catalyst-sd-wan-zero-day-cve-2026-20245-exploited-to-gain-root-access general Thu, 25 Jun 2026 16:23:03 GMT According to Mandiant research, a high-severity vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245, CVSS 7.8) was exploited as a zero-day for at least two months before public disclosure. The flaw allows an authenticated local attacker with netadmin privileges to execute arbitrary commands with https://omniware.org/threat-intel/bleeping-mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access https://omniware.org/threat-intel/bleeping-mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access defense Thu, 25 Jun 2026 16:22:49 GMT Mandiant has disclosed technical details on how attackers exploited CVE-2026-20245, a high-severity command injection flaw in Cisco Catalyst SD-WAN Manager, Controller, and Validator components, to gain root access on targeted devices. The vulnerability allows authenticated attackers to execute arbi https://omniware.org/threat-intel/bleeping-cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks https://omniware.org/threat-intel/bleeping-cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks general Wed, 24 Jun 2026 16:39:12 GMT The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of multiple maximum-severity flaws in Ubiquiti UniFi OS and Lantronix serial-to-ethernet servers. Three Ubiquiti vulnerabilities (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) allow unauthenticated r https://omniware.org/threat-intel/bleeping-amadey-stealc-malware-operations-disrupted-in-operation-endgame-action https://omniware.org/threat-intel/bleeping-amadey-stealc-malware-operations-disrupted-in-operation-endgame-action general Wed, 24 Jun 2026 16:39:00 GMT Microsoft, Europol, and international law enforcement partners have disrupted infrastructure supporting the Amadey and StealC malware operations in Operation Endgame. The coordinated action took down 326 servers and 142 domains across agencies in Canada, Denmark, Germany, the Netherlands, the United https://omniware.org/threat-intel/bleeping-healthtech-firm-xolis-suffers-data-breach-impacting-1-4-million-people https://omniware.org/threat-intel/bleeping-healthtech-firm-xolis-suffers-data-breach-impacting-1-4-million-people healthcare Wed, 24 Jun 2026 16:38:49 GMT Healthcare technology company Xsolis disclosed a data breach affecting approximately 1.4 million individuals. The company detected unauthorized network activity on January 22, 2026, resulting from a targeted phishing attack that occurred two days earlier. The breach exposed sensitive personal and me https://omniware.org/threat-intel/thn-github-updates-actions-checkout-to-block-common-pwn-request-attack-patterns https://omniware.org/threat-intel/thn-github-updates-actions-checkout-to-block-common-pwn-request-attack-patterns saas Tue, 23 Jun 2026 15:18:47 GMT GitHub has updated the "actions/checkout" action to block common pwn request attack patterns in CI/CD workflows. Effective June 18, 2026, version 7 of actions/checkout refuses to fetch fork pull request code in pull_request_target and certain workflow_run workflows by default. The protection applies https://omniware.org/threat-intel/bleeping-fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials https://omniware.org/threat-intel/bleeping-fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials general Tue, 23 Jun 2026 15:18:35 GMT Security researchers at SOCRadar report an ongoing campaign, dubbed "FortiBleed," targeting Fortinet FortiGate firewalls worldwide. According to the report, the campaign has compromised more than 430,000 FortiGate devices since at least February 2026. Attackers gained administrative access via crede https://omniware.org/threat-intel/bleeping-lastpass-confirms-data-breach-in-klue-supply-chain-attack https://omniware.org/threat-intel/bleeping-lastpass-confirms-data-breach-in-klue-supply-chain-attack saas Tue, 23 Jun 2026 15:18:12 GMT LastPass confirmed a data breach affecting customer information stored in its Salesforce environment. The incident occurred after the Icarus extortion group compromised Klue, a third-party market intelligence platform that integrated with LastPass's Salesforce and Gong systems. Attackers obtained OA https://omniware.org/threat-intel/bleeping-microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers https://omniware.org/threat-intel/bleeping-microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers general Mon, 22 Jun 2026 19:30:15 GMT Microsoft attributed a supply chain attack on the Mastra AI npm package environment to Sapphire Sleet, a North Korean state-sponsored group also known as BlueNoroff. Attackers compromised an npm maintainer account with publishing privileges and used it to release malicious updates across more than 1 https://omniware.org/threat-intel/bleeping-klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack https://omniware.org/threat-intel/bleeping-klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack saas Mon, 22 Jun 2026 19:30:05 GMT Klue, a market intelligence platform, disclosed a security incident on June 12 in which attackers obtained OAuth tokens used to connect Klue integrations to customers' Salesforce environments. According to Klue CEO Jason Smith, an attacker gained access through a compromised legacy credential associ https://omniware.org/threat-intel/thn-shapedplugin-wordpress-pro-plugins-backdoored-in-supply-chain-attack https://omniware.org/threat-intel/thn-shapedplugin-wordpress-pro-plugins-backdoored-in-supply-chain-attack saas Mon, 22 Jun 2026 19:29:40 GMT Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after threat actors tampered with the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases. The affected plugins include Product Slider Pro for WooCommerce (versions before 3. https://omniware.org/threat-intel/bleeping-texas-govt-data-breach-exposes-over-3-million-driver-s-licenses https://omniware.org/threat-intel/bleeping-texas-govt-data-breach-exposes-over-3-million-driver-s-licenses compliance Fri, 19 Jun 2026 18:38:20 GMT The Texas Parks and Wildlife Department (TPWD) disclosed a data breach affecting its license system vendor that exposed personal information for approximately 3.087 million hunting and fishing license customers. The Texas Cyber Command discovered the intrusion and investigated the unauthorized acces https://omniware.org/threat-intel/bleeping-klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks https://omniware.org/threat-intel/bleeping-klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks saas Fri, 19 Jun 2026 18:38:12 GMT Market intelligence platform Klue experienced an OAuth breach that exposed Salesforce CRM data across multiple customer organizations. According to ReliaQuest and Huntress research, attackers compromised Klue's Battlecards integration service accounts and obtained OAuth tokens granting access to cus