threat-intel Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites An international law enforcement operation, dubbed Operation Endgame, successfully disrupted SocGholish’s infrastructure and removed malware from nearly 15,000 WordPress websites. The takedown, involving agencies from mu… The Hacker News · Jun 19, 2026 High NLCADEbotnetwordpressmalware
threat-intel Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats A coordinated malware campaign targeting JetBrains Marketplace plugins has emerged, with 15 malicious plugins designed to steal AI API keys from users. These plugins, posing as AI coding assistants, exfiltrate keys to a… The Hacker News · Jun 17, 2026 High USaiapimalware
threat-intel Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk A widespread campaign involving malicious wallpapers distributed through the Steam Workshop has been identified, targeting gamers primarily in China and Russia. Attackers are exploiting the Wallpaper Engine’s sharing fea… Securelist · Jun 16, 2026 High CNRUsteamwallpapermalware
threat-intel China-Nexus Actor Spied on US Researchers Undetected for a Year Google’s Threat Intelligence Group (GTIG) discovered and disrupted a year-long espionage campaign by the China-Nexus threat actor, UNC6508, targeting US academic, medical, and military research institutions. The actor ut… Dark Reading · Jun 15, 2026 High CHUScyber espionageintel gatheringcredential theft
supply-chain Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues Microsoft is investigating a recent security incident involving the compromise of 73 open-source GitHub repositories as part of the ongoing "Miasma" supply chain attack. The attackers, utilizing a technique involving inf… The Hacker News · Jun 9, 2026 High supply chainopen sourceinformation stealer
supply-chain GitHub disables Microsoft repos pushing password-stealing malware Microsoft repositories on GitHub were temporarily disabled on June 5th due to concerns about distributing malware, specifically linked to the ongoing Miasma/Shai-Hulud supply-chain campaign. The incident involved the com… BleepingComputer · Jun 9, 2026 High USsupply-chain attackgithubmalware
supply-chain Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks A new wave of Shai-Hulud supply chain attacks has impacted over 471 NPM and PyPI packages, utilizing variants named Miasma and Hades. The attacks, originating from TeamPCP, involve credential harvesting and self-replicat… SecurityWeek · Jun 9, 2026 High supply chainnpmpypi
supply-chain New Shai-Hulud attack trojanizes 19 science-focused PyPI packages A new supply-chain attack, dubbed Shai-Hulud, has compromised 19 popular Python packages hosted on the PyPI, distributing a trojan designed to steal developer secrets. The malware leverages a chain of execution to downlo… BleepingComputer · Jun 8, 2026 High supply-chainpythonsecrets
supply-chain 'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud A new wave of attacks, dubbed the 'Hades' campaign, has targeted the Python Package Index (PyPI) with a variant of the Shai-Hulud worm. This campaign involved compromising 37 PyPI wheels and 19 code packages, utilizing a… Dark Reading · Jun 8, 2026 High USsupply-chainpythonopen-source
threat-intel VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances A China-based cyber espionage group, VerdantBamboo, deployed a BSD variant of the BRICKSTORM backdoor and the PLENET malware family on Linux appliances to target a victim organization. The attack involved exploiting vuln… The Hacker News · Jun 8, 2026 High CVE-2026-22769CHlinuxbackdoorespionage
supply-chain Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack A sophisticated supply chain attack, dubbed Miasma, has compromised 73 Microsoft GitHub repositories, including several within the Azure and Microsoft organizations. The attack leverages a re-compromised PyPI package, du… The Hacker News · Jun 6, 2026 High supply chaingithubopen source
threat-intel FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins A wave of fraudulent activity targeting FIFA World Cup 2026 fans is underway, involving fake websites, banking malware, and stolen login credentials. The operation, spearheaded by the Chinese-speaking group ‘GHOST STADIU… The Hacker News · Jun 5, 2026 High USCAMXfraudphishingmalware
malware The Evil MSI Background is Back!, (Fri, Jun 5th) This report details a recent cyberattack utilizing a classic MSI-branded JPEG payload, a technique previously documented by the SANS Internet Storm Center. The attack began with a phishing email containing a WeTransfer l… SANS Internet Storm Center · Jun 5, 2026 High USphishingmalwarepowershell
threat-intel China's TA4922 Expands Cybercrime Attacks Globally China's TA4922 cybercrime group has significantly expanded its operations globally, targeting a diverse range of countries and employing a wider array of tactics and techniques than previously observed. Initially focused… Dark Reading · Jun 4, 2026 High CHJATAphishingratmalware
threat-intel Chinese Cybercrime Group in Spotlight for Record Campaign Pace A Chinese cybercrime group, TA4922, is experiencing a record surge in campaign activity, utilizing sophisticated social engineering tactics to target organizations globally. The group’s primary objectives involve data th… SecurityWeek · Jun 4, 2026 High GBDEITsocial engineeringcredential phishingremote access
malware Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content A new malware campaign, dubbed Weedhack, is targeting Minecraft players through YouTube and malicious websites, distributing a MaaS (Malware-as-a-Service) tool. The campaign, active since January 2026, utilizes SEO poiso… The Hacker News · Jun 3, 2026 High USDEINminecraftmalwareyoutube
malware ISC Stormcast For Wednesday, June 3rd, 2026 https://isc.sans.edu/podcastdetail/9956, (Wed, Jun 3rd) The SANS Internet Storm Center's Stormcast for June 3rd, 2026 highlighted a concerning increase in malicious activity across the internet landscape. The broadcast detailed several ongoing threats, including observed phis… SANS Internet Storm Center · Jun 3, 2026 High phishingransomwaremalware
malware Over 116,000 Mincraft systems infected in WeedHack malware campaign A large-scale malware campaign, dubbed WeedHack, has infected over 116,000 Minecraft systems since January, primarily through malicious mods and clients promoted via YouTube and SEO poisoning. The malware operates as a M… BleepingComputer · Jun 2, 2026 High USDEINminecraftmalwaremaas
malware Over 116,000 Minecraft systems infected in WeedHack malware campaign A large-scale malware campaign, dubbed WeedHack, has infected over 116,000 Minecraft systems since January, primarily through malicious mods and clients promoted on YouTube and via SEO poisoning. The operation is a malwa… BleepingComputer · Jun 2, 2026 Medium USDEINminecraftmalwaremaas
threat-intel DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks A sophisticated cybercriminal operation, dubbed DriveSurge, has been hijacking thousands of legitimate websites to distribute malware, primarily through ClickFix and FakeUpdate attacks. The operation utilizes a traffic d… Dark Reading · Jun 2, 2026 High USmalwaretraffic distributionclickfix
