Today’s roundup
Philips and GE investigating Clop ransomware data theft claims
Microsoft working on Defender patch for ShieldBreak zero-day
SafePal data breach impacts 39,798 customers, stolen info for sale
New AmnesiaStealer macOS malware hijacks browser sessions via remote control
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
Infostealers Harvest 1.7 Billion Credentials in Six Months
Invisible AI Prompts Trigger Court Sanctions
McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen
Akira Ransomware Uses Safe Mode to Bypass EDR
DDoS Attacks Cause Major Threema Outages
Summary
Tech giants General Electric (GE) and Philips are investigating claims from the Clop ransomware gang that their systems were breached and data was stolen. Both companies confirmed ongoing investigations into these significant data theft allegations.
Microsoft is developing a security patch for the "ShieldBreak" zero-day vulnerability (CVE-2026-69414), publicly disclosed last week. The flaw affects Microsoft Defender, prompting urgent remedial action to address this critical threat.
Cryptocurrency hardware wallet provider SafePal reported a data breach affecting approximately 39,798 customers. A flaw enabled attackers to steal customer order information, which is now being offered for sale by a threat actor.
A new information-stealing malware, AmnesiaStealer, targets macOS users via "ClickFix" attacks. It features a streaming module allowing remote, interactive control of a victim's web browser, posing a significant threat to macOS system integrity.
A suspected China-nexus APT actor is actively exploiting CVE-2026-59310 (CVSS 9.8), a critical vulnerability in Broadcom VMware vCenter, deploying Babuk-derived ransomware. This high-impact attack leverages a directory-traversal flaw for arbitrary code execution.
Flashpoint data reveals information-stealing malware harvested 1.7 billion credentials in the first half of 2026. This highlights the pervasive and high-volume threat infostealers pose to individuals and organizations globally.
A litigant in Connecticut was sanctioned for embedding "AI prompt injections" in a court filing to manipulate any AI reviewing the document. This marks the first documented prompt injection attack against a U.S. court, leading to a ban from electronic filing.
A threat actor claims to have stolen 1.7 million McDonald's employee records from an Azure tenant using compromised credentials. An 8,000-row sample, verified as genuine, includes names, job titles, and internal email formats, raising social engineering risks.
Akira ransomware affiliates are using a new tactic to bypass EDR by rebooting compromised hosts into Safe Mode with Networking. This EDR evasion technique, observed after initial access via MFA-less SonicWall VPN, aims to facilitate encryption, though it failed in one instance due to memory limits.
The secure messaging service Threema experienced severe disruptions and intermittent outages due to multiple large-scale Distributed Denial-of-Service (DDoS) attacks. The company has deployed additional upstream DDoS protection and plans status page enhancements in response.
Want to dig deeper?
Vulnerabilities
Cyber Groups
| Akira | GOLD SAHARA, PUNK SPIDER, Howling Scorpius |
Malware Families