A recent threat intelligence report has detailed a range of cyber incidents, from supply chain attacks and data breaches affecting major companies to the exploitation of artificial intelligence technologies for malicious purposes. The report highlights the ongoing evolution of cyber threats, emphasizing the need for robust security measures across various sectors.
Polymarket, a cryptocurrency prediction market, confirmed a supply chain attack where a third-party vendor's website was compromised. Malicious JavaScript was injected, leading to fraudulent transactions that resulted in the theft of approximately $3 million from fewer than 15 accounts. The platform's backend systems remained unaffected.
In Japan, telecom operator KDDI reported a breach of its ISP email platform following an intrusion detected on June 17. The incident potentially compromised up to 14.22 million email addresses and passwords associated with services from six internet service providers, including J:COM and Biglobe.
Tata Electronics, an Indian manufacturer of electronics and semiconductors that supplies to companies like Apple and Tesla, experienced a cyberattack and data breach. The company indicated that its IT systems were impacted, while the World Leaks group claimed to have exfiltrated 630GB of data, purportedly including sensitive supplier and customer information.
Brazil's National Civil Defense warning platform, managed by the telecom regulator Anatel, was targeted by a cyberattack that disseminated a false "Extreme Alert" message to mobile devices. The system was taken offline by officials after the fake alert reached users in the regions of Paraná, São Paulo, and Rio de Janeiro.
The National Association of Insurance Commissioners, a US regulatory standards body for insurance, confirmed a cyberattack after the ShinyHunters group claimed to have stolen 3.1 terabytes of data. The group asserted that the breach occurred through an Oracle PeopleSoft zero-day vulnerability and included access to regulatory filings, production logs, and other internal records.
The report also shed light on emerging AI-driven threats. Researchers identified "EvilTokens," an AI-powered phishing service that exploits device-code authentication to steal Microsoft 365 tokens. A significant surge in device-code phishing was observed, with AI-generated lures and automated processes reducing the effort required by attackers.
Another AI-related threat involved a malicious AI skill that hijacked over 26,000 AI agents by leveraging trusted marketplaces and social media advertisements. This supply chain attack initially presented a seemingly benign package, which then used attacker-controlled external instructions to exfiltrate data from agent platforms after user approval.
Furthermore, researchers demonstrated a technique called "BioShocking AI," which tricks agentic browsers into bypassing their security guardrails. Tests conducted on various AI browsers, including ChatGPT Atlas and Perplexity Comet, showed how specially crafted prompts could lead to the exposure of user credentials and sensitive data.
Several vulnerabilities and patches were also highlighted. Cisco addressed CVE-2026-20245, a critical command injection flaw in Catalyst SD-WAN Manager that had been exploited as a zero-day for months. This vulnerability allows an administrator to execute root commands via a crafted file and affects both on-premises and cloud-managed deployments.
Dify released version 1.14.2 to fix four vulnerabilities in its open-source AI platform, including critical flaws CVE-2026-41947 and CVE-2026-41948, which could permit unauthenticated access and cross-tenant data exposure.
Three vulnerabilities in Ubiquiti UniFi OS, identified as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, are reportedly being exploited, with observed activity linked to the Mirai botnet. These flaws enable unauthorized modifications, file access, and command execution.
Langflow, an open-source AI workflow tool, is reportedly under attack due to exploitation of CVE-2026-55255, alongside ongoing mass exploitation of CVE-2026-33017. Attackers are enumerating flow IDs to run victim pipelines and extract embedded API keys, with remote code execution capabilities enabling malware deployment and cloud credential theft.
In terms of threat intelligence reports, the "FortiBleed" campaign was uncovered, which transforms compromised FortiGate firewalls into credential-stealing devices across 24 protocols, impacting over 430,000 devices globally and siphoning millions of credentials.
The StockStay espionage malware has been attributed to the Russia-linked Turla group, with targets including Ukrainian government and defense organizations. This malware, disguised as legitimate applications, is delivered through phishing campaigns using malicious remote desktop configuration files.
The Chinese DCloud Uni-App framework has been identified as the foundation for at least 236,493 scam domains since 2022, facilitating fraudulent activities such as fake cryptocurrency exchanges and phishing schemes. Technical indicators suggest centralized, likely China-based, operators are behind this fraud ecosystem.
Finally, the FulcrumSec cloud extortion group has been analyzed for its targeting of cloud-native organizations. This group exploits exposed credentials, unpatched applications, and misconfigured storage, leveraging broad permissions to move laterally, collect data over extended periods, and exfiltrate it using legitimate tools.
