AI Risks, Major Breaches, and Global Takedowns Dominate Cybersecurity News

The international 'Operation Endgame' has expanded its reported success, now confirming the disruption of not only SocGholish but also the Amadey botnet and StealC infostealer networks. The updated figures reveal a takedown of 326 servers and 142 domains, a significant increase from the initial report. Law enforcement also seized over EUR 41 million in criminal crypto assets and recovered 27 million stolen credentials. Microsoft played a key role, utilizing the RICO Act to dismantle Amadey and StealC infrastructure, highlighting a novel legal approach in cybercrime enforcement. This broader action further mitigates the threat from these initial access brokers.

New intelligence on the 'FortiBleed' campaign indicates a significantly larger scale than previously understood. Over 86,644 Fortinet devices, including FortiGate firewalls and SSL VPN gateways, have been compromised across 194 countries since February 2026. Threat actors, believed to be Russian-speaking, are employing an automated feedback loop: after gaining initial access via weak credentials, they use the compromised device as a listening post to harvest additional credentials from VPN traffic. These newly acquired credentials are then fed back into the campaign, expanding its reach exponentially. Victims span all sectors, with telecommunications being heavily targeted. This update underscores the urgent need for organizations to implement phishing-resistant MFA and restrict management interface access.

The Five Eyes alliance has reinforced its warning on AI-driven cyber threats, specifically urging corporate boards to elevate cybersecurity to a core business risk. The advisory emphasizes the accelerated threat velocity and increased sophistication enabled by AI, rendering traditional defenses obsolete. It outlines critical foundational security practices for immediate implementation, including reducing attack surface, accelerating patching, strengthening IAM, addressing legacy systems, and enhancing resilience. The statement also highlights potential legal and financial repercussions for organizations failing to act on this heightened guidance.

Further analysis of the ShapedPlugin supply chain attack reveals critical new information. The malicious updates, now assigned CVE-2026-10735 and CVE-2026-49777, specifically targeted 'Pro' versions of plugins. The backdoor creates a hidden administrator account (e.g., 'wp_support_sys'), steals database credentials from wp-config.php, and exfiltrates plaintext 2FA secrets to a C2 server at cdn-stats-api[.]com (IP 194.76.217.28). This sophisticated payload grants attackers persistent and complete control, making remediation more complex than initially understood.

Further analysis of the WhatsApp VBScript RMM campaign reveals additional technical details and TTPs. New observations include the use of obfuscated scripts with fake comments (T1027) and the initial access potentially involving credential gathering (T1589.003). Hunting hints now include monitoring for `cscript.exe //E:VBScript` and VBS files in download folders, alongside general RMM tools like AnyDesk or TeamViewer. Enhanced mitigations suggest restricting web-based content (M1021) and implementing execution prevention (M1038) to counter the threat more effectively.

A new Integris report indicates that 60% of U.S. manufacturers experienced a significant email-based security breach and 49% a mobile device breach in the past year. This highlights a critical gap between rapid smart factory technology adoption and cybersecurity maturity. The report also notes a significant commercial impact, with 83% of consumers concerned about security risks and 25% changing purchasing habits due to these concerns. This data provides real-world breach statistics and consumer impact, complementing the existing article's focus on AI-driven risks in the manufacturing sector.

The U.S. National Association of Insurance Commissioners (NAIC) has confirmed a breach by the ShinyHunters group, leveraging the critical Oracle PeopleSoft zero-day (CVE-2026-35273). The vulnerability's CVSS score is now confirmed at 9.8. Exploitation was active from May 27 to June 9, 2026, two weeks before Oracle's patch on June 10. The NAIC stated no PII was compromised, but public financial data was accessed. The FBI is investigating the broader campaign, which targeted over 100 organizations, expanding beyond the previously reported education sector to include regulatory bodies.