Mount Royal University in Calgary has confirmed that attackers breached its network in June, stole data from its file storage systems, and then deleted the files to hinder recovery, as the hackers now publicly claim the attack. The intrusion, detected around June 18, disrupted phones, the university website, and other systems. The affected storage held academic material such as assignments and research, but the university acknowledges some students and staff may have kept personal information there, and a separate departmental drive was also wiped. Mount Royal is notifying affected individuals and offering credit monitoring to current and recent employees, though not to students.
Researchers have shown an attack, called HalluSquatting, that weaponizes the tendency of AI coding assistants to invent plausible-sounding names for software packages that do not exist. The attackers work out which fake names an AI reliably hallucinates, register those names first on a package registry or GitHub, and upload a trap that instructs the coding agent to install a reverse shell or runs code directly. When the assistant fetches the made-up dependency on a developer's machine, it runs the attacker's payload. Tested against nine AI coding assistants, the technique could let attackers pool compromised developer machines into a botnet for crypto mining, denial-of-service attacks, or ransomware.
Okta warns of a campaign that phones Microsoft 365 users and talks them through what looks like setting up a passkey, but is actually a phishing kit that hands their account to the attacker. Active since April, the operators register passkey-themed domains and call targets, exploiting unfamiliarity with how passkeys really work. The kit mimics Microsoft's passkey enrollment without registering a real passkey, and pushes the victim to "save a recovery key" that the attacker controls, capturing the access needed to take over the account. The campaign, aimed at extortion, notably targets the passkey adoption process itself, turning a security upgrade into a social-engineering opening.
Socket found a coordinated campaign of 17 malicious packages on npm and PyPI that impersonate the payment SDKs for Paysafe, Skrill, and Neteller to steal developer and cloud credentials. The fake libraries mimic real SDKs, returning success responses without contacting the real services, while quietly harvesting environment secrets such as Paysafe API keys, AWS keys, and GitHub and npm tokens and sending them to a server on AWS. Because these packages get pulled into build pipelines, a single one reaching a continuous integration runner can hand over the broad credentials those runners hold. The npm versions trigger when a payment key is present; the PyPI versions run on install regardless.
BeyondTrust has patched two critical flaws in its Remote Support and Privileged Remote Access products that let an unauthenticated, network-positioned attacker bypass authentication and reach the appliance, including accounts with elevated privileges. The bugs, CVE-2026-40138 and CVE-2026-40139, both rated 9.2, sit in the authentication subsystem and depend on a specific authentication configuration being enabled. Cloud-hosted customers were patched automatically in April, but self-hosted deployments on version 25.3.2 or earlier need to update themselves. BeyondTrust has not reported exploitation, but its remote-support products have a history of being attacked, including flaws used to breach the US Treasury and to deploy ransomware, so internet-facing appliances should be patched quickly.
CERT/CC has warned that several Tenda router firmware versions contain an undocumented authentication backdoor that grants full administrative access to the web management interface. Tracked as CVE-2026-11405, the flaw lives in the login function of the router's web server: if normal password checking fails, the firmware compares the supplied password against a hidden value stored in the device configuration and, on a match, grants admin access regardless of the username. It affects models including the FH1201, W15E, AC10, AC5, and AC6, is baked into the firmware, and cannot be disabled from the interface. Tenda has not responded, so there is no fix, and public exploit tooling is already scanning for vulnerable devices.
Varonis disclosed a now-patched flaw in Google Cloud's Dialogflow CX, the platform many companies use to build customer-service, financial, and healthcare chatbots. Because all chatbots using the platform's custom-code feature in one Google Cloud project shared a single execution environment with a writable setup file and no isolation, an attacker who could edit one agent, needing only a single low-level permission, could overwrite that file and hijack every chatbot in the project. From there they could read live conversations, steal shared data, and make bots ask for passwords. Google reported no exploitation before fixing it and no customer action is now required, but the case shows how AI features inherit cloud risks.
Accenture, one of the world's largest IT consulting firms, has confirmed a data breach after a threat actor advertised stolen data for sale on a hacking forum. The seller claims to have taken about 35GB of source code along with RSA keys, SSH keys, Azure access tokens and storage keys, and configuration files, and shared a screenshot appearing to show them cloning an internal Azure DevOps repository. Accenture confirmed the breach but did not comment on the amount or type of data involved. If the stolen keys and tokens are valid, they could give attackers a path into Accenture's development systems or cloud infrastructure.
Researchers at Noma Labs showed that GitHub's new Agentic Workflows, which let an AI agent read issues and act on repositories automatically, can be tricked into leaking private code through nothing more than a public issue. The technique, GitLost, is indirect prompt injection: an attacker opens an ordinary-looking issue in an organization's public repository, buries plain-English instructions in it, and the agent, which often holds a token with read access across the org's repositories, follows them, fetches files from a private repo, and posts the contents in a public comment. No credentials, coding, or write access are needed. GitHub was notified, but researchers frame it as an architectural weakness.
Zimperium found RedWing, an Android bank-fraud operation rented out on Telegram as a finished product, complete with subscription tiers, guides, and a bot that builds each buyer a custom malicious app on demand, so no coding skill is needed. It spreads through phishing links leading to fake app-store pages that convincingly imitate Google Play and other stores. Once installed and granted permissions, it overlays fake login screens on real banking and crypto apps, reads incoming texts and screen content to capture one-time codes, and can silently forward the victim's calls to defeat phone-based verification. It also offers live screen control, keylogging, and camera access.
TrustStrike Labs