Cybersecurity briefing — 2026-06-16

A trusted cloud destination stops meaning safe the moment an attacker rides the relay itself.

• Port Ransomware Reaches Through Cloud Identity
• SprySOCKS Gains a Hidden Windows Control Channel
• Vertex AI Uploads Can Be Hijacked Cross-Tenant
• Stolen CDN Keys Turn Plugin Scripts Into Backdoors
• OIDC Trust Flaw Lets SimpleHelp Create Admins
• Rokarolla Turns Android Phones Into Fraud Tools
• Teams Traffic Became Ransomware Cover
• Repo Token Theft Opens Pharma Research Haul
• Salesforce Breach Exposes School Staff Data
• Manual Recovery Leaves Sugar Supply Frozen
• Login Software Became Velvet Ant’s Persistence Layer
• Couriers Turn Bank Friction Into Cash Exfiltration
• Utility Data Breach May Expose OT Access Path
• Rockwell Adapter Flaws Can Drop Live I/O
• Trusted Steam Wallpapers Can Steal Accounts
• Recursive NTFS Loops Can Stall Endpoint Scans
• VHDX Containers Help Malware Slip Past First-Line Defenses
• Plain HTTP Turns Quick.CMS Admin Traffic Dangerous
• Developer Tools Now Deliver Cross-Platform Malware