Cybersecurity briefing — 2026-06-17

A trusted SaaS destination no longer means benign traffic when the attacker is riding the relay itself.

• Port Ransomware Reaches Through Cloud Identity
• Utility Data Breach May Expose OT Access Path
• Teams Traffic Became Ransomware Cover
• OIDC Trust Flaw Lets SimpleHelp Create Admins
• JetBrains Plugins Turn AI Keys Into Loot
• Repo Token Theft Opens Pharma Research Haul
• Mastra Packages Turn npm Install Into Malware Delivery
• GitHub Trust Signals Fail Against Shai-Hulud Worms
• Trusted Steam Wallpapers Can Steal Accounts
• ScarCruft Lures Hide in Normal Windows Behavior
• Recursive NTFS Loops Can Stall Endpoint Scans
• C2 Takedown Left the Intrusion Alive
• Cloud Run URL Fetches Can Leak Cloud Credentials
• Couriers Turn Bank Friction Into Cash Exfiltration
• Compromised WordPress Pages Replace Fake Teams Downloads
• AI-Coached Fake Hires Slip Past Remote Vetting