Cybersecurity briefing, 2026-06-17

A trusted SaaS destination no longer means benign traffic when the attacker is riding the relay itself.

• Port Ransomware Reaches Through Cloud Identity
• Utility Data Breach May Expose OT Access Path
• Teams Traffic Became Ransomware Cover
• OIDC Trust Flaw Lets SimpleHelp Create Admins
• JetBrains Plugins Turn AI Keys Into Loot
• Repo Token Theft Opens Pharma Research Haul
• North Korea Attribution Expands Mastra Poisoning Risk
• GitHub Trust Signals Fail Against Shai-Hulud Worms
• Trusted Steam Wallpapers Can Steal Accounts
• ScarCruft Lures Hide in Normal Windows Behavior
• Recursive NTFS Loops Can Stall Endpoint Scans
• C2 Takedown Left the Intrusion Alive
• Cloud Run URL Fetches Can Leak Cloud Credentials
• Couriers Turn Bank Friction Into Cash Exfiltration
• Compromised WordPress Pages Replace Fake Teams Downloads
• AI-Coached Fake Hires Slip Past Remote Vetting

Recent editions

• Tuesday, June 16, 2026: Port Ransomware Reaches Through Cloud Identity · 19 stories
• Monday, June 15, 2026: Stolen CDN Keys Turn Plugin Scripts Into Backdoors · 8 stories
• Sunday, June 14, 2026: Splunk’s Control Plane Is Now the Target · 2 stories
• Saturday, June 13, 2026: Splunk’s Control Plane Is Now the Target · 9 stories
• Friday, June 12, 2026: AI Mass-Produces Phishing Faster Than Defenses Can Block · 17 stories
• Thursday, June 11, 2026: Netlogon Exploit Puts Active Directory at Risk · 13 stories
• Wednesday, June 10, 2026: Netlogon Exploit Puts Active Directory at Risk · 13 stories