Cybersecurity briefing, 2026-06-25

A standard Mac user can switch off your endpoint protection.

• Internet-facing PeopleSoft console becomes extortion foothold
• Criminal malware assembly lines are being torn down
• Standard Mac users can silence endpoint defenses
• KongTuke’s stealth foothold now looks brokered
• Malware now targets the analyst’s AI triage
• Help desks became the new identity control plane
• FortiGate compromise becomes a resale pipeline
• Unauthenticated pickle on GPU inference port
• Trusted CI workflows become the supply-chain weak point
• Vendor cutoff failed to stop seized-device forensics
• Cloud seizure hits scam laundering backbone
• Turla reuses KAZUAR to extend its espionage platform
• Agentic browsers leak secrets when context is faked
• Malicious extensions now cross into native code
• AI skills marketplace becomes a credential channel
• Residential IPs are becoming a shared crime layer
• Market0Day was attack infrastructure, not a listing site

Recent editions

• Wednesday, June 24, 2026: Criminal malware assembly lines are being torn down · 19 stories
• Tuesday, June 23, 2026: Embedded FFmpeg decoder exposes more than media players · 20 stories
• Monday, June 22, 2026: Trusted plugin updates became the payload · 16 stories
• Sunday, June 21, 2026: Infected routers become a hidden scanning fabric · 4 stories
• Saturday, June 20, 2026: Gravity SMTP bug exposes mail-sending credentials · 11 stories
• Friday, June 19, 2026: Ransomware affiliates rent kernel-grade EDR killing · 13 stories
• Thursday, June 18, 2026: Trusted plugin updates became the payload · 17 stories