Healthcare technology company Xsolis disclosed a data breach affecting nearly 1.4 million individuals following a targeted phishing attack on January 20, 2026. Attackers gained access to sensitive customer data including names, addresses, dates of birth, Social Security numbers, health insurance information, and medical treatment details. Xsolis detected the breach two days later, contained it with help from external cybersecurity experts, and reported it to law enforcement. The company has since reset all user passwords, increased system monitoring, accelerated employee security training, and strengthened credential management. Affected individuals are being notified by mail and offered 12 months of identity monitoring and theft restoration services through Kroll.
Nguồn: https://www.bleepingcomputer.com/news/security/healthtech-firm-xolis-suffers-data-breach-impacting-14-million-people. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
LastPass xác nhận dữ liệu khách hàng trong môi trường Salesforce bị truy cập sau cuộc tấn công chuỗi cung ứng nhằm vào Klue hôm 12/6. Nhóm tống tiền Icarus đã xâm nhập hạ tầng Klue bằng thông tin đăng nhập cũ, đánh cắp token OAuth kết nối Klue với Salesforce của khách hàng. Dữ liệu bị lộ bao gồm tên, số điện thoại, email, địa chỉ, thông tin hỗ trợ và dữ liệu CRM. LastPass cho biết sản phẩm cốt lõi, dịch vụ và kho dữ liệu khách hàng không bị ảnh hưởng.
Lập trình viên nên đọc bài này để hiểu rõ về cách tấn công supply chain attack hoạt động như thế nào, từ đó nâng cao kiến thức bảo mật cho các ứng dụng và hệ thống của mình, đặc biệt là khi sử dụng các dịch vụ cloud như Salesforce.
Kaspersky's 2026 SMB threat report reveals a nearly fivefold increase in cyberattacks disguising malware as popular AI tools like Claude compared to 2025. Fake messenger apps remain the most common lure with over 414,000 attacks detected in the first four months of 2026. Phishing campaigns increasingly exploit legitimate platforms (OneDrive, Zoom Docs) to bypass email filters. Dark web analysis shows SMBs and mid-sized businesses account for more than half of all initial access listings sold by brokers, with Middle East, Africa, and Latin America seeing significant increases. The report includes a practical cybersecurity action plan covering access controls, employee training, backups, and specialized security solutions.
Security awareness training as a phishing defense is obsolete in the AI era, where attacks are fluent and surface-level tells no longer exist. Drawing on Kahneman's System 1/2 framework applied at the organizational level, the argument is that companies should stop relying on human vigilance and instead audit their operational 'fast lanes' — processes where trust was granted and friction removed. Using the analogy of trusted-traveler programs like Nexus, the piece advocates for risk-tiered process design: identifying which fast paths were built on outdated assumptions and re-tiering them. It also calls out the trust inversion where employees face constant authentication while suppliers receive long-lived access based on a SOC 2 report, a gap attackers routinely exploit.
Huntress discloses it was among multiple victims of a supply chain attack targeting Klue, a market intelligence platform. The threat actor, dubbed Icarus, compromised Klue's backend systems on June 11, 2026, injecting code to steal OAuth tokens used by Klue's customers to connect their CRM tools. This allowed the attacker to directly query and exfiltrate Salesforce data from Huntress and other companies including Recorded Future, Tanium, and Jamf. The stolen Huntress data includes business contact info, pricing, subscription details, and sales communications — no product telemetry, passwords, or payment data was affected. Huntress shares IOCs (IP addresses, User-Agent strings), threat actor attribution details linking to the Icarus extortion group, and five recommended investigation steps for other potentially impacted organizations. The post is being updated in real time as the situation evolves, with a secondary unauthorized party also claiming access to breach data as of June 24.
A Huntress SOC investigation uncovered a Romanian threat actor who compromised a small client's internet-facing RDWeb terminal server via brute-forced credentials and no MFA. The attacker staged Gammadyne Mailer (a legitimate bulk email tool) with 8.9 million recipient addresses on the compromised desktop, configured to impersonate UK pharmacy chain Boots with a fake customer satisfaction survey. The phishing payload was hosted on a hijacked Bolivian government website (ipelc.gob.bo) to bypass reputation filters. Direct-to-MX delivery via 666 threads meant the victim's IP — not the attacker's — would be blocklisted. Huntress isolated all 25 endpoints mid-send, blocking 29,954 outbound SMTP connections in a 104-second burst. The investigation also revealed the attacker had been operating from at least July 2025, rotating the same Gammadyne project file across multiple compromised terminal servers targeting UK audiences with retail, tax, and crypto-themed lures.
Market research company Klue, breached on June 12, is communicating with the hacking group Icarus and believes they are deleting stolen customer data. However, a second unnamed hacker group has emerged, claiming to have obtained Klue's customer data from Icarus and threatening to leak it unless a ransom is paid. The second group alleges 195 affected Klue customers and claims Klue paid Icarus. Klue advises customers contacted by this second group to demand a data sample as proof before taking any action. The original breach involved a 2022 third-party credential that was never revoked, which attackers used to steal OAuth tokens and access customer clouds and databases. Affected companies include Gong, Jamf, HackerOne, Huntress, LastPass, Snyk, and others.
Modern phishing attacks have evolved far beyond misspelled domains and fake login pages. Attackers now use ClickFix (tricking users into running malicious terminal commands via fake CAPTCHAs), Browser-in-the-Browser (BitB) attacks that render convincing fake browser windows inside real pages, OAuth consent phishing (ConsentFix) that steals authorization codes without ever asking for a password, device code phishing that abuses legitimate OAuth flows to authorize attacker devices, and fake video conference overlays that prompt malware downloads under the guise of driver updates. Each technique systematically eliminates traditional red flags, weaponizing users' own habits and trusted infrastructure against them. Huntress SAT offers simulated scenarios replicating these exact tactics to build behavioral muscle memory before users encounter the real thing.
Klue, the market intelligence firm whose breach exposed customer data at LastPass, HackerOne, and others, says the original hacking group Icarus is now deleting the stolen data. However, a second unnamed hacker group claims to have obtained the data from Icarus and is extorting affected companies directly, demanding payment or threatening to leak everything. Icarus reportedly told Klue the second group only has data samples for a subset of customers, not the full dataset, and instructed Klue to tell customers not to pay the second group. The breach stemmed from a compromised third-party credential from 2022 that was never revoked, granting OAuth access to customers' Salesforce environments. Over a dozen companies including Gong, Jamf, HackerOne, and LastPass have confirmed they were affected.