For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Texas Parks and Wildlife Department has been affected by a third-party data breach involving its license system vendor. The incident exposed driver’s license information, passport numbers, emails, phone numbers, and residential addresses for 3,087,721 hunting and fishing license customers. Social Security numbers and payment data were not affected.
- ShapedPlugin, a WordPress plugin vendor, has faced a supply chain attack that delivered malicious updates for three paid plugins through its official updater. The malware installed a hidden fake WooCommerce plugin to steal admin, database, and 2FA credentials and modify affected websites. Incident analysis tied the compromise to vendor release infrastructure.
- iRhythm Technologies, a US digital health company focused on remote cardiac monitoring, has experienced a cyberattack involving third-party-hosted business applications. The company confirmed that attackers stole protected health information, proprietary data, and other personal data through a social engineering attack. Clinical systems were not affected.
- Market intelligence platform Klue has confirmed a breach after attackers used compromised legacy integration credentials to steal OAuth tokens connected to customer Salesforce environments. The tokens enabled theft of sales and customer data from several clients, including Huntress, Recorded Future, Tanium, and Jamf. The Icarus extortion group claimed responsibility.
AI THREATS
- Microsoft researchers detailed AutoJack, an exploit chain where a malicious web page can turn an AI browsing agent into a remote code execution vector. The attack abused localhost trust, missing authentication, and unsafe parameter handling in AutoGen Studio’s MCP WebSocket surface.
- Researchers described SearchLeak, a prompt injection technique in Microsoft 365 Copilot Search that can use a crafted link to trigger hidden instructions and exfiltrate data. The attack abused Bing image fetch to expose emails, authentication codes, and OneDrive or SharePoint files. Microsoft patched it as CVE-2026-42824.
- Researchers analyzed OpenClaw AI agent flaws where hidden contacts and phishing emails could trigger prompt injections, code execution, and data leaks. The attacks show how agent workflows that trust external messages can expose local tools, secrets, and enterprise data through ordinary interaction paths.
VULNERABILITIES AND PATCHES
- Fortinet FortiSandbox vulnerabilities CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 are being exploited through unauthenticated API requests. The flaws enable path traversal and root-level command execution, creating a risk of sandbox takeover that could affect malware analysis, policy enforcement, and internal security workflows overall.
Check Point IPS provides protection against these threats (Fortinet FortiSandbox Directory Traversal (CVE-2026-39813), Fortinet FortiSandbox Command Injection (CVE-2026-39808))
- Microsoft has confirmed CVE-2026-50656, a Defender zero-day. The flaw allows privilege escalation to SYSTEM through a race condition. A public proof-of-concept works on fully updated Windows 10 and Windows 11 systems, and Microsoft is preparing a security update.
- Cisco has acknowledged active exploitation of CVE-2026-20262, an arbitrary file write flaw in Catalyst SD-WAN Manager. Authenticated attackers can overwrite system files and potentially escalate to root. Cisco reported limited targeted attacks and released patches for affected devices.
- Splunk Enterprise CVE-2026-20253 is actively being exploited. The critical flaw lets unauthenticated attackers trigger file operations, which researchers showed can lead to remote code execution. Splunk said limited exploitation was observed, and security updates are available.
Check Point IPS provides protection against this threat (Splunk Enterprise Arbitrary File Write (CVE-2026-20253))
THREAT INTELLIGENCE REPORTS
- Check Point Research has unmasked a crypto clipboard hijacker promoted through a phishing website and amplified on GitHub, SourceForge, YouTube, and legitimate news websites. The Rust malware targets Windows and macOS and swaps copied wallet addresses to attacker wallets.
Check Point Threat Emulation and Harmony Endpoint provide protection against this threat
- Check Point Research has uncovered a seasonal surge in travel-themed cybercrime, with attackers registering 47,318 travel-related domains in May 2026. The campaigns use Booking.com, Airbnb, and Skyscanner lookalikes to target travelers and hospitality customers with fake pages designed to steal credentials and payment details.
- Check Point Research has documented Amazon-themed scams ahead of Prime Day from June 23 to 26, including thousands of newly registered domains and lookalike internationalized domains. The campaigns impersonate Amazon services and lure Prime members into credential theft, payment fraud, and fake support interactions.
- Check Point has assessed rising cyberattacks against Central US organizations, with healthcare, energy, utilities, and financial services recording elevated weekly attack volumes. The report highlights regional and sector-level targeting patterns across the Midwest and provides business context for CISOs tracking exposure.
The post 22nd June – Threat Intelligence Report appeared first on Check Point Research.
