Threat Intelligence - RH-ISAC Blog

Executive Summary In the last two years, ClickFix tactics have moved from a one-off social engineering trick into an industrialized attack ecosystem that is outpacing conventional antivirus and endpoint defenses. The technique first appeared in late 2023 and early 2024, and it skips exploits and vulnerabilities entirely as a fake webpage impersonating a CAPTCHA check, browser update…

Executive Summary On 9 June 2026, Group-IB Threat Intelligence reported a malicious shell script uploaded to VirusTotal assessed as a new modular macOS stealer likely distributed via ClickFix phishing pages, relying on compromised WordPress domains and Telegram infrastructure, with a strong European victim focus. According to Group-IB, a ClickLock Stealer operation has already targeted at least 100…

Executive Summary On 13 July 2026, Microsoft researchers published details of a ShinyHunters campaign active between mid-2025 and mid-2026 targeting customer SaaS-based applications, especially Salesforce instances, through voice phishing (vishing), supply chain compromise, and misconfigured guest access. The threat actors abused trusted OAuth relationships for unauthorized access, data exfiltration, and persistence.  ShinyHunters has demonstrated a consistent pattern…

Executive Summary On 02 July 2026, SOCRadar researchers linked the financially-motivated campaign dubbed “FortiBleed” to the Ransom and Lynx ransomware operations, marking the first confirmed instance connecting mass FortiGate credential theft to actual ransomware deployment. SOCRadar reported that an operator tied to FortiBleed infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly…

Executive Summary  On 19 June 2026, the threat group Icarus claimed to have compromised and exfiltrated data from customers of Klue, specifically the Salesforce integration of the market intelligence platform. Salesforce has since disabled Klue integrations. Compromised Data Scope  The impacted data may consist of business names, products trialed/used, subscription details (units, pricing), business contact info (full names, work emails, job title,…

Executive Summary A report published by The Hacker News on 17 June 2026 detailed a software supply chain attack impacting 144 npm packages associated with the Mastra ecosystem after threat actors compromised a maintainer account through a phishing attack. The attackers leveraged the compromised account to publish malicious package versions to the npm registry. According to the…

Executive Summary In June 2026, D3 lab researchers reported on a new banking trojan. NFCShare is an Android banking trojan initially distributed as a malicious Android Package file (APK) through a phishing flow impersonating Deutsche Bank. The malware presents a fake card-verification interface, prompts the victim to place a payment card near the phone, collects the card…

Executive Summary On 10 June 2026, BleepingComputer reported that Oracle PeopleSoft servers are allegedly being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to have stolen data from over 100 organizations. PeopleSoft is an enterprise business software suite used by large organizations to manage HR, payroll, finance, supply chain, procurement, and student…

Executive Summary On 9 June 2026, ServiceNow disclosed an incident in which unknown threat actors exploited a flaw to gain deeper unauthorized access to susceptible customer instances. On 5 June 2026, ServiceNow applied a security update to hosted customer instances to address an issue that could allow an unauthenticated user, under certain circumstances, to gain greater access to ServiceNow instances…

Executive Summary A Proofpoint Threat Research report published on 8 June 2026 detailed a phishing campaign tracked as UNK_DeadDrop targeting software developers across multiple organizations. The campaign uses fake recruitment and code review lures to convince developers to download malicious project files from GitHub repositories. Once executed, the malware is designed to compromise developer workstations and facilitate…