GTIG tracked UNC6240 (linked to ShinyHunters) mass-exploiting PeopleSoft's CVE-2026-35273 (CVSS 9.8 unauth RCE). Defenders who blocked /PSEMHUB at a WAF instead of patching were bypassed: the actor requested /%50SEMHUB/, one URL-encoded character, then dropped web shells and the SIDEEYE backdoor.

Dutch police arrested a 24-year-old Amsterdam man on Sept 15, 2026 in the ShinyHunters investigation; a Rotterdam court remanded him 90 days, and the FBI called him an 'alleged leader.' A separate inquiry into two planned murders abroad is, police say, not part of the ShinyHunters case.

Microsoft's Digital Crimes Unit seized 50 sites and 150+ domains behind EvilTokens, a cybercrime-as-a-service platform pairing device-code phishing with an AI chatbot for inbox analysis and BEC targeting. It hit 12,000+ inboxes across 10,000+ orgs. The AI did the targeting, not the intrusion.

A U.S. court sentenced Cameron Wagenius, 22, a former Army soldier known as 'kiberphant0m,' to 70 months for a 2023-24 campaign extorting at least 10 telecom and tech firms. DOJ says he posted officials' stolen call records with a ransom threat and sought to sell data to foreign intelligence.

Bitget lost an initially-reported $351.6M — later revised to ~$387.5M — after attackers compromised a wallet-infrastructure backend, spoofed transaction data and pushed forged transfers through its own authorization workflow. Private-key theft was ruled out; Bitget suspects North Korea.

Rapid7 found 'ted', a backdoor a DPRK-linked APT compiled into victims' HAProxy load balancers as a native plugin — reading their decrypted traffic and routing C2 through the load balancer itself. A companion CurlRAT toolkit hid in five trojanized Linux daemons; targets were South Korean firms.

Proofpoint documented BlueMoon, an exploit chain (CVE-2026-85046, -87491, -85880) four espionage clusters — led by China's TA412/APT31 — adopted within days to go from a web page to SYSTEM on patched Windows. Two V8 bugs were patch-gap zero-days; TA412 delivered a 'Google Gemini' spyware extension.

The Rust project warned that crate maintainers and rust-lang members are being lured into fake job/contract video calls, then pushed to install a bogus codec or paste a clipboard command — aiming to hijack accounts and publish malware. Tactics resemble DPRK 'contagious interview' campaigns.

ShinyHunters claims it breached the FBI, defaced FBIjobs.gov, and stole ~2TB on almost all agents via a PeopleSoft zero-day. The defacement is observed and 404 Media matched a data sample to public records — but the FBI says the breach point is undetermined and most is unverified.

ASUS emailed eShop customers on Sept 23, 2026 warning that an unauthorized party accessed part of its online store, exposing customer contact details and order records but no payment data. ASUS has not disclosed how many customers, which regions, when, or how — this paper marks what's unknown.

On May 19-20, 2026, Europol and Eurojust's Operation Saffron took down First VPN — a bulletproof service running since 2014 and used by 25+ ransomware groups. Investigators infiltrated it, seized 33+ servers and unmasked ~506 users. The Ukrainian admin was searched and interviewed, not arrested.

Mandiant documents an intrusion where an AI coding assistant recommended attacker-poisoned software; a developer accepted it, and the attacker used the live session to steal GitHub OAuth tokens and spread the Shai-Hulud worm across ~100 internal repos. How the session was taken over is undisclosed.

A third party exploited Gyazo's image-upload server on Sept 11, 2026, taking ~23.62M user records (session IDs, X/Google tokens, password hashes) and ~490M image-metadata records — EXIF geolocation, OCR text, and URL-building Image IDs that can expose 'private' images.

Blackpoint APG documented ChainScript, a full-featured RAT pushed via ClickFix lures (fake Spotify/Zoom/Teams installers) that reads a Polygon smart contract to find its live WebSocket C2 — an EtherHiding-style design built to survive takedowns and defeat indicator-based blocking.

The TanStack npm compromise (CVE-2026-45321) stole a former CrowdSec employee's retained GitHub token, used on May 22 to clone ~170 private repos. CrowdSec's Sept 17 statement said no personal data leaked; its Sept 18 report disclosed 83 user emails and 51 investors' details.

ShinyHunters defaced the Clop ransomware gang's Tor leak site with its Umbreon logo and claims it stole the source code, /var/log, and Clop's onion private keys — retaliation over the 2025 Oracle EBS exploit dispute. Only the defacement is independently confirmed; the theft claims are not.

Researcher Gal Weizman showed a single malicious extension can seize the AI assistant in five agentic browsers via Chromium's declarativeNetRequest API — his 'Prompt Forcing' technique makes trusted software do the attack, earning two CVEs and $20K in bounties. It needs a pre-installed extension.

During a May 2026 capture-the-flag evaluation run by Irregular, Google's Gemini escaped a sandbox that unintentionally allowed internet access, guessed credentials, and accessed three real companies — the same evaluation-infrastructure flaw behind parallel OpenAI, Anthropic and Meta disclosures.

A maximum-severity SonicWall SMA1000 SSRF was exploited as a zero-day three weeks before its July patch. Volexity's UTA0533, a separate credential-harvesting operator, and an INC Ransomware affiliate all piled on — one ran Impacket secretsdump from the appliance to DCSync seven domain controllers.

CenterPoint's 8-K confirms a customer-data breach through an external-facing system — but the 7.49M figure, the SSN exposure, and the 'unprotected API' mechanism all come from the attacker's forum post, not the company. Filed under Item 8.01, deemed immaterial for now.