Daily · 2026-06-22
🇰🇷 Klue OAuth victims grow, 🤖 AryStinger botnet D-Link, ⚡ FortiBleed GPU cracking, 🎯 Kimsuky LNK campaign, 📦 Steganographic Remcos RAT
Klue OAuth breach expands to 9+ cybersecurity victims with Icarus leak deadline today. AryStinger botnet compromises 4,000+ D-Link routers. New FortiBleed analysis reveals $350/day GPU cluster cracking 75K+ Fortinet passwords. Kimsuky, Remcos steganographic campaigns, and Brazil Civil Defense attack round out the threat landscape.
The Klue OAuth breach is the day's defining story: nine security vendors, including HackerOne, Huntress, Jamf, and Tanium, now confirm that stolen OAuth tokens let the Icarus group query their Salesforce instances for business contact data, and Icarus has set a leak deadline for today. Klue OAuth breach is the pattern to internalize: one vendor's legacy credentials, a chain of OAuth integrations, and an extortion group monetizing the access. Rotate any tokens issued to third-party Salesforce integrations and audit API access logs now.
AryStinger is the reminder that end-of-life hardware never stops being a liability: more than 4,000 D-Link routers running unpatchable firmware now operate as distributed proxy and scanning nodes, with DNS tampering and traffic interception as add-ons, and nearly half of infections sit in South Korea. The FortiBleed analysis lands with equal force: a 36-GPU rented cluster at $350 per day cracked 75,000+ Fortinet password hashes at 720 billion hashes per second, turning the GenAI compute market into a nation-state-speed attack tool.
Kimsuky's LNK lure disguised as a data breach verification request, the steganographic loader chain delivering Remcos alongside half a dozen other stealers, and the attack on Brazil's civil defense alert network round out the day; the last one matters because the compromise of an emergency alerting path carries physical safety consequences even before any abuse is confirmed.
Watchlist: Salesforce API logs for unexpected /services/data/ queries, replacement of EOL D-Link routers, and FortiGate credential and configuration exposure.