Daily Hunt Feed - 2026-06-30

Threat Hunt Feed (2026-06-30)

Hacker News: Best

• A native graphical shell for SSH — Mon, 29 Jun 2026 15:42:17 +0000
  • Matched TTPs: JavaScript (T1059.007), SSH (T1021.004), Server (T1584.004), At (T1053.002)

BleepingComputer

• NAIC says public data stolen in ShinyHunters’ PeopleSoft breach — Mon, 29 Jun 2026 16:30:28 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Microsoft extends Windows Server 2022 hotpatching until October 2027 — Mon, 29 Jun 2026 13:11:15 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• Critical SimpleHelp flaw exploited to deploy new stealer malware — Mon, 29 Jun 2026 10:00:00 -0400
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), SSH (T1021.004), Cloud Accounts (T1078.004), Server (T1584.004), Shell History (T1552.003), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Webinar: Why business email compromise attacks keep succeeding — Mon, 29 Jun 2026 08:14:22 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Impersonation (T1656), At (T1053.002)
• US seizes hundreds of FIFA World Cup illegal streaming domains — Mon, 29 Jun 2026 07:21:03 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)

Darkreading

• ‘Djinn’ Stealer Targets Cloud, AI Credentials — Mon, 29 Jun 2026 21:29:15 GMT
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), SSH (T1021.004), Cloud Accounts (T1078.004), Masquerading (T1036), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Vulnerabilities Expose Private Data in Indian Government Systems — Mon, 29 Jun 2026 21:05:29 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Server (T1584.004), At (T1053.002)
• Iran, Russia, China Target Water Systems for Sabotage — Mon, 29 Jun 2026 19:12:08 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Remote Access Tools (T1219), Credentials (T1589.001), At (T1053.002)
• Amazon Q VS Extension Flaw Leads to Cloud Credential Theft — Mon, 29 Jun 2026 11:44:42 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Web Services (T1584.006), Tool (T1588.002), Credentials (T1589.001), At (T1053.002)

The Hacker News

• Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input — Tue, 30 Jun 2026 00:10:09 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks — Mon, 29 Jun 2026 20:33:40 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More — Mon, 29 Jun 2026 20:11:07 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Vulnerabilities (T1588.006), Botnet (T1584.005), Password Managers (T1555.005), Domains (T1584.001), Masquerading (T1036), Server (T1584.004), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• 236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers — Mon, 29 Jun 2026 17:27:40 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Masquerading (T1036), Server (T1584.004), Proxy (T1090), Web Services (T1584.006), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Impersonation (T1656), At (T1053.002)
• Why Post-Quantum Cryptography Starts With Credentials — Mon, 29 Jun 2026 17:12:16 +0530
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Password Managers (T1555.005), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse — Mon, 29 Jun 2026 17:10:24 +0530
  • Matched TTPs: Serverless (T1584.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Encrypted Channel (T1573), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), HTML Smuggling (T1027.006), Visual Basic (T1059.005), At (T1053.002)
• Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts — Mon, 29 Jun 2026 14:02:31 +0530
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Steganography (T1001.002), At (T1053.002)
• Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw — Mon, 29 Jun 2026 12:36:34 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Firmware (T1592.003), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer — Mon, 29 Jun 2026 11:06:06 +0530
  • Matched TTPs: JavaScript (T1059.007), Keychain (T1555.001), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Password Managers (T1555.005), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), Windows Credential Manager (T1555.004), At (T1053.002), Dead Drop Resolver (T1102.001)