[narwhalrat]

August 2, 2026

Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves

Coldcard hardware wallets suffer $88M+ in cryptocurrency theft across three attack waves exploiting weak entropy in address generation. Microsoft attributes a Russian SVR campaign (Midnight Blizzard) to hotel Wi-Fi hijacking and device-code OAuth phishing targeting M365 accounts. DeepSeek's new V4 Flash model is trivially jailbroken with researchers bypassing multiple refusal classes via single prompts. Critical vulnerabilities in macOS Screen Sharing, Joomla Content Editor (CVE-2026-48907), and Ruby on Rails Active Storage enable pre-auth RCE, with active exploitation confirmed for the Joomla flaw.

June 21, 2026

FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

Fortinet networks face massive credential exposure via FortiBleed affecting 86,644 devices, while North Korea's Sapphire Sleet compromised 145 Mastra npm packages with an infostealer, and Google Cloud Vertex AI SDK suffered a cross-tenant RCE vulnerability. Critical CVEs in Splunk, NGINX, Cisco SD-WAN, and Joomla are under active exploitation, alongside emerging AI-focused attacks including AutoJack and malicious JetBrains plugins stealing API keys.

June 20, 2026

• ScarCruft (APT37) is delivering the new NarwhalRAT via spear-phishing impersonating Microsoft account security alerts. The Hacker News · Threat Intelligence & Espionage

in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

June 19, 2026

FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

FortiBleed exposed working SSL-VPN credentials for 70,000+ Fortinet devices across 194 countries via industrialized hash-cracking by a Russian-speaking group, while a forgotten GitHub token cost Novo Nordisk 1.3TB of drug formulas and internal AI models. Critical vulnerabilities in NGINX (CVE-2026-42530), Cisco SD-WAN and ISE, Splunk, and Joomla are under active exploitation, alongside AI pipeline supply-chain attacks hitting Mastra, JetBrains Marketplace, and Google Vertex AI. The AtomicArch campaign compromised ~1,500 Arch Linux AUR packages with Rust infostealers and eBPF rootkits.

June 18, 2026

• ScarCruft (APT37) delivered NarwhalRAT via spear-phishing impersonating Microsoft account security alerts, using Korean sites and pCloud for C2 (The Hacker News). · Threat Activity & Ransomware

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel

June 17, 2026

• ScarCruft (APT37) used spear-phishing impersonating Microsoft account security alerts to deliver NarwhalRAT. The Hacker News. · Threat Activity

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists