Security
Novo Nordisk Breach, Conti Guilty Plea, and Arch Linux Poisoning
Ransomware, supply chain attacks, and a Copilot zero-day — your daily security briefing.
FulcrumSec Claims Novo Nordisk Breach, Demands $25 Million
A cyber extortion group calling itself FulcrumSec claimed on June 16, 2026, that it breached Novo Nordisk’s internal systems, stole over one terabyte of data, and demanded a $25 million ransom. Novo Nordisk publicly disclosed unauthorized access to several internal IT systems around June 11–12, confirming that attackers copied data externally. The stolen information includes de-identified patient data from clinical trials, proprietary drug information, and internal company documents. No ransomware was deployed; the attack was pure data theft followed by extortion. An independent threat actor also demanded $50 million from Novo Nordisk in connection with the same breach. Both demands remain unpaid. After Novo Nordisk declined to pay, FulcrumSec indicated it may begin selling segments of the stolen data privately, including material tied to specific drugs. The group first emerged in October 2025 and follows a double-extortion playbook. Novo Nordisk is collaborating with external cybersecurity experts and law enforcement. Because pharmaceutical companies in the EU are subject to GDPR, the breach could lead to fines of up to 4% of global annual revenue for data protection failures.
Hacking group claims major hack of Novo Nordisk, seeks $25M ransom →
Conti Ransomware Loader Developer Pleads Guilty in Operation Riptide
Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, pleaded guilty on June 10, 2026, in federal court in Tennessee to conspiracy to commit wire fraud for his role in the Conti ransomware operation. The U.S. Department of Justice stated that Conti collected at least $150 million in ransom payments from more than 1,000 compromised networks across 47 U.S. states and 31 foreign countries. Lytvynenko coded the loader that delivered tools such as Cobalt Strike onto victim networks before the Conti ransomware was deployed. He admitted to possessing stolen data from twelve victims and, together with co-conspirators, extorted approximately $634,000 in Bitcoin from two Tennessee victims, including a government entity. When a third Tennessee victim refused a $3 million ransom demand, Lytvynenko and others published that victim’s stolen data online. Sentencing is scheduled for September 10, 2026, and he faces up to 20 years in federal prison. The guilty plea came two days after the FBI formally announced Operation Riptide on June 9, 2026 — a coordinated enforcement campaign that already included the takedown of First VPN Service used by ransomware groups. The investigation involved the FBI’s San Diego, Nashville, and El Paso field offices, the U.S. Secret Service, and international partners including Irish authorities. Conti disbanded in name in May 2022, but its personnel and tooling have been traced to successor groups such as Black Basta and Akira, which continue to cause significant damage. The FBI has signaled additional arrests and takedowns under Operation Riptide as its initial 60-day campaign continues.
Conti Ransomware Loader Developer Pleads Guilty in $150M Operation Riptide Case →
Attackers Hijacked Over 1,500 Arch Linux Packages in Supply Chain Attack
Attackers exploited orphaned packages in the Arch User Repository (AUR) to hijack over 1,500 packages, security firm Sonatype reported, naming the campaign “Atomic Arch.” No system breach occurred; the attackers adopted packages whose maintainers had abandoned them, inheriting the trust associated with those packages. They spoofed git commit data to make changes appear to come from a long-standing maintainer, but only the build recipe was altered. The edited scripts pulled in a malicious npm package, atomic-lockfile, whose install hook ran a hidden Rust binary at build time. The payload targeted developers specifically, harvesting browser cookies, session tokens, login credentials from Slack, Discord, Microsoft Teams, GitHub, npm, HashiCorp Vault, OpenAI, SSH keys, Docker logins, and VPN profiles. Stolen data was exfiltrated over Tor. The malware included an optional eBPF component that could hide itself and block debuggers if the malware had root access. Arch’s core distribution and official repositories were never affected. By Monday, the project froze new account registration while cleaning up. Maintainers reset malicious commits and banned accounts. Roughly 13,000 orphaned packages remain in the AUR, leaving a large attack surface. Arch advises users to review build scripts before building and treat any recently adopted or suddenly active package with suspicion. The Arch team also urged users to contact staff via the aur-general mailing list if suspicious commits are noticed. As an alternative, users can adopt Flatpak from Flathub, which includes proprietary apps and provides sandboxing.
New Android Trojan Rokarolla Targets 217 Banking and Crypto Apps
Zimperium’s zLabs documented a new Android banking trojan called Rokarolla, named after its command-and-control infrastructure. The malware targets 217 banking and cryptocurrency applications and carries 137 remote commands, giving an operator near-total control of an infected phone. Rokarolla can steal lock-screen PINs, read and send SMS messages, rewrite the clipboard to redirect cryptocurrency payments, and disable Google Play Protect. It spreads through malicious websites impersonating popular apps like TikTok and Chrome. The initial dropper is disguised as Google Play Protect and uses that masquerade to install the main payload and obtain Accessibility access. Financial theft is executed through overlays that capture card details and login credentials. The trojan also uses a separate overlay to harvest the device’s PIN, pattern, or password, allowing the operator to issue commands even while the phone is locked. A keylogger and screen logger record input and screen content, and the clipboard is silently rewritten with attacker-controlled wallet addresses. For surveillance, Rokarolla takes screenshots via Accessibility and exfiltrates them. Its 137 commands outnumber the 107 counted in the HOOK trojan. Zimperium did not attribute Rokarolla to a named threat group, and no independent lab has published a separate analysis, so the technical claims rest on a single source. The report documents capabilities, not confirmed infection counts; there is no software patch to apply because it is malware. Defenses include installing apps only from Google Play, leaving Play Protect enabled, and treating any unexpected Accessibility permission request as a red flag.
ShinyHunters Publishes 45 GB of Data from MSG Sports After Ransom Deadline Missed
ShinyHunters released 45 GB of stolen files after MSG Sports missed a June 15, 2026 ransom deadline. The group claims over 26 million customer and corporate records were taken. A sample reviewed by 404 Media contained customer emails to MSG, MSG responses, and internal “Talent” files listing high-profile individuals with fields including address, claim to fame, cost of talent, risk level, and contact information. In the reviewed portion, Ben Stiller was listed as “Low Risk” and rapper A Boogie wit da Hoodie as “High Risk,” with no documented criteria for either label. One customer email involved a man worried about being flagged by MSG’s facial recognition system. Whether payment card data or Social Security numbers exist in this dump remains unconfirmed. MSG uses facial recognition at its venues to identify and bar certain visitors. The dump landed on ShinyHunters’ dark-web blog during the Knicks’ NBA Finals run. Cybernews stated that ShinyHunters’ claims are “typically valid” and the sample review provided strong corroboration that the leak is genuine. MSG has not issued a public statement on the breach. Ticketing customers face phishing and harassment risk from exposed correspondence. VIPs listed in talent files now have home addresses, appearance fees, and internal risk ratings circulating publicly, creating physical security and social engineering risks.
Hackers Just Published Knicks and Madison Square Garden Data →
Varonis Reveals SearchLeak: M365 Copilot Vulnerability Enables One-Click Data Exfiltration
Varonis Threat Labs discovered a three-stage vulnerability chain called SearchLeak that turns Microsoft 365 Copilot Enterprise Search into a data exfiltration tool. The chain combines Parameter-to-Prompt Injection, an HTML rendering race condition, and a server-side request forgery via Bing. Microsoft assigned CVE-2026-42824 with a critical severity rating and has patched the vulnerability. The attack does not require plugins, special permissions, or a second click. An attacker sends a victim a link to a trusted microsoft.com domain containing a crafted q parameter. Copilot interprets the parameter as instructions, searches the victim’s mailbox, calendar, SharePoint, and OneDrive, and embeds exfiltrated data into an image URL during streaming. The browser renders the tag before Copilot’s post-processing guardrail wraps output in
blocks, creating a race condition. The image request goes to Bing’s searchbyimage endpoint (allowlisted in the Content Security Policy), and Bing’s server-side fetch sends the data to the attacker’s server. The blast radius includes email subject lines and content (often containing security codes, OTPs, password reset links), meeting details and notes, and private organizational files such as earnings reports and salary data. The attacker inherits the victim’s full graph permissions without authenticating. Varonis recommended monitoring Copilot Search URLs for encoded payloads, reviewing CSP allowlists, treating AI streaming output as untrusted at render time, and advising users to inspect links and report unusual Copilot behavior.
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon →
Google Imposes 24-Hour Waiting Period and Developer Mode for Android Sideloading
Google plans to change how Android sideloading works, citing security risks. The company’s analysis found that sideloading is responsible for “50 times more malware from internet-sideloaded sources than on apps available through Google Play.” The new process, called Advanced Flow, will apply to sideloading apps from unverified developers. Users must enable developer mode by tapping the build number seven times in the About Phone settings, confirm that no one is coaching them to turn off security, restart the phone and reauthenticate, wait through a mandatory 24-hour cooling-off period, and then use biometric authentication or a device PIN to proceed with the install. After that, users can enable the approach for seven days or allow it indefinitely. Advanced Flow will not be part of the open-source element of Android but will be part of the closed-source Google Play Services platform. Sideloading from verified developers and developers with limited distribution assets (restricted to 20 devices) will remain unchanged. The changes apply to “apps in select regions” starting September 2026. Matthew Forsythe, Google’s director of product management for Android app safety, outlined the new process.
Google’s big Android sideloading crackdown has a 24-hour catch - how the new limits work →
Secure Boot Certificates to Expire June 24 — Update Your Systems Now
Three certificates used in Secure Boot will expire on June 24. The Microsoft-signed certificates cryptographically verify the firmware and software loaded during system startup, designed to prevent bootkits — malware that loads before the operating system. The expiring certificates date from 2011 and are being replaced with certificates dated 2023. The replacement addresses risks stemming from LogoFail, a series of critical vulnerabilities discovered in 2023 that affected UEFI firmware on nearly all Windows and Linux systems and allowed attackers to bypass Secure Boot. Microsoft is updating Windows 10 and Windows 11 machines automatically during monthly patch distributions, but older machines may require manual attention. Linux distributors are updating “shims,” small first-stage UEFI bootloaders that bridge Secure Boot keys and Linux bootloaders. Machines that do not receive the updated keys will continue to function but will no longer be protected against new UEFI threats. To check the status on Windows, users can open Windows Security settings, then Device Security, then Secure Boot; a green checkmark indicates the update is complete. Users should avoid installing new motherboard firmware updates until after the certificates are replaced.
Windows and Linux users: The deadline to update Secure Boot keys is near →
TIAA’s AI Helps Save 76-Year-Old From Losing $3 Million Retirement to Scam
TIAA flagged an unusual request from a 76-year-old customer attempting to withdraw his entire $3 million retirement portfolio. The retiree had been targeted by a scammer, but TIAA’s AI system first noticed something was off, according to CEO Thasunda Brown Duckett. “He was being scammed, but our AI tool flagged it,” she said. A portfolio manager escalated the out-of-pattern withdrawal to TIAA’s fraud team, which spent hours trying to convince the customer he was being deceived. Eventually, a fraud specialist contacted the man’s daughter, and TIAA stopped the money from moving. The customer told TIAA, “You saved my bacon.” Duckett said the case demonstrates the need for humans and technology to work together: “This was the intersection of your workplace, which is our people, your culture, and AI, and that to me, is the opportunity. AI by itself would not have necessarily protected this person.” She added, “The human is not just in the loop, it’s still all about the humans. It’s not just the loop, it’s the whole highway.”