Nintendo confirms data stolen in WebMD subsidiary cyberattack

Multiple high-impact security events reported on 18 Jun 2026: a data-theft incident at TinyPulse (affecting Nintendo survey data) linked to a WebMD subsidiary breach; a self-spreading USB worm distributing clipboard‑stealer crypto malware over Windows shortcut (.lnk) files with Tor-based C2; an OAuth compromise at Klue used by the "Icarus" actors to exfiltrate Salesforce CRM data; a supply‑chain compromise of ShapedPlugin updates infecting WordPress sites; and a large FortiBleed leak exposing VPN credentials for ~73,932 Fortinet/FortiGate URLs. Separately, law enforcement removed ~15,000 SocGh