WhatsApp phishing attack uses fake business docs to hack PCs

A collection of BleepingComputer security reports (19–22 Jun 2026) covering multiple active threats and major incidents: WhatsApp phishing distributing VBScript to gain remote access; a $15M theft from the JaredFromSubway MEV bot via manipulated trading-opportunity logic; a newly disclosed FFmpeg “PixelSmash” flaw that can lead to RCE or DoS in many media apps (Jellyfin, Kodi, Emby, Nextcloud, PhotoPrism, OBS); the FortiBleed campaign using custom FortiGate sniffers to harvest credentials; Microsoft fixes for an AutoGen Studio chain (“AutoJack”) enabling code execution via a malicious webpage;