Hacker Selling 340 Million OnlyFans User Records Built From Old Breaches

Multiple high-impact threats reported: a hacker is selling a 340 million OnlyFans user dataset allegedly built by correlating old breaches and public profiles; VulnCheck attributes the RondoDox botnet to exploitation of a critical 2018 ASUS router authentication bypass to hijack over one million devices; the FBI warns of Kali365, a phishing-as-a-service that lets attackers bypass MFA and take over Microsoft 365 accounts; SafeDep uncovered the Megalodon supply-chain attack that injected malicious CI workflows into 5,561 GitHub repositories to harvest cloud credentials; a study found deleted Git