FortiBleed Credential Theft Connected to INC and Lynx Ransomware

Multiple active campaigns and novel threat vectors reported: “FortiBleed” credential-theft activity now linked to INC and Lynx ransomware actors, with a Nextcloud zero-day under investigation; Sysdig documents JADEPUFFER, an agentic ransomware operation that abused a Langflow flaw to steal credentials, reach production MySQL, and destroy Nacos configuration data; a malicious “Google Notes” browser extension (Chrome/Brave/Edge) that swaps copied crypto wallet addresses; phishing emails impersonating Interpol using Proton Drive links to deliver ransomware to small businesses; and EvilTokens, a浏览