Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
2026-06-28T19:24:08Z•a1cad08a57619de4f87e5a3600eb4bb876e2f30f97937e653f88a35024a77344
active-exploitationbackup-recovery-keybrowser-extensioncobalt-strikecredential-theftgithub-actionsiotlinux-kernelmacosmalwarenpmphishingprivilege-escalationprompt-injectionsignalstate-sponsoredsupply-chainzero-day
What happened
A large cluster of high‑risk cyber activity was reported: Russian intelligence phishing campaigns targeted messaging accounts (notably Signal) to steal credentials and backup recovery keys for account takeover; multiple state‑linked backdoors and espionage tools (STOCKSTAY, TinyRCT, Turla activity) and new malware/loaders (SharkLoader delivering Cobalt Strike, Mistic, Miasma supply‑chain variants) were observed; several Linux kernel local privilege‑escalation vulnerabilities (pedit COW CVE-2026-46331, DirtyClone CVE-2026-43503) and other high‑severity flaws (Amazon Q CVE-2026-12957, Cisco CVE-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- a1cad08a57619de4f87e5a3600eb4bb876e2f30f97937e653f88a35024a77344
- Enrichment time
- 2026-06-28T19:24:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.