Norks blast 250+ fake job offers to developers over 6 weeks to try and snarf creds and crypto

2026-06-09T07:23:58Za6b723c0fa38355e638b1006c6eeda5a831642f6fa9615d31c39922a64c7b6b6
Check Point VPNCisco SD‑WANGitHub takedownGogs RCENSO Group','WhatsApp targeting'Oxford UniversityPalo Alto VPNQilinShai‑HuludShinyHuntersWorld Food Programmeactive exploitationcredential theftdata breachexfiltrationjob‑offer scamnpm malwarephishingransomwareself‑spreading malwarespywaresupply chainunpatched vulnerabilitywormzero-day

What happened

A roundup of late-May/early-June 2026 security incidents reported by The Register covering widespread phishing (including 250+ fake developer job offers), active exploitation of multiple zero-days (notably Check Point VPN and Palo Alto VPN; Cisco SD‑WAN under active attack), ransomware campaigns (including Qilin affiliate activity), suspected self‑spreading/worm infections that forced GitHub repo removals, several high‑impact data breaches (World Food Programme ~600k families, Oxford University via career platform, ShinyHunters/Charter), supply‑chain malware in npm packages (Shai‑Hulud), an un

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
theregister_security
Record identifier
a6b723c0fa38355e638b1006c6eeda5a831642f6fa9615d31c39922a64c7b6b6
Enrichment time
2026-06-09T07:23:58Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.