> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # 22nd June – Threat Intelligence Report - URL: https://f4n6.co.uk/security-feed/22nd-june-threat-intelligence-report/ - Published: 2026-06-22T20:39:43.000Z - Updated: 2026-06-22T20:39:43.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-42824, CVE-2026-39813, CVE-2026-39808, CVE-2026-25089, CVE-2026-50656, Icarus ## 1\. Executive summary The 22 June Check Point weekly bulletin surfaces multiple active-exploitation events directly relevant to EMEA financial services. Splunk Enterprise (CVE-2026-20253) and Fortinet FortiSandbox (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active attack with unauthenticated RCE/file-operation primitives; Microsoft Defender zero-day CVE-2026-50656 has a public PoC that works against fully patched Windows 10/11\. A Salesforce-integrations breach at market-intelligence platform Klue — claimed by "Icarus" (attribution unconfirmed; no MITRE ATT&CK profile) — saw OAuth tokens abused to steal CRM data from Huntress, Recorded Future, Tanium and Jamf. Microsoft 365 Copilot Search was patched for CVE-2026-42824 (CVSS 6.5 MEDIUM; not in CISA KEV; EPSS 1%; CWE-77) following a SearchLeak prompt-injection chain that abuses Bing image fetch to exfiltrate email, auth codes and OneDrive/SharePoint content. A ShapedPlugin supply-chain attack pushed a hidden fake WooCommerce plugin stealing admin, database and 2FA credentials. Bottom line: EMEA FS firms should prioritise Splunk, FortiSandbox and Microsoft Defender patching, audit Salesforce/CRM integrations for legacy OAuth tokens, and review Microsoft 365 Copilot Search exposure. ## 2\. Regulatory framing | Article | Trigger (fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | Splunk CVE-2026-20253, FortiSandbox CVE-2026-39813/39808/25089, Microsoft Defender CVE-2026-50656, Cisco SD-WAN CVE-2026-20262 are under active exploitation | Activate ICT-related incident management process; triage Splunk/FortiSandbox/Defender/SD-WAN Manager assets for IOCs | | DORA Art. 18 | Klue/Salesforce OAuth token theft via third-party integration; ShapedPlugin supply-chain via WordPress plugin vendor | Classify incidents by severity and impact; document third-party origin in incident records | | DORA Art. 19 | Splunk unauthenticated RCE and FortiSandbox root-level command execution could qualify as major ICT-related incidents | Prepare major-incident reporting to competent authority within statutory window | | DORA Art. 24 | Splunk, FortiSandbox, Microsoft Defender, Cisco SD-WAN Manager vulnerabilities require resilience testing | Include in digital operational resilience testing scope; verify patch coverage and compensating controls | | DORA Art. 28 | Klue breach via Salesforce integration; ShapedPlugin via WordPress plugin vendor; iRhythm via third-party business apps | Apply ICT third-party risk principles; review vendor due-diligence and access scope | | DORA Art. 29 | Klue/Salesforce OAuth tokens indicate concentration risk on Salesforce-integrated CRM data | Assess concentration risk; identify other tenants of same integration | | DORA Art. 30 | Klue, ShapedPlugin, iRhythm incidents all involve ICT third-party providers | Verify contractual provisions for incident notification, audit rights and liability | | NIS2 Art. 21(2)(d) | ShapedPlugin supply-chain compromise; Klue Salesforce integration compromise | Apply supply-chain security measures; verify plugin/integration provenance and integrity | | NIS2 Art. 23 | Splunk RCE, FortiSandbox root command execution, Klue data theft may trigger incident reporting | Prepare incident notification to CSIRT/competent authority | | UK NIS 2018 | Splunk, FortiSandbox, Defender, SD-WAN Manager exploitation may affect OES/RDSP systems | Verify OES/RDSP duties for affected services | ## 3\. Technical analysis & attack chain ### 3.1 Klue / Salesforce OAuth token theft (Icarus — attribution unconfirmed) 1. **Initial access:** Attackers used compromised legacy integration credentials at Klue. 2. **Token theft:** Legacy credentials were used to steal OAuth tokens connected to customer Salesforce environments. 3. **Lateral data access:** Tokens enabled theft of sales and customer data from multiple Klue clients including Huntress, Recorded Future, Tanium and Jamf. 4. **Impact:** CRM data exfiltration; the "Icarus" extortion group claimed responsibility. Attribution is **unconfirmed** — no MITRE ATT&CK profile exists for this actor in the verified reference data. ### 3.2 Splunk Enterprise — CVE-2026-20253 (actively exploited) 1. **Initial access:** Unauthenticated attacker triggers file operations against Splunk Web/Splunk Enterprise endpoints. 2. **Exploitation:** Critical flaw enables arbitrary file operations; researchers demonstrated a path to remote code execution. 3. **Privilege escalation:** File operations enable system-level impact under the Splunk service account. 4. **Impact:** Limited exploitation observed; security updates available. Splunk said limited exploitation was observed. ### 3.3 Fortinet FortiSandbox — CVE-2026-39813, CVE-2026-39808, CVE-2026-25089 (actively exploited) 1. **Initial access:** Unauthenticated API requests against FortiSandbox management surface. 2. **Path traversal (CVE-2026-39813):** Directory traversal enables file access outside intended paths. 3. **Command injection (CVE-2026-39808):** Root-level command execution via injected parameters. 4. **Impact:** Sandbox takeover risk affecting malware analysis, policy enforcement and internal security workflows. ### 3.4 Microsoft Defender — CVE-2026-50656 (zero-day, PoC public) 1. **Initial access:** Local attacker triggers a race condition in the Defender component. 2. **Exploitation:** Privilege escalation to SYSTEM via the race window. 3. **Impact:** Public PoC works on fully updated Windows 10 and Windows 11; Microsoft is preparing a security update (not yet released at time of source publication). ### 3.5 Cisco Catalyst SD-WAN Manager — CVE-2026-20262 (actively exploited) 1. **Initial access:** Authenticated attacker (valid credentials required). 2. **Exploitation:** Arbitrary file write via the management interface. 3. **Privilege escalation:** System file overwrite enables potential root escalation. 4. **Impact:** Limited targeted attacks reported; Cisco released patches for affected devices. ### 3.6 SearchLeak / CVE-2026-42824 — Microsoft 365 Copilot Search (patched) 1. **Initial access:** User clicks a crafted link delivered to Copilot Search. 2. **Trigger:** Bing image fetch is abused to expose hidden instructions to the Copilot Search agent. 3. **Exfiltration:** Emails, authentication codes, OneDrive and SharePoint files are exposed. 4. **Mechanism:** Prompt injection in Copilot Search; Microsoft patched as **CVE-2026-42824** — CVSS **6.5 MEDIUM**, **not in CISA KEV**, EPSS **1%**, CWE-77 (command injection family). ### 3.7 ShapedPlugin supply-chain (WordPress) 1. **Initial access:** Vendor release infrastructure compromise at ShapedPlugin. 2. **Distribution:** Malicious updates pushed via the official updater for three paid plugins. 3. **Payload:** Hidden fake WooCommerce plugin installed on affected sites. 4. **Capability:** Steals admin, database and 2FA credentials; modifies affected websites. ### 3.8 AutoJack — AutoGen Studio MCP WebSocket 1. **Initial access:** Malicious web page visited by an AI browsing agent. 2. **Abuse:** Localhost trust, missing authentication and unsafe parameter handling in AutoGen Studio's MCP WebSocket surface. 3. **Impact:** AI browsing agent turned into a remote code execution vector. ### 3.9 OpenClaw AI agent flaws 1. **Initial access:** Hidden contacts and phishing emails reach the agent workflow. 2. **Trigger:** Prompt injection via trusted external messages. 3. **Impact:** Code execution, data leaks, exposure of local tools, secrets and enterprise data. ### 3.10 Crypto clipboard hijacker (Rust) - **Platforms:** Windows and macOS. - **Distribution:** Phishing website, amplified on GitHub, SourceForge, YouTube and legitimate news sites. - **Capability:** Swaps copied wallet addresses to attacker wallets. - **Protection:** Check Point Threat Emulation and Harmony Endpoint provide protection (vendor-specific). ### 3.11 Other notable items - **Texas Parks and Wildlife Dept:** Third-party license-vendor breach exposed driver's licence, passport, email, phone and address for 3,087,721 hunting/fishing licence customers; SSNs and payment data not affected. - **iRhythm Technologies:** Social-engineering attack on third-party-hosted business applications stole PHI, proprietary data and personal data; clinical systems unaffected. - **Travel-themed cybercrime:** 47,318 travel-related domains registered in May 2026; Booking.com, Airbnb and Skyscanner lookalikes target travellers and hospitality customers. - **Amazon Prime Day scams (23–26 June):** Thousands of newly registered domains and lookalike internationalised domains impersonating Amazon services. - **Central US targeting:** Healthcare, energy, utilities and financial services recorded elevated weekly attack volumes (regional context only). ## 4\. Mitigation & containment ### P1 — within 24 hours - **Splunk Enterprise (CVE-2026-20253):** Apply Splunk security updates immediately. If patching is not possible, restrict Splunk Web to trusted source IPs and monitor for unauthenticated file-operation attempts against `/services/` and search endpoints. - **Fortinet FortiSandbox (CVE-2026-39813/39808/25089):** Apply Fortinet patches. Restrict management API access to administrative subnets only; block unauthenticated API requests at the perimeter. - **Microsoft Defender (CVE-2026-50656):** Enable attack-surface reduction rules; monitor for SYSTEM privilege-escalation events originating from Defender processes; restrict local interactive logon to privileged users until a fix ships. - **Cisco Catalyst SD-WAN Manager (CVE-2026-20262):** Apply Cisco patches; audit SD-WAN Manager accounts and rotate credentials. - **Salesforce/CRM integrations:** Audit all connected apps and OAuth tokens; rotate tokens for any integration touching Klue, Salesforce, or legacy credential stores; revoke tokens for Huntress, Recorded Future, Tanium and Jamf integrations if present. - **Microsoft 365 Copilot Search (CVE-2026-42824):** Confirm the June 2026 cumulative update is applied tenant-wide; review Copilot Search usage and consider disabling for high-risk groups until validated. ### P2 — within 72 hours - **ShapedPlugin WordPress plugins:** Audit WordPress installations for any of the three affected paid plugins; remove if not business-critical; rotate WordPress admin, database and 2FA credentials on any site that received an update during the compromise window. - **Third-party business applications (iRhythm-style):** Apply principle of least privilege; review vendor access scope and session lifetimes. - **Crypto clipboard hijacker:** Block the identified phishing domains at the web proxy; deploy YARA rule (Section 6) to EDR for hunting. ### P3 — within 7 days - Conduct threat hunting for Rust clipboard-hijacker indicators on Windows and macOS endpoints. - Review travel-themed and Amazon Prime Day phishing lures targeting finance staff; add to user-awareness training. - Validate incident-response runbooks against Splunk/FortiSandbox exploitation scenarios; confirm reporting thresholds under DORA Art. 19 / NIS2 Art. 23. ## 5\. Indicators of compromise No specific file hashes, IP addresses or domain names are provided in the source material. The following high-level indicators are derived from the source: | Type | Value | Confidence | Source | | ----- | ------------------------------------------------------------ | ---------- | ----------------------- | | cve | CVE-2026-20253 (Splunk Enterprise) | high | Check Point 22 Jun 2026 | | cve | CVE-2026-39813 (FortiSandbox path traversal) | high | Check Point 22 Jun 2026 | | cve | CVE-2026-39808 (FortiSandbox command injection) | high | Check Point 22 Jun 2026 | | cve | CVE-2026-25089 (FortiSandbox) | high | Check Point 22 Jun 2026 | | cve | CVE-2026-50656 (Microsoft Defender) | high | Check Point 22 Jun 2026 | | cve | CVE-2026-20262 (Cisco Catalyst SD-WAN Manager) | high | Check Point 22 Jun 2026 | | cve | CVE-2026-42824 (Microsoft 365 Copilot Search) | high | Check Point 22 Jun 2026 | | actor | "Icarus" (no MITRE ATT&CK profile — attribution unconfirmed) | low | Check Point 22 Jun 2026 | No specific file hashes, IP addresses or domain names are present in the source material. ## 6\. Detection ### Sigma — Splunk Enterprise unauthenticated file-operation attempts ```yaml title: Splunk Enterprise Unauthenticated File Operation Attempt id: AT-2026-06-22-136-001 status: experimental description: Detects potential exploitation of CVE-2026-20253 in Splunk Enterprise author: Adverse Trace date: 2026/06/22 references: - https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/ logsource: category: webserver detection: selection: cs-method: - POST - PUT cs-uri-query|contains: - "/services/" - "/en-US/app/search/" filter_legitimate: c-user-agent|startswith: "Splunk" condition: selection and not filter_legitimate falsepositives: - Legitimate Splunk admin operations level: high ``` ### Sigma — FortiSandbox unauthenticated API path-traversal ```yaml title: FortiSandbox Unauthenticated API Path Traversal Attempt id: AT-2026-06-22-136-002 status: experimental description: Detects potential exploitation of CVE-2026-39813/39808/25089 in Fortinet FortiSandbox author: Adverse Trace date: 2026/06/22 references: - https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/ logsource: category: webserver detection: selection: cs-uri-query|contains: - "../" - "..%2f" - "..\\" - "/api/v1/" filter_legitimate: c-user-agent|startswith: "FortiSandbox" condition: selection and not filter_legitimate falsepositives: - Legitimate FortiSandbox admin operations level: high ``` ### YARA — Rust-based crypto clipboard hijacker ```yara rule AT_CryptoClipboardHijacker_2026_06_22 { meta: author = "Adverse Trace" date = "2026-06-22" description = "Detects Rust-based crypto clipboard hijacker targeting Windows and macOS that swaps copied wallet addresses to attacker wallets" reference = "https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/" strings: $rust_marker = "Rust" ascii $clipboard_win = "SetClipboardData" ascii $clipboard_mac = "NSPasteboard" ascii $wallet_term = "wallet" ascii nocase $clipboard_term = "clipboard" ascii nocase condition: uint16(0) == 0x5A4D and 2 of them } ``` ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-42824](https://nvd.nist.gov/vuln/detail/CVE-2026-42824?ref=f4n6.co.uk) | 6.5 Medium | — | 1% | Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a net… | *Could not resolve: CVE-2026-39813, CVE-2026-39808, CVE-2026-25089, CVE-2026-50656, CVE-2026-20262, CVE-2026-20253.* ## 7\. Sources - Check Point Research — *22nd June – Threat Intelligence Report* — https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/ — 2026-06-22 ## 8\. Adverse Trace position **Severity assessment:** The bulletin contains four actively exploited enterprise product vulnerabilities (Splunk, FortiSandbox, Microsoft Defender, Cisco SD-WAN Manager) and one supply-chain incident (ShapedPlugin) that together represent a high-priority patch cycle for EMEA FS firms. CVE-2026-42824 in Microsoft 365 Copilot Search is MEDIUM (CVSS 6.5) per the verified reference data and is not in CISA KEV, but the underlying SearchLeak chain — Bing image fetch → hidden instructions → email/auth-code/OneDrive exfiltration — is concerning for any tenant using Copilot Search. The Klue/Salesforce OAuth-token theft is the most strategically significant item: it demonstrates that legacy integration credentials remain a viable path into customer Salesforce environments and that the "Icarus" claim (attribution unconfirmed) is consistent with an extortion-only operation rather than a sophisticated APT. **Client impact:** Firms running Splunk, FortiSandbox or Microsoft Defender should treat patching as P1 within 24 hours; firms using Microsoft 365 Copilot Search should validate the June cumulative update and review Copilot Search exposure; firms with Salesforce-integrated CRM data should audit and rotate OAuth tokens immediately. **Next steps:** Adverse Trace will monitor for vendor patch availability (Microsoft Defender CVE-2026-50656 fix), track Icarus activity for further attribution signals, and update this advisory if specific IOCs emerge from the ShapedPlugin or Klue investigations. --- [Read the original source →](https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*