22nd June – Threat Intelligence Report

1. Executive summary

The 22 June Check Point weekly bulletin surfaces multiple active-exploitation events directly relevant to EMEA financial services. Splunk Enterprise (CVE-2026-20253) and Fortinet FortiSandbox (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active attack with unauthenticated RCE/file-operation primitives; Microsoft Defender zero-day CVE-2026-50656 has a public PoC that works against fully patched Windows 10/11. A Salesforce-integrations breach at market-intelligence platform Klue — claimed by "Icarus" (attribution unconfirmed; no MITRE ATT&CK profile) — saw OAuth tokens abused to steal CRM data from Huntress, Recorded Future, Tanium and Jamf. Microsoft 365 Copilot Search was patched for CVE-2026-42824 (CVSS 6.5 MEDIUM; not in CISA KEV; EPSS 1%; CWE-77) following a SearchLeak prompt-injection chain that abuses Bing image fetch to exfiltrate email, auth codes and OneDrive/SharePoint content. A ShapedPlugin supply-chain attack pushed a hidden fake WooCommerce plugin stealing admin, database and 2FA credentials. Bottom line: EMEA FS firms should prioritise Splunk, FortiSandbox and Microsoft Defender patching, audit Salesforce/CRM integrations for legacy OAuth tokens, and review Microsoft 365 Copilot Search exposure.

2. Regulatory framing

3. Technical analysis & attack chain

3.1 Klue / Salesforce OAuth token theft (Icarus — attribution unconfirmed)

1. Initial access: Attackers used compromised legacy integration credentials at Klue.
2. Token theft: Legacy credentials were used to steal OAuth tokens connected to customer Salesforce environments.
3. Lateral data access: Tokens enabled theft of sales and customer data from multiple Klue clients including Huntress, Recorded Future, Tanium and Jamf.
4. Impact: CRM data exfiltration; the "Icarus" extortion group claimed responsibility. Attribution is unconfirmed — no MITRE ATT&CK profile exists for this actor in the verified reference data.

3.2 Splunk Enterprise — CVE-2026-20253 (actively exploited)

1. Initial access: Unauthenticated attacker triggers file operations against Splunk Web/Splunk Enterprise endpoints.
2. Exploitation: Critical flaw enables arbitrary file operations; researchers demonstrated a path to remote code execution.
3. Privilege escalation: File operations enable system-level impact under the Splunk service account.
4. Impact: Limited exploitation observed; security updates available. Splunk said limited exploitation was observed.

3.3 Fortinet FortiSandbox — CVE-2026-39813, CVE-2026-39808, CVE-2026-25089 (actively exploited)

1. Initial access: Unauthenticated API requests against FortiSandbox management surface.
2. Path traversal (CVE-2026-39813): Directory traversal enables file access outside intended paths.
3. Command injection (CVE-2026-39808): Root-level command execution via injected parameters.
4. Impact: Sandbox takeover risk affecting malware analysis, policy enforcement and internal security workflows.

3.4 Microsoft Defender — CVE-2026-50656 (zero-day, PoC public)

1. Initial access: Local attacker triggers a race condition in the Defender component.
2. Exploitation: Privilege escalation to SYSTEM via the race window.
3. Impact: Public PoC works on fully updated Windows 10 and Windows 11; Microsoft is preparing a security update (not yet released at time of source publication).

3.5 Cisco Catalyst SD-WAN Manager — CVE-2026-20262 (actively exploited)

1. Initial access: Authenticated attacker (valid credentials required).
2. Exploitation: Arbitrary file write via the management interface.
3. Privilege escalation: System file overwrite enables potential root escalation.
4. Impact: Limited targeted attacks reported; Cisco released patches for affected devices.

3.6 SearchLeak / CVE-2026-42824 — Microsoft 365 Copilot Search (patched)

1. Initial access: User clicks a crafted link delivered to Copilot Search.
2. Trigger: Bing image fetch is abused to expose hidden instructions to the Copilot Search agent.
3. Exfiltration: Emails, authentication codes, OneDrive and SharePoint files are exposed.
4. Mechanism: Prompt injection in Copilot Search; Microsoft patched as CVE-2026-42824 — CVSS 6.5 MEDIUM, not in CISA KEV, EPSS 1%, CWE-77 (command injection family).

3.7 ShapedPlugin supply-chain (WordPress)

1. Initial access: Vendor release infrastructure compromise at ShapedPlugin.
2. Distribution: Malicious updates pushed via the official updater for three paid plugins.
3. Payload: Hidden fake WooCommerce plugin installed on affected sites.
4. Capability: Steals admin, database and 2FA credentials; modifies affected websites.

3.8 AutoJack — AutoGen Studio MCP WebSocket

1. Initial access: Malicious web page visited by an AI browsing agent.
2. Abuse: Localhost trust, missing authentication and unsafe parameter handling in AutoGen Studio's MCP WebSocket surface.
3. Impact: AI browsing agent turned into a remote code execution vector.

3.9 OpenClaw AI agent flaws

1. Initial access: Hidden contacts and phishing emails reach the agent workflow.
2. Trigger: Prompt injection via trusted external messages.
3. Impact: Code execution, data leaks, exposure of local tools, secrets and enterprise data.

3.10 Crypto clipboard hijacker (Rust)

• Platforms: Windows and macOS.
• Distribution: Phishing website, amplified on GitHub, SourceForge, YouTube and legitimate news sites.
• Capability: Swaps copied wallet addresses to attacker wallets.
• Protection: Check Point Threat Emulation and Harmony Endpoint provide protection (vendor-specific).

3.11 Other notable items

• Texas Parks and Wildlife Dept: Third-party license-vendor breach exposed driver's licence, passport, email, phone and address for 3,087,721 hunting/fishing licence customers; SSNs and payment data not affected.
• iRhythm Technologies: Social-engineering attack on third-party-hosted business applications stole PHI, proprietary data and personal data; clinical systems unaffected.
• Travel-themed cybercrime: 47,318 travel-related domains registered in May 2026; Booking.com, Airbnb and Skyscanner lookalikes target travellers and hospitality customers.
• Amazon Prime Day scams (23–26 June): Thousands of newly registered domains and lookalike internationalised domains impersonating Amazon services.
• Central US targeting: Healthcare, energy, utilities and financial services recorded elevated weekly attack volumes (regional context only).

4. Mitigation & containment

P1 — within 24 hours

• Splunk Enterprise (CVE-2026-20253): Apply Splunk security updates immediately. If patching is not possible, restrict Splunk Web to trusted source IPs and monitor for unauthenticated file-operation attempts against /services/ and search endpoints.
• Fortinet FortiSandbox (CVE-2026-39813/39808/25089): Apply Fortinet patches. Restrict management API access to administrative subnets only; block unauthenticated API requests at the perimeter.
• Microsoft Defender (CVE-2026-50656): Enable attack-surface reduction rules; monitor for SYSTEM privilege-escalation events originating from Defender processes; restrict local interactive logon to privileged users until a fix ships.
• Cisco Catalyst SD-WAN Manager (CVE-2026-20262): Apply Cisco patches; audit SD-WAN Manager accounts and rotate credentials.
• Salesforce/CRM integrations: Audit all connected apps and OAuth tokens; rotate tokens for any integration touching Klue, Salesforce, or legacy credential stores; revoke tokens for Huntress, Recorded Future, Tanium and Jamf integrations if present.
• Microsoft 365 Copilot Search (CVE-2026-42824): Confirm the June 2026 cumulative update is applied tenant-wide; review Copilot Search usage and consider disabling for high-risk groups until validated.

P2 — within 72 hours

• ShapedPlugin WordPress plugins: Audit WordPress installations for any of the three affected paid plugins; remove if not business-critical; rotate WordPress admin, database and 2FA credentials on any site that received an update during the compromise window.
• Third-party business applications (iRhythm-style): Apply principle of least privilege; review vendor access scope and session lifetimes.
• Crypto clipboard hijacker: Block the identified phishing domains at the web proxy; deploy YARA rule (Section 6) to EDR for hunting.

P3 — within 7 days

• Conduct threat hunting for Rust clipboard-hijacker indicators on Windows and macOS endpoints.
• Review travel-themed and Amazon Prime Day phishing lures targeting finance staff; add to user-awareness training.
• Validate incident-response runbooks against Splunk/FortiSandbox exploitation scenarios; confirm reporting thresholds under DORA Art. 19 / NIS2 Art. 23.

5. Indicators of compromise

No specific file hashes, IP addresses or domain names are provided in the source material. The following high-level indicators are derived from the source:

No specific file hashes, IP addresses or domain names are present in the source material.

6. Detection

Sigma — Splunk Enterprise unauthenticated file-operation attempts

title: Splunk Enterprise Unauthenticated File Operation Attempt
id: AT-2026-06-22-136-001
status: experimental
description: Detects potential exploitation of CVE-2026-20253 in Splunk Enterprise
author: Adverse Trace
date: 2026/06/22
references:

  - https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/
logsource:
  category: webserver
detection:
  selection:
    cs-method:

      - POST
      - PUT
    cs-uri-query|contains:

      - "/services/"
      - "/en-US/app/search/"
  filter_legitimate:
    c-user-agent|startswith: "Splunk"
  condition: selection and not filter_legitimate
falsepositives:

  - Legitimate Splunk admin operations
level: high

Sigma — FortiSandbox unauthenticated API path-traversal

title: FortiSandbox Unauthenticated API Path Traversal Attempt
id: AT-2026-06-22-136-002
status: experimental
description: Detects potential exploitation of CVE-2026-39813/39808/25089 in Fortinet FortiSandbox
author: Adverse Trace
date: 2026/06/22
references:

  - https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:

      - "../"
      - "..%2f"
      - "..\\"
      - "/api/v1/"
  filter_legitimate:
    c-user-agent|startswith: "FortiSandbox"
  condition: selection and not filter_legitimate
falsepositives:

  - Legitimate FortiSandbox admin operations
level: high

YARA — Rust-based crypto clipboard hijacker

rule AT_CryptoClipboardHijacker_2026_06_22 {
    meta:
        author = "Adverse Trace"
        date = "2026-06-22"
        description = "Detects Rust-based crypto clipboard hijacker targeting Windows and macOS that swaps copied wallet addresses to attacker wallets"
        reference = "https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/"
    strings:
        $rust_marker = "Rust" ascii
        $clipboard_win = "SetClipboardData" ascii
        $clipboard_mac = "NSPasteboard" ascii
        $wallet_term = "wallet" ascii nocase
        $clipboard_term = "clipboard" ascii nocase
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

CVE assessment

1 referenced CVE

Could not resolve: CVE-2026-39813, CVE-2026-39808, CVE-2026-25089, CVE-2026-50656, CVE-2026-20262, CVE-2026-20253.

7. Sources

• Check Point Research — 22nd June – Threat Intelligence Report — https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/ — 2026-06-22

8. Adverse Trace position

Severity assessment: The bulletin contains four actively exploited enterprise product vulnerabilities (Splunk, FortiSandbox, Microsoft Defender, Cisco SD-WAN Manager) and one supply-chain incident (ShapedPlugin) that together represent a high-priority patch cycle for EMEA FS firms. CVE-2026-42824 in Microsoft 365 Copilot Search is MEDIUM (CVSS 6.5) per the verified reference data and is not in CISA KEV, but the underlying SearchLeak chain — Bing image fetch → hidden instructions → email/auth-code/OneDrive exfiltration — is concerning for any tenant using Copilot Search. The Klue/Salesforce OAuth-token theft is the most strategically significant item: it demonstrates that legacy integration credentials remain a viable path into customer Salesforce environments and that the "Icarus" claim (attribution unconfirmed) is consistent with an extortion-only operation rather than a sophisticated APT. Client impact: Firms running Splunk, FortiSandbox or Microsoft Defender should treat patching as P1 within 24 hours; firms using Microsoft 365 Copilot Search should validate the June cumulative update and review Copilot Search exposure; firms with Salesforce-integrated CRM data should audit and rotate OAuth tokens immediately. Next steps: Adverse Trace will monitor for vendor patch availability (Microsoft Defender CVE-2026-50656 fix), track Icarus activity for further attribution signals, and update this advisory if specific IOCs emerge from the ShapedPlugin or Klue investigations.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.