Threat Intelligence Center

Phishing has traditionally left a trail defenders can follow: a suspicious domain, a hosted page, a URL worth blocking. A newer approach removes much of that trail. Cybercriminals are building phishing pages that exist only inside victims' browsers, meaning the fraudulent page is assembled on the endpoint itself.

Microsoft published 999 CVEs this month — 974 in its own products, 723 of those in Windows — which Rapid7 calls by far the most it has ever released in a single day. Two are already under active exploitation: CVE-2026-85880 in the Windows ALPC mechanism and CVE-2026-81963 in the Windows Update Stack, both reaching SYSTEM privileges.

The ClickFix technique, known for tricking users into running attacker-supplied commands themselves, has moved into the browser. In this campaign, operators abuse the Tampermonkey userscript extension to plant code inside the victim's browsing session and route command-and-control traffic through Google-hosted infrastructure, using that trusted hosting to blend in while stealing cryptocurrency.

Health-ISAC, the information sharing and analysis center for the health sector, has warned members of increasing data theft attacks attributed to the ShinyHunters threat group targeting healthcare organizations. The advisory points to a rising volume of intrusions focused on stealing sensitive records.

Users who download what appears to be the Exodus Wallet installer get no wallet at all. The tampered package, paired with a ClickFix lure, delivers an archive named Update_GS_7G0N-254V38L2350.zip containing the MSI payloads jg0384.msi and jn0101.msi, which install a modular remote access trojan.

Microsoft's June 2026 security update covers 206 vulnerabilities , 32 of which the company marked critical. Key Insight: Of those 32 critical entries, 28 are remote code execution flaws, meaning an attacker who reaches the affected component can run their own code on the machine.