SecurityWeek Roundup Covers Scattered Spider Arrest, ADT Data Leak and Security Advisories
Summary
SecurityWeek's roundup covers an ADT-confirmed intrusion and customer data exposure, a Scattered Spider-linked arrest, CISA advisories, a Cursor IDE code-execution flaw, BlueNoroff lures, and Qinglong vulnerabilities exploited to install a cryptominer.
Key points
- Finnish authorities arrested 19-year-old Peter Stokes, whom US prosecutors allege was a key Scattered Spider member; the US is pursuing his extradition.
- ADT confirmed unauthorized access to its cloud systems. ShinyHunters claimed it exfiltrated over 10 million Salesforce records; Have I Been Pwned data indicated about 5.5 million unique email addresses were exposed.
- CISA warned that a vulnerability in the end-of-life GRASSMARLIN tool can enable out-of-band exfiltration of sensitive files; no official patch is planned.
- BlueNoroff reportedly lures Web3 executives into fake Zoom meetings, prompting them to run malicious PowerShell scripts that steal crypto-wallet credentials and capture webcam footage.
- A Cursor IDE flaw, CVE-2026-26268, can enable hidden Git hooks to execute code when the AI agent performs Git operations.
- Snyk reported that Qinglong flaws CVE-2026-3965 and CVE-2026-4047 enable unauthenticated remote code execution and cryptominer deployment.
- Microsoft plans to block TLS 1.0 and 1.1 for Exchange Online POP and IMAP traffic starting in July 2026; CISA also published guidance on OT zero trust and agentic AI.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering a cybercrime arrest, a reported data breach, vulnerability disclosures, malicious campaigns, and security guidance.
- Impact
- ADT confirmed unauthorized access to its cloud-based systems. Have I Been Pwned data indicated approximately 5.5 million unique email addresses were exposed, alongside names, physical addresses, and in some cases partial SSNs; ShinyHunters claimed it exfiltrated over 10 million records. A vulnerability in Cursor IDE can enable arbitrary code execution through malicious Git hooks, while Qinglong authentication-bypass flaws can enable unauthenticated remote code execution and cryptocurrency mining that severely saturates server CPUs. BlueNoroff’s reported campaign uses fake meeting lures and malicious PowerShell scripts to harvest cryptocurrency-wallet-extension credentials and capture webcam footage. The GRASSMARLIN vulnerability can allow out-of-band exfiltration of sensitive files; the tool is end-of-life and has no planned official patch.
MITRE ATT&CK
CVE
CVE-2026-26268Anysphere · CursorTracked as CVE-2026-26268, the flaw is triggered when the tool’s AI agent autonomously performs Git operations, executing hidden scripts in nested repositories without the developer’s knowledge or approval.CVE-2026-3965whyour · qinglongThe flaws, tracked as CVE-2026-3965 and CVE-2026-4047, allow unauthenticated remote code execution by exploiting discrepancies in how the system handles URL rewriting and case-sensitive path matching.CVE-2026-4047Vendor / Product unavailableThe flaws, tracked as CVE-2026-3965 and CVE-2026-4047, allow unauthenticated remote code execution by exploiting discrepancies in how the system handles URL rewriting and case-sensitive path matching.
Threat Actors
BlueNoroffReportedly conducting a social engineering campaign against Web3 organizations using fake meeting lures, malicious PowerShell scripts, credential theft, and webcam capture.Lazarus GroupThe article describes BlueNoroff, which it says is conducting a campaign against Web3 organizations, as a financially motivated arm of Lazarus Group.Peter StokesUS prosecutors allege he was a key member of Scattered Spider and was involved in multiple corporate intrusions; he was arrested in Finland and faces US charges.Scattered SpiderUS prosecutors allege Peter Stokes was a key member of the group and involved in multiple intrusions against large corporations.ShinyHuntersClaimed responsibility for the ADT attack and asserted that it exfiltrated over 10 million records after ransom negotiations failed.
Vendors
ADTADT suffers major data leak CursorCursor IDE vulnerability opens door for silent code execution MicrosoftMicrosoft sunsets outdated encryption for legacy email protocols TetherIn coordination with US law enforcement, Tether froze approximately $344 million in USDT across the addresses, which had accumulated roughly $370 million through nearly 1,000 transactions since March 2021 and largely
Products
CursorCursor IDE vulnerability opens door for silent code execution Exchange OnlineMicrosoft has announced that Exchange Online will begin blocking TLS 1.0 and 1.1 for all POP and IMAP traffic starting in July 2026.GRASSMARLINCISA has issued an advisory regarding a critical vulnerability in GRASSMARLIN, an open source tool originally developed by the National Security Agency (NSA) for mapping industrial control system (ICS) networks.QinglongAttackers hijack Qinglong task management platforms to mine cryptocurrencySalesforceThe ShinyHunters extortion group claimed responsibility for the attack, asserting they exfiltrated over 10 million records from a Salesforce database after ransom negotiations failed.ZoomAttackers lure executives into fake Zoom meetings where fabricated technical issues prompt victims to execute malicious PowerShell scripts disguised as software fixes.
Countries
FinlandUS seeks extradition of teenage Scattered Spider member arrested in FinlandIranOFAC designated two cryptocurrency wallets directly linked to Iran’s Central Bank, marking the first such action against the institution and tying them to the IRGC-Qods Force and Hizballah.United KingdomThe UK’s National Cyber Security Centre (NCSC) warns that measuring a Security Operations Center (SOC) through ticket volume and log counts creates perverse outcomes that compromise network safety.
Industries
CryptocurrencyOFAC designated two cryptocurrency wallets directly linked to Iran’s Central Bank, marking the first such action against the institution and tying them to the IRGC-Qods Force and Hizballah.Home monitoringHome monitoring provider ADT has confirmed that unauthorized actors gained access to its cloud-based systems, leading to the exposure of customer information.Web3BlueNoroff, a financially motivated arm of the North Korean Lazarus Group, is conducting a social engineering campaign aimed at Web3 organizations.