Week in Review: Infostealer Account Takeovers, Active Exploits and Major Data Breaches
Summary
This roundup covers infostealer-related Claude account lockouts, active exploitation of flaws in several products, breaches at McKesson and Thomson Reuters, and campaigns using OAuth phishing, Teams vishing and fake Claude apps.
Key points
- Anthropic locked some Claude users out after infostealer malware compromised their login sessions.
- Attackers were exploiting flaws affecting Microsoft Exchange, SonicWall SMA 1000, PaperCut and Sangoma Switchvox; CVE-2026-62911, CVE-2026-83548, CVE-2026-83549 and CVE-2026-9586 are cited.
- McKesson disclosed an incident involving data stolen from third-party applications; ShinyHunters separately claimed it stole 284 million patient records.
- Thomson Reuters disclosed a breach affecting its C-Track platform, exposing court records and sensitive personal information across courts in the U.S., the U.S. Virgin Islands and Canada.
- The roundup describes an OAuth phishing campaign targeting prominent individuals and a Microsoft Teams vishing campaign called Spring Ring that sought to install malware or obtain remote access.
- A GitHub repository impersonating Anthropic was reported to deliver RevStealer, which targets passwords, cryptocurrency wallet data and login credentials.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering account compromise, vulnerability exploitation, data breaches, phishing, and malware delivery.
- Impact
- Infostealers compromised Claude login sessions, prompting Anthropic to lock affected users out. McKesson reported theft of data after access to third-party applications, while a Thomson Reuters breach exposed court records and sensitive personal information. Attackers were also reported exploiting vulnerabilities in Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and using phishing and vishing to gain access or deliver malware.
CVE
CVE-2026-62911Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)CVE-2026-83548Attackers are exploiting two previously undisclosed vulnerabilities (CVE-2026-83548, CVE-2026-83549) in SonicWall SMA 1000 appliances, the vendor confirmed on Tuesday.CVE-2026-83549Attackers are exploiting two previously undisclosed vulnerabilities (CVE-2026-83548, CVE-2026-83549) in SonicWall SMA 1000 appliances, the vendor confirmed on Tuesday.CVE-2026-9586Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
People
Becky PalmerVP and CISO at National Life Group; discussed defending against AI-driven attacks.Brian KuanWrote halo-record, a package for recording AI-agent activity.David HalbreichInsurance recovery partner at Reed Smith; discussed insurance coverage gaps related to AI.Hannes MühleisenCo-built DuckDB with Mark Raasveldt.Joye PurserGlobal Field CISO at Cohesity; discussed vulnerability prioritization in an interview.Kurt RoeckxDebian project secretary who announced the result of a vote on disclosure of AI assistance.Mark RaasveldtCo-built DuckDB with Hannes Mühleisen.Roy KatmorCo-founder and CEO of Orchid; discussed AI-agent credentials.Yaakov SteinVP CTO of Allot; discussed post-quantum readiness in an interview.
Threat Actors
Malware
Vendors
AllotIn this interview with Help Net Security, Dr. Yaakov Stein, VP CTO of Allot, discusses what post-quantum readiness looks like inside a mobile network.AnthropicAnthropic locked out Claude users after infostealers compromised login sessions.CohesityIn this Help Net Security interview, Dr. Joye Purser, Global Field CISO at Cohesity, explains how to rank vulnerabilities when KEV, EPSS, and CVSS point in different directions.Microsoftnews highlighted infostealer-driven account takeovers, active exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affectingMorphisecmalware that targets passwords, cryptocurrency wallet data and login credentials, according to Morphisec.National Life GroupNational Life Group CISO expects more vulnerabilities in six months than in thirty yearsPalo Alto Networksinto installing malware or granting remote access to their computers, according to Unit 42, Palo Alto Networks’ threat intelligence team.PaperCutThe threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most recent update on the ongoing attack campaign.Reed SmithDavid Halbreich, an insurance recovery partner at Reed Smith, breaks down how AI companies should handle coverage gaps that come up as the industry grows.Sangomaactive exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKesson and Thomson Reuters.SonicWallinfostealer-driven account takeovers, active exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKesson and ThomsonThomson ReutersSonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKesson and Thomson Reuters.
Products
C-TrackThomson Reuters has disclosed a data breach affecting C-Track, a court case management platform operated by its subsidiaries, exposing court records and sensitive personal information across courts in at least 12 USClaudeIt also showed attackers abusing OAuth phishing, Microsoft Teams vishing, fake Claude apps, and AI-related tricks to steal credentials, evade detection, and interfere with malware analysis.DuckDBDuckDB stays open source while the team behind it goes to work for AmazonMicrosoft Exchangehighlighted infostealer-driven account takeovers, active exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKessonMicrosoft TeamsIt also showed attackers abusing OAuth phishing, Microsoft Teams vishing, fake Claude apps, and AI-related tricks to steal credentials, evade detection, and interfere with malware analysis.OpenClawThe OpenClaw 2.0 release moves your sessions into SQLiteSangoma Switchvoxactive exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKesson and Thomson Reuters.SonicWall SMA1000account takeovers, active exploitation of flaws in products like Microsoft Exchange, SonicWall SMA 1000, PaperCut, and Sangoma Switchvox, and major data breaches affecting McKesson and Thomson Reuters.