INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Arizona Employee Clicks Malicious Link Exposing Foster Care Records

| 2026-10-05 13:57 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
Arizona’s state court system has suffered a phishing-led cyberattack after an employee clicked a malicious link. Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participants. Japanese car-sharing service Times Car has disclosed a data breach affecting approximately 6.6 million current and former accounts. Exposed information includes personal data, while identity-verification documents, including driver’s-license images, were exposed for about 1.6 million accounts.
Technical Mitigations AI-generated
• Check Point IPS can protect against Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772) and Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771). • Use a secure version of ChatGPT to prevent the use of malicious Custom GPTs in ClickFix campaigns. • Apply patches for CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-86950CVE-2026-86950 CVE-2026-90970CVE-2026-90970 CVE-2026-88772CVE-2026-88772 CVE-2026-76504CVE-2026-76504 CVE-2026-88771CVE-2026-88771
Target & Sectors
CA GB JP PL UA ZA
governmentgovernment educationeducation telecommunicationstelecommunications financefinance energyenergy
Incident Timeline
‎2026/10/05
Threat actors used a system vulnerability to exploit SharePoint ToolShell and compromise Azure service principals, automating cloud reconnaissance and destructive actions.
infrastructure Microsoft 365
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence.
organisation SharePoint ToolShell
THREAT INTELLIGENCE REPORTS Researchers documented Warlock ransomware attacks exploiting SharePoint ToolShell vulnerabilities against organizations in the utilities, telecom, government and education sectors.
organisation SharePoint
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
infrastructure 33 hosts
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
organisation SQL
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation the US Department of Education
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation Archives Canada
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation RedFlick
The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine.
organisation CosmicPulse
The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine.
threat_actor Star Blizzard
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
victims 100 organizations
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
organisation Antino
The group deployed the Antino backdoor through spear-phishing and tailored decoy documents.
data_breach 365 credentials
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
organisation JadePuffer
Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions.
organisation Storm-3168
Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions.
organisation NetScaler
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation NetScaler ADC
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation Check Point
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Catalyst SD-WAN
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Cisco Catalyst SD-WAN
Check Point IPS provides protection against this threat (Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504))
organisation Apple
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation CoreGraphics
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation Macs
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
infrastructure Ios
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
infrastructure Macos
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
infrastructure 9.9
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
organisation GitLab
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
organisation Foster Care Review Board
Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participants.
organisation ClickFix
Researchers demonstrated that malicious Custom GPTs hosted on ChatGPT were used in a ClickFix campaign to deliver remote access malware.
organisation PDF
Processing a malicious image or PDF can allow arbitrary code execution.
Tactical Metrics
Metrics
victims
100
Organizations
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
Metrics
infrastructure
33
Hosts
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence.
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Metrics
data_breach
365
Credentials
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Metrics
infrastructure
‎Ios
Affected Product
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
Metrics
infrastructure
‎Macos
Affected Product
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
Metrics
infrastructure
‎9.9
Software Version
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
Intelligence Sources
Check Point Research 2026-10-05