eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
ClickFix Campaign Distributed Through Shared Claude Chats
Bottom Line: Threat actors are leveraging Claude’s legitimate shared chat feature to trick users into executing malicious commands, abusing the platform.
On June 17th, 2026, Trend Micro published research on a sophisticated malvertising campaign in which threat actors leveraged trusted platforms, including Google Ads, GitLab Pages, and Claude.ai, to distribute malware through social engineering techniques. Running from April 8 to June 14, 2026, the campaign impersonated at least six legitimate AI brands, including Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains, and recorded over 2,000 confirmed victim interactions across seven weeks and six distinct attack waves.
The attackers primarily targeted users searching for popular AI development tools by purchasing malicious Google Ads that appeared alongside legitimate search results. The campaign relied on infrastructure hosted on GitLab Pages, where attackers created numerous malicious subdomains under the trusted *.gitlab.io domain. These sites mimicked legitimate software download pages and were rotated frequently to evade detection. A major escalation occurred in early May 2026 when the threat actors pivoted from GitLab-hosted pages to abusing Claude.ai’s shared chat feature. In this phase, malicious Google Ads redirected victims to publicly accessible Claude.ai shared chat URLs hosted on a legitimate domain.
Once a victim accessed the malicious shared chat page, they were presented with convincing instructions disguised as support guidance from entities such as Apple Support or the Corda Team. These instructions guided the user to open a terminal and execute a command that appeared benign but actually contained an obfuscated payload encoded in base64. Upon execution, the command initiated a chain of scripts that ultimately deployed the MacSync infostealer. This malware was designed to collect sensitive information from the compromised system, including browser credentials, cookies, SSH keys, and cryptocurrency wallet data. The exfiltrated information was then transmitted to attacker-controlled servers. The malware included a geographic evasion check that prevented execution on systems configured with Russian keyboard layouts. Confirmed victims spanned Taiwan, Japan, Singapore, India, France, and Italy, with Taiwan bearing the heaviest impact at 30.5% of total traffic.
eSentire Threat Intelligence Analysis:
This campaign showcases the evolving tactics of malvertising that exploit the growing popularity of AI developer tools. As AI tools become more deeply embedded in developer workflows, threat actors will continue to find ways to weaponize the trust these platforms have earned.
eSentire’s Threat Intelligence team has observed similar threat activity involving the delivery of infostealers through ClickFix campaigns that mimic Claude URLs as trusted lures. To mitigate the risks associated with this type of attack, organizations are advised to educate users about the dangers of executing command-line instructions sourced from web pages, particularly when delivered through advertisements. Monitoring for unusual terminal or PowerShell activity following web browsing sessions can also help identify potential compromises. End users are encouraged to avoid clicking on sponsored search results for software downloads and instead navigate directly to official vendor websites or use trusted package managers.
In response to the campaign, Anthropic took action by banning the malicious accounts and disabling the offending shared conversations. Additional mitigation measures are being implemented to prevent further abuse of the shared chat feature.
FortiBleed: The Compromise of 80,000+ Fortinet Firewalls
Bottom Line: FortiBleed is an ongoing largescale campaign targeting Fortinet firewalls and VPN appliances, via previously compromised credentials.
On June 16th, 2026, SOCRadar published a report on threat actor infrastructure that contained login credentials for Fortinet firewall and VPN appliances belonging to corporations and governments from around the globe. The campaign, dubbed FortiBleed, was initially discovered by the researcher Volodymyr Diachenko, and the uncovered data was verified by another researcher, Kevin Beaumont. The dataset includes usernames, email addresses, and plaintext passwords that appear to have originated from exports of configuration files from impacted Fortinet devices; the dataset was validated as “recent”. The credentials can be used by threat actors to gain unauthorized access to Fortinet appliances, where settings and security controls can be modified, or malicious backdoor user accounts can be created.
The campaign involved threat actors “quietly breaking into corporate Fortinet FortiGate firewalls and SSL VPN gateways on a massive, global scale”. The dataset contains credentials for over 86,000 Fortinet appliances, spanning across 194 countries. Most impacted devices were found to be in the United States and India. FortiBleed is suspected to be linked to Russian speaking threat actors, and based on the information contained within the dataset, including type of company, revenue, and country, it is believed to potentially be linked to an Initial Access Broker (IAB) operation, but this is unverified.
On June 19th, RansomNews published a report on the FortiBleed campaign, suggesting that the dataset was retrieved via a brute-forcing operation, where the attackers scanned FortiGate endpoints and conducted password spraying using a custom tool called forticheck. If the password spray was successful and access was obtained, network sniffers would be deployed to capture cleartext credentials and password hashes, which would be cracked offline. RansomNews indicates that targeting was not random, and that organizations were “ranked by revenue” using open-source intelligence. Later on June 19th, Fortinet confirmed that credentials used in the FortiBleed campaign were stolen via brute force attacks as well as part campaigns targeting known Fortinet vulnerabilities (CVE-2026-24858, CVE-2025-59718, CVE-2025-59719).
In response to the campaign, publicly accessible tools have been released, allowing organizations to search the uncovered dataset to identify potential impact. On June 18th, CISA published an advisory providing recommendations that organizations can take to ensure that Fortinet devices are hardened, including restricting access to management interfaces, and ensuring that Multi-Factor Authentication (MFA) is applied to all accounts where possible.
eSentire Threat Intelligence Analysis:
SOCRadar highlights that the FortiBleed campaign is ongoing, where the “attacker’s infrastructure is running and new victims continue to be added”. Kevin Beaumont’s assessment that the identified credentials appear recent and valid is notable, as it indicates that the exposed credentials are not taken from years old incidents, as was the case with the similar Belsen Group leak in January 2025. RansomNews suggested that access was obtained through a large-scale brute force campaign; a statement from a Fortinet spokesperson seems to corroborate these findings, suggesting that FortiBleed is likely a “resharing of data from previous incidents, as well as brute-forcing of credentials”, and not related to a “current incident or advisory”.
The notion that attackers may have also targeted organizations based on perceived revenue is also important, as it further suggests FortiBleed as being part of an IAB campaign. FortiBleed operators could sell access to target environments for higher costs based on this data or assessed by their ability to pay a potential ransom demand. The FortiBleed dataset was also cross-referenced with other exposed data and found to have overlaps with previous information stealer logs, breach data, and ransomware leak sites, suggesting that the data may have also been compiled through these methods as well.
As the FortiBleed campaign is ongoing, organizations that utilize Fortinet firewalls and VPN services should ensure that all devices are fully up to date on security patches, and that access to management interfaces is restricted to trusted IP addresses. Default credentials should not be used, and strong password policies and MFA should also be enforced on all accounts, to reduce the likelihood of successful brute force attacks. As credentials may have been sourced from previous incidents, organizations that responded to earlier breaches by only patching vulnerabilities without also rotating credentials could remain at risk. Organizations should also review the mentioned tools to assess impact; if found, credentials should be rotated, and administrative user activity should be audited.
In response to this disclosure, eSentire published an advisory, and eSentire’s Threat Response Unit (TRU) performed threat hunts to identify potential signs of compromise. eSentire’s Threat Intelligence team is continuing to track this topic for additional information and detection opportunities.
Espionage Campaign Targeting North American Organizations
Bottom Line: A PRC-nexus threat actor (UNC6508) was discovered conducting a long-running, covert cyber espionage campaign targeting North American medical, academic, and military research entities to collect sensitive data on AI, defense, and healthcare research.
On June 15th, 2026, Google’s Threat Intelligence Group (GTIG) and Mandiant Consulting disclosed a long-running cyber espionage campaign attributed with high confidence to UNC6508, a newly identified Peoples’ Republic of China (PRC) nexus threat cluster. The activity has been traced back to September 2023, with attacker dwell times lasting over a full year in the compromised networks. Targets spanned academic, medical, and military research institutions across North America. UNC6508 attempted to steal information including “sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research”.
In observed attacks, UNC6508 gained initial access to organizations by exploiting externally facing REDCap servers; the specific vulnerabilities targeted are not specified in the report. Three months after access was established, a custom malware dubbed INFINITERED, was deployed to maintain persistence and capture credentials. More than a year after access was first achieved, the threat actors implemented a rule to forward all emails with specific keywords to an attacker-controlled Gmail account.
Google has since disrupted the malicious infrastructure used in this campaign, including Gmail accounts used for data theft. Organizations identified as impacted by UNC6508 were notified by Google.
eSentire Threat Intelligence Analysis:
UNC6508’s Tactics, Techniques, and Procedures (TTPS), targeting, and data theft specifics are in line with known Chinese APT activity. National defence and cyber offensive program information could be utilized for espionage and strategic planning purposes. AI and medical research may enable economic espionage, including state owned businesses gaining a competitive advantage against North American organizations. The Canadian Center for Cybersecurity (CCCS) has previously confirmed that PRC associated actors conduct cyberattacks to establish a competitive advantage in the fields of biopharmaceutical and biomanufacturing capacities, as well as dual use technologies with applications in both military and consumer goods.
Despite disruption of infrastructure used in the reported campaign, The eSentire Threat Intelligence team assesses that it is probable UNC6508 will continue targeting organizations in related fields for espionage purposes. The group may invest in alternative tooling and exploits, as well as pivoting away from any known infrastructure, to avoid detection. To defend against PRC actors, organizations should prioritize the patching of all vulnerabilities, especially those in Internet-facing applications that can be utilized for initial access. The use of phishing resistant Multi-Factor Authentication (MFA) should be enforced for all accounts.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
