================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, June 30, 2026 - 6:06 AM EDT ================================================================ Researchers turned AI browsers from OpenAI, Perplexity, and Anthropic into credential thieves, and malicious AI-branded extensions and poisoned repositories spread the same playbook. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] LayerX's BioShocking trick fooled AI browsers from OpenAI, Perplexity, and Anthropic into copying a user's login credentials by disguising the theft as a game. see: AI Browsers Surrender User Credentials * [TREND] Attackers are weaponizing fresh flaws as Djinn Stealer rides a SimpleHelp bypass, ransomware crews adopt the BlueHammer Defender bug, and Kemp LoadMaster faces a 9.8-severity root exploit. see: SimpleHelp Flaw Spreads Djinn Stealer; BlueHammer Defender Flaw Turns Ransomware Weapon; Critical Flaws Open Appliances and Devices * [TREND] China-aligned Mustang Panda and other spies are hiding command traffic inside Zoho WorkDrive and Gmail OAuth tokens to blend espionage into routine corporate cloud noise. see: Nation-State Spies Abuse Cloud Services * [UPDATE (new)] Investigators confirmed only a handful of the roughly 100 victims in the ShinyHunters Oracle PeopleSoft campaign as Nissan detailed stolen current and former employee data. see: Oracle PeopleSoft and E-Business Suite Breaches Widen * [TREND] Commentators sharpen AI-bubble skepticism as Zitron catalogs strained boom economics, Newport revives the productivity paradox, and Figma's Dylan Field calls AI a tailwind, not a threat. see: Premium: Notes From The Bubble, Volume 1; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI * [TREND] Markets churned as the yen sank to a 40-year low on Fed hawkishness while the Magnificent Seven shed $2.3 trillion amid a rotation into chipmakers. see: Yen Hits 40-Year Low as Fed Turns Hawkish; Magnificent Seven Shed $2.3 Trillion in Tech Rotation SECURITY ---------------------------------------------------------------- 1. AI BROWSERS SURRENDER USER CREDENTIALS AI Security · [ai, browser, credential-theft] Latest developments: LayerX's BioShocking technique convinced six AI browsers and assistants—including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension—that they were playing a game, then watched them copy a user's credentials to an attacker, while Microsoft pulled a Chrome extension spoofing Perplexity that logged every search and address-bar keystroke through an attacker server, and SecurityWeek demonstrated indirect prompts hidden in a repository spawning a reverse shell through Claude Code. A wave of attacks weaponizes agentic AI tools against their own users, abusing browser assistants, fake AI-branded extensions, and developer agents to steal credentials and seize machines. Treat AI browser and extension permissions as privileged, vet extensions, and isolate coding agents from untrusted repositories. - The Hacker News: https://thehackernews.com/2026/06/new-bioshocking-attack-tricks-ai.html - The Hacker News: https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/06/29/chromium-extension-uses-airelated-branding-redirect-browser-search/ - SecurityWeek: https://www.securityweek.com/new-attack-abuses-claude-code-and-harmless-looking-repositories-to-hijack-developer-machines/ 2. ORACLE PEOPLESOFT AND E-BUSINESS SUITE BREACHES WIDEN Data Breaches · [breach, zero-day, extortion] Latest developments: SecurityWeek reported June 30 that investigators have confirmed only a handful of the roughly 100 organizations swept up in the ShinyHunters Oracle PeopleSoft campaign, as Nissan detailed stolen current and former employee data, the National Association of Insurance Commissioners said the group took only public data, outdated logs, and configuration files despite claiming 3.1 terabytes, and Defused confirmed fresh exploitation of the separate E-Business Suite flaw CVE-2026-46817 in Oracle Payments. The ShinyHunters extortion group exploited Oracle PeopleSoft and E-Business Suite zero-days to loot data from about 100 organizations, including Nissan and the NAIC. Oracle customers running PeopleSoft and EBS should patch and hunt for data-theft activity. - SecurityWeek: https://www.securityweek.com/nissan-employee-data-breached-in-oracle-peoplesoft-hack/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/nissan-discloses-employee-data-breach-linked-to-oracle-zero-day-attacks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach/ - The Hacker News: https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html 3. SIMPLEHELP FLAW SPREADS DJINN STEALER Vulnerabilities and Exploits · [infostealer, exploit, patch] Latest developments: Fresh analysis shows Djinn Stealer, delivered through SimpleHelp authentication-bypass flaw CVE-2026-48558, runs cross-platform across Windows, macOS, and Linux and zeroes in on cloud and AI credentials, SSH keys, cryptocurrency wallets, and developer tooling that links development and admin environments to wider enterprise systems. Attackers exploit a critical SimpleHelp remote-support flaw to drop the previously undocumented Djinn Stealer and the TaskWeaver loader. Patch SimpleHelp immediately and rotate any credentials, keys, and wallets reachable from affected hosts. - SecurityWeek: https://www.securityweek.com/critical-simplehelp-vulnerability-exploited-for-malware-delivery/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/ - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog 4. CRITICAL FLAWS OPEN APPLIANCES AND DEVICES Vulnerabilities and Exploits · [vulnerability, patch, rce] Latest developments: Progress disclosed CVE-2026-8037, a 9.8-severity flaw that lets an unauthenticated attacker run root commands on Kemp LoadMaster through its API, Apple patched over 30 iOS, macOS, and Safari flaws including four WebKit bugs found with Anthropic Claude and OpenAI Codex, researchers revealed AirDrop and Quick Share flaws affecting more than five billion Apple, Google, and Samsung devices, and CISA flagged three Daktronics controller flaws exposing highway signs and billboards to remote hacking. A run of critical patches lands across network appliances, consumer devices, and roadside controllers, several reachable without authentication. Administrators should update Kemp LoadMaster, Apple devices, and Daktronics controllers now and watch for proximity-based AirDrop and Quick Share fixes. - The Hacker News: https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html - The Hacker News: https://thehackernews.com/2026/06/apple-patches-30-ios-macos-safari-flaws.html - Help Net Security: https://www.helpnetsecurity.com/2026/06/30/apple-airdrop-google-samsung-quick-share-vulnerabilities/ - SecurityWeek: https://www.securityweek.com/new-controller-flaws-expose-highway-signs-and-billboards-to-remote-hacking/ 5. NATION-STATE SPIES ABUSE CLOUD SERVICES Nation-State Activity · [apt, espionage, critical-infrastructure] Latest developments: Acronis caught China-aligned Mustang Panda running two campaigns against the Indian government and hydropower targets using Zoho WorkDrive as a command channel, Kaspersky detailed ToddyCat's new Umbrij tool stealing Gmail OAuth tokens to read corporate email, ESET counted 35 Gamaredon spear-phishing campaigns against Ukraine through 2025, and Dark Reading reported Iran, Russia, and China breaching water systems through weak passwords and exposed PLCs. State-backed groups increasingly hide command traffic inside legitimate cloud platforms like Zoho WorkDrive and Gmail while pressing attacks on governments, energy, and water utilities. Defenders should monitor cloud-service abuse, lock down OAuth tokens, and harden exposed industrial controllers. - The Hacker News: https://thehackernews.com/2026/06/mustang-panda-uses-zoho-workdrive-as.html - Securelist (Kaspersky): https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/ - The Hacker News: https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html - Dark Reading: https://www.darkreading.com/ics-ot-security/iran-russia-china-target-water-systems-sabotage 6. BLUEHAMMER DEFENDER FLAW TURNS RANSOMWARE WEAPON Ransomware and Cybercrime · [ransomware, privilege-escalation, patch] Latest developments: CISA confirmed that ransomware gangs now exploit BlueHammer, a Microsoft Defender privilege-escalation vulnerability that attackers previously abused in zero-day attacks, marking its shift from targeted espionage to broad criminal use. BlueHammer lets attackers escalate privileges through Microsoft Defender, and ransomware crews have folded it into their playbooks. Apply Microsoft's patch and prioritize the flaw under CISA's exploited-vulnerability directive. - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Yen Hits 40-Year Low as Fed Turns Hawkish Latest developments: The yen slid past ¥162 to its weakest against the dollar in 40 years on June 30, putting Tokyo on intervention watch as traders now expect the Federal Reserve to raise rates this year. Japan's currency fell to a four-decade low after the Fed's hawkish shift, and Finance Minister Satsuki Katayama renewed her pledge to curb excessive yen volatility; gold tracked a 12% monthly loss on the same repricing. - WSJ Markets: https://www.wsj.com/finance/currencies/yen-falls-to-40-year-low-versus-dollar-traders-alert-for-potential-fx-intervention-ad9b6d9f?mod=rss_markets_main - FT Markets: https://www.ft.com/content/51a7198d-b00b-4e68-9c8b-1b5fbbdcf510 - WSJ Markets: https://www.wsj.com/finance/investing/u-s-futures-edge-up-yen-hits-40-year-dollar-low-8f295bc6?mod=rss_markets_main * Magnificent Seven Shed $2.3 Trillion in Tech Rotation Latest developments: The seven largest U.S. technology stocks have lost $2.3 trillion as investors rotate into chipmakers riding hyperscalers' AI spending, even as the Nasdaq tracks a 20% quarterly gain. Wall Street is moving money out of megacaps like Nvidia's Magnificent Seven peers and into semiconductor makers that supply the AI buildout, reshaping market leadership as the S&P 500 sets up to close its best quarter since 2020. - FT World: https://www.ft.com/content/b90bdfcb-d773-42f7-bb5f-52dbd28b2174 - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-06-30-2026?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 94F. Tonight: Partly Cloudy, low 76F. Wednesday: Sunny, high 98F. Business: * Switch Plans Data-Center Campus at Former Pitt Race Latest developments: Residents gathered June 29 to oppose Switch's proposal for three data-center buildings on roughly 400 acres of the former Pitt Race motorsports property in Beaver County. The data-center developer Switch wants to build a three-building campus on the old Pitt Race track in Beaver County, drawing organized opposition from neighbors worried about its scale and footprint. - WPXI: https://www.wpxi.com/news/local/group-gathers-oppose-proposed-data-center-development-site-former-beaver-county-racetrack/Y6VHQEVLQJBLRHYNYM6PWZCISM/ * River Valley District Scrambles to Repay Loan Latest developments: The River Valley School District board approved a last-minute plan June 29 to repay a short-term loan one day before the payment came due. River Valley School District lacked the funds to cover a short-term loan and its board passed an eleventh-hour repayment plan a day before the bill was due, exposing the district's financial strain. - WTAE: https://www.wtae.com/article/river-valley-school-district-plan-pay-off-loan-financial-struggles/71776702 * Power Surge Tests Pittsburgh Airport's Microgrid Latest developments: An unprecedented power surge hit Pittsburgh International Airport, testing the microgrid the airport built to run independent of the regional grid. Pittsburgh International Airport's microgrid, which it built to keep operating apart from the regional power grid, faced an unprecedented power surge that tested whether it works as planned. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/06/30/pittsburgh-airport-microgrid-outage-surge/stories/202606280061 Around town: * Dangerous Heat Wave Hits Western Pennsylvania Latest developments: The National Weather Service heat advisory took effect at 11 a.m. June 30 and runs through 10 p.m. Friday, with 90-degree highs and heat-index readings near 100; towns moved trash pickup earlier and Duquesne Light added crews. Western Pennsylvania's hottest stretch of 2026 brings 90-degree highs and 'feels-like' readings near 100 through Friday, prompting Pittsburgh-area communities to shift trash collection to cooler morning hours and Duquesne Light to boost staffing against possible outages. - KDKA: https://www.cbsnews.com/pittsburgh/news/heat-advisory-pittsburgh-area-heat-wave-national-weather-service-high-temperatures/ - KDKA: https://www.cbsnews.com/pittsburgh/news/trash-pickup-schedules-adjusted-in-pittsburgh-area-communities-due-to-impending-heat-wave/ - KDKA: https://www.cbsnews.com/pittsburgh/video/duquesne-light-urging-customers-to-prepare-for-extreme-heat-forecasted-to-hit-the-pittsburgh-area/ * Pittsburgh Drafts Rules for Staff AI Use Latest developments: PublicSource reported June 30 that Pittsburgh's city government is racing to set guidelines for its workers' use of artificial intelligence, training staff before publishing rules it has yet to release. Pittsburgh's city government is writing internal guidelines to govern how employees use AI, prioritizing getting staff up to speed over public release of the policy as it tries to keep pace with a fast-moving technology whose decisions could ripple for decades. - PublicSource: https://www.publicsource.org/five-years-in-ai-is-an-eternity-inside-pittsburghs-work-to-govern-a-technology-moving-too-fast-to-predict/ * Hempfield Area Breaks Ground on High School Overhaul Latest developments: Hempfield Area officials and residents gathered June 29 to break ground on the long-awaited renovation of the district's high school in Westmoreland County. Hempfield Area School District began its long-planned high school renovation in Westmoreland County, a project officials framed as building for an evolving education landscape. - TribLive: https://triblive.com/local/westmoreland/a-legacy-that-will-extend-far-beyond-these-walls-hempfield-area-celebrates-groundbreaking-of-high-school-renovation/ Events: * Picklesburgh, Goat Fest, and Anthrocon Headline July Latest developments: NEXTpittsburgh's July guide, posted June 29, rounds up the month's signature events, from Picklesburgh to Goat Fest to Anthrocon's furry parade. Pittsburgh's July calendar fills with outdoor staples: Picklesburgh downtown, Goat Fest, and Anthrocon, whose roughly 18,000 attendees stage a furry parade; NEXTpittsburgh's roundup also points to the North Side Music Festival in its Summer Concert Guide. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/12-iconic-pittsburgh-things-to-do-in-july-2026/ * 'French Moderns' Opens at The Frick Pittsburgh Latest developments: The Post-Gazette on June 30 spotlighted 'French Moderns,' the exhibition now at The Frick Pittsburgh surveying an era of artistic freedom. The Frick Pittsburgh, in Point Breeze, is showing 'French Moderns,' an exhibition of modern French painting and sculpture exploring what it meant to be modern. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/06/30/french-moderns-frick-pittsburgh/stories/202606290023 * Carnegie Museum Closes 'Polar World' After 43 Years Latest developments: The Carnegie Museum of Natural History is retiring its 'Polar World' exhibit after 43 years, the Post-Gazette reported, giving visitors a last chance to see it. After 43 years, the Carnegie Museum of Natural History in Oakland is closing 'Polar World,' its long-running Arctic and Antarctic exhibit. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/06/27/polar-world-carnegie-museum-of-natural-history-closure/stories/202606280064 SPORTS ---------------------------------------------------------------- Pirates (43-42) Mon Jun 29 · Pirates 11 · Phillies 7 · Final Valdez, Triolo and Rodriguez homer for Pirates in 11-7 win over Phillies https://plaintextsports.com/mlb/2026-06-29/pit-phi Up Next · Pirates @ Phillies · Tue Jun 30, 6:40 PM https://plaintextsports.com/mlb/2026-06-30/pit-phi Around the Teams: * Pirates Prospect Hernandez First to 100 Minor-League Strikeouts Latest developments: The Post-Gazette's MiLB Monday on June 29 noted Pirates top prospect Seth Hernandez became the first pitcher in the minor leagues to reach 100 strikeouts this season. Seth Hernandez, the Pirates' top pitching prospect, leads all of the minor leagues with 100 strikeouts, a milestone the Post-Gazette's MiLB Monday column highlighted. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/29/milb-prospects-hernandez-reinold-navarro-estuar-suero/stories/202606280113 * Why Only Seven Home Runs Have Reached the Allegheny Latest developments: A Post-Gazette feature broke down the physics behind why only seven home runs have cleared into the Allegheny River on the fly since PNC Park opened. In a quarter-century at PNC Park, only seven home runs—including O'Neil Cruz's blasts—have reached the Allegheny River on the fly, and a Post-Gazette piece explained the physics that makes the feat so rare. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/29/homerun-allegheny-river-science-physics-oneil-cruz/stories/202606260054 * Steelers' SNR Drive Builds All-Time Fantasy Roster Latest developments: The Steelers' SNR Drive show, in a June 26 episode the team posted June 29, had hosts Matt Williamson and Wes Uhler assemble their all-time Steelers fantasy-football team. On the team-produced SNR Drive, Matt Williamson and Wes Uhler drafted an all-time Steelers fantasy-football roster, debating the franchise's greatest players to fill the offseason lull. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=ugV5BReiPng Team USA: * USMNT Faces Bosnia in Round of 32 Latest developments: Ahead of Wednesday's round-of-32 match, captain Tim Ream said he feels no added pressure as the United States braces for surprises from Bosnia and Herzegovina, the Guardian reported June 29. The United States men's team, winners of Group D as co-host, plays Bosnia and Herzegovina on Wednesday, July 1, in the World Cup round of 32, with captain Tim Ream playing down knockout-round tension. - Guardian World Cup 2026: https://www.theguardian.com/sport/2026/jun/29/usmnt-bosnia-herzegovina-world-cup-round-of-32-preview * Malik Tillman Stars in USMNT Midfield Latest developments: ESPN profiled Malik Tillman on June 30, noting he has flourished in an unfamiliar U.S. midfield role after a disappointing club season at Bayer Leverkusen. Malik Tillman, shuffled into a new central-midfield spot for the United States, has become one of the team's standouts at the World Cup despite a down year with Bayer Leverkusen. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49214102/tillman-having-great-world-cup-usmnt-never-tell-himself READING ---------------------------------------------------------------- * Cal Newport -- Beware of Productivity Paradoxes Newport argues that the personal computer, seemingly a sure productivity win, shows how new tools can fail to deliver the gains they promise—a cautionary frame for today's claims about AI. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field on building the design company and why Field believes AI works as a tailwind rather than a threat to its business. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ * Ed Zitron -- Premium: Notes From The Bubble, Volume 1 Zitron launches an ongoing series cataloguing what he sees as mounting evidence of an AI investment bubble and the strained economics behind the boom. https://www.wheresyoured.at/premium-notes-from-the-bubble-volume-1/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,375.12 ▼ -1.6% Dow 51,899.04 ▲ +0.4% Nasdaq 25,508.01 ▼ -3.2% WTI crude 71.09 ▼ -7.7% EUR/USD 1.1382 ▼ -1.3% GBP/USD 1.3200 ▼ -0.8% USD/JPY 161.70 ▲ +0.6% ================================================================ Generated 2026-06-30 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================