================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, June 30, 2026 - 4:05 PM EDT ================================================================ Microsoft and independent researchers proved that AI agents can be hijacked through poisoned MCP tool descriptions, decades-old shell tricks, and exposed Langflow endpoints, turning the autonomous agent layer into the day's softest attack surface. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Poisoned MCP tool descriptions and an unauthenticated Langflow flaw show the AI agent layer is now an exploitable surface attackers weaponize for data theft and Monero mining. see: Poisoned MCP Tools and Shell Tricks Hijack AI Agents; Langflow RCE Deploys Monero Miner * [TREND] China-linked operators sharpened espionage as ToddyCat's new Umbrij tool stole Google OAuth tokens to read corporate Gmail and booby-trapped USB drives infected Japanese military networks. see: China-Linked Espionage Steals Gmail Tokens and Hits Japanese Military * [TREND] Japan absorbed outsized damage as Aflac's Tokyo subsidiary lost data on 4.38 million policyholders and the Blackfield gang demanded $2 million from motor maker Nidec. see: Aflac Japan Breach Exposes 4.38 Million; Blackfield Ransoms Nidec as RustDuck Botnet Spreads * [UPDATE (new)] The Supreme Court ruled cellphone location history is constitutionally protected, siding against a geofence warrant, the same day the House passed the Kids Internet and Digital Safety Act. see: Supreme Court Shields Phone Location Data as House Passes KIDS Act * [TREND] Fresh essays question the AI boom's economics, with Zitron arguing the industry is structurally losing money, Newport warning of a productivity paradox, and Figma's Dylan Field seeing a tailwind. see: The AI Industry Is Losing; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI SECURITY ---------------------------------------------------------------- 1. POISONED MCP TOOLS AND SHELL TRICKS HIJACK AI AGENTS AI Security · [ai, supply-chain, exploit] Latest developments: Microsoft Incident Response published research June 30 showing that attackers poison a Model Context Protocol tool's description to make an AI agent quietly forward company data to an outsider while every step looks routine, the same day Adversa AI disclosed GuardFall, a decades-old Bash shell trick that walks past the safety checks in ten of the eleven open-source coding and computer-use agents it tested. Model Context Protocol lets AI agents call external tools, and a malicious tool description can order the agent to exfiltrate sensitive data without breaking any rule. The same agents fall to GuardFall's shell-quoting bypass, which turns a malicious repository into a supply-chain vector. Audit agent permissions and vet every tool source. - The Hacker News: https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/ - The Hacker News: https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html - SecurityWeek: https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/ 2. CHINA-LINKED ESPIONAGE STEALS GMAIL TOKENS AND HITS JAPANESE MILITARY Nation-State Activity · [apt, espionage] Latest developments: Kaspersky's Securelist detailed Umbrij, a new ToddyCat tool that captures Google OAuth authorization tokens to read victims' corporate Gmail, while Bitdefender reported that USB drives carrying China-linked malware infected Japanese military networks for close to a year. ToddyCat, a long-running APT, sidesteps passwords by hijacking OAuth tokens to reach Gmail and other Google services. A parallel China-linked operation seeded removable USB drives that quietly persisted on Japan's military networks. Both abuse trusted authorization and removable media rather than software flaws. - Securelist (Kaspersky): https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/ - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/usb-drives-carrying-china-linked-malware-infected-japanese-military-networks-for-nearly-a-year 3. AFLAC JAPAN BREACH EXPOSES 4.38 MILLION Data Breaches · [breach, insurance] Latest developments: Aflac disclosed June 30 that attackers reached its Japan subsidiary's policyholder portal repeatedly between June 15 and June 25 and stole personal and bank-account information on 4.38 million policyholders. Aflac, the American insurance giant, lost sensitive policyholder and banking data after intruders breached its Tokyo subsidiary's web portal over a ten-day window. Affected customers should monitor accounts and watch for notification. - SecurityWeek: https://www.securityweek.com/aflac-japan-data-breach-impacts-4-38-million/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack/ 4. BLACKFIELD RANSOMS NIDEC AS RUSTDUCK BOTNET SPREADS Ransomware and Cybercrime · [ransomware, botnet, ddos] Latest developments: The Blackfield ransomware gang demanded $2 million from Nidec Corporation, the Japanese motor and electronic-components maker, the same day QiAnXin's XLab detailed RustDuck, a two-stage botnet rebuilt in Rust that conscripts routers, cameras, and servers for DDoS. Blackfield's extortion of Nidec adds another major Japanese manufacturer to the day's ransomware tally. RustDuck, tracked since February 2026, hijacks home routers, IP cameras, Android boxes, and weakly secured servers, stitching them into a fast-mutating network built to knock services offline. - BleepingComputer: https://www.bleepingcomputer.com/news/security/blackfield-ransomware-asks-nidec-corporation-for-2-million-ransom/ - The Hacker News: https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html 5. SUPREME COURT SHIELDS PHONE LOCATION DATA AS HOUSE PASSES KIDS ACT Policy and Regulation · [policy, privacy] Latest developments: The Supreme Court ruled June 30 that constitutional privacy protections cover cellphone location history, deciding for a bank robber whom a geofence warrant had identified, while the House passed the Kids Internet and Digital Safety Act by a 267-117 margin that the Senate looks unlikely to advance. The Court extended Fourth Amendment protection to the location trails phones leave behind, constraining geofence warrants nationwide. The House's KIDS Act would tighten online safeguards for minors but faces dim prospects in the Senate. - SecurityWeek: https://www.securityweek.com/supreme-court-rules-constitutional-privacy-protections-apply-to-cellphone-users-location-history/ - The Record: https://therecord.media/house-passes-kids-online-safety-bill-senate-unlikely 6. LANGFLOW RCE DEPLOYS MONERO MINER AI Security · [ai, rce, cryptomining] Latest developments: Threat actors are scanning the internet for exposed Langflow instances and exploiting CVE-2026-33017, a 9.3-severity unauthenticated remote-code-execution flaw, to install a Monero cryptocurrency miner. Langflow, a popular visual builder for AI workflows, carries an unauthenticated RCE bug that lets attackers run code on any exposed server. The current campaign drops a Monero miner. Patch immediately and pull Langflow off the public internet. - The Hacker News: https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 94F. Tonight: Mostly Clear, low 76F. Wednesday: Sunny, high 98F. Business: * UPMC Profits Rebound as Pay Rises Latest developments: PublicSource reported June 30 that UPMC's profits have returned and executive compensation climbed even as the network expands into Ohio. UPMC, Pittsburgh's largest healthcare network and employer, posted renewed profits and raised executive pay while pushing its expansion into Ohio, a recovery shadowed by recent layoffs and looming federal funding cuts. - PublicSource: https://www.publicsource.org/upmc-profits-increase-expansion-efforts-continue/ * Meijer Advances Cranberry Township Store Latest developments: The Post-Gazette reported June 30 that Meijer moved a step closer to building at the Henderson Crossings development in Cranberry Township. Michigan grocery chain Meijer advanced its plan for a store at the Henderson Crossings development in Cranberry Township, Butler County, extending the retailer's push into Pittsburgh's northern suburbs. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/pittsburgh-company-news/2026/06/30/meijer-henderson-crossings-cranberry-township-grocery/stories/202606290040 * JetBlue Marks 20 Years at Pittsburgh Airport Latest developments: TribLive reported June 30 that Pittsburgh International Airport and JetBlue marked two decades since the carrier arrived. Pittsburgh International Airport and JetBlue employees shared a plane-themed cake June 30 to mark 20 years since the airline's arrival, a move credited with helping reverse Western Pennsylvania's shrinking air service after the region lost its hub. - TribLive: https://triblive.com/business/how-jetblues-arrival-20-years-ago-was-turning-point-for-pittsburgh-international-airport/ Around town: * Extreme Heat Warning Through Friday Latest developments: The National Weather Service upgraded most of the region to an extreme heat warning running through 10 p.m. Friday, July 3, escalating the earlier code red advisory. Most of western Pennsylvania sits under an extreme heat warning through Friday, July 3, with heat-index values flirting with 100 degrees over the July 4 weekend; Pittsburgh-area communities shifted trash collection to early-morning hours to spare crews. - KDKA: https://www.cbsnews.com/pittsburgh/news/heat-advisory-pittsburgh-area-heat-wave-national-weather-service-high-temperatures/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/06/30/extreme-heat-warning-pittsburgh/stories/202606300035 * City Settles Fern Hollow Bridge Claims Latest developments: Pittsburgh City Council approved settlements June 30 with people hurt in the Fern Hollow Bridge collapse. Pittsburgh City Council approved financial settlements with victims of the January 2022 Fern Hollow Bridge collapse in Frick Park, where the aging span gave way and dropped a city bus and several vehicles into the ravine below. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/06/30/pittsburgh-fern-hollow-bridge-settlements/stories/202606300038 * Court Fight Over County Pension Fund Latest developments: TribLive reported June 30 that a court hearing opened over Allegheny County's underfunded employee pension. A lawyer for the Allegheny County district attorney's office argued in court June 30 that the county and its retirement board have let the employee pension fund grow dangerously unhealthy, opening a legal fight over how to repair it. - TribLive: https://triblive.com/local/legal-battle-over-fixing-allegheny-county-pension-fund-crisis-unfolds-in-court/ Events: * Great Pittsburgh Book Crawl Returns Latest developments: Pittsburgh Magazine detailed June 30 the Great Pittsburgh Book Crawl, running July 18 through 26. The Great Pittsburgh Book Crawl runs Saturday, July 18, through Sunday, July 26, sending readers to 30 bookstores across neighborhoods from Lawrenceville to Squirrel Hill; a free passport, available while supplies last at any participating shop, collects stamps along the way. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/know-it-all-the-great-pittsburgh-book-crawl/ * Brighton Heights Plans First Book Fair Latest developments: Pittsburgh Magazine reported June 30 that Brighton Heights will hold its first book fair this July at Legion Park. Book-club organizer Anne Perri Cole and neighbors will stage the first Brighton Heights Book Fair this July at Legion Park, with the mobile bookstore Raven's Quill among the sellers on hand. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/brighton-heights-book-fair-2026-legion-park/ SPORTS ---------------------------------------------------------------- Pirates (43-42) Mon Jun 29 · Pirates 11 · Phillies 7 · Final Valdez, Triolo and Rodriguez homer for Pirates in 11-7 win over Phillies https://plaintextsports.com/mlb/2026-06-29/pit-phi Up Next · Pirates @ Phillies · Tue Jun 30, 6:40 PM https://plaintextsports.com/mlb/2026-06-30/pit-phi Around the Teams: * The Physics of PNC Park's River Homers Latest developments: A Post-Gazette feature June 29 examined why only seven home runs have reached the Allegheny River on the fly at PNC Park. A Post-Gazette piece broke down the physics behind PNC Park's rare river home runs, noting only seven balls have cleared the right-field stands into the Allegheny on the fly in the park's history, with O'Neil Cruz among the sluggers cited as candidates to do it. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/29/homerun-allegheny-river-science-physics-oneil-cruz/stories/202606260054 * Reading the Steelers' Reshaped Offense Latest developments: A Post-Gazette guide June 30 laid out seven things fantasy players and fans should know about the Steelers' 2026 offense. A Post-Gazette breakdown weighed the Steelers' projected offense around quarterback Aaron Rodgers, receivers DK Metcalf and Michael Pittman, running backs Jaylen Warren and Rico Dowdle, and tight end Pat Freiermuth as training camp nears. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/06/30/fantasy-football-metcalf-pittman-rodgers-warren-dowdle-freiermuth/stories/202606300030 Team USA: * US Faces Bosnia and a Wisconsin Native Latest developments: The Guardian profiled June 30 Esmir Bajraktarevic, the Wisconsin-born midfielder who could face the United States with Bosnia and Herzegovina in the round of 32. Esmir Bajraktarevic, raised in Appleton, Wisconsin, and developed through the Chicago Fire and New England Revolution academies and U.S. youth teams, chose to play for Bosnia and Herzegovina, his parents' homeland, and now lines up against the United States in the World Cup round of 32. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jun/30/esmir-bajraktarevic-bosnia-and-herzegovina-usmnt * Balogun Draws PSG, Chelsea, Spurs Interest Latest developments: ESPN's transfer roundup June 30 reported that USMNT striker Folarin Balogun has drawn interest from Paris Saint-Germain, Chelsea, and Tottenham Hotspur. Folarin Balogun, the United States striker who scored twice in the group stage, has attracted transfer interest from Paris Saint-Germain, Chelsea, and Tottenham Hotspur, ESPN reported, as his World Cup form lifts his market value. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49223257/transfer-rumors-news-michael-olise-asks-bayern-munich-meeting-amid-real-madrid-psg READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry is structurally losing money, marshaling financial detail on Nvidia, Anthropic, and OpenAI to contend the boom cannot pay for itself. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport revisits how the personal computer, a seeming productivity slam dunk, took years to show measurable economic gains, and warns the same paradox may dog AI. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field on building the design tool and why Field believes AI gives the company a tailwind. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,375.12 ▼ -1.6% Dow 51,899.04 ▲ +0.4% Nasdaq 25,508.01 ▼ -3.2% WTI crude 71.09 ▼ -7.7% EUR/USD 1.1382 ▼ -1.3% GBP/USD 1.3200 ▼ -0.8% USD/JPY 161.70 ▲ +0.6% ================================================================ Generated 2026-06-30 16:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================