The prolific ShinyHunters group has announced it used a zero-day vulnerability in Oracle PeopleSoft to exploit the FBI jobs website and gain access to the AWS GovCloud instances and dump 2 TB of employee data. GovCloud being a special, locked-down version of the Amazon Web Services cloud for US government users.
ShinyHunters has previously been involved in dozens of high-profile hacks and ransomware incidents. Some of the highest-profile incidents include Jaguar-Land Rover, causing a measurable impact on the UK GDP, Grubhub, Carnival Cruise Lines, Rockstar Games, and multiple universities and educational institutions, casinos, and other government agencies. ShinyHunters has also been credited with the hack of the Canvas educational program in the spring of 2026 where data including test results and chat logs of hundreds of millions of students, teachers, and staff was stolen. ShinyHunters has generally been identified as an international group of criminals, often teenagers, who will demand a BitCoin ransom of several million US dollars, with the threat of the stolen data being leaked if the victims do not pay.
On May 15, 2026 the FBI released a bulletin on the activities of ShinyHunters, focusing on the Canvas educational hack. In the report, the FBI said that the group uses “harassment strategies, sending threatening text messages and phone calls to victims and their family members”. ShinyHunters says that this is not accurate, and that they will release the FBI employee data, including information of employees and their family members, if the agency does not retract the statements, telling The Register “I have been doing my very best to combat these allegations, and this is the best way to do it”.
Muse Agent Vulnerable
Ars Technica’s Dan Goodin reports on a serious exposure linked to the new Muse agent by Meta. Muse is yet another agentic platform, similar to OpenClaw, where agents run on a users computer and can take actions on behalf of that user. Typically an agent will also have direct access to a users accounts on various services, from email to GitHub and other cloud platforms.
In addition to network and account access, the Muse agent on macOS also requests access to the microphone, screen recording features, direct disk access, and user data like calendar and location. Unfortunately, the agent software also allows configuration of the agent, which can be done by other processes, such as the terminal. Critically, the transcription server can be changed to any address, without prompting the user. Once the transcription server is controlled by the attacker, they gain access to all the resources the agent has – including recording the screen and listening to the microphone without notifying the user. Other attacks demonstrated by the researchers include stealing authentication tokens of other services Muse has access to, and dumping the entire contents of the users WhatsApp messages.
Getting users to run arbitrary commands in terminals might seem difficult, but “ClickFix” attacks have been showing a disturbing degree of success recently. A compromised website presents the user an authentication prompt similar to a captcha, but instructs the user to copy a block of text and run a terminal to generate the authentication token. The text, obviously, is actually an encoded payload to download and install malware – or in this case, to gain access to the Muse agent.
Meta has made repeated claims that the Muse architecture was designed with security in mind, but it seems that some basic attack paths have been overlooked. While download statistics don’t seem to be available for the macOS version, the iOS version of the app has climbed to the number one position on the App Store with 1.5 million installs, and another 1.1 million installs on Android. If the macOS install numbers are at all similar, the rewards for successful exploitation could be significant.
Rust Developers Targeted
The Rust site posted a warning that members of the language team and high-profile crate developers have been specifically targeted by an unknown group that is suspected to be North Korea state hackers.
The Rust group warns about targeted phishing attempts against maintainers, often presented as a conference call to collaborate on a new feature or bug report. When the victim attempts to join the call, a false error says that a new video codec, or updated video conferencing software, or other plausible lure is required. The download link is, of course, malware.
This style of attack is suspected in an attack against the maintainer of the “arrayref” crate in June which led to a spate of supply chain poisoning in the Rust Cargo repository. Like many modern languages, Rust functionality is extended by the inclusion of libraries and modules which are automatically downloaded and included as part of the build process. Any compromise of an included module could compromise every program build with the malicious package, and the build environment itself, which is how most supply chain attacks spread.
The Rust developers recommend the usual protections: use multi-factor authentication, don’t open projects from unknown users, and be suspicious of strangers with candy.
NightmareEclipse Returns
Last week we learned the identity of the hacker behind the handle NightmareEclipse, and some of the information around their vendetta against Microsoft. While you might think releasing their identity might lead to fewer exploits, this apparently is not the case.
This week, NightmareEclipse has released “BigDiskBuster”, which exploits a denial of service vulnerability in Windows Defender. Once triggered, Windows Defender is no longer able to update itself or the signature database.
Per usual, proof of concept code is available, and currently there are no patches from Microsoft to address it.
New Attacks Against RSA
And finally, researchers have found a new attack against RSA. This uses classical attacks against 1024 bit RSA, and can be performed with obtainable hardware on a scale of months.
While the researchers demonstrated it against the deprecated 1024 bit RSA, it can also be applied to more commonly used 2048 and 4096 bit encryption. International encryption standards require a degree of difficulty of 2128 operations to defeat, and the new attack may drop the difficulty multiple orders of magnitude to 2119, even for 4096 bit keys.
The vulnerable aspects of RSA are generally less used in modern implementations, however the article points out that one current use is Privacy Pass, implemented by Apple and Cloudflare. An attack would require 243 attempts, or approximately 8 billion tries, but the researchers point out that this roughly equivalent to the amount of connections Cloudflare handles per day.