Last week in cybersecurity (June 22–28): EVN scams alert, AI manipulation, and Linux root-exploiting vulnerability
- Thanh Hoang
- Jun 29
- 6 min read
The recap of last week in cybersecurity (June 22–28, 2026) highlights a wave of phishing attacks heavily targeting end-users in Vietnam, most notably the impersonation of EVN and over 336 fraudulent World Cup websites.
On the international front, the cybersecurity community was shaken by AI agents being manipulated into installing malware, alongside the emergence of the TonRAT malware targeting hotels and the "DirtyClone" privilege escalation flaw granting Root access on Linux systems.
Last week in Vietnam cybersecurity: What traps are Vietnamese users facing?
Recent phishing attacks in Vietnam have actively exploited public trust in major brands and the global hype of major sporting events. Threat actors are continuously refining their tactics to compromise bank accounts and trigger critical data leaks.
1. EVN impersonation via Fake OTP messages containing malicious links
Quick summary: Vietnam Electricity (EVN) has issued an urgent warning regarding threat actors impersonating "EVN CSKH" (Customer Service) to send fake OTP messages paired with malicious links aimed at stealing assets.
Key highlights:
Capitalizing on EVN’s recent testing of a new application, fraudsters are sending messages containing 6-digit codes and a link that includes the string "evn" but uses a fraudulent domain extension.
The objective is to lure victims into clicking the link, thereby stealing personal identification data and hijacking funds from bank accounts.
Solution & action:
Absolutely do not click on attached links. EVN confirms that official OTP messages never contain any URLs.
EVN only dispatches OTPs when users actively log in or perform actions on the official app. Only download the "EVN CSKH" app from official Google Play or App Store platforms.
2. World Cup 2026: Explosive surge of hundreds of fraudulent websites
Quick summary: Tens of millions of football fans are falling prey to over 336 fraudulent domains related to World Cup 2026, as recorded by Kaspersky.
Key highlights:
Scammers set up free live-streaming websites that eventually demand cryptocurrency payments for "lifetime access," thereby harvesting user emails and passwords.
A flurry of fake betting and score-prediction sites require users to input sensitive personal info. Some phishing emails even trick victims into paying 200 AUD to receive fake "in-depth analytical reports."
Solution & action:
Only stream matches through officially licensed broadcasting platforms.
Enforce two-factor authentication (2FA) across all vital accounts and avoid password reuse. Deploy antivirus software featuring robust phishing link detection capabilities.
Last week in international cybersecurity: How Artificial Intelligence and Zero-Day vulnerabilities are ravaging systems
Globally, cybercriminals are employing highly sophisticated, stealthy techniques - ranging from "credential laundering" via legitimate services to embedding fake error logs designed to deceive artificial intelligence-driven security tools to compromise enterprise security.
3. "Identity laundering" via Calendly: TonRAT malware targets hotel systems
Quick summary: A highly sophisticated phishing campaign is blanket-targeting hotels across Europe and Asia, leveraging Calendly and Google services to bypass email filters and deliver a Node.js-based implant known as TonRAT.
Key highlights:
Hackers send fake complaint emails regarding bed bugs or health inspections. By utilizing Calendly's legitimate infrastructure, these emails easily circumvent standard SPF, DKIM, and DMARC security protocols.
Victims are redirected to download a ZIP file containing a shortcut (LNK) masked as an image. Clicking it executes PowerShell to pull down a legitimate Node.js instance and run the TonRAT malware anonymously via TON blockchain API functions.
Solution & Action:
Purge both persistence mechanisms used by the malware: the Run key in the Registry and the executable file located at AppData\Local\Nodejs. Conduct a comprehensive sweep on all front-desk reception computers.
4. "DirtyClone" flaw in Linux Kernel grants privilege escalation to root
Quick summary: Exploitation code has been published for vulnerability CVE-2026-43503 (CVSS 8.8), part of the DirtyFrag family, allowing local network users to abuse packet cloning mechanisms to fully compromise Linux systems.
Key highlights:
The flaw occurs because the Kernel drops the "safety flag" when cloning a network packet.
An attacker can trick the system into overwriting malicious instruction bytes into a legitimate process (such as the su command) via an IPsec connection. Since the entire operation occurs directly within the RAM, it leaves no traces on the hard drive.
Solution & action:
Update the Kernel immediately (patches are available starting from v7.1-rc5).
Temporary mitigation: Disable unprivileged user namespace cloning (kernel.unprivileged_userns_clone=0) or deactivate the esp4 and esp6 network modules.
5. "Gaslight" macOS malware uses fake errors to reverse-hack AI analysis systems
Quick Summary: Security researchers have recorded the first instance of a macOS malware (dubbed Gaslight) actively embedding fake error logs to blind artificial intelligence tools tasked with malware analysis.
Key highlights:
Developed in Rust by a North Korean threat group, Gaslight embeds a 3.5 KB file containing 38 fake error scenarios (e.g., SQL injection errors, expired tokens).
This functions as a Prompt Injection attack, aiming to force LLM-powered SOC automation systems into doubting their own analytical findings, truncating reports, or halting scans entirely.
Solution & action:
Never treat extracted strings from malware as safe inputs for AI models. Always cross-verify using manual reverse-engineering, sandbox environments, and behavioral logs.
6. AI coding agents duped into running reverse shells via clean GitHub repos (0DIN)
Quick summary: Researchers discovered a technique that tricks AI agents (like Claude Code) into opening a reverse shell back door for hackers without relying on any traditional zero-day vulnerabilities.
Key highlights:
Actors create a seemingly clean, safe GitHub repository. However, when the AI agent inputs installation commands, the source code deliberately throws a fake error message advising the AI to run an alternative debugging command.
Driven by its autonomous self-debugging nature, the AI automatically executes this suggested command, which resolves a hacker's DNS TXT record, pulls down a Base64-encoded string, and executes it to compromise the developer's machine.
Solution & action:
Administrators must restrict AI Agent privileges: Force the AI to publicly log its entire execution string and require mandatory human-in-the-loop approval before executing any remotely downloaded script.
7. CISA warns of active exploitation of RCE flaw in PTC Windchill
Quick summary: The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-12569 (CVSS 9.3) - a remote code execution flaw in PTC Windchill product data management software - to its Known Exploited Vulnerabilities (KEV) catalog due to rampant hacker activity.
Key highlights:
The deserialization vulnerability allows unauthenticated attackers to send requests that execute arbitrary remote code.
Hackers are aggressively dropping JSP-formatted Web Shells into systems. The Command and Control (C2) server IP has been identified as 5.180.41.35.
Solution & action:
Block IP 5.180.41.35 immediately on your firewall.
Audit HTTP logs for POST requests matching /Windchill/login/*.jsp and scan directories for the file flst.txt or any 16-character hex-formatted .jsp files.
8. KDDI attack: Over 14.22 million email credentials at risk of exposure
Quick summary: Japanese telecom giant KDDI confirmed that its email systems built for Internet Service Providers (ISPs) were compromised, threatening a massive data leak affecting 14.22 million accounts.
Key highlights:
The cyberattack exploited critical vulnerabilities found within third-party software integrated directly into KDDI’s core email infrastructure.
Several major ISPs are severely impacted, including STNet Inc., JCOM Co., Chubu Telecommunications, Nifty Corp., and Biglobe Inc.
Solution & action:
KDDI is urgently collaborating with the affected ISPs to enforce mandatory password resets for all users.
Enterprises must immediately apply strict supply chain security audits for all third-party software solutions before integrating them into core systems.
9. Supply chain reputation risks in the era of Artificial Intelligence
Quick summary: Supply chain executives are confronting a "visibility vulnerability" on generative AI tools (like ChatGPT, Perplexity), where AI tends to permanently memorize past data leaks or ransomware incidents if no updated refutations are published online.
Key highlights:
When procurement teams ask an AI to assess a supplier's reliability, the AI aggregates data from legacy press articles and historical incident reports.
If a business suffered a supply chain disruption or data breach in 2024 but failed to publish validated remediation updates online, by 2026, the AI will still pull that negative history as its definitive answer, crippling enterprise security posture in procurement reviews.
Solution & sction:
Implement a strategic media reputation monitoring framework.
Consistently publish incident-resolution whitepapers and case studies on highly authoritative sources to "re-train" AI models, ensuring the company’s cybersecurity profile remains up to date.
Everything that transpired last week in cybersecurity underscores that the line between safety and catastrophe is separated by just a single click or an unverified handoff to automation. Whether for corporations focusing on enterprise security or individual users, maintaining skepticism towards unverified URLs (like fake EVN or World Cup links), adopting multi-layered authentication mechanisms, and rapidly patching operating systems against threats remain the only way to survive in the digital domain.
--------------
References
EVN Impersonation Phishing Alerts: https://www.ipsip.vn/post/mao-danh-evn-nham-lua-dao
World Cup 2026 Fraud Escalations: https://vietnamnet.vn/world-cup-2026-nong-tren-san-co-lua-dao-cung-bung-phat-tren-mang-2529459.html
Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant: https://thehackernews.com/2026/06/microsoft-warns-of-photo-zip-phishing.html
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets: https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html
New macOS Malware Uses Fake Errors to Confuse AI Analysis Tools: https://cisowhisperer.com/new-macos-malware-uses-fake-errors-to-confuse-ai-analysis-tools/
0DIN: Clean GitHub Repos Can Trick AI Agents Into Reverse Shells: https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue: https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html
14 million sets of email info possibly leaked in cyberattack on KDDI: https://news.tuoitre.vn/14-million-sets-of-email-info-possibly-leaked-in-cyberattack-on-kddi-103260624153913191.htm
AEO: The New Visibility Layer Supply Chains Can't Afford to Ignore: https://www.supplychainbrain.com/blogs/1-think-tank/post/44099-aeo-the-new-visibility-layer-supply-chains-cant-afford-to-ignore
Comments