Canada's spy agency obtained a groundbreaking warrant allowing it to remotely clean malware from private devices infected by a botnet. This marks the first known instance of intelligence services using legal authority to directly access and repair civilian computers without individual owner consent. The unprecedented move highlights evolving approaches to cybersecurity threats, where government agencies take proactive measures to protect citizens' devices from widespread infections.

This weekly cybersecurity recap covers several critical security developments including browser vulnerabilities, EDR evasion tools, and malware threats. The roundup highlights new attack vectors ranging from a television botnet and OpenBSD security flaw to an Android trojan, underlining the continuing escalation in cyber threats across multiple platforms.

Legacy infrastructure systems can become a major security liability when deploying AI agents in enterprise environments. Organizations need to ensure their older technology stacks don't create vulnerabilities that AI-powered threats could exploit, while also preventing legacy systems from limiting the effectiveness of AI-driven security tools. The key is modernizing infrastructure alongside AI adoption to avoid creating new attack surfaces while implementing agent-based systems.

Google has set a September 30th deadline for Android developers in four countries to complete a verification process. The verification requirement appears to be part of Google's ongoing efforts to enhance security and trust on the Android platform by ensuring developer accountability in these specific regions.

Cybersecurity researchers have identified a new threat called OXLOADER, a malicious loader being distributed through fraudulent Google ads to deploy CastleStealer malware. The campaign demonstrates how attackers continue to exploit trusted advertising platforms to compromise systems. This discovery highlights the ongoing challenge of malvertising as a delivery mechanism for credential-stealing malware.

French President Emmanuel Macron urged wealthy democracies to cooperate on AI regulation at a G7 summit that included OpenAI's Sam Altman and other top AI executives, while criticizing the Trump administration's recent directive blocking foreign access to Anthropic's most advanced AI models as a "strictly nationalist" reaction. The restrictions on Anthropic have fueled European concerns about American AI dominance, with Macron calling for the U.S. to share cutting-edge technology and warning that shutting off access could hurt American firms' value. Altman echoed the call for international cooperation, saying an "international forum" is needed for AI safety standards rather than leaving such decisions solely to tech companies.

Hackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin that exposes API keys, putting website security at risk. The flaw allows attackers to access sensitive authentication credentials that could be used to compromise email systems and other connected services. WordPress site administrators using this plugin are urged to update immediately to protect their API keys from unauthorized access.

Cisco has announced it's acquiring identity lifecycle security company WideField Security to enhance Splunk's Agentic SOC capabilities, though no financial details were disclosed. WideField's technology discovers human and non-human identities, maps security exposures, and provides AI-powered behavioral analytics for real-time threat detection. This marks Cisco's third cybersecurity acquisition of 2026, coming on the same day Accenture announced a four-point-one billion dollar OT cybersecurity shopping spree that includes a majority stake in Dragos plus full acquisitions of runZero and NetRise.

Cybersecurity firms Huntress and Recorded Future were hit by a supply chain attack targeting market intelligence platform Klue that began on June 11th. Hackers accessed Klue's backend servers and pushed malicious code to harvest OAuth tokens, then used the Salesforce integration to exfiltrate business data including customer contacts, price quotes, and sales information over a 24-hour period. The attack has been attributed to a new extortion group called Icarus, following a pattern similar to previous incidents linked to ShinyHunters and UNC6395, though both affected firms confirmed no threat data, passwords, or engineering systems were compromised.

CISA is warning organizations about FortiBleed, a massive credential theft campaign that has compromised over 86,000 internet-facing Fortinet firewalls and VPNs across 194 countries. Russian-speaking threat actors have compiled a verified database of working usernames and passwords through automated testing, representing roughly half of all internet-facing Fortinet devices, and have been using a 45-GPU cluster to crack password hashes and pivot into corporate networks. CISA is urging affected organizations to immediately reset credentials, enable multi-factor authentication, and review logs for suspicious activity, as thousands of organizations including government entities and critical infrastructure providers have been impacted.