The Lyceum: Cyber Intelligence Daily — Jun 23, 2026

• Revoke abandoned OAuth tokens now: the Icarus group stole Salesforce CRM data from at least ten security firms—Huntress, Jamf, Recorded Future, Tanium, Gong, Insurity, Sprout Social, HackerOne, OneTrust, Snyk—through a long-disused but still-active credential tied to Klue's integration.
• Patch Splunk Enterprise immediately: CVE-2026-20253 (CVSS 9.8) is actively exploited, on CISA KEV since June 18, with a federal deadline that already passed June 21 and no workaround.
• Treat inbound media and chat attachments as code: a WhatsApp VBScript campaign installs legitimate RMM software across eleven countries, while FFmpeg's PixelSmash turns a malicious video file into remote code execution on media servers.

Klue detected unauthorized activity June 12 after attackers used a compromised legacy integration credential to obtain OAuth tokens connecting Klue to customers' Salesforce instances. Stolen data is commercial—business contacts, price quotes, email addresses, sales messages—but not passwords, payment details, or core telemetry. Huntress linked the breach to Icarus with high confidence; the group is now threatening to publish. ReliaQuest advises revoking and rotating all OAuth/refresh tokens tied to Klue, reviewing Salesforce API logs for unusual query volumes, and restricting integration accounts to known IP ranges—unexplained API spikes mean you're already in act two. [The Hacker News] [Huntress] [CSO Online]

Kaspersky observed compromised WhatsApp accounts silently sending malicious VBScript attachments—disguised as invoices, reports, and account notices—to existing contacts across Malaysia, Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, and Vietnam. The script tampers with Windows UAC and installs ManageEngine RMM Central, legitimate software that evades security alarms. Activity is unattributed; Kaspersky found low-confidence overlaps with Gh0st RAT and ValleyRAT plus Chinese-language script comments. Rule: a .vbs, .js, .bat, or .ps1 in a chat app is malicious—and audit which ManageEngine Endpoint Central instances report to unknown external addresses. [Securelist] [BleepingComputer]

CVE-2026-47729 is a Heartbleed-style heap over-read in Squid's FTP gateway, dormant since 1997 and surfaced by Calif.io using an AI model. It leaks other users' Authorization headers, cookies, and session tokens to a trusted user of the same proxy who can force an FTP directory fetch—an insider/shared-network threat, exposing cleartext HTTP and TLS-terminating setups. No patched release yet (fix coming in 7.7), but a public PoC exists. Workaround now: remove or comment out port 21 in Safe_ports in squid.conf and restart. Watch GreyNoise for FTP-port scanning as your early warning. [The Hacker News] [Calif.io]

FFmpeg fixed CVE-2026-8461, a press-rated high-severity flaw in the MagicYUV decoder causing denial of service and, in some setups, remote code execution. JFrog demonstrated working code execution against Jellyfin 10.11.9 via routine media-library scanning—no interaction beyond a file in a watched folder. Kodi, OBS Studio, PhotoPrism, and Nextcloud preview workflows all rely on FFmpeg. Fix shipped in 8.1.2 (June 17); Jellyfin updated its bundled copy. Any media server processing untrusted uploads without 8.1.2 is exposed. [BleepingComputer]

• Coverage note: CVE-2026-21509: Actively Exploited Microsoft Office Zero-Day Forces Emergency Patch — Research inputs treated this as prior or recirculated context rather than a fresh standalone development; monitor for a new vendor advisory, KEV deadline, or active-exploitation escalation. Key terms: Microsoft Office, zero-day, actively exploited, emergency patch, CVE-2026-21509. Source: SOC Prime.

• If Icarus publishes the Klue-sourced Salesforce data before ransom, the resulting spear-phishing won't look like phishing—stolen contact names, price quotes, and competitive intel let attackers impersonate real deals in progress.
• If GreyNoise shows scanning against Squid FTP ports in the next 48–72 hours, Squidbleed has moved from PoC to active exploitation, making FTP disablement the only defense for invisible corporate proxies with no patched release available.
• If the WhatsApp campaign's ValleyRAT and Gh0st RAT overlaps are independently confirmed, the RMM access reads as espionage rather than financial crime, and the eleven-country spread becomes a targeting map rather than opportunistic spray.