In today’s cybersecurity news…
Athena coalition looks to secure open source
Chainguard CEO Dan Lorenc announced Athena, a new coalition that looks to use AI tools to quickly remediate flaws in critical open-source software. At the announcement, the coalition includes JPMorgan Chase, Cisco, Cloudflare, Docker, Kyndryl, and PwC. The companies agree to pool data and remediations that apply across company stacks. The idea is to move from one-off patching to a more coordinated industry response. Lorenc says the first coordinated disclosures from Athena will be released “in about a month.” This is one of several attempts to solve this problem, IBM and Red Hat announced a similar effort earlier this month, and the Open Source Security Foundation established an AI/ML Security Working Group along similar lines.
In related news, SoftBank announced it will launch a cybersecurity “patching service” targeting Japan’s top 3,000 companies in critical infrastructure. This will be part of its joint venture with OpenAI called SB OAI Japan, which launched last year to develop AI services specific to the Japanese market.
Estonia to quarantine Russian email domains
Estonia’s Minister of Justice and Digital Affairs, Liisa Pakosta, announced that, as of August 31st, the country will quarantine emails sent from Russia’s .ru top-level domain before they are delivered to government officials. Officials receiving emails from that domain will be notified when a message has been isolated and given the option to open it with additional security precautions. This is similar to the quarantine measures Estonia uses across the public sector for individual emails based on specific risk criteria. This would now just apply the same protocol to an entire top-level domain. Pacosta characterized these emails as presenting “elevated cyber risk” and saying “there is a serious danger that they are being used to break into personal databases.”
Malicious package wave hits Arch Linux
The maintainers of the Arch Linux distribution announced this week that they suspended new signups for the Arch User Repository, or AUR, in response to a deluge of malicious package submissions. According to researchers at Sonatype, the campaign started with abandoned packages in AUR. These were modified to execute a malicious npm package during installation. By June 11, over 1,500 malicious packages were published. This doesn’t directly impact the Arch Linux distribution, as AUR is a community-driven repository.
FTC reports imposter scams cost $3.5 billion
The U.S. Federal Trade Commission warned that losses from imposter scams tripled since 2020. Of the $3.5 billion, victims lost nearly $1 billion to business impersonators and almost as much, $920 million, to government impersonators. Bank fraud resulted in the largest individual losses, often through threat actors contacting victims about fake bank transfers. Social media was a common theme among these fraud schemes, with $2.1 billion tied to attacks originating on social platforms, and one in three scams starting with initial contact on social media. Overall fraud losses climbed to $16 billion in 2025, up roughly 25% from 2024.
Huge thanks to our episode sponsor, ThreatLocker
How do we enable innovation without creating unnecessary risk?
That’s the challenge behind cloud adoption. Behind AI. Behind automation. And behind every major technology decision.
ThreatLocker helps organizations take a Zero Trust approach to that challenge—giving them greater control over what can execute, what can access their environment, and what users and applications are allowed to do.
That’s why ThreatLocker is proud to support Cyber Security Headlines.
Because security works best when innovation and control move together.
Cal Water investigating breach report
Earlier this week, the Iranian-linked hacktivist collective Handala published data it claimed was stolen from the California Water Service utility. Analysis by the firm Dataminr found that the leaked data included personal information and appears to be from a customer billing database. Handala claims the attack could have disrupted the utility’s water supply. Cal Water said its investigating these claims, but said ““preliminary findings indicate that there are no known operational disruptions to our water and wastewater systems.”
Heart monitoring company confirms data breach
In a filing with the US Securities and Exchange Commission, the cardiac monitoring company iRhythm disclosed it detected a data breach impacting patient data on June 8th. On June 9th, it received extortion demands from a threat actor, but it did not disclose any further details of the negotiations. The filing maintains attacks on business applications, not clinical systems or medical devices. The attacker gained access from a social engineering attack. No threat group was identified in the filing, and The Register said it found no major ransomware groups taking credit for the attack.
An all-in-one Android trojan
Researchers at zLabs detail the Android trojan Rokarolla, recently found to target hundreds of banking and cryptocurrency apps. It spreads through sites that spoof either TikTok or Google Chrome’s download page, using a dropper to impersonate the Play Store and deliver a second-stage payload on-device. The researchers note this malware marks a shift from simple data theft, adding in efforts to further isolate the victim from legitimate sources. Rokarolla sets itself as the default for calls and texts, blocking incoming calls and intercepting legitimate one-time passcodes and fraud alerts. Once a victim opens a legit banking app, the trojan uses Accessibility services to overlay a fake login page and steal credentials.
Group claims cyberattack on Novo Nordisk
Following up on our coverage from earlier this week, the group FulcrumSec contacted the site DataBreaches to take credit for the attack of the pharma giant Novo Nordisk. The group claimed it initially gained access in March through a GitHub access token, stealing roughly 1.3 terabytes of data. It claims this included intellectual property related to pharmaceutical development and private AI models. It claims it demanded a $25 million ransom, which the company did not pay.
India tries to stop cheating by blocking Telegram
India’s National Testing Agency, NTA, said that local authorities will restrict access to Telegram across India until June 22nd, the day after its National Eligibility Test for Undergraduate courses is held again. The government also ordered Telegram to disable messaging editing features in the country until June 30th. These exams were originally scheduled for May, but were canceled after reports that test questions leaked. The NTA also said the government worked to remove a “substantial number” of channels, groups, and bots claiming to sell cheating materials from the app. The NTA maintains no test papers have leaked.