Today’s stories all trace back to something an organization trusted by default: a login prompt, a browser extension, a supplier’s file-sharing platform, and the operating system’s own browser process. A vishing call handed ShinyHunters a working SSO session into Abbott’s internal systems, Chaos ransomware’s new backdoor routes its command-and-control traffic through a legitimate Chrome or Edge process to blend in, Stadler Rail is refusing a $12.3 million ransom after attackers took data through a third-party partner instead of its own network, and a widely installed Adobe browser extension let any website silently read a victim’s WhatsApp Web conversations. Here’s what changed since yesterday’s digest.
Breach watch: ShinyHunters vishes an Abbott employee, claims 22 million patient notes from a hijacked Entra SSO account
Healthcare and diagnostics giant Abbott Laboratories confirmed it is investigating two separate cyber incidents after the ShinyHunters extortion group claimed to have breached its systems. ShinyHunters told BleepingComputer it ran a vishing (voice phishing) attack against several Abbott employees in mid-June and used the access to compromise a corporate Microsoft Entra single sign-on account, then pulled data from every SaaS application connected to that account — including ServiceNow, SharePoint, Databricks, and Coupa. The group claims it stole more than 30 million records, over a million Social Security numbers, and more than 22 million doctor-patient notes and medical orders tied to legacy Exact Sciences systems in Abbott’s Cancer Diagnostics business, and set a leak deadline that has already slipped once, from July 18 to July 21, suggesting negotiations are underway. A second, separate claim from an actor calling itself ShadowByt3$ alleges a breach of Abbott’s LabCentral portal. Abbott says the affected systems are legacy and separate from its main operations, and that patient care, manufacturing, and product availability have not been disrupted. Cybernews · BleepingComputer
A single SSO account compromised by a phone call gave attackers a claimed foothold across four separate SaaS platforms at once — that’s the entire point of single sign-on, and it cuts both ways. If your organization centralizes access through an SSO provider, this is a good prompt to confirm your help desk has a vishing-resistant identity verification process before resetting credentials or approving MFA changes over the phone, since that’s precisely the step ShinyHunters says it exploited.
Malware watch: Chaos ransomware’s msaRAT hides its C2 traffic inside Chrome and Edge
Cisco Talos disclosed msaRAT, a new Rust-based backdoor used by the Chaos ransomware group (a 2025-era gang unrelated to the older Chaos ransomware family) that avoids network detection by never making a direct connection to its command-and-control server. Instead, msaRAT launches Chrome or Edge in headless mode, drives it over the Chrome DevTools Protocol — the browser’s own remote-debugging interface — and relays C2 messages through a WebRTC data channel carried by Twilio’s TURN relay service. What a defender sees on the wire is a legitimate browser process talking to Cloudflare and Twilio infrastructure, not malware calling home. Talos ties the backdoor’s delivery to Chaos’s established pattern: a fake Windows-update MSI dropped after email or voice phishing, followed by remote monitoring and management tooling. The Hacker News · Security Affairs
Network detection tools that flag “unrecognized process calling out” miss this by design — the process making the call is Chrome or Edge, tools your EDR is built to trust. If your monitoring doesn’t distinguish between a browser you launched and a browser launched headless with remote debugging enabled, this is exactly the kind of C2 channel that would pass through unnoticed, and it’s worth hunting for headless browser instances and unexpected WebRTC/TURN traffic now rather than after an incident.
Ransomware watch: Stadler Rail refuses Everest’s $12.3 million demand after a supplier’s platform is breached
Swiss train manufacturer Stadler Rail disclosed that the Everest ransomware group compromised a data-exchange platform shared with one of its suppliers in mid-July, stealing technical documents rather than encrypting anything on Stadler’s own network. Everest is demanding 10 million Swiss francs (about $12.3 million) and threatening to publish the stolen files. Stadler says none of its own systems were touched, no relevant personal data was exposed, all production sites remain fully operational, trains in service worldwide are unaffected, and the company will not pay — calling itself “not susceptible to extortion.” Stadler has filed a criminal complaint with police in Thurgau, Switzerland. BleepingComputer · The Record
The breach never touched Stadler’s own network, yet it still produced a seven-figure extortion demand against Stadler’s name — a reminder that your ransomware exposure isn’t bounded by your own perimeter when you share a file platform with a supplier. If your organization exchanges technical or contract data with vendors through a shared portal, it’s worth confirming who else holds credentials to that platform and whether a breach on their side would even be visible to your own security team before a leak site names you.
Vulnerability watch: Adobe Acrobat’s Chrome extension let any website read WhatsApp Web chats on 329 million browsers
Researchers at Guardio disclosed CVE-2026-48294 (CVSS 7.4), nicknamed HermeticReader — a universal cross-site scripting flaw in the Adobe Acrobat PDF extension for Chrome and other Chromium-based browsers, installed on an estimated 329 million browsers. The bug let any website a victim visited bypass the browser’s same-origin policy and read data from other open origins in the same session, including active WhatsApp Web conversations, without any interaction beyond loading the malicious page. Researchers reported the issue to Adobe in early June, and Adobe shipped a fix within days in version 26.5.2.3, distributed automatically. Guardio found no evidence of exploitation before the patch. The Hacker News · BleepingComputer
A PDF reader extension has no obvious business relationship to your WhatsApp Web tab, and that’s exactly what made this bug dangerous — cross-origin isolation is supposed to make one open tab invisible to another. Auto-updating extensions mean most users are already patched, but if your organization manages browser extensions centrally, this is a good prompt to confirm your policy actually tracks extension versions rather than just which extensions are allow-listed.
Final thought
Every story today is about a channel that was trusted precisely because it looked routine — an SSO session opened by a phone call, a browser process doing exactly what browsers do, a supplier’s file-sharing platform, and a PDF extension with no obvious reason to touch your messaging app. None of these needed a novel exploit chain; they needed defenders to assume that “legitimate-looking” and “safe” are the same thing. If you want a second opinion on whether your help desk can resist a vishing-driven SSO reset, whether your monitoring would catch a headless browser acting as C2, or whether a supplier’s security posture could expose you to extortion you never saw coming, see our zero trust architecture guide for Israeli SMBs or book a discovery call.