This was the week the same breach happened twice in two days — and the technique was a phone call. Charter confirmed an incident after ShinyHunters claimed 42 million Spectrum records; Carnival began notifying nearly 6 million people. Different companies, identical playbook: a vishing call compromises a Microsoft Entra account, the attacker pivots into Salesforce, and customer data walks out the door. ADT, Amtrak, Odido, Vimeo, and now two of the largest consumer brands in America have fallen to a chain whose weakest link is a human picking up the phone.

The other story is AI quietly finishing its move from research paper to standard-issue tooling. WithSecure tied a likely-Russian cluster, GreyVibe, to a Ukraine campaign that used ChatGPT, Gemini, and Ideogram across lures, malware, and post-compromise work. Check Point found Iran's Nimbus Manticore shipping a backdoor it assesses was AI-assisted. TrapDoor planted poisoned CLAUDE.md and .cursorrules files to subvert AI coding assistants directly. India's CERT-In made it official, naming AI-driven exploitation as the reason it now wants critical internet-facing flaws patched within twelve hours.

Defenders had real wins, too. CrowdStrike, Google, and Shadowserver took down all four of GlassWorm's command-and-control channels simultaneously — the only way to disrupt a botnet built on infrastructure no enterprise can block. Microsoft named Storm-2697 behind The Gentlemen ransomware and signaled law-enforcement action against the Chaotic Eclipse researcher now promising a July 14 exploit drop.

Let's get into it.

Breaches

Charter Communications, the parent of Spectrum and the largest US cable broadband provider, confirmed a cybersecurity incident on May 26–27 after ShinyHunters listed it and claimed 42 million customer records, demanding negotiations by May 27. A day later, Carnival Corporation began notifying 5,995,277 people that an April vishing breach exposed their data. Both intrusions follow the 2026 cluster's exact mechanics: a voice-phishing call compromises an employee's Microsoft Entra account, and the attacker uses that session to reach the company's Salesforce instance and export customer data. Charter disputes that sensitive PI or CPNI was taken; Carnival traces its intrusion to social engineering of an employee account caught on April 14.

Why it matters: This is not a new technique — it is the same playbook that already hit ADT, Amtrak, Odido, and Vimeo, and it keeps working against the largest enterprises in America because the weak point lives at the human and identity layer, not the perimeter. Phishing-resistant MFA on Entra, tight conditional-access policies, and Salesforce export monitoring matter more here than any patch. Carnival's 38-day gap from leak-site post to corporate confirmation is now a predictable rhythm — expect more confirmations to land on that cadence.

→ Read the Charter story · Carnival

Threat Actors

Three disclosures in one week show generative AI crossing from novelty to default tradecraft. WithSecure named GreyVibe, a likely-Russian cluster targeting Ukraine since August 2025, that used ChatGPT, Gemini, and Ideogram across lures, custom obfuscators, and a PowerShell RAT. Check Point disclosed that Iran's Nimbus Manticore (also Screening Serpens / UNC1549) shipped MiniFast, a Windows backdoor it assesses was AI-assisted, in a campaign that accelerated during regional military escalation. And Socket's TrapDoor — 34+ malicious packages across 384+ versions on npm, PyPI, and Crates.io — planted hidden instructions in CLAUDE.md and .cursorrules files to subvert the AI coding assistant itself.

Why it matters: The attack surface now includes the AI in the developer's loop, not just the package and the pipeline. AI doesn't give attackers new capabilities so much as it collapses the time and skill those capabilities used to require — which is exactly why India's CERT-In named AI-driven exploitation as justification for a 12-hour patch standard this same week. Treat CLAUDE.md and .cursorrules as security-sensitive files under code review, and assume the gap between disclosure and exploitation is now hours.

→ Read the GreyVibe story · Nimbus Manticore · TrapDoor

Takedowns

CrowdStrike's Counter Adversary Operations team, with Google and the Shadowserver Foundation, executed a simultaneous takedown of all four GlassWorm command-and-control channels on May 26–27. GlassWorm — a self-spreading supply-chain campaign active since early 2025 through poisoned packages, malicious VS Code extensions, and compromised GitHub repos — built its C2 on infrastructure defenders cannot easily block: the Solana blockchain (server addresses in transaction memos), the BitTorrent DHT, Google Calendar event titles, and direct servers. The four channels had to fall together to stop the operators rebuilding through one while another was seized.

Why it matters: This is a working template for disrupting a campaign built on public infrastructure no enterprise can block — and the operative word is simultaneity. If your developer endpoints showed historical GlassWorm activity, treat them as credential-compromise events: rotate GitHub and npm tokens, cloud and SSH keys, and hunt for non-business processes talking to public blockchain RPCs or the BitTorrent DHT.

→ Read the full story

Ransomware & Disclosure

Microsoft Threat Intelligence published a deep analysis of The Gentlemen ransomware, naming the RaaS operators Storm-2697. The Go encryptor, obfuscated with Garble, gives every file a fresh Curve25519 key pair — making decryption without the operator's private key functionally impossible — and ships a self-propagation module that can take a single endpoint to fleet-wide encryption within hours. It pairs with Check Point's earlier work tracing a victim list exceeding 1,570 organizations. Separately, the Windows researcher "Chaotic Eclipse" pledged a July 14 "bone-shattering" exploit drop after Microsoft pulled their GitHub account and referenced the Digital Crimes Unit, signaling possible law-enforcement referral over a six-zero-day disclosure run.

Why it matters: Two vendors converging on one ransomware operation in six weeks is how a program crosses from emerging to operationally mature — assume The Gentlemen is now a top-tier threat. And put July 14, 2026 on the vulnerability-management calendar as a high-alert window now: pre-position patch readiness, monitoring, and IR coverage against the existing Chaotic Eclipse zero-day list (RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma — three already under active exploitation).

→ Read the Storm-2697 story · Chaotic Eclipse

Threat Actors

The FBI's May 26 FLASH alert warns that Silent Ransom Group — also tracked as Luna Moth, Chatty Spider, and UNC3753 — is now sending operatives in person to US law firms, posing as IT support and inserting USB drives to steal client data for extortion. SRG has targeted law firms since Spring 2023, but the in-person variant is a sharp escalation of a chain that until now ran entirely over the phone and a remote-access tool. There is no encryption step — the leverage is the threat of disclosing or selling stolen client material.

Why it matters: Every endpoint and network control predicated on the attacker being remote stops working the moment the attacker walks through the front door. Treat unannounced "IT support" visitors as a documented attack vector this week: require pre-confirmed tickets, escort and verify any third party touching a workstation, and disable USB mass-storage insertion where it isn't operationally required.

→ Read the full story

Vulnerabilities

Microsoft patched CVE-2026-45659, a CVSS 8.8 deserialization-of-untrusted-data RCE in SharePoint Server, on May 26. Microsoft rates it Important and "less likely to be exploited," with no public PoC — but the "authenticated" precondition is the lowest role the product has: Site Member, which in most enterprises sweeps in broad employee, partner, guest, and dormant accounts. Combined with low attack complexity and no user interaction, the bar to exploitation is operationally trivial. It affects every supported on-prem version: Subscription Edition, 2019, and Enterprise Server 2016.

Why it matters: "Authenticated" is doing almost no work here. Patch this week, not on the next cycle, and pair the update with a Site Member inventory audit, restriction of internet-exposed SharePoint, and hunting for anomalous deserialization errors and unexpected w3wp.exe spawning in SharePoint logs.

→ Read the full story

The number to sit with this week is two — as in, two of the largest consumer companies in America, breached two days apart, by a phone call.

Charter and Carnival are not a vulnerability story. There is no CVE here, no unpatched server, no clever exploit. There is a person who answered a call from someone claiming to be IT, and an attacker who used that moment to step into a Microsoft Entra session and walk out of Salesforce with millions of records. We have now watched this exact sequence play out at ADT, Amtrak, Odido, Vimeo, and more — and the most important thing about it is how boring it has become. The technique hasn't improved. It doesn't need to. It keeps working because the weakness it targets isn't in the software; it's in the seam between a trusting human and an identity system that treats a successful login as proof of legitimacy.

Hold that next to the other thread running through the week. GreyVibe used ChatGPT and Gemini to build its lures and malware. Nimbus Manticore came back from a regional war with an AI-assisted backdoor. TrapDoor planted instructions to subvert the AI coding assistant sitting inside the developer's editor. India's CERT-In looked at all of this and concluded that the safe assumption is now twelve hours from disclosure to exploitation. None of these are stories about AI granting attackers powers they never had. They are stories about AI removing the time and skill those powers used to cost — the same way vishing removed the cost of breaching a Fortune 100 network down to a convincing phone manner.

That's the pattern worth naming: the frontier of attack in 2026 is not capability, it's friction. The cost of doing the obvious bad thing keeps falling — toward a phone call, toward a poisoned config file, toward an AI prompt — while the cost of catching it stays roughly fixed. Defenders who keep buying capability against a friction problem will keep losing, which is why the genuinely encouraging news this week came from the other side of that ledger. The GlassWorm takedown worked because four organizations coordinated to hit four channels at the same instant. Microsoft's Storm-2697 attribution worked because two vendors pooled what they each saw. Defense, too, gets cheaper when it's shared.

The question worth asking before next week's briefing: if an attacker called your help desk right now, claimed to be an employee locked out of their account, and asked for a reset — how many minutes, and how many humans, stand between that call and a session inside your most sensitive cloud app?

Until next time,

Stay sharp. Stay ahead.

📩 Share this briefing with a colleague who needs to stay ahead.

📰 Full coverage at thecybersignal.com

☀️ Daily briefing at daily.thecybersignal.com