Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast
Help Net Security week-in-review roundup: Claude infostealer lockouts, record Patch Tuesday, McKesson breach, SonicWall zero-days, PaperCut attacks.
This Help Net Security weekly roundup aggregates prior stories: Anthropic locking out Claude users after infostealer-compromised login sessions, August 2026 Patch Tuesday's 398 resolved CVEs, ShinyHunters' claim of 284 million stolen patient records from McKesson, active exploitation of SonicWall SMA 1000 zero-days (CVE-2026-83548/83549), Sangoma Switchvox SQL injection exploitation (CVE-2026-9586), and attackers planting RATs on compromised PaperCut servers. It also covers FBI OAuth phishing warnings, a Spring Ring vishing campaign abusing Microsoft Teams, and a fake Claude Opus 5 GitHub repo delivering RevStealer infostealer.
- Anthropic locked out Claude users after infostealers hijacked login sessions
- ShinyHunters claims 284M patient records stolen from McKesson
- SonicWall SMA 1000 zero-days CVE-2026-83548 and CVE-2026-83549 actively exploited
- Fake Claude Opus 5 GitHub repo delivers RevStealer infostealer
- Spring Ring vishing campaign abuses Microsoft Teams fake IT support
- ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1539 Steal Web Session CookieT1190 Exploit Public-Facing Application
- Threat actors
- ShinyHunters
- Malware
- RevStealer
- Victims
- McKesson
- AI models
- Claude Opus 5
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC | |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
| CVE-2026-9586 | Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition | 9.3 | 19% | KEVPoC | KEV |
From the original article
7 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Anthropic locks out Claude users after infostealers hijack login sessions Anthropic has started locking users out of their Claude accounts due to their login sessions having been compromised through infostealer malware.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.