Threat Intelligence Briefing: Key Cyber Incidents from the Week of May 4

Top Attacks and Breaches

Medtronic Cyberattack Exposes Millions of Records

Global medical device manufacturer Medtronic has disclosed a security incident affecting its corporate IT systems. An unauthorized third party managed to access sensitive data, although the company has asserted that the breach did not disrupt product operations, financial systems, or day-to-day business functions. The threat actor group ShinyHunters claimed responsibility, stating they stole approximately 9 million records. Medtronic is currently evaluating the extent of the data exposure.

Vimeo Breach Linked to Third-Party Analytics Vendor

Video hosting platform Vimeo confirmed a data breach that originated from a compromise at its analytics provider Anodot. The exposed information includes internal operational data, video titles and associated metadata, as well as a subset of customer email addresses. Critically, no passwords, payment details, or video content were accessed. The incident underscores the risks inherent in third-party integrations.

Robinhood Email System Abused for Phishing Campaign

Threat actors exploited the account creation process of online trading platform Robinhood to launch a sophisticated phishing campaign. The attackers sent emails from Robinhood's official mailing account, which passed standard security checks. The messages contained links to fraudulent sites designed to harvest credentials. Robinhood has stated that no accounts or funds were compromised and has since removed the vulnerable “Device” field that facilitated the abuse.

Trellix Source Code Repository Breach

Trellix, a major endpoint security and XDR vendor, suffered a breach of its source code repositories. Attackers accessed a portion of the company’s internal code. The organization has engaged forensic experts and law enforcement, and so far reports no evidence of product tampering, pipeline compromise, or active exploitation.

AI Threats

Critical Flaw in Cursor's AI Coding Environment

Researchers have identified CVE-2026-26268, a vulnerability in the Cursor coding environment that allows remote code execution when its AI agent interacts with a cloned malicious repository. The attack leverages Git hooks and bare repositories to run attacker scripts, potentially leading to the exposure of source code, access tokens, and internal tools. This flaw highlights new attack surfaces introduced by AI-assisted development platforms.

Bluekit: AI-Powered Phishing-as-a-Service Platform

A new phishing-as-a-service platform called Bluekit has been exposed by researchers. It bundles over 40 phishing templates with an AI Assistant that utilizes models such as GPT-4.1, Claude, Gemini, Llama, and DeepSeek. The platform centralizes domain setup, creates realistic login clones, includes anti-analysis filters, provides real-time session monitoring, and exfiltrates stolen data via Telegram. The use of AI significantly lowers the barrier for attackers.

AI-Enabled Supply Chain Attack Introduces PromptMink Malware

Researchers have demonstrated an AI-driven supply chain attack in which Anthropic's Claude Opus co-authored a code commit that introduced PromptMink malware into an open-source autonomous cryptocurrency trading project. The hidden dependency siphoned credentials, planted persistent SSH access, and stole source code, enabling full wallet takeover. This incident underscores the risks of trusting AI-generated code without thorough review.

Vulnerabilities and Patches

Microsoft Fixes Privilege Escalation in Entra ID

Microsoft has patched a privilege escalation vulnerability in Microsoft Entra ID that allowed the Agent ID Administrator role for AI agents to take over any service account. Researchers published a proof-of-concept demonstrating that attackers could add credentials and impersonate privileged identities. Administrators are urged to apply the update immediately.

Critical cPanel Authentication Bypass Under Active Exploitation

cPanel has addressed CVE-2026-41940, a critical authentication bypass vulnerability in cPanel and WHM. The flaw is being actively exploited in the wild as a zero-day and allows an attacker to gain full administrative control without any credentials. Users of affected versions should apply the patch without delay.

To stay informed on the latest cyber threats, regularly consult our Threat Intelligence Bulletins and follow best practices for patch management and third-party risk assessment.