Week one of June 2026 reads like a sector survey of modern attack economics: fraudsters industrializing World Cup scarcity, a cloud hijacker quietly renting out your SMTP reputation, an AI coding agent tricked into handing over its own repository, and Cisco shipping its seventh SD-WAN zero-day. One week, five lessons.
Quick Answer
The week of May 30 – June 5, 2026 delivered five stories defenders should track: 4,300+ fraudulent FIFA World Cup domains from the GHOST STADIUM operation; PCPJack’s hijacking of 230 cloud servers into a covert SMTP relay network; a prompt-injection flaw in Anthropic’s Claude Code GitHub Action that enabled repo takeover (fixed in v1.0.94, CVSS 7.8); Cisco’s seventh SD-WAN zero-day of the year (CVE-2026-20245, root command execution); and the steady mainstreaming of agentic AI in defensive operations. Patch the Action, segment SD-WAN management planes, and warn fans about ticket scams — now.
FIFA World Cup 2026 Scams Are Already Industrial-Scale
With the tournament kicking off June 11, Group-IB has tracked more than 4,300 fraudulent FIFA-related domains registered since August 2025. The most sophisticated operation — dubbed GHOST STADIUM, run by a Chinese-speaking cybercrime group — operates hundreds of cloned ticketing and merchandise sites. The economics are brutal: FIFA logged over 150 million ticket requests in the first fifteen days, leaving the tournament roughly 30x oversubscribed. Scarcity plus anxiety is the perfect fraud substrate.
The active vectors: lookalike ticketing domains, banking malware bundled into pirated streaming apps, credential harvesting on cloned FIFA login pages, and card-skimming merchandise shops. For enterprises, the play is user education before the group stage starts — World Cup phishing peaks in the ten days around kickoff, and the same techniques that power AI-powered phishing operations are at work here.
- Buy tickets only via FIFA’s official channels;
- Treat any discounted or resale ticket offer as fraud until proven otherwise;
- Alert finance teams to transaction-anomaly patterns on corporate cards;
- Block newly registered FIFA-lookalike domains at the resolver.
PCPJack: 230 Cloud Servers Turned Into a Covert SMTP Relay
Researchers at Hunt.io exposed the operator tracked as PCPJack, who compromised some 230 business servers across AWS, Google Cloud, and Azure — in the US, Europe, and Asia — and converted them into SMTP proxies for phishing and spam at scale. The operation surfaced because the attacker left two open directories on a C2 server (213.136.80[.]73) containing source code, deployment logs, internet scanners, and a live Sliver C2 configuration.
Relay abuse is quietly devastating: phishing mail originates from legitimate business domains, laundering sender reputation and frequently sidestepping SPF/DKIM/DMARC alignment. Detection is straightforward if you look: unexpected outbound traffic on ports 25/587/465, new accounts on mail servers, DNS lookups for relay configuration, and per-host send-volume spikes. It’s the same class of cloud-native abuse we dissected in AI infrastructure under attack — your cloud footprint is someone else’s free infrastructure.
Claude Code GitHub Action: Repo Takeover via a Single Issue
Researcher RyotaK (GMO Flatt Security) disclosed a critical flaw in Anthropic’s Claude Code GitHub Action — the integration that lets Claude triage issues, review PRs, and manage repository workflows. The Action ships with broad default permissions (code, issues, PRs, discussions, workflow files), and the flaw let an attacker open a crafted GitHub issue whose contents steered the agent into executing arbitrary commands on the runner and pushing malicious code into the repository and its dependents. Anthropic rated it 7.8 under CVSS v4.0, paid a bounty, and shipped a fix within four days.
This is textbook prompt injection against an over-privileged agent — the exact failure mode mapped in our prompt injection deep-dive and the reason the OWASP agentic applications guidance insists on least-privilege boundaries for AI in CI/CD. If you run any AI agent in your pipelines:
- Update
claude-code-actionto v1.0.94 or later immediately; - Audit the permission grants the Action receives — scope to exactly what it needs;
- Require human approval on merges and workflow-file changes;
- Treat issue and PR text as untrusted input, because it is.
Cisco SD-WAN Zero-Day CVE-2026-20245: Root, No Patch Yet
Cisco warned of its seventh SD-WAN zero-day exploited in 2026: CVE-2026-20245 allows arbitrary command execution as root on affected devices, with no patch available at the time of reporting. Until the fix lands, the mitigations are architectural: keep SD-WAN management interfaces off the internet, segment them from the data plane, and layer monitoring on management sessions. Edge-device zero-days have been the defining breach vector of the year — the pattern behind 2026’s zero-day surge and the BlueHammer/RedSun perimeter breaks.
Gemini Voice Assistant Hijacked via Notification Channel
Researchers demonstrated that Google’s Gemini voice assistant can be steered through messaging notifications: crafted notifications triggered assistant actions including smart-home control via Google Home, Zoom call initiation, and access to calendar and contact data. The bypass matters because it targets notification-handling logic rather than the assistant itself — no voice, no wake word, no visible interaction. As assistants accumulate home and office integrations, the notification channel becomes an implicit trust boundary that most organizations have never inventoried.
Agentic AI Moves From Demo to Defense Operations
The defensive side of the AI story kept accelerating. Anthropic’s Claude Mythos — the model whose technical-preview testing surfaced 10,000+ flaws — is being evaluated for autonomous security operations. Startup Offroad raised $7M for autonomous security agents aimed at enterprise identity risk, and Willow emerged from stealth with an access platform built specifically for securing AI agents. The direction of travel is clear: SOCs are shifting from alert-driven to autonomous-response workflows.
But every autonomous defender is also a potential attack surface. Compromised security agents with broad permissions would be catastrophic force multipliers — which is why agentic AI security and multi-agent system isolation are now core disciplines, and why techniques like the AI agent persistence attacks we documented matter to defenders and attackers alike.
The Week at a Glance
| Story | Severity | Actor / Vendor | Key Fact | Your Move |
|---|---|---|---|---|
| FIFA World Cup scams | Critical | GHOST STADIUM | 4,300+ fraud domains; 30x oversubscription | User awareness + domain blocking |
| PCPJack SMTP relay | High | PCPJack | 230 hijacked cloud servers; Sliver C2 | Monitor ports 25/587/465 |
| Claude Code Action flaw | High | Anthropic | CVSS 7.8; issue → repo takeover | Upgrade to v1.0.94+ |
| Cisco SD-WAN CVE-2026-20245 | Medium | Cisco | 7th zero-day of 2026; root RCE, unpatched | Segment management planes |
| Gemini notification hijack | Medium | Actions via message notifications | Audit assistant integrations | |
| Agentic AI defense wave | Emerging | Industry | Claude Mythos, Offroad $7M, Willow | Plan for agent governance |
Frequently Asked Questions
How many FIFA World Cup 2026 scam domains exist?
Group-IB has tracked more than 4,300 fraudulent FIFA-related domains registered since August 2025, largely tied to the Chinese-speaking GHOST STADIUM operation running cloned ticketing and merchandise sites. Volume typically peaks in the ten days around the June 11 kickoff.
What is PCPJack?
PCPJack is a threat actor documented by Hunt.io that hijacked roughly 230 cloud servers across AWS, Google Cloud, and Azure and converted them into SMTP relay proxies for phishing and spam. Its exposure came from two misconfigured open directories on its C2 server, which leaked source code, deployment logs, and a live Sliver C2 configuration.
How did the Claude Code GitHub Action takeover work?
The flaw, found by RyotaK of GMO Flatt Security, let an attacker open a GitHub issue containing crafted instructions that induced Claude Code — running with broad default permissions — to execute arbitrary commands on the runner and push malicious code to the repository. Anthropic fixed it in claude-code-action v1.0.94 and rated it 7.8 under CVSS v4.0.
Is Cisco CVE-2026-20245 patched?
At the time of reporting, no patch was available. The flaw allows arbitrary command execution as root on affected SD-WAN devices. Until a fix ships, keep management interfaces off the internet, segment them from the data plane, and monitor management sessions closely.
References
- Group-IB — FIFA World Cup 2026 fraud research (via The Hacker News coverage)
- Hunt.io — PCPJack cloud SMTP relay investigation
- GMO Flatt Security / RyotaK — Claude Code GitHub Action disclosure; Anthropic advisory (fix: v1.0.94)
- Cisco — SD-WAN security advisory, CVE-2026-20245
- Hmmnm — Prompt Injection Attacks Explained
- Hmmnm — OWASP Top 10 for Agentic Applications 2026
- Hmmnm — Agentic AI Security: The New Attack Surface
- Hmmnm — Zero-Day Surge 2026
- Hmmnm — AI Agent Persistence Attacks
- Hmmnm — AI-Powered Cyber Attacks: Defender’s Guide
