Hackers Hit Global Stock Exchange, Finance Ministry, Dashlane, Red Hat, and Meta in a Week of Escalating Attacks

A global stock exchange executive had their inbox pillaged for at least five months. Afghanistan's Ministry of Finance was targeted in a spear-phishing campaign. Password manager Dashlane disclosed that fewer than 20 users had their encrypted vaults stolen. Red Hat's npm packages were compromised by a credential-stealing worm. And Meta's AI support bot was tricked into handing over Instagram accounts. Those five separate incidents were all disclosed or analyzed in the first week of June 2026.

Symantec and Carbon Black published details on June 3 of an email spying campaign against a senior member of an unnamed major financial exchange. The attacker used legitimate Windows tools and a custom infostealer built on Aspose's .NET library to convert and exfiltrate emails via Dropbox. The spying ran from at least August 2025 to February 2026. The researchers noted that information about listings, enforcement actions, and market-moving events could have been of significant value to businesses, investors, or a foreign government.

On the same day, The Hacker News reported that the Pakistan-aligned SideCopy group targeted Afghanistan's Ministry of Finance with a spear-phishing campaign. The delivery method was a ZIP archive containing a malicious LNK file with a Pashto-language filename. The payload was Xeno RAT, an open-source remote access trojan.

Dashlane disclosed on May 31 that an external threat actor launched a brute-force attack against certain user accounts on the personal subscription plan. The attacker aimed to break two-factor authentication. Fewer than 20 users had their encrypted vaults downloaded. The company did not specify when the attack occurred or how the attacker gained enough information to target specific accounts.

A new supply chain attack campaign codenamed Miasma compromised Red Hat npm packages, according to a June 2 report. The attack used install-time execution to steal credentials and secrets from developer machines and delivered a self-propagating worm. The researchers said the campaign reused core tactics from the earlier Mini Shai-Hulud campaign, including CI/CD targeting and encrypted exfiltration.

Krebs on Security reported on June 1 that hackers exploited Meta's AI support bot to reset passwords for high-profile Instagram accounts. The attackers followed instructions circulating on Telegram that detailed how to trick the bot into authorizing password changes. Among the accounts defaced were the Obama White House Instagram account and the Chief Master Sergeant of the U.S. Space Force. Both were briefly defaced with pro-Iranian images and messages. Meta has since updated the bot's response protocols.

Security teams across finance, government, and major platforms now face a common pattern: attackers are finding and exploiting the path of least resistance. For the stock exchange and the finance ministry, that path was email and spear-phishing. For Dashlane, it was brute-forcing accounts. For Red Hat, it was the npm supply chain. For Meta, it was a large language model.