The week the details decided security

Last week had no single big story, but a series of reminders that in security the detail is what decides. The Coldcard hardware wallet lost roughly 88.6 million dollars because of a weak random number generator that slipped into the firmware back in 2021. The ShinyHunters group kept up its campaign against Salesforce-linked data and added more victims with tens of millions of records.

Alongside that, two critical vulnerabilities where waiting does not pay off. Adobe Campaign Classic got a patch for a CVSS 10.0 flaw that lets code run without user interaction. Rails fixed a critical hole in Active Storage that allowed file reads and potentially remote code execution. And on the road, another trick surfaced where a fake browser update over hijacked hotel Wi-Fi drops a surveillance trojan.

Coldcard: an expensive box undone by a weak random number generator

The strongest story of the week. Coldcard Bitcoin wallets by the Canadian firm Coinkite became the target of a series of attacks that, per Galaxy Research, amount to an estimated 1,367 BTC (~88.6 million dollars) from more than 4,500 addresses across three waves. One wave emptied 1,196 addresses in just 41 minutes.

This was not a break in the cryptography, nor phishing. In March 2021 a firmware integration bug routed seed generation to a deterministic software random number generator instead of the hardware entropy source. The keys looked random but sat in a small, predictable subspace. Anyone who reconstructed the generator's logic could recompute candidate seeds and drain addresses en masse. Hence the speed, this was not cracking individual keys but sweeping a known set.

What to do:

• Treat entropy as a first-class risk. Use a CSPRNG with a documented hardware source for keys, seeds, and tokens, and verify it never falls back to software.
• Test the randomness source, not just the algorithm. Statistical tests (dieharder, NIST STS) reveal predictability a code review misses.
• Have a key rotation plan. When a weak entropy source surfaces, you must be able to regenerate and migrate quickly.

ShinyHunters: extortion of Salesforce-linked data continues

The ShinyHunters group added more victims in a campaign aimed at corporate data stored in or synced with Salesforce. Among the new names are Paris-based Questel SAS with a claimed 21 million-plus Salesforce records and over 147 GB of internal data, Israeli Lumenis with 1.1 million customer and employee records plus another 176 GB, and Swiss Alcon with more than 25 million records. Each set includes some personal data.

The pattern is consistent. Attackers reach the data through connected accounts and integrations, pull large volumes of records, and then push for payment under threat of publication. The risk is not just the SaaS platform itself, but the ecosystem of OAuth apps, connectors, and service accounts around it.

What to do:

• Review OAuth apps and connectors linked to Salesforce and other SaaS. Remove anything no one actively uses.
• Scope integration and service account permissions to the minimum, and enable detection of bulk exports.
• Prepare for a SaaS data extortion scenario, including communications and legal steps, not just classic ransomware.

Adobe Campaign Classic: a CVSS 10.0 flaw runs code without interaction

Adobe released a patch for a maximum-severity vulnerability in Campaign Classic, its enterprise marketing automation platform. The flaw CVE-2026-48449 scores 10.0 on CVSS and is a case of incorrect authorization that can lead to arbitrary code execution without user interaction.

Marketing platforms tend to connect to customer databases, email channels, and other internal systems, so a successful attack here does not stay on one server. That makes fast patching all the more important, and do not assume no one outside can see the system.

What to do:

• Deploy the Adobe patch for Campaign Classic as a priority, it belongs in the critical bucket.
• Check whether the instance is needlessly exposed to the internet and restrict access to required networks.
• Review logs for unusual activity around administration and integration interfaces.

Rails Active Storage: a critical hole from file reads to RCE

Rails fixed a critical vulnerability in Active Storage through which an unauthenticated attacker could read arbitrary application files and potentially escalate to remote code execution. Active Storage is a widely used component for handling files and attachments, so the impact spans a broad set of applications.

What to do:

• Update Rails to the patched version. If you cannot right now, verify which parts of the app use Active Storage.
• Check access to the file store and sensitive paths so they are not easily reachable even on a flaw.
• Monitor access logs for attempts to read outside expected paths.

Hotel Wi-Fi and CornFlake: a fake browser update on the road

Microsoft described operation CaptiveCrunch, which it attributes to the Storm-2945 group, assessed as a sub-cluster of Russian Midnight Blizzard. Over hijacked hotel Wi-Fi, the attackers pushed a fake browser update that delivers the CornFlake trojan. It can capture webcam images, microphone audio, and keystrokes.

Traveling management and technicians are more exposed on public networks, and hotel Wi-Fi is a convenient target. The fake update is an old technique, which is exactly why it works on someone in a hurry.

What to do:

• On the road, never install an update offered by a web page or a captive portal. Update only from official sources.
• Use the corporate VPN, and prefer mobile data over unknown Wi-Fi for sensitive work.
• For traveling roles, consider hardened device profiles and endpoint detection of RAT deployment.

What to take away from all of this

• A key is only as secure as its randomness. Verify the entropy source, not just the algorithm.
• SaaS risk is not just the platform, but the ecosystem of integrations around it. Watch OAuth apps and service accounts.
• For critical patches like Adobe Campaign Classic or Rails, do not wait. Attackers find exposed systems before you do.
• Detect mass anomalies. 1,196 addresses drained in 41 minutes, or a large SaaS export, are a clear pattern.
• A public network is not a trusted environment. On the road, update only from official sources and use a VPN.
• What you expose to the internet is what matters. Keep an inventory and hide what does not need to be out there.

What we would do at Cyber Rangers

In practice we tackle these things together. We look at the whole key lifecycle, where the entropy actually comes from, and whether a software fallback lurks anywhere. We test from an attacker's view what your company and its SaaS integrations expose to the outside, and review which systems like Adobe Campaign or Rails apps you have exposed and how fast you can patch them. And we drill your team on responding to a fast, partly automated attack, so the first real incident is not the first rehearsal.