2026年6月28日の
セキュリティ情報

Subject: [Info] Supply Chain Attack Targeting AI Coding Agents

Dear team,

We are sharing information regarding a new attack vector targeting AI coding agents such as Claude Code.

■ Overview
Researchers from Mozilla's 0DIN have demonstrated a method where AI agents are tricked into executing malicious payloads from seemingly benign GitHub repositories. By inducing the agent to run specific initialization commands (e.g., python3 -m axiom init), attackers can bypass security scanners and human reviewers to establish an interactive shell on the developer's device.

■ Scope
- Development environments utilizing autonomous AI coding agents (e.g., Claude Code).
- Environments where AI agents are permitted to clone and set up external repositories.

■ Mitigation Steps
1. Review and tighten the approval process for commands executed by AI agents, specifically prohibiting blind approval of installation or initialization scripts.
2. Isolate development environments by running AI agents within containers or sandboxed environments.
3. Educate developers to critically evaluate commands suggested by AI agents before execution.

■ Reference
- Mozilla 0DIN AI security platform report

Priority: Medium
Deadline: Immediate/Ongoing

Subject: [Security Alert] Beware of Phishing Emails

Hi everyone,

We have received reports of phishing campaigns using fake guest complaint emails to target organizations.

What we need from you:
1. Do not open emails from unknown senders or click on suspicious links and attachments.
2. If you have accidentally clicked a link or entered your credentials, please report it to the IT security team immediately.

Deadline: Immediate / Ongoing

Subject: [Security Alert] Warning Regarding Signal/WhatsApp Recovery Keys

Hi everyone,
It has been reported that attackers are attempting to steal "Backup Recovery Keys" for Signal and WhatsApp to take over user accounts.

What we need you to do:
1. Never share your app recovery keys or backup keys with anyone, regardless of the reason.
2. Do not enter your recovery keys into any website or link provided in suspicious messages.

Deadline: Immediate

件名: 【共有】ロシア系APTによるSignal/WhatsAppリカバリキー標的攻撃について

お疲れさまです。ロシアの諜報機関（RIS）に関連するアクター（UNC5792, UNC4221）による新手法に関する情報共有です。

■ 概要
攻撃者がフィッシングを通じてSignalのバックアップリカバリキーを窃取し、アカウントの完全な乗っ取りおよびメッセージ履歴の復元を行うキャンペーンが観測されています。特筆すべきは、同一電話番号でアカウントを再作成しても旧キーが有効であり、設定から明示的に新キーを生成しない限りリスクが継続することです。

■ 影響範囲
- Signal, WhatsApp 利用ユーザー

■ 対応手順
1. ユーザーに対し、リカバリキーを第三者に共有しないよう周知徹底する。
2. キー流出の疑いがあるユーザーには、設定メニューから新しいリカバリキーを生成させ、旧キーを無効化させる。

■ 参考情報
- FBI/CISA Advisory PSA I-062626-PSA

対応優先度: 高
対応期限: 速やかに

Subject: [Intel] Russian APT Targeting Signal/WhatsApp Recovery Keys

Hi team,
Sharing intelligence regarding a campaign by Russian Intelligence Services (RIS) actors UNC5792 and UNC4221.

■ Overview
Attackers are using phishing to coax targets into handing over Signal Backup Recovery Keys. This allows them to restore backups, read message histories, and maintain persistence. Notably, the key remains valid even if the user creates a new account with the same phone number.

■ Scope
- Users of Signal and WhatsApp

■ Mitigation Steps
1. Educate users to never share recovery keys via any channel.
2. For compromised accounts, instruct users to generate a new key in Settings to invalidate the previous one.

■ Reference
- FBI/CISA Advisory PSA I-062626-PSA

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Fortinet Products CVE-2025-32756

Dear Team,

We are sharing information regarding a critical vulnerability in Fortinet products.

■ Overview
A stack-based buffer overflow (CVE-2025-32756) has been identified in FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This vulnerability allows an unauthenticated attacker to achieve root-level arbitrary code execution via a single HTTP request. It has been reported that this flaw was exploited in the wild prior to the advisory.

■ Affected Products
- FortiVoice
- FortiMail
- FortiNDR
- FortiRecorder
- FortiCamera

■ Mitigation Steps
1. Verify if your current product versions are susceptible to CVE-2025-32756.
2. Apply the latest security patches provided by Fortinet immediately.

■ Reference
- Fortinet Official Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Phishing Campaign Using Fake Guest Complaint Emails

Dear colleagues,
We have been alerted to a phishing campaign targeting the hospitality sector using fake guest complaint emails.

What we need from you:
1. Do not click on links or open attachments from unknown senders, especially those that redirect you through multiple websites.
2. If you have accidentally clicked a suspicious link or entered your credentials, please report it to the IT security team immediately.

Deadline: Immediate