The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants.

The threat actors told BleepingComputer the vulnerability allows remote code execution and that they used it Monday night to access FBI systems before moving laterally into FBI-managed AWS GovCloud infrastructure.

ShinyHunters claims it stole between 2TB and 3TB of data from the agency, including information on current and former FBI employees, job applicants, and other internal records.

The group also claims it compromised FBI Criminal Justice, HR, Medlink, and additional services during the intrusion.

ShinyHunters further claims it is now exploiting the same alleged zero-day against other organizations, including Fortune 500 companies.

BleepingComputer has not independently verified the alleged zero-day, lateral movement, or amount of stolen data.

However, ShinyHunters shared a screenshot with BleepingComputer showing the FBI Jobs website at apply.fbijobs.gov defaced with the group’s Umbreon Pokémon logo and a message claiming that FBI employee and applicant information had been compromised.

The defacement stated, “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since ’19 ;)”.

The message further claimed that sensitive personally identifiable and health-related information belonging to FBI employees and applicants had been stolen.

“All FBI data was compromised including sensitive PII/PHI on incumbent and former FBI employees and all applicant information,” read a message on the defaced site.

“We have a lot more than what we claim here. Thank you for your attention to this matter.”

ShinyHunters told BleepingComputer that the FBI quickly became aware of the intrusion, immediately took affected systems offline, and that the FBI Jobs site now displays a maintenance message.

The group also claimed that access to multiple FBI networks was terminated simultaneously after the agency detected the intrusion.

“They literally pulled the plug on everything,” ShinyHunters said.

The threat actors shared two sample records with BleepingComputer that the group claims were stolen during the attack, including data allegedly associated with FBI personnel.

One record allegedly contained information associated with an FBI special agent involved in a previous BreachForums investigation, while another allegedly contained information associated with FBI Director Kash Patel.

BleepingComputer is not publishing the personal information contained in those records and has not independently verified their authenticity or source.

404 Media first reported the alleged breach after receiving a sample containing approximately 5,000 purported FBI employee records.

The publication said it verified that some information in the sample was accurate, including phone numbers corresponding to people with the same names and numbers associated with US Department of Justice personnel.

Alleged PeopleSoft zero-day

ShinyHunters claims they gained initial access through a new zero-day vulnerability in Oracle PeopleSoft that remains unpatched.

“The Oracle product we exploited the 0day in is PeopleSoft. We found another one yesterday and immediately exploited it on the FBI,” ShinyHunters told BleepingComputer.

The group also claims it tried to erase evidence of its activity from compromised servers to make the zero-day harder to identify.

ShinyHunters also told BleepingComputer that it is now using the same alleged PeopleSoft vulnerability to target corporations and the Fortune 500 after targeting the education sector.

ShinyHunters claims the stolen FBI data came from systems accessed following the initial PeopleSoft compromise.

These systems allegedly include the FBI’s AWS GovCloud environment, which was used to store employee and applicant information.

BleepingComputer has contacted Oracle and Google Cloud’s Mandiant threat intelligence team to determine whether they are aware of a new PeopleSoft vulnerability or related exploitation activity.

Retaliation over FBI report

ShinyHunters later published a lengthy statement on its data leak site claiming the attack was retaliation for an FBI FLASH report detailing ShinyHunters that was published in May 2026.

The group disputes claims that ShinyHunters actors may exaggerate access to sensitive information, harass victims and their relatives, conduct swatting attacks, and falsely claim to possess compromising material.

The threat actors denied those allegations and also rejected claims that it is part of “The Com,” a loose-knit cybercrime community frequently tied to data breaches, cryptocurrency theft attacks, and commonly referenced by law enforcement and security researchers.

In the statement, ShinyHunters gave the FBI one week to correct or remove the FLASH report, while claiming the demand was not financially motivated and was not extortion.

When asked whether the group would release the allegedly stolen FBI data if the agency did not make changes to the report, ShinyHunters declined to say.

“No comment,” the threat actor told BleepingComputer.

When BleepingComputer asked the main representative of the ShinyHunters extortion gang whether they were concerned this would lead to increased pressure from the US government to apprehend them, they responded, “I don’t care.”

The alleged PeopleSoft zero-day would not be the first time ShinyHunters has been linked to exploitation of a previously unknown Oracle vulnerability.

During Clop’s 2025 Oracle E-Business Suite data theft campaign, ShinyHunters was part of a group calling itself “Scattered Lapsus$ Hunters” that leaked a proof-of-concept exploit later confirmed by Oracle to match one used in the attacks.

ShinyHunters later told BleepingComputer that the exploit originally belonged to them and that the Clop ransomware gang obtained it without authorization.

That dispute resurfaced last week when ShinyHunters breached and defaced Clop’s data leak site, claiming it stole server data and the private keys for its Tor onion service.

The group subsequently added Clop to its own leak site and threatened to extort the ransomware operation, saying the attack was retaliation for threats allegedly made during the Oracle E-Business Suite campaign.

BleepingComputer has contacted the FBI, Oracle, and Google Cloud’s Mandiant threat intelligence team regarding the alleged breach and PeopleSoft zero-day and will update this story if we receive a response.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

from the good-deals-on-cool-stuff dept

The Soundfreaq Sound Spot II combines wireless audio performance, ambient lighting, and relaxing sound features in a compact design built for modern lifestyles. Featuring a Bamboo and White finish with eco-friendly materials, this Bluetooth speaker complements bedrooms, offices, living rooms, and personal spaces while delivering both style and functionality. Engineered with a custom-designed audio driver, Bass Boost DSP technology, and a passive radiator, Sound Spot II delivers balanced sound with vocal clarity and enhanced bass performance. Beyond music playback, Sound Spot II includes built-in nature sounds, ambient lighting, and sleep timer functionality designed to help create a more relaxing environment. With Bluetooth connectivity, rechargeable battery power, and splash-resistant construction, it offers convenient performance for home and daily use. It’s on sale for $80.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

Jesse Lyu doesn’t think the Rabbit R1 was a flop.

Lyu’s gadget was among the first in the gold rush to create dedicated AI hardware that acted as a virtual assistant. You could speak into the R1 and ask it to complete tasks for you—book an Uber; order food on DoorDash. After a buzzy launch at CES 2024, it earned scathing reviews. All the agentic stuff on the R1 just didn’t work that well. WIRED gave it a 3/10.

Since those early days, the capabilities of AI assistants have vastly improved, and now the tech is all the rage. So Rabbit is banging the drum again.

On Tuesday, Rabbit announced OS3, a standalone “agentic operating system” designed to run across multiple screens. It also arrives as a software update for the company’s R1 gadget, though you don’t need an R1 to use it. Instead, you can access OS3 through a desktop browser, Telegram on your phone, or even iMessage.

It’s a striking pivot for a company that once championed the handheld hardware over smartphone apps, but the environment for this type of software has ripened.

Agents that handle tasks for you are all anyone in Silicon Valley talks about. Meta’s new Muse agent was just banned from crawling Amazon to shop on a user’s behalf using a virtual machine. Lyu smirks as he brings it up, saying, “We’ve been through all of this a year and a half ago,” calling back to the R1’s controversial use of a virtual machine to execute app actions on your behalf. So was Rabbit just too ahead of the curve?

Lyu says from a monetary perspective, the Rabbit R1 was tremendously successful, especially considering the company doesn’t offer a subscription for its AI features, unlike many competitors. He claims the company delivered more than 100,000 of the orange-red, Teenage Engineering-designed gadgets worldwide, with return rates of less than 5 percent, and earned roughly a 45 to 50 percent margin on the hardware.

Jesse Lyu, CEO and founder of Rabbit.

Advertisement

Courtesy of Rabbit

“Internally, from an engineering perspective—we didn’t make the wrong bet,” Lyu says. “I think the challenge is really being extremely limited in resources, team-wise and money-wise, compared to other AI studios that raised billions of dollars.” He says Rabbit has raised around $60 million in total and currently employs 15 people.

But after dismal reviews upon the R1’s launch, the company had to make tough decisions. Rabbit decided against expanding the team and chose to stay lean, but things were dire around this time last year. A planned launch in India was stymied by regulations, putting the company in financial strain, so much so that a handful of employees went on strike and claimed they weren’t getting paid. Lyu says he respected their decision, adding that the company secured more funding and is on stronger footing. “There are no issues with the company’s health,” he says.

Lyu says the team decided not to rush into new hardware, and instead focused on delivering software updates to polish the R1 experience—to date, Lyu says Rabbit has deployed around 50 updates in the past year and a half. He points to a dedicated Discord community of more than 12,000 users that provide feedback on what new features to add to the R1, like opening up the hardware. For example, you can integrate OpenClaw or Hermes AI agents into the R1 instead of using Rabbit’s proprietary models.

In May, Apple agreed to pay out $250 million as part of a class action lawsuit over claims the company overhyped its Apple Intelligence tools, specifically the long-delayed Siri AI overhaul.

Although the revamped Siri AI voice assistant is now available for owners of newer iPhones via iOS 27, you may still be eligible to claim cash back for past purchases. This settlement covers customers in the US who made their purchases from June 10, 2024 to March 29, 2025, and bought certain iPhone 15 or iPhone 16 models from Apple. If you qualify, you might receive up to $95 for each phone.

This settlement revolves around Apple’s promotion of Siri features to sell iPhones. “I expected to receive a Siri Apple Intelligence feature and did not receive it,” reads part of the statement you have to sign when filling out the claim form. As part of the settlement, Apple denies any wrongdoing.

“We resolved this matter to stay focused on doing what we do best, delivering the most innovative products and services to our users,” read part of Apple’s statement from May about the settlement.

To file a claim, visit the dedicated website: smartphoneaisettlement.com. Click the blue button in the top-right corner of the page labeled File A Claim. First, you’ll be asked whether you have a Claim ID and PIN to enter. It’s not required for you to already have this info on hand. On the final page, you’ll need either your iPhone’s serial number or Apple Account ID on hand to file the claim.

Not sure where your serial number is located? Open the Settings app, tap General, then choose About. Your serial number will be a string of letters and numbers near the top of the screen.

You can choose to receive the settlement money through PayPal, Venmo, an electronic bank transfer, or a paper check. If you have multiple devices and want to make claims for all of them, then you’ll need to fill out the form again for every eligible device. iPhone owners have until December 21 to make their claims.

QUADMOVR is no stranger to designing, printing, and flying self-built quads, and their latest experiment swaps every propeller for a 3D printed centrifugal wheel that lives inside its own vaned case. Each unit starts as a 60 mm PETG impeller that bolts to a standard T-mount motor with two M2 screws. A matching 90 mm housing, 28 mm tall, sandwiches between the motor and the carbon arm so the spinning wheel sits inside a 0.3 mm gap. Air enters through the open center on top. Curved vanes fling it outward the way a shop blower does. Fixed vanes in the case then turn that radial blast downward, which is how four of these assemblies lift a plain movr200cp2 X frame.

Files appeared on MakerWorld in May as a modified version of Baba’s 2024 “drone radial Impeller Propeller,” a project he had previously worked on, but with some extra bits added to get them to fit properly with NewBeeDrone FLOW 2004 motors – particularly when it comes to mounting, stiffness, and cable routing. The video credits acknowledge Felix Niessen, the original designer of the impeller. If you plan to print them, use PETG, 0.16 mm layers, five walls, and no infill, and leave them just as they come out of the printer, with no extra balancing or cleaning required. Although the tolerances are rather precise, you may need to do some little sanding before they round neatly, and printing the two plates takes approximately 7 hours.

Sale

SKYROVER X1 Drone with Camera Combo with Screen Controller, 4K/60fps Video, 8K Photo, 360° Obstacle…

• Cinematic 4K/60fps HDR Video & 48MP Photos: Captures smooth 4K/60fps HDR video and detailed 48 MP photos with a 1/1.32″ CMOS sensor and f…
• 5.5″ HD Touchscreen Remote — See Every Detail, Even in Direct Sunlight: 700-nit brightness and 60Hz display delivers crystal-clear live view…
• Under 249g & Travel Ready: Under 249g and easy to pack, the drone with camera for adults is built for grab-and-go flying without adding bulk to your…

It’s the same airframe, flight controller, and battery pack, with only two different rotors and the same Fettec 35 A AIO and 6S 550 mAh pack. But with the printed impellers, the quad weights 189 grams without the battery. When you swap in some high-quality three-blade props, the weight reduces to 141 grams. Each impeller weighs 15.7 grams, compared to 2.9 grams for a standard prop. Putting all that extra mass and surface area through the air, as well as the extra turn the air must make to get to the prop, all cost you hover time, but as the flight footage shows, the quad can still climb, translate, and perform the same acrobatic moves as before, despite not having GPS or self-leveling. A side-by-side comparison with a quad using standard props demonstrates the difference in efficiency. Some people have even described the propellers as having a “jet-like” noise, while being quieter than a pair of open blades.

In terms of safety, one of the practical advantages of these printed impellers is that the housing wraps around the working parts to protect them, much like the protective rings on early toy quads. Although none of this is a finished product yet, as QUADMOVR even labels it experimental, Baba stated in his original listing that the motor height, wheel-to-duct alignment, and KV all need to be relatively close for this to fly successfully. Some pilots who tried an older 60 mm version discovered it would simply sit there shaking if anything was wrong, while at least one person tested the 60 mm version on a heavier 5-inch quad and witnessed pieces break under strain.

The print files for this project are freely accessible under a Creative Commons non-commercial license, so if you have a competent FDM machine and a T-mount 2004, you can try it. Of course, ordinary three-blade props still prevail in terms of weight, inertia, and how little energy is wasted while rotating air twice. These printable impellers demonstrate that you can create a real FPV quad with a printed centrifugal wheel in a vaned shroud that can stay in the air long enough to fly in the same way as QUADMOVR flies everything else.
[Source]

Throughout her career, roboticist Barbara Mazzolai has turned to nature for inspiration. Now she wants to ensure the technology she builds gives back to the environment, too.

After starting her career as a biologist, a chance opportunity saw Mazzolai switch streams to engineering and become an early pioneer of bioinspired robotics. Building on her knowledge of biology’s ability to solve a diverse set of problems, she has developed robots based on octopuses, plant roots, and even seeds. “I’ve always been fascinated by living organisms, [and] by the extraordinary variety of solutions in nature, selected by the evolutionary process,” she says.