UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCESATURDAY, 4 JULY 2026
Sharing Intelligence Network Breached
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

◆ MODERATECyber and Information Warfare4 JUL 2026

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

ALSO FILED
▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026
▌ INTELLIGENCE BRIEF

CIA and FBI Refuse White House Demand for Centralized Foreign Spy Registry

The CIA and FBI are defying a White House and ODNI directive to compile a centralized master registry of all known foreign intelligence operatives, citing catastrophic operational security risks if such a list were ever compromised.

◆ HIGH CONFIDENCEIntelligence Community4 JUL 2026
▌ INTELLIGENCE BRIEF

Divided House: DIA and CIA Split on Iran Nuclear Strike Damage as Doha Talks Resume

Contradictory DIA and CIA assessments of US strike effectiveness on Iran's nuclear programme have exposed a structural intelligence dispute at the moment most consequential to ongoing ceasefire negotiations.

◆ MODERATEIntelligence Community4 JUL 2026
▌ INTELLIGENCE BRIEF

CIA and FBI Resist White House Order to Build Master Spy Registry

A White House directive to build a centralised master list of all foreign intelligence operatives has triggered open institutional resistance from the CIA and FBI, who warn the repository would constitute an unprecedented single point of failure in US counterintelligence history.

◆ HIGH CONFIDENCEIntelligence Community3 JUL 2026
▌ INTELLIGENCE BRIEF

Inside the Pipeline: How China Is Secretly Training Russia's Army

Classified Russian documents confirm Defence Minister Belousov personally authorised covert military training for approximately 200 Russian troops at People's Liberation Army facilities in Beijing and Nanjing, covering drones, electronic warfare, and radiological, biological, and chemical warfare tactics.

◆ HIGH CONFIDENCECovert Operations3 JUL 2026
▌ INTELLIGENCE BRIEF

Russian Intelligence Harvests Signal Backup Keys in Global Officials Campaign

Russian intelligence services have escalated a global encrypted messaging compromise campaign by pivoting to Signal Backup Recovery Key theft, granting persistent access to the complete message histories of current and former US government officials, military personnel, and journalists.

◆ HIGH CONFIDENCECyber and Information Warfare2 JUL 2026
▌ INTELLIGENCE BRIEF

Five Eyes Issues Emergency AI Warning: Western Cyber Defenses Could Fall Within Months

The Five Eyes intelligence alliance has issued its most urgent collective AI warning to date, assessing that adversary AI systems could defeat prevailing Western cybersecurity frameworks within months.

◆ HIGH CONFIDENCECyber and Information Warfare29 JUN 2026
▌ INTELLIGENCE BRIEF

Iran Rebuilds War Machine as Ceasefire Clock Ticks Down

Western intelligence assessments confirm Iran has reconstituted approximately 75% of its pre-war military capability within weeks of the June 17 Islamabad Memorandum ceasefire, with 30 of 33 missile sites restored to operational status and continued Russian-origin weapons transfers documented.

◆ MODERATEConflict and War29 JUN 2026