Latest cybersecurity reporting from selected sources.

Malware Targeted macOS Users Visiting Patel Foundation Merchandise PageTwo months after Iran-linked hackers exfiltrated FBI Director Kash Patel's personal email, the government official's name is tangled up in another cyber incident, this time through a MAGA swag shop he co-founded. ClickFix malware on the site tried to trick shoppers into running a malicious command.

Also: npm Packages Infiltrated, FBI Issues Fraud Alert, Campbell's Soup Cans CISOThis week, a recently fixed Oracle flaw is being actively exploited, Shelly tackled Pro 4PM DoS bug, "Shai-Hulud 2.0" hit npm, the FBI warned of rising bank account takeover scams, regulators fined Comcast over a vendor breach, Iberia reported a supplier incident and Campbell's canned its CISO.

Texas-Based Harris Health Says FBI Just Gave Green Light to Notify 5,000 PatientsHarris Health is contacting 5,000 patients about a breach involving a former employee who improperly accessed electronic health records for over a decade. The Texas health entity said it discovered and reported the incident four years ago to the FBI, which just gave the green light for notification.

US Cyber Defense Agency Deploys Support to Nevada Following Ransomware IncidentThe Cybersecurity and Infrastructure Security Agency and FBI are aiding Nevada after a cyberattack disabled state services, exposing how local governments - amid surging ransomware, IT shortfalls and federal funding cuts - are increasingly reliant on strained national cyber defense resources.

FBI's Sanjay Virmani Discusses Recent FBI TakedownsDeveloping strong relationships with private sector and international partner organizations is vital for tackling cybercrime. A proactive approach ensures more efficient incident responses, said Sanjay Vermani, the special agent in charge of the FBI in San Francisco

SEC Says Large Companies Must Report Material Incidents to Investors as of Dec. 18The FBI outlined procedures for publicly traded companies to invoke a delay in reporting material cybersecurity incidents to investors as required under a U.S. SEC rule. Regulators allow companies a pause of up to 60 business days and up to 120 business days for a substantial national security risk.