BLOG 2026 JULY  2026  2025  2024  2023

AI blog  APT blog  Attack blog  BigBrother blog  BotNet blog  Cyber blog  Cryptocurrency blog  Exploit blog  Hacking blog  ICS blog  Incident blog  IoT blog  Malware blog  OS Blog  Phishing blog  Ransom blog  Safety blog  Security blog  Social blog  Spam blog  Vulnerebility blog 

2026 January(89) February(123) March(106) April(119) May(126) June(97) July(101) August(348) September(454) October(99) November(0) December(0)

DATE

NAME

Info

CATEG.

WEB

25.7.26

 Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense When CrowdStrike tested frontier AI to understand how its capabilities perform in vulnerability research, we learned the greatest differentiator was not the model used, but the harness around it. AI blog CROWDSTRIKE

25.7.26

 Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks In February 2026, Socket.dev published research on a multi-stage npm supply chain worm operating under the internal flag SANDWORM_MODE. The campaign spanned 19 malicious packages in total across two unique publisher aliases and demonstrated a new class of supply chain attacks that targeted AI-augmented development workflows. AI blog CROWDSTRIKE

25.7.26

 The AI era of cybercrime has arrived: The 2026 Cybercrime in the age of AI report New research reveals how AI is rewiring cybercrime today, and how you can prepare for what’s coming tomorrow. AI blog THREATDOWN

25.7.26

 The guardrails problem just played out on both sides of the same incident No hacker. No threat actor. No crime. Just an AI model, an authorized test, and a guardrails problem playing out on both sides of the same incident. Incident blog THREATDOWN

25.7.26

 The stack had a good run. Defense systems are the future. Something shifted in late 2025 that I don't think our industry has fully reckoned with yet. ICS blog SOPHOS

25.7.26

 In code we trust? Why the most trusted software receives the least scrutiny. Recent CVEs across GitHub, Anthropic, Google, dbt, and MISP expose a simple truth: the most trusted code is often the least questioned. As organizations connect AI agents to production systems, those overlooked assumptions can become powerful new attack paths. Vulnerebility blog SOPHOS

25.7.26

 Sophos joins Anthropic's Project Glasswing As a Project Glasswing member, Sophos gains access to Claude Mythos 5, an advanced frontier model not currently available to the public, to find and fix software vulnerabilities before AI-driven attackers can exploit them. AI blog SOPHOS

25.7.26

 When the "attacker" is an AI agent Last week, Hugging Face disclosed a security incident of a new kind: an intrusion carried out end to end by an autonomous AI agent. AI blog SOPHOS

25.7.26

 Updated Cyber Threat Actor Naming System Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors. This new naming taxonomy represents an effort to standardize tracking across platforms and public reporting. APT blog GTI

25.7.26

 Announcing InfraTrust, the source of intelligence on security risks across hardware infrastructure Today we’re excited to announce InfraTrust, a global hardware infrastructure security knowledgebase making mission critical infrastructure security data available faster, so you have it when you need it to defend your enterprise. InfraTrust is a searchable, continuously updated source of security advisories and risk data from major enterprise hardware infrastructure vendors. Cyber blog Eclypsium

25.7.26

 Email threat landscape: Q2 2026 trends and insights In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains. Spam blog Microsoft blog

25.7.26

 Law Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, With an Assist From TrendAI™ Kratos, the phishing-as-a-Service (PhaaS) platform behind a large share of recent Microsoft 365 credential theft, has been taken offline by the BKA and ZIT in an operation dubbed Olympus Blade. Phishing blog Trend Micro

25.7.26

 Volume Is Not Risk: Making Sense of the 'Vulnpocalypse' A briefing for security leaders on separating vulnerability disclosure volume from exploitable risk in 2026. Vulnerebility blog Trend Micro

25.7.26

 Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass Device code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement. Phishing blog Trend Micro

25.7.26

 Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure TrendAI™ Research breaks down what changed in CISA’s updated advisory on an ongoing PLC exploitation, why this activity might be more dangerous than a similar campaign in 2023, and how organizations can take action now to protect themselves. ICS blog Trend Micro

25.7.26

 Inside the OpenAI – Hugging Face Incident: The AI Breach With No Human Attacker Behind It OpenAI’s own models broke out of a test sandbox and into Hugging Face’s servers to solve an evaluation, with no human attacker involved. The incident showed how keeping agentic AI safe now depends on how it’s contained, not just on how it’s trained. AI blog Trend Micro

25.7.26

 13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan We analyzed a sustained tech support scam campaign that sent more than 13 million emails to Japanese addresses, with workplace-themed lures suggesting a possible expansion toward enterprise targets. Spam blog Trend Micro

25.7.26

 The Signs Were There: What the First Autonomous Ransomware Case Confirms An AI agent has run a ransomware intrusion on its own for the first time, from break-in to data destruction. The autonomous attacks TrendAI™ Research predicted are beginning to arrive, and defending against them shifts from blocking known indicators to detecting behavior. Ransom blog Trend Micro

25.7.26

 Joomla Multiple COM Extensions Unauthenticated File Uploads to RCE Joomla! Multiple COM_Extensions Unauthenticated File Uploads to RCE Vulnerebility blog SonicWall

25.7.26

 Russian Global Webmail Espionage Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor tracked by other vendors as Void Blizzard and LAUNDRY BEAR. APT blog Palo Alto

25.7.26

 Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure. ICS blog Palo Alto

25.7.26

 Preview: Cisco Talos at Black Hat USA 2026 Here’s some of the ways Talos is showing up at Black Hat, alongside our friends at Cisco and Splunk. Cyber blog CISCO TALOS

25.7.26

 Don’t swing at everything Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever. AI blog CISCO TALOS

25.7.26

 Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN. Malware blog CISCO TALOS

18.7.26

 The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets Group-IB discovers a sophisticated multi-layered scam scheme targeting fans with fake ticket sales on two fronts: social network platforms and fraudulent websites impersonating official distributors. Spam blog GROUP-IB

18.7.26

 Inside the Matching Engine: How Distributed Tokenization Identifies Compromised Cards Without Exposing Them Discover how Distributed Tokenization identifies compromised cards at pre-authorization without exposing raw card data — a technical deep-dive for fraud operations and risk teams. Hacking blog GROUP-IB

18.7.26

 SonicWall SMA1000 vulnerabilities in active exploitation On July 14, 2026, SonicWall disclosed two vulnerabilities in SonicWall SMA1000 appliances. Models 6210, 7210, and 8200v are affected. Vulnerebility blog SOPHOS

18.7.26

 GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a sophisticated engine for adversary operations and a high-value target for attacks. We explore the following developments: AI blog GTI

18.7.26

 Demystifying AI Exploits: A Blueprint for AI-Assisted Vulnerability Management As highlighted in the Mandiant M-Trends 2026 report, the mean time-to-exploit (TTE) has dropped to -7 days, meaning vulnerabilities are often exploited a week before a patch even exists. Hacking blog GTI

18.7.26

 The Risk of Exposed Cloud Functions and How to Harden Mandiant security assessments frequently identify publicly exposed serverless applications that lack authentication, often as a result of specific business requirements. Serverless deployments typically run custom-developed code that incorporates third-party packages, making them targets for a wide range of application-level attacks, including: Hacking blog GTI

18.7.26

 Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain Introduction Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation,... Malware blog Seqrite

18.7.26

 Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – Initial Infection through LNK file Stage 2 – PowerShell Downloader Analysis Stage 3 – The .NET Dropper... Hacking blog Seqrite

18.7.26

 Spirals: New Stealthy Ransomware Deployed Against Asian IT Company Attack using previously unseen ransomware payload occurred in June 2026. The skill of its operators suggests wider campaigns may follow. Ransom blog SECURITY.COM

18.7.26

 Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor Four years after Symantec first uncovered Daxin, the most advanced malware we had seen from a China-linked actor, it has been found running inside a Taiwan manufacturing firm, deployed with a novel new backdoor. APT blog SECURITY.COM

18.7.26

 GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses Third iteration of ransomware from Hyadina developers who first launched the Monster ransomware in 2022. Ransom blog SECURITY.COM

18.7.26

 ACR Stealer: Two observed intrusion chains amid increased threat activity From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. Malware blog Microsoft blog

18.7.26

 Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery hreat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. Hacking blog Microsoft blog

18.7.26

 Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself. AI blog Trend Micro

18.7.26

 The PhantomGate Campaign — Obfuscation, Persistence, and Covert Surveillance This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of PhantomGate malware. This family uses a series of obfuscated .LNK and .BAT files to download a malicious binary via PowerShell commands. Embedded payloads provide additional functionality for controlling webcams and capturing audio, using legitimate libraries to help bypass security. Malware blog SonicWall

18.7.26

 Microsoft Security Bulletin Coverage for July 2026 Microsoft’s July 2026 Patch Tuesday has 576 vulnerabilities, of which 255 are Elevation of Privilege. Microsoft had said last week in this blog that “As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release”. OS Blog SonicWall

18.7.26

 The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape. Malware blog Palo Alto

18.7.26

 TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development We identified a previously undocumented modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution. BotNet blog Palo Alto

18.7.26

 Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure. Vulnerebility blog Palo Alto

18.7.26

 AI Security Report 2026 For years, the cyber security industry tracked AI as a force multiplier: something that made existing attack techniques faster, cheaper, and more accessible. That framing was accurate. But the Annual AI Security Report 2026 from Check Point Research documents a transition that goes further. AI has crossed from assistant to operator. Where it once helped attackers prepare, it now runs the operation. AI blog CHECKPOINT

18.7.26

 UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. Malware blog CISCO TALOS

18.7.26

 The Hunter's Paradox: Is it time to embrace automated threat hunting? Humans can no longer keep up with the volume and velocity of security data on their own, but AI can't be fully trusted. David discusses the merits of both and muses on what the future might look like. AI blog CISCO TALOS

18.7.26

 [Video] Where protection starts: Cisco Talos Intelligence Integrations Every day, defenders make high-consequence decisions with incomplete information. Learn how Cisco Talos Intelligence Integrations help reduce uncertainty by turning the latest threat intelligence into proactive protections across Cisco technologies. Cyber blog CISCO TALOS

18.7.26

 The serpent’s tongue: Luring the Python out of its den This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments. Cyber blog CISCO TALOS

18.7.26

 Begun, the Patch Wars have Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story. Vulnerebility blog CISCO TALOS

18.7.26

 Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical." Vulnerebility blog CISCO TALOS

18.7.26

 WolfSSL, GeoVision, VTK vulnerabilities Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in WolfSSF, fourteen in GeoVision, and one vulnerability in VTK-DICOM. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Vulnerebility blog CISCO TALOS

18.7.26

 Forgotten UEFI shims undermining Secure Boot ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities OS Blog Eset
11.7.26 Phishing in the Balkans: Fake Traffic Fines, Real Losses This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state road authority, and how it can be linked to both Darcula and Phoenix PhaaS platforms with victims across the globe. Phishing blog GROUP-IB
11.7.26 Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs This blog covers Group-IB’s overview of Scattered Spider, backed by Group-IB’s proprietary intelligence, providing additional information to what has already been reported publicly, with added clarification on 0ktapus and how it is related to Scattered Spider. Hacking blog GROUP-IB
11.7.26 RedHook Returns with a Dangerous Upgrade Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack. Malware blog GROUP-IB
11.7.26 Sophos named a 2026 Gartner® Peer Insights™ Customers’ Choice for Email Security Sophos has been named a 2026 Gartner® Peer Insights™ Customers’ Choice in the 2026 Gartner® Peer Insights™ Voice of the Customer for Email Security. This marks Sophos’ entry into the report, as well as Sophos’ first ever Customers’ Choice distinction for Email Security. Cyber blog SOPHOS
11.7.26 When AI agents look like attackers: what behavioral telemetry tells us An X-Ops analysis of how AI coding agents trigger endpoint detection rules designed for adversaries AI blog SOPHOS
11.7.26 "Exploit mitigation" stalled around 2008. The attacks didn't. AI turns a patched bug into a working exploit in hours. Why endpoint exploit mitigation stalled in 2008, and what a default-on mitigation layer looks like now. AI blog SOPHOS
11.7.26 The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021, remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem. Hacking blog GTI
11.7.26 The Two BIOS Passwords Everyone Confuses When someone tells me “we set the BIOS password on the fleet,” my first question is always “which one?” Because there are at least two firmware passwords on a modern machine, they do completely different things, and the failure I see most often is a team that sets one, assumes it covers the other, and leaves a gap they do not know they have. Hacking blog Eclypsium
11.7.26 Post-Mythos Cybersecurity: Can You Automate Infrastructure Assurance with AI? Programs like Anthropic’s Mythos and OpenAI’s Daybreak are changing how organizations think about security architecture, internal engineering, staffing, and vendor commitments. OpenAI describes Daybreak as a defender-focused program for finding, validating, and fixing vulnerabilities before attackers can exploit them. AI blog Eclypsium
11.7.26 From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting  Russian Aerospace Organizations   Table of Contents Introduction Infection Chain Technical Analysis Conclusion Seqrite Coverage Indicators of Compromise (IOCs) MITRE ATT&CK Mapping Introduction The Seqrite Threat Research Team identified a targeted spear-phishing campaign disguised as a legitimate business invoice. The phishing email impersonates a legitimate... Phishing blog Seqrite
11.7.26 Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape Cyble breaks down how dark web ecosystems are evolving in 2026 with ransomware, initial access brokers, AI-driven attacks, and underground threat activity. Cyber blog Cyble
11.7.26 Mid-Year Threat Trends: What H1 2026 Signals for the Rest of the Year H1 2026 threat intelligence trends show rising ransomware, AI-driven attacks, and identity risks reshaping the global cyber risk outlook for 2026. Cyber blog Cyble
11.7.26 Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. Malware blog Cyble
11.7.26 GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses Third iteration of ransomware from Hyadina developers who first launched the Monster ransomware in 2022. Ransom blog SECURITY.COM
11.7.26 GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware  GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. Malware blog Microsoft blog
11.7.26 rclone Remote-Control API Unauthenticated Command Execution rclone Remote-Control API Unauthenticated Command Execution (CVE-2026-41179) Vulnerebility blog SonicWall
11.7.26 Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Malware blog Palo Alto
11.7.26 Cavern Manticore: Exposing Iran-Linked Modular C2 Framework Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it. APT blog CHECKPOINT
11.7.26 Winning 54% of the time With Wimbledon's help, Hazel argues against the popular myth that "Attackers only need to be right once, but defenders need to be right 100% of the time." Cyber blog CISCO TALOS
11.7.26 UAT-7810 continues building ORB networks using new malware Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware. Malware blog CISCO TALOS
11.7.26 ESET Threat Report H1 2026 A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts. Cyber blog Eset
9.7.26 GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses Third iteration of ransomware from Hyadina developers who first launched the Monster ransomware in 2022. Ransom blog SECURITY.COM
9.7.26 Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution We are revealing a proof-of-concept exploit that enables remote code execution in Anthropic’s Claude Code CLI (with Claude Sonnet 4.6 & 5, Opus 4.8) and OpenAI’s Codex CLI (with GPT-5.5) when employed to defensively assess the security of an open-source or third-party library. AI blog AINOW
9.7.26 Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims Residential proxies are one of the hottest topics in cybersecurity today. Turns out, they are often not in residences, and they facilitate a wide range of criminal activity. In the simplest terms, a little piece of software in a TV, digital picture frame, or your phone might enable a company to sell access to your device’s bandwidth to their own customers. Hacking blog INFOBLOX
9.7.26 Fake 7-Zip downloads are turning home PCs into proxy nodes A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims’ machines into residential proxy nodes—and it has been hiding in plain sight for some time. Hacking blog MALWAREBYTES
8.7.26 When prompts become shells: RCE vulnerabilities in AI agent frameworks AI agents have fundamentally changed the threat model of AI model-based applications. By equipping these models with plugins (also called tools), your agents no longer just generate text; they now read files, search connected databases, run scripts, and perform other tasks to actively operate on your network. AI blog Microsoft blog
4.7.26 GachiLoader adopts AI skill lure AI skills are threat actors’ newest and most dangerous lures. AI blog THREATDOWN
4.7.26 A double-edged bleeding edge: Classifying AI threats Sophos X-Ops presents a working taxonomy for attacks using, and targeting, AI AI blog SOPHOS
4.7.26 Vect and TeamPCP partner for ransomware campaigns Credentials harvested through supply chain compromises enable large‑scale ransomware deployment Ransom blog SOPHOS
4.7.26 Google’s Continued Disruption of Malicious Residential Proxy Networks Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks. Hacking blog GTI
4.7.26 The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. Since the mobilization of this ecosystem to support frontline objectives, we have witnessed the expedited development of new influence assets linked to multiple, expansive, covert information operations (IO) campaigns and a revitalization of pro-Russia hacktivism at an unprecedented scale. APT blog GTI
4.7.26 Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment Authors: Dixit Panchal & Soumen Burma Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Initial Mail: Email Attachment: Lure: Official GoI, Income Tax Document: Technical Analysis: Infrastructural Artefacts & Threat actor Attributions. Campaign Timeline. Conclusion:... Cyber blog Seqrite
4.7.26 Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. Malware blog Cyble
4.7.26 The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security Bring Your Own Vulnerable Driver (BYOVD) has gone from a niche tactic to a standard part of the ransomware playbook and Windows' own kernel hardening does little to stop it. Hacking blog SECURITY.COM
4.7.26 Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data. Malware blog Trend Micro
4.7.26 Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. Malware blog Trend Micro
4.7.26 TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. Malware blog Trend Micro
4.7.26 Android Arsink RAT Revisited Targeting User Credentials The SonicWall Capture Labs threat research team identified an ongoing Android Remote Access Trojan (RAT) campaign that employs multiple techniques to harvest sensitive user information through phishing and data exfiltration activities by impersonating the actual app icons and using similar names. Malware blog SonicWall
4.7.26 Joomla Content Editor Remote Code Execution The SonicWall Capture Labs threat research team became aware of a PHP code upload and execution vulnerability in Joomla products, assessed its impact, and developed mitigation measures. Joomla is a free, open-source Content Management System (CMS) used to build and manage websites and online applications. It serves as a powerful, flexible alternative to platforms like WordPress, offering extensive customization through thousands of extensions and templates. Vulnerebility blog SonicWall
4.7.26 Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector Unit 42 researchers found that large language models (LLMs) consistently hallucinate web domains for legitimate brands. Adversaries are actively weaponizing this vector by registering these nonexistent domains to intercept traffic generated by AI systems. We call this phenomenon phantom squatting, and it poses a significant risk to the software supply chain. AI blog Palo Alto
4.7.26 Threat Brief: Mitigating Large-Scale Credential Attacks Unit 42 is aware of a large-scale password spraying and credential theft campaign (“FortiBleed”) against Fortinet devices. We observed attempts targeting MSSQL devices as well, and have seen reports of Sophos devices also being targeted. While this activity is not targeting Palo Alto Networks devices, Unit 42 has observed suspicious login attempts in customer telemetry and we are providing this report out of an abundance of caution to ensure our customers have the latest intelligence and product recommendations to protect, detect and respond to attacks to their network. Hacking blog Palo Alto
4.7.26 CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Throughout 2025, we observed a cluster of activity targeting government entities and critical infrastructure in Southeast Asia. Specifically, the activity targeted state-owned enterprises in the energy and government sectors. APT blog Palo Alto
4.7.26 Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique AI can turn high-level malicious ideas into concrete techniques, and can independently design and implement novel attack paths that have not yet appeared in real-world campaigns. AI blog CHECKPOINT
4.7.26 ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 Talos has identified "ARToken," a phishing-as-a-service platform that targets Microsoft 365. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token persistence, email access, BEC operations, and SharePoint exfiltration. Phishing blog CISCO TALOS
4.7.26 Catan and Mouse What do board games and cybersecurity have in common? Pattern recognition. Strategy. Adaptation. In this week’s Threat Source Bill explores why curiosity may be a defender’s most valuable skill. Cyber blog CISCO TALOS
4.7.26 Martin Lee: Running through the Arctic (and the threat landscape) Ever wonder how someone goes from studying human viruses to leading cybersecurity teams? In this Humans of Talos, we’re joined by Martin Lee, EMEA Lead, to talk about his journey into the industry. Cyber blog CISCO TALOS
4.7.26 Cyber readiness for SMBs: Getting the basics right AI is changing cybercrime, but SMB cyber readiness still largely depends on closing the familiar gaps Cyber blog Eset
4.7.26 This month in security with Tony Anscombe – June 2026 edition Three-day patching deadlines, exposed fuel-tank systems, scams costing billions of dollars, and social media bans for children all gave Tony plenty to unpack in June 2026 Cyber blog Eset
4.7.26 Inside the inbox: Why cybercriminals want to break into your email account Your inbox is an identity system all of its own: whoever owns it may own a lot more Cyber blog Eset