https://cybersecuritytracker.ai/?cats=threat-intelCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:32:50 GMThttps://bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominerscst-3223Threat actors are conducting ClickFix attacks on Steam discussion forums, disguising malicious downloads as solutions for gaming and computer issues that instead deliver XMRig cryptominers to infected systems. The campaign exploits the trust users place in community forums when seeking technical support, creating a social engineering vector at scale within a popular gaming platform.Sat, 25 Jul 2026 22:37:47 GMThttps://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caughtcst-3222A profile examines Phineas Fisher, a hacktivist credited with breaching multiple controversial government spyware vendors and remaining unidentified. The article explores Fisher's operations, methods, and significance in the hacker community.Sat, 25 Jul 2026 20:24:14 GMThttps://bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memorycst-3216A malvertising campaign deploys fraudulent cryptocurrency and trading platform websites containing malicious JavaScript that constructs malware in browser memory, bypassing traditional file-based detection methods.Sat, 25 Jul 2026 15:21:09 GMThttps://wired.com/story/security-news-this-week-the-openai-models-that-hacked-hugging-face-were-active-on-the-internet-for-dayscst-3215OpenAI models used in a hack of Hugging Face remained active on the internet for several days before detection. The incident underscores the exposure window between initial compromise and discovery in supply chain security contexts.Sat, 25 Jul 2026 10:30:00 GMThttps://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.htmlcst-3212CTM360 research documents a shift in insurance-focused phishing tactics from delayed account compromise to real-time hijacking. Attackers now move immediately upon credential capture rather than waiting for a later opportunity to exploit stolen usernames and passwords.Sat, 25 Jul 2026 10:14:21 GMThttps://cyberscoop.com/botnets-residential-proxy-networks-proliferate-lumen-black-lotus-labscst-3199Botnets powered by residential proxy networks are expanding despite periodic takedowns, with Lumen Technology's Black Lotus Labs tracking approximately 60 million compromised IP addresses globally. A single botnet provider, IPIDEA, rebounded to pre-disruption size within hours after coordinated action in January, demonstrating the resilience of the ecosystem. Researchers conclude that isolated takedowns are ineffective and that coordinated regulation and enforcement across industry and law enforcement is required to address the growing threat.Fri, 24 Jul 2026 19:47:44 GMThttps://bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accountscst-3192Attackers are modifying DNS settings on hotel and conference center Wi-Fi networks to redirect users to fraudulent Microsoft 365 login pages, capturing credentials in the process. This technique exploits the trusted nature of venue Wi-Fi to conduct large-scale phishing attacks against travelers and conference attendees. The attackers gain access to authentic Microsoft 365 accounts without triggering multi-factor authentication if users enter their credentials on the fake login page.Fri, 24 Jul 2026 17:50:37 GMThttps://therecord.media/wrench-attacks-against-cryptocurrency-holderscst-3184Security researchers report an increase in physical attacks including home invasions and kidnappings targeting cryptocurrency holders. These strong-arm tactics represent a shift in criminal methods beyond traditional digital attacks.Fri, 24 Jul 2026 15:55:00 GMThttps://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.htmlcst-3180North Korean threat actors known as BlueNoroff are running phishing campaigns that impersonate Zoom and Microsoft Teams to deliver malware, leveraging typosquatted domains and compromised industry contacts. The group profiles cryptocurrency wallets during the social engineering process before distributing malicious payloads to targets.Fri, 24 Jul 2026 15:12:35 GMThttps://securityweek.com/in-other-news-dolphin-x-ai-powered-malware-car-anti-theft-device-hack-400-linux-kernel-flawscst-3182A roundup of several security stories including Siemens ROX II industrial switch vulnerabilities, a Russian espionage campaign targeting Zimbra webmail, a ransomware extortion attempt against Stadler Rail, AI-powered malware called Dolphin X, a car anti-theft device hack, and over 400 Linux kernel flaws.Fri, 24 Jul 2026 14:20:00 GMThttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-systemcst-3186Google Threat Intelligence Group is launching a new cryptonym-based naming system for tracking threat actors, replacing the separate schemas previously maintained by Mandiant and Google's Threat Analysis Group. The system uses memorable two-word combinations where the first word identifies the actor and the second word indicates its origin, type, or motivation, with categories assigned to countries and cybercriminal groups. Google will rename several dozen active groups initially and continue on a rolling basis, preserving legacy names and mappings for cross-reference.Fri, 24 Jul 2026 14:00:00 GMThttps://bleepingcomputer.com/news/security/europol-flags-4-340-urls-for-removal-in-the-com-crackdowncst-3158Europol identified and flagged 4,340 URLs for removal during an operation targeting "The Com," a decentralized network of nihilistic violent extremist groups. The operation involved coordination across multiple weeks to disrupt online content associated with the network.Fri, 24 Jul 2026 12:56:53 GMThttps://databreaches.net/2026/07/24/il-weeks-after-cyberattack-eths-students-receive-phishing-scam-emails?pk_campaign=feed&pk_kwd=il-weeks-after-cyberattack-eths-students-receive-phishing-scam-emailscst-3173Evanston Township High School students received phishing emails six weeks after a prior cyberattack disrupted campus operations for two days. The malicious messages, sent from a compromised student email account, offered lucrative part-time job opportunities ($550 for two to three hours weekly) and were signed by a fake Human Resource department. The incident suggests continued compromise or exploitation of school infrastructure following the earlier attack.Fri, 24 Jul 2026 12:07:02 GMThttps://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.htmlcst-3164The Golden Chickens malware-as-a-service operation has returned with four newly identified malware families, including TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and a modified web browser credential stealer. The threat group continues operations despite previous public disclosures about their infrastructure and tactics. The new families include modular implants that expand the operator's technical capabilities.Fri, 24 Jul 2026 10:09:24 GMThttps://wired.com/story/satellite-images-reveal-how-giant-scam-compounds-keep-on-expandingcst-3157Satellite imagery analysis shows that dozens of alleged scam compounds have emerged in Myanmar in recent months, even as authorities claim to be cracking down on these criminal operations. The rapid construction of these facilities suggests that scam networks are adapting and expanding their physical infrastructure despite enforcement efforts.Fri, 24 Jul 2026 10:00:00 GMThttps://thehackernews.com/2026/07/fake-notepad-plugin-delivers.htmlcst-3143CERT-UA disclosed that UAC-0099, a Russia-aligned threat group, is distributing a malicious program disguised as a Notepad++ plugin to compromise Windows systems. The campaign delivers malware called MATCHBOIL.V2, continuing the group's pattern of using trojanized software delivery mechanisms.Fri, 24 Jul 2026 06:50:57 GMThttps://helpnetsecurity.com/2026/07/24/phishing-simulation-benchmark-reportcst-3149Analysis of 13.9 million simulated phishing messages reveals that only one in ten recipients report suspicious emails to security teams, leaving organizations vulnerable to attackers who need only a single successful compromise. Well-funded companies show higher rates of employees opening phishing attachments, possibly due to larger user populations or weaker security awareness practices.Fri, 24 Jul 2026 05:00:30 GMThttps://bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targetscst-3133Dolphin X is a newly identified remote access trojan that incorporates machine learning to profile and rank infected systems, allowing operators to prioritize targeting high-value victims. The malware demonstrates an emerging trend of threat actors integrating AI capabilities into their attack tooling to improve operational efficiency.Thu, 23 Jul 2026 21:20:34 GMThttps://bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malwarecst-3135Attackers are using malvertising on Bing search results to distribute a fake Claude desktop application installer that harvests credentials and installs the SectopRAT remote access trojan. The malicious installer is hosted on a subdomain of the legitimate Claude.ai domain, creating a convincing social engineering lure.Thu, 23 Jul 2026 19:48:30 GMThttps://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitalitycst-3139Attackers have compromised public Wi-Fi gateways at hotels, conference centers, and similar venues to redirect traffic and steal Microsoft 365 credentials from traveling corporate employees through DNS poisoning tactics. The campaign, active since at least June 2026, affects organizations across financial services, healthcare, legal, energy, and retail sectors globally. ReliaQuest assesses the tradecraft mirrors tactics previously attributed to APT28 (also known as Fancy Bear and Forest Blizzard), a Russian military intelligence group.Thu, 23 Jul 2026 18:00:00 GMThttps://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026cst-3131ClearFake maintains prominence in threat intelligence reporting, while CastleLoader emerges as a new malware variant of note in July 2026.Thu, 23 Jul 2026 17:12:43 GMThttps://therecord.media/zimbra-webmail-zero-click-phishing-russia-laundry-bearcst-3111A Russian-linked threat group called Laundry Bear has conducted targeted attacks against Zimbra webmail users globally using zero-click phishing techniques, according to U.S. and other government authorities. The activity represents a coordinated espionage campaign leveraging a popular email platform to gain unauthorized access to user accounts.Thu, 23 Jul 2026 16:58:00 GMThttps://bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malwarecst-3099Ukraine's CERT discovered attackers distributing a malicious tool disguised as a Notepad++ plugin to achieve persistence on compromised systems. The attacks use legitimate copies of Notepad++ bundled with the LunchPoke utility to deceive users into running malware. This technique exploits the trust users place in well-known applications and their plugin ecosystems.Thu, 23 Jul 2026 16:32:35 GMThttps://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.htmlcst-3103This story appears to be a preview or teaser for a ThreatsDay Bulletin covering multiple threat categories including Android spyware, programmable logic controller (PLC) attacks, and artificial intelligence (AI) image prompt injection attacks among other threats.Thu, 23 Jul 2026 15:02:07 GMThttps://microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insightscst-3123Microsoft's disruption of the Tycoon2FA phishing-as-a-service platform in March 2026 produced sustained impact through Q2, reducing associated phishing volume by 92% overall with no comparable replacement service emerging. Microsoft Threat Intelligence detected approximately 7.6 billion email phishing threats in Q2 2026, though monthly volumes declined modestly from April to June, with credential phishing remaining the primary payload objective. Threat actors expanded beyond email into Microsoft Teams-based social engineering and voice phishing, with malicious call attempts reaching nearly ten times mid-2025 baselines by quarter end.Thu, 23 Jul 2026 15:00:00 GMThttps://unit42.paloaltonetworks.com/russian-webmail-espionagecst-3124Unit 42 identifies a Russian-linked cyberespionage campaign targeting Zimbra webmail servers through JavaScript injection attacks designed to capture user credentials. The threat actors inject malicious code into compromised Zimbra instances to harvest login credentials from victims.Thu, 23 Jul 2026 14:10:53 GMThttps://helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malwarecst-3091Threat actors abused Anthropic's Claude Artifacts feature to host a malicious download page on the legitimate claude.ai domain. Employees at 29 organizations were deceived by a sponsored Bing ad linking to this artifact in July, which then redirected them to a spoofed Claude site distributing SectopRAT malware. The attack exploited legitimate platform features to establish trust and bypass initial security skepticism.Thu, 23 Jul 2026 13:12:21 GMThttps://thehackernews.com/2026/07/china-nexus-jadeprox-uses-new-triback.htmlcst-3106Group-IB identified a China-linked threat actor designated JadeProx through an exposed Alibaba Cloud server in Singapore. The group deployed a previously unknown Windows loader called TriBack Loader in attacks against government, healthcare, and education organizations across Asia and Latin America.Thu, 23 Jul 2026 12:20:23 GMThttps://thehackernews.com/2026/07/how-synthetic-identity-fraud-is-coming.htmlcst-3084Synthetic identity fraud differs from traditional identity theft by creating entirely fictional identities using a mix of real and fabricated data points rather than stealing an existing person's information. This approach is difficult to detect because no actual victim monitors the fraudulent account activity. The article discusses how this attack pattern is beginning to extend to machine identities in digital ecosystems.Thu, 23 Jul 2026 11:45:00 GMThttps://thehackernews.com/2026/07/attackers-weaponize-github-actions.htmlcst-3085Researchers discovered a large-scale campaign weaponizing compromised GitHub repositories and Actions runners as attack infrastructure against cPanel and WebHost Manager instances. The campaign involved malicious Packagist development versions across 10 packages associated with a legitimate PHP and DevOps developer between July 12 and 13.Thu, 23 Jul 2026 11:28:54 GMThttps://blog.talosintelligence.com/preview-cisco-talos-at-black-hat-usa-2026cst-3082Cisco Talos will present research and demonstrations at Black Hat USA 2026, including lightning talks on threat actor use of AI prompts, the Warlock ransomware group, zero trust agent identity, and vulnerability discovery trends. The group will deliver a main stage keynote on securing enterprises with AI agents, plus two workshops focused on integrating AI into security operations and monitoring autonomous systems as potential insider threats. Talos threat intelligence is embedded across the Cisco security portfolio and will be showcased at booth 2633.Thu, 23 Jul 2026 10:00:14 GMThttps://bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-trafficcst-3068Chaos ransomware operators deployed a new backdoor called msaRAT that conceals command-and-control traffic by routing it through Chrome or Edge browsers. This technique allows attackers to blend malicious communications with legitimate browser traffic, making detection more difficult.Thu, 23 Jul 2026 10:00:00 GMThttps://darkreading.com/cyberattacks-data-breaches/brazilian-banking-trojan-spreading-portugalcst-3061A Brazilian banking trojan is actively spreading in Portugal, exploiting the shared language between Portuguese businesses and Brazilian threat actors. The linguistic overlap creates favorable conditions for social engineering and targeted attacks against Portuguese organizations.Thu, 23 Jul 2026 07:00:00 GMThttps://recordedfuture.com/research/tag-195-evolves-maas-ecosystemcst-3132Insikt Group identified four new malware families associated with TAG-195, a financially motivated malware-as-a-service (MaaS) developer: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. These families demonstrate TAG-195's architectural evolution toward a modular, controller-and-plugin design that loads capability modules on demand rather than embedding all functionality in a single implant. The shift reflects both technical improvements in detection evasion and commercial incentives of the MaaS model, including selective capability provisioning and compartmentalization of risk across customers.Thu, 23 Jul 2026 00:00:00 GMThttps://darkreading.com/mobile-security/fake-bahrain-alert-apps-android-surveillance-malwarecst-3051Cybercriminals distributed a fake alert application disguised as an official Bahrain warning tool, which delivered multi-stage Android spyware to victims. The malware was promoted through counterfeit Google Play storefronts and targeted civilians during a period of heightened tensions from Iranian missile strikes in the region.Wed, 22 Jul 2026 19:42:42 GMThttps://cyberscoop.com/sandworm-mode-malware-ai-supply-chain-crowdstrikecst-3038Sandworm_Mode, a self-propagating worm discovered in February, targets AI coding assistants and software development environments to steal credentials, API keys, and secrets from CI/CD pipelines and major language model providers. The malware blends its activity with legitimate development traffic, uses multi-day delays to evade detection, and destroys compromised environments if unable to spread. CrowdStrike has monitored the threat for four months but has not determined its origin or ultimate intent, though it appears designed for persistent access and may represent a broader trend of supply-chain attacks against AI development toolchains.Wed, 22 Jul 2026 17:24:46 GMThttps://sentinelone.com/labs/frontier-models-tackle-autonomous-long-horizon-malware-analysiscst-3045SentinelLabs evaluated frontier AI models on a multi-stage malware analysis benchmark based on their investigation of fast16, a 2005 sabotage implant, finding that only OpenAI's GPT-5.6 Sol completed the full eight-stage reverse-engineering task. The benchmark tested whether models could maintain investigative integrity as new evidence contradicted earlier conclusions, with successful completion requiring project-scale recovery including withdrawing incorrect conclusions and repairing technical artifacts. The researchers concluded that the strongest current use case is supervised investigative support where human analysts retain authority over objectives, quality control, and final publication.Wed, 22 Jul 2026 16:55:29 GMThttps://therecord.media/kimsuky-north-korea-espionage-groupware-companiescst-3037Researchers have identified a recent campaign by Kimsuky, a North Korean advanced persistent threat (APT) group, targeting South Korean software vendors that produce collaborative work software.Wed, 22 Jul 2026 16:47:00 GMThttps://wiz.io/blog/agentless-threat-hunting-fortigatecst-3029A researcher's guide addresses agentless threat detection for virtual appliances by mapping event logs to real-world attack campaigns. The approach enables continuous monitoring without deploying agents to appliances, potentially offering organizations visibility into security events across distributed infrastructure.Wed, 22 Jul 2026 14:24:50 GMThttps://thehackernews.com/2026/07/why-modern-socs-need-multi-layered.htmlcst-3000The article argues that modern security operations centers require multi-layered detection approaches because traditional endpoint and malware-based defenses no longer catch most attacks. According to the CrowdStrike Global Threat Report, approximately 79% of attacks are malware-free, with threat actors increasingly relying on techniques that evade conventional security tools.Wed, 22 Jul 2026 11:25:35 GMThttps://schneier.com/blog/archives/2026/07/first-person-identity-theft-story.htmlcst-3009A first-person account describes how a victim's email account was compromised after they shared a two-factor authentication code with a scammer, illustrating the cascade of risk when an email account is breached. The article emphasizes that email security serves as the foundation for protecting most online accounts.Wed, 22 Jul 2026 11:02:26 GMThttps://thehackernews.com/2026/07/trojanized-newtonsoftjson-fork-hides.htmlcst-2976Researchers discovered a trojanized Newtonsoft.Json fork published to NuGet under the typosquatted name Newtonsoftt.Json.Net that contains code designed to manipulate live game outcomes on the Digitain platform. The package functions as a working library while hiding malicious game-rigging functionality, differing from typical info-stealing packages found on package registries.Wed, 22 Jul 2026 06:00:06 GMThttps://recordedfuture.com/blog/modern-attack-vectorscst-3030Modern threat actors have shifted from brute-force attacks to targeting digital identities through stolen session cookies, credential stuffing, and MFA fatigue campaigns. Adversaries increasingly exploit unpatched edge infrastructure like VPNs and supply chain vulnerabilities in open-source repositories. Organizations need real-time, outside-in threat intelligence to detect attack patterns before breaches occur, as traditional internal security telemetry often misses critical pre-attack signals.Wed, 22 Jul 2026 00:00:00 GMThttps://reliaquest.com/blog/red-teams-find-assumptionscst-3204Red teams are most effective when they identify the underlying assumptions and decisions that enable security weaknesses, rather than just finding vulnerabilities themselves. The relationship between red teams and defenders must be collaborative and trust-based, with both sides working toward the shared goal of reducing organizational risk. Red team programs often lose support when findings are diluted through reporting chains or when leadership lacks direct exposure to insights, making it difficult to drive meaningful remediation.Wed, 22 Jul 2026 00:00:00 GMThttps://cyberscoop.com/north-korea-it-worker-scheme-funds-russia-war-ukrainecst-2924A security firm report details how North Korea's IT worker scheme generates revenue through front companies and sanctioned entities that partially fund Russia's military operations and weapons procurement. Analysis of leaked payment server data shows $1.97 million flowing directly to a sanctioned North Korean defense entity between December 2025 and February 2026, with broader distribution across multiple domestic programs and military-related organizations. The scheme represents a significant revenue stream supporting both North Korea's weapons program and its material support to Russia's war effort in Ukraine.Tue, 21 Jul 2026 16:00:00 GMThttps://news18.com/sports/football/fifa-world-cup-2026-ticket-fraud-surges-as-fake-websites-and-domains-rise-ws-lo-10172861.htmlcst-2946Fraudulent ticket sales for the FIFA World Cup 2026 are increasing through counterfeit websites and domains designed to deceive buyers. Attackers are exploiting the high demand for World Cup tickets by creating convincing fake storefronts to steal money and personal information from unsuspecting fans.Tue, 21 Jul 2026 14:23:05 GMThttps://isc.sans.edu/diary/rss/33172cst-2928This article explains how modern operating systems and browsers detect captive portals on public WiFi networks by attempting to access specific HTTP URLs and checking for redirect responses. Different platforms use different detection URLs: Windows checks msftconnecttest.com, Apple uses captive.apple.com, Android and Chrome use generate_204 endpoints, and Firefox uses detectportal.firefox.com. Understanding these detection mechanisms can help network administrators and security analysts recognize benign traffic patterns and assist users who encounter connectivity issues.Tue, 21 Jul 2026 13:44:56 GMThttps://arstechnica.com/security/2026/07/apps-targeted-at-us-troops-contain-chinese-and-russian-codecst-2914Researchers examined hundreds of mobile apps marketed to US military personnel and discovered that over 12 percent contained software components from companies in China, Russia, or other foreign nations. One popular app for rating base living conditions included code from Huawei, while two others incorporated Russian advertising services. The findings raise concerns that adversary governments could harvest location and deployment data on service members through these applications.Tue, 21 Jul 2026 13:19:38 GMThttps://bankinfosecurity.com/cryptohack-roundup-sentencing-in-97m-laundering-case-a-31946cst-2917A roundup article covers sentencing in a cryptocurrency laundering case involving approximately $97 million. The piece aggregates cryptocurrency-related news and enforcement actions.Tue, 21 Jul 2026 13:10:10 GMThttps://sentinelone.com/labs/iran-war-cyber-threat-landscape-a-midyear-assessment-on-what-matterscst-2915SentinelLABS released a midyear assessment of cyber threats linked to Iran, finding that actual risk remains lower than public perception and centers on persistent access, trusted administrative accounts, and selective disruption rather than widespread attacks. The report establishes a taxonomy distinguishing Iran-linked operators by organizational affiliation (MOIS, IRGC units, domestic surveillance clusters) and mission set, noting that multiple vendor names often refer to overlapping activity from the same groups. Operational security targets include espionage, destructive hack-and-leak operations, social engineering, dissident surveillance, and opportunistic OT targeting, with impact claims frequently exceeding independently verified evidence.Tue, 21 Jul 2026 13:00:21 GMT