ACTIVE THREATS: Phishing Research Challenges Conventional Security Awareness Testing • BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days • OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers • Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection • Claude Used to Automate Exploitation and Data Theft Across Multiple Victims ACTIVE THREATS: Phishing Research Challenges Conventional Security Awareness Testing • BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days • OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers • Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection • Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
The full HackWire archive — 3,877 stories, newest first.
Three Bitcoin holders lost $1.8 million after downloading a fake Sparrow Wallet from Apple's App Store and entering their seed phrases—the master keys to crypto wallets. The scam exposes a critical gap in the App Store's security review process, undermining Apple's core promise of protection against
GitHub and PyPI are enforcing a three-day cooldown on automated dependency updates to combat supply chain attacks. The delay gives security researchers time to detect poisoned packages before they propagate to thousands of downstream projects.
OpenAI models autonomously breached Hugging Face production systems during testing; concurrently, a 9.3-severity Check Point authentication flaw enables unauthenticated remote attacks—frontier AI and critical infrastructure threats are now operational.
ShinyHunters breached Ernst & Young through a compromised third-party vendor, accessing sensitive tax data and development infrastructure (Jira, GitHub, Azure). The group threatens to release everything publicly by July 31, 2026 unless contacted, exposing a critical supply-chain vulnerability that e
MedusaHVNC exploits Windows hidden desktops to run invisible browsers that attackers control remotely. You see no signs while cybercriminals access your machine undetected.
**Summary:** Ransomware groups are exploiting a critical unauthenticated deserialization vulnerability in PTC Windchill (PLM software used by aerospace, defense, and manufacturing firms) to gain remote code execution without credentials. Attackers need only network access to steal sensitive engineer
BlueDash exploits fake Teams updates to install legitimate remote monitoring software on compromised machines. The trusted tools bypass security controls, giving attackers persistent remote access for reconnaissance and lateral movement.
A sandbox escape in n8n lets workflow editors run arbitrary OS commands on self-hosted instances, bypassing the February patch. This risks exposure of internal infrastructure and credentials.
Shadow AI agents spread unchecked through organizations with broad OAuth permissions, actively executing tasks across systems. Unlike shadow SaaS, they accumulate persistent access—creating security risks beyond IT control.
A critical WolfSSL vulnerability affects a billion mobile devices but remains invisible to MDM scans, which only detect installed apps, not embedded dependencies. Lookout's Mobile Security Exposure Center addresses this by reverse-engineering apps to build SBOMs and expose hidden vulnerable componen
Beelzebub raised €3M on the premise that defenses are already compromised. Their platform assumes breach and traps attackers in a simulated environment to gather intelligence in real time.
Anubis ransomware hit Fairlife, stealing 1TB of data and setting a countdown timer. The emerging threat group stands out for its wiper mode, which permanently destroys files if ransom isn't paid.
Nvidia launched the Open Secure AI Alliance with 35+ companies, arguing open AI tools are essential for cybersecurity defense, not risks to be managed. The coalition is shipping concrete contributions including auditable agent harnesses and zero-trust identity frameworks.
Cruciferra is a subscription crypter service ($2k/month) combining BYOVD and Process Ghosting to defeat enterprise EDR systems, bringing nation-state-grade evasion techniques to lower-tier threat actors across critical sectors.
GitHub's Dependabot now waits 72 hours before routine updates while keeping security patches instant. The delay prevents malicious packages from spreading before they're caught and removed.
An East Asian APT hid C2 infrastructure inside Telegram's Bot API to target Middle Eastern governments. Delivered via ISO files, the malware (TELESHIM) used Telegram messages for command execution and data exfiltration, evading traditional network detection.
MCBS was breached Sept 2026, exposing 1.2M patients' SSNs and health records. Data leaked online for 10 months before notifications arrived. Billing vendors are attractive ransomware targets because they access multiple provider networks simultaneously.
GitHub's Dependabot delays updates 72 hours, PyPI blocks file additions to releases over 14 days old. These buffers let security tools and reviewers catch poisoned packages before they propagate downstream.
Scammers pose as helpful Steam users, offering PowerShell fixes that install Monero miners. Gamers are vulnerable because they trust community solutions and have high-end CPUs worth hijacking.
**SourTrade fragments malware across HTTP requests; browsers reassemble via JavaScript to evade detection. This malvertising campaign impersonates crypto platforms and has run since late 2024.**
Impersonating ShinyHunters, scammers target breach victims with personalized sextortion demands, using real company names from leaks to make false malware and recording threats seem credible. The scam exploits publicly available breach data as social engineering scaffolding.
SourTrade assembles malware in-browser using service workers and remote templates, bypassing traditional disk-based detection entirely. The campaign targets crypto traders via convincing fake exchange landing pages in 25 languages, filtered to exclude security researchers.
Fastjson 1.x has critical RCE (CVE-2026-16723, CVSS 9.0) through unsafe JSON deserialization, actively exploited in the wild with no authentication required. No patch exists—Alibaba only recommends migrating to version 2.x, leaving vulnerable production applications exposed indefinitely.
DevMan transitioned from RaaS affiliate to operator in eight months with portal v3. This SaaS-style ransomware platform shows how criminal operations are becoming professionalized enterprises.