ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure
The full HackWire archive — 3,887 stories, newest first.
North Korean threat actors are using counterfeit job postings and fake coding challenges to deliver OtterCookie, a credential-stealing malware, via steganographic code embedded in SVG image files. The four-stage attack targets high-value developers and engineers, evading detection while exfiltrating
Residential proxies alone can't evade detection anymore. Cybercriminals now layer them with synthetic identities, device fingerprints, and behavioral signals to create convincing fake personas that bypass multiple fraud verification checks simultaneously.
ACR Stealer targets enterprises via ClickFix campaigns, stealing browser credentials, authentication tokens, and M365 files using fileless and obfuscated techniques to evade detection.
Armenia arrested the wrong Aleksandr Ermakov following a U.S. extradition warrant for REvil ransomware crimes. The detained tourist is a former lawyer from Omsk; authorities allegedly confused him with a different namesake sanctioned for the 2022 Medibank hack, exposing how patronymic details get lo
Military advantage in autonomy hinges on trusted information infrastructure, not system quantity. Winners reliably share data between drones, AI, and allied platforms at mission speed.
EU orders Google to share Android AI features with rivals by August 2027, covering 11 core system functions and sensor data. The Digital Markets Act ruling reshapes European mobile AI competition and exposes Google's deep control over the continent's digital infrastructure.
A critical Windows privilege escalation flaw (LegacyHive) allowing standard users unauthorized registry access was disclosed by researcher Nightmare Eclipse, escalating tensions with Microsoft over vulnerability disclosure practices.
Risk Ledger raised $32.3M Series B to expand in North America and enhance AI-driven supply chain risk assessment. Its network-first model differs from traditional vendor assessment platforms.
A July 13 cyberattack on Nichirei, Japan's largest frozen food producer, disrupted supply chains nationwide, affecting restaurants and retailers. The company shut systems offline to contain the breach and began restoring operations July 18.
Two Chinese nationals charged with laundering $43M in investment fraud proceeds via shell companies (2020-2022). The case reveals sophisticated criminal networks exploiting American victims at industrial scale.
**Summary:** Windows Server 2022 mainstream support ends October 13, 2026, shifting to extended support through 2031. Organizations must plan Windows Server 2025 upgrades within 90 days.
CISA alerts: critical Fortinet vulnerabilities actively exploited—unauthenticated RCE and auth bypass in FortiGate firewalls. Immediate patching essential for enterprise perimeter security.
A critical SharePoint remote code execution vulnerability saw active exploitation within 72 hours of disclosure. Authenticated attackers can execute arbitrary code on vulnerable servers, threatening enterprise environments.
CVE-2026-58644, a critical SharePoint RCE, is actively exploited. Unauthenticated attackers execute arbitrary code via unsafe deserialization. CISA ordered federal agencies to patch by July 19.
Coca-Cola subsidiary Fairlife suspended US milk production after a ransomware attack compromised production systems. No product safety issues were confirmed, but supply chain disruption is expected as the company investigates the incident.
Anubis ransomware combines encryption with permanent data destruction via 'wipe mode.' With ~90 victims, it uniquely intensifies extortion pressure on healthcare and critical infrastructure by converting ransomware from recoverable to irreversible data loss.
Agentic AI systems threaten traditional cybersecurity by operating unpredictably and requiring broad system access. They make autonomous decisions existing security models can't predict or control, breaking foundational assumptions about threat detection and access control.
ClickLock, a new macOS information stealer discovered in June 2026, uses aggressive social engineering and forced screen lockouts to coerce users into revealing passwords, cryptocurrency assets, and browser credentials. Since May, it has infected 100+ systems across 33 countries while evading antivi
An unauthenticated e-rickshaw app in India enables remote vehicle disruption, exposing IoT security gaps. The case highlights infrastructure vulnerabilities in emerging markets and rising AI-powered social engineering threats targeting high-profile individuals.
Over 1M phishing emails use "text salting"—hidden text that confuses AI security filters. Attackers weaponize LLMs to generate retail scams at scale, reaching inboxes despite advanced defenses.
Ransomware hit Coca-Cola's Fairlife dairy unit, halting U.S. production of milk and protein drinks. Production systems were compromised; Canadian ops unaffected and product safety confirmed.
Rockwell Automation communication modules (1756-EN2/EN3/ENBT) contain a critical DoS vulnerability allowing unauthenticated network attackers to disrupt connections via malicious CIP packets. The flaw requires no authentication and can be exploited repeatedly, potentially disrupting industrial opera
A stored XSS flaw (CVE-2026-9292) in Rockwell DataMosaix's Workflows lets authenticated attackers inject persistent scripts for credential theft and operational disruption in manufacturing systems.
CVE-2026-11889 allows authenticated attackers to bypass tenant isolation in SALTO ProAccess Space. The privilege escalation breaks multi-tenant logical separation, amplifying insider threat risk across enterprise facilities.