ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure
The full HackWire archive — 3,887 stories, newest first.
OkoBot malware deploys 20+ payloads to steal crypto keys and financial credentials from targeted users. The modular framework suggests professional threat actors conducting coordinated campaigns.
A critical vulnerability in Claude for Chrome enables malicious extensions to hijack AI operations and access Gmail, Drive, Calendar, and Salesforce without user consent. The flaw exploits insufficient isolation between browser extensions, allowing attackers to simulate user interactions and abuse t
Four critical vulnerabilities in Siemens SICAM 8 enable authentication bypass and firmware compromise, threatening power grids and manufacturing systems worldwide. Patches available in version V26.20; immediate patching required.
Rockwell Automation patched three critical DoS flaws in PLC controllers allowing remote attackers to trigger system failures via malicious files, potentially halting manufacturing operations.
Israeli startup Oak launches from stealth with $60M in seed funding to consolidate fragmented identity governance through an AI-powered platform. It unifies governance of human, machine, and AI identities into a single operating system, addressing enterprises' struggles with disconnected IAM tools.
15+ coordinated attacks exploit legitimate delivery—NuGet, Chrome defaults, installers. Attackers favor social engineering over zero-days, using Google Sheets and Telegram for command-and-control.
Two Scattered Spider members, ages 18 and 20, were sentenced to 5.5 years for a £29 million attack on Transport for London that disabled 148 systems and affected 9 million daily commuters.
ClickLock Stealer, a macOS malware targeting 100+ users across 33 countries, uses social engineering to steal browser data, cryptocurrency credentials, and system information exfiltrated via Telegram-controlled channels.
AI data centers scale faster than security can keep pace. Integrated GPU systems—unlike isolated traditional servers—create novel attack surfaces that legacy practices don't address.
OT systems controlling critical infrastructure were designed without security and cannot safely restart like IT systems. Standard IT vulnerability management is risky here—forcing a patch that restarts a power grid's controller could cause more real-world harm than leaving the vulnerability unpatche
Agent data injection corrupts trusted data fed to AI agents rather than hijacking their instructions, enabling attackers to misdirect shopping agents, trick coding assistants, and inject malicious code into production while evading modern defenses.
n8n's token exchange flaw validates JWTs using only the `sub` claim, ignoring the `iss` issuer claim. This allows attackers with valid tokens from one trusted provider to impersonate users from another, affecting Enterprise instances with multiple configured token issuers (CVE-2026-59208, CVSS 7.6).
ClickLock is a macOS infostealer that crashes apps every 210ms until users surrender credentials. It spreads via a Terminal command and uses fake dialogs and LaunchAgent persistence.
TELEPUZ malware spreads via ClickFix lures on compromised websites, stealing data and executing remote commands on infected systems. Its modular architecture allows attackers to customize payloads for specific targets while evading detection through reduced footprint and flexible deployment.
Two senior Scattered Spider members were sentenced to 5.5 years for orchestrating a 2024 Transport for London cyberattack that compromised critical infrastructure. The conviction signals escalating law enforcement action against organized cybercriminal groups.
23andMe settled for $18 million with 43 states over a 2023 breach that exposed genetic data to millions. The breach stemmed from credential-stuffing attacks and weak MFA.
AI agents operate at machine velocity with opaque logic, breaking legacy security controls designed for human-speed workflows. Attackers weaponize AI agents faster than defenders can understand and detect them, requiring entirely new security paradigms rather than patched defenses.
Researchers exposed PhantomEnigma: a campaign that compromised 20+ Brazilian .gov.br sites to distribute malware via fake government emails with valid digital signatures, bypassing email security.
Spirals, a new Rust-based ransomware, breached a South Asian IT firm in 24 hours after systematically disabling antivirus and 23 critical services including Veeam and VMware. Its precision and speed underscore urgent needs for faster threat detection and response capabilities.
Russian threat actor UAT-11795 distributes Starland RAT through trojanized software installers since June 2025, targeting the US, Europe, and Latin America to steal credentials and cryptocurrency.
CISA ordered federal agencies to patch CVE-2026-46817, a critical Oracle EBS vulnerability under active exploitation, by July 18. The flaw allows unauthenticated remote attackers to fully compromise systems via HTTP with minimal technical effort.
Windows 11 24H2 Home and Pro editions lose support October 13, 2026—90 days away. Millions of devices will stop receiving security updates, becoming targets for unpatched exploits, ransomware, and credential theft.
China's cybersecurity giants face military procurement penalties for bidding fraud and collusion, not technical failures. Over a dozen firms received 21+ enforcement actions since 2021, reflecting the PLA's structured crackdown on defense acquisition misconduct.
F5 patched a critical NGINX heap overflow (CVE-2026-42533, CVSS 9.2) enabling RCE on non-ASLR systems. Unauthenticated attackers trigger it via regex map directives, causing DoS on protected systems.