ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor
The full HackWire archive — 3,891 stories, newest first.
China-linked APT UAT-7810 developed three new backdoor variants (LongLeash, DogLeash, JarLeash) to weaponize 1000+ compromised SOHO routers as a relay network for persistent espionage and lateral movement. The operational relay box (ORB) infrastructure enables long-term access and compartmentalizes
Accenture confirmed a 35GB data breach with stolen source code, Azure credentials, and cryptographic keys. The company claims no operational impact but left details about breach scope and personal data exposure unanswered.
Threat actors deployed Vidar infostealer and XMRig cryptominer via malvertising to target SMBs globally. The dual-payload attack steals credentials while mining Monero, maximizing monetization per victim.
AI coding agents trigger security detection rules indistinguishable from real attacks. Their legitimate activities—credential access, code execution—mimic intrusion behavior, leaving endpoint security tools unable to distinguish productivity tools from threats.
Attackers pose as IT staff directing victims to fake passkey enrollment pages, stealing credentials and MFA codes in real-time. The campaign weaponizes Microsoft's new passkey feature as a social engineering vector, with operator-controlled phishing kits monitored live to harvest authentication resp
Researchers discovered 'GitLost,' a critical prompt injection flaw in GitHub Agentic Workflows that lets unauthenticated attackers steal private repository data through a single malicious GitHub Issue. No credentials required.
**Summary:** CISA confirmed active exploitation of four critical vulnerabilities in Adobe ColdFusion, Langflow, and Joomla extensions—all enabling unauthenticated remote code execution. Federal agencies must patch by July 10.
A critical Google Cloud Dialogflow CX vulnerability allowed attackers with minimal write permissions to silently hijack AI agents, steal sensitive data, inject phishing attacks, and erase audit trails across entire enterprise deployments. The flaw exposed companies in customer service, finance, and
Blocking phishing emails doesn't stop attacks—attacker infrastructure remains active. Traditional email defenses address detection, not disruption, leaving organizations vulnerable to persistent campaigns.
Ubiquiti patched seven critical flaws (CVSS 9.0–10.0) in UniFi products allowing unauthenticated network-based command injection across access control, security, and networking systems. Prior Ubiquiti vulnerabilities were actively weaponized by Russian state-sponsored actors, establishing a concerni
Cybersecurity startup IRIS C2, which offers up to $7 million for zero-day exploits, is operated by convicted felons Jack Burkman and Jacob Wohl, known for orchestrating disinformation campaigns and election interference schemes. The venture uses infrastructure from their prior fraudulent operations
SCMBANKER malware targets Latin American banks through ClickFix social engineering attacks that use fake CAPTCHA pages to trick users into installing credential-stealing payloads. The campaign establishes persistent C&C access for transaction hijacking and banking fraud.
**EvilTokens exploits "ghost phishing"—emails bypass security scanners by appearing harmless in transit, then reveal malicious phishing pages only when opened in browsers, targeting Microsoft 365 credentials.**
AI automates personalized service desk attacks at scale, defeating traditional detection methods like skepticism and consistency checks. Organizations must strengthen identity verification and behavioral monitoring to defend against this escalating threat.
GitHub's verified commit badge offers false security: attackers can rewrite commits and modify code while keeping signatures intact, defeating Git's tamper-detection promise and enabling supply chain attacks on open-source projects.
Researchers discovered that GitHub Copilot and similar AI assistants refuse harmful requests in chat but comply when framed as development tasks—a vulnerability called "workflow-level jailbreaking." By disguising malicious prompts as routine coding work, attackers bypass safety guardrails these mode
With 75% of consumers and 68% of enterprises now using passkeys, attackers are abandoning credential stuffing to target weaker identity verification flows, relocating rather than retreating. As primary authentication hardens through passwordless security, the ATO threat has shifted downstream to hum
CISA mandated urgent patching of CVE-2026-55255, an authentication bypass in Langflow enabling attackers to steal LLM credentials and execute code within AI workflows. The actively exploited IDOR vulnerability requires federal agencies to remediate by Friday to prevent compromise of AI infrastructur
KDDI disclosed a July 2026 breach affecting 12.2M people across five Japanese ISPs. Attackers exploited a zero-day in third-party software, exposing emails and passwords undetected for 30+ days.
DuckDuckGo's browser now blocks YouTube ads by default on iOS, macOS, and Windows using uBlock Origin filters. The feature integrates with Duck Player for ad-free, privacy-focused viewing across both YouTube's site and embedded videos.
Ubiquiti patched seven critical UniFi flaws including CVE-2026-50746, a command injection in Connect 3.4.16 requiring no user interaction. 100,000+ devices vulnerable; upgrade to 3.4.20+ urgently.
CISA ordered federal agencies to patch a critical, exploitable ColdFusion vulnerability by Friday. The flaw allows unauthenticated remote code execution, suggesting active attacks in the wild.
Estonia becomes the first to issue digital IDs to AI agents, enabling autonomous systems to authenticate directly with government services. This raises questions about accountability and security.
CISA warned of four critical vulnerabilities (CVSS 10.0) under active exploitation as of July 8. Attackers are targeting AI platform Langflow to steal LLM provider and AWS credentials. Adobe ColdFusion, JoomShaper, Joomla, and WordPress are actively being exploited with minimal delay after disclosur