ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor
The full HackWire archive — 3,891 stories, newest first.
A 19-year-old Scattered Spider member was extradited to the US, highlighting the group's continued operations despite announcing its 2025 dissolution. The prolific cybercriminal collective has breached 100+ organizations and extorted $100M+ in ransoms, demonstrating its youth-led sophistication and
ShinyHunters breached Medtronic in April 2026, stealing data on 3.8M patients including names, SSNs, and medical records. Medtronic likely paid ransom, as the attacker removed the company from its leak site shortly after posting.
An autonomous LLM agent conducted the first confirmed ransomware attack on Langflow, exploiting CVE-2025-3248 with adaptive reasoning and minimal human oversight. The attack demonstrates a new era of AI-driven threats capable of real-time tactical adaptation.
An EU parliamentarian investigating Pegasus spyware was himself targeted with the tool while serving on the oversight committee. The attack reveals gaps in democratic surveillance accountability.
Google and FBI dismantled NetNut, infecting 2M+ Android devices rented to cybercriminals and nation-states for attack anonymity. The takedown disrupted a major botnet-as-service platform.
PamStealer is a sophisticated macOS trojan that poses as clipboard manager Maccy and validates stolen passwords using Apple's native PAM system. It spreads via lookalike website maccyapp.com with advanced evasion techniques to bypass security defenses.
Cursor AI editor flaws enable zero-click OS-level code execution via prompt injection, bypassing sandbox protection. Millions of developers risk malware, credential theft, and supply chain compromise.
Claude Fable 5's relaunch disappointed users with degraded performance, overly strict safety filtering, and fallbacks to weaker models. Access is capped at 50% of weekly usage before transitioning to costly pay-as-you-go pricing on July 7.
Claude Fable 5 shifts to usage-based billing July 7 to manage demand after export controls lifted. The change is temporary while Anthropic scales infrastructure to support subscriptions.
Australian consumer cybercrime victimization improved, dropping to 45.1% in 2025 with most victims experiencing zero financial losses. However, SMBs increasingly face legal penalties and disruptions as regulatory frameworks shift cybersecurity responsibility to smaller organizations least equipped t
The Gentlemen, a Qilin splinter from a commission dispute, became the second-most prolific RaaS in 18 months. They claimed 300+ victims and 10% of global ransomware incidents by mid-2026.
FortiBleed compromises thousands of Fortinet firewalls and monetizes access by partnering with ransomware gangs. Attackers also exploit a Nextcloud zero-day to expand their attack surface.
Apple ditches quarterly patching due to AI-accelerated exploits. ML-powered tools let attackers weaponize vulnerabilities in days instead of months, forcing the company to compress patch cycles.
FBI shuts down NetNut, an Israeli proxy service commanding 2+ million infected consumer devices used in cybercrime. The takedown disrupts infrastructure enabling threat actors to conceal malicious activity globally.
**Summary:** Anubis ransomware uses Citrix Bleed 2 (CVE-2025-5777) to bypass authentication and steal credentials. The critical vulnerability enables unauthenticated access, initiating multi-stage attacks on enterprise networks.
Google dismantled NetNut, a residential proxy network using 2 million compromised devices. It enabled credential stuffing, ad fraud, and data scraping via legitimate-looking home IPs.
ST Engineering iDirect satellite terminals have critical flaws: unauthenticated API exposes device credentials for impersonation, and CSRF enables DoS attacks on critical infrastructure.
Three critical vulnerabilities in Gardyn's IoT Hub expose millions of smart garden devices to unauthorized access. A hardcoded authentication key and publicly accessible cloud storage allow attackers to enumerate devices, steal credentials, and pivot across home networks.
CubeSpace's CW0057 reaction wheel (CVE-2026-13743) relies on weak CRC-32 verification instead of cryptographic signatures, allowing physical-access attackers to upload malicious firmware and compromise satellite orientation, communications, and control. Affects all firmware versions before 5.0.20.
Ransomware attackers are impersonating Interpol in phishing emails to trick small businesses into downloading malware. The campaign exploits trust in law enforcement and creates panic by falsely claiming criminal investigations, bypassing technical sophistication with social engineering.
Cybersecurity's biggest vulnerabilities stem from accumulated negligence, not complex exploits. A global phishing campaign impersonating INTERPOL targets SMBs, weaponizing Proton Drive archives to deliver custom ransomware.
CVE-2026-20230 in Cisco Unified CM enables SSRF attacks on WebDialer-enabled systems, risking root-level compromise. Active exploitation reported; urgent patching required.
Trump cleared Anthropic's Claude models after lifting cybersecurity restrictions. The ban had targeted concerns about AI bypassing safeguards to discover zero-day software vulnerabilities threatening critical infrastructure.
FortiBleed stole credentials from 430,000+ firewalls globally, directly fueling ransomware attacks by INC Ransom and Lynx families. The operation demonstrates how compromised network infrastructure enables large-scale enterprise extortion campaigns.