ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
ClickFix—a social engineering technique that tricks users into executing malicious commands—has become the dominant malware delivery method globally and now targets macOS users for the first time. The attack bypasses traditional antivirus defenses by exploiting human psychology rather than software
Threat actors have evolved from generic bulk phishing to precision attacks that fingerprint victims' devices and automatically deliver customized OS-specific malware, dramatically increasing infection rates while evading traditional security controls.
Kubota disclosed a month-long breach exposing 52,000 employees and dependents' data including SSNs, government IDs, and banking information. The company notified affected individuals 71 days after the March-April intrusion ended, following regulatory requirements under state privacy laws.
VEIL#DROP distributes PureLogs malware via compromised Google Blogger pages using social engineering. The campaign reflects a trend of attackers abusing trusted platforms to evade detection.
Attackers distribute SEO-poisoned spoofed installers that deploy ScreenConnect and AsyncRAT. They impersonate OBS, DS4Windows, and Bandicam for persistent backdoor access across multiple languages.
Peter Stokes, 19, was extradited from Finland to face U.S. charges in the Scattered Spider case. The collective targets critical infrastructure and enterprises through social engineering and credential theft, making them one of the most prolific and sophisticated hacking groups in recent years.
Critical unpatched vulnerability in Argo CD's repo-server enables unauthenticated attackers to execute arbitrary code and seize Kubernetes cluster control. No patch exists and no CVE has been assigned, creating significant supply chain risk for organizations relying on this widely-adopted GitOps too
Legacy email security can't stop modern threats like BEC and phishing, which cause 91% of breaches. Email's open architecture was never designed to handle today's sophisticated attacks.
DuneSlide is a critical sandbox escape in Cursor (used by 50%+ Fortune 500, CVSS 9.8). Attackers gain full machine and cloud access via prompt injection without user interaction.
Adobe patched seven critical flaws in ColdFusion and Campaign Classic enabling unauthenticated code execution. AI-driven discovery is compressing exploitation windows from days to hours, dramatically escalating risk for enterprise deployments.
Ousaban, a Brazilian banking trojan, targets Spain and Portugal via phishing and steganography. It steals credentials and hijacks sessions at 25+ banks to enable account takeovers.
**81 million password-spray attacks targeted Microsoft 365 over two weeks, compromising 78 accounts across 64 organizations. Attackers exploited misconfigured Conditional Access Policies that failed to protect the ROPC OAuth flow, successfully bypassing MFA defenses.**
DHS confirmed a May-June cyberattack on HSIN, an unclassified security information-sharing platform. The breach exposed FIFA World Cup coordination data; attackers' identity and extent of stolen information remain unknown.
Threat actors are exploiting exposed AI inference endpoints to power attacks requiring only endpoint knowledge and no authentication. Researchers observed three campaigns weaponizing Ollama and LiteLLM endpoints for penetration testing, credential theft, and social engineering between March and May
InfernoGrabber, an AI-generated ransomware, runs entirely in browsers to steal data, encrypt files, and demand ransom without native payloads—proving frontier AI models can operationalize previously theoretical threats.
Critical unauthenticated RCE (CVE-2026-8037, CVSS 9.6) in Kemp LoadMaster's `/accessv2` endpoint under active exploitation since June 29. String-handling flaw allows remote command execution with no credentials needed—patch immediately.
Criminal IP enriches OpenCTI threat intelligence with infrastructure context and vulnerability correlation, transforming raw indicators into prioritized, actionable threats and helping defenders move beyond indicator fatigue.
900+ Oracle E-Business Suite instances are actively exploited globally. Threat actors exploit misconfigurations across finance, healthcare, and manufacturing for credential theft and data exfiltration.
Apple released critical security patches across iOS, iPadOS, macOS, and Safari, patching dozens of core vulnerabilities. These flaws could enable code execution and widespread data theft on millions of devices globally.
A six-question framework helps security teams distinguish genuine AI capabilities from marketing hype, focusing on model selection, automation boundaries, validation, and implementation details. Vendors should clearly justify their AI choices rather than hide behind "proprietary" claims.
Events are prime cyber targets yet many planners treat security reactively. Success requires proactive threat intelligence and coordination months in advance to prevent credential theft, supply chain compromise, and operational disruption.
Organizations recognize cyber threats but lack resources to defend. Bitdefender's 2026 survey shows 87% of IT leaders are threat-aware yet only 34% have implemented defenses—revealing a dangerous gap between awareness and action.
Citrix patched six NetScaler flaws including CVE-2026-8451 (memory disclosure) and HTTP/2 Bomb DoS. Attacks expose cryptographic material and sensitive data, requiring immediate patching.
Adobe patched 7 critical RCE flaws (CVSS 10.0) in ColdFusion and Campaign Classic via file uploads and input validation bypasses. Unauthenticated attackers can execute code remotely. Immediate patching required.