Security · Top stories
Greatness PhaaS Adds Device Code Phishing, Targets Microsoft 365 Accounts
The Greatness phishing-as-a-service (PhaaS) toolkit now supports device code phishing, exploiting the OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and compromise user accounts. This update allows attackers to steal MFA-approved authentication tokens and maintain access to compromised accounts, posing a greater threat to online security. The platform is sold for $289 per month and targets platforms including Microsoft 365, iCloud, Yahoo, and Google Workspace.
Russia Charges Telegram Founder Pavel Durov with Aiding Terrorism, Seeks Arrest
Russia's Federal Security Service (FSB) has charged Telegram founder Pavel Durov with aiding terrorist activity and placed him on an international wanted list. The FSB alleges Telegram failed to remove channels and bots used by Ukrainian special services and extremist organizations to coordinate sabotage and terrorism within Russia, resulting in casualties and financial damage. Durov has rejected the allegations, stating Russia is retaliating for his refusal to comply with demands for mass surveillance and censorship.
Liechtenstein's Register of Beneficial Owners Breached, 31,000 Records Exfiltrated
A cyberattack on Liechtenstein's Register of Beneficial Owners resulted in the exfiltration of data belonging to approximately 31,000 individuals. The breach, which occurred from Wednesday night into Thursday last week, compromised a critical financial transparency tool used to combat money laundering and terror financing in the principality.
Visa Acquires Fraud Prevention Firm BioCatch for $2.4 Billion
Visa is acquiring BioCatch, a fraud prevention company, for $2.4 billion in cash. This acquisition integrates BioCatch's behavioral biometrics technology into Visa's services to enhance cybersecurity and financial crime detection, addressing a global economy cost of over $1 trillion annually from scams and account takeovers.
Horizon3 Raises $250M Series E, Reaching $2 Billion Valuation
Cybersecurity startup Horizon3 secured $250 million in Series E funding, increasing its valuation from $650 million to $2 billion in 14 months. The funding, co-led by NightDragon and NEA, will support the company's growth as enterprises seek solutions for continuous, automated vulnerability testing against escalating AI-driven threats.
Amgen Discloses Data Breach Affecting Patient Health and Proprietary Information
Biotechnology company Amgen reported a data breach where threat actors stole corporate data and patient information from third-party cloud systems. The unauthorized activity was detected in July 2026, leading to an ongoing investigation into the scope of the exfiltrated data, which includes proprietary information and protected health information.
ShinyHunters Leaks Brinks Home Data After Breach Affecting 4.9 Million Records
Brinks Home, a residential security company, experienced a data breach identified on July 20, with the ShinyHunters extortion group claiming responsibility. ShinyHunters has leaked over 41 gigabytes of data, including 4.9 million Salesforce records with personally identifiable information (PII), after Brinks Home did not pay a ransom. The breach did not affect alarm monitoring or system functionality.
Arch Linux Disables AUR Package Adoption and Pushes Due to Malware Influx
Arch Linux has disabled package adoption and pushes in its Arch User Repository (AUR) following an increase in malicious package adoptions and commits. This measure was taken to prevent the spread of malware, including remote-access trojans (RATs) and info-stealers, which attempt to upload user data and spread laterally across systems. The disablement is temporary while the Arch Linux DevOps team addresses the security situation.
Judge Dismisses Google's DMCA Scraping Lawsuit, Reddit's Similar Case Proceeds
A judge dismissed Google's lawsuit against SerpApi, which alleged DMCA 1201 violations for scraping Google's search results, finding Google's claim unfounded. However, Google plans to refile its complaint. Separately, a judge largely denied SerpApi's motion to dismiss a similar lawsuit from Reddit, allowing Reddit's DMCA claim regarding scraping copyrighted content from Google search results to proceed.
H96 TV Streaming Sticks Implicated in Ad Fraud and Proxy Network Operation
Bitsight researchers uncovered a widespread ad fraud operation, named Fuyao and attributed to Zhejiang Fengwo IoT Technology Co., Ltd., involving H96 TV streaming sticks. These devices spoof mobile phones to click ads on AI-generated websites and also function as SOCKS5 proxy exit nodes, while secretly collecting user hardware and installed app information. This activity highlights security vulnerabilities and fraudulent practices within generic streaming devices, impacting online advertising and user privacy.
AI Chatbots Outperform Humans in Romance and 'Pig Butchering' Scams
A study conducted by four universities found that AI chatbots, including ChatGPT, Claude, and Gemini, are more effective than human scammers at building trust in romance and "pig butchering" scams. This development indicates an increased threat in online fraud, as AI can more effectively manipulate victims over extended periods.
Okta Acquires AI Identity Security Startup Permiso for Reported $200 Million
Okta has signed an agreement to acquire Permiso Security, an AI identity security startup, for a reported $200 million in an all-cash deal. This acquisition expands Okta's identity management capabilities to include continuous monitoring and threat detection for human, non-human, and AI agent identities in multi-cloud environments, addressing the growing need for securing autonomous software deployments.
Hush Security Raises $30 Million to Secure Enterprise AI Agents
Hush Security, a Tel Aviv-based cybersecurity startup, secured $30 million in Series A funding, bringing its total raised to $41 million. The funding will be used to expand its platform for securing enterprise AI agents, focusing on identity and access management for autonomous AI within sensitive systems.
FTC Sues Hims & Hers Over Alleged Patient Data Sharing with Advertisers
The Federal Trade Commission (FTC) has filed a lawsuit against telehealth provider Hims & Hers, alleging the company shared sensitive patient health information with advertising platforms such as Meta, Snap, Microsoft, Pinterest, Reddit, and X. The FTC claims Hims & Hers engaged in deceptive practices by promising privacy while sharing customer data, violating the FTC Act. This action highlights ongoing regulatory scrutiny of data privacy in the telehealth sector.
Coordinated Cyberattack Impacts Over 30 Minnesota Water Systems
A coordinated cyberattack targeted the operational technology of more than 30 community water systems in Minnesota on July 26 and 27. The attack caused outages and communication failures, with Braham's water plant going offline and other cities like Plymouth, South St. Paul, and Maple Plain experiencing affected automated controls or cellular communication issues. The incident prompted a statewide cybersecurity response involving Minnesota IT Services (MNIT).
CISA and ACSC Release Guidance for Isolating Critical Infrastructure OT Systems During Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Cyber Security Centre (ACSC) have issued joint guidance, "CI Fortify – Advice for isolating vital systems," for critical infrastructure organizations. This guidance advises preparing to isolate operational technology (OT) systems from less trusted networks to maintain essential services during cyberattacks or other disruptions, addressing threats from state-sponsored actors.
Spur Intelligence Secures $200 Million Investment from Insight Partners for Bot Detection
Spur Intelligence, a cybersecurity startup specializing in IP intelligence and bot detection, raised $200 million in a funding round led by Insight Partners. This investment will accelerate and scale Spur's operations, which help organizations distinguish legitimate human users from increasingly sophisticated bot traffic and anonymized web activity. The funding addresses the growing challenge of bot activity, which now surpasses human internet traffic.
Cyera Acquires Oasis Security for $1 Billion to Secure AI Agents and Non-Human Identities
Data security company Cyera is acquiring agentic access management provider Oasis Security in a $1 billion deal, with approximately $700 million paid in cash and the remainder in shares. This acquisition integrates Oasis's non-human identity and agentic access governance platform into Cyera's offerings, addressing security challenges posed by the increasing use of AI agents in enterprise environments.
Apple Releases iOS 26.6 and iPadOS 26.6 with 87 Security Fixes
Apple released iOS 26.6 and iPadOS 26.6, addressing 87 vulnerabilities across its mobile operating systems. These updates fix flaws that could allow arbitrary code execution, privilege escalation, and data access, enhancing device security for iPhone and iPad users.
Google Threat Intelligence Group Unifies Threat Actor Naming System
Google Threat Intelligence Group (GTIG) has introduced a new unified naming schema for tracking threat actors, replacing the previously separate systems used by Mandiant and Google's Threat Analysis Group (TAG). This change aims to standardize threat actor identification across platforms and public reporting, making it easier for defenders to understand and respond to threats.
Amazon launches GuardDuty investigation agent for AI-powered threat assessment
Amazon introduced the GuardDuty investigation agent in public preview, enhancing threat assessments across AWS environments. This tool automates investigation processes, reducing time from hours to minutes and providing structured risk assessments and actionable recommendations.
Dysphoria IoT Botnet Uses Blockchain for C2 After JackSkid Disruption
The Dysphoria IoT botnet has adopted blockchain-based name services and infected-device relays for command-and-control (C2) following a March law enforcement operation against its predecessor, JackSkid. Researchers from CNCERT and Qi'anxin's XLab estimate the botnet to have over 200,000 bots, using them for distributed denial of service (DDoS) attacks and traffic relay operations. This architectural change makes the botnet more resilient to disruption by obscuring the location of its controllers.
Cloudflare open-sources 'pvcli' debugger for OHTTP and MASQUE privacy protocols
Cloudflare has open-sourced "privacy-client" (pvcli), a command-line debugger for Oblivious HTTP (OHTTP) and MASQUE protocols, under an Apache 2.0 license. This tool addresses the difficulty of troubleshooting privacy services like Apple's iCloud Private Relay and Microsoft's Edge Secure Network VPN, which split trust across multiple operators to prevent any single entity from linking user identity to online activity.
Indian Government Orders GitHub to Remove Bluetooth-Based Chat App Bitchat
The Indian Cybercrime Coordination Centre (I4C) has ordered GitHub to remove the Bluetooth-based messaging application Bitchat, citing concerns that it enables communication during network restrictions and poses a risk of misuse by various illicit groups. This action highlights government efforts to control communication channels, particularly those that bypass traditional surveillance methods, impacting developers of privacy-focused communication tools.
Dolphin X Malware Uses AI Profiling to Rank High-Value Targets
A new remote access trojan named Dolphin X incorporates an "AI Profiler" feature to score and rank infected users, helping cybercriminals prioritize victims. This development allows attackers to automate the identification of high-value targets from a large pool of compromised accounts, potentially increasing the efficiency of cyberattacks.
Chick-fil-A reports data breach from credential stuffing attacks
Chick-fil-A has alerted customers about a data breach caused by credential stuffing attacks affecting accounts. The breach may involve sensitive information like names, email addresses, and partial credit card numbers.
AegisAI raises $36M Series A to combat AI-driven spear phishing with AI agents
AegisAI, a startup founded by former Google security executives, secured $36 million in Series A funding to develop AI agents that detect and prevent AI-crafted spear phishing attacks. The company's technology analyzes email messages for anomalies that traditional rule-based systems often miss, addressing the increasing sophistication of AI-powered cyber threats.
White House Launches AI-Driven Gold Eagle Initiative for Cybersecurity Coordination
The White House has launched the Gold Eagle initiative, an AI-supported federal clearinghouse for cybersecurity vulnerabilities. This program aims to enhance vulnerability detection and remediation across government and private sectors by facilitating collaboration between software maintainers and infrastructure operators. Gold Eagle is backed by multiple federal agencies and uses AI to manage cybersecurity risks efficiently.
Upbound Group discloses $13M fraud in Acima leases following data breach
Upbound Group reported a cybersecurity incident where threat actors stole non-sensitive customer information and documents, leading to $13 million in fraudulent Acima lease-to-own agreements. The stolen data was used to obtain goods, resulting in financial losses for the company when fraudsters failed to make payments. Upbound has implemented enhanced security measures and notified federal law enforcement.
Swiss rail manufacturer Stadler rejects $12.3M ransom demand after cyberattack
Swiss rail vehicle manufacturer Stadler Rail rejected a $12.3 million ransom demand from the Everest ransomware gang following a data breach on a platform shared with a supplier. The company reported no impact on its IT systems or production operations, and stated only non-security-relevant technical information was stolen, demonstrating a firm stance against cyber extortion.
South Korea's diplomat training system breached by hackers for 9 months
Hackers compromised South Korea's diplomatic academy's e-learning platform for nine months, exposing employee data. This breach raises serious cybersecurity concerns, especially given the country's past experiences with North Korean cyberattacks.
GitHub Restructures Bug Bounty Program, Reduces Public Payouts by July 2026
GitHub is restructuring its bug bounty program to prioritize quality over quantity, introducing a permanent, invite-only VIP program with higher payouts and direct access to its security engineering team. Starting July 27, 2026, public bug bounty payouts will be reduced by at least 50% across all severity levels, with fixed payments replacing previous ranges. This change aims to reduce the volume of submissions and reward established researchers more effectively.
Cyberattack Halts Operations of Japanese Cold-Chain Operator Nichirei, Impacts Food Supply
A cyberattack on Nichirei Logistics Group disrupted frozen food shipments in Japan, affecting major chains like KFC. Operations began partial restoration post-attack, with a focus on data safety due to potential personal data compromise.
AI-Driven Security Startup Glow Emerges With $180M Funding at $1.2B Valuation
Glow, a cybersecurity startup leveraging AI to bolster endpoint security, has emerged from stealth with a $1.2 billion valuation and $180 million in Series A funding. Founded by former Meta and Snowflake executives, the startup seeks to address AI-related cyber risks by providing tools that manage software on employee devices. This reflects the growing concern over AI-augmented cyber threats and the need for enhanced security strategies.
Authorities Shut Down Kratos Phishing-as-a-Service Platform, Arrest Developer
German and U.S. authorities dismantled the Kratos phishing-as-a-service platform, used for Microsoft 365 phishing campaigns, and arrested its developer in Indonesia. The platform had 1,800 users running 15,000 campaigns monthly, significantly affecting global cybersecurity due to its ability to bypass multifactor authentication.
23andMe Settles $18 Million Data Breach Case Across 42 States
23andMe will pay $18 million to settle claims from 42 states over a data breach affecting 6.9 million users, including genetic data. The settlement requires enhanced cybersecurity measures and accountability going forward. This settlement follows issues of inadequate data protection and significant delays in breach notifications.
Judge Dismisses Lawsuit Against Apple Over iCloud CSAM Detection
A lawsuit accusing Apple of not preventing child sexual abuse material (CSAM) on iCloud was dismissed by a California judge. The company was ruled immune under Section 230, shielding it from liability for user-uploaded content. The case highlights ongoing debates about tech companies' roles in moderating content on their platforms.
Qilin Ransomware Gang Exploits Patched PAN-OS VPN Vulnerability
The Qilin ransomware gang is exploiting a critical flaw (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect to gain unauthorized access and deploy ransomware. Despite the vulnerability being patched on May 13, 2026, attacks have led to network breaches and data encryption. The U.S. CISA has urged federal agencies to secure their GlobalProtect instances immediately.
Estée Lauder Data Breach Exposes Sensitive Details Through Oracle E-Business Vulnerability
Estée Lauder disclosed a significant data breach resulting from the exploitation of a zero-day vulnerability in Oracle E-Business Suite. The attack occurred in August 2025 and was revealed in June 2026, impacting personal data including Social Security numbers, financial, and health information of employees. The breach was connected to the Cl0p cybercrime group and affected multiple companies.
FCC Fines and Plans Ban on DJI-Tech Disguised Products Citing National Security
The FCC has fined eight companies $25,000 each for not responding to inquiries about their use of DJI technology. The Commission plans a retroactive ban on their drones and cameras, given concerns over evading foreign drone bans. This crackdown reflects national security concerns involving disguised DJI tech in the US.