From BleepingComputer · 40 stories
New 'ShieldBreak' Zero-Day Exploit Bypasses Microsoft Defender Patch, Grants SYSTEM Privileges
Security researcher Nightmare Eclipse released "ShieldBreak," a new zero-day exploit for Microsoft Defender that bypasses a previous patch for the RoguePlanet vulnerability (CVE-2026-50656). This exploit allows SYSTEM privileges on fully updated Windows 10, Windows 11, and Windows Server systems, highlighting an incomplete patch for a privilege escalation flaw.
WhatsApp Rolls Out Optional On-Device Scam Alert Feature in Limited Beta
WhatsApp has launched a limited beta of "Scam Alert," an optional feature that uses an on-device machine learning model to identify suspicious messages from unknown contacts. This feature processes message content locally on the user's device to maintain end-to-end encryption while alerting users to potential scams. Users can block, report, or ignore flagged messages, and can opt to share message data to improve the model's accuracy.
New Mirai Variant "Evooo1Bot" Adds Stealth and Proxy Capabilities to Botnet Code
A new Mirai botnet variant, dubbed Evooo1Bot, has been actively exploiting vulnerabilities in internet-facing hardware for at least a month, according to FortiGuard Labs. This variant includes enhanced stealth features like SSH honeypot detection and a SOCKS proxy function, allowing attackers to conceal their origin and pivot into internal networks. The added capabilities make Evooo1Bot more sophisticated than previous Mirai-derived malware, posing a greater threat to network security.
FBI Warns of Cybercriminals Hacking Accounts to Steal Explicit Images for Extortion
The FBI has issued a public warning about cybercriminals hacking into social media and online accounts of adults and children to steal explicit images and videos. These stolen materials are then used for blackmail, sold on criminal marketplaces, or shared with other criminals to facilitate further sextortion, with student-athletes and young boys frequently targeted.
Mozilla Replaces GPG Signing Key for Firefox and Thunderbird After Accidental Exposure
Mozilla has replaced the GPG signing subkey used for Firefox and Thunderbird Linux tarballs, RPM packages, and checksum files. The previous key was inadvertently committed in an unencrypted copy to a private GitHub repository. This change primarily affects users who manually verify GPG signatures or use Firefox RPM packages on older Linux distributions, who will need to import the new key and the old key's revocation.
Polish Energy Plant Cyberattack Used Novel Private APN Vector, Shutting Down Turbine
A previously undisclosed cyberattack in December 2025 targeted a small Polish combined heat and power (CHP) plant, causing a temporary shutdown of its steam turbine and water treatment system. The attack, which threatened heat supply to 50,000 residents, utilized a private Access Point Name (APN) as an attack vector, marking the first documented real-world use of this method to access industrial control systems.
UNC6671 Extortion Group Rebrands and Continues Vishing Attacks on Financial Firms
The UNC6671 extortion group has rebranded its operations under new names including Redact, Pink, Helix, and Falcon, despite an alleged retirement of its previous BlackFile brand. The group continues to use voice phishing (vishing) to target enterprise employees, particularly in financial services, private equity, and professional services, leading to data theft from cloud environments like Microsoft 365 and Okta.
Ransom Cartel Creator Sentenced to 16 Years for Ransomware-as-a-Service Operation
Maksim Silnikau, the 40-year-old Belarusian creator and administrator of the Ransom Cartel ransomware-as-a-service operation, was sentenced to 16 years in prison in Virginia. Silnikau developed the ransomware and recruited affiliates to attack at least 18 companies globally between 2021 and 2023, providing them with tools and infrastructure for intrusions and ransom negotiations.
Over 24,000 Internet-Exposed Servers Leak BMC Password Hashes via Decades-Old Flaw
More than 24,000 internet-exposed servers are leaking authentication password hashes due to CVE-2013-4786, a 20-year-old vulnerability in the Intelligent Platform Management Interface (IPMI) v2.0 specification. This flaw allows remote attackers to obtain password hashes before login and conduct offline password guessing attacks, potentially leading to full control over physical servers and broader management plane compromise.
Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
Hackers are redirecting users to fake Microsoft 365 login pages by changing DNS settings on Wi-Fi devices in hotels and conference centers. This campaign, ongoing since June, affects organizations across various sectors by potentially compromising sensitive business information.
Origin Energy Confirms Customer Data Breach Affecting Personal and Partial Banking Details
Origin Energy confirmed a data breach affecting its 4.8 million customer accounts, compromising personal details and partial banking information. This incident exposes customers to potential identity theft and phishing, highlighting ongoing cybersecurity risks for critical service providers.
Symlink Vulnerability in AI Coding Assistants Poses Security Threat
Researchers discovered that a vulnerability in six AI coding assistants allows malicious repositories to execute code on developers' machines. By exploiting symbolic link (symlink) flaws, attackers could bypass user consent and access sensitive files, raising significant security concerns.
Adobe Acrobat Integration in WhatsApp Web Exposes User Data Through Chrome Extension Vulnerability
Adobe Acrobat tools are now available within WhatsApp Web and Windows app, allowing users to handle PDFs easily. However, a critical vulnerability in the Adobe Acrobat Chrome extension, affecting 329 million users, could enable unauthorized access to WhatsApp Web chats. The flaw has been patched, ensuring data security moving forward.
Researcher Releases Windows Zero-Day Exploit 'LegacyHive' Post-Patch Tuesday
Security researcher Chaotic Eclipse released a zero-day exploit for Windows shortly after Microsoft's Patch Tuesday. The exploit, called LegacyHive, targets the Windows User Profile Service and allows privilege escalation on all supported Windows versions. This revelation underscores ongoing security challenges and may necessitate urgent updates from Microsoft.
US Charges Russians for Operating 'Bulletproof' Hosting Services Linked to $62M in Cybercrime Losses
U.S. prosecutors have unsealed charges against three Russian nationals linked to bulletproof hosting providers Media Land and ML.Cloud. The Russians allegedly supported ransomware attacks through these services, causing over $62 million in damages. A $10 million reward is offered for information leading to their arrests.
Microsoft Removes Ads from Windows 11 Search Box for Cleaner Experience
Microsoft is testing a refined Windows 11 Search Box through the Windows Insider program, featuring a decluttered interface and the removal of advertisements in web searches. These changes aim to enhance user experience by prioritizing recent searches and presenting relevant local content without promotional clutter, addressing user feedback.
Microsoft Patches Windows Defender 'RoguePlanet' Vulnerability CVE-2026-50656
Microsoft has patched the 'RoguePlanet' vulnerability (CVE-2026-50656) affecting Windows Defender on Windows 10 and 11, which allowed SYSTEM privileges escalation. The vulnerability was disclosed by researcher Nightmare Eclipse, and a month later Microsoft released the patch in Malware Protection Engine update version 1.1.26060.3008. The flaw's potential use in privilege escalation makes its resolution important for system security.
Google and FBI Disrupt NetNut Proxy Network of 2 Million Devices
Google, the FBI, Lumen, and others disrupted the NetNut residential proxy network involving over 2 million devices used for malicious activities. The operation disabled command-and-control features, protecting home devices from being exploited. This action significantly reduces cybercriminals' ability to mask their activities using residential IPs.
Russian Sandworm Hackers Target Ukrainian IT Workers with Malicious VPNs via Fake Job Offers
Russian military intelligence hackers, identified as Sandworm (UAC-0145), are posing as recruiters on Ukrainian job sites to trick IT professionals into installing malicious software. Active since at least May, the campaign aims to compromise systems by having victims download a modified VPN application during a fake recruitment process, allowing for command execution and further payload delivery.
Seven Arrested in €30M Commerzbank Fraud Exploiting Service Provider Flaw
Seven individuals have been arrested in Brazil and Europe in connection with a €30 million bank fraud that impacted Commerzbank customers in November 2023. The fraud exploited a vulnerability in a service provider's system, leading to unauthorized withdrawals, though Commerzbank states customers suffered no financial losses.
Adform Ad Platform Compromised to Steal Cryptocurrency via Malicious JavaScript
Online advertising firm Adform experienced a supply-chain attack where its JavaScript tracking script, 'trackpoint-async.js' served from 's2.adform.net', was compromised. The malicious code replaced Bitcoin, Ethereum, or TRON wallet addresses copied to users' clipboards or entered into form fields with attacker-controlled addresses, potentially redirecting cryptocurrency payments. Adform detected the incident on July 27, 2026, removed the code, and notified clients.
UK Police and Education Data Breached by ExfilSquad, Ransom Demanded
The UK's Police National Legal Database (PNLD) and Department for Education (DfE) experienced separate data breaches, with the ExfilSquad extortion group claiming responsibility. The PNLD breach exposed contact information for over 100,000 police officers and criminal justice professionals, while the DfE incident involved over 600,000 lines of data from two portals. ExfilSquad is demanding a ransom for the data.
Amazon Attributes Multiple npm Package Hijacks to North Korea's Sapphire Sleet
Amazon Threat Intelligence has attributed the September 2025 hijacks of the npm packages debug and chalk, along with the March 2026 axios compromise and an earlier typo-crypto incident, to North Korea's Sapphire Sleet group. This attribution connects previously separate incidents of crypto theft and package compromise under a single threat actor, highlighting a consistent pattern of social engineering and supply chain attacks affecting widely used JavaScript libraries.
Ernst & Young Discloses Data Breach: Client Tax Information Compromised
Ernst & Young experienced a data breach via a third-party support system, compromising clients' personal and financial data. The breach, spanning March 28 to April 12, included sensitive tax information, with notifications sent to affected clients and state regulators. The incident underscores the vulnerabilities associated with third-party IT services.
Fastjson 1.x RCE Vulnerability Actively Exploited, No Patch Available
Attackers are targeting a critical remote code execution (RCE) vulnerability in Alibaba's Fastjson 1.x library, affecting Spring Boot applications. The flaw, CVE-2026-16723, allows unauthenticated code execution and currently has no official patch from Alibaba for the 1.x branch. This impacts organizations using Fastjson 1.x in specific Spring Boot configurations, requiring immediate mitigation or migration to Fastjson2.
Apple Sued for $1.8M After Fake Crypto Wallet App Appears on App Store
Three individuals are suing Apple, alleging that a fraudulent Sparrow Wallet application downloaded from the App Store led to the theft of approximately $1.8 million in Bitcoin. The lawsuit, filed on July 24 in California, claims Apple failed to adequately review and monitor applications, despite promoting the App Store as a secure source for software.
Clop Ransomware Exploits PTC Windchill and FlexPLM Vulnerability for Data Theft
The Clop ransomware group is exploiting a critical vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM to exfiltrate data from targeted companies. This exploitation has led to extortion campaigns and prompted urgent warnings from cybersecurity agencies and authorities.
HollowGraph Malware Utilizes Microsoft 365 Calendars for C2 Communications
HollowGraph, a new malware, uses Microsoft 365 calendar events dated to 2050 for command-and-control and data exfiltration. This method disguises traffic as legitimate, targeting Israeli entities and linked to Iranian threat actors.
DOJ Seizes Over 1,000 Domains for Illegal World Cup Streaming
The U.S. Department of Justice seized and blocked over 1,000 domains during the World Cup for illegal streaming. This action aims to protect intellectual property and consumers from potential security threats associated with unauthorized streaming sites.
Critical ServiceNow Flaw Exploited Despite Patch Release
A critical remote code execution vulnerability (CVE-2026-6875) in ServiceNow's AI Platform is being actively exploited, allowing attackers to execute code remotely. Despite the July patches, attacks were observed shortly thereafter. This issue highlights the urgency for self-hosted customers to apply updates promptly to prevent system compromise.
OpenSSL HollowByte Flaw Exposes Servers to Memory Exhaustion with Minimal Payload
A vulnerability in OpenSSL, known as HollowByte, allows attackers to trigger a denial-of-service condition by sending an 11-byte payload. The flaw causes vulnerable servers to pre-allocate memory for incomplete TLS handshake messages. Fixed versions without official CVEs or advisories include OpenSSL 4.0.1 and others released on June 9. Upgrading is crucial to prevent potential server freezes.
Claude for Chrome Vulnerability Exposes User Data to Rogue Extensions
A vulnerability in Claude for Chrome allows rogue extensions to trigger sensitive tasks without user consent. Discovered by Manifold Security, the flaw enables malicious extensions to access Gmail, Google Docs, Calendar, and Salesforce, posing a significant security risk. This issue persists in version 1.0.80, with no current patch.
Zoom Patches Critical Vulnerability Allowing Account Takeovers
Zoom has patched a critical vulnerability (CVE-2026-53412) in its Windows applications, rated 9.8 on the CVSS scale, which enabled potential account takeovers. The flaw affected Zoom Workplace, Zoom VDI Client, and Zoom Meeting SDK for Windows prior to version 7.0.0. This vulnerability impacts user security and necessitates immediate updates to prevent unauthorized account access.
Progress Software Confirms Zero-Day Vulnerability in ShareFile Storage Zone Controllers
Progress Software advised ShareFile users to shut down Storage Zone Controllers due to a zero-day vulnerability. The high-severity path traversal flaw, affecting versions 5.x and 6.x, led to precautionary account access suspension and patches release. No customer data compromise has been reported.
Microsoft 365 Users Targeted in Voice Phishing Campaign for Fake Entra Passkey Enrollment
A voice phishing campaign is exploiting Microsoft 365 users to unwittingly enroll fake Entra passkeys, giving attackers unauthorized account access and facilitating potential data extortion. Initiated by the group O-UNC-066, the campaign began in April and spans multiple industries, highlighting vulnerabilities in the passkey adoption process Microsoft implemented. Okta reported the attacks, which utilize convincing phishing kits mimicking Microsoft's passkey enrollment portal.
US and Allied Nations Warn of Russian Router-Based Cyberattacks on Critical Infrastructure
US and several allied nations have issued a warning regarding Russian state-backed attempts to exploit poorly secured routers to breach critical infrastructure. The FSB's hacking groups target sectors including energy, healthcare, and communications by using known vulnerabilities and SNMP exploits. The warning underscores the need for immediate security enhancements in affected sectors.
U.S. Sanctions VPN and Malware Providers for Ransomware Support
The U.S. Treasury sanctioned First VPN Service and its administrator for aiding ransomware activities against American infrastructure. Ukrainian Dmytro Rashevskyi, associated with the VPN, and Belarusian Yegeniy Silayev, a cryptor seller, were named in the sanctions. The sanctions prevent U.S. entities from transacting with them, underscoring a broader crackdown on cybercriminal support networks.
UK and EU Sanction Russia's FSB and GRU for Cyberattacks Involving Critical Infrastructure
The UK and EU have imposed joint cyber sanctions targeting Russia's FSB and GRU following a cyberattack on Poland's energy grid that nearly caused a major blackout last winter. The coordinated sanctions, the first of their kind, address ongoing Russian-led cyber espionage campaigns against EU member states. These actions reflect growing international concerns regarding Russia's capacity to destabilize Europe’s critical infrastructure.
Critical Gitea Docker Vulnerability CVE-2026-20896 Faces Active Exploitation
Gitea Docker images are subject to a critical authentication bypass vulnerability (CVE-2026-20896) now under active exploitation. The flaw allows attackers to impersonate any user, including administrators, via reverse proxy authentication with default configurations. It affects versions before 1.26.3 and about 6,200 instances globally.
Microsoft Utilizes AI to Enhance Windows Security Updates Frequency and Efficiency
Microsoft announced the integration of AI to improve the frequency and effectiveness of Windows security updates. Using advanced AI models, Microsoft seeks to accelerate the detection of vulnerabilities in its codebase. This change aims to improve protections against increasingly AI-driven cyber threats.