From BleepingComputer · 40 stories
12 Million Affected in KDDI Data Breach, Exploiting Zero-Day Vulnerability
KDDI, a major Japanese telecom provider, confirmed a breach affecting 12.2 million email addresses and 7.6 million passwords via a compromised email system used by five ISPs. The breach exploited a zero-day vulnerability in third-party software. KDDI has implemented security measures and coordinated password resets to prevent future incidents.
DuckDuckGo Browser Now Blocks YouTube Video Ads Using Community Filters
DuckDuckGo has released a feature that blocks video ads, including those on YouTube, on its browser. This feature, based on community-maintained filter lists and additional rules for compatibility, is enabled by default on iOS, Windows, and Mac, with Android support to follow. Users can enjoy ad-free video playback while maintaining privacy, but may experience longer buffering times.
Chinese APT UAT-7810 Develops New Malware to Expand ORB Network
Chinese APT group UAT-7810 has advanced its Operational Relay Box (ORB) network with new malware, including LONGLEASH, DOGLEASH, and JARLEASH. These tools exploit known router vulnerabilities to enhance the group's cyber espionage capabilities, posing potential risks to critical infrastructure.
Medtronic Hack Exposes Data of Nearly 4 Million People in ShinyHunters Breach
Medtronic suffered a data breach in April 2026, compromising the personal and medical information of over 3.8 million individuals, with some sources claiming 9 million records affected. The ShinyHunters group accessed Medtronic's corporate IT systems, despite the company's reassurance about device safety. Medtronic is offering credit monitoring and support services to those impacted, highlighting security vulnerabilities in healthcare technology.
FortiBleed Campaign Compromises Fortinet Devices, Linked to Ransomware Groups
The FortiBleed campaign has been connected to the INC and Lynx ransomware groups, compromising credentials from Fortinet devices. Researchers found the operation entailed scanning 11,250 FortiGate portals and compromised 354 targets, leading to 12 ransomware deployments. The breach highlights significant cybersecurity risks, affecting organizations globally.
AI Technology Reduces Vulnerability Exploitation Time, Increasing Security Concerns
The rapid increase in newly reported vulnerabilities, and the use of AI in exploit development, has significantly reduced the time it takes for cyber threats to be operationalised. This has created a larger 'exposure window' between vulnerability discovery and remediation, placing pressure on security teams. With CVEs published at an unprecedented rate, prompt response times are becoming crucial to mitigate potential breaches.
CISA Warns of Active Exploitation of Critical Progress Kemp LoadMaster Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that a critical command injection vulnerability (CVE-2026-8037) in Progress Kemp LoadMaster is being actively exploited by attackers. This flaw allows unauthenticated attackers to execute arbitrary commands on affected LoadMaster appliances, which are widely used by tech companies and government entities for traffic distribution and application performance.
RingCentral Data Breach Impacts 1.6 Million Accounts After Social Engineering Attack
RingCentral experienced a data breach in July, affecting 1.6 million individuals, following a "sophisticated social engineering campaign." The ShinyHunters extortion group claimed responsibility and leaked data after RingCentral did not meet their demands, leading to the information being added to HaveIBeenPwned.
Microsoft 365 services experience widespread outage in North America
Microsoft 365 services, including Teams, SharePoint, and OneDrive, are experiencing a significant outage primarily affecting users in North America. The disruption began at 10:44 AM ET on July 23, leading to degraded functionality and access issues across multiple platforms, prompting Microsoft to advise customers to review business continuity plans.
CISA Issues Guidance on Zero Trust for Critical Infrastructure Security
CISA has released new guidance emphasizing the implementation of Zero Trust principles in critical infrastructure security. This guidance aims to mitigate threats from state-sponsored actors exploiting identity vulnerabilities, especially in operational technology environments.
Ostium platform suffers $23.7M theft in off-chain attack
Ostium trading platform experienced a $23.75 million theft due to price manipulation via compromised off-chain infrastructure. The incident has halted trading operations as the platform works on security measures and assessing impacts for liquidity providers.
Four AI coding agents affected by sandbox escape vulnerabilities
Security researchers have demonstrated sandbox escape vulnerabilities in Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. These vulnerabilities exploit file interactions that allow the sandboxed agents to trigger commands outside their protected environment, highlighting significant security shortcomings in AI coding tools.
Hackers Target Russian Government Agencies via ViPNet Software Abuse
A threat actor is exploiting ViPNet's update mechanism to deploy malware against Russian organizations, including government agencies. The campaign, named HelloNet, impacts multiple sectors and reflects ongoing vulnerabilities in widely used security products.
U.S. charges Chen and Zhang for laundering $43 million from investment scams
U.S. prosecutors charged Zhuoying Chen and Haojie Zhang with laundering $43 million from cyber investment fraud. The defendants allegedly managed a network that facilitated the transfer of fraud proceeds to China, impacting numerous victims.
Spirals ransomware encrypts networks within 24 hours after initial compromise
A new ransomware group, Spirals, compromised an IT services firm in South Asia and completed data theft and encryption in under 24 hours. The rapid expansion of ransomware capabilities poses significant threats to corporate network security.
Spanish Police Dismantle €140 Million Cyber Fraud Network, Four Arrested
Spanish Police have dismantled a cybercrime organization involved in €140 million of investment fraud and business email compromise (BEC), arresting four individuals. This operation highlights a sophisticated scheme utilizing over 800 bank accounts and numerous accomplices to launder significant amounts of illicit funds.
Microsoft Entra ID adopts passkeys as default authentication by September 2026
Starting September 2026, Microsoft Entra ID will replace SMS and voice authentication with passkeys as the default method. This transition aims to enhance security against credential theft and phishing attacks, as SMS and voice authentication will be retired in February 2027.
UK charges five in connection with Russian Coms spoofing platform
UK authorities have charged five individuals linked to the Russian Coms caller ID spoofing platform, which facilitated over 1.8 million scam calls. This platform, operational since 2020, enabled criminals to impersonate financial institutions and law enforcement, leading to significant financial losses for victims worldwide.
RedHook Android malware exploits Wireless ADB for elevated privileges
The RedHook Android malware now leverages Wireless ADB to gain shell access without USB connections. This enhancement increases its capability, allowing for sophisticated attacks including credential theft and remote control of devices.
Australia warns of global CMS-targeting campaign exploiting vulnerabilities
The Australian Cyber Security Centre alerted about a global exploitation campaign affecting vulnerable CMS platforms, including WordPress and Joomla. Affected sites have had webshells deployed, allowing attackers persistent access to steal data and compromise services, highlighting the urgent need for security updates.
New Helix vishing group targets SharePoint for data theft
A new cybercriminal group named Helix is using vishing and MFA abuse to steal data from SharePoint environments. The group impersonates employees to trick victims into giving up sensitive information, leading to data extortion practices similar to those of previous groups like ShinyHunters and BlackFile.
Global anti-fraud operation leads to 5,800 arrests and $293M seized
Law enforcement agencies arrested 5,811 suspects and seized $293 million in a worldwide anti-fraud initiative named "Operation First Light 2026." This operation targeted various forms of social engineering fraud and money laundering, and revealed over 142,000 victims across 97 countries.
Malicious SDKs on npm and PyPI Target Paysafe, Skrill, and Neteller Users
At least 17 malicious packages on npm and PyPI masqueraded as legitimate Paysafe, Skrill, and Neteller SDKs, deploying credential-stealing malware. This attack could compromise sensitive user data, impacting developers and businesses relying on these payment services.
Phishing Campaign Impersonates Major Brands to Steal Google Credentials
A phishing campaign is impersonating over 30 prominent brands, including Adobe and Netflix, targeting marketing professionals to steal Google account credentials. By using legitimate HR platforms and real recruiter names, the threat actor enhances the phishing attempt's credibility, making it a significant security threat.
EtherRAT malware spreads via fake IT support calls on Microsoft Teams
Threat actors are using Microsoft Teams to impersonate IT support and deliver EtherRAT malware to corporate networks. This strategy combines phishing emails and remote access tools to compromise systems and gain control.
Trezor Customers Affected by Data Breach at Shipping Partner ShipMonk
Hardware wallet manufacturer Trezor disclosed a data breach impacting nearly 14,000 customers after its shipping provider, ShipMonk, experienced unauthorized access to its systems. The incident exposed customer order data, including names, addresses, emails, and phone numbers, for orders placed between May 10 and August 8, 2026. Trezor's own systems were not compromised, but the breach raises concerns about potential phishing attempts targeting affected users.
AI Watermark Removal Tools Emerge, Efficacy Unverified Against Text Watermarks
A market for tools claiming to remove AI watermarks has appeared following Anthropic's announcement of invisible watermarks in Claude's output. However, the efficacy of these tools against text watermarks cannot be verified because Anthropic has not released details on its watermarking method or a corresponding detector. This development highlights the ongoing challenge of verifying AI-generated content and the rapid response from developers to new AI features.
City-Forum Campaign Targets Salesforce and ServiceNow Guest Users with Custom Tools
A campaign named 'City-Forum' is exploiting guest user access in Salesforce Experience Cloud (Aura and LWR implementations) and ServiceNow customer portals to steal data. The attacks use a custom multi-platform toolset and target telecommunications, banking, financial services, enterprise software vendors, and public-sector portals globally.
Hundreds of Fake Chrome VPN Extensions Route User Traffic Through Proxies
Security researchers identified 737 Chrome VPN extensions that routed user browser traffic through a single SOCKS5 proxy infrastructure. These extensions, downloaded nearly 75,000 times and primarily targeting Russian-speaking users, impersonated legitimate VPN brands, allowing an adversary-in-the-middle to observe browsing activity and data.
Researchers demonstrate 'Plug And Pwn' attack for Windows SYSTEM access via USB auto-install
Security researchers Alejandro Hernando and Borja Martinez have unveiled "Plug And Pwn" attacks that exploit the Windows Plug and Play (PnP) feature to achieve SYSTEM-level code execution. This method abuses the automatic installation of vendor software for emulated USB devices, allowing an unprivileged user to gain high-level access on Windows 11 machines. The attack can be triggered physically or remotely under specific conditions.
Cloudflare Reports 519% Surge in 1 Tbps DDoS Attacks in Q2 2026
Cloudflare's H1 2026 DDoS Threat Report indicates a 519% quarter-over-quarter increase in network-layer DDoS attacks exceeding 1 Tbps between Q1 and Q2 2026. The report, based on data from Cloudflare's network, highlights a shift in attack vectors, with DNS-based attacks becoming the primary method, and notes the influence of geopolitical events on the threat landscape.
BdThemes WordPress Plugins Removed After Supply Chain Attack Creates Rogue Admins
A supply chain attack on BdThemes, a WordPress plugin vendor, led to the compromise of their infrastructure and the modification of a remote JSON feed. This allowed attackers to create rogue administrator accounts on WordPress sites using affected plugins, prompting WordPress.org to remove all BdThemes products, impacting over 350,000 active installations.
UK Man Sentenced for Blackmail and Sextortion of 117 Victims as Part of 'The Com'
Justin Swaddle, a 20-year-old from Leeds, was sentenced to two years in prison for blackmail and sextortion offenses against 117 victims aged 13 to 17. Operating under aliases like 'Epstein' and 'Moscow' on platforms including Snapchat, Telegram, and Discord, Swaddle was a member of 'The Com,' an online collective whose members coerce victims into self-harm and sexual activity for peer status.
Head Mare Exploits TrueConf Server Flaws to Distribute Backdoored Client Installers
The hacktivist group Head Mare exploited vulnerabilities in unpatched TrueConf video conferencing servers to replace legitimate client installers with malicious versions containing PhantomCore and PhantomGraph backdoors. These attacks, discovered by Kaspersky in July, targeted Russian organizations across various sectors, allowing attackers to gain persistent remote access and exfiltrate data.
North Carolina Ports Hit by Cyberattack, Forcing Manual Operations
North Carolina Ports experienced a cyberattack that disrupted IT systems and forced a shift to manual operations across its three locations: Wilmington, Morehead City, and Charlotte. The incident, detected on August 4, led to system-wide outages and delays, though operations are gradually returning to normal with manual processing still in effect. This event highlights the ongoing vulnerability of critical infrastructure to cyber threats.
New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
Researchers have discovered a new attack, named Interrupt Injection or TONTOU, that bypasses existing Spectre v2 mitigations on Intel and AMD CPUs. This vulnerability allows an unprivileged local attacker to leak kernel memory, such as Linux password hashes, by exploiting a timing window during branch predictor neutralization. AMD has released a kernel patch for Linux, while Intel states no mitigation is necessary.
77 Malicious "Evil Twin" Extensions Removed from Open VSX Marketplace
Manifold Security discovered 77 malicious "evil twin" extensions on the Open VSX marketplace between July 26 and August 1, 2026. These extensions mimicked legitimate developer tools and exfiltrated system and development environment information, leading to their removal from Open VSX on August 3, 2026.
Greatness PhaaS Adds Device Code Phishing, Targets Microsoft 365 Accounts
The Greatness phishing-as-a-service (PhaaS) toolkit now supports device code phishing, exploiting the OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and compromise user accounts. This update allows attackers to steal MFA-approved authentication tokens and maintain access to compromised accounts, posing a greater threat to online security. The platform is sold for $289 per month and targets platforms including Microsoft 365, iCloud, Yahoo, and Google Workspace.
Amgen Discloses Data Breach Affecting Patient Health and Proprietary Information
Biotechnology company Amgen reported a data breach where threat actors stole corporate data and patient information from third-party cloud systems. The unauthorized activity was detected in July 2026, leading to an ongoing investigation into the scope of the exfiltrated data, which includes proprietary information and protected health information.
ShinyHunters Leaks Brinks Home Data After Breach Affecting 4.9 Million Records
Brinks Home, a residential security company, experienced a data breach identified on July 20, with the ShinyHunters extortion group claiming responsibility. ShinyHunters has leaked over 41 gigabytes of data, including 4.9 million Salesforce records with personally identifiable information (PII), after Brinks Home did not pay a ransom. The breach did not affect alarm monitoring or system functionality.