CrashStealer on DanSec Daily

Cybersecurity Brief – 2026-07-16

Thu, 16 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims ^[11].
Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations ^[18].

Newly Discovered Vulnerabilities

Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products ^[5].
A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts ^[12].
Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable ^[29].
Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform ^[35].
A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service ^[7]^[28].
Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent ^[9]^[24]^[30].
Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks ^[19]^[27].
Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching ^[16]^[31].
A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions ^[37].
The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits ^[23].
July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days ^[38].

Notable Threat Actor Activity

The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications ^[1]^[4].
Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware ^[10]^[14].
A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet ^[13].
The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users ^[39].

Trends, Tools, or Tactics of Interest

Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics ^[2].
TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities ^[3].
Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise ^[20].
Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools ^[32].
The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing ^[15].
SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows ^[6].

Regulatory or Policy Developments Affecting the Security Industry

The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level ^[36].
The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions ^[34].
The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy ^[22].

Sources

Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com

Cybersecurity Brief – 2026-07-14

Tue, 14 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft attributed a year-long series of intrusions into corporate Salesforce environments to threat actors linked to the ShinyHunters data-extortion group, who gained access without exploiting technical vulnerabilities in the Salesforce platform ^[3].
Japan’s largest taxi operator, Nihon Kotsu, shut down parts of its infrastructure following a cyberattack that compromised its systems ^[12].
Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands, resulting from a compromise at a third-party service provider ^[16].
The Jscrambler npm package was backdoored with infostealer malware and downloaded nearly 1,500 times before being taken down ^[13].
Google and Microsoft removed the ModHeader browser extension, used by 1.6 million users, after researchers discovered a hidden component collecting browsing history ^[5].
The Cybersecurity and Infrastructure Security Agency (CISA) published details of a data leak caused by a contractor uploading internal credentials, including AWS Govcloud keys, to GitHub ^[26].
Progress Software instructed customers to shut down ShareFile Storage Zone Controllers due to a credible security threat under investigation ^[35].

Newly Discovered Vulnerabilities

Critical remote code execution vulnerabilities in the iCagenda and Balbooa Forms Joomla extensions are being actively exploited by threat actors ^[15]^[34].
Zimbra patched a critical code execution vulnerability that allowed malicious code embedded in crafted emails to execute when the emails were opened ^[32].
A vulnerability in RabbitMQ enables unauthenticated attackers to obtain the broker’s OAuth client secret, potentially allowing full control over the broker ^[31].

Notable Threat Actor Activity

Russian state-backed hackers were jointly sanctioned by the EU and UK for coordinating cyberattacks and disinformation campaigns across Europe, with specific targeting of critical infrastructure and government entities ^[19]^[21]^[33].
US and allied cybersecurity agencies warned that Russian state actors are targeting vulnerable and misconfigured routers to gain access to critical infrastructure networks ^[20].
A new phishing-as-a-service operation, Forg365, is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle session theft, antibot evasion, and AI-assisted phishing page generation ^[8].
An unknown threat actor used an AI-generated PowerShell script to enumerate Active Directory environments during an intrusion ^[11].
The GigaWiper modular implant was identified, combining backdoor and wiper functionalities, allowing threat actors to select their preferred destructive attack method ^[23].
A new macOS infostealer, CrashStealer, poses as Apple’s crash reporting tool to harvest credentials, keychain data, and cryptocurrency wallets, using a notarized dropper to bypass Gatekeeper ^[4]^[14].

Trends, Tools, or Tactics of Interest

AI tools are increasingly used by threat actors to automate social engineering, phishing, and attack flows, making attacks more efficient and scalable ^[1]^[6]^[8]^[36].
The MemGhost attack demonstrates how a single malicious email can implant persistent false memories in AI agents with inbox access, affecting their operational decision-making ^[7].
Proof-of-concept “Ghostcommit” attack shows how malicious prompt injections can be hidden inside image files, potentially compromising AI systems during code reviews ^[39].
Open source tool “ScamBuster” leverages AI-driven victim personas to engage with email scammers, enabling data collection on phishing operations for organizations and law enforcement ^[24].
Organizations are forming “Yellow Teams” to both attack and defend AI systems, developing tools to test AI’s potential in cybersecurity from both perspectives ^[22].
The security industry is seeing a trend towards combining autonomous AI with analyst copilots in security operations centers to enhance detection and response ^[10].
Fake cryptocurrency gift card sites are becoming increasingly sophisticated and harder to distinguish from legitimate sites ^[40].

Regulatory or Policy Developments Affecting the Security Industry

The Pentagon suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program to conduct a comprehensive review and reform of contractor cybersecurity requirements ^[28].
The EU and UK jointly issued their first coordinated cyber sanctions package, targeting Russian individuals and entities for cyberattacks and disinformation campaigns ^[19]^[21]^[33].

Sources

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths - thehackernews.com
Japan's largest taxi operator shuts systems after cyberattack - bleepingcomputer.com
Lidl discloses online shop breach after service provider hack - bleepingcomputer.com
Hackers backdoor Jscrambler npm package with infostealer malware - bleepingcomputer.com
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found - thehackernews.com
Lessons Learned from CISA’s Recent GitHub Leak - krebsonsecurity.com
Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns - securityweek.com
CISA warns of actively exploited RCE flaws in Joomla extensions - bleepingcomputer.com
Organizations Warned of Exploited Joomla Extension Vulnerabilities - securityweek.com
Zimbra Patches Critical Code Execution Vulnerability - securityweek.com
RabbitMQ Vulnerability Threatens Enterprise Systems - securityweek.com
EU sanctions Russian GRU military hackers over cyberattacks - bleepingcomputer.com
Weak Security Continues to Fuel Russian Cyberattacks - darkreading.com
EU Targets Russian Intelligence Officers Accused of Running a Yearslong Cyber Spying Campaign - securityweek.com
US and allies warn of Russian critical infrastructure attacks - bleepingcomputer.com
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft - thehackernews.com
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory - thehackernews.com
GigaWiper Lets Threat Actors Choose Their Own Destructive Attack - darkreading.com
CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks - thehackernews.com
New CrashStealer malware poses as Apple crash reporting tool - bleepingcomputer.com
Report: Attackers Are Using AI to Automate Social Engineering - blog.knowbe4.com
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More - thehackernews.com
AI Security Report 2026 - research.checkpoint.com
New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email - thehackernews.com
Ghostcommit attack hides malicious AI instructions in images - malwarebytes.com
Turning the Tables on Email Scammers With 'ScamBuster' - darkreading.com
'Yellow Teams' Are Defining the Future of AI Security - darkreading.com
Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots - thehackernews.com
Fake crypto gift card sites are getting harder to spot - malwarebytes.com
Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules - securityweek.com