Cybersecurity Brief – 2026-07-24

Fri, 24 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Origin Energy, an Australian energy provider, confirmed a data breach in which an unauthorized party accessed and leaked customer data online, exposing sensitive personally identifiable information^[15]^[31].
Upbound Group disclosed a data breach resulting in the theft of non-sensitive customer information and documents, leading to $13 million in fraudulent contract losses^[37].
Chick-fil-A experienced a credential stuffing attack in which threat actors used credentials obtained from other companies to compromise Chick-fil-A One accounts^[34].

Newly Discovered Vulnerabilities

A nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges^[22].
A zero-day vulnerability in Check Point products, tracked as CVE-2026-16232, has been exploited in the wild against customers with specific configurations^[39].
A sandbox escape vulnerability was identified in Anthropic’s Claude Cowork, allowing AI agents to break out of a Linux virtual machine and access Mac files^[7].
HermeticReader, a now-patched flaw in Adobe’s Acrobat Chrome extension, could have allowed attackers to spy on WhatsApp Web chats^[41].
A hidden flaw in a dealer-installed car alarm system was discovered, potentially allowing attackers to unlock vehicles and track their locations without owners’ knowledge^[40].

Notable Threat Actor Activity

A Russian state-supported espionage group, known as Laundry Bear or Void Blizzard, exploited a zero-day flaw in Zimbra’s webmail client to steal email and two-factor authentication codes from Western organizations. The group used “half-click” phishing emails requiring only message preview to compromise targets^[5]^[17]^[26].
CERT-UA reported a campaign by threat actors distributing a fake Notepad++ plugin containing malware (MATCHBOIL.V2) to compromise Windows systems. The malware was delivered via an archive with the legitimate Notepad++ application and a malicious utility named LunchPoke^[4]^[18].
The Clop ransomware gang is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign^[13].
The Chaos ransomware group is deploying a Rust-based implant called msaRAT, which routes command-and-control traffic through the victim’s own Chrome or Edge browsers^[8]^[23].
A China-nexus threat cluster tracked as JadeProx is using a new TriBack loader in attacks targeting government, healthcare, and education organizations across Asia and Latin America^[9].
Attackers are weaponizing GitHub Actions runners by turning compromised repositories into distributed attack infrastructure to target cPanel and WebHost Manager (WHM) servers^[11].
A malvertising campaign is promoting a fake Claude desktop app via Bing ads, delivering SectopRAT malware through a legitimate Claude.ai domain^[16].

Trends, Tools, or Tactics of Interest

Two new phishing toolkits, including “Jalisco,” are being tracked for their capability to bypass multifactor authentication (MFA) via device code phishing^[2].
Ransomware delivery tactics continue to evolve, with phishing emails now often serving as initial access vectors rather than direct payload delivery, enabling stealthier and more targeted attacks^[3].
The new Dolphin X remote access trojan uses an AI-powered profiling feature to score and rank infected users, enabling cybercriminals to prioritize high-value targets^[14].
Synthetic identity fraud is increasingly being used to target machine identities, making detection more challenging compared to traditional identity theft^[10].
AI security guardrails and protections are inconsistent across different languages, exposing gaps in multilingual environments, particularly in the EU^[25].
Nuclear-sabotage malware benchmarks show that most frontier AI models struggle to sustain a malware investigation^[36].
New developments in security operations center (SOC) automation, threat intelligence enrichment, and AI-native investigation are being highlighted as means to address sophisticated email threats and improve administrative workflows^[1].
The adoption of agentic AI presents new challenges for confidential computing, even as technical barriers to secure data vaults are being addressed^[27].

Regulatory or Policy Developments Affecting the Security Industry

The European Commission fined Google €890 million ($1 billion) for violating the Digital Markets Act (DMA) concerning search and app store antitrust violations^[21].
The FedRAMP 20X transition replaces point-in-time assessments with continuous, machine-readable evidence to demonstrate that security controls are operational, impacting compliance requirements for cloud service providers^[20].

Sources

Australian energy provider Origin says data breach exposes client data - bleepingcomputer.com
Data Breach Confirmed After Australian Energy Giant Origin Is Hacked - securityweek.com
Upbound Group Says Data Breach Led to $13 Million in Fraudulent Contract Losses - securityweek.com
Chick-fil-A Accounts Get Fried in Credential Stuffing Attack - securityweek.com
New RefluXFS Linux flaw lets attackers gain root privileges - bleepingcomputer.com
New Check Point Zero-Day Vulnerability Exploited in the Wild - securityweek.com
Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files - thehackernews.com
WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw - malwarebytes.com
Millions of cars could be tracked and unlocked by a hidden security flaw - malwarebytes.com
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes - thehackernews.com
Russian hackers exploit Zimbra zero-click flaw for email theft - bleepingcomputer.com
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets - darkreading.com
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks - thehackernews.com
Hackers abuse Notepad++ plugins to stealthily install malware - bleepingcomputer.com
Clop ransomware targets Windchill, FlexPLM in data theft attacks - bleepingcomputer.com
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge - thehackernews.com
New msaRAT malware uses Chrome, Edge browsers to route C2 traffic - bleepingcomputer.com
China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks - thehackernews.com
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers - thehackernews.com
Fake Claude app promoted by Bing ads pushes SectopRAT malware - bleepingcomputer.com
New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication - blog.knowbe4.com
From Inbox to Encryption: How Ransomware Delivery Has Evolved - blog.knowbe4.com
New Dolphin X malware uses AI to rank high-value targets - bleepingcomputer.com
How Synthetic Identity Fraud is Coming for Machine Identities - thehackernews.com
Europe's Multilingual Reality Exposes AI Security Gaps - darkreading.com
Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models - securityweek.com
Elevating the SOC Experience: Smarter Automation, Richer Threat Intelligence, and AI-Native Investigation - blog.knowbe4.com
Agentic AI Challenges Progress in Confidential Computing - darkreading.com
EU fines Google $1 billion for search, app store antitrust violations - bleepingcomputer.com
FedRAMP Rev5 Is Ending: What the 20x Transition Really Requires - bleepingcomputer.com

JadeProx on DanSec Daily

Cybersecurity Brief – 2026-07-24

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources