Cybersecurity Brief – 2026-07-16

Thu, 16 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims ^[11].
Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations ^[18].

Newly Discovered Vulnerabilities

Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products ^[5].
A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts ^[12].
Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable ^[29].
Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform ^[35].
A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service ^[7]^[28].
Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent ^[9]^[24]^[30].
Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks ^[19]^[27].
Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching ^[16]^[31].
A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions ^[37].
The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits ^[23].
July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days ^[38].

Notable Threat Actor Activity

The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications ^[1]^[4].
Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware ^[10]^[14].
A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet ^[13].
The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users ^[39].

Trends, Tools, or Tactics of Interest

Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics ^[2].
TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities ^[3].
Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise ^[20].
Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools ^[32].
The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing ^[15].
SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows ^[6].

Regulatory or Policy Developments Affecting the Security Industry

The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level ^[36].
The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions ^[34].
The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy ^[22].

Sources

Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com

OkoBot on DanSec Daily

Cybersecurity Brief – 2026-07-16

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources