Major Incidents or Breaches

  • Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims [11].
  • Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations [18].

Newly Discovered Vulnerabilities

  • Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products [5].
  • A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts [12].
  • Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable [29].
  • Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform [35].
  • A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service [7][28].
  • Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent [9][24][30].
  • Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks [19][27].
  • Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching [16][31].
  • A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions [37].
  • The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits [23].
  • July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days [38].

Notable Threat Actor Activity

  • The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications [1][4].
  • Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware [10][14].
  • A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet [13].
  • The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users [39].

Trends, Tools, or Tactics of Interest

  • Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics [2].
  • TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities [3].
  • Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise [20].
  • Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools [32].
  • The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing [15].
  • SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows [6].

Regulatory or Policy Developments Affecting the Security Industry

  • The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level [36].
  • The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions [34].
  • The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy [22].

[1]: https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/ [2]: https://blog.knowbe4.com/social-engineering-central-ai-assisted-attacks [3]: https://thehackernews.com/2026/07/tuxbot-v3-evolution-shows-signs-of-llm.html [4]: https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html [5]: https://thehackernews.com/2026/07/firefox-chrome-adobe-and-vmware-updates.html [6]: https://thehackernews.com/2026/07/sase-has-ai-blind-spot-inspecting.html [7]: https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html [9]: https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html [10]: https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html [11]: https://www.bleepingcomputer.com/news/security/dutch-police-bust-investment-fraud-ring-stealing-over-100-million/ [12]: https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/ [13]: https://www.bleepingcomputer.com/news/security/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator/ [14]: https://www.bleepingcomputer.com/news/security/-asyncapi-npm-packages-infected-with-credential-stealing-malware/ [15]: https://www.bleepingcomputer.com/news/security/we-built-a-vulnerability-vending-machine-ai-tokens-in-zero-days-out/ [16]: https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/ [18]: https://www.darkreading.com/threat-intelligence/police-disrupt-140m-euro-cyber-fraud-ring-spain [19]: https://www.darkreading.com/cyber-risk/forgotten-bootloaders-expose-secure-boot-blind-spot [20]: https://www.darkreading.com/identity-access-management-security/identity-attacks-overtake-exploits-top-ransomware-cause [22]: https://www.darkreading.com/cybersecurity-operations/tech-xit-uk-sovereignty-push-amid-ai-strife [23]: https://www.darkreading.com/vulnerabilities-threats/claude-flaw-malicious-prompts-ai-agents [24]: https://www.darkreading.com/application-security/2-click-cursor-exploit-dev-environment-takeover [27]: https://www.securityweek.com/old-uefi-shims-expose-systems-to-secure-boot-bypass/ [28]: https://www.securityweek.com/nightmare-eclipse-drops-legacyhive-windows-zero-day/ [29]: https://www.securityweek.com/trend-micro-tanium-eset-and-tenable-patch-severe-product-vulnerabilities/ [30]: https://www.securityweek.com/unpatched-cursor-vulnerability-exposes-users-to-code-execution/ [31]: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-sharepoint-vulnerabilities/ [32]: https://www.securityweek.com/windows-bind-link-attacks-can-hide-malware-from-edr-tools/ [34]: https://www.securityweek.com/us-charges-russian-individuals-and-firms-for-running-cybercrime-services/ [35]: https://www.securityweek.com/vulnerabilities-patched-by-fortinet-ivanti-servicenow/ [36]: https://www.securityweek.com/white-house-launches-ai-driven-gold-eagle-vulnerability-coordination-initiative/ [37]: https://www.malwarebytes.com/blog/news/2026/07/claude-for-chrome-flaw-could-let-rogue-extensions-access-your-gmail [38]: https://www.malwarebytes.com/blog/bugs/2026/07/july-2026-patch-tuesday-fixes-622-microsoft-cves-including-three-zero-days [39]: https://www.malwarebytes.com/blog/threat-intel/2026/07/this-fake-apple-app-can-unlock-your-macs-password-vault

Sources#

  1. Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
  2. Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
  3. Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
  4. Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
  5. Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
  6. Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
  7. Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
  8. Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
  9. Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
  10. 2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
  11. Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
  12. Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
  13. Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
  14. CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
  15. CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
  16. Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
  17. Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
  18. July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
  19. OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
  20. OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
  21. Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
  22. AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
  23. Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
  24. This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
  25. Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
  26. TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
  27. Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
  28. Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
  29. We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
  30. SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
  31. White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
  32. US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
  33. Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com