Cybersecurity Brief – 2026-07-26

Major Incidents or Breaches

Steam discussion forums are being abused in ClickFix attacks that lure users with fake fixes for gaming and computer problems, resulting in victims being infected with XMRig cryptominers ^[7].
Threat actors are sending sextortion emails demanding $2,000 in Bitcoin by leveraging email addresses exposed in data breaches leaked by the ShinyHunters extortion group ^[9].

Attackers are actively targeting a critical remote code execution vulnerability in Fastjson 1.x, a widely used Java JSON library, for which no patch is available. Exploitation can allow malicious JSON requests to execute code in affected Spring Boot applications ^[2].
A working proof-of-concept exploit for a GitLab vulnerability allowing authenticated users to execute commands as the git user on self-managed 18.11.3 servers and earlier has been published. The flaw was patched by GitLab six weeks prior ^[3].
Rockwell Automation has patched code execution vulnerabilities in its Arena Simulation Software that could be exploited by attackers to target industrial environments ^[12].

Affiliates of the Cl0p ransomware group are exploiting unauthenticated remote code execution flaws in internet-exposed PTC Windchill and FlexPLM deployments as part of ongoing ransomware campaigns ^[5].
Russian hackers are attempting to steal emails belonging to US nuclear scientists ^[11].

The SourTrade malvertising campaign is distributing malware in fragmented pieces, leveraging malicious JavaScript to have victims’ browsers assemble the final Windows executable in memory using the legitimate Bun runtime. This approach avoids delivering a complete malicious file directly ^[1]^[8].
The DevMan ransomware-as-a-service portal offers affiliates a centralized web platform for building payloads, managing victim data, and handling affiliate payouts, indicating increased professionalization and streamlining of ransomware operations ^[6].
Insurance phishing campaigns are evolving from credential harvesting to real-time account hijacking, reflecting a shift in tactics to more immediate exploitation of compromised accounts ^[4].
Malicious actors are increasingly using JavaScript on fake financial and trading websites to assemble malware entirely in browser memory, reducing reliance on traditional file-based payload delivery ^[8].

The US State Department has implemented a ban on known scammers from entering the United States ^[11].