DanSec

Cybersecurity Brief

Saturday 1 August 2026

In this brief Amgen, Adform, UK Department for Education, OnTrac, Adobe, Google, +5 more
Vendors
Amgen, Adform, UK Department for Education, OnTrac, Adobe, Google, Apple, CISA, Microsoft
Threat actors
CornFlake, AtlasRAT

Major Incidents or Breaches

  • Pharmaceutical company Amgen disclosed a data breach involving the theft of corporate and patient health information from multiple cloud systems operated by third-party providers [15].
  • Online advertising firm Adform suffered a supply-chain attack in which its script was compromised to deliver cryptocurrency-stealing malware to websites using its platform. The attack replaced wallet addresses copied to visitors’ clipboards [17].
  • The UK Department for Education lost 607,000 records in an incident noted among other recent breaches [30].
  • Parcel delivery company OnTrac was hacked, as reported in a roundup of recent incidents [30].

Newly Discovered Vulnerabilities

  • Adobe released security updates for Campaign Classic (ACC) to address a CVSS 10.0 vulnerability that allows arbitrary code execution without user interaction [6][30].
  • Researchers disclosed 84 vulnerabilities in 4G and 5G core networks, including flaws that could enable session hijacking and denial-of-service attacks [12].
  • A critical vulnerability named CosmosEscape was found in Azure Cosmos DB, exposing the primary key for Cosmos DB accounts and granting attackers full read and write access [35].
  • Google addressed 1,072 security bugs in recent Chrome releases, surpassing the number fixed in the prior 23 milestones combined. Among these, a 13-year-old flaw was uncovered by Google’s AI agent [11][32].

Notable Threat Actor Activity

  • A Chinese-speaking threat actor targeted Central Asian government organizations using the OctLurk and SilkLurk malware families [8].
  • Another Chinese-speaking actor used the DeepSeek AI model via the open-source Hermes Agent framework to autonomously attack exposed servers, launching attacks after receiving instructions through Telegram [14][19].
  • A spear-phishing campaign targeting a law firm deployed a previously undocumented Go-based loader called HollowFrame and a Rust-based backdoor named Matryoshka [9].
  • Hijacked hotel Wi-Fi networks were used to push fake browser updates, delivering the CornFlake remote access trojan capable of webcam, microphone, and keystroke capture [7].
  • Multiple phishing campaigns are targeting AI solution providers and impersonating major brands to steal credentials and access [28].
  • Scammers are exploiting fake Fortnite rewards and locker value sites to hijack player accounts [36].
  • A campaign is distributing AtlasRAT by disguising it as a Flash Player installer [37].
  • Threat actors are abusing unsolicited FaceTime calls to impersonate Apple Support and conduct scams [2].
  • Three sophisticated phishing kits using open-source adversary-in-the-middle (AiTM) attack frameworks were identified, capable of bypassing multi-factor authentication (MFA) [4].
  • Device code phishing, exploiting the OAuth 2.0 device authorization grant to steal access tokens, has rapidly become a large-scale threat [13].
  • Attackers are increasingly adapting malicious AI skills and leveraging AI-assisted malware, according to ESET’s latest threat report [21].
  • Cheap Android TV boxes are being shipped with apps that rewrite device identity to mimic popular brands and turn user broadband into proxies for ad fraud [10].
  • The Arch Linux project temporarily disabled adoption of AUR packages following a surge in malicious takeovers of existing packages [16].
  • Interpol is using a global system to curtail fraudulent payments by coordinating rapid response across law enforcement agencies [24].
  • The new Defcon badge features an open-source chip that doubles as a security key, advancing hardware security and transparency [27].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Cybersecurity and Infrastructure Security Agency (CISA) issued updated guidance on Software Bill of Materials (SBOM), adding new fields to improve comprehensiveness, though some concerns remain regarding practical risk management [22].
  • CISA warned of a significant increase in cyberattacks targeting internet-exposed programmable logic controllers (PLCs) in US water and wastewater utilities [20].
  • Cyberattacks on Minnesota water systems are under investigation, with officials highlighting the threat from Iranian hackers due to geopolitical motivations and a history of targeting water infrastructure [31].
  • The EU is forming a new team in Brussels to enforce the AI Act, which will require AI companies to label or watermark AI-generated content such as chatbots or imagery [33].
  • California launched the Delete Request and Opt-out Platform (DROP), enabling residents to reduce their digital footprint; other US states may adopt similar measures if successful [25].

Sources

  1. Amgen says cloud data breach exposed patient health, proprietary info - bleepingcomputer.com
  2. Online ad firm Adform’s script compromised to steal cryptocurrency - bleepingcomputer.com
  3. In Other News: OpenAI Open Source Tool, AWS Links Hacks to North Korea, Mythos Crypto Research - securityweek.com
  4. Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction - thehackernews.com
  5. Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw - thehackernews.com
  6. Critical Flaw Allowed to Azure Cosmos DB Pwnage - securityweek.com
  7. Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined - thehackernews.com
  8. Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace - securityweek.com
  9. Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk - thehackernews.com
  10. Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks - thehackernews.com
  11. Hacker uses DeepSeek AI to autonomously attack vulnerable servers - bleepingcomputer.com
  12. HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm - thehackernews.com
  13. Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware - thehackernews.com
  14. Phishing Campaigns Targeting AI Solutions Providers, (Sat, Aug 1st) - isc.sans.edu
  15. Fake Fortnite rewards are stealing players’ accounts - malwarebytes.com
  16. Fake Flash Player installs AtlasRAT - malwarebytes.com
  17. Apple Warns Users to be Wary of Unsolicited FaceTime Calls - blog.knowbe4.com
  18. New Phishing Kits Use Open-Source Tools to Bypass MFA - blog.knowbe4.com
  19. 6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026 - thehackernews.com
  20. ESET tracks rise in malicious AI skills and adaptable malware - bleepingcomputer.com
  21. Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies - thehackernews.com
  22. Arch Linux disables AUR package adoption to stop malware flood - bleepingcomputer.com
  23. Interpol Leverages Global System to Curtail Fraud Payments - darkreading.com
  24. The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key - wired.com
  25. CISA Issues Fresh SBOM Guidance. Did They Get It Right? - darkreading.com
  26. CISA warns of cyberattacks disrupting U.S. water utilities - bleepingcomputer.com
  27. Cyberattacks on Minnesota Water Systems Investigated as Officials Warn About Iranian Hackers - securityweek.com
  28. EU to Crack Down on AI Deepfakes, Illicit Imagery and Hacking With New Team in Brussels - securityweek.com
  29. DROP Platform Lets Californians Reduce Digital Footprint - darkreading.com
  30. Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations - securityweek.com