Major Incidents or Breaches

  • Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users [12][20].
  • A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer [4].
  • Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals [5].
  • The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations [8][17].
  • Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash [6].

Newly Discovered Vulnerabilities

  • A critical remote code execution vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to deploy reverse SSH tools, providing attackers persistence and remote access. The vulnerability is the subject of a global threat campaign, and patching alone may not fully mitigate the threat [11][16][29].
  • An unpatched SQL injection vulnerability in GeoServer is being exploited in the wild, allowing attackers to achieve remote code execution [21].
  • WordPress 7.0.4 patched a remote code execution vulnerability that could be exploited by users with Author-level or higher permissions via malicious Postscript files [25].
  • Adobe Commerce released a patch for CVE-2026-71362, a vulnerability that saw exploitation attempts immediately after disclosure [24].
  • Fortinet released patches for authentication flaws in FortiWeb and FortiManager that could allow attackers to log in with arbitrary credentials or impersonate FortiGate appliances [27].
  • Microsoft patched the LegacyHive Windows zero-day vulnerability, which was disclosed after the July 2026 Patch Tuesday [9].

Notable Threat Actor Activity

  • The Iran-linked APT42 group is conducting AI-assisted spear phishing campaigns targeting US organizations, leveraging artificial intelligence to enhance the effectiveness of their attacks [3].
  • Akira ransomware affiliates have been observed disabling endpoint detection and response (EDR) by rebooting compromised systems into Safe Mode with Networking, enabling data theft even when encryption fails [7].
  • Initial access brokers are using vishing (voice phishing) attacks through Microsoft Teams to gain entry for ransomware gangs [2].
  • The Jewelbug group is simultaneously engaged in state espionage and financially motivated cybercrime, including cryptocurrency theft [8][17].

Trends, Tools, or Tactics of Interest

  • The rise of “Shadow AI” is being identified as a new dimension of Shadow IT, with employees using unapproved AI tools and services in the workplace, increasing organizational risk [1].
  • AI coding tools are introducing unvetted or hallucinated open source dependencies at a pace that exceeds current security review capabilities, raising supply chain risks [13].
  • Multiple “AI watermark remover” tools have appeared online following the introduction of watermarking in Anthropic’s Claude model, though most cannot reliably remove watermarks, highlighting rapid attempts to circumvent AI content authenticity measures [10].
  • AmnesiaStealer, a Rust-based macOS infostealer, is capable of harvesting passwords, keychain data, browser information, and cookies, expanding the threat landscape for macOS users [22].
  • New Android malware combines social engineering, a remote access trojan, and NFC relay capabilities to enable real-time fraudulent use of victims’ bank cards [31].
  • WhatsApp has rolled out a “Scam Alert” feature using a local machine learning model to flag potential scam messages for users [15].

Regulatory or Policy Developments Affecting the Security Industry

  • The White House issued a memo instructing the National Coordination Center to establish a program allowing private security companies to apply for approval to conduct offensive hack-back operations against foreign cybercrime gangs. Contracts may require a $1 million bond to ensure compliance with operational requirements [14][28].
  • Over 3,000 lawsuits have been filed by parents against Meta, TikTok, Google, and Snap, challenging the design of social media platforms and their impact on youth safety [32].

Sources#

  1. Trezor discloses data breach affecting nearly 14,000 customers - bleepingcomputer.com
  2. 14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
  3. Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
  4. Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - bleepingcomputer.com
  5. Hackers breach govt webmail while running parallel crypto fraud - bleepingcomputer.com
  6. 'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading.com
  7. Ukraine shuts down 94 fraudulent call centers, seize millions in cash - bleepingcomputer.com
  8. Critical VMware vCenter RCE flaw exploited for reverse SSH access - bleepingcomputer.com
  9. Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading.com
  10. Critical VMware vCenter Vulnerability in Attackers’ Crosshairs - securityweek.com
  11. Hackers Exploiting Unpatched GeoServer Zero-Day - securityweek.com
  12. WordPress 7.0.4 Patches Remote Code Execution Vulnerability - securityweek.com
  13. Adobe Commerce Bug Targeted Immediately After Disclosure - securityweek.com
  14. Fortinet Patches Authentication Flaws in FortiWeb and FortiManager - securityweek.com
  15. Microsoft patches LegacyHive Windows zero-day vulnerability - bleepingcomputer.com
  16. Iranian APT Launches AI-Assisted Spear Phishing Attacks - blog.knowbe4.com
  17. Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - bleepingcomputer.com
  18. Warning: Vishing Attacks Open the Door to Ransomware Gangs - blog.knowbe4.com
  19. Shadow AI: The New Frontier of Shadow IT - blog.knowbe4.com
  20. Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion - bleepingcomputer.com
  21. AI 'watermark removers' flood the web. Almost none can prove they work. - bleepingcomputer.com
  22. AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions - securityweek.com
  23. New Android malware lets criminals use your bank card in real time - malwarebytes.com
  24. WhatsApp rolls out new feature that flags potential scam messages - bleepingcomputer.com
  25. White House taps security firms for offensive hack-back operations - bleepingcomputer.com
  26. White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - securityweek.com
  27. Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits - malwarebytes.com