AssuranceAmerica on DanSec Daily

Cybersecurity Brief – 2026-07-11

Sat, 11 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Progress Software has instructed ShareFile customers to immediately shut down Windows Storage Zone Controllers due to a “credible external security threat” targeting these servers. The company is actively responding to the incident and has communicated directly with affected customers ^[5]^[20].
Researchers uncovered that a cybercrime group left one of its servers exposed, revealing details about the WP-SHELLSTORM campaign, which has backdoored thousands of WordPress sites. The exposure included hacking tools, logs, and target lists ^[13].
The Dutch National Police reported strong indications that Dutch hackers were involved in the February breach at telecommunications provider Odido ^[19].
A data breach at AssuranceAmerica has affected 7 million individuals, as disclosed in a roundup of recent incidents ^[33].
The US Department of Homeland Security (DHS) database was reportedly hacked, according to recent reports ^[33].

Newly Discovered Vulnerabilities

Zimbra has issued an urgent advisory to patch a critical vulnerability in its Classic Web Client that could allow attackers to execute arbitrary code via crafted emails. The flaw is actively being addressed and users are urged to update ^[4]^[24].
Six new vulnerabilities have been identified in the U-Boot bootloader, used across a wide range of hardware, which could allow malicious images to crash devices or execute code at boot, enabling stealthy firmware attacks ^[7]^[17].
A critical authentication bypass vulnerability is being actively exploited in the official Docker image for the Gitea self-hosted Git service. Attackers can impersonate any user, including administrators ^[21].
A flaw in Alibaba’s XQUIC (XRING) QUIC and HTTP/3 library allows any remote client to crash the server with legal traffic. There is currently no patch available ^[11].
A newly disclosed flaw called “Ill Bloom” in certain cryptocurrency wallet software’s recovery phrase generation has been exploited to drain over $5 million from wallets ^[16].
Researchers have demonstrated that a laser attack can reset passwords on Tangem wallet cards by targeting the chip, and affected cards cannot be patched ^[8].
Three now-patched vulnerabilities in the OpenClaw AI assistant allowed for credential theft, privilege escalation, and remote code execution through a WhatsApp-to-host attack chain ^[9].
Security issues in Microsoft BitLocker security wrappers have exposed ATMs and organizations to potential compromise ^[28].
Two critical vulnerabilities in Google Chrome were patched in rapid succession, prompting users to update for protection ^[41].

Notable Threat Actor Activity

An initial access broker associated with the Payouts King ransomware group is using Microsoft Teams phishing to deploy a malicious Microsoft Edge browser extension, facilitating ransomware attacks ^[3].
Hackers are exploiting the Gitea Docker image authentication bypass vulnerability to gain admin access to self-hosted Git instances ^[21].
Attackers are targeting Microsoft 365 users with vishing campaigns, using fake Microsoft Entra passkey enrollment requests and voice-based social engineering to gain access. Okta has issued a warning regarding these tactics ^[15]^[36].
Unknown threat actors compromised Injective Labs’ GitHub repository for its SDK project, publishing malicious npm packages designed to steal cryptocurrency wallet keys and credentials ^[6].
A China-linked group known as Silver Fox has been attributed to the new MODBEACON remote access trojan, which uses gRPC streaming for encrypted command and control traffic ^[10].
Both China and India-linked hacking groups have been documented targeting the Balochistan Police force in Pakistan over the past two years ^[35].
Researchers demonstrated “HalluSquatting,” using adversarial AI hallucinations to deliver botnet malware via popular AI assistants ^[38].

Trends, Tools, or Tactics of Interest

Cyberattacks against healthcare service providers more than doubled in the first half of 2026, with attackers increasingly targeting service providers and other healthcare businesses beyond hospitals and clinics ^[27].
GigaWiper, a new remote access Trojan, combines standalone wiper, ransomware encryption, and multi-pass wiping commands for system-level sabotage ^[37]^[39].
AI agents are driving rapid growth in non-human identities within organizations, complicating identity management and access visibility ^[23].
Researchers identified that many free Android VPN apps leak traffic, transmit unencrypted data, and engage in tracking, undermining user privacy and security expectations ^[14].
Comment stuffing in HTML phishing attachments is being used as a mechanism to evade AI-based detection systems ^[32].
AI coding tools are prompting debate over whether their security risks outweigh productivity gains, with concerns about scanning, remediation, and false positives ^[30].

Regulatory or Policy Developments Affecting the Security Industry

Multiple countries are increasing social media restrictions, particularly age-based account controls, though compliance by major platforms is reportedly lacking ^[29].
Adobe has increased its patch release cadence in response to growing security concerns ^[33].
The NSA has reinstated its Tailored Access Operations (TAO) unit, signaling renewed emphasis on offensive cyber capabilities ^[33].

Legal and Law Enforcement Actions

A member of the Ryuk ransomware group has pleaded guilty in the US and faces up to 15 years in prison for attacks on US companies ^[18].
A former ransomware negotiator for DigitalMint was sentenced to 70 months in prison for assisting the BlackCat (ALPHV) ransomware group ^[25]^[34].
A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving a prison sentence for money laundering ^[22].
Canadian authorities have disrupted ransomware operations, as noted in a recent incident roundup ^[33].

Sources

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat - thehackernews.com
Progress urges ShareFile admins to shut down servers over “credible” threat - bleepingcomputer.com
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites - thehackernews.com
Police suspects Dutch hackers were involved in Odido breach - bleepingcomputer.com
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops - securityweek.com
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions - thehackernews.com
Zimbra urges customers to patch critical web client XSS flaw - bleepingcomputer.com
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot - thehackernews.com
New U-Boot flaws could enable stealthy firmware attacks - bleepingcomputer.com
Hackers exploit critical auth bypass in Gitea Docker image - bleepingcomputer.com
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers - thehackernews.com
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets - thehackernews.com
Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched - thehackernews.com
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws - thehackernews.com
Fresh ATM Crypto Software Bugs: Jackpot or Bust? - darkreading.com
Two Chrome updates in two days fix critical vulnerabilities - malwarebytes.com
Threat Actor Uses Phishing to Breach Orgs for Ransomware Gangs - blog.knowbe4.com
Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access - thehackernews.com
Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers - securityweek.com
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages - thehackernews.com
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic - thehackernews.com
China, India-Linked Hackers Both Targeted Same Pakistani Police Force - securityweek.com
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
Cybercriminals Flock to Healthcare Businesses as Attacks Surge - darkreading.com
GigaWiper Combines Multiple Malware for System-Level Sabotage - securityweek.com
This new Windows malware can take over your PC and wipe it clean - malwarebytes.com
The Replicant in Your Directory: AI Agents and the Identity Security Gap - bleepingcomputer.com
Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking - thehackernews.com
"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th) - isc.sans.edu
AI Coding: Do Security Risks Outweigh Productivity Gains? - darkreading.com
More Countries Jump on the Social Media 'Ban Wagon' - darkreading.com
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison - bleepingcomputer.com
Former ransomware negotiator gets 4 years for BlackCat attacks - bleepingcomputer.com
Third US Security Expert Sentenced to Prison for Helping Ransomware Gang - securityweek.com
Money launderer accused of stealing seized crypto while in prison - bleepingcomputer.com

Cybersecurity Brief – 2026-07-10

Fri, 10 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Japanese telecommunications company KDDI suffered a data breach affecting 12 million individuals after hackers exploited a zero-day vulnerability in a third-party system to gain access to a KDDI email platform used by ISPs ^[36].
AssuranceAmerica reported a breach in which attackers accessed the driver’s license numbers and other personal information of approximately 6.9 million customers ^[42].
Mount Royal University confirmed that data was stolen in a ransomware attack, with hackers accessing the internal network and deleting two drives containing employee, student, and university data ^[39].
The OpenMandriva Linux project disclosed an attempted internal sabotage by a contributor following a dispute among project members ^[13].

Newly Discovered Vulnerabilities

Microsoft released patches for the Defender vulnerability known as RoguePlanet (CVE-2026-50656), which could allow attackers to gain SYSTEM privileges. Details and proof-of-concept exploits had already been made public prior to the patch ^[11]^[22]^[38]^[43].
Palo Alto Networks patched 13 vulnerabilities in PAN-OS software, including buffer overflow, denial of service, command injection, server-side request forgery, and authentication bypass issues ^[35].
A Linux kernel vulnerability dubbed ‘GhostLock’, present in every major distribution since 2011, was disclosed. The flaw allows attackers to gain root access ^[37].
The Injective Labs SDK project’s GitHub repository was compromised, resulting in a malicious npm package that stole cryptocurrency wallet private keys and mnemonic phrases ^[14].

Notable Threat Actor Activity

A new ransomware family called GodDamn uses the PoisonX kernel driver, signed by Microsoft, to disable endpoint security software as part of its defense evasion tactics ^[10]^[26].
A new data-extortion group named Helix is conducting attacks against SharePoint environments using voice phishing (vishing), device code phishing, and multi-factor authentication abuse to steal data ^[15].
Researchers identified a network of 200 GitHub repositories being used to distribute Windows malware by loading PowerShell code that fetches commands from public dead drops ^[32].
Invoice phishing attacks are being conducted via the legitimate Shop app, developed by Shopify, to trick users into fraudulent transactions ^[1].
A phishing campaign is impersonating Interpol’s cybercrime investigation unit to deliver ransomware, targeting small businesses across multiple global regions ^[2].
A phishing-as-a-service platform called Forg365 uses AI-assisted lure generation, adversary-in-the-middle, and device code methods to target Microsoft 365 accounts ^[17].

Trends, Tools, or Tactics of Interest

Attackers are abusing dormant GitHub accounts to enumerate corporate organizations, repositories, and user accounts via the GitHub API, making detection more difficult ^[4].
The GigaWiper Windows backdoor combines three older destructive programs into a single toolkit, offering disk wiping, fake ransomware, and spyware capabilities ^[5].
AI-driven attacks are accelerating, with adversaries using models to rapidly craft tailored phishing lures and pivot between targets in minutes ^[8].
Security researchers demonstrated ‘HalluSquatting’, where adversarial manipulation of AI assistant hallucinations can enable remote code execution and botnet delivery ^[31].
AI coding assistants can be tricked into executing malicious code on developer machines using legacy attack techniques, as detailed in the newly disclosed GhostApproval method ^[40].
Prompt injection and agentic risk are rising concerns as AI systems become more autonomous and susceptible to adversarial manipulation ^[3].
Cloud bucket hijacking, Windows local privilege escalation chains, and other misconfigurations continue to be prevalent attack vectors ^[7].
AI gateways are emerging as a new risk surface, with incidents showing that compromise can expose access to AI models, cloud infrastructure, and IAM data ^[25].
npm version 12 now disables install scripts by default to reduce supply chain risk, and granular access tokens that bypass two-factor authentication are being deprecated ^[6].
AI agents are being recognized as a new identity type, requiring approaches distinct from traditional service accounts or API tokens ^[23].

Regulatory or Policy Developments Affecting the Security Industry

The UK government announced an Agentic AI Defense Plan and an associated industry pledge to improve national cybersecurity posture, with a focus on addressing risks from autonomous AI systems ^[34].
European lawmakers voted against permitting large technology firms to scan private messages, but the “Chat Control” bill will still allow companies to scan citizens’ texts, emails, and social media messages for child abuse material ^[27].
Microsoft indicated that Windows users should expect more frequent security updates as the company increases reliance on artificial intelligence for vulnerability discovery in its codebase ^[16].
Microsoft announced it will retire the Outlook Web Access (OWA) Light client in a future Exchange Server update ^[19].

Sources

12 Million Impacted by Data Breach at Japanese Telco KDDI - securityweek.com
6.9 million driver’s license numbers stolen from AssuranceAmerica - malwarebytes.com
Mount Royal University Confirms Data Stolen in Ransomware Attack - securityweek.com
OpenMandriva Linux says contributor tried to sabotage the project - bleepingcomputer.com
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges - thehackernews.com
Microsoft Reins in RoguePlanet Zero-Day Threat - darkreading.com
Microsoft Patches Defender ‘RoguePlanet’ Vulnerability - securityweek.com
Microsoft fixes RoguePlanet zero-day in Defender - malwarebytes.com
Palo Alto Networks Patches 13 Vulnerabilities - securityweek.com
15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google - securityweek.com
Injective SDK on npm infected with cryptocurrency wallet stealer - bleepingcomputer.com
GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses - thehackernews.com
'GodDamn' Ransomware Uses BYOVD to Smite US Companies - darkreading.com
New Helix vishing group emerges in SharePoint data theft attacks - bleepingcomputer.com
Network of 200 GitHub Repositories Used for Malware Infection - securityweek.com
Invoice Phishing Attacks Are Abusing the Shop App - blog.knowbe4.com
Phishing Campaign Impersonates Interpol to Deliver Ransomware - blog.knowbe4.com
New Forg365 phishing platform uses AI to target Microsoft 365 accounts - bleepingcomputer.com
Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs - thehackernews.com
New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware - thehackernews.com
AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up - thehackernews.com
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique - securityweek.com
Prompt Injection and the Rise of Agentic Risk - blog.knowbe4.com
ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories - thehackernews.com
AI Gateways Offer Attackers the Keys to the Kingdom - darkreading.com
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk - thehackernews.com
AI Agents Are a New Kind of Identity & Most Organizations Aren't Ready - darkreading.com
UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge - securityweek.com
A Majority of European Lawmakers Voted Against Letting Big Tech Read Our Messages. They’re Going to Anyway - wired.com
Microsoft expects more Windows security updates from AI-discovered flaws - bleepingcomputer.com
Microsoft to retire the OWA Light client in Exchange Server - bleepingcomputer.com

Cybersecurity Brief – 2026-07-09

Thu, 09 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

AssuranceAmerica disclosed a data breach affecting approximately 6.9 million drivers after attackers accessed its systems earlier this year, exposing sensitive driver records ^[15].
Mount Royal University in Calgary confirmed a breach in which hackers accessed and deleted data from the university’s file storage systems, including employee, student, and university data ^[17]^[35].
Accenture confirmed a data breach following hacker claims of source code theft. The company stated the incident was contained and did not impact operations or service delivery ^[40].
Japanese telecommunications company KDDI reported a breach impacting 12 million individuals, caused by attackers exploiting a zero-day in a third-party system to access an ISP email system ^[32].
Madison Square Garden was found to have maintained a database categorizing celebrities, including sensitive labels such as “LGBTQIA” and risk ratings, raising privacy and surveillance concerns ^[28].

Newly Discovered Vulnerabilities

Microsoft released patches for the Defender vulnerability known as RoguePlanet (CVE-2026-50656), which could allow privilege escalation to SYSTEM level. The flaw was publicly disclosed prior to patch release ^[5]^[16]^[34]^[42].
Ubiquiti issued updates for multiple critical vulnerabilities affecting UniFi Connect, Talk, Access, Protect, and OS products, which could enable privilege escalation and arbitrary code execution ^[12].
Researchers disclosed a 15-year-old Linux kernel vulnerability dubbed GhostLock, present in all major distributions since 2011, allowing attackers to gain root access ^[33].
Tenda firmware was found to contain an unpatched backdoor (CVE-2026-11405) that grants unauthenticated attackers admin access to device web management interfaces ^[39].
Google Chrome 150 update resolved 27 vulnerabilities, including 13 use-after-free bugs and two critical-severity flaws ^[37].

Notable Threat Actor Activity

A new ransomware family named GodDamn is using the PoisonX kernel driver, signed by Microsoft, to disable endpoint security software as part of its defense evasion tactics, with attacks targeting US companies ^[4]^[23].
The threat actor Lurking Lizard is distributing fake 7-Zip installers to turn victim devices into nodes for a malicious residential proxy network ^[9].
China-linked threat clusters have exploited Roundcube vulnerabilities at US and Canadian universities to steal credentials and deploy backdoor malware ^[19].
A China-linked APT associated with the LapDogs campaign has expanded its toolkit with new SOHO router backdoors: LongLeash, DogLeash, and JarLeash ^[41].
Malicious packages mimicking Paysafe, Skrill, and Neteller SDKs were found on npm and PyPI, delivering stealer malware to developers and users of payment applications ^[18].
The Vidar infostealer is targeting SMBs via malvertising campaigns that lure users with cracked or pirated software, delivering malware for both data theft and cryptomining ^[27].

Trends, Tools, or Tactics of Interest

Multiple reports highlight the increasing speed and sophistication of AI-driven attacks, with attackers using AI models to rapidly craft targeted lures, automate testing, and pivot to new targets within minutes ^[2]^[21].
AI coding agents and assistants are being actively exploited or manipulated:
- Proof-of-concept attacks show that code review agents can be tricked into running malicious code on developer machines ^[7].
- The GhostApproval attack leverages symlink flaws in six popular AI coding assistants to allow malicious repos to execute code on developer systems ^[8]^[36].
- HalluSquatting attacks trick AI coding assistants into fetching and installing non-existent, attacker-controlled packages, leading to botnet malware infections ^[11].
- AI coding agents have been observed triggering endpoint security rules, sometimes mimicking human attacker behaviors and causing operational confusion ^[10].
AI gateways, which provide access to models and cloud infrastructure, are emerging as high-value targets, with incidents demonstrating their potential to expose IAM data and facilitate cryptomining ^[22].
Attackers are chaining weaknesses in AI workflows, cloud misconfigurations, and stolen credentials to breach cloud environments, as demonstrated in a case where a lone attacker compromised an AWS environment in 72 hours ^[26].
Voice phishing (vishing) campaigns are targeting Microsoft 365 users by impersonating security requests to enroll new Entra passkeys, aiming to bypass multi-factor authentication ^[20].
AI-powered service desk attacks are becoming more convincing and scalable, leveraging generative AI for social engineering and impersonation ^[21].
There is a growing trend of malicious software distribution through developer ecosystems, such as fake SDKs on npm and PyPI ^[18], and the use of cracked software as lures in malvertising ^[27].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the upcoming retirement of the Outlook Web Access (OWA) Light client in Exchange Server, impacting organizations relying on this lightweight email client ^[13].
A global anti-fraud operation led by law enforcement agencies resulted in the arrest of 5,811 suspects and the seizure of $293 million in illicit assets across 97 countries ^[14].
A survey revealed that European organizations may have an inflated sense of security regarding their collaboration tools and platforms, indicating a confidence gap in collaboration security practices ^[24].

Sources

AssuranceAmerica data breach exposes records of 6.9 million drivers - bleepingcomputer.com
Mount Royal University confirms breach as hackers claim attack - bleepingcomputer.com
Mount Royal University Confirms Data Stolen in Ransomware Attack - securityweek.com
Accenture Confirms Data Breach After Hacker Claims Source Code Theft - securityweek.com
12 Million Impacted by Data Breach at Japanese Telco KDDI - securityweek.com
Madison Square Garden Kept a List of Gay Celebrities - wired.com
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges - thehackernews.com
Microsoft patches RoguePlanet Defender zero-day vulnerability - bleepingcomputer.com
Microsoft Patches Defender ‘RoguePlanet’ Vulnerability - securityweek.com
Microsoft fixes RoguePlanet zero-day in Defender - malwarebytes.com
Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS - thehackernews.com
15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google - securityweek.com
Unpatched Backdoor in Tenda Firmware Grants Admin Access to Devices - securityweek.com
Chrome 150 Update Patches 27 Vulnerabilities - securityweek.com
GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses - thehackernews.com
'GodDamn' Ransomware Uses BYOVD to Smite US Companies - darkreading.com
Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes - thehackernews.com
Hackers exploit Roundcube flaw to spy on academic researchers - bleepingcomputer.com
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors - securityweek.com
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials - bleepingcomputer.com
Vidar Infostealer Hammers SMBs via Malvertising Campaign - darkreading.com
AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up - thehackernews.com
3 Ways AI Powers Service Desk Attacks and How to Prevent Them - bleepingcomputer.com
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It - thehackernews.com
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents - thehackernews.com
AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique - securityweek.com
New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware - thehackernews.com
AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers - thehackernews.com
AI Gateways Offer Attackers the Keys to the Kingdom - darkreading.com
Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours - darkreading.com
Entra passkey enrollment vishing targets Microsoft 365 users - bleepingcomputer.com
Microsoft to retire the OWA Light client in Exchange Server - bleepingcomputer.com
Police arrests 5,800 suspects in global anti-fraud crackdown - bleepingcomputer.com
European Organizations Have a Collaboration Security Confidence Gap - darkreading.com