Injective Labs on DanSec Daily

Cybersecurity Brief – 2026-07-11

Sat, 11 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Progress Software has instructed ShareFile customers to immediately shut down Windows Storage Zone Controllers due to a “credible external security threat” targeting these servers. The company is actively responding to the incident and has communicated directly with affected customers ^[5]^[20].
Researchers uncovered that a cybercrime group left one of its servers exposed, revealing details about the WP-SHELLSTORM campaign, which has backdoored thousands of WordPress sites. The exposure included hacking tools, logs, and target lists ^[13].
The Dutch National Police reported strong indications that Dutch hackers were involved in the February breach at telecommunications provider Odido ^[19].
A data breach at AssuranceAmerica has affected 7 million individuals, as disclosed in a roundup of recent incidents ^[33].
The US Department of Homeland Security (DHS) database was reportedly hacked, according to recent reports ^[33].

Newly Discovered Vulnerabilities

Zimbra has issued an urgent advisory to patch a critical vulnerability in its Classic Web Client that could allow attackers to execute arbitrary code via crafted emails. The flaw is actively being addressed and users are urged to update ^[4]^[24].
Six new vulnerabilities have been identified in the U-Boot bootloader, used across a wide range of hardware, which could allow malicious images to crash devices or execute code at boot, enabling stealthy firmware attacks ^[7]^[17].
A critical authentication bypass vulnerability is being actively exploited in the official Docker image for the Gitea self-hosted Git service. Attackers can impersonate any user, including administrators ^[21].
A flaw in Alibaba’s XQUIC (XRING) QUIC and HTTP/3 library allows any remote client to crash the server with legal traffic. There is currently no patch available ^[11].
A newly disclosed flaw called “Ill Bloom” in certain cryptocurrency wallet software’s recovery phrase generation has been exploited to drain over $5 million from wallets ^[16].
Researchers have demonstrated that a laser attack can reset passwords on Tangem wallet cards by targeting the chip, and affected cards cannot be patched ^[8].
Three now-patched vulnerabilities in the OpenClaw AI assistant allowed for credential theft, privilege escalation, and remote code execution through a WhatsApp-to-host attack chain ^[9].
Security issues in Microsoft BitLocker security wrappers have exposed ATMs and organizations to potential compromise ^[28].
Two critical vulnerabilities in Google Chrome were patched in rapid succession, prompting users to update for protection ^[41].

Notable Threat Actor Activity

An initial access broker associated with the Payouts King ransomware group is using Microsoft Teams phishing to deploy a malicious Microsoft Edge browser extension, facilitating ransomware attacks ^[3].
Hackers are exploiting the Gitea Docker image authentication bypass vulnerability to gain admin access to self-hosted Git instances ^[21].
Attackers are targeting Microsoft 365 users with vishing campaigns, using fake Microsoft Entra passkey enrollment requests and voice-based social engineering to gain access. Okta has issued a warning regarding these tactics ^[15]^[36].
Unknown threat actors compromised Injective Labs’ GitHub repository for its SDK project, publishing malicious npm packages designed to steal cryptocurrency wallet keys and credentials ^[6].
A China-linked group known as Silver Fox has been attributed to the new MODBEACON remote access trojan, which uses gRPC streaming for encrypted command and control traffic ^[10].
Both China and India-linked hacking groups have been documented targeting the Balochistan Police force in Pakistan over the past two years ^[35].
Researchers demonstrated “HalluSquatting,” using adversarial AI hallucinations to deliver botnet malware via popular AI assistants ^[38].

Trends, Tools, or Tactics of Interest

Cyberattacks against healthcare service providers more than doubled in the first half of 2026, with attackers increasingly targeting service providers and other healthcare businesses beyond hospitals and clinics ^[27].
GigaWiper, a new remote access Trojan, combines standalone wiper, ransomware encryption, and multi-pass wiping commands for system-level sabotage ^[37]^[39].
AI agents are driving rapid growth in non-human identities within organizations, complicating identity management and access visibility ^[23].
Researchers identified that many free Android VPN apps leak traffic, transmit unencrypted data, and engage in tracking, undermining user privacy and security expectations ^[14].
Comment stuffing in HTML phishing attachments is being used as a mechanism to evade AI-based detection systems ^[32].
AI coding tools are prompting debate over whether their security risks outweigh productivity gains, with concerns about scanning, remediation, and false positives ^[30].

Regulatory or Policy Developments Affecting the Security Industry

Multiple countries are increasing social media restrictions, particularly age-based account controls, though compliance by major platforms is reportedly lacking ^[29].
Adobe has increased its patch release cadence in response to growing security concerns ^[33].
The NSA has reinstated its Tailored Access Operations (TAO) unit, signaling renewed emphasis on offensive cyber capabilities ^[33].

Legal and Law Enforcement Actions

A member of the Ryuk ransomware group has pleaded guilty in the US and faces up to 15 years in prison for attacks on US companies ^[18].
A former ransomware negotiator for DigitalMint was sentenced to 70 months in prison for assisting the BlackCat (ALPHV) ransomware group ^[25]^[34].
A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving a prison sentence for money laundering ^[22].
Canadian authorities have disrupted ransomware operations, as noted in a recent incident roundup ^[33].

Sources

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat - thehackernews.com
Progress urges ShareFile admins to shut down servers over “credible” threat - bleepingcomputer.com
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites - thehackernews.com
Police suspects Dutch hackers were involved in Odido breach - bleepingcomputer.com
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops - securityweek.com
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions - thehackernews.com
Zimbra urges customers to patch critical web client XSS flaw - bleepingcomputer.com
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot - thehackernews.com
New U-Boot flaws could enable stealthy firmware attacks - bleepingcomputer.com
Hackers exploit critical auth bypass in Gitea Docker image - bleepingcomputer.com
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers - thehackernews.com
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets - thehackernews.com
Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched - thehackernews.com
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws - thehackernews.com
Fresh ATM Crypto Software Bugs: Jackpot or Bust? - darkreading.com
Two Chrome updates in two days fix critical vulnerabilities - malwarebytes.com
Threat Actor Uses Phishing to Breach Orgs for Ransomware Gangs - blog.knowbe4.com
Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access - thehackernews.com
Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers - securityweek.com
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages - thehackernews.com
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic - thehackernews.com
China, India-Linked Hackers Both Targeted Same Pakistani Police Force - securityweek.com
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
Cybercriminals Flock to Healthcare Businesses as Attacks Surge - darkreading.com
GigaWiper Combines Multiple Malware for System-Level Sabotage - securityweek.com
This new Windows malware can take over your PC and wipe it clean - malwarebytes.com
The Replicant in Your Directory: AI Agents and the Identity Security Gap - bleepingcomputer.com
Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking - thehackernews.com
"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th) - isc.sans.edu
AI Coding: Do Security Risks Outweigh Productivity Gains? - darkreading.com
More Countries Jump on the Social Media 'Ban Wagon' - darkreading.com
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison - bleepingcomputer.com
Former ransomware negotiator gets 4 years for BlackCat attacks - bleepingcomputer.com
Third US Security Expert Sentenced to Prison for Helping Ransomware Gang - securityweek.com
Money launderer accused of stealing seized crypto while in prison - bleepingcomputer.com

Cybersecurity Brief – 2026-07-10

Fri, 10 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Japanese telecommunications company KDDI suffered a data breach affecting 12 million individuals after hackers exploited a zero-day vulnerability in a third-party system to gain access to a KDDI email platform used by ISPs ^[36].
AssuranceAmerica reported a breach in which attackers accessed the driver’s license numbers and other personal information of approximately 6.9 million customers ^[42].
Mount Royal University confirmed that data was stolen in a ransomware attack, with hackers accessing the internal network and deleting two drives containing employee, student, and university data ^[39].
The OpenMandriva Linux project disclosed an attempted internal sabotage by a contributor following a dispute among project members ^[13].

Newly Discovered Vulnerabilities

Microsoft released patches for the Defender vulnerability known as RoguePlanet (CVE-2026-50656), which could allow attackers to gain SYSTEM privileges. Details and proof-of-concept exploits had already been made public prior to the patch ^[11]^[22]^[38]^[43].
Palo Alto Networks patched 13 vulnerabilities in PAN-OS software, including buffer overflow, denial of service, command injection, server-side request forgery, and authentication bypass issues ^[35].
A Linux kernel vulnerability dubbed ‘GhostLock’, present in every major distribution since 2011, was disclosed. The flaw allows attackers to gain root access ^[37].
The Injective Labs SDK project’s GitHub repository was compromised, resulting in a malicious npm package that stole cryptocurrency wallet private keys and mnemonic phrases ^[14].

Notable Threat Actor Activity

A new ransomware family called GodDamn uses the PoisonX kernel driver, signed by Microsoft, to disable endpoint security software as part of its defense evasion tactics ^[10]^[26].
A new data-extortion group named Helix is conducting attacks against SharePoint environments using voice phishing (vishing), device code phishing, and multi-factor authentication abuse to steal data ^[15].
Researchers identified a network of 200 GitHub repositories being used to distribute Windows malware by loading PowerShell code that fetches commands from public dead drops ^[32].
Invoice phishing attacks are being conducted via the legitimate Shop app, developed by Shopify, to trick users into fraudulent transactions ^[1].
A phishing campaign is impersonating Interpol’s cybercrime investigation unit to deliver ransomware, targeting small businesses across multiple global regions ^[2].
A phishing-as-a-service platform called Forg365 uses AI-assisted lure generation, adversary-in-the-middle, and device code methods to target Microsoft 365 accounts ^[17].

Trends, Tools, or Tactics of Interest

Attackers are abusing dormant GitHub accounts to enumerate corporate organizations, repositories, and user accounts via the GitHub API, making detection more difficult ^[4].
The GigaWiper Windows backdoor combines three older destructive programs into a single toolkit, offering disk wiping, fake ransomware, and spyware capabilities ^[5].
AI-driven attacks are accelerating, with adversaries using models to rapidly craft tailored phishing lures and pivot between targets in minutes ^[8].
Security researchers demonstrated ‘HalluSquatting’, where adversarial manipulation of AI assistant hallucinations can enable remote code execution and botnet delivery ^[31].
AI coding assistants can be tricked into executing malicious code on developer machines using legacy attack techniques, as detailed in the newly disclosed GhostApproval method ^[40].
Prompt injection and agentic risk are rising concerns as AI systems become more autonomous and susceptible to adversarial manipulation ^[3].
Cloud bucket hijacking, Windows local privilege escalation chains, and other misconfigurations continue to be prevalent attack vectors ^[7].
AI gateways are emerging as a new risk surface, with incidents showing that compromise can expose access to AI models, cloud infrastructure, and IAM data ^[25].
npm version 12 now disables install scripts by default to reduce supply chain risk, and granular access tokens that bypass two-factor authentication are being deprecated ^[6].
AI agents are being recognized as a new identity type, requiring approaches distinct from traditional service accounts or API tokens ^[23].

Regulatory or Policy Developments Affecting the Security Industry

The UK government announced an Agentic AI Defense Plan and an associated industry pledge to improve national cybersecurity posture, with a focus on addressing risks from autonomous AI systems ^[34].
European lawmakers voted against permitting large technology firms to scan private messages, but the “Chat Control” bill will still allow companies to scan citizens’ texts, emails, and social media messages for child abuse material ^[27].
Microsoft indicated that Windows users should expect more frequent security updates as the company increases reliance on artificial intelligence for vulnerability discovery in its codebase ^[16].
Microsoft announced it will retire the Outlook Web Access (OWA) Light client in a future Exchange Server update ^[19].

Sources

12 Million Impacted by Data Breach at Japanese Telco KDDI - securityweek.com
6.9 million driver’s license numbers stolen from AssuranceAmerica - malwarebytes.com
Mount Royal University Confirms Data Stolen in Ransomware Attack - securityweek.com
OpenMandriva Linux says contributor tried to sabotage the project - bleepingcomputer.com
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges - thehackernews.com
Microsoft Reins in RoguePlanet Zero-Day Threat - darkreading.com
Microsoft Patches Defender ‘RoguePlanet’ Vulnerability - securityweek.com
Microsoft fixes RoguePlanet zero-day in Defender - malwarebytes.com
Palo Alto Networks Patches 13 Vulnerabilities - securityweek.com
15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google - securityweek.com
Injective SDK on npm infected with cryptocurrency wallet stealer - bleepingcomputer.com
GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses - thehackernews.com
'GodDamn' Ransomware Uses BYOVD to Smite US Companies - darkreading.com
New Helix vishing group emerges in SharePoint data theft attacks - bleepingcomputer.com
Network of 200 GitHub Repositories Used for Malware Infection - securityweek.com
Invoice Phishing Attacks Are Abusing the Shop App - blog.knowbe4.com
Phishing Campaign Impersonates Interpol to Deliver Ransomware - blog.knowbe4.com
New Forg365 phishing platform uses AI to target Microsoft 365 accounts - bleepingcomputer.com
Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs - thehackernews.com
New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware - thehackernews.com
AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up - thehackernews.com
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique - securityweek.com
Prompt Injection and the Rise of Agentic Risk - blog.knowbe4.com
ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories - thehackernews.com
AI Gateways Offer Attackers the Keys to the Kingdom - darkreading.com
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk - thehackernews.com
AI Agents Are a New Kind of Identity & Most Organizations Aren't Ready - darkreading.com
UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge - securityweek.com
A Majority of European Lawmakers Voted Against Letting Big Tech Read Our Messages. They’re Going to Anyway - wired.com
Microsoft expects more Windows security updates from AI-discovered flaws - bleepingcomputer.com
Microsoft to retire the OWA Light client in Exchange Server - bleepingcomputer.com