Cybersecurity Brief – 2026-07-23

Thu, 23 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Upbound Group reported a cyberattack in which threat actors leveraged stolen data to create $13 million in fraudulent Acima leases, indicating significant financial impact and data misuse^[13].
South Korea disclosed a breach of the National Diplomatic Academy’s online education system, resulting in the theft of personal information of current and former Ministry of Foreign Affairs employees and diplomats worldwide over a ten-month period^[14].
Swiss rail manufacturer Stadler Rail confirmed a ransomware attack. The Everest ransomware gang demanded a $12.3 million ransom after breaching a data exchange platform shared with a supplier^[15].
Tens of millions of accounts were affected in breaches at Suno and Paidwork, with hackers leaking names, email addresses, phone numbers, passwords, and financial information^[32]^[42].
Chick-fil-A loyalty accounts were hijacked through the use of stolen passwords, exposing users to account compromise and potential fraud^[41].
A ransomware attack on a Japanese frozen-food supply chain company disrupted the supply of frozen food to thousands of clients, including major franchises^[23].

Newly Discovered Vulnerabilities

Check Point patched a critical vulnerability in its SmartConsole admin panel that allowed attackers full administrative access. The flaw was actively exploited as a zero-day in the wild^[4]^[12].
Researchers disclosed a local privilege escalation vulnerability in Ubuntu’s snap-confine, which could allow unprivileged users to gain root access on default desktop installs^[6].
A high-severity vulnerability (CVE-2026-29059) in the open-source Windmill developer platform is under active exploitation, allowing unauthenticated attackers to read arbitrary server files^[8].
The Adobe Acrobat Chrome extension, installed on over 314 million devices, contained a now-patched vulnerability chain that allowed malicious sites to access and exfiltrate WhatsApp Web data, including messages and contacts^[7]^[18]^[34].
A fourth SharePoint vulnerability (CVE-2026-50522) was reported as exploited in recent attacks, enabling threat actors to steal machine keys and maintain long-term access^[38].
Oracle released a quarterly security update addressing over 1,400 vulnerabilities across its product suite^[40].

Notable Threat Actor Activity

The Everest ransomware gang was responsible for the cyberattack and ransom demand against Stadler Rail^[15].
Iranian hackers are actively targeting Siemens, Schneider Electric, and Rockwell ICS devices, with updated US federal advisories detailing their techniques for compromising programmable logic controllers^[31].
A Brazilian banking trojan is actively spreading in Portugal, leveraging the shared Portuguese language to target local businesses^[22].
Advanced threat actors are exploiting AI toolchains, as demonstrated by the Sandworm_Mode malware that leverages trusted AI tools and workflows to blend malicious activity with legitimate operations^[24].
Threat actors are using “phantom squatting” to manipulate AI-generated outputs, causing AI tools to direct users to phishing sites^[1].
A malicious Android app disguised as a Bahrain alert application is delivering multi-stage spyware during periods of heightened civilian fear, exploiting fake Google Play sites^[25].

Trends, Tools, or Tactics of Interest

The ARToken phishing kit, built on the EvilTokens platform, has been identified as a sophisticated phishing-as-a-service tool automating business email compromise (BEC) attacks through targeted social engineering and credential theft^[2].
Attackers are increasingly leveraging AI hallucinations and trusted AI workflows to facilitate phishing and evade detection, with examples such as phantom squatting and Sandworm_Mode malware^[1]^[24].
AI-generated applications (notably those coded with Vibe) are being found to contain numerous exploitable vulnerabilities, including denial-of-service, authorization, and secrets exposure risks^[37].
Enterprise adoption of generative AI is amplifying ransomware risk by inheriting excessive permissions or compromised identities, highlighting the importance of identity controls and governance^[16].
There is a trend of data leakage from EU and US financial institutions via tracking pixels and cookie trackers, inadvertently transmitting customer data to ad platforms and raising compliance and privacy concerns^[27].
A new infrastructure cybersecurity knowledge base, InfraTrust, and its Pulse report have been launched to help organizations prioritize patching of infrastructure vulnerabilities^[17].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated urgent patching of an actively exploited remote code execution vulnerability in the Langflow visual framework for US government agencies^[19].
Microsoft has announced it will cease providing security updates for Exchange 2016 and 2019 through the Extended Security Update program in October 2026^[21].
GitHub will reduce public bug bounty payouts by at least half at every severity level, moving top rewards to a VIP tier starting July 27, 2026^[5].

Sources

Upbound says hack caused $13 million in fraudulent Acima leases - bleepingcomputer.com
South Korea discloses data breach impacting diplomats worldwide - bleepingcomputer.com
Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack - bleepingcomputer.com
Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts - securityweek.com
Paidwork breach exposes data of 23 million users: Check if you’re affected - malwarebytes.com
Chick-fil-A loyalty accounts hijacked using stolen passwords - malwarebytes.com
Ransomware Attack Puts a Chill On Japanese Frozen-Food Chain - darkreading.com
Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access - thehackernews.com
Check Point warns of SmartConsole zero-day exploited in attacks - bleepingcomputer.com
Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs - thehackernews.com
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication - thehackernews.com
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data - thehackernews.com
Adobe Chrome extension flaw let sites access private WhatsApp chats - bleepingcomputer.com
Flaw in Adobe Extension With 300M Installs Enabled WhatsApp Data Theft - securityweek.com
Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks - securityweek.com
Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates - securityweek.com
US Warns of Iranian Hackers Targeting Siemens, Schneider, and Rockwell ICS Devices - securityweek.com
Brazilian Banking Trojan Actively Spreading in Portugal - darkreading.com
Attackers Are Learning to Live Off the AI Toolchain - darkreading.com
Attackers Exploit AI Hallucinations to Send Users to Phishing Sites - blog.knowbe4.com
Fake Bahrain Alert App Deploys Android Surveillance Malware - darkreading.com
Warning: ARToken Phishing Kit Automates BEC Attacks - blog.knowbe4.com
Vibe-Coded Apps Riddled With Exploitable Security Flaws - securityweek.com
How enterprise GenAI can amplify ransomware risk — and how to contain it - bleepingcomputer.com
EU Financial Institutions Leak Data Through Cookie Trackers - darkreading.com
New InfraTrust report reveals infrastructure flaws admins should patch first - bleepingcomputer.com
CISA orders urgent action on actively exploited Langflow RCE flaw - bleepingcomputer.com
Microsoft to stop Exchange 2016 / 2019 security updates in October - bleepingcomputer.com
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier - thehackernews.com

Paidwork on DanSec Daily

Cybersecurity Brief – 2026-07-23

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources