Tenda on DanSec Daily

Cybersecurity Brief – 2026-07-09

Thu, 09 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

AssuranceAmerica disclosed a data breach affecting approximately 6.9 million drivers after attackers accessed its systems earlier this year, exposing sensitive driver records ^[15].
Mount Royal University in Calgary confirmed a breach in which hackers accessed and deleted data from the university’s file storage systems, including employee, student, and university data ^[17]^[35].
Accenture confirmed a data breach following hacker claims of source code theft. The company stated the incident was contained and did not impact operations or service delivery ^[40].
Japanese telecommunications company KDDI reported a breach impacting 12 million individuals, caused by attackers exploiting a zero-day in a third-party system to access an ISP email system ^[32].
Madison Square Garden was found to have maintained a database categorizing celebrities, including sensitive labels such as “LGBTQIA” and risk ratings, raising privacy and surveillance concerns ^[28].

Newly Discovered Vulnerabilities

Microsoft released patches for the Defender vulnerability known as RoguePlanet (CVE-2026-50656), which could allow privilege escalation to SYSTEM level. The flaw was publicly disclosed prior to patch release ^[5]^[16]^[34]^[42].
Ubiquiti issued updates for multiple critical vulnerabilities affecting UniFi Connect, Talk, Access, Protect, and OS products, which could enable privilege escalation and arbitrary code execution ^[12].
Researchers disclosed a 15-year-old Linux kernel vulnerability dubbed GhostLock, present in all major distributions since 2011, allowing attackers to gain root access ^[33].
Tenda firmware was found to contain an unpatched backdoor (CVE-2026-11405) that grants unauthenticated attackers admin access to device web management interfaces ^[39].
Google Chrome 150 update resolved 27 vulnerabilities, including 13 use-after-free bugs and two critical-severity flaws ^[37].

Notable Threat Actor Activity

A new ransomware family named GodDamn is using the PoisonX kernel driver, signed by Microsoft, to disable endpoint security software as part of its defense evasion tactics, with attacks targeting US companies ^[4]^[23].
The threat actor Lurking Lizard is distributing fake 7-Zip installers to turn victim devices into nodes for a malicious residential proxy network ^[9].
China-linked threat clusters have exploited Roundcube vulnerabilities at US and Canadian universities to steal credentials and deploy backdoor malware ^[19].
A China-linked APT associated with the LapDogs campaign has expanded its toolkit with new SOHO router backdoors: LongLeash, DogLeash, and JarLeash ^[41].
Malicious packages mimicking Paysafe, Skrill, and Neteller SDKs were found on npm and PyPI, delivering stealer malware to developers and users of payment applications ^[18].
The Vidar infostealer is targeting SMBs via malvertising campaigns that lure users with cracked or pirated software, delivering malware for both data theft and cryptomining ^[27].

Trends, Tools, or Tactics of Interest

Multiple reports highlight the increasing speed and sophistication of AI-driven attacks, with attackers using AI models to rapidly craft targeted lures, automate testing, and pivot to new targets within minutes ^[2]^[21].
AI coding agents and assistants are being actively exploited or manipulated:
- Proof-of-concept attacks show that code review agents can be tricked into running malicious code on developer machines ^[7].
- The GhostApproval attack leverages symlink flaws in six popular AI coding assistants to allow malicious repos to execute code on developer systems ^[8]^[36].
- HalluSquatting attacks trick AI coding assistants into fetching and installing non-existent, attacker-controlled packages, leading to botnet malware infections ^[11].
- AI coding agents have been observed triggering endpoint security rules, sometimes mimicking human attacker behaviors and causing operational confusion ^[10].
AI gateways, which provide access to models and cloud infrastructure, are emerging as high-value targets, with incidents demonstrating their potential to expose IAM data and facilitate cryptomining ^[22].
Attackers are chaining weaknesses in AI workflows, cloud misconfigurations, and stolen credentials to breach cloud environments, as demonstrated in a case where a lone attacker compromised an AWS environment in 72 hours ^[26].
Voice phishing (vishing) campaigns are targeting Microsoft 365 users by impersonating security requests to enroll new Entra passkeys, aiming to bypass multi-factor authentication ^[20].
AI-powered service desk attacks are becoming more convincing and scalable, leveraging generative AI for social engineering and impersonation ^[21].
There is a growing trend of malicious software distribution through developer ecosystems, such as fake SDKs on npm and PyPI ^[18], and the use of cracked software as lures in malvertising ^[27].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the upcoming retirement of the Outlook Web Access (OWA) Light client in Exchange Server, impacting organizations relying on this lightweight email client ^[13].
A global anti-fraud operation led by law enforcement agencies resulted in the arrest of 5,811 suspects and the seizure of $293 million in illicit assets across 97 countries ^[14].
A survey revealed that European organizations may have an inflated sense of security regarding their collaboration tools and platforms, indicating a confidence gap in collaboration security practices ^[24].

Sources

AssuranceAmerica data breach exposes records of 6.9 million drivers - bleepingcomputer.com
Mount Royal University confirms breach as hackers claim attack - bleepingcomputer.com
Mount Royal University Confirms Data Stolen in Ransomware Attack - securityweek.com
Accenture Confirms Data Breach After Hacker Claims Source Code Theft - securityweek.com
12 Million Impacted by Data Breach at Japanese Telco KDDI - securityweek.com
Madison Square Garden Kept a List of Gay Celebrities - wired.com
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges - thehackernews.com
Microsoft patches RoguePlanet Defender zero-day vulnerability - bleepingcomputer.com
Microsoft Patches Defender ‘RoguePlanet’ Vulnerability - securityweek.com
Microsoft fixes RoguePlanet zero-day in Defender - malwarebytes.com
Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS - thehackernews.com
15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google - securityweek.com
Unpatched Backdoor in Tenda Firmware Grants Admin Access to Devices - securityweek.com
Chrome 150 Update Patches 27 Vulnerabilities - securityweek.com
GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses - thehackernews.com
'GodDamn' Ransomware Uses BYOVD to Smite US Companies - darkreading.com
Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes - thehackernews.com
Hackers exploit Roundcube flaw to spy on academic researchers - bleepingcomputer.com
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors - securityweek.com
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials - bleepingcomputer.com
Vidar Infostealer Hammers SMBs via Malvertising Campaign - darkreading.com
AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up - thehackernews.com
3 Ways AI Powers Service Desk Attacks and How to Prevent Them - bleepingcomputer.com
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It - thehackernews.com
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents - thehackernews.com
AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique - securityweek.com
New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware - thehackernews.com
AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers - thehackernews.com
AI Gateways Offer Attackers the Keys to the Kingdom - darkreading.com
Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours - darkreading.com
Entra passkey enrollment vishing targets Microsoft 365 users - bleepingcomputer.com
Microsoft to retire the OWA Light client in Exchange Server - bleepingcomputer.com
Police arrests 5,800 suspects in global anti-fraud crackdown - bleepingcomputer.com
European Organizations Have a Collaboration Security Confidence Gap - darkreading.com

Cybersecurity Brief – 2026-07-08

Wed, 08 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Accenture confirmed a security breach after a threat actor claimed to have stolen 35 GB of source code and other data, which was subsequently offered for sale online ^[17].
A small Ohio county reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data ^[31].
A critical flaw in GitHub Agentic Workflows was demonstrated to allow unauthenticated attackers to craft issues in public repositories and exfiltrate data from private repositories ^[10]^[27].
Ubiquiti disclosed seven critical vulnerabilities in UniFi OS, including a maximum-severity command injection flaw, and released security updates ^[15].
A hidden authentication backdoor was discovered in multiple Tenda router firmware versions, potentially granting attackers administrative access to the device’s web management panel ^[19].

Newly Discovered Vulnerabilities

Researchers disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw enabling root access and container escape on most unpatched Linux distributions ^[5].
The Januscape vulnerability, a 16-year-old Linux kernel flaw, was revealed to allow virtual machine escape and arbitrary code execution on Intel and AMD systems running KVM ^[23]^[37].
A critical Gitea vulnerability (CVE-2026-20896) is under active exploitation, allowing attackers to bypass authentication with a single HTTP header and access repositories and secrets ^[32].
A critical flaw in Google Dialogflow CX could have allowed attackers with edit rights on one Code Block-enabled agent to compromise other agents in the same Google Cloud project ^[8]^[26].
A critical session isolation vulnerability in the Writer AI platform, now patched, could have exposed session tokens across tenants ^[12].
Four actively exploited vulnerabilities in Adobe, Joomla, and Langflow were added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of active exploitation ^[6].
A recently patched maximum-severity vulnerability (CVE-2026-48282) in Adobe ColdFusion is being actively exploited in the wild ^[16]^[34].

Notable Threat Actor Activity

Chinese threat group UAT-7810 is actively evolving its malware, including the new LONGLEASH variant, to expand their Operational Relay Box (ORB) network by compromising primarily unpatched router devices ^[18].
Suspected China-aligned actors exploited vulnerabilities in Roundcube webmail software to target physics and engineering departments at US and Canadian universities for espionage ^[14].
Iran-linked threat actors have been observed using a modular command and control framework and compromising IT service providers to reach high-value targets in Israel ^[35].
A new Android malware operation, RedWing, is being offered as a bank fraud-as-a-service on Telegram, enabling even low-skill criminals to take over devices and steal banking credentials ^[7].
A Microsoft 365 device code phishing campaign, leveraging collaboration-themed lures and abusing the device-code flow, has been observed targeting M365 accounts since late June 2026 ^[9].
A suspected member of pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest was arrested in Spain ^[20].
Scammers are using fake job offers from well-known brands, nested redirects, and phishing tactics to compromise marketing professionals’ Google accounts ^[25]^[40].
New scams on Reddit and Discord are tricking users into giving up login codes through false report claims ^[39].

Trends, Tools, or Tactics of Interest

Attackers are exploiting flaws in GitHub Agentic Workflows by creating public issues to trigger workflows that can leak data from private repositories ^[10]^[27].
ActiveState highlighted that certain attack chains in GitHub Actions can evade traditional CI security scanners, indicating a need for improved governance and detection ^[21].
The RedWing malware-as-a-service model demonstrates increased accessibility of sophisticated Android banking fraud tools via Telegram ^[7].
Phishing campaigns are increasingly using brand impersonation, nested redirects, and fake prompts to evade detection and increase success rates ^[25]^[40].
Scammers are leveraging AI to create convincing fraudulent products, such as fake flowers, and to embed hidden trackers in AI-generated code ^[41]^[42].
CISA is reportedly using Anthropic’s Mythos AI platform to scan government software for vulnerabilities, indicating a trend toward AI-driven security assessments ^[33].
The use of modular malware frameworks by Iran-linked actors and evolving malware by Chinese groups shows a trend toward adaptable, persistent threat infrastructure ^[18]^[35].

Regulatory or Policy Developments Affecting the Security Industry

CISA ordered US federal agencies to patch a maximum-severity Adobe ColdFusion vulnerability by Friday in response to active exploitation ^[16].
Microsoft announced that Windows settings backup and restore will be enabled by default on Microsoft Entra-joined or hybrid-joined enterprise systems after upgrading to Windows 11 26H2 ^[24].

Sources

Accenture confirms breach after hacker offers stolen data for sale - bleepingcomputer.com
County Government Reportedly Paid $1 Million to Cyber Extortion Group - securityweek.com
Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data - thehackernews.com
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows - darkreading.com
Ubiquiti warns of new max severity UniFi OS vulnerability - bleepingcomputer.com
Hidden backdoor in Tenda router firmware grants admin access - bleepingcomputer.com
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros - thehackernews.com
New Januscape Linux flaw allows VM escape on Intel, AMD devices - bleepingcomputer.com
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems - securityweek.com
Critical Gitea Flaw Under Active Exploitation, Researchers Warn - securityweek.com
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots - thehackernews.com
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft - darkreading.com
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants - thehackernews.com
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV - thehackernews.com
CISA orders feds to patch max severity ColdFusion flaw by Friday - bleepingcomputer.com
Critical Adobe ColdFusion Vulnerability Exploited in Attacks - securityweek.com
Chinese hackers develop LONGLEASH malware to expand ORB network - bleepingcomputer.com
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities - thehackernews.com
Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks - securityweek.com
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service - thehackernews.com
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts - thehackernews.com
Spain arrests suspected member of pro-Russian hacktivist groups - bleepingcomputer.com
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts - darkreading.com
Fake Netflix, Coca-Cola, and FIFA job scams target marketers - malwarebytes.com
How the Reddit and Discord false report scam steals accounts - malwarebytes.com
The GitHub Actions Attack Pattern Your CI Security Scanners Miss - bleepingcomputer.com
Claude Code’s hidden tracker was an “experiment,” says Anthropic - malwarebytes.com
Scammers are using AI to sell impossible flowers - malwarebytes.com
CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws - securityweek.com
Microsoft to enable Windows settings backup by default for orgs - bleepingcomputer.com

Cybersecurity Brief – 2026-07-07

Tue, 07 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers are actively exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, enabling remote code execution^[17].
River Bank & Trust, a US financial institution, has experienced a data breach, with customer data exposed^[32].
Armored Likho, an APT group, has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan using modular RATs and information stealers^[18]^[27].
The NetNut residential proxy botnet, built on millions of hijacked devices and used by criminals, was disrupted through a coordinated operation involving Google, the FBI, and others^[35].

Newly Discovered Vulnerabilities

Several Tenda router firmware versions contain an undocumented authentication backdoor, granting administrative access to attackers^[2].
BeyondTrust patched two critical authentication bypass flaws in Remote Support (RS) and Privileged Remote Access (PRA) products that could allow unauthenticated attackers to gain access^[3]^[11].
A 16-year-old use-after-free bug in Linux’s KVM hypervisor, dubbed ‘Januscape’ (CVE-20xxxx), allows guest VMs to escape to the host on Intel and AMD x86 systems^[5].
Threat actors are probing a critical flaw in Gitea Docker images (CVE-2026-20896), which was recently patched^[6].
Attackers are targeting a newly disclosed memory disclosure flaw in Citrix NetScaler products following the release of a proof-of-concept exploit^[19].
Proof-of-concept code has been released for a root escalation vulnerability in Linux known as ‘Bad Epoll’, increasing the risk of exploitation^[29].

Notable Threat Actor Activity

An Iranian APT group affiliated with Iran’s Ministry of Intelligence and Security has been using a new modular C2 framework, Cavern (also called Cavern Manticore), to target Israeli organizations^[4]^[31].
A suspected China-nexus threat cluster is distributing a fake Indian tax filing utility to deliver DcRAT, targeting Indian taxpayers, tax professionals, and finance teams^[9].
North Korean threat actors have compromised over 100 legitimate open source packages and repositories in the PolinRider campaign to deliver a backdoor and information stealer to developers^[28].
Threat actors are abusing Microsoft Teams voice calls by impersonating IT support to distribute EtherRAT malware for initial access^[14].
Phishing campaigns are impersonating over 30 major brands in fake job interviews to steal Google account credentials from marketing professionals^[13].
Securonix has observed ‘Veil#Drop’ attacks leveraging compromised websites, Blogspot, PowerShell, and fileless techniques to deploy the PureLog information stealer^[25].

Trends, Tools, or Tactics of Interest

Device Code Phishing attacks are leveraging the OAuth 2.0 Device Authorization Grant on Microsoft websites to trick users, bypassing traditional URL-checking defenses^[1].
Researchers demonstrated ‘TrojPix’, a new technique for exfiltrating data from air-gapped systems by manipulating on-screen pixels to transmit information via video cable emissions^[10].
The first complete LLM-driven ransomware attack, dubbed JadePuffer, was reported, where an agentic threat actor exploited a Langflow flaw to steal data and encrypt systems^[20].
Researchers have uncovered prompt injection attacks embedding malicious prompts in websites to trick autonomous AI agents into making unauthorized cryptocurrency payments^[30].
Blogspot-hosted payloads and fileless malware delivery methods are being used in recent sophisticated attack frameworks^[25].
Ongoing discussion on the rapid pace of software development driven by AI and the associated lag in security integration and controls^[16].
The NetNut botnet disruption highlights the prevalence and risks of residential proxy networks built on compromised devices^[35].

Regulatory or Policy Developments Affecting the Security Industry

Vietnamese authorities arrested seven individuals allegedly responsible for operating HiAnime, a major anime piracy streaming service, prior to its shutdown in June^[15].
The Office of Professional Responsibility within ICE has opened over 100 cases investigating incidents of doxing and threats against ICE employees, reflecting increased scrutiny of online threats targeting government personnel^[21].

Sources

Max severity Adobe ColdFusion flaw now exploited in attacks - bleepingcomputer.com
6th July – Threat Intelligence Report - research.checkpoint.com
'BusySnake' Infostealer Slithers into Critical Infrastructure Networks - darkreading.com
Armored Likho APT Targeting Government, Electric Power Entities - securityweek.com
NetNut botnet takes a hit. Don’t be part of the next one. - malwarebytes.com
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware - thehackernews.com
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA - thehackernews.com
BeyondTrust warns of critical flaws in remote access software - bleepingcomputer.com
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems - thehackernews.com
Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure - thehackernews.com
CitrixBleed-ing Again? NetScaler Vulnerability Under Attack - darkreading.com
Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability - securityweek.com
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations - thehackernews.com
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework - research.checkpoint.com
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT - thehackernews.com
North Korean Hackers Target Open Source Developers in Supply Chain Attacks - securityweek.com
Fake IT support calls on Microsoft Teams push EtherRAT malware - bleepingcomputer.com
Phishing poses as big-brand job interview to steal Google accounts - bleepingcomputer.com
Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks - securityweek.com
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website - securelist.com
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions - thehackernews.com
JadePuffer: The First Complete LLM-Driven Ransomware Attack - darkreading.com
Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments - securityweek.com
Software Is Now Written at the Speed of Thought. Security Isn't. - bleepingcomputer.com
Vietnam arrests suspects behind HiAnime anime piracy service - bleepingcomputer.com
ICE’s Internal Watchdog Is Now Investigating Online Critics - wired.com