Visa on DanSec Daily

Cybersecurity Brief – 2026-08-21

Fri, 21 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

A database belonging to the people finder service ClarityCheck was found exposed, leaking 9 million images of individuals’ faces ^[57].
Operation CameraSwarm compromised 14,000 Dahua IP cameras across Ukraine and Russia, with a focus on Russian and CIS telecom networks ^[46].
The Grandoreiro banking trojan has resurfaced in a new campaign targeting Mexico, following a previous law enforcement takedown ^[36].
A new Android malware named Manic is actively targeting Ukrainian banks, government, and identity services, as well as Russian and European financial institutions. It can exfiltrate data from offline devices by leveraging nearby infected devices ^[19]^[28].
A critical vulnerability in the Elementor Pro WordPress plugin enables attackers to upload executable files for remote code execution on affected servers ^[24].
A set of 40 malicious Mozilla Firefox extensions, posing as Web3 wallet products, have been identified stealing cryptocurrency wallet secrets ^[22].
A researcher discovered new Android malware distributed via legitimate DoFun head unit software, serving ads and building a proxy botnet ^[1].
A new report indicates that one in four data breaches now involve AI-enabled attacks, marking a 56 percent increase from the previous year ^[3].

Newly Discovered Vulnerabilities

GitLab vulnerability CVE-2026-19478 (CVSS 9.4) is under active exploitation, allowing attackers to exploit affected instances shortly after disclosure ^[6].
Microsoft Entra ID is affected by a critical remote code execution vulnerability (CVSS 10.0) that has been exploited in the wild ^[7].
Malicious versions of three Rust crates, including arrayref, were published after a maintainer account compromise, introducing build-time malware that executed on developers’ systems ^[8]^[23].
A critical vulnerability in the MLflow open-source AI engineering platform is being exploited to steal cloud credentials by allowing HTTP requests to internal endpoints ^[27]^[48].
Citrix NetScaler ADC and NetScaler Gateway are affected by two security flaws, including a critical authentication bypass. Exploitation is expected and admins are urged to patch immediately ^[14]^[26]^[52].
Zimbra Collaboration Suite (ZCS) is being actively exploited via a now-patched critical remote code execution vulnerability ^[15]^[29]^[44].
Atlassian and Splunk have issued patches for dozens of critical and high-severity vulnerabilities that could enable arbitrary code execution, privilege escalation, and data access ^[47].
Cisco has patched critical vulnerabilities in Crosswork and Secure Workload products, which could result in remote code execution, authentication bypass, and path traversal ^[49].
A critical flaw in the isolated-vm open-source JavaScript sandbox allows attackers to escape the sandbox and potentially achieve remote code execution ^[13].
NASA’s AIT-GUI operator console contains a chain of flaws allowing unauthenticated attackers to issue spacecraft commands ^[20].

Notable Threat Actor Activity

Suspected Russian cyber espionage groups have been observed abusing legitimate authentication flows, including Google OAuth and WhatsApp linking, to hijack accounts of individuals in academia, aerospace and defense, government, and NGOs ^[9].
The Head Mare hacktivist group has exploited vulnerabilities in TrueConf software to deploy PhantomCore malware ^[43].
Pakistan-linked threat actor Transparent Tribe has refreshed its toolset for cyberattacks targeting Afghan organizations, with limited success against Indian government agencies ^[35].

Trends, Tools, or Tactics of Interest

AI-generated exploit scripts are being used in active threats targeting US critical infrastructure, specifically Siemens S7 PLCs ^[11].
Attackers are exploiting trusted components, such as signed drivers and legitimate applications, to evade detection and blend malware into environments ^[10]^[53].
The Manic Android malware introduces a fallback data exfiltration mechanism using proximity to other infected devices, enabling data theft even from offline phones ^[19]^[28].
The ToxicPanda 2.0 and GoldDigger Android banking malware families have expanded their capabilities to include on-device fraud and a broader set of remote commands ^[21].
Researchers have demonstrated a “Zombie Card” attack that revives expired Visa contactless cards for in-store purchases by rewriting expiration data at the point of sale ^[16].
Two new denial-of-service (DoS) attacks exploit how major CDNs translate HTTP/3 to HTTP/1.1, resulting in amplification up to 350 times ^[18].
AI is increasingly being leveraged to personalize phishing attacks, making them harder for traditional email filters to detect ^[25].
The CUSTODY framework has been released to constrain AI agents in enterprise networks, following OpenAI-related incidents ^[31].
OpenAI has overhauled model security with new features such as sandboxing, 30-minute alerting, and training pauses in response to recent security incidents ^[51].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued warnings and urged immediate patching for actively exploited vulnerabilities in MLflow and TrueConf ^[27]^[43].
Twitch has introduced an opt-out option for users who do not want their content used for Amazon AI training ^[55].

Sources

9 million images of people’s faces exposed by reverse lookup service - malwarebytes.com
Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia - securityweek.com
'Grandoreiro' Malware Resurfaces With Mexico Campaign - darkreading.com
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices - thehackernews.com
New Manic Android malware can exfiltrate data through nearby devices - bleepingcomputer.com
Critical Elementor Pro bug exposes WordPress sites to RCE attacks - bleepingcomputer.com
40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets - thehackernews.com
The invisible passenger in your car - securelist.com
Report: One-Quarter of Breaches Are Enabled by AI-Driven Attacks - blog.knowbe4.com
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure - thehackernews.com
Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution - thehackernews.com
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads - thehackernews.com
Hackers poison arrayref Rust crate to push infostealer malware - bleepingcomputer.com
CISA warns of hackers exploiting critical MLflow vulnerability - bleepingcomputer.com
MLflow Vulnerability Exploited for Cloud Credential Theft - securityweek.com
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers - thehackernews.com
Citrix urges admins to patch new NetScaler flaws as soon as possible - bleepingcomputer.com
Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler - securityweek.com
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution - thehackernews.com
Critical Zimbra RCE flaw now actively exploited in attacks - bleepingcomputer.com
Hackers Target Zimbra Servers in Active Exploitation Campaign - securityweek.com
Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities - securityweek.com
Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities - securityweek.com
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE - thehackernews.com
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands - thehackernews.com
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts - thehackernews.com
CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities - securityweek.com
Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks - darkreading.com
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure - thehackernews.com
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More - thehackernews.com
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - research.checkpoint.com
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud - thehackernews.com
Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments - thehackernews.com
CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification - thehackernews.com
How MSPs can catch phishing attacks email filters miss - bleepingcomputer.com
New CUSTODY Framework Constrains AI Agents Inside the Network - darkreading.com
OpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training Pauses - securityweek.com
Twitch wants your content for Amazon AI training. Here’s how to opt out - malwarebytes.com

Cybersecurity Brief – 2026-08-04

Tue, 04 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

The Police National Legal Database (PNLD) in the UK suffered a cyberattack resulting in the exposure and dark web publication of contact information for over 100,000 police officers, government employees, and criminal justice professionals ^[10]^[16].
A cyberattack targeted Liechtenstein’s Register of People Behind Companies and Foundations, impacting a registry used for anti-money laundering and counter-terrorism efforts ^[31].
Brinks Home disclosed a data breach with hackers leaking files, though alarm monitoring and system functionality were reportedly unaffected ^[35].
River Bank confirmed that data stolen in a June ransomware attack was subsequently deleted by the attackers, with investigations ongoing ^[32].
Brazilian educational institutions have experienced multiple security incidents, as detailed in a new analysis of response cases ^[1].

Newly Discovered Vulnerabilities

An authentication bypass vulnerability (CVE-2026-18577) in N-able N-central remote monitoring and management servers has been exploited in the wild, allowing attackers to gain administrator access. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, and N-able has released patches following reports of active exploitation and patch bypasses ^[3]^[15]^[19]^[34].
Recent vulnerabilities in SonicWall SMA 1000 VPN appliances have been exploited by ransomware actors for root access and lateral movement within victim networks ^[6]^[36].

Notable Threat Actor Activity

The INC Ransomware operation has emerged as the leading group exploiting SonicWall SMA 1000 vulnerabilities, using these flaws for initial access and subsequent ransomware deployment ^[6]^[36].
Russian threat actor Midnight Blizzard (APT29) has been linked to a global campaign targeting hospitality Wi-Fi networks, using custom malware to breach Microsoft 365 accounts ^[11].
A Chinese-speaking threat actor is using a leaked version of the DarkSword exploit kit to deploy GHOSTBLADE malware targeting Apple iOS devices ^[9].
Another Chinese threat actor weaponized the Deepseek AI agent to attack a security firm, attempting proxyjacking across over 1,200 hosts ^[22].
Eighteen malicious npm packages have been discovered delivering a cross-platform remote access trojan (RAT) to users of Alibaba developer tools ^[4].
The ExfilSquad hacking group leaked information for over 100,000 UK police officers and staff following the PNLD breach ^[16].
Fake Roblox Xeno Executor installers are being used to distribute infostealer and RAT malware to Roblox players ^[14].

Trends, Tools, or Tactics of Interest

Device code phishing attacks have increased by 1,500 percent in 2026, with vishing incidents doubling, reflecting the rise of social engineering techniques that bypass traditional security controls ^[18].
A new Russian loader-as-a-service, DOUBLECUP, uses ClickFix techniques to hide malware in browser cache images, delivering payloads to both Windows and macOS devices ^[13].
Threat actors are increasingly abusing trusted platforms and supply chains, including npm packages and Google Password Manager’s passkey sync, to compromise user accounts and systems ^[4]^[5]^[12]^[26].
Researchers have identified three new “Pass-ta-key” attacks that allow malware on compromised Windows devices to hijack Google-synced passkeys, bypassing user verification ^[5]^[12].
The BTMOB Android RAT ecosystem has grown into a fragmented underground business with resellers, source-code vendors, and custom versions ^[17].
AI platforms such as Claude, Codex, and Cursor are being integrated into security operations for detection writing, investigation, and response ^[8]^[21]^[26].
New tools for tracing the origins of AI-generated videos have been developed, aiming to improve detection and attribution of deepfakes ^[20].
WhatsApp and TikTok-related scams continue, with social engineering targeting account takeover and delivering unwanted applications or fraudulent charges ^[38]^[39].

Regulatory or Policy Developments Affecting the Security Industry

The European Union has begun enforcement of key provisions of the AI Act, requiring increased transparency for chatbots, deepfakes, and other consumer-facing AI systems ^[40].
California launched the Delete Request and Opt-out Platform (DROP), enabling residents to send mass deletion and opt-out requests to registered data brokers ^[41].
New York awarded $9 million in grants to enhance cybersecurity at 153 water systems in response to ongoing threats to water and wastewater infrastructure ^[28].
Visa announced the acquisition of fraud intelligence firm BioCatch for $2.4 billion to strengthen account takeover and fraud prevention capabilities for financial institutions ^[30].

Sources

PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web - thehackernews.com
ExfilSquad hackers leak info of over 100,000 UK police officers, staff - bleepingcomputer.com
Cyberattack Hits Liechtenstein’s Register of People Behind Companies and Foundations - securityweek.com
Brinks Home Discloses Data Breach as Hackers Leak Files - securityweek.com
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack - securityweek.com
An analysis of incidents at Brazilian educational institutions - securelist.com
CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises - thehackernews.com
N-able warns of N-central auth bypass flaw exploited in attacks - bleepingcomputer.com
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers - darkreading.com
N‑able Patches Vulnerability Exploited to Hack N-central Servers - securityweek.com
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws - thehackernews.com
Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks - securityweek.com
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts - bleepingcomputer.com
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS - thehackernews.com
Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm - darkreading.com
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users - thehackernews.com
Fake Roblox Xeno script launcher pushes infostealer, RAT malware - bleepingcomputer.com
Device Code Phishing Up 1,500% in 2026; Vishing Doubles - darkreading.com
New DOUBLECUP ClickFix service hides malware in browser cache images - bleepingcomputer.com
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts - thehackernews.com
New Pass-ta-key attacks let malware hijack Google-synced passkeys - bleepingcomputer.com
What cybersecurity experts are talking about in 2026 - virusbulletin.com
Inside the Underground Business of the Android BTMOB RAT malware - bleepingcomputer.com
FOMO in the SOC: Where AI Platforms like Claude Actually Fit - thehackernews.com
Anthropic: Claude Attacks Result of Security Gaps, Not Model Issues - darkreading.com
New Tool Traces AI Videos Back to Their Source - darkreading.com
WhatsApp account takeover scam asks you to “vote for my friend” - malwarebytes.com
“Adult TikTok” searches lead to scams - malwarebytes.com
The AI Act kicks into action, forces companies to be clear about AI chatbots - malwarebytes.com
Californians can tell data brokers to DROP their information - malwarebytes.com
New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems - securityweek.com
Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion - securityweek.com