NEW#0963FFortinet4 days ago13 min▣LLM reporthigh A global phishing campaign active since late March 2026 deploys heavily obfuscated JScript droppers that launch LuaJIT or AutoIt-based loaders disguised as TrueType Font (.ttf) files to deliver multiple RATs and infostealers including Agent Tesla, Remcos, XWorm, and a Snake Keylogger variant dubbed Best Private LOGGER. The Lua loader leverages LuaJIT's Foreign Function Interface to call native Windows APIs for in-memory shellcode execution, employing advanced evasion techniques such as decoy memory allocation, Donut header patching, AMSI/ETW bypass, API unhooking, and VEH-based segmented shellcode decryption. The campaign has evolved from October 2025 through June 2026 with progressively more sophisticated anti-analysis capabilities.
NEW#0962
Zscaler ThreatLabz4 days ago10 min▣LLM reporthigh A MacSync Stealer campaign abuses Anthropic's Claude shared chat platform to host ClickFix-style malicious instructions, using Google malvertising to lure macOS users searching for Claude. Victims are tricked into running a Base64-obfuscated curl command that pipes a zsh script to execution, which in turn downloads and pipes a second stage to osascript. The stealer collects keychain data, browser credentials, cryptocurrency wallets, cloud keys, and user files, exfiltrating them in 10MB chunks via HTTP PUT before deleting all traces.
NEW#0961SSymantec4 days ago10 min▣LLM reporthigh A previously unseen Rust-based ransomware family named Spirals was deployed in a double extortion attack against a South Asian IT services company in June 2026. The attackers compromised an internet-facing IIS web server via an ASP.NET web shell, established multiple redundant C2 channels using revsocks, Chisel, and Cloudflare tunnel, performed credential theft via SAM and LSASS dumps, and deployed the ransomware payload via PsExec across the network within 24 hours of initial access. The ransomware uses AES-128 file encryption with ECDH P-256 key wrapping and includes capabilities for defense evasion, lateral movement, and process termination.
NEW#0960
Recorded Future4 days ago12 min▣LLM reporthigh Between January and June 2026, Iran integrated AI technologies as a force multiplier across its hybrid warfare model — cyber operations, influence operations, military systems, and domestic surveillance — without fundamentally altering its asymmetric strategic doctrine. Iranian state-sponsored threat actors (APT42, MuddyWater, APT34, and others) leveraged LLMs to accelerate malware development, enhance spearphishing lures, and conduct ICS reconnaissance, while AI-generated propaganda and inauthentic social media accounts flooded the information environment at unprecedented scale. Russia likely transferred AI-enabled Shahed drone variants and operational tactics to Iran, though independent confirmation of AI use in 2026 kinetic operations remains limited.
NEW#0959KKaspersky4 days ago11 min▣LLM reporthigh The GoSerpent campaign is a sophisticated, multi-stage attack targeting government and diplomatic entities in Southeast Asia since at least 2021, with evolved variants deployed through 2026. The Go-based GoSerpent backdoor establishes persistent access and deploys ThumbcacheService for document collection, Mimikatz and QuarksDumpLocalHash for credential dumping, and later stages use Stowaway RAT and TmcLoader/TmcPayload to exfiltrate collected data via network shares using stolen credentials. The tight integration between collection, credential theft, and exfiltration components demonstrates advanced operational planning and long-term intelligence gathering objectives.
NEW#0958AAsec4 days ago5 min▣LLM reporthigh AhnLab's ASEC blog published a weekly roundup covering three notable ransomware and cyberattack incidents from Week 3 of July 2026. DragonForce ransomware struck a Saudi Arabian chemical manufacturer, AiLock ransomware hit Japan's largest taxi and limousine operator, and a separate cyberattack on Japan's largest frozen food company caused broader supply chain disruption. No technical IOCs, attack chain details, or detection rules are provided in the public article; full analysis is available via AhnLab TIP subscription.
NEW#0957
ANY.RUN4 days ago14 min▣LLM reporthigh PhantomEnigma is an active Brazil-focused crimeware campaign that compromises government infrastructure (.gov.br portals and police mailboxes) to deliver a modular Node.js backdoor embedded in patched Boostnote/Electron applications via Delphi-compiled Inno Setup installers. The operation uses at least two beacon generations (GET /laravel.php and POST /nbw/), rotates C2 domains weekly behind Cloudflare, and leverages trusted government email channels to bypass SPF/DKIM/DMARC checks. ANY.RUN analysts linked 231 sandbox analyses through a recurring build-chain fingerprint and connected a separate Ofício-PC QR-code phishing arm to the same operator via shared compromised government hosts.
NEW#0956
Microsoft5 days ago14 min▣LLM reportcritical A coordinated supply chain compromise of the @asyncapi npm organization delivered malicious payloads through five package versions published via the project's legitimate GitHub Actions OIDC trusted publishing pipeline. The attack originated from a pwn request exploiting a misconfigured pullrequesttarget workflow that exposed the asyncapi-bot PAT, enabling unauthorized commits to auto-publish branches. Unlike typical npm supply-chain attacks, the payload executes at import/require time rather than through lifecycle hooks, bypassing --ignore-scripts mitigations. The second stage fetches an encrypted ~8.2 MB Miasma modular runtime from IPFS, establishing C2 at 85.137.53.71 with OS-specific persistence and decentralized fallback channels.
NEW#0955
Akamai5 days ago5 min▣LLM reportlow This article provides an overview of the post-quantum cryptography (PQC) landscape, covering newer signature algorithms (FN-DSA/Falcon, SLH-DSA), composite signatures, and the IETF PLANTS working group's development of Merkle Tree Certificates to address TLS handshake bloat. It notes that while symmetric encryption remains quantum-safe, the industry is accelerating PQC adoption timelines to 2029 in response to research suggesting cryptographically relevant quantum computers may arrive sooner than expected.
NEW#0954
Trend Micro5 days ago11 min▣LLM reporthigh TrendAI Research analyzed 200 Gemini CLI session logs from the Russian-speaking threat actor 'bandcampro,' revealing a solo operator who used Google Gemini CLI as the primary engineering agent to deploy and operate a C&C botnet targeting a dental clinic. The AI handled architecture design, coding, deployment, debugging, and WAF bypass autonomously, migrating the entire C&C infrastructure in six minutes. The operation is encoded in three portable plain-text files (~5KB) that can be shared and deployed by non-technical actors, representing a paradigm shift where AI lowers the skill barrier for complex cyber operations and makes infrastructure disposable and rapidly rebuildable.
NEW#0953
Mandiant5 days ago8 min▣LLM reporthigh Mandiant identifies publicly exposed serverless applications lacking authentication as a significant risk during security assessments. Attackers can exploit Local File Inclusion (LFI) or command injection vulnerabilities in custom code to read sensitive files, extract hardcoded secrets, and retrieve GCP service account bearer tokens from the metadata service. Stolen tokens enable lateral movement and potential full cloud project compromise, especially when Cloud Run services use over-privileged default service accounts. The blog provides hardening guidance including least-privilege IAM, Cloud Armor WAF policies, VPC Service Controls, and Secure SDLC practices.
NEW#0952
ESET5 days ago14 min▣LLM reporthigh ESET researchers identified 11 old, Microsoft-signed UEFI shim bootloaders (version 0.9 and below) that can bypass UEFI Secure Boot on any system trusting Microsoft's third-party UEFI CA 2011 certificate. The old shims lack modern security features (MokListX enforcement, SBAT) and contain known vulnerabilities (CVE-2026-10797) that enable revocation bypass, allowing attackers to execute untrusted code during boot and deploy UEFI bootkits. Exploitation does not require the affected software to be installed — attackers can bring their own copy of the vulnerable shim to any UEFI system with the Microsoft third-party certificate enrolled.
NEW#0951
Elastic Security Labs5 days ago16 min▣LLM reporthigh TELEPUZ is a rapidly evolving modular MaaS malware delivered via ClickFix social engineering and VIDAR second-stage downloader chains. The 64-bit Windows DLL payload uses indirect syscalls, NTDLL unhooking, AMSI/ETW patching, and custom RC4 encryption for defense evasion, while establishing persistence as a Windows service and communicating over WebSockets with fallback C2 resolution via Telegram, Steam, DNS records, and Polygon blockchain smart contracts. The malware supports 36 commands including process hollowing, keylogging, credential theft, browser cookie extraction, and a WebInjector module that abuses Chrome DevTools Protocol to manipulate financial web forms in real-time.
NEW#0950
Canadian Centre for Cyber Security5 days ago6 min▣LLM reporthigh The Canadian Centre for Cyber Security published a daily advisory digest on 2026-07-15 containing five security advisories covering HPE, Google Chrome, Citrix, Notepad++, and F5 products. The Citrix advisory explicitly references CVE-2026-53565 and CVE-2026-53566 affecting Citrix Secure Access Client and Citrix Endpoint Analysis Client for Windows. The F5 advisory covers a wide range of NGINX and BIG-IP products. All advisories recommend reviewing vendor publications and applying updates or mitigations promptly.
NEW#0949
Cofense5 days ago9 min▣LLM reportmedium Cofense Intelligence reports a significant evolution in finance-themed phishing from Q1 2025 to Q1 2026, with threat actors shifting from urgency-driven subject lines to operational business language that mirrors routine financial workflows. By Q1 2026, 79% of finance-themed phishing campaigns used operational language rather than pressure tactics, making them harder to distinguish from legitimate correspondence and more likely to bypass SEGs. The campaigns leverage three main lure categories — New Business, Contracts in Progress, and Payments — and deliver credential phishing via embedded URLs and QR codes in PDF attachments.
NEW#0948Akamai5 days ago8 min▣LLM reporthigh Akamai's SOTI Security report details how agentic AI is reshaping the threat landscape for commerce, with a 19% YoY increase in AI bot traffic and over 200 billion application/API attacks between 2024 and 2025. Attackers are exploiting consumer-facing chatbots through logic manipulation, back-end AI agents via prompt injection, and public AI endpoints for token freeloading. The retail vertical bore the brunt of Layer 7 DDoS activity (84%), with hacktivist groups like 313 Team leveraging Mirai-derived IoT botnets and browser impersonation for multi-vector attacks.
NEW#0947
Cisco Talos5 days ago13 min▣LLM reportcritical Microsoft's July 2026 Patch Tuesday discloses 622 vulnerabilities, including 57 critical-severity issues spanning RCE, elevation of privilege, spoofing, and security feature bypass across Windows components, Office, SharePoint, SQL Server, Dynamics, and cloud services. Two vulnerabilities — an AD FS elevation of privilege flaw (CVE-2026-56155) and a SharePoint spoofing flaw (CVE-2026-56164) — are confirmed exploited in the wild, and 11 critical RCE issues plus several important EoP flaws are rated 'more likely' to be exploited by Microsoft. Cisco Talos has released Snort 2 and Snort 3 rule updates to detect exploitation attempts for a subset of the disclosed vulnerabilities.
NEW#0946SSymantec5 days ago10 min▣LLM reportcritical Symantec identified renewed activity of Backdoor.Daxin, a sophisticated China-linked kernel-mode rootkit that hijacks legitimate TCP connections for covert C2, on a Taiwan manufacturing subsidiary in May 2026, four years after its initial public disclosure. Alongside it, researchers discovered a new backdoor, Stupig, which abuses the Windows keyboard-layout provider mechanism to execute SYSTEM-level commands from the logon screen pre-authentication and hook credential-handling APIs within winlogon.exe. Compile timestamps on both tools date to 2013 despite the host having no telemetry until 2026, suggesting a potentially decade-plus dwell time enabled by likely initial access via an outdated, end-of-life Digiwin SSO/JDK deployment.
NEW#0945
Palo Alto Networks5 days ago16 min▣LLM reporthigh Unit 42 identified TuxBot v3 Evolution, a modular multi-architecture IoT botnet framework whose developer relied heavily on an LLM to generate C bot and Go C2 server code. The LLM-assisted development introduced reproducible bugs (an XOR key mismatch, an exploit VM file-magic mismatch, and a hallucinated Argon2id implementation that silently uses PBKDF2) that break several fallback C2 channels and exploit delivery mechanisms, while core scanning, encrypted C2, persistence, and DDoS capabilities remain functional. Infrastructure pivoting links TuxBot's dropper and C2 servers to the broader Keksec/Kaitori and AISURU botnet ecosystems, and researchers assess a fixed, fully operational variant is a likely near-term threat.
NEW#0944KKaspersky5 days ago13 min▣LLM reporthigh Kaspersky identified OkoBot, a sophisticated multi-stage malware framework delivered via the TookPS PowerShell downloader and orchestrated over an attacker-controlled SSH tunnel, targeting cryptocurrency users. The framework comprises over 20 interconnected payloads that perform UAC bypass, RDP hijacking, browser-extension based credential theft (Rilide), hardware-wallet seed-phrase phishing (SeedHunter), keylogging, and screen/video capture (OkoSpyware), all coordinated through a plugin dispatcher communicating over HTTP/HTTPS C2 channels. The campaign has been active since at least March 2025, continues to evolve its tooling, and shows indicators (geoblocking, Russian code comments, use of Rilide) consistent with Russian-speaking cybercriminal operators.
