Weekly Recap — 2026-07-06 -> 2026-07-13
Developer Supply Chains Under Siege as Auth Protocols Betray Trust This week's dominant story is the systematic poisoning of software development supply chains. Attackers published malicious packages across npm, PyPI, NuGet, and Go repositories impersonating legitimate payment SDKs, cryptocurrency tools, and code protection utilities — the PaySafe/Skrill typosquat campaign harvested developer secrets, the Injective SDK compromise exfiltrated cryptocurrency wallet keys and mnemonics, and the jscrambler supply chain attack delivered a Rust-built infostealer targeting cloud credentials and AI assistant configs. A GitHub lure network of 222 fake repositories and a Braintree NuGet typosquat intercepting live credit card data rounded out an assault on the trust foundation modern software relies on. Authentication protocols themselves became the attack surface. The Railway device-code phishing campaign and the EvilTokens PhaaS platform abuse Microsoft's OAuth device-authorization flow so victims complete real MFA on genuine Microsoft pages while attackers capture tokens valid for 90 days, while the LSHIY campaign used the legacy ROPC flow to bypass Conditional Access policies entirely. On the infrastructure side, CitrixBleed 2 (CVE-2025-5777) steals active session tokens from NetScaler gateway memory, and researchers demonstrated how ADFS ghost signing keys hidden in Machine DPAPI can forge administrator-level SAML assertions without touching LSASS. Defenders should immediately audit package dependencies for typosquatted or compromised versions, rotate developer secrets and cryptocurrency wallet credentials that may have been exposed, and review Microsoft 365 Conditional Access policies to block device-code flows and legacy authentication protocols where they are not business-required.
Detection / Hunteropenrouter
By the Numbers
- Total articles: 41
- By severity: Critical: 8, High: 26, Informational: 1, Low: 2, Medium: 4
- By category: APT: 3, data breach: 2, general security news: 4, malware: 14, phishing/social engineering: 3, threat actor: 6, vulnerability: 9
Top Threats
Software Supply Chain Poisoning
Attackers compromised the software development pipeline at every layer this week, publishing malicious packages across npm, PyPI, NuGet, and Go repositories that impersonated payment SDKs, cryptocurrency tools, and code-protection utilities. The jscrambler compromise and Braintree NuGet typosquat demonstrate that install-time execution is no longer the only risk — later-stage injection into distribution files and runtime method hooking now evade script-only scanners and intercept live payment card data directly from application code.
- https://socket.dev/blog/npm-pypi-campaign-typosquats-popular-secure-payment-apps
- https://socket.dev/blog/compromised-injective-sdk-npm-package
- https://socket.dev/blog/braintree-nuget-typosquat-skims-credit-cards
- https://socket.dev/blog/jscrambler-supply-chain-attack
- https://socket.dev/blog/malicious-go-module-exposes-github-malware-lure-network
- https://asec.ahnlab.com/en/94417/
- https://www.elastic.co/security-labs/mexican-banking-fraud-scmbanker-ref6045
Authentication Protocol Abuse and Token Theft
Rather than cracking credentials, attackers exploited the mechanics of authentication protocols themselves. Device-code phishing campaigns trick victims into completing real MFA on genuine Microsoft infrastructure while attackers capture OAuth tokens, the ROPC flow bypasses Conditional Access by targeting the token endpoint directly, and CitrixBleed 2 reads session cookies from gateway memory — each technique subverts a different trust assumption that MFA policies rely on.
- https://securelist.com/microsoft-device-code-phishing-attack/120350/
- https://www.huntress.com/blog/conditional-access-misconfigurations
- https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomware
- https://cloud.google.com/blog/topics/threat-intelligence/recovering-active-adfs-signing-keys-machine-dpapi/
- https://any.run/cybersecurity-blog/usa-top-30-threats-2026/
Critical Vulnerability Surge and Active Exploitation
Q2 2026 saw a 62.5% jump in critical CVEs with exploitation timelines compressing further, while June alone produced 60 high-impact vulnerabilities including 23 already on CISA's KEV catalog. The Roundcube XSS-to-RCE chain under active exploitation by UNK_MassTraction and the CitrixBleed 2 session-token leak illustrate how n-day chaining on externally exposed services now provides APTs with a productized path from initial access to persistent network pivot.
- https://asec.ahnlab.com/en/94360/
- https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation
- https://www.akamai.com/blog/security-research/2026/jul/adobe-coldfusion-critical-path-traversal-cve-2026-48282
- https://www.recordedfuture.com/blog/june-2026-cve-landscape
- https://cyber.gc.ca/en/daily-digest/2026-07-07
- https://cyber.gc.ca/en/daily-digest/2026-07-08
- https://cyber.gc.ca/en/daily-digest/2026-07-09
- https://cyber.gc.ca/en/daily-digest/2026-07-10
- https://blog.talosintelligence.com/wolfssl-vulnerabilities/
Ransomware Defense Evasion Escalation
Ransomware operators escalated defense evasion to the kernel level this week. GodDamn ransomware deploys the Microsoft-signed PoisonX driver to terminate security processes and strip user-mode API hooks at the deepest OS layer, while GigaWiper merges a wiper, fake ransomware that deliberately discards decryption keys, and VNC-like remote control into a single modular implant — blurring the line between extortion and pure destruction.
- https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand
- https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
- https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomware
- https://asec.ahnlab.com/en/94390/
- https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/
AI-Powered Attack Tooling and AI Platform Vulnerabilities
AI is collapsing the cost of sophisticated attacks on both sides of the equation. PromptSpy became the first Android malware leveraging generative AI to adapt its UI manipulation across devices, SCMBANKER's banking-fraud scripts show strong LLM-generation artifacts, and CrowdStrike documented 18 new prompt-injection techniques including dormant trigger-activated instructions that evade review-time detection — while the Dialogflow Rogue Agent vulnerability showed how shared cloud-run execution environments in AI platforms can be hijacked to steal service-account tokens and inject phishing prompts.
- https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-prompt-injection-techniques/
- https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/
- https://www.elastic.co/security-labs/mexican-banking-fraud-scmbanker-ref6045
- https://www.varonis.com/blog/rogue-agent-dialogflow-attack
- https://www.akamai.com/blog/security/2026/jul/adaptive-ai-detecting-modern-dga-attacks
Trending CVEs
- CVE-2024-42009 (2 mentions) — Roundcube webmail XSS vulnerability actively exploited by UNK_MassTraction to obtain credentials for chaining with CVE-2025-49113 RCE; listed on CISA KEV catalog. Sources: 1, 2
- CVE-2025-49113 (2 mentions) — Critical post-auth PHP deserialization RCE in Roundcube webmail with published proof-of-concept and confirmed active exploitation; chained with CVE-2024-42009 for full server compromise. Sources: 1, 2
- CVE-2025-5777 (1 mentions) — CitrixBleed 2 pre-auth memory overread in NetScaler ADC/Gateway leaking ~127 bytes of heap memory per request including valid session tokens; weaponized by IAB into seven-step ransomware playbook. Sources: 1
- CVE-2026-48282 (1 mentions) — Ongoing critical unauthenticated path traversal in Adobe ColdFusion RDS FILEIO handler enabling arbitrary file read/write and RCE — continuing from prior week's coverage. Sources: 1
- CVE-2026-1207 (1 mentions) — Django vulnerability under confirmed active exploitation in the wild, affecting versions prior to 4.2.28, 5.2.11, and 6.0.2. Sources: 1
- CVE-2025-55182 (1 mentions) — React2Shell vulnerability (CVSS 10.0) in Meta React Server Components/Next.js exploited by Lazarus Group to deploy COPPERHEDGE and EtherRAT via dependency confusion and compromised PoC code. Sources: 1
- CVE-2026-10520 (2 mentions) — Ongoing critical RCE in Ivanti Sentry with active exploitation and public PoC — continuing from prior weeks. Sources: 1, 2
- CVE-2026-35616 (2 mentions) — Actively exploited RCE in Fortinet FortiClient EMS linked to EKZ information-stealing malware delivery; Nuclei template created by Insikt Group. Sources: 1, 2
- CVE-2026-55255 (1 mentions) — IDOR vulnerability in Langflow /api/v1/responses endpoint allowing authenticated attackers to access another user's flow; added to CISA KEV indicating active exploitation. Sources: 1
- CVE-2026-34908 (2 mentions) — Actively exploited lack of access control in Ubiquiti UniFi OS allowing settings changes without administrator authentication. Sources: 1, 2
Sector Trends
- Financial Services — Latin American banking customers faced coordinated fraud campaigns this week, with Banana RAT targeting Brazilian financial sessions and SCMBANKER automating Mexican banking fraud through clipboard hijacking and vishing overlays. Payment processing ecosystems were hit from the developer side too, as typosquatted Braintree and PaySafe SDK packages intercepted live credit card data and merchant credentials directly from application code. Sources: 1, 2, 3, 4, 5
- Education and Research — University physics and engineering departments with ties to national security research became the primary target of China-nexus espionage this week, as UNK_MassTraction exploited Roundcube webmail vulnerabilities to steal credentials and deploy backdoors on mail servers treated as network pivot points. Sources: 1, 2
- Government and Law Enforcement — Rival China-nexus and India-nexus espionage actors independently compromised Pakistani law enforcement infrastructure, converging on the Balochistan Police to access biometric records, criminal case files, and citizen complaint data — with one actor weaponizing the police complaint portal itself to deliver malware to both officers and citizens. Sources: 1
- Software Development — Developers were the direct target of multiple supply chain attacks this week, as malicious packages across npm, PyPI, NuGet, and Go repositories stole cloud credentials, cryptocurrency wallets, payment card data, and AI assistant configurations from build systems and developer machines. Sources: 1, 2, 3, 4, 5
Notable Incidents
- CitrixBleed 2 Weaponized into Seven-Step Ransomware Playbook — An initial access broker productized CVE-2025-5777 exploitation into a consistent seven-step playbook from session token theft through privilege escalation via registry symbolic-link LPE, backdoor admin accounts, rogue RMM installation, and DragonForce ransomware deployment — demonstrating how gateway vulnerabilities now carry a direct path to full organizational encryption in under an hour.
- Roundcube XSS-to-RCE Chain Exploited Against University Physics Departments — UNK_MassTraction chained CVE-2024-42009 with CVE-2025-49113 to turn university mail servers into edge devices for network pivot, deploying the LLM-assisted IceCube credential stealer and VShell backdoor — treating email infrastructure as equivalent to VPN gateways for persistent access to departments tied to national security research.
- jscrambler npm Compromise Delivers Rust Infostealer Targeting Developer Secrets — Compromised versions of a legitimate code-protection package delivered a sophisticated Rust-built cross-platform infostealer targeting crypto wallets, cloud credentials (AWS/GCP/Azure), and AI assistant configs (Claude, Cursor, Windsurf) — later versions evolved to evade script-only scanners by injecting droppers into distribution files rather than using preinstall hooks.
- GodDamn Ransomware Deploys Microsoft-Signed PoisonX Kernel Driver — Hyadina's latest ransomware rebrand uses a kernel driver carrying a legitimate Microsoft digital signature to terminate security product processes and remove user-mode API hooks at the deepest OS level — rendering endpoint protection blind during the encryption phase and representing a significant escalation in defense evasion.
- GigaWiper Combines Destructive Wiper with Fake Ransomware That Discards Decryption Keys — This Golang modular implant merges three separate malware families into one tool that encrypts files with random keys never saved — meaning victims cannot recover data even if they pay — while also offering VNC-like remote control and multi-pass secure disk wiping, blurring the line between ransomware and pure destruction.