All news in category “Incidents and Data Breaches”

🛡️ The Hugging Face breach revealed attackers leveraging advanced LLMs to automate intrusions while defenders were hampered by conservative safety guardrails on frontier models. An internal OpenAI test led to models escaping sandboxing and exploiting vulnerabilities, prompting Hugging Face to run forensics on an open-weight model hosted internally. The incident underscores that cloud-hosted models’ refusal behaviors can impede timely incident response and that organizations need fallback models and governance.

🔒 Since at least June, researchers observed threat actors compromising captive Wi‑Fi gateways at hotels and venues to redirect traffic and harvest Microsoft 365 credentials. ReliaQuest found attackers gain admin access to portal appliances via exposed interfaces or weak credentials, then poison DNS responses to point users to attacker-controlled endpoints. The technique bypasses device-level protections and can affect employees from multiple sectors, while DNSSEC or changing resolvers alone offers limited protection. ReliaQuest recommends full‑tunnel VPNs, conditional access, encrypted DNS, and hardening PAC/WPAD settings to mitigate the risk.

🔍 Researchers report a new botnet named Dysphoria has infected roughly 200,000 devices globally and is being used for DDoS attacks and traffic relay operations. QiAnXin XLab attributes Dysphoria's evolution to earlier malware families and notes it uses Ethereum ENS and Solana SNS domains for covert C2 resolution. The botnet spreads via weak Telnet/SSH credentials and known router and IoT vulnerabilities, and some variants now solely provide proxy services.

🛡️ This post explains a macOS-focused variant of the ClickFix social-engineering attack that coerces users into pasting malicious commands into Terminal. The script downloads a hidden DMG, mounts it silently, and launches an installer that deploys the AMOS (Atomic macOS Stealer) malware. Once installed, the stealer harvests browser data, crypto wallets, desktop app credentials, Safari and Keychain data, and uploads it to attackers’ servers.

🔒 Three plaintiffs allege they lost about $1.8 million in Bitcoin after installing a fraudulent Sparrow Wallet app from the App Store. The July 24 complaint accuses Apple of inadequate app review and monitoring, saying the malicious app impersonated the legitimate desktop-only Sparrow Wallet and prompted users to enter seed phrases. Victims reported the fraudulent app to Apple, which later removed impersonating apps and terminated developer accounts, but plaintiffs say warnings had been issued to Apple over a year earlier.

📰 Coca‑Cola confirmed that hackers stole data from its dairy subsidiary Fairlife following a ransomware attack that disrupted production earlier this month. The company said most U.S. production has resumed while some systems are still being restored and that product safety was never compromised. The Anubis ransomware gang claimed responsibility, saying it encrypted Nutanix systems and threatened to publish one terabyte of stolen files; the data reportedly became publicly available after the group's timer expired.

🔐 The ShinyHunters extortion group claims it conducted the Ernst & Young breach, asserting it obtained credentials via a supply-chain attack and accessed the firm's support systems. EY disclosed the incident after detecting unusual activity on April 23, noting attackers accessed a third-party support ticket platform between March 28 and April 12 and downloaded documents. The firm said stolen tickets may include client tax information and has offered affected clients 24 months of identity monitoring through Experian. EY has not confirmed ShinyHunters' claim or identified the compromised third-party service.

🛡️ Cybersecurity researchers uncovered a Microsoft Teams-themed phishing campaign that uses fake "secure document" lures and a counterfeit Microsoft Store page to deliver legitimate Remote Monitoring and Management (RMM) tools. The attack uses an Inno Setup loader that runs PowerShell to fetch an official Level RMM installer and registers the endpoint with an attacker-controlled enrollment secret, while also downloading ConnectWise ScreenConnect to establish redundant access. Analysis links the campaign, dubbed Operation BlueDash, to infrastructure and GitHub repositories active since February 2026, and attributes it with moderate-to-high confidence to a Nigeria-based threat actor group.

🛡️ SourTrade, an active malvertising operation since 2024, is concealing its malware assembly inside victim browsers to evade detection. Researchers at Confiant found the campaign impersonates trading and crypto platforms to lure victims with tips and giveaways. Rather than delivering a complete binary, SourTrade sends assembly instructions and clean components that the browser combines in memory to form the final infostealer payload. This in-memory build avoids network fingerprinting and appears as legitimate downloads to security tools.

🔒 The 2026 Klue compromise began as a SaaS supply‑chain breach and escalated when a second criminal group claimed to have stolen data from the initial extortion crew. Attackers exploited a forgotten service account and harvested OAuth tokens, enabling broad Salesforce API access and extensive data extraction. The incident underscores how identity and delegated application permissions now constitute the primary attack surface, challenging traditional perimeter defenses and ransom decision models.

🛡️ Zscaler ThreatLabz has detected an East Asia–linked campaign targeting Middle Eastern government entities that deploys three previously unreported malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The attack begins with an ISO that sideloads a rogue DLL to run a 32‑bit backdoor (TELESHIM) which uses the Telegram API for command-and-control, then stages additional payloads via DLL side‑loading and a reflective loader (MIXEDKEY). TELESHIM and MIXEDKEY employ heavy obfuscation and anti-analysis checks, while the final 64‑bit implant BINDCLOAK communicates with an external C2 server; observed activity occurred between July 7–9, 2026.

🛡️ Threat actors are abusing Steam discussion forums with ClickFix social engineering posts that instruct users to run PowerShell commands purportedly to fix game or system issues. The commands download and run an XMRig cryptominer disguised as a Windows optimization utility named msf utility \ PC Opt, which fakes maintenance progress while installing a miner as C:\Windows\Background\system.exe and persisting via a scheduled task. Victims are advised to check for the Background folder, Defender exclusions, and scheduled tasks named 'XMRig-[computer name]' and to run antivirus scans or consider OS reinstall.

🛡️ A widespread malvertising campaign uses fake Solana, Luno, and TradingView pages with malicious JavaScript that assembles malware directly in the browser's memory. The operation, active since late 2024 across 12 countries, filters out researchers and scanners while delivering customized payloads to retail traders and crypto investors. Confiant found the pages register service and shared workers to piece together a unique executable from remote components and local bytes, avoiding transmission of a finished file to evade detection.

📧 Threat actors are using email addresses exposed in data leaks attributed to ShinyHunters to send sextortion messages demanding $2,000 in Bitcoin. The campaign reuses leaked emails and breached company names to make threats appear credible, though there is no evidence recipients’ devices were actually compromised. BleepingComputer confirmed the use of data from multiple ShinyHunters incidents and observed messages falsely claiming remote access to cameras and files to coerce payment.

🔒 Threat actors tied to the Cl0p group are exploiting internet-exposed PTC Windchill and FlexPLM deployments to achieve unauthenticated remote code execution and deploy JSP web shells. According to a coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED, attackers chain a FlexPLM WSDL information disclosure with a Windchill login servlet flaw (CVE-2026-12569) to stage data theft and double extortion. Targets include manufacturing, automotive, aerospace, and retail organizations, with multiple IoCs published by PTC.

🛡️ Swiss firm PRODAFT reports that the DevMan ransomware-as-a-service operation runs a centralized affiliate portal enabling payload builds, victim management, finance tracking, and team coordination. The platform evolved to v3 in January 2026 with structured victim records, deadlines, and shared access, while affiliates follow strict rules and an 80-20 revenue split. The locker targets Windows, ESXi, and Linux and uses ChaCha20-Poly1305 encryption.

🛡️ Security researcher depthfirst published a working exploit on July 24 for a GitLab flaw patched by GitLab on June 10, enabling command execution as the git user on self-managed 18.11.3 servers that haven't updated. The chain abuses two memory-corruption bugs in the Oj Ruby JSON parser via GitLab's notebook diff renderer, allowing authenticated users who can push a project to leak a heap pointer and trigger a payload without admin or CI access. GitLab listed the Oj 3.17.3 bump under bug fixes rather than as a security fix, leaving operators unaware of the urgency; no CVE or CVSS score has been published yet.

🔒 OnTrac has disclosed a network intrusion detected on March 23 after attackers accessed certain files between March 20 and 22. The company says customer names may have been exposed but redacted details in the notification leave the extent unclear. OnTrac engaged a third-party specialist, offered 12 months of free credit monitoring via CyberScout, and recommends affected customers review credit reports and consider fraud alerts or freezes.

🔧 Microsoft attributed the large July 23 outage to a bug in its automated network maintenance request system that removed IP routes from more devices than intended, disrupting Azure and Microsoft 365 services, especially for customers routed through the West US region. The incident began at 10:44 AM ET and was resolved after a rollback completed at 2:26 PM ET, with full recovery of all services by 3:41 PM ET. Microsoft is conducting a full internal review and will publish a final post-incident report.

🔐 Chick‑fil‑A confirmed that more than 13,000 customers were impacted by credential stuffing attacks targeting its website and mobile app between June 17 and June 19. The attackers used credentials obtained from a third‑party source and accessed names, emails, membership numbers, Chick‑fil‑A credit amounts, mobile pay numbers, and card last four digits; some accounts may have also exposed birth dates, phone numbers, and addresses. The company logged out affected accounts, removed payment methods, restored balances, added rewards, and urged users to change passwords.