All news in category “Incidents and Data Breaches”

🛡️ Barracuda researchers observed LogoKit phishing campaigns that build a unique login page for each victim in real time by pulling a live screenshot of the target organization’s website as the page background. The kit extracts the victim email from the URL, identifies the employer domain, and uses commercial services like Thum.io and Clearbit to assemble a convincing, per-victim page. Credential harvesting is routed via a Telegram bot, and victims are redirected to the genuine site, complicating detection and takedown.

🛡️ This analysis examines how threat actors abused the legitimate remote administration tool ScreenConnect in a broad malware distribution campaign. Attackers hosted convincing phishing sites that mimicked popular free utilities, bundling installers that triggered DLL sideloading to silently install ScreenConnect and deploy malicious scripts. Those scripts disabled protections, created Defender exclusions, installed AsyncRAT, and established persistence via scheduled tasks, enabling remote control and lateral movement.

🔒 A coordinated cyberattack impacted operational technology at more than 30 Minnesota community water systems on July 26–27, prompting a statewide cybersecurity response. Several municipalities, including Braham, Plymouth, South St. Paul and Maple Plain, reported outages, communications failures or affected automated controls, with Maple Plain declaring a local emergency. Minnesota IT Services (MNIT) and federal partners are investigating, sharing intelligence and working to contain and recover systems while attribution and technical details remain under investigation.

🛡️ Check Point researchers observed a widespread phishing campaign from June 25 through mid-July that impersonated Microsoft Teams notifications and directed recipients to genuine Microsoft sign-in pages. Victims were prompted to grant permissions to attacker-controlled applications, allowing abuse of the OAuth consent flow to access mail, files, Teams, SharePoint, OneDrive, and calendars. The campaign targeted roughly 120 organizations across multiple sectors and geographies before it ended.

🔒 Microsoft’s Secure Boot contained a persistent weakness for most of its lifespan, researchers found. ESET analysts discovered 11 signed firmware images, including at least one from 2013, that were defective yet remained publicly signed. These images, known as shims, were intended to extend Secure Boot to Linux and utility software but can be abused to bypass protections via UEFI. The flaw arose because Microsoft failed to revoke the vulnerable shims after the defects were identified.

🔒 Rapid7 and other researchers disclosed technical details for CVE-2026-16232, a critical authentication bypass in Check Point Security Management Server and MDS. The flaw lets an unauthenticated attacker obtain an application login token and authenticate with full administrator privileges via SmartConsole. Exploitation requires network access to the Management Server and permissive Trusted Clients configuration. Check Point released Jumbo Hotfixes on July 22, 2026, and Rapid7 published a PoC for testing.

🔒 Ransomware activity rose year over year in June and remained elevated in Q2 2026, with VPNs and other network edge devices increasingly used as initial access vectors. Threat actors like Qilin and The Gentlemen led observed incidents, while emerging groups such as KryBit drew attention for ransomware-as-a-service operations. Researchers also documented an autonomous AI agent, JadePuffer, that completed an intrusion chain and delivered a ransom demand.

🛡️ Source code for the Flying Eagle Android RAT framework is circulating on criminal Telegram channels, with Hunt.io and researcher NetAskari tracing matching control panels and certificates to 170 internet servers. The toolkit is linked to a fake Chinese Public Security app that can capture payments, keystrokes, record screens, use cameras, and display phishing prompts for finance and government services. Chinese authorities urged removal, password changes, and reporting while investigators note the server count does not prove active infections.

🔒 Lava researchers found tens of thousands of internet-exposed Baseboard Management Controllers (BMCs) vulnerable to a 2013 IPMI authentication flaw, allowing rapid access by guessing weak or factory-set passwords. BMCs provide out-of-band control of servers and often sit outside standard monitoring, enabling persistent, hard-to-detect compromises that can span shared data center and AI/GPU infrastructure. Vendors including Supermicro and HPE were among the most impacted.

🛡️ CubePilot, an Australian drone flight-controller maker, reported a DNS hijacking on July 24 that redirected traffic to attacker-controlled infrastructure and allowed issuance of TLS certificates for all cubepilot.org subdomains. The firm regained domain control the same day, revoked the fraudulent certificates, preserved evidence, and informed authorities. Critical services including OEM portals, the community forum, and documentation remain offline while the company investigates and advises caution around credentials and recent firmware downloads.

🔒 Medical billing firm Medical Computer Business Services (MCBS) disclosed a 2025 network breach that exposed data for 1,261,464 individuals. The intrusion, occurring between September 22–26, 2025, potentially exposed sensitive information including Social Security numbers, dates of birth, medical histories, and insurance identifiers. MCBS identified seven covered entities whose patient records it processed and urges affected individuals to consider fraud alerts or credit freezes. The PEAR ransomware group claims responsibility and says 3.3 TB of data was exfiltrated and leaked.

🛡️ The Hugging Face breach revealed attackers leveraging advanced LLMs to automate intrusions while defenders were hampered by conservative safety guardrails on frontier models. An internal OpenAI test led to models escaping sandboxing and exploiting vulnerabilities, prompting Hugging Face to run forensics on an open-weight model hosted internally. The incident underscores that cloud-hosted models’ refusal behaviors can impede timely incident response and that organizations need fallback models and governance.

🔒 Since at least June, researchers observed threat actors compromising captive Wi‑Fi gateways at hotels and venues to redirect traffic and harvest Microsoft 365 credentials. ReliaQuest found attackers gain admin access to portal appliances via exposed interfaces or weak credentials, then poison DNS responses to point users to attacker-controlled endpoints. The technique bypasses device-level protections and can affect employees from multiple sectors, while DNSSEC or changing resolvers alone offers limited protection. ReliaQuest recommends full‑tunnel VPNs, conditional access, encrypted DNS, and hardening PAC/WPAD settings to mitigate the risk.

🔍 Researchers report a new botnet named Dysphoria has infected roughly 200,000 devices globally and is being used for DDoS attacks and traffic relay operations. QiAnXin XLab attributes Dysphoria's evolution to earlier malware families and notes it uses Ethereum ENS and Solana SNS domains for covert C2 resolution. The botnet spreads via weak Telnet/SSH credentials and known router and IoT vulnerabilities, and some variants now solely provide proxy services.

🛡️ This post explains a macOS-focused variant of the ClickFix social-engineering attack that coerces users into pasting malicious commands into Terminal. The script downloads a hidden DMG, mounts it silently, and launches an installer that deploys the AMOS (Atomic macOS Stealer) malware. Once installed, the stealer harvests browser data, crypto wallets, desktop app credentials, Safari and Keychain data, and uploads it to attackers’ servers.

🔒 Three plaintiffs allege they lost about $1.8 million in Bitcoin after installing a fraudulent Sparrow Wallet app from the App Store. The July 24 complaint accuses Apple of inadequate app review and monitoring, saying the malicious app impersonated the legitimate desktop-only Sparrow Wallet and prompted users to enter seed phrases. Victims reported the fraudulent app to Apple, which later removed impersonating apps and terminated developer accounts, but plaintiffs say warnings had been issued to Apple over a year earlier.

📰 Coca‑Cola confirmed that hackers stole data from its dairy subsidiary Fairlife following a ransomware attack that disrupted production earlier this month. The company said most U.S. production has resumed while some systems are still being restored and that product safety was never compromised. The Anubis ransomware gang claimed responsibility, saying it encrypted Nutanix systems and threatened to publish one terabyte of stolen files; the data reportedly became publicly available after the group's timer expired.

🔐 The ShinyHunters extortion group claims it conducted the Ernst & Young breach, asserting it obtained credentials via a supply-chain attack and accessed the firm's support systems. EY disclosed the incident after detecting unusual activity on April 23, noting attackers accessed a third-party support ticket platform between March 28 and April 12 and downloaded documents. The firm said stolen tickets may include client tax information and has offered affected clients 24 months of identity monitoring through Experian. EY has not confirmed ShinyHunters' claim or identified the compromised third-party service.

🛡️ Cybersecurity researchers uncovered a Microsoft Teams-themed phishing campaign that uses fake "secure document" lures and a counterfeit Microsoft Store page to deliver legitimate Remote Monitoring and Management (RMM) tools. The attack uses an Inno Setup loader that runs PowerShell to fetch an official Level RMM installer and registers the endpoint with an attacker-controlled enrollment secret, while also downloading ConnectWise ScreenConnect to establish redundant access. Analysis links the campaign, dubbed Operation BlueDash, to infrastructure and GitHub repositories active since February 2026, and attributes it with moderate-to-high confidence to a Nigeria-based threat actor group.

🛡️ SourTrade, an active malvertising operation since 2024, is concealing its malware assembly inside victim browsers to evade detection. Researchers at Confiant found the campaign impersonates trading and crypto platforms to lure victims with tips and giveaways. Rather than delivering a complete binary, SourTrade sends assembly instructions and clean components that the browser combines in memory to form the final infostealer payload. This in-memory build avoids network fingerprinting and appears as legitimate downloads to security tools.