ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories

A cybercrime group known as xplogs22 has been observed targeting Russia and other CIS countries with phishing emails that deliver Xworm. The group, per F6, is believed to have been active since November 2023. Prior attacks mounted by the threat actors leveraged Formbook and Snake Keylogger, before switching to XWorm around July 2025. In recent months, Russian customers of the banking sector have also been targeted by an Android trojan called LunaSpy as part of social engineering attacks. LunaSpy can capture camera streams, record audio and the screen, and collect sensitive data. The malware is disguised as an antivirus application to evade detection.

The financially motivated extortion group known as Toy Ghouls (aka Bearlyfy and Labubu) has targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March 2026. According to Kaspersky, the group previously relied on third-party encryptors like RedAlert, LockBit, and Babuk. “GenieLocker, apparently a custom design, upgrades their toolkit and reduces their reliance on third-party software,” Kaspersky said. In at least one case, initial access to the target environment was obtained via an OpenVPN connection originating from an external partner’s network, with the attackers likely exploiting the trusted relationship to breach the target, conduct reconnaissance, deliver additional tools for credential harvesting, and perform lateral movement via RDP and SSH to reach other Windows and Linux hosts. “During the impact phase, the attackers encrypted files on the compromised Windows machines with the PE version of the GenieLocker ransomware,” Kaspersky said. “On the compromised Linux and ESXi servers, they stopped active virtual machines and encrypted their disks using the ELF version of GenieLocker.” Details of the activity were first highlighted by F6 in March 2026.

The malware loader known as CastleLoader, which has been previously used to deliver CastleStealer and a Python-based remote access trojan (RAT) via ClickFix-style lures, has now been used to distribute two payloads tied to the Needle Stealer framework: a Rust-based desktop wallet spoofer, and a Golang-based malicious browser extension installer. Arctic Wolf said it also identified a new shellcode loader variant spreading via digitally signed installers. The campaign has been codenamed Noidret. The introduction of these new tools is seen as an attempt to focus on cryptocurrency-specific targeting and establish browser-level persistence.

Speaking of ClickFix, CyberProof said it tracked a ClickFix variant that involves tricking victims into pasting a single command into the Windows Run dialog, which then communicates with a WebDAV endpoint and uses rundll32.exe to load a remote, non-DLL payload and call its first export by ordinal without having to leave any artifacts on disk. “The payload (gc.key, j.pm, or goog.ct) is a file served from the attacker WebDAV share and is not a standard DLL by extension,” CyberProof said. “It is invoked by rundll32.exe through ordinal #1, which runs its primary routine while keeping the export name off the command line.”

Victims searching Google for how to install Claude on a Mac are being served sponsored results that lead them to a weaponized claude.ai/share conversation dressed up as an Apple Support install guide. The “guide” instructs them to open Terminal and paste a single curl command, ultimately leading to execution of MacSync Stealer. “MacSync is a six-stage kill chain, not a smash-and-grab,” Huntress said. “The components are a thin zsh loader, a server-side AppleScript stealer that keeps the valuable logic off the endpoint and behind an api-key gate, a native Mach-O RAT for hands-on access, a separately signed helper built to steal a single TCC permission (Screen Recording), and a set of wallet-app trojans. Each stage sets up the ones that follow.”

A Russian-speaking threat group is said to be behind an active campaign called Operation STANDOFF that combines commodity-malware distribution, a proxy-botnet that conscripts victims into relay infrastructure, targeted hands-on-keyboard intrusion of enterprise networks, and an AI-driven, multi-channel influence and engagement-manipulation capabilities under one roof. “The operation is materially more than a botnet,” VMRay Labs said. “It couples automated, scaled cybercrime with hands-on-keyboard, targeted intrusion and a coordinated influence capability, all on the same infrastructure and built by a common development team.” The influence apparatus uses networks of fake Telegram accounts and AI-generated personas to artificially boost the visibility of content, push commercial promotions, and drive traffic to gambling and fraud-adjacent services. The activity uses a pay-per-install (PPI) loader masquerading as software installers that delivers Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig cryptocurrency miner, while a second, targeted operations layer relies on a bespoke, multi-operator command-and-control console through which human operators conduct hands-on-keyboard intrusions of selected victims.

Security researcher Eaton Zveare has disclosed details of a vulnerability in My Eicher, a fleet management system developed by the Volvo Group and Eicher Motors for Indian commercial vehicle customers, that enabled the discovery of unauthenticated internal and. admin APIs that could be exploited to gain high-level access to systems and even enable account takeover. “Account takeover made it possible to gain control over a person’s (or company’s) entire fleet, which could consist of hundreds of vehicles,” Zveare said. Following responsible disclosure on November 3, 2025, the issue was addressed at some point by November 20.

A Chinese-speaking threat actor has been carrying out an AI-enabled autonomous hacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824). The actor, operating under the aliases knaithe and KnYuan, has leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator, while orchestrating the operation through Telegram to enumerate targets, source exploit tools, and initiate attacks without human intervention. “Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making,” Unit 42 said. Additionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity. “When initial exploitation failed due to the target environment’s restrictive configurations, their Hermes Agent autonomously conducted searches for known critical-severity Common Vulnerabilities and Exposures (CVEs),” Unit 42 said. “It initially surveyed 10 product families, scanning GitHub for trending proofs of concept (PoCs) and prioritizing vulnerabilities by attack surface.”

Details have emerged about a covert Linux XMRig campaign that exploits trusted access, and weaponizes Pluggable Authentication Modules (PAM) to create a forensic smokescreen and deploy a highly customized XMRig botnet implant. “Initial access was achieved by exploiting a trusted third-party relationship, highlighting critical supply chain risks,” Group-IB said. “The threat actor escalated to root access, but weaponised the pam_rootok policy to seamlessly impersonate multiple low-privileged users to create a forensic smokescreen designed to confuse incident responders and establish a ‘hydra-like’ redundant persistence across unmonitored accounts.” The campaign is characterized by efforts to actively suppress system visibility by disabling logging services and removing authentication logs to blind standard file-based monitoring. The campaign was first observed in March 2026.

Threat actors are masquerading as recruiters and trucking victims into installing a malicious application disguised as an AI meeting tool called Relay. The malware targets both macOS and Windows users, and attempts to steal sensitive data including browser credentials, wallet-related information, Keychain data, and Telegram sessions, per SlowMist.

Australian energy company Origin Energy said it completed the initial phase of its review into a security incident that took place earlier this month, finding that “the information of approximately 900,000 current and former customers was accessed.” The information accessed may include name, address, date of birth, phone number, last four digits of a credit card, or the BSB and last three digits of a bank account, and account details.

Health-ISAC is warning of an increase in successful attacks conducted by ShinyHunters. “The group appears to prioritize identity compromise and SaaS access over traditional ransomware deployment,” it said. “The operational pattern described in recent incident reporting aligns to a repeatable chain: vishing (voice social engineering) → helpdesk/MFA reset or device re-enrollment → Microsoft Entra (or Okta/Google) SSO account takeover → pivot into connected SaaS platforms → rapid data exfiltration for extortion leverage. Even when victim statements indicate limited operational impact, the described tradecraft is the key defensive lesson. SSO is the control plane, and ShinyHunters’ leverage is created through data theft at cloud scale.”

GitHub has laid out the various steps it has taken to harden the supply chain at various stages and combat attacks that target weaknesses in package repositories and CI/CD systems for malware propagation. Some of these include: (1) npm adding preventive account protection for high-impact accounts, (2) safer pull_request_target defaults for GitHub Actions checkout, (3) better controls over who and what triggers GitHub Actions workflows, (4) read-only Actions cache for untrusted triggers, (5) support for CircleCI in npm trusted publishing, (6) Action workflow network firewall, (7) staged publishing for npm, (8) default package cooldown for Dependabot version updates, (9) self-service credential revocation for incident response, and (10) expanded credential revocation API support.

In an update released on July 29, 2026, Google shipped patches to address 370 flaws in its Chrome browser, including seven that are rated critical in severity (from CVE-2026-17650 through CVE-2026-17656). Of these, 349 flaws were reported by Google itself, with the tech giant noting that the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. None of the patched vulnerabilities have been flagged as actively exploited. The fixes are available in versions 151.0.7922.71/.72 for Windows and Mac and 151.0.7922.71 for Linux. Google has addressed over 1,800 vulnerabilities in Chrome since the beginning of the year.

The U.K. National Cyber Security Centre (NCSC) has urged network device manufacturers to help incident response teams by making it easier to gather evidence after a compromise. “Forensic observability is particularly important for edge devices such as firewalls, VPN gateways and other network appliances,” NCSC said. “These systems often sit at trust boundaries and are increasingly targeted by sophisticated threat actors. Forensic observability means giving defenders reliable ways to understand what a device is doing, what it has done and whether it can still be trusted after an incident. This includes telemetry, logging, configuration state, and the ability to collect forensic data from both memory and data at rest. Manufacturers should provide supported mechanisms for gathering the evidence needed to investigate incidents, assess impact, and restore trust in affected systems.”

Barracuda has revealed that LogoKit has evolved from a standard phishing kit into a “real-time deception platform” capable of building customized phishing pages for each victim. “LogoKit has moved beyond static fake login pages, such as pre-built replicas of popular brands, to the creation and use of real-time, highly personalized phishing experiences,” it said. “The platform uses legitimate commercial web services to recreate a victim’s corporate login experience, making phishing attacks more convincing and harder to detect. Every victim effectively receives a uniquely branded phishing page, making generic indicators of compromise harder to identify.” This involves capturing a real-time screenshot of the victim’s legitimate website and building phishing pages tailored to them. LogoKit uses the commercial Thum.io service to “create full, legitimate website screenshots for the phishing background and Clearbit to add legitimate brand logos.” The attackers also rely on legitimate services, including Google Favicon, ImageKit and Microlink APIs, to dynamically load authentic logos and website imagery in real-time. LogoKit campaigns use phishing emails bearing warnings about passwords or delivery failures and timesheet updates to direct victims to the fake pages.

A new analysis from VulnCheck has revealed that despite a significant uptick in vulnerability discovery and disclosure, 23.43% of known exploited vulnerabilities (KEVs) showed evidence of exploitation on or before the day the CVE was published. “At the same time, vulnerabilities appear to be being exploited faster, with the median time from CVE publication to KEV falling from 120 days in 2025 to 80 days during the first half of 2026,” VulnCheck said. “Of 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, have been confirmed as exploited in the wild, roughly matching the overall exploitation rate of all vulnerabilities in the first six months of the year.” The top technology categories being targeted by exploitation activity include CMS systems, network edge devices, operating systems, server software, and AI infrastructure (e.g., Langflow, Majordomo, lollms, LiteLLM, and dify).

An active, broad, and opportunistic credential stuffing campaign has been observed since July 25, 2026, resulting in successful unauthorized logins to SonicWall VPN and firewall accounts. To date, 92 unique user accounts across 30 organizations have been impacted. “The activity stems from five IPs and relies on infrastructure hosted on DigitalOcean to compromise numerous, seemingly unrelated organizations,” Huntress said. “Current telemetry indicates this is an automated credential validation attack, consistent with similar campaigns targeting SonicWall VPNs throughout 2025 and 2026.”

Google Threat Intelligence Group (GTIG) said it will be rolling out a unified naming schema for tracking threat actors as part of its effort to standardize tracking across platforms and public reporting. “The new naming convention aligns with industry standard threat actor naming systems,” GTIG said. To that end, the new schema utilizes a cryptonym-based approach employing two-word combinations for each distinct threat actor, similar to those adopted by CrowdStrike (e.g., Mustang Panda) and Microsoft (e.g., Twill Typhoon). The first word is a term chosen to represent the specific actor, while the second word categorizes threat clusters by motivation, attribution, or activity type. Going forward, APT44 (aka Sandworm) will be referred to as Sandworm Relic, where Relic is the category name for threat actors of Russian origin. Similarly, those from China will be grouped under Castle, Iran under Ion, North Korea under Neptune, and cybercriminal gangs under Comet. GTIG said it will continue to use UNC (or uncategorized) for threat clusters that are still in the early stages of investigation.

A new remote access trojan (RAT) called MedusaHVNC is being sold as malware-as-a-service (MaaS), per BlackFog. The malware embeds a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop that’s out of sight of the victim. “The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state,” BlackFog said. “This gives the operator access to live, logged-in sessions while the activity continues to come from the victim’s usual machine.” The seller lists Chrome, Edge, Brave, Firefox, and Telegram as supported applications. The malware uses a 5-stage infection chain. It begins when the legitimate “wscript.exe” binary executes a JavaScript launcher, which then sets off the subsequent steps, including dropping additional payloads and using AutoIT to decrypt and launch MedusaHVNC, which then communicates with an external server to exfiltrate data.

CubePilot has announced an operational disruption stemming from a DNS hijacking attack. Unknown threat actors are said to have gained control of the cubepilot[.]org domain DNS settings on July 24, allowing them to intercept traffic intended for internal systems. The threat actors also obtained TLS certificates covering all cubepilot.org subdomains. “The certificates obtained by the attacker covered every cubepilot.org subdomain, so credentials entered on any of our services on 24 July may have been captured – the portal and the forum included,” CubePilot said. “If you used the same password anywhere else, change it there now.” CubePilot has since regained control of its domains and revoked the fraudulently issued certificates.

The threat actor known as APT-C-60 has continued to target Japanese organizations with spear-phishing emails to deliver SpyGlace malware. “While several changes have been identified, such as a shift in infrastructure from Bitbucket to GitHub and updates to the malware itself, many characteristics remain consistent, including the abuse of legitimate services and the behavior of the malware,” JPCERT/CC said late last year. As of 2026, the spear-phishing emails contain a Proton Drive link to trick recipients into downloading a RAR archive containing a LNK file, which then deploys SpyGlace by downloading an intermediate payload from jsDelivr. “By using legitimate services, the threat actor may be attempting to make communications and downloads appear to be normal access,” JPCERT/CC said.

Google has launched a preview of CodeMender, an AI agent designed to scan codebases for security flaws, confirm they are exploitable and eliminate false positives, and generate fixes for developers to review. The tool supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. “The agent goes beyond static code-pattern analysis by simulating an attack with exploit code it builds and runs in an isolated, customer-managed sandbox,” Google said. “The agent uses this proof-of-concept exploit to verify that the security flaw poses a legitimate risk. This critical verification phase allows your security practitioners and developers to prioritize validated risks by eliminating false positives.” CodeMender will add support for third-party frontier models later this year.

Europol said it supported an action targeting nihilistic violent extremist content online between June and July 2026 with an aim to disrupt The Com online ecosystem and restrict propaganda dissemination. The agency and its partners have flagged 4,340 “horrific” URLs linked to The Com for removal. Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, and Sweden participated in the effort. “Groups affiliated with The Com recruit members and groom victims on social media, messaging apps, and gaming platforms to engage in self-harm, animal torture, violent attacks, and the production of child sexual abuse material,” Europol said. “They distribute propaganda on accessible platforms to attract young individuals, funnelling potential members and victims into private forums and chat rooms where radicalisation and victimisation occur. Victims are typically coerced into remaining under the perpetrators’ influence through (s)extortion.” Members of the loose-knit collective also participate in cybercrime, extortion, doxxing, swatting, real-life shootings, stabbings, and other physical violence.

Fake downloads of games, mods, cracks, and software are being used to spread RenPy Loader (aka RenEngine Loader). “Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer,” Malwarebytes said. “RenPy Loader has also been observed delivering other malware, including Hijack Loader and Lumma Stealer, showing that the final payload can vary between campaigns.”