Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Fake Bahrain Alert App Exploits Crisis to Deploy Android Spyware
In July 2026, a malicious Android application named "BH Alert" emerged, masquerading as Bahrain's official civil-defense emergency alert app. Distributed through counterfeit Google Play Store and Bahraini government websites, the app exploited heightened public concern during Iranian missile strikes. Once installed, it deployed a sophisticated four-stage surveillance platform capable of harvesting lockscreen credentials, SMS messages, contacts, and screenshots, running banking-app overlays, and granting attackers full remote control over the device. This campaign underscores the increasing trend of threat actors leveraging trusted government applications during crises to disseminate advanced spyware. Organizations should be vigilant about such tactics, as similar methods have been observed in previous incidents, including a Trojanized version of Israel's "Red Alert" app distributed via phishing campaigns earlier this year.
SANDWORM_MODE: Unveiling the npm Supply Chain Attack on AI Development Tools
In February 2026, the SANDWORM_MODE malware campaign targeted the npm ecosystem by distributing 19 typosquatted packages under aliases 'official334' and 'javaorg'. Upon installation, these packages executed a multi-stage attack: initially harvesting developer credentials and environment variables, followed by deploying a malicious MCP server to compromise AI coding assistants. The malware propagated by injecting itself into GitHub repositories and CI/CD pipelines, exfiltrating sensitive data, and, if thwarted, activating a destructive fallback to erase user files. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/?utm_source=openai)) This incident underscores the escalating sophistication of supply chain attacks, particularly those exploiting AI development tools. Organizations must enhance their security measures to detect and prevent such multi-faceted threats that blend into legitimate development workflows.
Critical Flaws in Microsoft's Passkey Implementation Uncovered
In July 2026, security researchers identified critical vulnerabilities in Microsoft's passkey implementation within Windows 11 and Microsoft Entra ID. These flaws allowed attackers to exploit weaknesses reminiscent of traditional password attacks, enabling them to impersonate privileged users and bypass phishing-resistant multifactor authentication. The vulnerabilities were disclosed to Microsoft, which subsequently released patches to address the issues. This incident underscores the importance of thorough implementation and validation of security protocols, even when adopting advanced authentication methods like passkeys. Organizations must remain vigilant, ensuring that new technologies are deployed securely to prevent exploitation by threat actors.
Lampion Banking Trojan Resurfaces in Portugal: A 2026 Threat Analysis
In July 2026, the Brazilian banking Trojan known as Lampion was identified in an active campaign targeting Portuguese users. The malware is disseminated through phishing emails that masquerade as financial and administrative communications, leading recipients to download malicious ZIP files. Once executed, Lampion establishes persistence, connects to a remote command-and-control server, and can inject overlays into banking websites to steal credentials. This campaign has resulted in significant data breaches and financial losses for affected individuals and organizations. The resurgence of Lampion underscores the persistent threat posed by banking Trojans, especially those leveraging social engineering tactics. Organizations must remain vigilant, as attackers continue to exploit language and cultural similarities to enhance the effectiveness of their campaigns.
Nichirei Cyberattack: A Wake-Up Call for Supply Chain Security
In July 2026, Nichirei Corporation, a leading Japanese frozen food and logistics company, experienced a significant cyberattack attributed to the RansomHouse group. The attack disrupted operations across approximately 140 distribution centers, affecting major clients like Kentucky Fried Chicken Japan, which faced ingredient shortages and operational challenges. The breach led to system failures, particularly in refrigerated warehouse and frozen food shipping services, causing widespread supply chain disruptions. Nichirei collaborated with external cybersecurity firms and authorities to investigate and mitigate the incident, aiming to fully resume operations by the end of the week. This incident underscores the escalating threat of ransomware attacks targeting critical supply chains, highlighting the need for robust cybersecurity measures and incident response strategies. Organizations must prioritize securing their digital infrastructures to prevent similar disruptions and protect sensitive data from malicious actors.
RefluXFS (CVE-2026-64600): Critical Linux Kernel XFS Vulnerability
On July 22, 2026, a critical vulnerability known as RefluXFS (CVE-2026-64600) was disclosed, affecting the Linux kernel's XFS filesystem. This flaw allows unprivileged local users to overwrite root-owned files, such as `/etc/passwd` or setuid-root binaries, by exploiting a race condition in the copy-on-write (CoW) mechanism. The exploit enables attackers to gain persistent root access without leaving traces in kernel logs, and the changes persist across reboots. Systems running Linux kernel version 4.11 or later with XFS filesystems created with `reflink=1` are vulnerable. Default installations of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux are particularly at risk. ([blog.qualys.com](https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600?utm_source=openai)) The RefluXFS vulnerability underscores the importance of timely patch management and system monitoring. With over 16.4 million systems potentially affected, organizations must prioritize updating their Linux distributions and implementing security measures to prevent unauthorized access and potential data breaches. ([secnews.gr](https://www.secnews.gr/en/723207/refluxfs-cve-2026-64600-linux-xfs-16m-systems/?utm_source=openai))
Critical Authentication Bypass in Check Point SmartConsole (CVE-2026-16232) Exploited
In July 2026, Check Point identified a critical authentication bypass vulnerability (CVE-2026-16232) in its SmartConsole login process, allowing unauthenticated remote attackers to gain full administrative privileges. Exploitation requires internet access to the Management Server IP address and a configuration without Trusted Clients restrictions. Successful attacks enable modification of security policies and configurations. Check Point confirmed active exploitation affecting a limited number of customers. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-16232?utm_source=openai)) This incident underscores the escalating risks associated with exposed management interfaces and the necessity for stringent access controls. Organizations must prioritize timely patching and restrict management access to trusted IP addresses to mitigate such vulnerabilities.
GitHub Actions Exploited in Large-Scale cPanel and WHM Server Attacks
In July 2026, a large-scale cyberattack exploited compromised GitHub repositories to target cPanel and WebHost Manager (WHM) servers. Attackers inserted malicious GitHub Actions workflows into repositories associated with a legitimate PHP developer, leading to the deployment of GitHub-hosted runners that scanned for vulnerable cPanel and WHM instances susceptible to CVE-2026-41940, an authentication bypass vulnerability. Upon successful exploitation, the attackers harvested sensitive data, including credentials and configuration files, from the compromised servers. This incident underscores the evolving nature of supply chain attacks, where trusted development tools and platforms are weaponized to facilitate widespread exploitation. Organizations must remain vigilant and implement robust security measures to protect against such sophisticated threats.
Unveiling JadeProx: China's New Cyber Threat Targeting Critical Sectors
In mid-April 2026, cybersecurity firm Group-IB uncovered an exposed Alibaba Cloud server linked to a China-nexus operation named JadeProx. This operation targeted government, healthcare, and education sectors across Asia and Latin America using a previously undocumented Windows loader called TriBack Loader. The attackers exploited vulnerabilities in public-facing applications, deploying web shells to gain initial access, and utilized sophisticated techniques such as DLL sideloading and encrypted payloads to evade detection. Notably, the campaign included intrusions into a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs. The discovery of JadeProx underscores the evolving tactics of state-sponsored threat actors, emphasizing the need for organizations to bolster their cybersecurity defenses. The use of advanced loaders like TriBack Loader highlights the importance of monitoring for novel malware strains and implementing robust security measures to protect sensitive data and critical infrastructure.
CISA Adds Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
On July 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-16232 and CVE-2026-50522. CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole, allowing unauthenticated remote attackers to gain administrative access and modify security policies. CVE-2026-50522 is a deserialization vulnerability in Microsoft SharePoint, enabling unauthorized remote code execution without authentication. Both vulnerabilities are actively exploited, posing significant risks to organizations using these platforms. The inclusion of these vulnerabilities in the KEV Catalog underscores the increasing trend of attackers targeting critical infrastructure through widely used enterprise applications. Organizations are urged to prioritize the remediation of these vulnerabilities to mitigate potential breaches and maintain compliance with security directives.
Critical Vulnerability in Claude Cowork Exposes Root Access Risk
In July 2026, security researchers identified a critical vulnerability in Anthropic's Claude Cowork, an AI agent environment designed to execute code within isolated Linux sandboxes. The discovered attack chain allows an attacker with local code execution capabilities to escalate privileges to root within the sandbox, effectively bypassing all isolation mechanisms. This escalation enables unauthorized access to the host system's files and applications, posing significant security risks. ([threat-modeling.com](https://threat-modeling.com/anthropic-claude-cowork-sandbox-escape-root-access/?utm_source=openai)) This incident underscores the evolving challenges in securing AI agent environments, highlighting the necessity for robust sandboxing techniques and continuous security assessments to prevent privilege escalation and unauthorized access.
Chaos Ransomware's msaRAT: Exploiting Browsers for Stealthy C2 Channels
In July 2026, the Chaos ransomware group deployed a new Rust-based remote access trojan (RAT) named msaRAT. This malware leverages the Chrome DevTools Protocol to control headless instances of Chrome or Edge browsers on compromised Windows machines, routing command-and-control (C2) traffic through WebRTC channels. By utilizing legitimate browser processes, msaRAT effectively conceals malicious communications, making detection and mitigation challenging for defenders. This incident underscores a growing trend among threat actors to exploit trusted applications and services to evade detection. The use of browser-mediated C2 channels highlights the need for enhanced behavior-based detection mechanisms and vigilant monitoring of legitimate application processes to identify and thwart such sophisticated attacks.