Critical Vulnerabilities in FatFs Expose Millions of Embedded DevicesCritical Vulnerabilities in FatFs Expose Millions of Embedded Devices
In July 2026, security firm runZero disclosed seven vulnerabilities in FatFs, a widely used filesystem library for FAT and exFAT formats. These flaws, present in devices like security cameras, drones, and industrial controllers, allow attackers to exploit crafted storage media to corrupt memory and execute arbitrary code. The vulnerabilities, rated Medium to High severity, include issues like integer overflows and buffer overflows, leading to potential device crashes or unauthorized code execution. Notably, CVE-2026-6682 involves an integer overflow during FAT32 volume mounting, which can result in memory corruption and code execution. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai))
The widespread use of FatFs in embedded systems, combined with the lack of upstream fixes and the absence of a responsive maintainer, poses significant security risks. Devices relying on FatFs remain vulnerable, and the exploitation of these flaws could lead to persistent operational denial of service or device bricking. Organizations must assess their exposure and implement mitigations to protect against potential attacks. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai))
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Unprivileged Users Can Gain Root Access via 'Bad Epoll' Vulnerability in Linux Kernel
In July 2026, a critical vulnerability known as 'Bad Epoll' (CVE-2026-46242) was disclosed in the Linux kernel's eventpoll subsystem. This use-after-free flaw allows unprivileged users to escalate their privileges to root, affecting Linux desktops, servers, and Android devices. The vulnerability arises from a race condition where two kernel components attempt to free the same memory object simultaneously, leading to memory corruption and potential system compromise. A proof-of-concept exploit demonstrates a high success rate in achieving root access, even from within restrictive environments like Chrome's renderer sandbox.
The discovery of 'Bad Epoll' underscores the challenges in detecting complex race-condition vulnerabilities within critical system components. Despite prior identification of similar flaws by advanced AI models, this particular issue remained undetected, highlighting the need for continuous and comprehensive security assessments. Organizations are urged to apply the available patches promptly to mitigate potential exploitation risks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Unveiling Avalon: The AI-Assisted Malware Framework with Ransomware Capabilities
In July 2026, cybersecurity researchers identified a new modular malware framework named Avalon, which is distributed through a sophisticated multi-stage phishing campaign. This framework integrates various malicious functionalities, including credential harvesting, lateral movement, remote access, system recovery disruption, and ransomware deployment. The ransomware component, dubbed CrownX, encrypts critical files and delivers ransom notes with payment instructions and deadlines. The attack initiates with a deceptive email containing a link to a password-protected archive on Proton Drive. Within this archive, an ISO image houses a Windows Shortcut file that, when executed, triggers a sequence leading to Avalon's deployment. Avalon employs advanced evasion techniques to bypass detection by security tools from vendors such as Microsoft Defender, SentinelOne, and CrowdStrike. It also targets data from browsers, cryptocurrency wallets, and communication applications, exfiltrating information to a remote server. Additionally, Avalon disrupts system recovery by terminating Volume Shadow Copy Service and deleting shadow copies, complicating incident response efforts. The emergence of Avalon underscores the increasing sophistication of malware threats, particularly those leveraging artificial intelligence to streamline development and enhance capabilities. This trend highlights the need for organizations to adopt proactive security measures, including employee training on phishing awareness, robust endpoint protection, and comprehensive incident response plans to mitigate the risks posed by such advanced threats.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
FortiBleed Campaign's Link to Inc and Lynx Ransomware Groups Unveiled
In July 2026, the FortiBleed campaign, initially identified as a credential-harvesting operation targeting Fortinet FortiGate firewalls, was linked to ransomware-as-a-service groups Inc Ransom and Lynx. SOCRadar researchers discovered that an operator within the FortiBleed infrastructure was actively engaged in ransom negotiations for both groups, indicating that credentials obtained through FortiBleed were being utilized for ransomware deployment. The campaign compromised approximately 12,000 FortiGate devices, with at least 12 confirmed ransomware deployments resulting in hundreds of encrypted endpoints across affected organizations. ([darkreading.com](https://www.darkreading.com/threat-intelligence/fortibleed-actors-inc-lynx-ransomware-gangs?utm_source=openai))
This incident underscores the evolving threat landscape where initial access brokers collaborate with ransomware operators, amplifying the risk to organizations. The exploitation of network security devices as entry points highlights the critical need for robust perimeter defenses and vigilant monitoring to prevent unauthorized access and subsequent ransomware attacks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
PamStealer: A New Threat to macOS Users in 2026
In July 2026, cybersecurity researchers identified a new macOS malware named PamStealer, which masquerades as the legitimate Maccy clipboard manager. Distributed through fake websites, PamStealer employs a two-stage attack chain: an initial AppleScript lure that bypasses macOS's quarantine protections, followed by a Rust-based payload. This payload validates user credentials via macOS's Pluggable Authentication Modules (PAM) before exfiltrating sensitive data, including browser cookies, clipboard contents, and cryptocurrency wallet information. The malware also establishes persistence by creating login items and disguises itself as system components to evade detection.
The emergence of PamStealer underscores a growing trend of sophisticated macOS-targeted malware that leverages native system features to enhance stealth and effectiveness. This development highlights the need for macOS users to exercise caution when downloading software and to remain vigilant against increasingly advanced social engineering tactics.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Anthropic's Mythos AI Breach: A Wake-Up Call for AI Security
In April 2026, unauthorized users gained access to Anthropic's restricted AI cybersecurity tool, Mythos, through a third-party vendor environment. Mythos, designed for enterprise security, was considered too powerful for public release due to its potential to identify vulnerabilities and simulate cyberattacks autonomously. The breach raised significant concerns about the security of advanced AI tools and the potential misuse of such technologies.
This incident underscores the critical need for robust security measures when handling powerful AI tools, especially those capable of autonomous actions. It highlights the importance of securing third-party vendor environments to prevent unauthorized access to sensitive technologies.
Threat report
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Medtronic Data Breach: ShinyHunters Claims 9 Million Records Stolen
In April 2026, Medtronic, a leading global medical device manufacturer, detected unauthorized access to its corporate IT systems. The cybercriminal group ShinyHunters claimed responsibility, alleging the theft of over 9 million records containing personally identifiable information (PII) and internal corporate data. Medtronic confirmed the breach but has not verified the exact number of records compromised. The company assured that the incident did not impact product security, patient safety, or operational systems. Investigations are ongoing to determine the full scope of the data accessed.
This incident underscores the persistent threat posed by cyber extortion groups targeting critical infrastructure sectors. The healthcare industry, in particular, remains a prime target due to the sensitive nature of the data it handles. Organizations must continually enhance their cybersecurity measures to protect against such sophisticated attacks.
High impact
Kill Chain
ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Urgent: Microsoft SharePoint RCE Vulnerability (CVE-2026-45659) Under Active Exploitation
In May 2026, Microsoft disclosed a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint Server, stemming from the deserialization of untrusted data. This flaw allows authenticated attackers with minimal privileges to execute arbitrary code on unpatched SharePoint servers without user interaction. Despite the release of security updates on May 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of this vulnerability as of July 2, 2026, and added it to its Known Exploited Vulnerabilities Catalog, urging immediate remediation.
The active exploitation of CVE-2026-45659 underscores the critical need for organizations to promptly apply security patches to prevent potential breaches. With over 10,000 SharePoint servers exposed online, the risk of widespread exploitation is significant, highlighting the importance of maintaining up-to-date systems to safeguard sensitive information.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
ConsentFix and ClickFix: Unveiling the New Era of Microsoft 365 Account Hijacking
In July 2026, a sophisticated social engineering attack known as ConsentFix emerged, targeting Microsoft 365 users. This attack exploits users' habitual responses to familiar prompts by presenting a seemingly legitimate authentication process. Victims receive phishing lures that lead them to a fake Microsoft sign-in page, where they are instructed to drag a localhost callback link into their browser. This action inadvertently grants attackers OAuth tokens, enabling unauthorized access to the victim's Microsoft 365 account without requiring passwords or bypassing multi-factor authentication. The attack is particularly insidious as it leverages routine user behaviors, making it difficult to detect and prevent.
The ConsentFix attack underscores the evolving nature of cyber threats that exploit user trust and routine actions. As attackers continue to refine their methods, it is imperative for organizations to enhance user education on recognizing sophisticated phishing attempts and to implement robust security measures that can detect and mitigate such deceptive tactics.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability (CVE-2025-5777)
In July 2026, the Anubis ransomware group exploited the Citrix Bleed 2 vulnerability (CVE-2025-5777) to gain initial access to targeted systems. This critical flaw in Citrix NetScaler ADC and Gateway devices allows unauthenticated attackers to extract sensitive memory contents, including session tokens, enabling them to bypass multi-factor authentication and hijack user sessions. Anubis affiliates utilized legitimate Remote Management and Monitoring (RMM) tools such as ScreenConnect, Zoho Assist, and UltraVNC to maintain control over compromised systems, facilitating lateral movement and data encryption. ([thehackernews.com](https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html?utm_source=openai))
The exploitation of CVE-2025-5777 underscores the persistent threat posed by ransomware groups leveraging known vulnerabilities and legitimate tools to evade detection. Organizations must prioritize timely patching of critical vulnerabilities and monitor for unauthorized use of RMM tools to mitigate such risks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
ClickFix: The Rising Threat in Malware Delivery
Between March 1 and May 31, 2026, the ClickFix social engineering technique emerged as the predominant method for malware delivery, as reported by ReliaQuest. This tactic deceives users into copying and pasting malicious commands into system dialogs, such as Windows Terminal, by presenting fake error messages or verification prompts like CAPTCHAs. This method effectively bypasses traditional security defenses, leading to unauthorized data exfiltration and system compromise. Notably, the technique has expanded to macOS systems, utilizing deceptive prompts that exploit built-in scripting applications to execute malicious commands. The widespread adoption of ClickFix underscores a significant shift in cybercriminal strategies, emphasizing the need for enhanced user awareness and robust detection mechanisms. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix?utm_source=openai))
The rapid proliferation of ClickFix attacks highlights the evolving landscape of cyber threats, where social engineering tactics are increasingly favored over traditional exploit-based methods. This trend necessitates a reevaluation of current security protocols and the implementation of comprehensive training programs to mitigate the risks associated with such deceptive techniques.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Phishing Attacks Evolve: Adaptive Campaigns Target Devices and OS
In July 2026, sophisticated phishing campaigns emerged that dynamically adapt to a victim's device and operating system. Attackers utilize user-agent data to fingerprint victims, collecting information such as email addresses, browser details, device type, language, local time, screen size, and geolocation. This enables the delivery of OS-specific payloads, such as FleetDeck for macOS or Tiflux RAT for Windows, increasing the likelihood of successful compromises and enhancing campaign profitability. ([darkreading.com](https://www.darkreading.com/application-security/phishing-campaigns-auto-adapt-victims-device-os?utm_source=openai))
This trend underscores a significant evolution in phishing tactics, moving from generic attacks to highly targeted, platform-aware strategies. Organizations must enhance cross-platform monitoring and educate employees on recognizing sophisticated phishing attempts to mitigate these advanced threats.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
