Browser-As-A-Proxy: New msaRAT Malware Routes Command-and-Control Through Chrome and Edge
A newly documented remote access trojan, msaRAT, marks a structural departure in how ransomware-affiliated tooling communicates with its operators. Rather than relying on obfuscated domains or fronted infrastructure to evade network detection, msaRAT eliminates direct malware-to-command-and-control traffic entirely. It hijacks a victim's own installed Chrome or Edge browser through the Chrome DevTools Protocol, then uses that browser to negotiate a WebRTC connection relayed through legitimate Cloudflare Workers and Twilio TURN infrastructure.
Key Finding: msaRAT removes the malicious process from the network path entirely by forcing a victim's legitimate Chrome or Edge browser to carry all command-and-control traffic over a WebRTC relay, rendering process-based and reputation-based detection models structurally blind to the technique.
Read more →
Unearthing Legacy Risk: Analyzing CVE-2026-64600 and the RefluXFS Kernel Privilege Escalation
A nine-year-old race condition in the Linux kernel's XFS copy-on-write path, tracked as CVE-2026-64600 and named RefluXFS, allows an unprivileged local user to overwrite root-owned files and obtain persistent root access on default installations of major enterprise Linux distributions. Disclosed by Qualys Threat Research Unit on July 22, 2026, the flaw operates at the filesystem block-allocation layer, below where SELinux, kernel lockdown, seccomp, and container isolation are designed to intervene—meaning standard hardening controls do not stop it.
Read more →
Zero-Click Espionage: Russian APT Laundry Bear Exploit Target Zimbra Webmail for Silent Email Theft
Unit 42 has disclosed CL-STA-1114, a Russian state-nexus cyberespionage campaign—overlapping with activity tracked elsewhere as Void Blizzard, LAUNDRY BEAR, and TA488—that has exploited a stored cross-site scripting flaw in Zimbra Collaboration Suite's Classic UI, tracked as CVE-2025-66376, since at least July 2025.
Read more →
Publication Date: July 23, 2026
Unpatched Infiltration: UmiJS Zero-Day Vulnerability Exposes React Applications to Remote Execution
A critical zero-day vulnerability in UmiJS—a widely adopted React application framework powering enterprise, fintech, and SaaS environments—enables unauthenticated remote code execution through malicious payload injection during application build and runtime phases. Tracked as CVE-2026-16492, this vulnerability affects an estimated 40,000+ public repositories and creates a cascading supply chain exposure for organizations lacking build-process verification controls.
Publication Date: July 23, 2026
Ghost in the Pipeline: Cross-Language Malware Tactics Behind PylangGhost and GolangGhost
Nation-state threat actors attributed to North Korea have deployed sophisticated remote access trojan (RAT) variants—PylangGhost (Python-based) and GolangGhost (Go-based)—through social engineering campaigns impersonating recruitment professionals. The dual-language malware architecture exploits structural gaps in traditional endpoint detection while leveraging interview-themed phishing to harvest institutional credentials.
Publication Date: July 23, 2026
Project CAV3RN Expansion: New Framework Module Signals Escalated Threat Activity
Project CAV3RN represents a critical escalation in Iranian state-sponsored cyberespionage capability through the integration of modular command-and-control infrastructure that exploits legitimate enterprise communication channels—specifically Microsoft Outlook calendar functions and DNS tunneling protocols—to establish resilient C2 pathways resistant to traditional detection mechanisms.
Publication Date: July 22, 2026
Unauthenticated Threat Vector: Analyzing the Critical CVE-2026-6875 Flaw in ServiceNow Infrastructure
CVE-2026-6875 represents a critical authentication bypass enabling unauthenticated remote code execution across ServiceNow deployments worldwide. The vulnerability permits threat actors to execute arbitrary code on affected instances without credential presentation, establishing direct pathways to IT Service Management databases, change management systems, and integrated enterprise infrastructure.
Publication Date: July 22, 2026
Poisoning the Perimeter: Analyzing Qilin Ransomware’s Exploitation of PAN-OS Infrastructure
Qilin ransomware operators have weaponized a critical authentication bypass vulnerability in Palo Alto Networks GlobalProtect VPN infrastructure to establish unauthorized network access without credential validation, fundamentally altering ransomware attack sequencing from endpoint compromise to perimeter infrastructure exploitation.
Publication Date: July 22, 2026
Default-Open Defenses: Analyzing the Hard-Coded Credential Vulnerability in PraisonAI Infrastructure
PraisonAI deployments across all versions prior to 0.31.2 contain hardcoded authentication credentials embedded directly into application source code and compiled binaries—a foundational infrastructure vulnerability that grants unauthenticated adversaries direct access to autonomous agent systems, backend orchestration layers, and dependent infrastructure without exploitation of secondary vulnerabilities.
Publication Date: July 21, 2026
Implicit Trust Exploitation: Analyzing the SSRF Risk Cascade in Stoatchat Environments
CVE-2026-63306 is a critical Server-Side Request Forgery vulnerability affecting stoatchat infrastructure that permits unauthenticated attackers to bypass network segmentation and access internal services, metadata endpoints, and credential management systems. The vulnerability requires immediate remediation prioritization across all deployment contexts due to the absence of compensating controls in default configurations and confirmed in-the-wild exploitation activity. Immediate actionable guidance: Immediate action required: Inventory all stoatchat instances, confirm version status, and establish patch deployment sequencing within 24 hours.
Publication Date: July 21, 2026
Inside HelloNet’s VPN Supply Chain Compromise
The HelloNet APT campaign represents a sophisticated supply chain attack leveraging compromised VIPNet update infrastructure to distribute malicious payloads across enterprise networks in financial services, government contracting, and critical infrastructure sectors. By injecting backdoors into legitimate security patches, HelloNet operators established persistent access while evading standard endpoint detection mechanisms.
Publication Date: July 21, 2026
Inside the Windows Cloud Files Driver Privilege Escalation Threat
CVE-2026-58613 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver that enables authenticated users to escalate privileges to kernel mode. Unlike privilege escalation vulnerabilities typically requiring administrative access or sophisticated social engineering, this flaw is exploitable by any authorized user with filesystem access—a condition present across most cloud-synchronized environments where OneDrive, SharePoint Sync, or Microsoft Teams file integration is active.
Publication Date: July 20, 2026
Fortinet FortiSandbox Zero-Days: Active Exploitation Under Federal Mandate
Two actively exploited zero-day vulnerabilities in Fortinet FortiSandbox have triggered an emergency federal patch mandate with a July 21, 2026 compliance deadline—creating a compressed 48-72 hour remediation window for federal agencies and critical infrastructure operators. CVE-2026-25089 (CVSS 8.8) and CVE-2026-39808 (CVSS 9.1) enable unauthenticated remote code execution and privilege escalation on appliances running versions 3.2.0 through 4.2.5.
Publication Date: July 20, 2026
Windows LegacyHive Zero-Day: PROFSVC Local Privilege Escalation
A critical, previously undisclosed zero-day vulnerability in the Windows Professional Services (Profsvc.exe) component enables unauthenticated local privilege escalation to SYSTEM-level access, bypassing modern UAC controls and eliminating post-exploitation friction for adversaries. Tracked as LegacyHive, the vulnerability exploits memory corruption in the Profsvc service handler, requiring only local code execution or direct RPC endpoint access—no user interaction necessary.
Publication Date: July 20, 2026
OpenSSL "HollowByte" Denial-of-Service Vulnerability: Minimal Payload, Maximum Impact
A denial-of-service vulnerability in OpenSSL servers has emerged as a significant asymmetric threat to production TLS infrastructure across enterprise, government, and critical infrastructure environments. Designated "HollowByte," the flaw enables remote attackers to trigger memory exhaustion and service degradation using a minimal 11-byte packet sequence, requiring no authentication or user interaction.
Publication Date: July 17, 2026
AsyncAPI npm Package Compromise: Pwn Request Attack Injects Credential-Stealing Malware and Miasma RAT into Supply Chain
The AsyncAPI npm package ecosystem experienced a sophisticated supply chain compromise in July 2026 when threat actors exploited misconfigured GitHub Actions workflows to inject credential-stealing malware and the Miasma Remote Access Trojan directly into published packages consumed by tens of thousands of developers and enterprise build environments worldwide. The attack vector—a "Pwn Request"—leverages insufficient permission scoping in automated CI/CD pipelines by submitting malicious pull requests to repositories, enabling arbitrary code execution within privileged build contexts and package poisoning at publication time.
Publication Date: July 17, 2026
Zero Dwell Time: Why Spirals Ransomware Requires a New Doctrine for Network Containment
Spirals ransomware represents a structural inflection in the ransomware threat landscape: a demonstrated capability to achieve full network encryption in under 24 hours from initial access. This compression of the attack lifecycle invalidates the dwell-time assumptions embedded in the majority of enterprise detection and response frameworks.
Publication Date: July 17, 2026
Poisoning the Interface: How OkoBot’s Multi-Payload Architecture Hijacks Cryptographic Hardware
The OkoBot malware framework represents a structural escalation in financially motivated threat design, moving beyond single-payload credential theft toward a modular, multi-vector attack system purpose-built to compromise cryptocurrency users across wallet software, browser extensions, and clipboard environments simultaneously.
Publication Date: July 16, 2026
CISA Issues Emergency Guidance as Microsoft SharePoint Vulnerabilities Expose Enterprise Networks
On July 14, 2026, CISA issued a formal hardening directive following confirmed active exploitation of three Microsoft SharePoint vulnerabilities affecting on-premises and hybrid deployments across enterprise and government environments. Threat actors have been observed chaining these vulnerabilities to progress from initial network access—including at least one unauthenticated vector—through privilege escalation to remote code execution, enabling credential theft, lateral movement, and ransomware staging within environments where SharePoint functions as both a document repository and an identity-integrated workflow platform.
Publication Date: July 16, 2026
SonicWall SMA1000 Zero-Days Actively Exploited, Enterprise Remote Access Under Fire
CISA has issued a formal hardening directive following confirmed active exploitation of three chained Microsoft SharePoint vulnerabilities — including at least one vector that requires no authentication whatsoever — enabling threat actors to move from initial network access through privilege escalation to full remote code execution across on-premises and hybrid enterprise and government environments.
Publication Date: July 16, 2026
LabubaRAT: Rust-Based RAT Exploits NVIDIA Brand Trust for Persistent Windows Compromise
A newly identified remote access trojan designated LabubaRAT is actively targeting Windows environments by impersonating legitimate NVIDIA system software. Discovered and analyzed by researchers at Blackpoint Cyber, the malware presents itself as `nvidia-sysruntime.exe` — a filename sufficiently plausible across any environment running NVIDIA GPU hardware that users, administrators, and endpoint security tooling may extend it implicit trust.
Publication Date: July 15, 2026
Microsoft July 2026 Patch Tuesday: Convergent Threat Pressure, Wormable Authentication Exploitation, and the Limits of CVE-by-CVE Triage as an Operational Model
Executive Summary The July 2026 Microsoft Patch Tuesday release, delivered on July 14, 2026, presents a convergence of threat conditions that collectively exceed the risk profile of any individual component. The release addresses 127 CVEs across Windows and associated products, accompanied by more than 130 independently tracked Chromium-based Edge browser vulnerabilities — producing a combined exposure surface exceeding 257 vulnerabilities within a single patch cycle. Anchoring the release is CVE-2025-47981, a heap-based buffer overflow in the Windows SPNEGO Extended Negotiation protocol rated CVSS 9.8, classified as wormable, and requiring neither credentials nor user interaction to exploit across all supported Windows versions. Active exploitation of a Windows Defender race condition — CVE-2026-50656, designated RoguePlanet — with publicly available proof-of-concept code, combined with CISA-confirmed ransomware exploitation of a related prior disclosure designated BlueHammer, compounds operational urgency. An irreversible Kerberos RC4 authentication deprecation embedded in the same cumulative update introduces a distinct category of risk that cannot be addressed through rollback after patch application. Organizations should treat this release as a formal risk event requiring phased, sequenced deployment rather than routine monthly maintenance. One actionable takeaway: Verify that the July 9, 2026 out-of-band patch for CVE-2026-50656 has been applied to all Windows endpoints before deploying the July 14 cumulative update, and audit all Kerberos RC4 dependencies on domain controllers before applying that update to those systems.
Publication Date: July 15, 2026
Windows NEGOEX Authentication Protocol Heap Overflow: Unauthenticated Remote Code Execution at the Pre-Authentication Boundary
A critical heap-based buffer overflow vulnerability in the Windows NEGOEX security extension — designated CVE-2025-47981 and scored 9.8 (Critical) under the Common Vulnerability Scoring System — exposes enterprise authentication infrastructure to unauthenticated, pre-authentication remote code execution across a broad range of Microsoft Windows deployments.
Publication Date: July 15, 2026
When the Defender Becomes the Vector: RoguePlanet and the Privilege Escalation Risk Inside Microsoft's Malware Engine
Microsoft Defender's malware scanning engine — a deeply privileged, near-universally deployed system component — contains an elevation of privilege flaw that enables a locally authenticated user to achieve SYSTEM-level access, effectively weaponizing the security layer organizations rely upon most to detect and neutralize endpoint threats.
Publication Date: July 14, 2026
Unauthenticated and Undetected: How Active Exploitation of Joomla Extension Vulnerabilities Is Exposing the Hidden Costs of Third-Party Plugin Governance
Two widely deployed Joomla extensions — iCagenda and Balbooa Forms — are the subject of a CISA Known Exploited Vulnerabilities (KEV) catalog designation confirming active, in-the-wild exploitation of critical unauthenticated remote code execution vulnerabilities. Because exploitation requires no credentials, no user interaction, and no insider access, any internet-facing Joomla installation running unpatched versions of these extensions represents a viable, immediately actionable target for threat actors operating across criminal, opportunistic, and potentially nation-state-aligned campaigns. The affected extensions serve functions — event calendar management and web form data collection — common across government portals, educational institutions, nonprofits, and commercial web properties, concentrating risk in sectors where Joomla adoption is historically high.
Publication Date: July 14, 2026
Router Hygiene as Strategic Defense: How Russian State-Sponsored Actors Are Exploiting Network Edge Infrastructure — and What Organizations Must Do Now
On July 9, 2026, the NSA, CISA, and FBI issued a joint Cybersecurity Advisory documenting an active, sustained Russian state-sponsored campaign targeting network routing infrastructure across federal agencies, critical infrastructure operators, and enterprise environments. FSB-affiliated threat actors are exploiting Cisco Smart Install protocol misconfigurations, weak SNMP community strings, and known Cisco IOS vulnerabilities — at least one of which has been formally added to CISA's Known Exploited Vulnerabilities catalog — to achieve persistent, low-visibility footholds in high-value networks.
Publication Date: July 14, 2026
When Trust Becomes a Weapon: OAuth Client ID Spoofing and the Identity-Layer Crisis in Microsoft Entra ID and M365 Environments
A technique documented by Proofpoint Threat Insight in July 2026 has elevated cloud identity security from a configuration concern to a structural architectural problem. Threat actors are exploiting a foundational trust assumption within the OAuth 2.0 authorization framework: that a declared Client ID corresponds to a legitimate, verified application. By injecting spoofed Client IDs drawn from Microsoft's own catalog of trusted first-party applications — including Microsoft Office, Azure CLI, and Microsoft Teams — adversaries are successfully impersonating those applications during authorization flows, bypassing Conditional Access Policies, and achieving persistent access to enterprise Microsoft 365 environments with minimal forensic footprint.
Publication Date: July 13, 2026
Progress ShareFile Pre-Authentication RCE Chain — Vendor Directs Customer Server Shutdowns With No Patch Available
Progress Software has issued an emergency advisory directing customers operating on-premises ShareFile Storage Zone Controllers to shut down those systems immediately, citing a credible threat posed by a pre-authentication remote code execution vulnerability chain comprising two linked identifiers — CVE-2026-2699 and CVE-2026-2701. No patch is available, and Progress has not established a remediation timeline. As a parallel precautionary measure, Progress has taken its own cloud-managed Storage Zone Controller infrastructure offline.
Publication Date: July 13, 2026
Critical Zimbra Classic Web Client Vulnerability Enables Malicious Script Execution in Authenticated Email Sessions
A critical cross-site scripting vulnerability in Zimbra's Classic Web Client has been publicly disclosed and patched, presenting an immediate and material risk to enterprise, government, and institutional organizations operating on-premises Zimbra email infrastructure. The flaw permits threat actors to inject and execute malicious scripts within authenticated user sessions — potentially through nothing more than a crafted email that a recipient previews or opens — without requiring system-level access or elevated privileges.
Publication Date: July 13, 2026
When the Shield Becomes the Weapon: The `jscrambler` npm Supply Chain Compromise and the Weaponization of Developer Trust
The confirmed compromise of `jscrambler` npm package version 8.14.0 — a widely deployed JavaScript obfuscation and code protection utility — represents a precisely targeted software supply chain intrusion that embedded a malicious binary directly into the package's `preinstall` lifecycle hook. Upon execution of a standard `npm install` command, the binary triggered automatically, with no user interaction required, across developer workstations, CI/CD pipeline runners, Docker build containers, and staging environments.
Published July 10, 2026
Green Light, Red Network: How GodDamn Ransomware's PoisonX Driver Turns Enterprise Security Dashboards Into Liabilities
On July 9, 2026, researchers from Symantec's Threat Hunter Team published analysis of GodDamn, a ransomware variant deployed by the Hyadina threat group in active campaigns targeting North American enterprises — with documented concentration in the healthcare, manufacturing, and education sectors — since at least May 21, 2026. GodDamn is a functional rebrand of the Beast and Monster ransomware lineages, distinguished from its predecessors by its integration of PoisonX, a kernel-level driver carrying a legitimate Microsoft Windows Hardware Compatibility Publisher signature.
Published July 10, 2026
The Loud and the Silent: How Factory-v3 Loaders Deploy Vidar and XMRig as a Dual-Monetization Payload
A coordinated, high-volume malware campaign documented by Palo Alto Networks Unit 42 on July 8, 2026 is deploying paired payloads — Vidar Stealer version 2.0 and the XMRig Monero miner — through a Go-compiled loader framework designated Factory-v3. The campaign reaches endpoints through two primary delivery channels: search engine malvertising impersonating cracked software downloads, and compromised high-subscriber YouTube channels with pinned malicious file links.
Published July 10, 2026
Before the Money Moves: Operation First Light 2026 and the Closing Window for Financial Fraud Interdiction
On July 8, 2026, INTERPOL announced the culmination of Operation First Light 2026, a coordinated law enforcement action spanning 97 countries that resulted in 5,811 arrests, the execution of more than 10,211 search warrants, and the interception of approximately $293 million USD in fraudulently obtained fiat currency and digital assets. Investigators identified and disrupted more than 14,800 malicious bank accounts and electronic wallets used as cash-out infrastructure by transnational fraud syndicates.
Published July 8, 2026
Manufactured Distance: How UAT-7810's ORB Network Infrastructure is Rewriting the Rules of Attribution
On July 7, 2026, Cisco Talos documented UAT-7810's continued expansion of the "LapDogs" Operational Relay Box network — a layered proxy architecture routing downstream espionage operations through compromised residential devices, paired with a new self-erasing malware suite that eliminates forensic artifacts upon detection.
Published July 8, 2026
The Gray Zone Under Fire: Manufacturing's Converging Ransomware & APT Crisis at the IT/OT Boundary
Telemetry compiled by CYFIRMA across Q2 2026 documents a sector-defining inflection point for global manufacturing: a sustained, elevated risk baseline of 6.7 out of 10 that shows no signs of cyclical relief, with Akira ransomware accounting for over 25% of global operations against the sector.
Published July 8, 2026
The Soft Target Doctrine: How the Texas Hearing Institute Breach Exposes Mid-Market Healthcare's Structural Security Deficit
In March 2026, the Texas Hearing Institute identified unauthorized access to its internal network following a compromise active since at least February 11. The Interlock ransomware syndicate exfiltrated 540 gigabytes of sensitive data before detection occurred, ultimately exposing 29,498 individuals.
Published July 7, 2026
The Telemetry Trap: Deconstructing the Windows GDID Identity Stack & The Myth Of Network Anonymity
In July 2026, federal prosecutors unsealed charges against Peter Stokes, a 19-year-old alleged Scattered Spider operative apprehended in Finland, whose identification and location tracking were enabled in significant part by Microsoft telemetry logs mapping a persistent Windows device identifier — the Global Device Identifier — to his activity across multiple platforms.
Published July 7, 2026
The JVM Contagion: Deconstructing Multi-Platform Persistence & Modular Expansion In Java-Based MaaS Pipelines
Security researchers at LevelBlue Labs published a detailed analysis on June 25, 2026, documenting QuimaRAT, a Java-based Remote Access Trojan actively marketed across dark web forums under an industrialized Malware-as-a-Service subscription model offering tiered access from $150 monthly to $1,200 for lifetime licensing.
Published July 7, 2026
The Compilation Evasion: How Cavern Manticore Weaponizes Non-Standard .Net Architectural Structures to Defeat Security Perimeters
In July 2026, Check Point Research published a technical analysis of Cavern Manticore, an Iran-nexus cyber espionage group attributed to actors linked to the Ministry of Intelligence and Security and assessed as related to the Lyceum and OilRig subgroups.
Published July 6, 2026
The Machine-Speed Adversary: Deconstructing the Architectural Threat of Autonomous LLM-Driven Ransomware Agents
In July 2026, the Sysdig Threat Research Team documented a threat actor designated JADEPUFFER executing the first confirmed end-to-end agentic ransomware campaign—a fully autonomous operation in which a large language model agent conducted intrusion, lateral movement, credential harvesting, and irreversible database destruction without human operator involvement.
Published July 6, 2026
The Gamification of Ecosystem Ingress: Deconstructing TeamPCP's Crowdsourced Supply Chain Warfare
Between March and June 2026, a threat actor group designated TeamPCP executed a cascading software supply chain campaign that compromised foundational developer tools, infected an estimated 518 million cumulative package downloads across 172 upstream packages, and deployed a self-propagating credential-harvesting worm designated Shai-Hulud 3.0 across npm, PyPI, and GitHub Actions ecosystems.
Published July 6, 2026
The Residential Smokescreen: Stripping Anonymity from State-Sponsored and Automated Identity Attacks
On July 2, 2026, the Federal Bureau of Investigation, the IRS Criminal Investigation division, and Google's Threat Intelligence Group executed a coordinated global takedown of the NetNut proxy network—also tracked as the Popa botnet—dismantling infrastructure commanding at least 2 million infected residential devices that had served as anonymous routing infrastructure for hundreds of threat clusters spanning ransomware operations to state-sponsored espionage.
Published: July 6, 2026
The Exposed Lens: Unpacking Memory Exhaustion, Path Traversal, And Tenant Segregation Breakdown in DICOM Software Components
On June 30, 2026, CISA issued Medical Advisory ICSMA-26-181-01 disclosing five high-severity vulnerabilities in the OFFIS DICOM Communications Toolkit, an open-source library embedded in thousands of commercial imaging systems and diagnostic workstations worldwide.
Published: July 3, 2026
The Deceptive Assessment: Inside the Deserialization Collapse of Enterprise SharePoint Frameworks
Microsoft's May 2026 security patches addressed a critical remote code execution vulnerability (CVE-2026-45659) in on-premises SharePoint Server 2016, 2019, and Subscription Edition, stemming from unsafe .NET deserialization of untrusted object streams.
Published: July 3, 2026
The Authorization Intercept: Re-Evaluating Trust Boundaries in the Browser-Native Phishing Era
Mid-2026 threat intelligence reveals a critical paradigm shift in cloud credential compromise. The "ConsentFix" attack methodology, combining OAuth consent phishing with copy-paste social engineering, completely bypasses traditional Multi-Factor Authentication by operating entirely after successful user authentication.
Published: July 3, 2026
The Exploited Hunter: Weaponizing Urgency and Package Dependency Confusion Against the Vulnerability Research Community
Security researchers and vulnerability analysts have become targets of a sophisticated campaign distributing trojanized proof-of-concept exploit repositories on GitHub. The "ChocoPoC" Remote Access Trojan campaign, discovered by YesWeHack and Sekoia, exploits the professional urgency of cybersecurity practitioners by distributing weaponized repositories for high-severity, newly disclosed vulnerabilities.
Published: June 30, 2026
The Identity Pivot: How WhatsApp Usernames Reshape OSINT, Corporate Impersonation, and Global OpSec
WhatsApp's transition to unique usernames represents the platform's most significant architectural change in its 17-year history, fundamentally decoupling user identity from phone numbers at a service with 3 billion users.