Weekly Review, 2026-07-06
Weekly Review - July 06, 2026
Covers 7 daily digests (2026-06-30 to 2026-07-06).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. EvilTokens and ARToken target Microsoft 365 via OAuth 2.0 vulnerabilities
6 outlets, 2026-07-01 to 2026-07-06 - severity 4/5
The EvilTokens threat actor and its ARToken phishing-as-a-service affiliate are targeting Microsoft 365 environments through sophisticated credential harvesting and automated password spray attacks. The attack chain exploits the Microsoft Identity Platform's OAuth 2.0 Device Authorization Grant workflow, where attackers use legitimate domains or open redirects to trick users into entering one-time codes on official Microsoft authentication pages. This mechanism allows attackers to bypass multi-factor authentication and harvest access, refresh, and ID tokens, providing persistent access to Outlook mailboxes, SharePoint sites, OneDrive files, and Teams conversations. A massive Azure CLI password spray campaign targeting the deprecated OAuth ROPC flow resulted in approximately 81 million login attempts and the compromise of dozens of identities across multiple businesses. The ARToken platform features a React-based dashboard with over 80 API endpoints designed for business email compromise (BEC) operations, including inbox rule manipulation and keyword monitoring. The situation remains active as attackers continue to use these session-hijacking techniques to maintain silent, long-term access to victim accounts.
Sources
- ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 - Cisco Talos Blog, 2026-07-01 (quality: 20/21)
- This phishing kit looks more like BEC-as-a-service - CyberScoop, 2026-07-01 (quality: 17/21)
- Massive Password Spray Campaign Targeting Azure CLI - SecurityWeek, 2026-07-01 (quality: 20/21)
- Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts - The Hacker News, 2026-07-01 (quality: 20/21)
- ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit - BleepingComputer, 2026-07-03 (quality: 19/21)
- When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website - Securelist, 2026-07-06 (quality: 18/21)
2. FBI and Google disrupt NetNut residential proxy network using Popa botnet
5 outlets, 2026-07-03 to 2026-07-06 - severity 4/5
The FBI, IRS Criminal Investigation, and Google coordinated a major disruption of the NetNut residential proxy network, which was built upon the Popa botnet. The botnet utilized at least two million compromised Android devices, including smart TVs and streaming boxes, to route malicious traffic through legitimate residential IP addresses for activities such as password-spraying, account takeovers, advertising fraud, and Mirai-variant DDoS attacks. NetNut recruited these devices by tricking users into installing "bandwidth sharing" apps or by leveraging pre-compromised hardware from grey-market supply chains and malware families like Badbox 2.0. In response, law enforcement seized hundreds of associated domains, while Google disabled command-and-control (C2) accounts and used Google Play Protect to automatically disable malicious applications and SDKs. This operation significantly degraded NetNut's business operations by reducing its available device pool by millions.
Sources
- FBI Seizes NetNut Proxy Platform, Popa Botnet - Krebs on Security, 2026-07-02 (quality: 20/21)
- Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices - SecurityWeek, 2026-07-03 (quality: 19/21)
- Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices - The Hacker News, 2026-07-02 (quality: 18/21)
- NetNut proxy network disrupted, 2 million infected devices cut off - BleepingComputer, 2026-07-03 (quality: 20/21)
- NetNut botnet takes a hit. Don’t be part of the next one. - Malwarebytes, 2026-07-06 (quality: 14/21)
3. Scattered Spider member Peter Stokes faces charges for luxury jewelry retailer attack
5 outlets, 2026-07-02 to 2026-07-03 - severity 4/5
Peter Stokes, a member of the Scattered Spider hacking collective, was extradited from Finland to the United States to face charges of conspiracy, fraud, and computer intrusion. Stokes is alleged to have participated in multiple network breaches since 2022, including an attack on a luxury jewelry retailer where he and co-conspirators allegedly stole data and demanded an $8 million cryptocurrency ransom. The group utilized social engineering techniques, such as using Google Voice numbers to impersonate employees and call IT helpdesks to reset credentials, to facilitate their intrusions. Scattered Spider's operations have impacted a wide range of organizations across the retail, insurance, aviation, and technology sectors, including Caesars Entertainment, MGM Resorts, and Salesforce. Following an investigation that included criminal referrals from Microsoft, Stokes was arrested in Finland in April 2025 and has since made an initial court appearance in Chicago, where he was ordered to remain in jail.
Sources
- Alleged Scattered Spider hacker extradited to the United States - BleepingComputer, 2026-07-02 (quality: 18/21)
- Teen suspect in Scattered Spider hacks is extradited to US - The Record from Recorded Future News, 2026-07-01 (quality: 19/21)
- 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - The Hacker News, 2026-07-01 (quality: 20/21)
- Alleged longstanding member of Scattered Spider extradited to US - CyberScoop, 2026-07-02 (quality: 19/21)
- Alleged Scattered Spider Hacker Extradited to US - SecurityWeek, 2026-07-03 (quality: 14/21)
4. INC and Lynx ransomware operations target FortiGate firewalls in FortiBleed campaign
5 outlets, 2026-07-01 to 2026-07-03 - severity 4/5
The FortiBleed campaign, linked to the INC ransom and Lynx ransomware operations, targeted approximately 430,000 FortiGate firewalls globally to harvest over 110 million credentials. Attackers scanned for exposed Fortinet devices and deployed a custom Golang-based tool, known as FortiGate Sniffer, to intercept VPN credentials and authentication data from network traffic. An operational security error by the threat actors exposed a server containing stolen configuration files, harvested credentials, and documentation, which allowed researchers to observe an operator accessing negotiation panels for both ransomware groups. The campaign achieved administrator-level access on 409 targets and fully compromised 354 organizations, leading to at least 12 confirmed ransomware deployments and the encryption of hundreds of endpoints. Following security notifications, the number of identified devices undergoing traffic sniffing decreased from 19,000 to 11,000. The Cybersecurity and Infrastructure Security Agency issued a warning regarding the widespread use of these compromised credentials.
Sources
- FortiBleed credential-theft campaign linked to Lynx ransomware - BleepingComputer, 2026-07-01 (quality: 20/21)
- FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations - The Hacker News, 2026-07-02 (quality: 20/21)
- FortiBleed campaign traced to INC and Lynx ransomware operations - Cybersecurity Dive - Latest News, 2026-07-02 (quality: 18/21)
- FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs - darkreading, 2026-07-02 (quality: 20/21)
- 22nd June – Threat Intelligence Report - Check Point Research, 2026-07-01 (quality: 15/21)
5. Unauthorized Third Party Compromises Aflac Life Insurance Japan Ltd Policyholder Portal
2 outlets, 2026-06-30 to 2026-07-06 - severity 4/5
An unauthorized third party accessed the systems of Aflac Life Insurance Japan Ltd. between June 15 and June 25, 2026, by compromising a policyholder portal. The breach exposed the personal information of approximately 4.38 million customers and agents, including names, addresses, phone numbers, dates of birth, gender, and insurance account details. Additionally, the attackers exfiltrated insurance premium transfer account information for roughly 230,000 individuals, though no credit card data was accessed. In response to the discovery on June 25, the company suspended certain systems to contain the incident and initiated an investigation with external cybersecurity experts. While the breach disrupted at least five services, Aflac Incorporated confirmed that the incident was limited to Japanese systems and did not affect its U.S. business operations. The company has filed a disclosure with the Securities and Exchange Commission regarding the event.
Sources
- Insurance giant Aflac discloses data breach after subsidiary hack - BleepingComputer, 2026-06-30 (quality: 16/21)
- Aflac Japan Data Breach Impacts 4.38 Million - SecurityWeek, 2026-06-30 (quality: 17/21)
6. ShinyHunters exploits Oracle PeopleSoft vulnerability to target over 100 organizations
3 outlets, 2026-06-30 to 2026-07-03 - severity 4/5
ShinyHunters exploited a critical remote code execution vulnerability (CVE-2026-35273) in the Oracle PeopleSoft Environment Management component to conduct a data theft campaign targeting over 100 organizations. The attack, which occurred between May 27 and June 9, 2026, impacted various sectors including education and finance, with notable victims including the National Association of Insurance Commissioners (NAIC), Nissan Americas, and several credit rating agencies. While ShinyHunters claimed to have exfiltrated 3.1 TB of data from the NAIC, the organization reported that the stolen information consisted primarily of publicly available statutory reports, outdated logs, and configuration data rather than personally identifiable information. The breach resulted in operational disruptions, such as Moody’s suspending data services, and prompted Oracle to release an advisory for affected PeopleTools versions.
Sources
- Insurance body confirms hackers posted Oracle PeopleSoft breach data - Cybersecurity Dive - Latest News, 2026-06-29 (quality: 19/21)
- Nissan discloses employee data breach linked to Oracle zero-day attacks - BleepingComputer, 2026-06-29 (quality: 18/21)
- NAIC says public data stolen in ShinyHunters' PeopleSoft breach - BleepingComputer, 2026-06-29 (quality: 19/21)
- Nissan Employee Data Breached in Oracle PeopleSoft Hack - SecurityWeek, 2026-06-30 (quality: 17/21)
7. China Iran and Russia target water utility systems via configuration weaknesses
1 outlet, 2026-06-30 - severity 5/5
Nation-state actors from China, Iran, and Russia are targeting water utility systems to conduct sabotage operations. These attackers gain access to critical infrastructure by exploiting weak passwords, exposed programmable logic controllers (PLCs), and insufficient network segmentation. The intrusions rely on these existing configuration weaknesses rather than the deployment of sophisticated malware. The current activity focuses on breaching operational technology environments to disrupt essential water services.
Sources
- Iran, Russia, China Target Water Systems for Sabotage - darkreading, 2026-06-29 (quality: 10/21)
8. APT28, MuddyWater, and Kimsuky use ClickFix and ConsentFix against developers
3 outlets, 2026-07-01 to 2026-07-03 - severity 4/5
Threat actors are utilizing ClickFix and ConsentFix social engineering techniques to deliver malware and hijack Microsoft 365 accounts by tricking users into executing malicious commands or granting unauthorized OAuth permissions. In ClickFix attacks, victims are prompted via fake error messages to use keyboard shortcuts like Windows+X or macOS Script Editor to paste and run obfuscated commands, which can deliver payloads such as Atomic macOS Stealer or Deepload. ConsentFix attacks involve fake authentication screens that lead users to surrender session tokens, allowing attackers to bypass multi-factor authentication and achieve account takeover in seconds. These campaigns have targeted developers through Google Ads malvertising and have been linked to state-backed groups including APT28, MuddyWater, and Kimsuky. The scope of these activities is significant, with Microsoft reporting that ClickFix accounted for 47% of its observed initial-access cases in 2025 and a single ClearFake wave potentially infecting over 147,000 systems. As of early 2026, the technical barrier for these attacks is decreasing due to the availability of tutorials and working code on cybercrime forums.
Sources
- Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery - The Hacker News, 2026-07-01 (quality: 20/21)
- And the Winner in Dominant Malware Delivery? ClickFix - darkreading, 2026-07-01 (quality: 20/21)
- ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds - BleepingComputer, 2026-07-02 (quality: 13/21)
Under the Radar
High-severity stories that received limited coverage this period.
ShinyHunters targets education sector through Instructure Canvas supply chain attacks
1 outlet, 2026-07-06 - severity 4/5
The threat actor ShinyHunters targeted the education sector through supply chain attacks, claiming responsibility for a breach of the Instructure Canvas system that allegedly compromised 3.65TB of data across approximately 9,000 schools. The group also exploited Oracle software suites used by higher education institutions to manage student records and financial aid, following previous large-scale breaches involving PowerSchool and Progress Software’s MOVEit. These attacks leveraged vulnerabilities in specialized edtech vendors and diverse device environments to access sensitive student data and intellectual property. The Los Angeles Unified School District and various K-12 and higher education institutions remain impacted by these systemic vulnerabilities in procurement and resource allocation.
Why it matters: Confirmed widespread exploitation of supply chain vendors like Instructure and Progress Software affecting thousands of schools and millions of students.
Sources
- Why schools are easy prey for hackers — and why they struggle to fight back - Cybersecurity Dive - Latest News, 2026-07-06 (quality: 20/21)
North Korean threat actors execute PolinRider campaign targeting public GitHub repositories
1 outlet, 2026-07-04 - severity 4/5
North Korean threat actors linked to the Contagious Interview campaign executed the PolinRider campaign by publishing 108 malicious software packages and browser extensions across npm, Packagist, Go, and Google Chrome registries. The attackers utilized Git history rewriting, including force pushes and anti-dated commits, to mask malicious changes and concealed payloads within whitespace padding or fake font files. This activity compromised 1,951 public GitHub repositories belonging to 1,047 unique owners to deliver malware such as BeaverTail, DEV#POPPER RAT, and OmniStealer. The malware specifically targets configuration files like "tailwind.config.js" and "next.config.mjs" to append malicious JavaScript, often fetching second-stage payloads via blockchain infrastructure.
Why it matters: Confirmed widespread supply chain exploitation involving nearly 2,000 repositories and significant malware deployment by a known North Korean threat actor.
Sources
- North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign - The Hacker News, 2026-07-04 (quality: 20/21)
- North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets - The Hacker News, 2026-07-03 (quality: 20/21)
Anubis ransomware actors exploit Citrix Bleed 2 to target NetScaler systems
1 outlet, 2026-07-03 - severity 4/5
Anubis ransomware actors are exploiting the Citrix Bleed 2 vulnerability (CVE-2025-5777) to bypass authentication and gain initial access to NetScaler ADC and Gateway systems. Once inside, affiliates utilize legitimate Remote Management and Monitoring (RMM) tools such as ScreenConnect and Zoho Assist to maintain persistence and blend with standard IT traffic. The campaign includes specialized modules like Anubis's /WIPEMODE, which can irreversibly reduce files to 0 KB, and The Gentlemen RaaS group's use of a Go-based backdoor alongside "bring your own vulnerable driver" (BYOVD) techniques to disable security software from Microsoft, ESET, and Palo Alto Networks. Concurrently, a partnership between VECT and TeamPCP has emerged to combine supply chain credential theft with ransomware deployment, with VECT's encryption process currently prone to flaws that permanently destroy files larger than 128 KB.
Why it matters: Active exploitation of a critical Citrix vulnerability (CVE-2025-5777) by ransomware actors poses a high risk of widespread unauthorized access and data destruction.
Sources
- Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials - The Hacker News, 2026-07-02 (quality: 20/21)
All Stories by Category
Vulnerabilities & Patches
- Zhipu AI and 360 Security Tools Advance Vulnerability Discovery Capabilities (2026-07-04, 1 outlet, severity 3/5)
- OpenClaw Ecosystem Faces 530 Vulnerabilities and Malicious Skill Distribution (2026-07-01, 1 outlet, severity 3/5)
- Apple Updates Patching Strategy to Combat AI-Driven Cyber Threats (2026-07-03, 1 outlet, severity 2/5)
- Apple Reverses Age-Old Patch Policy to Keep Up With AI - darkreading
- Malwarebytes Reports Mac Malware, ConsentFix, and WinRAR Vulnerabilities (2026-07-06, 1 outlet, severity 2/5)
- A week in security (June 29 – July 5) - Malwarebytes
- NIST Enrichment Reductions Compromise CVE Coverage and Accuracy Data (2026-06-30, 1 outlet, severity 2/5)
- NIST Enrichment Reductions Impact CVE Coverage, Accuracy - darkreading
Data Breaches
- Kubota North America Breach Exposes Employee Social Security Numbers (2026-07-02, 1 outlet, severity 3/5)
- Kubota says hackers had month-long access to network systems - BleepingComputer
Ransomware
- Apple Email Flaw, BlueHammer Ransomware, and AI Compute Hijacking Threats (2026-07-03, 1 outlet, severity 4/5)
- JadePuffer uses LLM agent to launch ransomware attack on Alibaba Nacos (2026-07-02 to 2026-07-05, 3 outlets, severity 3/5)
- AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack - The Hacker News
- Agentic AI Used to Conduct Ransomware Attack via Langflow - SecurityWeek
- JadePuffer ransomware used AI agent to automate entire attack - BleepingComputer
- The Gentlemen Ransomware Targets 300+ Victims and NATO Contractor Indra (2026-07-03, 1 outlet, severity 4/5)
- The Gentlemen ransomware: what you need to know - GRAHAM CLULEY
- Interpol Impersonation Ransomware Campaign Targets Small Businesses Globally (2026-07-03, 1 outlet, severity 3/5)
- DeepSeek LLM Hallucinations Enable New InfernoGrabber Browser Ransomware Attack (2026-07-01, 1 outlet, severity 3/5)
- Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - Check Point Research
- Kairos Extorted $1 Million From Union County via Data Theft (2026-07-05, 1 outlet, severity 3/5)
- Black Basta Ransomware Uses Corporate Structures to Maximize Extortion (2026-06-30, 1 outlet, severity 3/5)
- Bumblebee and AdaptixC2 Malware Used to Deploy Akira Ransomware (2026-06-30, 1 outlet, severity 3/5)
- From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira - The DFIR Report
- Blackfield Ransomware Demands $2 Million From Nidec Corporation (2026-06-30, 1 outlet, severity 3/5)
- Blackfield ransomware asks Nidec Corporation for $2 million ransom - BleepingComputer
- RustDuck Botnet Uses Rust to Hijack Routers and Servers (2026-07-01, 1 outlet, severity 3/5)
- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS - The Hacker News
Supply Chain Attacks
- Polymarket Supply Chain Attack and KDDI Email Breach Detailed (2026-06-30, 1 outlet, severity 4/5)
- 29th June – Threat Intelligence Report - Check Point Research
- Operation Navy Ghost uses PyPI packages to hijack Telegram bots (2026-07-01, 1 outlet, severity 3/5)
- Malicious PyPI packages give hackers control of Telegram bot servers - BleepingComputer
Nation-State / APT
- Armored Likho targets government and electric power infrastructure using BusySnake Stealer (2026-07-03 to 2026-07-04, 2 outlets, severity 4/5)
- Mustang Panda Exploits Vulnerabilities to Target Indian Government Systems (2026-06-30, 1 outlet, severity 4/5)
- UNC5792 and UNC4221 Russian cyber campaign targets Signal and WhatsApp users (2026-06-30, 2 outlets, severity 4/5)
- U.S. offers $10 million for hackers targeting WhatsApp, Signal users - BleepingComputer
- US posts $10 million reward over Russian cyber campaign targeting Signal, WhatsApp - The Record from Recorded Future News
- ToddyCat APT uses Umbrij malware to steal OAuth codes from Chromium browsers (2026-06-30 to 2026-07-03, 2 outlets, severity 3/5)
- ToddyCat: your hidden email assistant. Part 2 - Securelist
- ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API - The Hacker News
Malware & Botnets
- Malware delivered via USB and software extensions targets critical networks. (2026-06-30, 1 outlet, severity 4/5)
- Pegasus Spyware Infected Stelios Kouloglou During PEGA Committee Investigation (2026-07-03, 3 outlets, severity 3/5)
- Someone infected a spyware probe overseer with spyware - CyberScoop
- Spyware found on phone of European Parliament member probing it - The Record from Recorded Future News
- European Parliament Member Investigating Spyware Was Hacked With Pegasus - The Hacker News
- Unknown threat actors use SEO poisoning to distribute ScreenConnect and AsyncRAT (2026-07-01 to 2026-07-02, 2 outlets, severity 3/5)
- ChocoPoC malware campaign uses trojanized GitHub exploits to target cybersecurity researchers (2026-07-02, 2 outlets, severity 3/5)
- New ChocoPoC malware targets researchers via trojanized PoC exploits - BleepingComputer
- New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - The Hacker News
- QuimaRAT Java-Based Malware Targets Windows, Linux, and macOS Systems (2026-07-06, 1 outlet, severity 3/5)
- New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS - The Hacker News
- PamStealer malware uses fake Maccy sites to steal macOS credentials (2026-07-03, 1 outlet, severity 3/5)
- TrojPix malware leaks air-gapped data through video cable emissions (2026-07-06, 1 outlet, severity 3/5)
- Kaspersky Report Reveals Persistent Threats and Undetected Malware Risks (2026-07-02, 1 outlet, severity 3/5)
- Ousaban Banking Trojan Uses Fake PDFs to Target Iberian Users (2026-07-02, 1 outlet, severity 3/5)
- Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - The Hacker News
- Opera Launches Paste Protect to Combat ClickFix Security Attacks (2026-07-02, 1 outlet, severity 2/5)
- Opera rolls out Paste Protect feature to fight ClickFix attacks - BleepingComputer
- VEIL#DROP Chain Uses Blogger Pages to Distribute PureLogs Stealer (2026-07-02, 1 outlet, severity 2/5)
- Criminal IP Integration Enhances OpenCTI With Contextual Threat Intelligence (2026-07-02, 1 outlet, severity 1/5)
- Turning Indicators into Intelligence in OpenCTI with Criminal IP - BleepingComputer
Phishing & Social Engineering
- Montana Empire uses phantom squatting to target national postal service domains (2026-07-01, 2 outlets, severity 3/5)
- Silver Fox Uses Fake Indian Tax Utility to Deploy DCRat (2026-07-06, 1 outlet, severity 3/5)
- Cofense Research: Phishing Campaigns Use User-Agent Data to Deploy FleetDeck (2026-07-02, 1 outlet, severity 3/5)
- Flare Report: AI and Call Centers Fuel BEC Attacks (2026-07-01, 1 outlet, severity 3/5)
- Lessons from the Underground: How to Combat Business Email Compromise - BleepingComputer
- MetaMask users targeted by new secret recovery phrase phishing campaign (2026-07-01, 1 outlet, severity 3/5)
- Why Ask Credentials If There Are Secret Codes?, (Wed, Jul 1st) - SANS Internet Storm Center, InfoCON: green
- Threat actors use Venezuela earthquake domains and Amazon job text scams (2026-07-01, 2 outlets, severity 2/5)
- Scammers race to cash in on Venezuelan earthquake disaster - GRAHAM CLULEY
- Watch out for “high paying, low effort” Amazon job texts - Malwarebytes
Identity & Access Management
- Microsoft 365 Faces 81 Million Password-Spraying Login Attempts (2026-07-02, 1 outlet, severity 3/5)
- Hackers target Microsoft 365 accounts with 81 million login attempts - BleepingComputer
- Exposed AI Endpoints Hijacked by Attackers for Offensive Operations (2026-07-01, 1 outlet, severity 3/5)
- Prisma Browser Integrates WebAuthn Support for Secure RDP Access (2026-07-03, 1 outlet, severity 2/5)
- AI Agents Break Traditional Identity Lifecycle Management Models (2026-07-02, 1 outlet, severity 2/5)
- Identity Lifecycle Management Wasn't Built for AI Agents - The Hacker News
- Agentic AI Identity Risks Threaten Organizations via Excessive Permissions (2026-06-30, 1 outlet, severity 2/5)
- Agentic AI Has an Identity Problem and Attackers Know It - BleepingComputer
- Scott Helme Launches Why No Passkeys To Track Adoption (2026-07-01, 1 outlet, severity 1/5)
AI & Machine Learning Security
- Amazon researchers bypassed Anthropic safeguards to identify software vulnerabilities (2026-07-02, 4 outlets, severity 3/5)
- Anthropic reactivates Fable, Mythos after securing government approval - Cybersecurity Dive - Latest News
- US lifts export controls on Anthropic’s frontier cybersecurity AI models - The Record from Recorded Future News
- US lifting export control restrictions on Anthropic’s Mythos, Fable - CyberScoop
- Trump Administration Lifts Restrictions on Anthropic’s Claude Models After Cybersecurity Alarm - SecurityWeek
- BioShocking prompt injection attack manipulates agentic browsers to exfiltrate GitHub credentials (2026-07-01 to 2026-07-02, 2 outlets, severity 3/5)
- New BioShocking attack manipulates AI browser into data theft - BleepingComputer
- ‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials - SecurityWeek
- Attackers use Agentjacking to execute arbitrary code via vulnerable AI agents (2026-07-01, 2 outlets, severity 3/5)
- Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks - SecurityWeek
- Fake Bug Report Hijacks AI Coding Agents at Scale - darkreading
- Silent Swap cryptocurrency clipper campaign uses malicious Chrome extension to intercept data (2026-06-30 to 2026-07-01, 2 outlets, severity 3/5)
- Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input - The Hacker News
- Fake Perplexity extension on Chrome Web Store tracked searches - BleepingComputer
- Indirect prompt injection attacks target Claude Code and AI browsers (2026-06-30, 2 outlets, severity 3/5)
- Zscaler Warns Prompt Injection Attacks Trick AI Agents Into Crypto Payments (2026-07-06, 1 outlet, severity 3/5)
- Unit 42 Warns of Phantom Squatting via LLM Hallucinations (2026-07-02, 1 outlet, severity 3/5)
- SkillCloak uses self-extracting packing to bypass AI agent scanners. (2026-07-06, 1 outlet, severity 3/5)
- iOS AI Apps Leak OpenAI API Keys, Study Finds (2026-07-01, 1 outlet, severity 3/5)
- ChatGPT Prompt Manipulation Bypasses Safety Filters to Generate Violent Imagery (2026-07-01, 1 outlet, severity 3/5)
- DeepSeek AI Powers New Chromium API Browser Ransomware Attack (2026-07-02, 1 outlet, severity 3/5)
- Microsoft Warns Poisoned MCP Tool Descriptions Can Leak AI Data (2026-07-01, 1 outlet, severity 3/5)
- New Avalon Malware Framework Integrates CrownX Ransomware Capabilities (2026-07-04, 1 outlet, severity 3/5)
- New Avalon Malware Framework Packs CrownX Ransomware Capabilities - The Hacker News
- Agentic AI Token Costs Threaten Cybersecurity Budget Stability (2026-06-30, 1 outlet, severity 2/5)
- The AI Token Costs That Can Break Cybersecurity - SecurityWeek
- Bill Swearingen’s Geometric Clothing Aims to Defeat Facial Recognition AI (2026-06-30, 1 outlet, severity 2/5)
- Can Clothes Make You Invisible to Facial Recognition? - darkreading
- Auditing AI-Driven SDLC: Strategies for Managing New Software Risks (2026-07-03, 1 outlet, severity 2/5)
- RemoteThreat CEO Chris Thompson Discusses AI and Red Teaming Evolution (2026-06-30, 1 outlet, severity 1/5)
- Protiviti Study: Scaling AI Requires Strategic Priority and Ethical Governance (2026-06-30, 1 outlet, severity 1/5)
- At AI’s Inflection Point, How Do You Go From Experimentation to Enterprise Value? - Corporate Compliance Insights
- Six Essential Security Questions for Evaluating Frontier AI Vendors (2026-07-01, 1 outlet, severity 1/5)
- AI-Driven Vulnerability Surges Demand Better Business-Centric Risk Prioritization (2026-07-06, 1 outlet, severity 1/5)
- Finding vulnerabilities was never the hard part - CyberScoop
- 6 Key Capabilities for Evaluating AI SOC Platforms in 2026 (2026-07-06, 1 outlet, severity 1/5)
- Quantifind Secures $200 Million to Expand AI Risk Intelligence Platform (2026-06-30, 1 outlet, severity 1/5)
Legal & Law Enforcement
- Supreme Court Rules Google Cellphone Location Data Collection Is Fourth Amendment Search (2026-06-30, 3 outlets, severity 3/5)
- Supreme Court delivers ‘major win’ for tech privacy in Chatrie ruling - CyberScoop
- Supreme Court Rules Constitutional Privacy Protections Apply to Cellphone Users’ Location History - SecurityWeek
- Justices rule that cellphone location histories are protected by the Fourth Amendment - The Record from Recorded Future News
- Amazon pays $2.25M FTC fine for withholding fraud victim records (2026-07-01, 1 outlet, severity 2/5)
- Amazon fined $2.25M for withholding evidence from fraud victims - BleepingComputer
- US and FIFA Shut Down 400 Illegal World Cup Sites (2026-06-30, 1 outlet, severity 2/5)
- US racks up about 400 wins over illegal World Cup streaming sites - The Record from Recorded Future News
- Google loses final appeal against €4.1 billion EU antitrust fine (2026-07-03, 1 outlet, severity 1/5)
- Google loses final appeal to overturn €4.1 billion EU fine - BleepingComputer
Policy & Regulation
- U.S. Department of Commerce shuts down Anthropic Claude Fable 5 models (2026-07-01 to 2026-07-03, 2 outlets, severity 3/5)
- Anthropic to restore Claude Fable access on Wednesday - BleepingComputer
- Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls - The Hacker News
- Claude Fable 5 isn’t permanently leaving subscriptions, Anthropic says - BleepingComputer
- Claude Fable relaunch disappoints users with nerfed performance - BleepingComputer
- DHS proposes ANCHOR-CI framework to replace CIPAC for critical infrastructure operators (2026-07-01, 2 outlets, severity 3/5)
- DHS to unveil replacement council for critical infrastructure cybersecurity - CyberScoop
- DHS proposes new framework for public-private infrastructure security collaboration - Cybersecurity Dive - Latest News
- Max Schrems to Challenge EU-U.S. Data Privacy Framework Following Ruling (2026-07-03, 1 outlet, severity 3/5)
- Supreme Court decision threatens EU-US data transfer agreement - The Record from Recorded Future News
- CMMC Cybersecurity Requirements Now Impacting U.S. Defense Industry Contracts (2026-07-06, 1 outlet, severity 3/5)
- CMMC Cybersecurity Rules Are Rolling Into Defense Contracts - Corporate Compliance Insights
- Warner’s AI AGENT Act Proposes Federally Vetted Software List (2026-06-30, 1 outlet, severity 3/5)
- OpenAI Limits GPT-5.6 Release Following Trump Administration Request (2026-06-30, 1 outlet, severity 3/5)
- OpenAI voluntarily limits new AI models at government’s request - Cybersecurity Dive - Latest News
- Bitdefender Report: 55% of Cyber Workers Told to Hide Breaches (2026-07-03, 1 outlet, severity 3/5)
- Most cybersecurity workers have been told to conceal a breach, report finds - Cybersecurity Dive - Latest News
- House passes KIDS Act despite Senate opposition over accountability gaps (2026-07-01, 1 outlet, severity 2/5)
- House passes kids’ online safety bill, but Senate approval unlikely - The Record from Recorded Future News
- UK National Cyber Action Plan launch delayed by leadership crisis (2026-07-03, 1 outlet, severity 2/5)
- Launch of UK's National Cyber Action Plan delayed amid Labour leadership crisis - The Record from Recorded Future News
- FTI Consulting Guide Outlines Governance Duties for US Broker-Dealers (2026-07-06, 1 outlet, severity 1/5)
- A Helpful Guide to Corporate Governance at US Broker-Dealers - Corporate Compliance Insights
Other Cybersecurity
- DHS Investigating Cyberattack on HSIN Information-Sharing Platform (2026-07-02, 1 outlet, severity 4/5)
- DHS confirms hackers breached HSIN info-sharing platform - BleepingComputer
- Cyberattacks Target Critical Infrastructure and Hospitality Sectors Globally (2026-07-01, 1 outlet, severity 4/5)
- WhatsApp begins global reservations for usernames to protect user phone numbers (2026-06-30, 3 outlets, severity 2/5)
- WhatsApp rolls out usernames to help users hide their phone number - BleepingComputer
- WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private - The Hacker News
- WhatsApp Rolling Out Username Feature to Bolster Phone Number Privacy - SecurityWeek
- Microsoft accelerates post-quantum cryptography shift to protect critical products and services (2026-07-01, 2 outlets, severity 2/5)
- Microsoft accelerates quantum-safe roadmap as risks grow - BleepingComputer
- Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - The Hacker News
- Microsoft releases policy to prevent unauthorized third-party bots from joining Teams meetings (2026-06-30 to 2026-07-02, 2 outlets, severity 2/5)
- Microsoft adds smarter bot protection to Teams meetings - BleepingComputer
- Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - SecurityWeek
- Australian SMBs Face Rising Cyber Risks as Individual Crime Drops (2026-07-03, 1 outlet, severity 2/5)
- Russ Vought Takes Control of Classified Intelligence Agency Budgets (2026-07-01, 1 outlet, severity 2/5)
- An intelligence budget 'super user' job is now in the hands of Russ Vought - The Record from Recorded Future News
- Using Sentinel-2 and QGIS to Track Wildfire Damage Severity (2026-06-30, 1 outlet, severity 2/5)
- Russell Vought Open to Re-staffing CISA Under New Administration (2026-07-01, 1 outlet, severity 2/5)
- FIFA World Cup Security Requires Integrated Digital Threat Intelligence (2026-07-02, 1 outlet, severity 2/5)
- Safe Events Start With Threat Intel and Digital Security - darkreading
- Ukraine Uses Seized Crypto From Cybercriminals to Buy War Bonds (2026-06-30, 1 outlet, severity 2/5)
- Ukraine to use seized crypto from cybercrime group to buy war bonds - The Record from Recorded Future News
- No specific threat actor, victim, or incident identified in provided text (2026-06-30 to 2026-07-06, 1 outlet, severity 1/5)
- ISC Stormcast For Tuesday, June 30th, 2026 https://isc.sans.edu/podcastdetail/9988, (Tue, Jun 30th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast For Thursday, July 2nd, 2026 https://isc.sans.edu/podcastdetail/9992, (Thu, Jul 2nd) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994, (Mon, Jul 6th) - SANS Internet Storm Center, InfoCON: green
- Planet Labs Imagery Reveals Widespread Destruction From Venezuela Earthquakes (2026-06-30, 1 outlet, severity 1/5)
- CIA Director John Ratcliffe Announces Major CIA Tech Restructuring (2026-07-01, 1 outlet, severity 1/5)
- CIA chief highlights major shifts in agency’s tech approach - The Record from Recorded Future News
- Kali Linux 2026.2 Debuts With Nine New Security Tools (2026-06-30, 1 outlet, severity 1/5)
- Kali Linux 2026.2 released with 9 new tools, NetHunter updates - BleepingComputer
- Women Over 50 Offer Vital Expertise for the AI Era (2026-06-30, 1 outlet, severity 1/5)
- Women Over 50: An Overlooked Workforce Built for the Age of AI - Corporate Compliance Insights
- Veena Dubal on Algorithmic Wage Discrimination and Uber’s Pay Models (2026-06-30, 1 outlet, severity 1/5)
- This pay gap is programmed (Lock and Code S07E13) - Malwarebytes
- Flipper Zero shifts firmware development to community-led model (2026-07-06, 1 outlet, severity 1/5)
- Flipper Zero firmware development continues with community help - BleepingComputer
- Talos’s Martin Lee on transitioning from virology to cybersecurity (2026-07-01, 1 outlet, severity 1/5)
- Martin Lee: Running through the Arctic (and the threat landscape) - Cisco Talos Blog
- Dawnguard Secures $6.3 Million for Security Architecture Automation Platform (2026-07-01, 1 outlet, severity 1/5)
- SANS Internet Storm Center Releases Weekly July 1st Stormcast Podcast (2026-07-01, 1 outlet, severity 1/5)
- ISC Stormcast For Wednesday, July 1st, 2026 https://isc.sans.edu/podcastdetail/9990, (Wed, Jul 1st) - SANS Internet Storm Center, InfoCON: green
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.