Weekly Review - July 20, 2026

Covers 7 daily digests (2026-07-14 to 2026-07-20).

All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.

Top Stories

1. Russian nationals provided hosting services enabling LockBit, Blacksuit, and Play attacks

4 outlets, 2026-07-15 to 2026-07-17 - severity 4/5

Russian nationals Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin operated bulletproof hosting services Media Land and ML.Cloud to provide infrastructure and technical support for ransomware gangs, phishing, and brute-force attacks. These services, along with the anonymity provider First VPN Service (1VPNS) administered by Dmytro Rashevskyi, enabled threat actors like LockBit, Blacksuit, and Play to hide attack origins and manage exfiltrated data. The activities of these providers resulted in over $62 million in damages, affecting victims across 21 U.S. states, Canada, the United Kingdom, the European Union, the United Arab Emirates, and Australia. In response, the U.S. Department of Justice unsealed a 2024 indictment against the Russian nationals, while the Department of the Treasury and OFAC issued sanctions against 1VPNS, Rashevskyi, and malware cryptor seller Yegeniy Vladimirovich Silayev. The Council of the European Union also implemented sanctions against Volosovik and his hosting companies.

Sources

• US charges alleged operators of Russian bulletproof hosting service - BleepingComputer, 2026-07-15 (quality: 19/21)
• US unseals indictment against alleged operators of Russian bulletproof hosting service - The Record from Recorded Future News, 2026-07-14 (quality: 20/21)
• US Charges Russian Individuals and Firms for Running Cybercrime Services - SecurityWeek, 2026-07-15 (quality: 18/21)
• Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrime - CyberScoop, 2026-07-16 (quality: 20/21)
• Treasury sanctions First VPN Service, others for abetting ransomware gangs - CyberScoop, 2026-07-14 (quality: 19/21)

2. Scattered Spider members sentenced for 2024 cyberattack against Transport for London

4 outlets, 2026-07-16 to 2026-07-18 - severity 4/5

Thalha Jubair and Owen Flowers, leading members of the Scattered Spider cybercrime collective, were sentenced to 66 months in prison for their roles in a 2024 cyberattack against Transport for London. The intrusion caused widespread operational disruption, rendering 148 internal systems inoperable and forcing all 27,000 employees to report to an office in person to reset passwords. The attack resulted in £29 million ($39 million) in recovery costs for Transport for London. Investigations by the National Crime Agency and the FBI linked the pair to numerous other targets, including SSM Health Care Corporation, Sutter Health, Marks & Spencer, Co-op, and Harrods, with U.S. authorities accusing Jubair of involvement in at least 120 cyberattacks. While hackers using the Scattered Spider name continued to claim credit for attacks through early 2026, law enforcement and security researchers from Microsoft and CrowdStrike stated that the arrests materially degraded the group's operational capabilities.

Sources

• Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack - The Record from Recorded Future News, 2026-07-16 (quality: 20/21)
• Two Scattered Spider Hackers Sentenced to Jail in UK - SecurityWeek, 2026-07-16 (quality: 19/21)
• Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack - The Hacker News, 2026-07-16 (quality: 13/21)
• Leading members of Scattered Spider sentenced in UK to 66 months in jail - CyberScoop, 2026-07-17 (quality: 20/21)

3. Attacker exploits AsyncAPI GitHub Actions workflow to publish malicious npm packages

3 outlets, 2026-07-15 to 2026-07-16 - severity 4/5

An attacker compromised the AsyncAPI npm organization by exploiting a misconfigured GitHub Actions workflow using the pull_request_target event. On July 14, 2026, the attacker opened a malicious pull request that executed untrusted code, allowing them to use the authenticated asyncapi-bot identity to trigger legitimate release workflows. This process resulted in the publication of five malicious package versions—including @asyncapi/specs, @asyncapi/generator, @asyncapi/generator-components, and @asyncapi/generator-helpers—which carried valid OIDC provenance attestations. These packages deployed the Miasma tasking framework via a multi-stage payload that included an obfuscated JavaScript implant and an encrypted second-stage loader downloaded from IPFS. Miasma supports diverse command-and-control channels such as HTTP, Nostr, and Ethereum smart contracts, and possesses capabilities for credential theft, AI tool poisoning, and worm-like propagation across npm, PyPI, and Cargo registries. The malicious versions were subsequently unpublished from the npm registry following the identification of the compromise.

Sources

• Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - The Hacker News, 2026-07-15 (quality: 20/21)
• Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery - Threat intelligence | Microsoft Security Blog, 2026-07-16 (quality: 20/21)
• AsyncAPI npm packages infected with credential-stealing malware - BleepingComputer, 2026-07-15 (quality: 19/21)

4. Unknown APT Group Targets Russian Organizations via HelloNet Campaign and ViPNet

2 outlets, 2026-07-17 to 2026-07-20 - severity 4/5

An unknown APT group has been conducting the HelloNet campaign since at least May 2026, targeting large Russian organizations across the government, energy, transport, education, and logistics sectors. The attackers achieve persistence by using DLL sideloading to launch a malicious file, wtsapi32.dll (HelloInjector), via the legitimate itcsrvup64.exe executable within the InfoTeCS ViPNet Update System directory. Once active, the injector targets the svchost.exe process to deploy a suite of modules, including HelloProxy for network interception, HelloExecutor for command execution, HelloCleaner for deleting software logs, and a Rust-based HelloBackdoor for file manipulation. While Kaspersky researchers initially linked the campaign to a Chinese-speaking APT group, they later assigned low confidence to this attribution, noting that indicators such as a sina.com reference and a download mirror hosted by the University of Science and Technology of China may constitute a false flag operation. The campaign remains an active threat to users of the ViPNet information-security product suite.

Sources

• HelloNet campaign — new malicious modules launched through the ViPNet update system - Securelist, 2026-07-16 (quality: 16/21)
• Hackers abuse ViPNet software to target Russian govt agencies - BleepingComputer, 2026-07-19 (quality: 18/21)

5. Credential-stuffing attacks target 23andMe resulting in theft of customer data

2 outlets, 2026-07-16 to 2026-07-17 - severity 4/5

Between April and September 2023, 23andMe (now Chrome Holding Co.) fell victim to a series of credential-stuffing attacks that went undetected for five months. The breach resulted in the theft of genetic ancestry data and personal information belonging to 6.9 million customers, with attackers subsequently leaking millions of genetic profiles on the dark web. Investigations by various regulators, including the New York Attorney General and the Information Commissioner's Office, found that the company lacked essential safeguards such as multifactor authentication, password blocklisting, rate limiting, and adequate intrusion prevention. Following 23andMe's March 2025 bankruptcy filing, the company's assets were acquired in July 2025 by the 23andMe Research Institute (formerly TTAM Research Institute) for $305 million. As of July 2026, the company has agreed to pay $18 million to settle claims brought by a coalition of 43 state attorneys general and has previously settled a class-action lawsuit for $30 million.

Sources

• 23andMe reaches $18 million settlement with states for massive breach - The Record from Recorded Future News, 2026-07-15 (quality: 20/21)
• 23andMe to pay $18 million in new genetics data breach settlement - BleepingComputer, 2026-07-16 (quality: 19/21)

6. TetrisPhantom targets Southeast Asian government and diplomatic entities using GoSerpent malware

2 outlets, 2026-07-16 to 2026-07-17 - severity 4/5

The TetrisPhantom threat actor has conducted a long-running espionage campaign targeting government and diplomatic entities in Southeast Asia using the GoSerpent malware family. Since 2021, the actor has utilized various iterations of Go-based implants, with a more sophisticated phase beginning in late 2025 and evolving further in May 2026. The attack chain involves deploying the GoSerpent RAT to execute credential dumping via Mimikatz and QuarksDumpLocalHash, followed by the use of ThumbcacheService to archive sensitive documents into a local database. More recent operations utilize the Stowaway RAT for SOCKS5 proxying and reverse tunneling, alongside TmcLoader and TmcPayload to exfiltrate data via network shares. The attackers host their command-and-control infrastructure on legitimate providers, including Alibaba Cloud and UCLOUD HK. Researchers from Kaspersky and Cyderes have attributed the activity to TetrisPhantom based on technical similarities between the observed toolsets.

Sources

• GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - Securelist, 2026-07-16 (quality: 18/21)
• New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage - The Hacker News, 2026-07-17 (quality: 20/21)

7. Ransomware attack targeting Fairlife forces temporary suspension of United States production

4 outlets, 2026-07-17 to 2026-07-20 - severity 3/5

A ransomware attack targeting Fairlife, a subsidiary of The Coca-Cola Company, has forced the temporary suspension of production at the company's United States facilities. The intrusion involved unauthorized access to various systems, including those used for production operations, though the company stated that product quality and safety remain unaffected. While U.S. operations are halted, Fairlife's facilities in Canada have not been impacted by the incident. The Coca-Cola Company has activated incident response protocols, engaged cybersecurity experts, and notified law enforcement and the U.S. Securities and Exchange Commission. As of the latest update, no specific ransomware group has claimed responsibility, and the company has not confirmed whether corporate or consumer data was stolen.

Sources

• Coca-Cola says Fairlife ransomware attack halts US dairy production - BleepingComputer, 2026-07-16 (quality: 18/21)
• Coca-Cola Suspends US Fairlife Production Due to Ransomware Attack - SecurityWeek, 2026-07-17 (quality: 17/21)
• Ransomware attack forces Coca-Cola to suspend US production at dairy unit - Cybersecurity Dive - Latest News, 2026-07-17 (quality: 19/21)
• Dairy company Fairlife suspends production in US after cyber incident - The Record from Recorded Future News, 2026-07-17 (quality: 16/21)

8. FSB Russian state-linked hackers target critical infrastructure via networking device vulnerabilities

4 outlets, 2026-07-14 - severity 4/5

Russian state-linked hackers, specifically linked to the FSB, are targeting critical infrastructure by exploiting vulnerabilities in networking devices such as routers and switches. These actors focus on unpatched or weakly secured hardware to gain persistence and move laterally within sensitive networks. The campaign targets a broad range of networking equipment to compromise organizational connectivity and bypass traditional security perimeters. Authorities and international allies are advising defenders to prioritize the patching of edge devices to mitigate the risk of unauthorized access and long-term network infiltration.

Sources

• Officials once again warn defenders that Russian hackers are targeting network devices - CyberScoop, 2026-07-13 (quality: 7/21)
• US authorities warn that state-linked hackers are targeting vulnerable networking devices - Cybersecurity Dive - Latest News, 2026-07-13 (quality: 7/21)
• Weak Security Continues to Fuel Russian Cyberattacks - darkreading, 2026-07-13 (quality: 7/21)
• US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers - SecurityWeek, 2026-07-14 (quality: 7/21)

Under the Radar

High-severity stories that received limited coverage this period.

UAC-0145 ClickFix campaign targets Ukrainian users using fake CAPTCHA checks

2 outlets, 2026-07-15 to 2026-07-20 - severity 4/5

Russian state-sponsored threat actor UAC-0145, a sub-cluster of Sandworm affiliated with the GRU, conducted a ClickFix campaign between June and July 2026 targeting Ukrainian users through compromised websites. The attackers used the SMARTAXE tool and Cloaking.House to display fake CAPTCHA checks that utilized Ethereum smart contracts via the EtherHiding technique to retrieve remote resource domains. These fake CAPTCHAs tricked victims into executing PowerShell commands that installed various malware, including the GHETTOVIBE data-stealer, SCOUTCURL reconnaissance scripts, and FLUIDLEECH and LOADLOOP loaders. Additionally, the campaign distributed COWARDDUCK Android backdoors via messaging apps to exfiltrate sensitive file types to Dropbox.

Why it matters: Confirmed Sandworm/GRU campaign targeting Ukraine with widespread malware deployment and sophisticated social engineering techniques.

Sources

• UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware - The Hacker News, 2026-07-19 (quality: 20/21)
• Sandworm hackers have a CAPTCHA trick for Ukrainians - The Record from Recorded Future News, 2026-07-16 (quality: 20/21)

UTA0533 Exploits SonicWall SMA 1000 Series VPN via Two Zero-Day Vulnerabilities

2 outlets, 2026-07-18 to 2026-07-20 - severity 4/5

Threat actor UTA0533 exploited two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, to gain root access to SonicWall SMA 1000 series VPN appliances. The attack chain involved using a pre-authentication WebSocket tunnel bypass to reach localhost-only services, followed by a path traversal flaw in the "ctrl-service" to escalate privileges. Once root access was achieved, the actor deployed the ORANGETAIL Java web shell and the Suo5 HTTP proxy, established persistence via startup scripts, and used tcpdump to intercept unencrypted LDAP traffic. While the exploitation allowed for the potential capture of cached credentials and network traffic, researchers noted limited evidence of successful lateral movement to other systems.

Why it matters: Confirmed exploitation of critical zero-day vulnerabilities in widely deployed VPN appliances allowed threat actors to gain root access and intercept network traffic.

Sources

• SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access - The Hacker News, 2026-07-19 (quality: 20/21)
• Inc Ransomware Exploits SonicWall SMA Zero-Days - darkreading, 2026-07-17 (quality: 20/21)

All Stories by Category

Vulnerabilities & Patches

• Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ (2026-07-14, 1 outlet, severity 4/5)
  • Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ - CyberScoop
• SharkNinja Vacuum Flaw Allows Region-Wide Remote Control and Data Theft (2026-07-16, 1 outlet, severity 3/5)
  • Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide - The Hacker News
• AFC Security Flaws in 6 GHz Wi-Fi Threaten Critical Infrastructure (2026-07-15, 1 outlet, severity 3/5)
  • 6 GHz Wi-Fi Flaws Could Disrupt Critical Systems - darkreading
• Siemens ROX II Zero-Day Chain Grants Persistent Root Access (2026-07-17, 1 outlet, severity 3/5)
  • Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy - Unit 42
• Google Chrome Sync Exploited by Stalkers to Monitor Users (2026-07-16, 1 outlet, severity 3/5)
  • Security researchers find stalkers abusing Chrome’s sync feature - CyberScoop
• Intruder’s AI pipeline discovers CVE-2026-3985 in Creative Mail plugin (2026-07-16, 1 outlet, severity 3/5)
  • We built a vulnerability vending machine: AI tokens in, zero-days out - BleepingComputer
• Hikvision ISAPI endpoint targeted by internet-wide reconnaissance scans (2026-07-20, 1 outlet, severity 2/5)
  • Scans for Hikvision Intelligent Security API, (Sun, Jul 19th) - SANS Internet Storm Center, InfoCON: green
• **Synthesis failed for this cluster.

• SAP warns of critical flaws in NetWeaver and Commerce Cloud
• SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud** (2026-07-14, 2 outlets, severity 2/5)
  • SAP warns of critical flaws in NetWeaver and Commerce Cloud - BleepingComputer
  • SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud - SecurityWeek
• Shark Vacuum Vulnerabilities and Weekly Security Updates Highlight Risks (2026-07-20, 1 outlet, severity 2/5)
  • A week in security (July 13 – July 19) - Malwarebytes
• Windows Server 2022 Mainstream Support Ends in 90 Days (2026-07-17, 1 outlet, severity 1/5)
  • Windows Server 2022 reach end of mainstream support in 90 days - BleepingComputer

Data Breaches

• ClickLock Stealer uses coercion loops to steal macOS user login passwords (2026-07-17, 2 outlets, severity 3/5)
  • New ClickLock macOS malware traps users into revealing login password - BleepingComputer
  • New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password - The Hacker News
• Plaintiffs Target Ace Hardware Over AdTech Violations and Consent Banner Failures (2026-07-17, 1 outlet, severity 3/5)
  • New CIPA Claims Expand Privacy Litigation Risk Over Website Consent Banners - Corporate Compliance Insights
  • What Antitrust’s Indirect-Purchaser Doctrine Can Teach Tariff Refund Litigants - Corporate Compliance Insights
• Craneware hackers steal employee and customer data from hospital software (2026-07-20, 1 outlet, severity 3/5)
  • Software provider to more than 2,000 US hospitals says hackers stole employee and customer data - The Record from Recorded Future News
• Ernst & Young data breach exposes client tax and financial info (2026-07-18, 1 outlet, severity 3/5)
  • Ernst & Young discloses data breach after support system hack - BleepingComputer
• Synopsys finds no evidence of data breach following D1R claims (2026-07-15, 1 outlet, severity 2/5)
  • Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims - SecurityWeek
• The Hacker in the Hoodie Index Tracks Material Cyber Breaches (2026-07-20, 1 outlet, severity 1/5)
  • New Index Tracks Material Breaches — And Refuses to Add Up the Losses - SecurityWeek

Ransomware

• Trump administration launches Gold Eagle initiative to remediate critical infrastructure vulnerabilities (2026-07-15 to 2026-07-18, 5 outlets, severity 2/5)
  • White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - SecurityWeek
  • White House details ‘Gold Eagle’ clearinghouse for AI cyber threats - CyberScoop
  • US launches vulnerability clearinghouse amid AI-fueled surge in flaws - Cybersecurity Dive - Latest News
  • Trump administration unveils AI-supported clearinghouse for cyber vulnerabilities - The Record from Recorded Future News
  • Gold Eagle Clearinghouse Targets Security Gap, but How Is Unclear - darkreading
• Spirals ransomware encrypts South Asian IT firm within 24 hours (2026-07-16, 1 outlet, severity 3/5)
  • New Spirals ransomware encrypts victim network in under 24 hours - BleepingComputer
• Identity Attacks Surpass Exploits as Leading Cause of Ransomware (2026-07-16, 1 outlet, severity 3/5)
  • Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading
• The ransomware negotiator who was working for the other side (2026-07-14, 1 outlet, severity 3/5)
  • The ransomware negotiator who was working for the other side - GRAHAM CLULEY
• Japan's largest taxi operator shuts systems after cyberattack (2026-07-14, 1 outlet, severity 3/5)
  • Japan's largest taxi operator shuts systems after cyberattack - BleepingComputer
• GigaWiper Lets Threat Actors Choose Their Own Destructive Attack (2026-07-14, 1 outlet, severity 3/5)
  • GigaWiper Lets Threat Actors Choose Their Own Destructive Attack - darkreading
• The inside job that cost ransomware victims millions (2026-07-14, 1 outlet, severity 3/5)
  • The inside job that cost ransomware victims millions - Malwarebytes

Supply Chain Attacks

• CylindricalCanine Linked to DigiCert Breach and Code-Signing Certificate Theft (2026-07-18, 1 outlet, severity 4/5)
  • GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft - The Hacker News
• UK charges suspects linked to Russian Coms call spoofing platform (2026-07-14, 1 outlet, severity 4/5)
  • UK charges suspects linked to Russian Coms call spoofing platform - BleepingComputer
• Keksec develops TuxBot v3 Evolution IoT botnet framework using LLMs (2026-07-15 to 2026-07-16, 2 outlets, severity 3/5)
  • TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development - Unit 42
  • TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - The Hacker News
• SuccessKey Uses Blockchain C2 to Deliver RAT via Vite Packages (2026-07-18, 1 outlet, severity 3/5)
  • Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT - The Hacker News
• Cursor Flaw Allows Malicious Repositories to Execute Windows Code (2026-07-15, 1 outlet, severity 3/5)
  • Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - The Hacker News
• Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Coll (2026-07-14, 1 outlet, severity 3/5)
  • Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found - The Hacker News
• Lessons Learned from CISA’s Recent GitHub Leak (2026-07-14, 1 outlet, severity 2/5)
  • Lessons Learned from CISA’s Recent GitHub Leak - Krebs on Security

Nation-State / APT

• Russian hackers exploit IP cameras to spy on NATO logistics (2026-07-15, 1 outlet, severity 4/5)
  • NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says - The Record from Recorded Future News
• TeamPCP's Nx Console attack on GitHub highlights agentic security needs. (2026-07-20, 1 outlet, severity 4/5)
  • How agentic endpoint security shuts down IDE-based supply chain attacks - Cybersecurity Dive - Latest News
• TookPS campaign uses OkoBot malware to target cryptocurrency users' credentials (2026-07-16 to 2026-07-17, 2 outlets, severity 3/5)
  • OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - The Hacker News
  • New OkoBot framework deploys 20 payloads to steal data, crypto - BleepingComputer
• MuddyWater and Iran-linked actors use AI to boost cyberattacks (2026-07-17, 1 outlet, severity 3/5)
  • Iran-nexus actors using AI to enhance cyber playbook - Cybersecurity Dive - Latest News
• States are building their own election defense networks as federal support evapo (2026-07-14, 1 outlet, severity 2/5)
  • States are building their own election defense networks as federal support evaporates - CyberScoop

Malware & Botnets

• bandcampro used Gemini CLI to target a dental clinic via Patriot Bait (2026-07-16 to 2026-07-20, 2 outlets, severity 3/5)
  • Google Gemini CLI abused as a hacking agent, malware botnet operator - BleepingComputer
  • Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs - The Hacker News
• Autonomous AI agent exploits code-execution vulnerabilities to breach Hugging Face infrastructure (2026-07-20, 3 outlets, severity 3/5)
  • Hugging Face discloses breach linked to autonomous AI agent - BleepingComputer
  • World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent - The Hacker News
  • Hugging Face Hacked in Autonomous AI Attack - SecurityWeek
• Threat actors use fake GitHub repositories to distribute BoryptGrab infostealer malware (2026-07-15 to 2026-07-17, 2 outlets, severity 3/5)
  • Nearly 300 GitHub repos pose as legit software to push malware - BleepingComputer
  • How to use GitHub safely - Malwarebytes
• Hackers breach Nichirei Logistics Group and Nichirei Foods servers causing outages (2026-07-16 to 2026-07-17, 2 outlets, severity 3/5)
  • Cyberattack on Japan's largest cold-chain operator disrupts KFC, supermarket supplies - The Record from Recorded Future News
  • Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei - SecurityWeek
• UAT-11795 Targets Global Users With Starland RAT and WLDR Campaign (2026-07-16, 2 outlets, severity 3/5)
  • UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign - Cisco Talos Blog
  • Russian hackers trojanize WebEx, Zoom apps to push Starland malware - BleepingComputer
• MacOS.Stealer.Crash uses Werkbit Setup to steal data from macOS users (2026-07-14 to 2026-07-15, 3 outlets, severity 3/5)
  • New CrashStealer malware poses as Apple crash reporting tool - BleepingComputer
  • CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks - The Hacker News
  • This fake Apple app can unlock your Mac’s password vault - Malwarebytes
• OkoBot targets cryptocurrency users while phishing campaigns target LastPass and Bitwarden (2026-07-15, 2 outlets, severity 3/5)
  • LastPass, Bitwarden users targeted with fake security alerts - BleepingComputer
  • OkoBot: new sophisticated malware framework targets cryptocurrency users - Securelist
• Daxin Rootkit and Stupig Backdoor Found in Taiwan Manufacturing Firm (2026-07-16, 1 outlet, severity 3/5)
  • Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor - The Hacker News
• NadMesh Botnet Targets Exposed AI Services to Steal Cloud Credentials (2026-07-18, 1 outlet, severity 3/5)
  • New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens - The Hacker News
• REF9403 Uses Fake Coding Tests to Distribute OtterCookie Malware (2026-07-18, 1 outlet, severity 3/5)
  • Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images - The Hacker News
• PhantomEnigma hijacks Brazilian government websites to distribute Node.js malware (2026-07-16, 1 outlet, severity 3/5)
  • 20+ Hijacked Government Websites Became
an Attack Channel - The Hacker News
• RenPy Loader and Amatera Stealer Spread via Fake Game Downloads (2026-07-20, 1 outlet, severity 3/5)
  • Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding - Malwarebytes
• ACR Stealer malware surge targets enterprise customers, Microsoft warns (2026-07-19, 1 outlet, severity 3/5)
  • Microsoft warns of surge in ACR Stealer attacks on customers - BleepingComputer
• Windows Bind Link Attacks Evade EDR Detection, Bitdefender Finds (2026-07-16, 1 outlet, severity 3/5)
  • Windows Bind Link Attacks Can Hide Malware From EDR Tools - SecurityWeek
• LabubaRAT Mimics NVIDIA Software to Hijack Windows Systems (2026-07-15, 1 outlet, severity 3/5)
  • LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts - The Hacker News
• 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet (2026-07-14, 1 outlet, severity 3/5)
  • 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet - The Hacker News
• Game Cheat Spyware, Chrome Sync Stalking, and Rapid Ransomware Threats (2026-07-17, 1 outlet, severity 2/5)
  • ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories - The Hacker News

Phishing & Social Engineering

• Malicious extensions exploit ClaudeBleed vulnerability to impersonate Claude for Chrome users (2026-07-15 to 2026-07-16, 2 outlets, severity 4/5)
  • Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads - The Hacker News
  • Claude for Chrome flaw could let rogue extensions access your Gmail - Malwarebytes
• Iberian hackers dismantled for investment fraud and business email compromise attacks (2026-07-15 to 2026-07-16, 2 outlets, severity 3/5)
  • Spanish Police take down €140 million cyber fraud ring, arrest four - BleepingComputer
  • Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading
• Jalisco and OmegaLord phishing kits bypass Microsoft 365 MFA (2026-07-15, 1 outlet, severity 3/5)
  • New phishing kits target Microsoft 365 accounts, evade MFA - BleepingComputer
• The serpent’s tongue: Luring the Python out of its den (2026-07-14, 1 outlet, severity 3/5)
  • The serpent’s tongue: Luring the Python out of its den - Cisco Talos Blog
• Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft (2026-07-14, 1 outlet, severity 3/5)
  • Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft - The Hacker News
• Smashing Security: Remote-control e-rickshaws and AI-driven book marketing scams (2026-07-16, 1 outlet, severity 2/5)
  • Smashing Security podcast #476: Remote-control rickshaws and rogue book marketers - GRAHAM CLULEY
• Warning: Scammers are using FaceTime to empty bank accounts (2026-07-14, 1 outlet, severity 2/5)
  • Warning: Scammers are using FaceTime to empty bank accounts - Malwarebytes

Cloud & Infrastructure Security

• Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Re (2026-07-14, 1 outlet, severity 3/5)
  • Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read - The Hacker News
• OT Security Challenges: Protecting Critical Infrastructure From Physical Risks (2026-07-17, 1 outlet, severity 2/5)
  • Legacy Systems, Real-World Impacts: The Reality of OT Security - SecurityWeek
• NATO and U.S. Military Autonomy Demands Secure Information Infrastructure (2026-07-17, 1 outlet, severity 1/5)
  • The Race to Field Military Autonomy Is On, Can Trusted Information Infrastructure Keep Pace? - The Hacker News
• SecurityWeek Cloud & Data Security Summit Sessions Now Available On-Demand (2026-07-20, 1 outlet, severity 1/5)
  • Watch on Demand: Cloud & Data Security Summit - SecurityWeek

Identity & Access Management

• Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Acti (2026-07-14, 1 outlet, severity 3/5)
  • Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity - The Hacker News
• Microsoft Entra ID to Default to Passkeys by September 2026 (2026-07-15, 1 outlet, severity 2/5)
  • Microsoft Entra ID gets passkeys default authentication starting September - BleepingComputer
• AI Agents Outpace Traditional Security, Requiring New Identity-Based Models (2026-07-17, 1 outlet, severity 2/5)
  • AI Agents Broke the Security Playbook. Here's What Replaces It. - BleepingComputer
• Oak Secures $60 Million to Launch AI-Powered Identity Operating System (2026-07-16, 1 outlet, severity 1/5)
  • Oak Emerges From Stealth Mode With $60 Million in Funding - SecurityWeek

AI & Machine Learning Security

• Nightmare-Eclipse and BlueHammer exploits demand validation-based security approaches. (2026-07-15, 1 outlet, severity 4/5)
  • You Don't Have to Run an Exploit to Know If You're Vulnerable - BleepingComputer
• Hackers backdoor Jscrambler npm package with infostealer malware (2026-07-14, 1 outlet, severity 4/5)
  • Hackers backdoor Jscrambler npm package with infostealer malware - BleepingComputer
• Cato Networks research shows AI harnesses enable rapid cyberattacks (2026-07-16, 1 outlet, severity 3/5)
  • Forget the model. When it comes to cybersecurity, it’s all about the harness - CyberScoop
• Agent Data Injection (ADI) Attacks Can Manipulate AI Agent Actions (2026-07-16, 1 outlet, severity 3/5)
  • New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands - The Hacker News
• OpenAI Uses GPT-Red to Automate Prompt Injection Testing for GPT-5.6 Sol (2026-07-16, 1 outlet, severity 3/5)
  • OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol - The Hacker News
• Google Must Grant Rival AI Assistants Android System Access (2026-07-17, 1 outlet, severity 3/5)
  • E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants - The Hacker News
• Morse Code Exploit Triggers AI Authority Laundering Financial Attack (2026-07-18, 1 outlet, severity 3/5)
  • The Real AI Threat Is Blind Trust - darkreading
• Hidden Text in 1M+ Emails Bypasses AI Security Filters (2026-07-17, 1 outlet, severity 3/5)
  • 1M+ Emails Use Hidden Text to Dupe AI Security Filters - darkreading
• New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Em (2026-07-14, 1 outlet, severity 3/5)
  • New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email - The Hacker News
• Ghostcommit attack hides malicious AI instructions in images (2026-07-14, 1 outlet, severity 3/5)
  • Ghostcommit attack hides malicious AI instructions in images - Malwarebytes
• Lava Labs Warns AI Data Center Growth Outpaces Security Measures (2026-07-17, 1 outlet, severity 2/5)
  • AI Data Centers Are Being Built Faster Than They Can Be Secured - SecurityWeek
• SANS Institute Report: AI Cybersecurity Adoption Outpaces Governance Frameworks (2026-07-15, 1 outlet, severity 2/5)
  • Sharp rise in AI adoption for cyber defense exposes major governance gap - Cybersecurity Dive - Latest News
• Drata Survey: 43% of GRC Professionals Find AI Increases Workload (2026-07-17, 1 outlet, severity 2/5)
  • 43% of GRC Professionals Say AI Makes Their Jobs Harder - Corporate Compliance Insights
• AI Bug Discovery Requires Human Validation to Prove Exploitability (2026-07-16, 1 outlet, severity 2/5)
  • AI Can Find Bugs, But Human Knowledge Still Proves Them - The Hacker News
• Organizations Must Manage Third-Party AI Risks to Protect Consumers and Employees (2026-07-15, 1 outlet, severity 2/5)
  • 10 Questions Every Organization Should Ask a Potential AI Vendor - Corporate Compliance Insights
• MCP Security Risks: Protecting Secrets in AI Infrastructure Access (2026-07-20, 1 outlet, severity 2/5)
  • The secret problem in AI infrastructure: Why MCP security starts with secrets - Cybersecurity Dive - Latest News
• Introducing Precursor: detecting agentic behavior with continuous client-side si (2026-07-14, 1 outlet, severity 2/5)
  • Introducing Precursor: detecting agentic behavior with continuous client-side signals - The Cloudflare Blog
• Capital One Open Sources AI-Powered VulnHunter Security Tool (2026-07-20, 1 outlet, severity 1/5)
  • Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool - SecurityWeek
• Incode Technologies Launches Privacy-First On-Device Facial Age Estimation Tool (2026-07-19, 1 outlet, severity 1/5)
  • The Future of Age Verification: Your Face Never Leaves Your Device - BleepingComputer
• MindStone Agent and Arcovo’s Clint Bodungen Discuss Agentic AI Governance (2026-07-17, 1 outlet, severity 1/5)
  • Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive - SecurityWeek
• AI-Driven Threat Hunting: Balancing Automation With Human Reasoning (2026-07-16, 1 outlet, severity 1/5)
  • The Hunter's Paradox: Is it time to embrace automated threat hunting? - Cisco Talos Blog
• Agentic AI Security Risks Demand New Organizational Defense Strategies (2026-07-17, 1 outlet, severity 1/5)
  • Agentic AI: Taming the Unpredictable - darkreading

Legal & Law Enforcement

• **Synthesis failed for this cluster.

• US sanctions VPN, malware providers for enabling ransomware attacks
• VPN service favored by ransomware groups is sanctioned by US
• [U.S** (2026-07-14, 3 outlets, severity 4/5)
  • US sanctions VPN, malware providers for enabling ransomware attacks - BleepingComputer
  • VPN service favored by ransomware groups is sanctioned by US - The Record from Recorded Future News
  • U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support - The Hacker News
• Anubis Ransomware Exploits CitrixBleed to Target Healthcare and Finance Sectors (2026-07-17, 1 outlet, severity 4/5)
  • Anubis ransomware: what you need to know - GRAHAM CLULEY
• UAT-11795 Deploys Starland RAT via Trojanized Software Campaign (2026-07-17, 1 outlet, severity 4/5)
  • Begun, the Patch Wars have - Cisco Talos Blog
• Multiple Jscrambler Packages Impacted by Supply Chain Attack (2026-07-14, 1 outlet, severity 4/5)
  • Multiple Jscrambler Packages Impacted by Supply Chain Attack - SecurityWeek
• ShinyHunters and ShadowByt3$ target Abbott Laboratories via Exact Sciences and LabCentral (2026-07-18, 2 outlets, severity 3/5)
  • Abbott probes two cyber incidents amid extortion claims - BleepingComputer
  • Abbott discloses cyberattack on cancer diagnostics business - Cybersecurity Dive - Latest News
• Aleksanteri Kivimäki wanted after Vastaamo psychotherapy data breach appeal fails (2026-07-15, 1 outlet, severity 3/5)
  • Finland issues wanted notice for hacker behind massive psychotherapy data breach - The Record from Recorded Future News
• Zhuoying Chen and Haojie Zhang Charged in $43M Fraud Laundering (2026-07-17, 1 outlet, severity 3/5)
  • US charges two over laundering $43 million from investment fraud - BleepingComputer
• Dutch Police Bust €100 Million Monthly Investment Fraud Ring (2026-07-16, 1 outlet, severity 3/5)
  • Dutch police bust investment fraud ring stealing over €100 million - BleepingComputer
• Senate Intelligence Committee questions Jay Clayton during DNI confirmation hearing (2026-07-16, 2 outlets, severity 2/5)
  • Dems press DNI nominee Jay Clayton on election security questions, but leave dismayed - CyberScoop
  • Trump’s DNI pick grilled about election security, voter fraud - The Record from Recorded Future News
• TopSec and Venustech Face PLA Bans Over Bidding Misconduct (2026-07-16, 1 outlet, severity 2/5)
  • China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans - SecurityWeek
• Armenia Detains Russian Tourist in Potential REvil Identity Mix-up (2026-07-17, 1 outlet, severity 2/5)
  • Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man - The Hacker News

Policy & Regulation

• Iran Tracks US Military via Ad Data and CrashStealer Emerges (2026-07-18, 1 outlet, severity 4/5)
  • In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint - SecurityWeek
• SleeperGem Uses Malicious RubyGems to Target Developer Machines (2026-07-20, 1 outlet, severity 3/5)
  • SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines - The Hacker News
• Pentagon Suspends CMMC Phase 2 Amid Assessor and Cost Concerns (2026-07-17, 1 outlet, severity 3/5)
  • Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday - SecurityWeek
• Illinois, New York, and California Mandate New Frontier AI Safety Rules (2026-07-15, 1 outlet, severity 3/5)
  • Frontier AI: The Genie's Out of the Bottle, but Where's the Rulebook? - darkreading
• Ofcom investigates TikTok for alleged age verification failures under Online Safety Act (2026-07-17, 1 outlet, severity 3/5)
  • UK investigates TikTok for alleged age-verification lapses, exposing kids to online harms - The Record from Recorded Future News
• Commerce OIG Finds Weaknesses in BIS China Export Verifications (2026-07-15, 1 outlet, severity 3/5)
  • When Oversight Findings Lead to More Oversight: An OIG Report on China Exports - Corporate Compliance Insights
• UK Cyber Shield Strategy Aims to Counter US AI Export Controls (2026-07-16, 1 outlet, severity 2/5)
  • Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading
• Senator Wyden Urges Rubio and Blanche to Oppose Canadian Surveillance Bill (2026-07-17, 1 outlet, severity 2/5)
  • Senator calls on Rubio, Blanche to push back against Canadian surveillance legislation - The Record from Recorded Future News
• Arnall Golden Gregory Guides Non-US Firms Through US Privacy Laws (2026-07-20, 1 outlet, severity 2/5)
  • A Field Guide to Privacy Law for Companies Entering the US Market - Corporate Compliance Insights
• Ukrainians protest dismissal of tech-focused Defense Minister Mykhailo Fedorov (2026-07-17, 1 outlet, severity 2/5)
  • Ukrainians rally against dismissal of tech-minded defense minister Fedorov - The Record from Recorded Future News
• Unit 42 Report: AI Accelerates Speed and Efficiency of Attacks (2026-07-17, 1 outlet, severity 2/5)
  • AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report - Unit 42
• Federal Rotational Cyber Workforce Program Sees Minimal Employee Participation (2026-07-17, 1 outlet, severity 2/5)
  • Program to rotate cyber personnel through federal agencies saw little use - CyberScoop
• Religious Objections to AI Tools May Trigger Title VII Claims (2026-07-15, 1 outlet, severity 2/5)
  • For Some Workers, AI Resistance Is a Matter of Faith - Corporate Compliance Insights
• SEC Proposed Rule Change May Increase Risks for Public Companies (2026-07-17, 1 outlet, severity 2/5)
  • Making It Easier to Go Public Isn’t the Same as Making It Easier to Be Public - Corporate Compliance Insights
• Samsung clarifies health data policy after user backlash over deletion. (2026-07-16, 1 outlet, severity 2/5)
  • Samsung backs down on threat to delete health data - Malwarebytes
• Nigeria Mandates Cyberattack Disclosures to Combat Rising Digital Crime (2026-07-15, 1 outlet, severity 2/5)
  • Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits - darkreading
• EU leaders eye social media ban for children under age 13 (2026-07-14, 1 outlet, severity 2/5)
  • EU leaders eye social media ban for children under age 13 - The Record from Recorded Future News
• Russian celebrity journalist Ksenia Sobchak says hackers accessed Telegram chann (2026-07-14, 1 outlet, severity 2/5)
  • Russian celebrity journalist Ksenia Sobchak says hackers accessed Telegram channels via email breach - The Record from Recorded Future News
• Martyn’s Law: What New Anti-Terrorism Guidance Means for Event Organizers (2026-07-14, 1 outlet, severity 2/5)
  • Martyn’s Law: What New Anti-Terrorism Guidance Means for Event Organizers - Corporate Compliance Insights
• The UK’s FCA Is Weighing Real-World Impact, Not Just Careful Wording (2026-07-14, 1 outlet, severity 2/5)
  • The UK’s FCA Is Weighing Real-World Impact, Not Just Careful Wording - Corporate Compliance Insights
• Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules (2026-07-14, 1 outlet, severity 2/5)
  • Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules - SecurityWeek
• FCPA and Bribery Laws: Navigating Compliant Corporate Gift Policies (2026-07-20, 1 outlet, severity 1/5)
  • Does Your Organization Have a Compliant Gift Policy Under Federal, State & Local Law? - Corporate Compliance Insights
• CRC-Oyster Acquires Modern Regulatory Services to Expand Compliance Expertise (2026-07-18, 1 outlet, severity 1/5)
  • CRC-Oyster Acquires Modern Regulatory Services - Corporate Compliance Insights
• Auxilius Secures €1.3M Pre-Seed Funding to Advance AI-Native GRC (2026-07-18, 1 outlet, severity 1/5)
  • Auxilius Raises €1.3M in Pre-Seed Round - Corporate Compliance Insights
• Optro, OnBoard, and Clarity AI Launch New GRC Solutions (2026-07-18, 1 outlet, severity 1/5)
  • GRC News Roundup: Optro, OnBoard, Clarity AI, Eventus & more - Corporate Compliance Insights

Other Cybersecurity

• CISA warns of actively exploited RCE flaws in Joomla extensions (2026-07-14, 1 outlet, severity 4/5)
  • CISA warns of actively exploited RCE flaws in Joomla extensions - BleepingComputer
• Flock Safety cameras face scrutiny over privacy and accuracy issues. (2026-07-17, 1 outlet, severity 3/5)
  • The backlash against Flock cameras is spreading - Malwarebytes
• Fortified Health Security Report: Healthcare Risk Mitigation Rates Plummet (2026-07-15, 1 outlet, severity 3/5)
  • Healthcare sector faces persistent challenges with supply-chain security, identity management - Cybersecurity Dive - Latest News
• FAA and TSA Cybersecurity Gaps Hinder Aviation Network Security (2026-07-17, 1 outlet, severity 3/5)
  • Gaps in network security, oversight strategy hamper US’s aviation cybersecurity regulators - Cybersecurity Dive - Latest News
• Trends and Tactics in the Residential Proxy Market (2026-07-18, 1 outlet, severity 3/5)
  • Inside the Search for "Clean" Residential Proxies for Carding - BleepingComputer
• Arctic Wolf Report: 33% of IT Assets Lack Critical Controls (2026-07-20, 1 outlet, severity 2/5)
  • Your attack surface is bigger than you think - Cybersecurity Dive - Latest News
• IoT Door Lock Failure Leads to Home Lockout Incident (2026-07-15, 1 outlet, severity 2/5)
  • Weekly Update 512: IoT Lockout Fail - Troy Hunt
• Election Experts and Officials Slam Trump’s Claims of Voter Fraud (2026-07-18, 1 outlet, severity 1/5)
  • State officials, election experts pan Trump speech: ‘This is what desperation looks like’ - CyberScoop
• Zelensky Appoints Yevhenii Khmara as Ukraine's Acting Defense Minister (2026-07-18, 1 outlet, severity 1/5)
  • Zelensky appoints Ukraine's acting security service chief as acting defense minister - The Record from Recorded Future News
• Beacon Security and Risk Ledger Secure Funding for Security Platforms (2026-07-17, 1 outlet, severity 1/5)
  • Beacon Security Raises $13 Million for Security Data Platform - SecurityWeek
  • Risk Ledger Raises $32 Million in Series B Funding - SecurityWeek
• ISC Stormcast For Tuesday, July 14th, 2026 https://isc.sans.edu/podcastdetail/10 (2026-07-14, 2 outlets, severity 1/5)
  • ISC Stormcast For Tuesday, July 14th, 2026 https://isc.sans.edu/podcastdetail/10006, (Tue, Jul 14th) - SANS Internet Storm Center, InfoCON: green
  • AI Security Report 2026 - Check Point Research
• Diligent and Seward & Kissel Report Rise in M&A Activism (2026-07-18, 1 outlet, severity 1/5)
  • Deals in Dispute: Activism Against M&A - Corporate Compliance Insights
• DShield SIEM Update Adds ELK 8.19.15, TTY, and Suricata Logs (2026-07-15, 1 outlet, severity 1/5)
  • Recent DShield SIEM Update, (Tue, Jul 14th) - SANS Internet Storm Center, InfoCON: green
• ISC Stormcast Podcast Delivers Daily Cybersecurity News Digest (2026-07-20, 1 outlet, severity 1/5)
  • ISC Stormcast For Monday, July 20th, 2026 https://isc.sans.edu/podcastdetail/10014, (Mon, Jul 20th) - SANS Internet Storm Center, InfoCON: green
• ISC Stormcast Podcast Delivers Daily Cybersecurity News and Trends (2026-07-17, 1 outlet, severity 1/5)
  • ISC Stormcast For Friday, July 17th, 2026 https://isc.sans.edu/podcastdetail/10012, (Fri, Jul 17th) - SANS Internet Storm Center, InfoCON: green
• Dark Reading Launches DR Global to Cover International Cybersecurity Intelligence (2026-07-16, 1 outlet, severity 1/5)
  • Guten Tag, Bonjour, Hola to Our European Cyber Defenders! - darkreading
• SANS Institute Releases July 16th ISC Stormcast Podcast Digest (2026-07-16, 1 outlet, severity 1/5)
  • ISC Stormcast For Thursday, July 16th, 2026 https://isc.sans.edu/podcastdetail/10010, (Thu, Jul 16th) - SANS Internet Storm Center, InfoCON: green
• SANS Institute Releases July 15th ISC Stormcast Podcast Update (2026-07-15, 1 outlet, severity 1/5)
  • ISC Stormcast For Wednesday, July 15th, 2026 https://isc.sans.edu/podcastdetail/10008, (Wed, Jul 15th) - SANS Internet Storm Center, InfoCON: green

Reported Data Breaches

Breaches reported via Have I Been Pwned this period.

• Paidwork Data Breach Compromises Over 23 Million User Accounts (2026-07-20)
• Fluke Data Breach Exposes Over 821,000 Compromised User Accounts (2026-07-15)
• Goose Creek Candle Company breach exposes 6.6 million customer records (2026-07-15)