July featured major security developments including the first agentic ransomware operation attributed to JADEPUFFER, a new US vulnerability coordination body called GOLD EAGLE, and an AI-assisted breach at Hugging Face involving OpenAI agents. The month also saw Azure tenant takeover abuse, ENCFORGE ransomware targeting AI/ML assets, and several high-profile breaches affecting FastJson, Abbott Laboratories, Accenture, and Fairlife. #JADEPUFFER #GOLDEAGLE #HuggingFace #OpenAI #ENCFORGE #FastJson #AbbottLaboratories #Accenture #Fairlife
Elastic built an AI-assisted bug bounty triage system to handle a surge of AI-generated HackerOne reports, using multi-stage analysis, adversarial review, and sandboxed reproduction on ephemeral Google Cloud VMs. The system agrees with human security engineers 85% of the time and uses Elastic-specific triage rules to distinguish real issues from features or out-of-scope reports while keeping a human in the final decision loop. #HackerOne #Elastic #Claude #ElasticWorkflows #GoogleCloudPlatform #Elasticsearch #Kibana
77 Open VSX extensions impersonated legitimate developer tools in an “evil twin” campaign and sent system and development-environment data to attacker infrastructure. Manifold Security linked the packages to mangorbit[.]com and found that 19 of them collected unusually detailed reconnaissance, including Git and CI metadata. #OpenVSX #ManifoldSecurity #mangorbit
XCSSET version 40 has resurfaced to target macOS users by infecting compromised Xcode projects and GitHub repositories, spreading when developers build the poisoned code. The updated malware adds new Chrome hijacking and Telegram trojanizing modules, along with stronger evasion tactics and aggressive attempts to disable macOS security protections. #XCSSET #Xcode #GitHub #Unit42
Greatness has evolved from a credential phishing service into an advanced platform that uses adversary-in-the-middle and device-code phishing to steal Microsoft 365 access tokens. Researchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data. #Greatness #RingCentral #Microsoft365 #ShinyHunters
TP-Link has fixed 15 vulnerabilities in the Omada zero-touch provisioning mechanism that could be chained with earlier command-injection flaws to enable remote code execution and network compromise. Forescout’s Vedere Labs disclosed the issues at Black Hat USA, warning that attackers could abuse predictable serial numbers, default credentials, and cloud adoption weaknesses to hijack devices and steal administrator access. #TPLink #Omada #Forescout #VedereLabs #CVE20257850 #CVE20257851 #CVE20259289 #CVE20259293 #CVE202515544 #CVE202515627 #CVE202515631
Preferred Financial Group in the United States reported a ransomware incident attributed to the play threat actor. The attack resulted in unauthorized access and disruption of business operations. #UnitedStates
First Tek in Taiwan was targeted by the play ransomware threat actor, associated with the United States, leading to unauthorized access and encryption of victim files. The incident resulted in disruption and attempted ransom demands, impacting Taiwan #Taiwan
In August 2026, ransomware group incransom claimed to have exfiltrated over 8TB of data from TRULITE GLASS & ALUMINUM SOLUTIONS, a North American architectural glass and aluminum fabricator/distributor based in the US. The actor stated it has accessed corporate systems including ERP/CRM, financial and HR records, M&A and board materials, customer/vendor data, and IT infrastructure documentation, threatening further publication unless negotiations are resolved #UnitedStates
Security vendors used Black Hat USA 2026 to unveil a wave of new AI-driven, automation-focused tools for exposure management, identity security, cloud defense, and remediation. Several announcements also highlighted fresh research on threat actors using AI, along with reports showing that many organizations still struggle to close known vulnerabilities effectively. #CrowdStrike…
Liechtenstein’s register of beneficial owners was hit by a major cyberattack that exposed data from nearly 31,000 entities. Authorities said the stolen information did not include banking data or account balances, and no ransom demand has been made yet. #Liechtenstein #VwbP
Centro Universitário CESMAC (cesmac.edu.br), Brazil, was targeted by the krybit ransomware threat actor, according to the claim. The incident affected the organization in #Brazil
RUPP Spritzguss in Germany was targeted by the qilin ransomware threat actor, resulting in disruption and data encryption as part of the attack. The incident affected the impacted country(s): #Germany
Galvin Brothers in Ireland was targeted by the qilin ransomware group, with the attackers attempting to encrypt systems and extort the victim for continued access and data. The incident is reported to impact Ireland #Ireland
ChainDrop is a self-propagating malware campaign that has compromised more than 1,300 npm packages with about 2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, and file-entry-cache. The attack spread through a maintainer’s GitHub account compromise and used legitimate GitHub Actions releases to deliver infostealing payloads targeting developer, cloud, and CI/CD credentials. #ChainDrop #Keyv #Cacheable #Deliveroo #Ornikar #OneReach #Picsart #Qlik #ServiceTitan