Researchers at Group-IB have identified a new Android malware family called WindRelay that abuses NFC capabilities to relay live card data from victims' phones to fraudsters. The malware is used in conjunction with the known SpyNote RAT, enabling contactless payment fraud. The campaign was first detected in 2026, with details published on August 13, 2026.
North Korean state-sponsored IT workers are infiltrating government agencies and private businesses by applying for remote positions using fake identities and stolen personally identifiable information. The FBI is actively investigating a specific case involving a North Korean remote IT worker who gained employment at an unnamed organization. These operatives use sophisticated interview techniques and fraudulent documentation to bypass hiring vetting, posing risks of data exfiltration, intellectual property theft, and compromised security postures for affected entities.
Threat actors have begun exploiting CVE-2026-55040, a critical security feature bypass vulnerability in Microsoft SharePoint, following the release of public proof-of-concept code. The flaw, which stems from weak authentication mechanisms, allows unauthenticated attackers to bypass security features. Microsoft released a patch as part of its July 2026 Patch Tuesday updates. The vulnerability carries a CVSS score of 9.1, indicating critical severity. Organizations using SharePoint are urged to apply the latest security updates immediately to mitigate the risk of active exploitation.
Check Point Research attributes a zero-day exploitation of a Microsoft Windows vulnerability to the Lazarus Group, a North Korean threat actor, in a campaign designated Operation Dream Job. The attacks target defense and aerospace companies in France, Germany, Brazil, and India, delivering a previously unseen backdoor after achieving SYSTEM-level access.
Security researchers have identified 737 free VPN and proxy extensions in the Chrome Web Store that primarily target Russian-speaking users seeking access to blocked services. The extensions, published across at least 40 developer accounts, have accumulated approximately 75,486 installs. Once installed, the extensions intercept browser traffic and route it through attacker-controlled proxy infrastructure, enabling potential traffic interception and data theft. Of the identified extensions, 274 have been found to impersonate 66 legitimate services. Google Chrome is the affected platform.
Analysis of over 338 million attack simulations in H1 2026 shows that while average prevention effectiveness is strong, internal defenses lag significantly behind edge defenses, indicating that attackers are succeeding by evading detection rather than overwhelming systems.
Security researchers have identified a new Android malware strain named Manic targeting users in multiple European countries. The malware features a fallback data exfiltration mechanism that utilizes nearby infected devices to transmit stolen information. The discovery was reported by BleepingComputer, though specific technical details regarding the exfiltration method, infection chain, and exact victim count remain under review.
CERT Polska has issued an advisory warning that a critical vulnerability in Zimbra Collaboration Suite is being actively exploited by attackers. The flaw allows remote code execution, posing significant risk to organizations globally. Users are urged to apply security updates and monitor official advisories for mitigation guidance.
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. The scheme targets victims in the interim between infection and public disclosure, potentially leading to financial loss and compromised data recovery.
Japanese cloud and data center service provider Sakura Internet disclosed a security incident involving unauthorized access to its sales management system. Customer contract and membership information of up to 1.36 million accounts may have been exposed. The company has not detailed the specific attack vector or confirmed whether data was exfiltrated.
A large-scale campaign attributed to hackers compromised over 14,500 Dahua IP cameras over a 35-day period, researchers report. The operation, dubbed CameraSwarm, primarily affected devices in Ukraine and Russia. The compromise of network-connected cameras raises concerns about surveillance, botnet recruitment, and network pivoting capabilities.
U.S. cybersecurity agencies, including CISA and the NSA, have issued a warning that threat actors are leveraging AI-generated scripts to exploit vulnerabilities in Siemens S7 Series programmable logic controllers. The advisory highlights risks to operational technology environments across critical infrastructure sectors, though specific exploitation details and affected sectors remain under investigation.
Huntress researchers observed a 155-fold increase in password spraying attacks during the first half of 2026. One campaign generated over 81 million login attempts within a two-week period, exploiting legacy authentication protocols and gaps in multi-factor authentication policies that left certain login flows unprotected.
Microsoft has released a fix for a bug that caused Windows Defender to crash on certain systems after a recent security update. The issue resulted in 0xc0000005 access violation errors, potentially leaving systems without real-time protection. The company has not reported active exploitation of the bug.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical-severity remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Organizations are urged to apply Microsoft's security update immediately and monitor for indicators of compromise.
Connor Riley Moucka, 26, of Kitchener, Ontario, has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations using the Snowflake cloud data platform. The plea also covers the theft of call and text history records from over 100 million AT&T customers. The case was reported by Krebs on Security on August 6, 2026.
A new analysis by security researchers, reported by Krebs on Security, finds that generic TV streaming boxes—often sold for a one-time fee with promises of unlimited content—are not only secretly renting out users' Internet connections but also spoofing themselves as mobile phones to click ads on AI-generated websites. This sprawling ad fraud operation defrauds online merchants and advertising networks, while users face degraded network performance and potential legal/ethical issues.
LG Electronics USA announced it will suspend apps on its webOS smart TV platform that function as always-on residential proxy nodes. The decision comes after researchers found that a significant portion of apps in LG's store allow unknown third parties to route internet traffic through users' TVs, raising privacy and security concerns.
Microsoft released its July 2026 Patch Tuesday update, fixing at least 570 security vulnerabilities across Windows, Office, and Azure—nearly triple the number patched in June. The company attributes the surge to AI-assisted vulnerability discovery. While no active exploits are confirmed, the sheer volume underscores an expanded attack surface, prompting urgent calls for prioritization.
A contractor for the Cybersecurity and Infrastructure Security Agency inadvertently published dozens of internal CISA credentials, including AWS Govcloud keys, in a public GitHub repository. The exposure remained undetected for approximately six months until KrebsOnSecurity notified CISA in July 2026. The agency's subsequent postmortem identifies significant gaps in secret management and access controls.
A chain of vulnerabilities in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, could allow unauthenticated attackers to issue arbitrary commands to the spacecraft and instrument command bus. The issue is tracked as GHSA-p9r8-2q67-fp86 and has a CVSS v3.1 score of 9.4.
Zimperium zLabs researchers have detailed an updated version of the ToxicPanda (aka TgToxic) Android banking malware, now featuring 167 remote commands and a PIN harvesting workflow that targets more than 140 banking and cryptocurrency applications. The malware's global footprint has expanded, and it is being used alongside GoldDigger to enhance on-device fraud capabilities.
Researchers from Socket Threat Research have identified 40 malicious Mozilla Firefox extensions that pose as legitimate Web3 products, including OKX Wallet, Rabby Wallet, and TronLink, to facilitate cryptocurrency wallet theft. These extensions are part of a larger campaign dubbed "Offside Wallet Theft Factory," which encompasses 77 browser add-ons sharing source code and infrastructure overlaps. The malicious extensions were designed to mimic the appearance and functionality of trusted wallet interfaces, tricking users into revealing private keys or seed phrases, which were then exfiltrated to attacker-controlled servers. The findings highlight a significant threat to the Firefox add-on ecosystem and users interacting with decentralized finance (DeFi) platforms.
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the MLflow open-source AI engineering platform to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the flaw. Federal civilian agencies have been directed to remediate the vulnerability by a specified deadline. The advisory highlights the risk of unauthorized access or compromise of systems running vulnerable MLflow instances, though specific exploitation details, affected versions, and patch information remain limited in the public report.
