📢 WEBINAR - The developer who built the automation may have left months ago, but the access token hasn’t.

That AI agent is still running with standing privileges and no current human owner.

SailPoint experts show how to find every orphaned one and map it back to a real person.

🔗 See how here: https://thehacker.news/securing-ai-use

PureLogs Stealer now hides behind Blogger pages and a fake PDF JavaScript file.

Experts say VEIL#DROP uses PowerShell, dynamic Blogspot URLs, fileless .NET loading, and #Microsoft-signed LOLBins to evade detection.

How the chain unfolds: https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html

90+ spoofed software domains are pushing AsyncRAT through ScreenConnect.

Kaspersky says the sites mimic OBS Studio, Bandicam, DNS Jumper, and DS4Windows, then use SEO to surface in Google and Bing.

How the fake installers turn ScreenConnect into RAT access: https://thehackernews.com/2026/07/seo-poisoned-software-sites-abuse.html

🔥 Scattered Spider now has another accused member in U.S. custody.

Peter Stokes, 19-years-old, was extradited from Finland after prosecutors tied “Bouquet” to at least four alleged intrusions.

One included an $8M crypto demand.

Read - https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html

⚡ Argo CD repo-server has an UNPATCHED code execution flaw (no CVE).

Experts say unauthenticated gRPC access can execute commands on the service.

With default Helm installs, a single compromised pod can reach it if network policies are off. That path extends to Redis cache poisoning and cluster takeover.

Repo-server attack flow explained: https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html

⚠️ CISA added CVE-2026-45659 to KEV following active exploitation.

The SharePoint Server RCE was patched in May 2026.

Microsoft says an authenticated Site Member can execute code remotely — no admin rights required.

FCEB agencies have until July 4 to patch.

Details: https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html

🛑 Fake GitHub PoC repos are being used to infect vulnerability researchers with ChocoPoC RAT.

The PoC may look clean. The #malware hides in Python dependencies like frint and skytext, then steals saved passwords, cookies, browser data, and files.

How the trap works: https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html

🚨 FortiBleed has already led to at least 12 #ransomware deployments.

Experts say one operator tied to the campaign was active in INC Ransom and Lynx negotiation panels.

The trail includes 354 completed FortiGate attack chains.

Details here: https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html

🔥 An AI agent turned Langflow RCE into automated database extortion.

CVE-2025-3248 exploited to steal secrets, move laterally, hijack Nacos, encrypt 1,342 configuration items, and drop database schemas.

Inside the attack chain: https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html

🛑 AI agents don’t trigger leaver events.

No HR record.
No manager.
No offboarding date.

IGA tools may only see a service account while API access, OAuth grants, and stale credentials drift outside the human identity lifecycle.

Where the model breaks: https://thehackernews.com/2026/07/identity-lifecycle-management.html

ToddyCat’s Umbrij can turn an active Gmail session into Google API access.

Experts say it launches Chrome or Edge in headless mode, grabs an OAuth authorization code, and lets operators exchange it for an access token.

How the STRD attack chain works: https://thehackernews.com/2026/07/toddycat-linked-umbrij-malware-abuses.html

#ThreatsDay Bulletin is live, and this week’s threats were quiet, weird, and too easy to miss.

🤖 Stolen AI compute
🔨 BlueHammer ransomware
🍎 Apple email flaw
🚨 Fake INTERPOL ransomware
📋 ClickFix defenses
🐀 BeepRAT espionage
🧬 Millennium RAT
🎣 UNC1151 phishing
🔎 AI search hijack
👥 Teams bot controls
🧠 GPT-5.6 Sol
🕵️ UNC5792 reward
🧩 Prompt injection
🕶️ Anthropic tracking
📱 Device-aware phishing
🏛️ Amazon FTC fine
🏗️ Claude sandbox root

Read the full roundup: https://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.html

🚨 Update - Citrix CVE-2026-8451 is now under active exploitation, less than 24 hours after disclosure.

A Frankfurt IP hit sensors for 5 hours, delivering the watchTowr exploit only after a 200 OK response and skipping 404s.

Learn the malformed SAML exploit path works: https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html

🛑 Ransomware crews are stacking three ugly paths into enterprise networks.

🔸 Anubis: Citrix Bleed 2
🔸 The Gentlemen: Go backdoor + BYOVD
🔸 VECT/TeamPCP: supply-chain credential theft

How the attack paths connect: https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html

🔥 Google disrupted #NetNut, a proxy network spanning at least 2 million home devices.

In one June week, GTIG saw 316 threat clusters using suspected NetNut exit nodes to hide location and guess passwords.

The simple risk: your home IP becomes someone else’s relay.

Learn more: https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html