⚠️ CISA added CVE-2026-45659 to KEV following active exploitation.

The SharePoint Server RCE was patched in May 2026.

Microsoft says an authenticated Site Member can execute code remotely — no admin rights required.

FCEB agencies have until July 4 to patch.

Details: https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html

🛑 Fake GitHub PoC repos are being used to infect vulnerability researchers with ChocoPoC RAT.

The PoC may look clean. The #malware hides in Python dependencies like frint and skytext, then steals saved passwords, cookies, browser data, and files.

How the trap works: https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html

🚨 FortiBleed has already led to at least 12 #ransomware deployments.

Experts say one operator tied to the campaign was active in INC Ransom and Lynx negotiation panels.

The trail includes 354 completed FortiGate attack chains.

Details here: https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html

🔥 An AI agent turned Langflow RCE into automated database extortion.

CVE-2025-3248 exploited to steal secrets, move laterally, hijack Nacos, encrypt 1,342 configuration items, and drop database schemas.

Inside the attack chain: https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html

🛑 AI agents don’t trigger leaver events.

No HR record.
No manager.
No offboarding date.

IGA tools may only see a service account while API access, OAuth grants, and stale credentials drift outside the human identity lifecycle.

Where the model breaks: https://thehackernews.com/2026/07/identity-lifecycle-management.html

ToddyCat’s Umbrij can turn an active Gmail session into Google API access.

Experts say it launches Chrome or Edge in headless mode, grabs an OAuth authorization code, and lets operators exchange it for an access token.

How the STRD attack chain works: https://thehackernews.com/2026/07/toddycat-linked-umbrij-malware-abuses.html

#ThreatsDay Bulletin is live, and this week’s threats were quiet, weird, and too easy to miss.

🤖 Stolen AI compute
🔨 BlueHammer ransomware
🍎 Apple email flaw
🚨 Fake INTERPOL ransomware
📋 ClickFix defenses
🐀 BeepRAT espionage
🧬 Millennium RAT
🎣 UNC1151 phishing
🔎 AI search hijack
👥 Teams bot controls
🧠 GPT-5.6 Sol
🕵️ UNC5792 reward
🧩 Prompt injection
🕶️ Anthropic tracking
📱 Device-aware phishing
🏛️ Amazon FTC fine
🏗️ Claude sandbox root

Read the full roundup: https://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.html

🚨 Update - Citrix CVE-2026-8451 is now under active exploitation, less than 24 hours after disclosure.

A Frankfurt IP hit sensors for 5 hours, delivering the watchTowr exploit only after a 200 OK response and skipping 404s.

Learn the malformed SAML exploit path works: https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html

🛑 Ransomware crews are stacking three ugly paths into enterprise networks.

🔸 Anubis: Citrix Bleed 2
🔸 The Gentlemen: Go backdoor + BYOVD
🔸 VECT/TeamPCP: supply-chain credential theft

How the attack paths connect: https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html

🔥 Google disrupted #NetNut, a proxy network spanning at least 2 million home devices.

In one June week, GTIG saw 316 threat clusters using suspected NetNut exit nodes to hide location and guess passwords.

The simple risk: your home IP becomes someone else’s relay.

Learn more: https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html

🚨 PamStealer targets Mac users through fake Maccy sites.

A compiled AppleScript stages a Rust stealer that validates the entered login password through PAM, then targets browsers, crypto wallets, iCloud Keychain, and clipboard content.

How the attack chain works: https://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.html

⚠️ A member of the EU committee investigating spyware abuse was hacked with Pegasus while serving on it.

Citizen Lab says Stelios Kouloglou’s #iPhone was compromised in Oct. 2022 and Mar. 2023, likely via Apple’s HomeKit zero-click exploit.

Attackers could have accessed PEGA documents and deliberations.

Details: https://thehackernews.com/2026/07/european-parliament-member.html

#ThreatsDay this week reads like attackers opened the junk drawer of the internet and found everything still plugged in:

🧠 exposed AI compute
📧 email privacy gaps
🧩 fake browser extensions
🤖 meeting bots
📋 clipboard tricks
🛡️ Defender flaws
🎭 fake INTERPOL ransomware

Just an Empire State Building-sized amount of trust left unattended - https://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.html

⚠️ Armored Likho targeted power and government agencies.

Kaspersky says the attacks span Russia, Brazil, and Kazakhstan, using BusySnake Stealer, GitHub-hosted payloads, Go2Tunnel reverse tunneling, and patched CVE-2025-9491 LNK abuse.

How the stealer chain works: https://thehackernews.com/2026/07/armored-likho-targets-government.html

🛑 Six malicious npm packages mimicked Rollup polyfill tools.

Experts link them to North Korea-linked actors. They used hidden install-time execution and JSONKeeper fetches to load payloads for remote access and browser, wallet, cloud, SSH, and npm secret theft.

Read: https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html