AI attacks move in minutes. Your SOC is still on the first alert.

Next week we're hosting a free WEBINAR with Zscaler on defending at machine speed: shrink the attack surface, kill lateral movement, contain the attack before it spreads.

Save your seat 👇 https://thehackernews.com/2026/07/ai-attacks-move-in-minutes-join-this.html

Cyber teams own continuity planning at most organizations but only 22% rate their program as strategic.

Can your continuity program survive real-world disruption? Discover why resilience programs fail under pressure — and what leading teams do differently. Read the new report to explore:

✅ Insights from 500+ leaders across North America, the UK, Germany, and the UAE.
✅ How leaders feel prepared, yet fewer than 4 in 10 actually met recovery targets when disruption hit.
✅ Why resilience programs break down at dependency mapping, third-party risk, and AI governance.

Get the report - https://thn.news/business-continuity-report

🚨 Cybercrime did not need one big break this week. It used the usual doors: cloud storage, browser trust, support calls, package names, weak defaults, and exposed admin paths.

This week’s #ThreatsDay covers:

• Cloud bucket hijacking
• Windows LPE chain
• Global fraud bust
• Chrome extension abuse
• npm/PyPI typosquats
• Fake IT support scams
• Meta phishing abuse
• Tax-themed RAT lures
• Remcos loader campaign
• Ransomware tooling links
• Realtek driver flaws
• ADFS key exposure
• AI/cloud exfiltration risks
• Teams phishing
• Taiwan espionage case
• Scattered Spider/0ktapus links
• Process Parameter Poisoning
• Esri ArcGIS flaw
• Claude warning in China

Read the full bulletin: https://thehackernews.com/2026/07/threatsday-cloud-bucket-hijacking.html

💪 npm 12 now turns off install scripts by default.

Dependency lifecycle scripts, implicit node-gyp builds, Git dependencies, and remote URL dependencies no longer run or resolve unless explicitly allowed.

GitHub is also phasing out npm tokens that bypass 2FA.

Read the article: https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html

🛑 Microsoft has detailed GigaWiper, a Windows backdoor that can spy on a machine and destroy it on command.

It can wipe disks, overwrite the Windows drive, or run fake #ransomware that encrypts files without saving a recovery key.

No decryptor. Just dead machines.

Read about it here 🠖 https://thehackernews.com/2026/07/new-gigawiper-windows-backdoor-bundles.html

🚨 Attackers are using 50+ dormant #GitHub “ghost” accounts and exposed PATs to map corporate orgs through the GitHub API.

Datadog says the campaigns enumerate repos, users, gists, followers, and org memberships. In select cases, actors cloned private repos.

Read the article - https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html

A #ransomware negotiator got 70 months in prison for betraying five clients to BlackCat operators.

Angelo Martino shared confidential insurance limits and negotiation strategy to drive up ransoms, then helped deploy BlackCat against more U.S. victims.

Authorities seized $10 million in assets.

Here’s how the scheme worked: https://thehackernews.com/2026/07/ransomware-negotiator-gets-70-months-in.html

🛑 WARNING - Hackers exploited the "Ill Bloom" flaw to drain $3.1 million from 431 #cryptocurrency wallets.

Weak recovery phrase generation left some older mobile wallets created between 2016 and 2018 exposed, potentially allowing attackers to reconstruct private keys and gain unauthorized access.

Check the details on THN 🠖 https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html

UPDATE 🠒 Latest MS Defender’s RoguePlanet patch may have introduced a new problem.

Researcher 'Chaotic Eclipse' says Defender can cache a massive Zone.Identifier ADS file and exhaust disk space when a system visits a custom SMB server.

They reproduced it on Windows 11 25H2 and Windows Server 2025.

Read: https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html

🚨 Hackers are using fake #Microsoft Entra passkey pages to target Microsoft 365 accounts.

The vishing campaign steals credentials and MFA responses, then attempts to register attacker-controlled passkeys while adapting to prompts in real time.

Read how the attack works: https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html

🛑 ALERT - A VPN is supposed to hide your traffic. A new study says many free #Android VPN apps do not.

Researchers tested 281 popular apps with 2.4B+ installs:

→ 29 leak traffic, including visited sites
→ 246 contact ad/tracking servers
→ 5 could let a same-Wi-Fi attacker hijack the tunnel

The app still says “connected.”

Check whether yours is listed: https://thehackernews.com/2026/07/study-of-281-free-android-vpn-apps.html

🚨 They hacked thousands of sites. Then forgot to lock their own front door.

For 3 weeks, this crew left its server wide open, spilling the whole operation: WP-SHELLSTORM. Inside were 27 known plugin bugs, target lists over 1.4M domains, and thousands of backdoors planted.

Some may still be open on your site.

See what to patch: https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html

🚨 XRING has no patch or CVE.

This new unpatched #vulnerability can let a remote, unauthenticated client crash HTTP/3 servers built on Alibaba's XQUIC with about 260 bytes of legal QPACK traffic.

It affects every release through v1.9.4. A public PoC is available.

Read details on THN 🠖 https://thehackernews.com/2026/07/unpatched-xring-flaw-in-xquic-lets.html

🚨 A Silver Fox-linked #malware distributor is selectively deploying a new backdoor called MODBEACON.

It uses encrypted gRPC streaming for command-and-control and loads additional plugins directly in memory.

Read the full story: https://thehackernews.com/2026/07/new-modbeacon-rat-uses-grpc-streaming.html

Lumen thought it had 17,000 cyber assets. Then it found 500,000 devices. Today, it tracks about 1.1 million.

The lesson is simple: you cannot fix what you cannot see.

Read how Lumen rebuilt its asset inventory: https://thehackernews.com/2026/07/from-17000-to-11-million-assets-how.html

⚡ A researcher showed how three #OpenClaw flaws could have let an external #WhatsApp message trigger host code execution.

The bugs could also expose credentials or enable sandbox escape in vulnerable configurations.

Read the full story on THN 🠒 https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html

⚠️ Not dramatic, just worth your attention!

A single laser pulse can reset a Tangem hardware wallet's password and let an attacker drain the funds, no old password or backup card needed.

It can't be patched, but the attack needs the physical card and a $250K lab, and it destroys the card to get in.

Read the full story 🠒 https://thehackernews.com/2026/07/laser-attack-resets-tangem-wallet.html

🚨 Six new flaws in U-Boot, the software that boots everything from routers to servers.

A booby-trapped firmware image can crash the device, or on some, run the attacker's code, all before startup finishes and before anything checks the image is safe.

Read details here: https://thehackernews.com/2026/07/six-new-u-boot-flaws-could-let.html

🚨 Attackers compromised Injective Labs’ #GitHub repo and published npm package 1.20.21 with code that sent crypto wallet private keys and seed phrases to an external server.

Users should update to 1.20.23 and rotate exposed secrets.

Read more: https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html

🚨 URGENT SECURITY WARNING 🠒 Progress ordered ShareFile customers to shut down on-premises Storage Zone Controllers over a “credible external security threat.”

Progress told THN it disabled accounts as a precaution and has no indication of unauthorized access.

Read what is known so far - https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html

🚨 Zimbra has fixed a critical stored XSS flaw in its Classic Web Client.

A crafted email could run malicious code when opened and expose mailbox information, session data, or account settings.

Read the full story on THN 🠖 https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html

Zimbra has not reported in-the-wild exploitation. Update to version 10.1.19.