🎮 Game-cheat spyware
🧩 Fake installer RATs
⏱️ Network encrypted in under 24 hours

Also this week:
▸ 290 fake GitHub repos
▸ Chrome Sync stalking
▸ OAuth phishing
▸ Windows EDR bypasses
▸ Major fraud busts
▸ 3,900 threat servers mapped

Read the full ThreatsDay Bulletin: https://thehackernews.com/2026/07/threatsday-game-cheat-spyware-24-hour.html

🛑 Two Scattered Spider hackers have been sentenced to 5.5 years each for the £29 million TfL attack.

The intrusion left 148 systems inoperable, disrupted Dial-a-Ride and payment services, and forced all 27,000 employees into the office for password resets.

Here's how investigators tied them to the attack: https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html

Phishing pages aren't the attack. They're the last step.

Before that there's a funnel: search ads, social content, fake storefronts, AI creative. Built like real marketing, because it is real marketing. Just pointed at fraud instead of conversions.

Bolster AI's CEO Rod Schultz and Lead Security Analyst Lauren Barer break down how these funnels work and what to catch before fraud spreads in our webinar.

Register for the webinar here: https://thn.news/mythos-webcast

Microsoft patched a SharePoint flaw after attackers had already exploited it as a zero-day.

CVE-2026-58644 affects every supported on-premises SharePoint version and can lead to remote code execution.

CISA has now added it to KEV.

Here's what SharePoint admins need to check: https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html

🚨 New GoSerpent malware has targeted government and diplomatic entities across Southeast Asia since late 2025.

It gives attackers long-term access, steals credentials, collects sensitive files, and routes traffic through compromised hosts.

Inside the campaign: https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html

🛑 A single command pasted into Windows Run can give ACR Stealer your browser passwords, live session tokens, PDFs, and Microsoft 365 files.

One ClickFix chain hides its payload inside a JPEG and runs almost entirely in memory.

See how it gets in and what it steals: https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html

⚡ Armenia has detained a Russian tourist on a U.S. extradition request for a REvil #ransomware suspect with the same name.

His lawyers say authorities have the wrong man.

The wanted Ermakov reportedly cannot leave Russia and has checked in with the prison service every month since 2024.

Here’s what happened: https://thehackernews.com/2026/07/armenia-detains-russian-tourist-on-us.html

🔥 European Union (EU) has ordered Google to open #Android features to rival AI assistants, including the camera, microphone, screen contents, locked-screen hotwords, and background app control.

Consent still applies. For six features, Google cannot require certification.

Here's what changes, and when - https://thehackernews.com/2026/07/eu-orders-google-to-open-android-mic.html

Military autonomy is not just a platform race. It is an information infrastructure challenge.

Drones, vessels, satellites, AI systems, and allies must exchange trusted mission data across platforms and security domains.

Why the future force depends on what connects it: https://thehackernews.com/2026/07/the-race-to-field-military-autonomy-is.html

🚨 A fake coding test can be the whole attack.

North Korea-linked hackers are hiding malware across ordinary-looking SVG flag images. Run the project, and it assembles an OtterCookie-aligned toolkit that steals browser credentials, crypto wallet data, files, and clipboard contents, then opens a SocketIO backdoor.

Read the full attack chain: https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html

🚨 Attackers are targeting the datacenters that train, host, and serve AI, not just the AI models themselves.

Lava has released FORGE: The Top 10 Data Center & AI Infrastructure Security Risks: https://thn.news/forge-framework

Built with security leaders and practitioners across neoclouds, HPC, and enterprise security — open, free, and made to evolve.

🚨 CylindricalCanine breached two DigiCert support workstations with a fake screenshot ZIP.

The group obtained EV code-signing certificates to sign Zhong Stealer. DigiCert revoked 60, including 27 linked to the group.

Read how the support chat breach led to signed malware: https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html

🛑 New NadMesh botnet malware hunts exposed AI services for AWS keys and Kubernetes tokens.

It targets ComfyUI, Ollama, n8n, Gradio, and MCP deployments, pulling cloud credentials, Docker configs, and model access from compromised hosts.

How the botnet works and survives removal: https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html

⚠️ Seven malicious npm packages are targeting Vite developers.

They stay quiet during installation. Import one, and it starts a RAT delivery chain that can steal credentials, exfiltrate files, and open a reverse shell.

The attacker stores the delivery path in public blockchain transactions.

See the affected packages and full attack chain: https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html

🛑 OpenSSL quietly fixed HollowByte, a flaw where an 11-byte TLS request can reserve up to 131 KB of server memory per connection.

On the glibc systems researchers tested, that memory remained frozen until restart.

Full details: https://thehackernews.com/2026/07/openssl-hollowbyte-flaw-could-freeze.html

🛑 URGENT - A single anonymous HTTP request can run code on an unpatched #WordPress 6.9 or 7.0 site, even on a default install with zero plugins.

The new wp2shell flaw sits in core and still has no CVE for scanners to match.

Affected releases and mitigations 🠖 https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html