Skip to content
skopnix
Every edition · newest first

The archive.

1,115 dispatchespage 18 / 19№ 95 – 36

  1. Mon 27 Jul 2026

    37 dispatches
    The SID that wasn’t there: bypassing KB5014754 to Domain Admin on a fully patched AD CSVULN
  2. Inside the growing residential proxy botnet threatMALW
  3. [KEV] CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnKEV
  4. MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal DataMALW
  5. Health system in South Carolina, Georgia closes offices after malware affects networksMALW
  6. Vidar Malware: How the Multithreaded Windows Stealer WorksMALW
  7. Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC BackdoorEXPL
  8. After law enforcement disrupted JackSkid, Dysphoria shifted its IoT botnet C2 to blockchain name services and infected-device relays. Weak Telnet and SSH passwords remain the main way in. Read how the botnet adapted: https://thehackernews.com/2026/07/dysphoria-iot-botnet-adds-blockchain-c2.htmlMALW
  9. Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid DisruptionMALW
  10. Be careful downloading Windows 11 apps from Google, 70+ fake sites are pushing malware right nowMALW
  11. BrainDrain: A Chrome extension that collects your AI prompts without you ever opening it and has 100k users, 9 AI platformsMALW
  12. Telegram phishing campaign targeted exiled Belarusian activist, Russians and KazakhstanisAPT
  13. From /init to Code Execution with Opus-5 in Claude Code - An Indirect Prompt Injection StoryEXPL
  14. Coca-Cola confirms data theft in Fairlife ransomware attackBRCH
  15. Ernst & Young data breach claimed by ShinyHunters extortion gangBRCH
  16. Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehiclesEXPL
  17. RT by @TheHackersNews: WARNING - Public PoC released for a vBulletin flaw that turns one unauthenticated request into code execution. No login, no click. The request reaches PHP’s eval(). Self-hosted admins should update now. Details: https://thehackernews.com/2026/07/public-exploit-released-for-patched.htmlEXPL
  18. Public Exploit Released for Patched vBulletin Pre-Auth Code Execution FlawVULN
  19. New vBulletin Vulnerability!VULN
  20. RT by @cyb3rops: Quick follow-up on the OceanLotus / APT-C-00 campaign from the recent 360 report - the one using disc-image delivery, Analyzer.exe DLL sideloading, and http://NTUSER.MAN persistence. We turned up more indicators tied to the same group, and both are barely detected: An ISO container (6/60) with the same anti-debug + long-sleep traits, seen via China on 2 Jun 2026. Billfish.rar (2/63), tagged persistence + anti-debug, seen via Japan on 24 Jul 2026 9130d7d2271e9cb118dd83907d9865cba547304a1f6c72743973efd59813df18 (ISO image) 0bae4acd83015b8447e90aec97efa2e81d136bfd512a69301d6187fed2e45c74 (Billfish.rar)APT
  21. PTC Windchill Vulnerability Exploited in Ransomware CampaignEXPL
  22. DentaQuest disclosed a data breach that impacted +23 million individualsBRCH
  23. MedusaHVNC Malware Uses Hidden Windows Desktops to Evade DetectionMALW
  24. A fake Microsoft Teams update deploys two legitimate RMM tools on the same Windows host. Operation BlueDash installs Level RMM and ScreenConnect in parallel, apparently to retain remote access if one is removed. How the phishing chain works: https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.htmlMALW
  25. RDP bitmap cache artifacts revealed the threat actor opening the Veeam Backup & Replication console, reviewing backup jobs, tape & storage infrastructure — and removing backups from the configuration database. Full report https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/EXPL
  26. Hackers used autonomous AI agent to spy on Thailand's finance ministryAPT
  27. GitLab Users Urged to Patch After Research Reveals Critical RCE ChainVULN
  28. Hacked Public Wi-Fi Gateways Used to Harvest Corporate CredentialsEXPL
  29. Java Spring Boot "heapdump" scans, (Mon, Jul 27th)VULN
  30. New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitchVULN
  31. A poisoned package can land in a Dependabot update PR before registries remove it. GitHub is adding a 3-day cooldown for routine version updates, while security fixes will still move immediately. Why three days, and what the delay cannot stop: https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.htmlSUPL
  32. GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package AdoptionSUPL
  33. From Google Ads to Terminal: Dissecting an Apple Support Impersonation Campaign Abusing Claude Share.MALW
  34. Marathon Petroleum’s CISO on OT security automation, supply chain riskPOLI
  35. Nono: Open-source sandbox for AI agentsMALW
  36. MCBS Data Breach Affects 1.2 Million IndividualsBRCH
  37. GitHub delays version updates so malware gets caught firstRSCH

  38. Sun 26 Jul 2026

    15 dispatches
    ExfilSquad claims Wesco International on its leak siteRANS
  39. Deadlock claims Caspian One on its leak siteRANS
  40. > free time today > what was bro doing with a torrent movie .exe > download > 1gb .exe > lmfao binary inflation > bonk bonk > remove junk > deflate binary > 500kb > bonk bonk > no imports > crt stripped > position independent > checks language > kills self if in belarus or russia > runs 2000 random functions in random order > trying to stall to evade VMs > decrypts .exe from inside itself > runs mystery .exe in memory > .exe steals goop off machine > bonk bonk > yara flags as lumma stealer overall this wasnt the greatest goop ive ever seen, but i was a big fan of free_movie.exe. its a certified limewire 2002 classic. inflated binary: e25ae92b95809ee42f61810a0253ead29b3a6aa8adf91f785c80c9bec5f38bd8 stripped binary: 732d7a945163a3f31eae25028562bd5d9a352c31eb90c777042bceeeb1c6b3ec in-memory payload (partially reconstructed): 3e561eecde0071766626d80d6ce3cf1626fb2dbed0ef437948f622c283a0e91e c2: overcjo(.)cyou betavmt(.)cyou hiatuft(.)cyou auditva(.)cyouMALW
  41. Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)VULN
  42. GitHub, PyPI add time-based defenses against supply chain attacksSUPL
  43. Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 CredentialsBRCH
  44. ExfilSquad claims Microsoft on its leak siteRANS
  45. Can a cloud tenant really black out the power grid? We asked the Bit2Watt researchers. Their answer 🠒 the scariest result only works if thousands of GPUs spike their power at the same instant, and in reality they never line up that cleanly, which blunts the attack. Also notable: they didn't warn any cloud provider first, because there's no product bug to patch. Read: https://thehackernews.com/2026/07/new-bit2watt-attack-could-let-cloud.htmlRSCH
  46. Rockwell Patches Code Execution Flaws in Arena Simulation SoftwareVULN
  47. Malvertising Sends Malware in Pieces, Then Makes the Browser Build the ExecutableMALW
  48. Iran-Linked Actors Breach Are Targeting US Water and Energy Control SystemsAPT
  49. Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breachedEXPL
  50. RT by @cyb3rops: France Exposes Russia's Secret Cyber Espionage Network https://www.unredacted.info/russia/france-exposes-russias-secret-cyber-espionage-network/APT
  51. RT by @cyb3rops: Hackers use DNS poisoning on hotel Wi‑Fi to steal Microsoft 365 accounts https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/EXPL
  52. Steam forum ClickFix attacks infect gamers with XMRig cryptominersMALW

  53. Sat 25 Jul 2026

    8 dispatches
    RT by @TheHackersNews: The malware arrives in pieces. The victim’s browser puts it together. SourTrade malvertising delivers a legitimate Bun runtime, malicious bytecode, and PE components separately, then uses the browser to build the final Windows executable with a different hash each session. See how the browser-assembled malware chain works: https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.htmlMALW
  54. Malicious sites use JavaScript to build malware in browser memoryMALW
  55. Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched AvailableVULN
  56. 5 months …KEV
  57. DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate PayoutsRANS
  58. CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account HijackingMALW
  59. A featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker networkMALW
  60. Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCEEXPL