Security Signals (07/28/26-08/11/26)

Top ATT&CK Techniques Observed

T1566 – Phishing: Credential theft remained one of the primary initial access vectors, with campaigns using device code phishing, adversary-in-the-middle (AiTM) techniques, fake recruiters, Google Ads lures, procurement scams, eCards, and other social engineering methods.

T1071 – Application Layer Protocol: Threat actors increasingly relied on legitimate services and protocols—including Outlook, DNS, browsers, blockchain infrastructure, Telegram, and cloud platforms—for command-and-control to blend malicious traffic with normal network activity.

T1583 / T1584 – Acquire & Compromise Infrastructure: Multiple investigations focused on attacker-controlled infrastructure, compromised government websites, malicious domains, cloud resources, and software repositories used to support phishing, malware delivery, and command-and-control.

T1195 – Supply Chain Compromise: Software supply chain attacks remained highly active, targeting npm packages, PyPI repositories, SDKs, browser extensions, AI tooling, IDE components, and other developer ecosystems.

T1105 / T1059 – Ingress Tool Transfer & Command Execution: Researchers observed widespread use of custom loaders, remote access trojans, malware frameworks, scripting engines, ClickFix techniques, and living-off-the-land methods to establish persistence and evade detection.

What Matters Most

Identity has become the preferred attack surface. Rather than exploiting vulnerabilities, many campaigns focused on stealing credentials through phishing, adversary-in-the-middle attacks, Microsoft 365 abuse, and social engineering.

ClickFix continues to gain momentum. Multiple unrelated threat actors—including financially motivated groups, DPRK operators, and nation-state campaigns—adopted ClickFix techniques, reinforcing its emergence as a mainstream initial access method.

Trusted infrastructure is increasingly abused. Government websites, SaaS platforms, Microsoft 365, GitHub, Telegram, cloud services, and blockchain infrastructure were repeatedly leveraged to host payloads, deliver malware, or conceal command-and-control traffic.

Threat research is shifting toward infrastructure analysis. Many reports focused less on individual malware samples and more on mapping attacker infrastructure, command-and-control architecture, operational ecosystems, and attribution.

What Defenders Should Watch

• Device code phishing, AiTM campaigns, and Microsoft 365 authentication abuse
• ClickFix-style execution chains involving PowerShell, MSBuild, script interpreters, or trusted Windows utilities
• Newly observed domains, DNS tunneling, Outlook- or browser-based C2 channels, and rapidly changing infrastructure
• Unauthorized package updates, developer dependencies, browser extensions, SDKs, and software repositories
• Remote administration tools, custom loaders, and malware communicating through trusted cloud services

Quick Wins

• Strengthen phishing-resistant authentication and monitor for suspicious OAuth, device code, and session activity
• Expand detection coverage for ClickFix techniques and script-based execution from user-accessible directories
• Monitor outbound DNS, Outlook, browser, and cloud-service traffic for unusual command-and-control behavior
• Verify software dependencies, package updates, browser extensions, and developer tooling before deployment
• Continuously enrich detections with current malicious domains, URLs, IPs, and C2 infrastructure to identify emerging campaigns earlier

Key Insight: This reporting period highlighted a continued shift away from traditional exploit-driven intrusions toward attacks that abuse trusted identities, legitimate services, and widely used platforms. At the same time, researchers placed greater emphasis on uncovering attacker infrastructure and command-and-control techniques, giving defenders more opportunities to detect campaigns through behavioral patterns rather than malware signatures alone.

Chaos in Teams: Vishing

Source: Sophos
(Published: 28 July 2026)
Sophos analysts investigated a Microsoft Teams voice phishing (vishing) campaign tracked as STAC4749 that used a consistent set of IT-themed cloud domains and personas… Read more.

SilverFox Evolves

Source: Cato Networks
(Published: 28 July 2026)
SilverFox is expanding its toolkit. Read more.

Phantom Stealer: Shellcode, Steganography and Credential Theft

Source: Splunk
(Published: 28 July 2026)
STRT observed that Phantom Stealer leverages multiple loader variants to deliver its payload. Read more.

Joyfill npm Supply Chain Compromise

Source: StepSecurity
(Published: 28 July 2026)
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts, were published to the npm registry. Read more.

A New RAT in the Valley: SafeRAT

Source: ExaTrack
(Published: 28 July 2026)
This article details a new malicious code, SafeRat, which we attribute to the APT group Silver Fox. Read more.

ClickFix Keeps Evolving: Rundll32 Ordinal Execution Over WebDAV

Source: CyberProof
(Published: 28 July 2026)
The CyberProof Threat Research Team has tracked a ClickFix variant that pushes execution deep into trusted Windows components. Read more.

SonicWall Credential Stuffing Campaign

Source: Huntress
(Published: 28 July 2026)
Starting on July 25, 2026, at approximately 18:02:21 UTC, the Huntress SOC detected an out-of-the-ordinary spike in successful SonicWall VPN and firewall logins… Read more.

MacSync Stealer RAT Reverse Engineering

Source: Huntress
(Published: 29 July 2026)
In mid-July, Huntress investigated a macOS intrusion in which the victim thought they were installing Claude, but instead ran a full stealer and remote access… Read more.

Inside Astaroth’s New Spambot Component

Source: CrowdStrike
(Published: 29 July 2026)
Established Latin American (LATAM) threat actors are continuously adapting their malware capabilities and attack methodologies to circumvent defensive measures and maintain effectiveness against target environments. Read more.

TA488 Comes for Outlook With Another Half-Click Exploit

Source: Proofpoint
(Published: 29 July 2026)
On 22 July 2026, TA488 initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA). Read more.

Amazon Identifies North Korean Hacker Group Behind Open Source Supply Chain Attacks

Source: AWS
(Published: 29 July 2026)
Amazon is sharing new findings about how a threat actor linked to the Democratic People’s Republic of Korea (DPRK) is targeting open source software libraries… Read more.

Dysphoria Botnet Evolution and Technical Analysis

Source: Qianxin XLab
(Published: 29 July 2026)
Since Q1 2026, XLab has been continuously tracking an emerging botnet family named Dysphoria whose bot population exceeds 200,000. Read more.

WP2Shell WordPress Exploit: Technical Analysis and Real Attack Data

Source: Wordfence
(Published: 29 July 2026)
On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers… Read more.

Autonomous AI Cyber Attack Campaign

Source: Unit 42
(Published: 30 July 2026)
Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. Read more.

HollowFrames: Layered Loader and Matryoshka Backdoors

Source: Blackpoint Cyber
(Published: 30 July 2026)
HollowFrame established a durable execution layer by combining persistence with multiple payload launching techniques, while Matryoshka extended… Read more.

XMRig Covert Linux PAM Abuse

Source: Group-IB
(Published: 30 July 2026)
In May 2026, a highly covert Monero (XMR) cryptomining campaign was identified, leveraging advanced stealth techniques to infiltrate and persist within targeted Linux environments. Read more.

GenieLocker Ransomware for Windows, Linux and ESXi

Source: Kaspersky Securelist
(Published: 30 July 2026)
The new GenieLocker ransomware family has been active since March 2026. Read more.

OCTLurk and SilkLurk Backdoors in Central Asia

Source: Kaspersky Securelist
(Published: 30 July 2026)
We have been tracking two new backdoors, OctLurk and SilkLurk, observed in attacks against government organizations primarily in Central Asia since January 2025. Read more.

Cl0p Targets Windchill

Source: Censys
(Published: 30 July 2026)
On July 22, 2026, ReliaQuest reported observations of a threat actor exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill and FlexPLM. Read more.

XCSSET v4.0 Malware Analysis

Source: Unit 42
(Published: 31 July 2026)
After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. Read more.

DarkSword’s Panel Sprawl

Source: Censys
(Published: 31 July 2026)
DarkSword is a commercial iOS exploit chain, six chained vulnerabilities spanning iOS 18.4 through 18.7, that leaked publicly via a GitHub repository… Read more.

CaptiveCrunch: Midnight Blizzard Targets Travelers Worldwide

Source: Microsoft
(Published: 31 July 2026)
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks… Read more.

Polinrider Caused Dozens of npm and Go Compromises

Source: OpenSourceMalware
(Published: 31 July 2026)
That PolinRider connection grabbed my attention, because that campaign isn’t really known for compromising legitimate packages. Read more.

Snowlight Government Chinese Campaign

Source: SOCRadar
(Published: 31 July 2026)
SOCRadar Threat Research Unit (STRU) identified and analyzed an exposed adversary-operated staging server containing a full attack infrastructure… Read more.

From WSProxy to Root: INC Ransomware and SonicWall SMA Exploit Chain

Source: Resecurity
(Published: 1 August 2026)
Virtual private network (VPN) appliances occupy one of the most sensitive positions in modern enterprise architecture: the boundary between the untrusted public internet and the internal corporate… Read more.

NullReceiver DPRK C2 Technique

Source: OpenSourceMalware
(Published: 2 August 2026)
We just identified a new blockchain-based command-and-control technique hiding inside two trojanized npm packages, bianira-ui and fluid-type-ui. Read more.

DoubleCup ClickFix Loader and DeviceManager RATs

Source: SOCRadar
(Published: 3 August 2026)
SOCRadar’s Threat Research Unit (STRU) identified and analyzed DOUBLECUP, a Russian Loader-as-a-Service (LaaS) for ClickFix campaigns. Read more.

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Source: Netskope
(Published: 3 August 2026)
In April 2026, Netskope Threat Labs reported a Windows-based Malware-as-a-Service (MaaS) infostealer delivered through the “Clickfix” social engineering tactic. Read more.

Targeted Attack Against Government Entities in the Middle East – Part 2

Source: Zscaler
(Published: 3 August 2026)
This is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. Read more.

Inside a Russian-Speaking Access Broker’s Dual Operation

Source: CloudSEK
(Published: 3 August 2026)
An exposed server owned by a Russia-nexus threat actor revealed months of activity from a high-volume initial access broker. Read more.

N-able Vulnerability Exploitation

Source: Huntress
(Published: 3 August 2026)
On August 1–2, 2026, N-able disclosed a critical vulnerability in N-central, its flagship remote monitoring and management (RMM) platform… Read more.

Smoke Screen: ScreenConnect RMM Abuse and Cloudflare Tunnels

Source: Securonix
(Published: 4 August 2026)
Securonix Threat Research has been tracking an active, multi-wave campaign we are calling SMOKE#SCREEN, in which threat actors use a rotating collection of social engineering lures… Read more.

QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

Source: Fortinet
(Published: 4 August 2026)
FortiGuard Labs is tracking a campaign associated with a long-standing supply chain attack on the QuickFox application. Read more.

Cryptomining Attack Hiding in Memory

Source: Aqua Security
(Published: 4 August 2026)
The attacks most likely to go undetected are the ones that never touch disk. Read more.

ChainDrop Supply Chain Compromise: Anatomy of a Self-Propagating Worm

Source: Microsoft
(Published: 4 August 2026)
Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers… Read more.

Shai-Hulud Is Back: August

Source: JFrog
(Published: 4 August 2026)
The JFrog security research team identified a new version of the Shai-Hulud supply-chain malware affecting 400+ packages across 1700+ versions. Read more.

Malware Bypasses DNS With Direct-to-IP Communication

Source: Unit 42
(Published: 4 August 2026)
Malware samples often bypass DNS entirely, communicating directly to IP addresses instead. Read more.

Fake CAPTCHA, Real Business: Traffic Distribution for Hire

Source: Netskope
(Published: 4 August 2026)
A single PDF factory has stamped out more than 12,700 structurally similar FakeCaptcha documents and parked them on Webflow’s content delivery network… Read more.

Detecting CertiGhost CVE-2026-54121

Source: Nextron Systems
(Published: 4 August 2026)
Many organizations rely on Microsoft Active Directory to manage users, computers, logins, and access permissions. Read more.

macOS ClickFix Campaign Learned to Hide

Source: Microsoft
(Published: 5 August 2026)
Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS), through a large cluster of look-alike domains. Read more.

Payroll Pirates: Strange New Tides in Business Email Compromise

Source: Arctic Wolf
(Published: 6 August 2026)
Arctic Wolf is tracking an ongoing Microsoft 365 phishing campaign affecting healthcare, education, manufacturing, government, professional services, and other sectors across the United States… Read more.

StealNui: A New Linux RAT/Clipper

Source: ExaTrack
(Published: 6 August 2026)
This binary, detected only once on VirusTotal, makes far too much noise on Exalyze to be honest, so let’s dig into it a little to understand… Read more.

22 Seconds to Compromise: Automated SSH Actors

Source: SANS ISC
(Published: 6 August 2026)
On May 23, 2026, a threat actor successfully authenticated to my Cowrie SSH honeypot using compromised credentials and, within 22 seconds, injected a backdoor SSH key… Read more.

Fake Zoom Installer Delivers Overlord RAT

Source: Jamf
(Published: 6 August 2026)
Jamf Threat Labs recently identified a campaign using a fake Zoom installer to deliver a configured build of Overlord, an open-source remote access framework… Read more.

CaptiveCrunch: Amplifying Coverage With Variant Discovery

Source: Stairwell
(Published: 6 August 2026)
CaptiveCrunch is an ongoing espionage campaign reported on by Microsoft on July 31, 2026. Read more.

CVE-2026-16812: Critical Command Injection in Arista VeloCloud Orchestrator

Source: Resecurity
(Published: 6 August 2026)
CVE-2026-16812 is a critical unauthenticated OS command injection vulnerability affecting on-premises Arista VeloCloud Orchestrator (VCO) deployments. Read more.

AI Token Jacking

Source: Unit 42
(Published: 6 August 2026)
It’s three a.m., do you know what your AI agent is doing? Read more.

Clustering macOS ClickFix Campaign Pages Using HTTP-Basma

Source: Netomize
(Published: 6 August 2026)
On August 5, 2026, the Microsoft Security Research Team (MSRT) blogged about a new macOS ClickFix campaign… Read more.

Supply Chain Attack Activities Against Domestic Electron Software

Source: Qianxin
(Published: 7 August 2026)
Since our discovery of Operation Dragon Dance in 2021, we have repeatedly emphasized the vulnerability of domestic Electron software… Read more.

BDThemes Ecosystem Supply Chain Compromise via Poisoned API Response

Source: Wordfence
(Published: 8 August 2026)
The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor… Read more.

CERT-UA Article 6318863

Source: CERT-UA
(Published: 8 August 2026)
CERT-UA ???????? ?????????? ???? ???????????? ?????????? ??????? ?????????? ????????? ????????? ??????????? UAC-0145… Read more.

Kimsuky Integrates AI/LLM Into Attack Chain

Source: Genians
(Published: 9 August 2026)
???? ???? ??(Genians Security Center)? ?? ?????? ?? ??? ?? ???? ??? ???(Kimsuky)? ??? ??? ???? GitHub ? GitLab ?? ?? ??? ????? ???? ????. Read more.

Insolent Hyena: Mixed Motives and Objectives

Source: BI-ZONE
(Published: 10 August 2026)
Hacktivists typically target organizations to generate publicity. Read more.

Aeternum Blockchain C2 Analysis

Source: Unit 42
(Published: 10 August 2026)
Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Read more.

Lazarus Group IT Workers Investigation – Part Two

Source: ANY.RUN
(Published: 10 August 2026)
Back in December, we were the first ever to fully record the Famous Chollima infiltration cycle. Read more.

Abyssos: Technical Analysis of a New Modular RAT

Source: Zscaler
(Published: 10 August 2026)
In late June 2026, Zscaler ThreatLabz identified a new malware family that we track as Abyssos. Read more.

Deadlock Ransomware: Rust-Based Encryptor With Decentralized Recovery Infrastructure

Source: Microsoft
(Published: 10 August 2026)
Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Read more.

TXTBook: A Supply Chain Heist Rehearsed in Public

Source: CloudSEK
(Published: 10 August 2026)
An operator has spent the summer of 2026 publishing malicious packages to the public npm registry under names that belong to somebody else. Read more.

AI Sidebar Extension Monetizes Its Own Updates

Source: Netskope
(Published: 11 August 2026)
The Chrome extension “AI Sidebar with DeepSeek AI” that Google removed from the Chrome Web Store in January 2026 for stealing AI conversation content resumed shipping… Read more.

Head Mare Targets TrueConf Server With PhantomCore

Source: Kaspersky Securelist
(Published: 11 August 2026)
In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Read more.

Deleting the Defenders: A Commodity BYOVD Toolkit

Source: VMRay
(Published: 11 August 2026)
[Source page could not be retrieved reliably; excerpt left blank for manual verification.] Read more.

The Phishing Link That Died on Purpose

Source: Gen Digital
(Published: 11 August 2026)
The first URL was already dead. Read more.

Fake CCleaner Installs GhostDesk Chrome Spyware

Source: Malwarebytes
(Published: 11 August 2026)
A fake version of the popular PC cleaning tool CCleaner is being used to infect Windows users with a malicious Chrome extension called GhostDesk… Read more.

Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack

Source: Check Point Research
(Published: 11 August 2026)
Check Point Research is tracking a long-running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. Read more.

Kimwolf v7 Botnet Malware

Source: Unit 42
(Published: 11 August 2026)
We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. Read more.

ClickFix Campaign Abuses Deno Runtime for Infostealer Delivery

Source: Sophos
(Published: 11 August 2026)
Counter Threat Unit™ (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism… Read more.