Retaliatory cyber crime is now legal in America, Adobe Commerce is being used to hijack storefronts, the Trivy incident compromised over 2,500 organizations, and some ding dongs flying home from DEFCON thought it would be funny to spin up an Evil Twin on a Delta flight.
Welcome back to another Cyberattack Sunday; Aug 09 - 15, 2026.
Let’s dive in…
Critical Flaws Hit Belgian eID Software Used By 2 Million People
Researchers found critical vulnerabilities in the software behind Belgium’s national electronic ID system, which about 2 million people rely on to prove their identity online.
Source: https://www.securityweek.com/critical-flaws-discovered-in-belgian-eid-software-used-by-2-million-people/
US Sanctions Iranian $6 Billion Crypto “Exchange” Shelbit
The US sanctioned Shelbit, an Iranian cryptocurrency operation it says moved roughly $6 billion, accusing it of helping Iran evade sanctions and launder funds.
Source: https://www.infosecurity-magazine.com/news/us-sanctions-iranian-6bn-crypto/
Levi Strauss Confirms Corporate Data Stolen In Cyberattack
Clothing giant Levi Strauss confirmed that attackers stole corporate data in a recent cyberattack.
Source: https://www.securityweek.com/corporate-data-stolen-in-levi-strauss-cyberattack/
Go-Based macOS Malware Steals Crypto Wallets And Secrets
Researchers detailed a new Go-based macOS infostealer that harvests cryptocurrency wallets, passwords, and other sensitive data from infected Macs.
Source: https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/
Progress LoadMaster Flaw Now Actively Exploited, CISA Warns
CISA urged immediate patching of a critical flaw in Progress LoadMaster load-balancing appliances that is now being actively exploited in attacks.
Sources: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-progress-loadmaster-vulnerability/
https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-progress-loadmaster-flaw-exploited-in-attacks/
“Ghostjacking” Uses Poisoned Logs To Turn AI Agents Against Their Owners
Researchers detailed Ghostjacking, an attack that plants malicious instructions in log files an AI agent reads, abusing the agent’s trusted network access to slip data past firewall controls.
Sources: https://www.infosecurity-magazine.com/news/ghostjacking-ai-gents-access/
https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/
Russian-Linked Hackers Sabotaged A Second Polish Energy Plant Via Private Cellular Network
Investigators revealed that Russian-linked hackers breached the operational-technology network of a small Polish power plant last year by pivoting through a private cellular (APN) connection, part of a pattern of attacks on Polish energy facilities.
Sources: https://www.securityweek.com/novel-private-apn-pivot-let-hackers-sabotage-second-polish-energy-facility/
https://www.bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/
https://thehackernews.com/2026/08/hackers-breach-polish-power-plant.html
https://www.infosecurity-magazine.com/news/attack-polish-power-plant-2025-led/
Fake “Solidity Pro” VS Code Extensions Steal Crypto Wallets And Credentials
Malicious VS Code extensions posing as “Solidity Pro” developer tools steal cryptocurrency wallets, API keys, and login credentials from developers who install them.
Source: https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
One-Click Atlassian Rovo AI Flaw Exposed Enterprise Data
Researchers disclosed RovoBlast, a one-click prompt-injection flaw in Atlassian’s Rovo AI assistant that could be tricked via a malicious URL into leaking a company’s Jira and Confluence data.
Sources: https://www.csoonline.com/article/4207306/one-click-flaw-in-atlassian-rovo-exposed-enterprise-data-via-prompt-injection-attack.html
https://www.infosecurity-magazine.com/news/rovoblast-atlassian-rovo-url/
Metabase Patches Zero-Day Being Exploited For Full Access
Metabase patched a SQL-injection zero-day that attackers were already exploiting to gain total, unauthenticated access to the analytics platform and steal customer data.
Sources: https://www.securityweek.com/metabase-patches-vulnerability-exploited-as-zero-day/
https://www.csoonline.com/article/4208307/metabase-sqli-exploit-grants-attackers-total-access.html
New Jersey And Alabama Join The Wave Of US Water Cyberattacks
New Jersey and Alabama became the latest states hit in the ongoing campaign against water-utility control systems, which officials increasingly link to Iran and which has now touched more than a dozen states.
Sources: https://www.securityweek.com/new-jersey-alabama-join-states-targeted-in-water-cyberattacks/
https://techcrunch.com/2026/08/14/what-we-know-about-the-alleged-iranian-hacks-on-u-s-water-utilities/
Valve Notifies Steam Hardware Customers Of A Data Breach
Valve told customers who bought Steam hardware that their data was exposed in a breach.
Source: https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/
LexisNexis Shuts Down Services After Suspicious Server Activity
Data broker LexisNexis took services offline after detecting suspicious activity on its servers.
Source: https://www.bleepingcomputer.com/news/security/lexisnexis-shuts-down-services-after-suspicious-activity-on-servers/
“The Com” Member Jailed For Blackmail And Sextortion
A member of the loose “The Com” cybercrime network was sentenced to prison for a blackmail and sextortion scheme.
Source: https://www.bleepingcomputer.com/news/security/member-of-the-com-sent-to-prison-for-blackmail-sextortion/
TrueConf Flaws Exploited To Swap Client Installers With PhantomCore Malware
The Head Mare group exploited flaws in TrueConf video-conferencing servers to replace legitimate client installers with ones carrying PhantomCore backdoor malware.
Sources: https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html
(Prior week’s TrueConf breach disclosure is registered; this adds the attacker and malware.)
New Passkey Attacks Can Recover Synced Keys Or Bypass Phishing Protection
Researchers detailed new attacks that can recover synced passkey private keys or bypass the phishing-resistance passkeys are meant to provide, though analysts note real-world exploitability is limited and requires an already-compromised device.
Sources: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html
https://www.securityweek.com/new-attack-methods-enable-malware-to-hijack-passkey-protected-accounts/
https://arstechnica.com/security/2026/08/heres-why-the-new-pass-ta-key-attack-is-mostly-a-nothingburger/
BdThemes WordPress Plugins Poisoned To Create Rogue Admins, No File Changed
A supply-chain attack on BdThemes WordPress plugins poisoned the JSON data they fetch from a remote server, silently creating rogue administrator accounts on sites without altering a single plugin file.
Sources: https://www.infosecurity-magazine.com/news/bdthemes-wordpress-poisoned-api/
https://www.bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/
https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html
SonicWall SMA1000 Flaws Now Exploited By Ransomware Gangs, CISA Warns
CISA warned that ransomware gangs are now exploiting SonicWall SMA1000 VPN appliance flaws to break into networks.
Source: https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/
New StormEncryptor Ransomware Deployed By Ex-Medusa Affiliate
A former Medusa ransomware affiliate is using new ransomware called StormEncryptor, which China-linked attackers are deploying, likely by exploiting the N-able N-central flaw.
Sources: https://www.bleepingcomputer.com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/
https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html
Mozilla Revokes Firefox And Thunderbird Linux Signing Key After Exposure
Mozilla revoked and reissued the GPG signing key used for Firefox and Thunderbird on Linux after the key was exposed, potentially in a public location.
Sources: https://www.securityweek.com/mozilla-issues-new-firefox-gpg-key-following-exposure/
https://thehackernews.com/2026/08/mozilla-revokes-firefox-and-thunderbird.html
US And South Korea Warn Of Gunra Ransomware Exploiting Fortinet And Schneider Flaws
US and South Korean agencies warned that the Gunra ransomware gang is exploiting vulnerabilities in Fortinet and Schneider Electric products to breach government agencies and critical infrastructure.
Sources: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/
https://thehackernews.com/2026/08/gunra-ransomware-exploits-fortinet-and.html
https://www.infosecurity-magazine.com/news/gunra-ransomware-fortinet-flaws/
Logistics Giant Ceva Breach Disrupts Operations And Hits European Clients
Logistics giant Ceva suffered a data breach and operational disruption from a cyberattack that affected its European clients.
Sources: https://www.infosecurity-magazine.com/news/logistics-ceva-data-breach/
https://www.securityweek.com/ceva-logistics-operations-disrupted-by-cyberattack/
Malicious MCP Servers Trick AI Coding Agents Into Leaking Data
Researchers showed that malicious MCP servers can split instructions across responses to manipulate AI coding agents into exfiltrating a developer’s data without triggering safeguards.
Source: https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html
“Plug And Pwn”: Fake USB Devices Grab Full SYSTEM Access On Windows 11
Researchers demonstrated a “Plug and Pwn” attack that abuses Windows 11’s automatic driver installation for USB devices to gain full SYSTEM-level control of a machine just by plugging in a malicious device.
Sources: https://thehackernews.com/2026/08/researchers-turn-usb-auto-install-into.html
https://www.bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/
Banned AI-Chat-Stealing Extension Sneaks Back Into The Chrome Store
An extension previously banned for stealing users’ AI chats returned to the Chrome Web Store and resumed its malicious data collection.
Source: https://www.securityweek.com/extension-banned-for-stealing-ai-chats-returns-to-chrome-store-resumes-malicious-activities/
Suisun City, California Hit By Cyberattack In Wave Of Local-Government Incidents
Suisun City, California responded to a cyber incident amid a broader wave of attacks on US local governments.
Source: https://www.infosecurity-magazine.com/news/suisan-cyber-incident-government/
Zoom Patches Zero-Click Flaws Letting Attackers Hijack Meeting Participants
Zoom patched serious flaws, including a zero-click remote-code-execution bug and screen-sharing and annotation flaws, that could let a meeting participant take over other attendees’ devices during a call.
Sources: https://www.wired.com/story/a-zoom-screen-sharing-bug-let-anyone-take-over-other-devices-on-a-call/
https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/
https://www.csoonline.com/article/4208223/zoom-zero-click-rce-flaws-allow-attackers-to-compromise-meeting-participants.html
https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html
https://arstechnica.com/security/2026/08/researchers-found-a-way-to-hijack-devices-through-zoom-screen-sharing/
FBI: A North Korean Remote IT Worker Landed A Job At A US Government Agency
The FBI said a North Korean operative posing as a remote IT worker successfully got hired by a US government agency, part of the regime’s scheme to fund itself through fraudulent tech employment.
Source: https://techcrunch.com/2026/08/11/north-korean-remote-it-staffer-worked-for-us-government-agency-says-fbi/
Cisco Warns Of High-Severity ClamAV Flaws With Public Exploits
Cisco warned of high-severity vulnerabilities in the widely used ClamAV antivirus engine, with public exploit code already available.
Source: https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/
SharePoint Flaw Now Exploited In Ransomware Attacks
CISA warned that a Microsoft SharePoint flaw, exploited shortly after a proof-of-concept was released, is now being used in ransomware attacks; researchers also disclosed an AI-assisted exploit chain reaching unauthenticated access.
Sources: https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/
https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/
https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
DDoS Attacks Over 1 Tbps Surged Fivefold In One Quarter
Cloudflare reported that enormous DDoS attacks exceeding 1 Tbps surged fivefold in the second quarter, as attackers grow their firepower.
Source: https://www.bleepingcomputer.com/news/security/ddos-attacks-over-1-tbps-surged-fivefold-in-the-second-quarter/
Researchers Built A Fake Crypto Startup And Accidentally Hired North Korean Operatives
Security researchers set up a fake cryptocurrency startup and, in the process of hiring, ended up with three applicants they identified as suspected North Korean IT operatives, illustrating how deeply the scheme has infiltrated tech recruiting.
Source: https://thehackernews.com/2026/08/researchers-built-fake-crypto-startup.html
A Malicious SIM Card Can Run Attacker Code Inside Cellular Modems
Researchers showed that a specially crafted SIM card can execute an attacker’s code inside the baseband modems that power cellular devices, opening a hard-to-detect attack surface.
Source: https://thehackernews.com/2026/08/a-malicious-sim-card-can-run-attacker.html
Cursor Flaw Let Repositories Run Commands Before Trust Verification
A security bug in the Cursor AI code editor let a malicious repository execute commands before the user’s trust check could catch it.
Source: https://www.infosecurity-magazine.com/news/cursor-security-bug-command/
Six npm Packages Hide Their C2 Address In An Ethereum Wallet
Researchers found six malicious npm packages that read their command-and-control server address from an Ethereum blockchain wallet, making the infrastructure harder to block.
Source: https://www.infosecurity-magazine.com/news/npm-packages-ethereum-wallet-c2/
SAP Patches Critical Code-Injection And Memory-Corruption Flaws
SAP released patches for critical vulnerabilities including code injection and memory corruption, led by a maximum-severity SAP Commerce Cloud flaw now under active attack.
Sources: https://www.securityweek.com/sap-patches-critical-code-injection-memory-corruption-vulnerabilities/
https://thehackernews.com/2026/08/sap-commerce-cloud-flaw-could-let.html
https://www.bleepingcomputer.com/news/security/max-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks/
Someone Set Up A Fake Wi-Fi Network On A Delta Flight Full Of DEF CON Attendees
Delta is investigating after someone ran a fake Wi-Fi hotspot and a Wi-Fi “deauth” attack mid-flight on a plane carrying attendees returning from the DEF CON hacking conference, with the DEF CON crowd itself the leading suspect.
Sources: https://techcrunch.com/2026/08/11/delta-investigating-after-someone-set-up-fake-wi-fi-network-mid-flight/
https://www.bleepingcomputer.com/news/security/delta-probes-wi-fi-deauth-attack-on-flight-carrying-def-con-attendees/
https://arstechnica.com/information-technology/2026/08/def-con-crowd-suspected-in-fake-hotspot-attack-on-delta-flight/
Adobe Urges Immediate Patching Of Critical ColdFusion Flaws
Adobe urged customers to immediately patch critical vulnerabilities in ColdFusion and Campaign Classic.
Source: https://www.securityweek.com/adobe-urges-immediate-patching-of-critical-coldfusion-campaign-classic-flaws/
Wesco Confirms Security Incident After ExfilSquad Claims Data Theft
Distribution company Wesco confirmed a security incident after the ExfilSquad group claimed to have stolen its data; researchers later confirmed the group’s access to sensitive data across 13 organizations.
Sources: https://www.bleepingcomputer.com/news/security/wesco-confirms-security-incident-after-exfilsquad-claims-data-theft/
https://www.infosecurity-magazine.com/news/exfilsquads-13-organizations/
FBI Warns Hackers Are Breaking Into Accounts To Steal Intimate Photos
The FBI warned that cybercriminals are hacking into victims’ online accounts specifically to steal their private, explicit photos.
Sources: https://techcrunch.com/2026/08/11/fbi-says-cybercriminals-are-hacking-into-victims-online-accounts-to-steal-their-intimate-pictures/
https://www.bleepingcomputer.com/news/security/fbi-warns-of-hackers-targeting-online-accounts-to-steal-explicit-photos/
Cisco Patches ASA And FTD Firewall Zero-Day Being Exploited To Crash Devices
Cisco patched a zero-day flaw in its ASA and FTD firewall and VPN products that attackers are exploiting to crash the devices in denial-of-service attacks.
Sources: https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/
https://www.securityweek.com/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/
https://thehackernews.com/2026/08/cisco-asa-and-ftd-flaw-exploited-in.html
DeadLock Ransomware Uses Polygon Smart Contracts To Resist Takedown
The DeadLock ransomware gang is using Polygon blockchain smart contracts to host its command infrastructure, making its operation harder for law enforcement to dismantle.
Sources: https://thehackernews.com/2026/08/deadlock-ransomware-uses-polygon-smart.html
https://www.bleepingcomputer.com/news/security/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown/
Sandworm Targets IT Pros With A Trojanized WireGuard VPN And Fake Job Interviews
Russia’s Sandworm group (via sub-cluster UAC-0145) is using fake job interviews to push a trojanized WireGuard VPN client that can run attacker commands on the IT professionals it targets.
Sources: https://thehackernews.com/2026/08/sandworm-linked-uac-0145-uses-fake-job.html
https://www.bleepingcomputer.com/news/security/sandworm-hackers-target-it-pros-with-trojanized-wireguard-vpn-client/
Kimwolf Android Botnet Disguises DDoS Traffic As Normal Browsing
Researchers detailed Kimwolf v7, an Android botnet that makes its HTTP/2 DDoS traffic look like legitimate browser activity to evade detection.
Source: https://thehackernews.com/2026/08/kimwolf-v7-android-botnet-makes-http2.html
Violent Cargo Thefts Surge As Thieves Chase AI Hardware
WIRED reported a sharp, violent rise in cargo thefts targeting valuable AI hardware like GPUs, with some robberies turning physically dangerous.
Source: https://www.wired.com/story/the-worst-ive-ever-seen-cargo-thieves-are-turning-violent-in-pursuit-of-ai-hardware/
Lazarus Exploited A Windows Zero-Day To Hit Defence Firms
North Korea’s Lazarus group exploited a fresh Windows zero-day (ShieldBreak) to gain SYSTEM access and deploy a backdoor against defence firms, in some cases using post-quantum key exchange to deliver the exploit through its “Dream Job” lures.
Sources: https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/
https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/
https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
https://www.infosecurity-magazine.com/news/lazarus-post-quantum-key-dream-job/
https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/
Trivy Supply-Chain Hack Impacts Over 2,500 Organizations
A supply-chain compromise initially blamed on malicious LiteLLM releases was traced to the widely used Trivy security scanner, exposing more than 2,500 organizations.
Sources: https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/
https://www.securityweek.com/trivy-not-litellm-behind-the-2500-org-compromise/
Attackers Exploit VMware vCenter Flaw For Persistent Remote Access
Attackers are exploiting a critical VMware vCenter vulnerability (CVE-2026-59310), just five days after disclosure, to gain persistent remote access via reverse SSH.
Sources: https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
https://www.infosecurity-magazine.com/news/vcenter-cve-2026-59310-exploited/
https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
Fake CCleaner Downloads Turn Chrome Into A Credential-Stealing Spy Tool
Attackers are using fake CCleaner downloads to turn victims’ Chrome browsers into credential-stealing surveillance tools.
Source: https://www.csoonline.com/article/4208565/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool.html
The Government Is Monitoring Anti-Flock Social Media Accounts
The American government is monitoring TikTok and Instagram accounts that criticize the Flock license-plate-reader surveillance network.
Source: https://www.404media.co/the-government-is-monitoring-anti-flock-tiktok-and-instagram-accounts/
“City-Forum” Attacks Steal Data From Salesforce And ServiceNow Portals
A stealthy campaign dubbed “City-Forum” is using a custom toolset to steal data from organizations’ Salesforce and ServiceNow portals.
Sources: https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/
https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/
https://www.csoonline.com/article/4209788/salesforce-servicenow-data-targeted-in-city-forum-attacks/
WindRelay Malware Pairs With SpyNote RAT In Live-Call Scam
Researchers detailed WindRelay, an NFC-relay malware used alongside the SpyNote remote-access trojan in live phone-call scams to steal victims’ payment-card and account data.
Source: https://www.infosecurity-magazine.com/news/windrelay-nfc-relay-spynote-rat/
Android Malware Combo Takes Out Loans And Relays Victims’ Credit Cards
Researchers found an Android malware combination that takes out loans in victims’ names and relays their credit-card data to attackers.
Source: https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
Security Researcher Publishes New Windows Zero-Day After Microsoft’s Legal Threat
After Microsoft reportedly threatened legal action, researcher Nightmare Eclipse published a new Windows zero-day, and separately showed a Defender security patch could be bypassed to seize control of a system.
Sources: https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/
https://www.csoonline.com/article/4208760/researcher-bypasses-microsoft-defender-security-patch-seizing-control.html
737 Chrome VPN Extensions Caught Secretly Routing Your Traffic Through Proxies
Researchers found 737 Chrome VPN extensions quietly routing users’ web traffic through proxy servers, turning tools people install for privacy into potential surveillance and abuse infrastructure.
Sources: https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html
https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy/
Uber Freight Investigating After Hacking Group Claims Data Breach
Uber Freight is reportedly investigating after a hacking group claimed to have breached its data.
Source: https://techcrunch.com/2026/08/12/uber-freight-reportedly-investigating-after-hacking-group-claims-data-breach/
Hackers Exploit Critical Adobe Commerce Flaw To Hijack Customer Accounts
Attackers are exploiting a critical Adobe Commerce (Magento) vulnerability, almost immediately after disclosure, to hijack customer accounts on online stores.
Sources: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/
https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/
Terabytes Of Credentials Leaked In Massive Supply-Chain Attack
A massive supply-chain attack leaked terabytes of stolen credentials, underscoring the scale of harvested login data now circulating.
Source: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/
CBP Workers Allegedly Used Government Databases To Spy On Exes And Crushes
WIRED reported that US Customs and Border Protection employees allegedly misused government databases to spy on ex-partners, romantic interests, and colleagues.
Source: https://www.wired.com/story/cbp-workers-allegedly-used-government-databases-to-spy-on-exes-crushes-and-colleagues/
UK Watchdog Reprimands Criminal Records Office Over 2023 Breach
The UK’s ICO formally reprimanded the ACRO criminal records office over a 2023 data breach.
Source: https://www.infosecurity-magazine.com/news/ico-reprimands-acro-records-office/
Akira Ransomware Reboots Into Safe Mode To Kill EDR — Then Botches Its Own Attack
An Akira ransomware affiliate rebooted victim machines into Windows Safe Mode to disable endpoint protection, but the trick backfired: it stole data yet failed to encrypt anything, crashing its own attack.
Sources: https://www.infosecurity-magazine.com/news/akira-affiliate-crashes-ransomware/
https://www.itsecurityguru.org/2026/08/13/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack/
https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/
https://www.csoonline.com/article/4209606/akira-ransomware-reboots-into-windows-safe-mode-to-knock-edr-offline/
Trump Authorizes Private Companies To Carry Out Offensive Cyberattacks
President Trump signed a memorandum letting the White House mobilize private security firms to conduct offensive “hack-back” operations against foreign cybercrime gangs, a first for US policy that raises legal and escalation concerns.
Sources: https://www.securityweek.com/white-house-mobilizes-security-firms-for-operations-against-foreign-cybercrime-gangs/
https://www.infosecurity-magazine.com/news/trump-private-offensive-cyber/
https://www.csoonline.com/article/4209169/trump-administration-opens-door-to-private-sector-cyber-offensives.html
https://www.bleepingcomputer.com/news/security/white-house-taps-security-firms-for-offensive-hack-back-operations/
https://techcrunch.com/2026/08/13/in-a-first-us-will-allow-some-private-firms-to-carry-out-cyberattacks/
https://arstechnica.com/security/2026/08/white-house-recruits-security-firms-to-hack-overseas-cybercriminals/
https://www.itsecurityguru.org/2026/08/14/trump-signs-memorandum-allowing-private-firms-to-launch-offensive-cyber-operations-against-foreign-threat-actors/
AI Agents Waged A Near-Autonomous Cyberattack On Asian Government Networks
Researchers documented a near-autonomous cyberattack in which AI agents carried out most of the intrusion against Asian government networks with minimal human direction.
Source: https://www.csoonline.com/article/4209210/ai-agents-wage-near-autonomous-cyberattack-on-asian-government-networks.html
Scammers Abuse Shopify’s Own Notification System In “Fake Refund” Scam
Scammers are exploiting Shopify’s legitimate notification system to send convincing fake refund messages that trick shoppers into handing over money or data.
Source: https://www.itsecurityguru.org/2026/08/13/scammers-exploit-shopifys-own-notification-system-in-new-fake-refund-scam/
WhatsApp Rolls Out A Feature That Flags Potential Scam Messages
WhatsApp launched a new safety feature that warns users about messages likely to be scams.
Sources: https://www.bleepingcomputer.com/news/security/whatsapp-rolls-out-new-feature-that-flags-potential-scam-messages/
https://www.securityweek.com/whatsapp-unveils-new-scam-alert-feature/
Exposed AWS Key Behind Breach Affecting 1,500-Plus UK Charities
An exposed AWS access key led to a breach at CRM provider Beacon that affected more than 1,500 UK charities, including healthcare and victim-support organizations.
Sources: https://www.infosecurity-magazine.com/news/exposed-aws-key-data-charities/
https://www.securityweek.com/over-1000-charities-hit-by-beacon-crm-data-breach/
https://www.infosecurity-magazine.com/news/healthcare-victim-charities-beacon/
Trezor Breach At Fulfillment Vendor ShipMonk Hits Nearly 14,000 Customers
Hardware-wallet maker Trezor disclosed a data breach affecting nearly 14,000 customers, traced to its fulfillment provider ShipMonk.
Sources: https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/
https://www.securityweek.com/14000-trezor-customers-impacted-by-data-breach-at-shipmonk/
Hackers Breach Government Webmail While Running A Parallel Crypto Scam
Attackers breached a government webmail system while simultaneously running a cryptocurrency fraud operation from the same campaign.
Source: https://www.bleepingcomputer.com/news/security/hackers-breach-govt-webmail-while-running-parallel-crypto-fraud/
GeoServer Zero-Day Under Active Exploitation
Attackers are exploiting an unpatched zero-day in the widely used GeoServer geospatial data platform.
Sources: https://www.csoonline.com/article/4209388/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver.html
https://www.securityweek.com/hackers-exploiting-unpatched-geoserver-zero-day/
Ukraine Shuts Down 94 Fraudulent Call Centres And Seizes Millions
Ukrainian authorities dismantled 94 fraudulent call centres and seized millions in cash in a major crackdown on scam operations.
Source: https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash/
Apple Sends New Threat Notifications Over Mercenary Spyware Attacks
Apple sent a fresh round of “Threat Notification” alerts warning specific users they were targeted by mercenary spyware, and urged recipients to take the warnings seriously.
Sources: https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/
https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/
Researchers Link Chinese APT “Jewelbug” To Hack-For-Hire Operations
Researchers tied a Chinese advanced-threat group called Jewelbug to commercial hack-for-hire operations.
Source: https://www.infosecurity-magazine.com/news/researchers-link-chinese-apt-hack/
AmnesiaStealer macOS Malware Spreads Via ClickFix
A new macOS infostealer called AmnesiaStealer, spread through ClickFix lures, steals data and hijacks victims’ browser sessions.
Sources: https://www.infosecurity-magazine.com/news/macos-infostealer-spread-clickfix/
https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/
Data Analyst Jailed For Stealing Company Data And Extorting Employer
A data analyst was sentenced to prison for stealing his employer’s data and using it to extort the company.
Source: https://www.bleepingcomputer.com/news/security/data-analyst-sent-to-prison-for-stealing-data-extorting-employer/
RingCentral Breach Exposed Info Of 1.6 Million Accounts
Communications company RingCentral disclosed a data breach that likely exposed the information of about 1.6 million accounts.
Sources: https://www.bleepingcomputer.com/news/security/ringcentral-data-breach-exposed-info-of-16-million-accounts/
https://www.securityweek.com/1-6-million-likely-impacted-by-ringcentral-data-breach/
New Mirai-Based “Evooo1Bot” Botnet Turns Routers Into Proxies
A new Mirai-derived Linux botnet called Evooo1Bot is hijacking routers and other devices, turning victims into traffic-relay nodes for attackers.
Sources: https://www.infosecurity-magazine.com/news/new-linux-botnet-evooo1bot-victims/
https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/
Shell Investigates Potential Incident After Clop Data-Theft Claims
Energy giant Shell is investigating a “potential incident” after the Clop ransomware gang claimed to have stolen its data, part of Clop’s broader data-theft extortion wave.
Source: https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/
Hackers Arrested Over €30 Million Bank Fraud Exploiting A Provider Flaw
Authorities arrested suspects behind a €30 million (about $33 million USD) bank fraud scheme that exploited a flaw in a service provider’s systems.
Source: https://www.bleepingcomputer.com/news/security/hackers-arrested-over-30m-bank-fraud-exploiting-service-provider-flaw/
macOS Screen Sharing Flaw Under Active Attack To Deploy Crypto Miner
Attackers are actively exploiting a macOS Screen Sharing vulnerability that gives full control of Macs, using it to deploy a Monero cryptocurrency miner.
Sources: https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/
https://arstechnica.com/security/2026/08/vulnerability-giving-attackers-full-control-of-macs-is-under-active-exploitation/
A Coin-Sized Device Can Hack A Boeing 737
Researchers demonstrated a coin-sized device capable of interfering with systems on a Boeing 737, raising aviation-security concerns.
Source: https://www.wired.com/story/this-coin-sized-device-can-hack-a-boeing-737/
Signal Adds A Feature To Thwart Man-In-The-Middle Attacks
Signal rolled out a new security feature designed to detect and prevent man-in-the-middle attacks on encrypted conversations.
Source: https://www.bleepingcomputer.com/news/security/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks/
AI API Flaw Let Weaker Models Decode Stronger Models’ Protected Outputs
Researchers found a flaw across OpenAI, Anthropic, and Google APIs that could let a weaker AI model decode the protected outputs of a stronger one, undermining a safeguard meant to keep advanced model responses confidential.
Source: https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html
Congrats on making it all the way to the end. Did any of these incidents surprise you?
Did any show up in your feed this week?
Let me know in the comments!