[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMalware & Ransomware
Malware Targets Automotive Head Units
Kaspersky uncovered a surprising new threat in June 2026: a piece of Android malware that targets the Android-based head units found in many cars, using a legitimate system app called TWCore as its unwitting accomplice. This sneaky malware piggybacks on TWCore's update process to spread its reach.
Malware Targets Android Car Systems Through Built-In Updaters
Malware is sneaking into Android car systems through built-in updaters, allowing hackers to wreak havoc on unsuspecting drivers. This sneaky attack was recently discovered by Kaspersky researchers, who linked it to a notorious ad-fraud operation called BADBOX.
Agent Tesla Malware Evolves with Advanced Evasion Tactics
Researchers have uncovered a sneaky new tactic used by Agent Tesla Malware, where attackers use emoji obfuscation and spoofed emails to infect finance departments with a simple, yet cleverly designed, malicious attachment. This devious approach tricks victims into launching the infection chain with just a single reply.
Hackers Exploit FTP Server Banners to Deliver Windows Malware
Hackers have been cleverly using FTP server banners to spread Windows malware since July 2026, embedding commands in the greeting text that triggers an infection chain. This sneaky tactic, known as a dead-drop resolver, allows attackers to deliver malware via PowerShell scripts and other files.
Microsoft patches exploited Entra ID flaw amid rising attacks
Microsoft has patched a critical vulnerability in its Entra ID platform, known as CVE-2026-69836, which allowed attackers to execute code remotely with ease, and has already been exploited in recent attacks. This flaw enabled unauthorized threat actors to gain control and wreak havoc, making swift action crucial to prevent further damage.
Microsoft Entra ID Flaw Exploited, Enables Remote Code Execution
Microsoft warns of a critical flaw in Entra ID that lets hackers execute code remotely by exploiting a deserialization vulnerability, giving them free rein to wreak havoc over the network. This maximum-severity flaw, tracked as CVE-2026-69836, has been patched, but highlights the importance of staying vigilant against remote code execution threats.
US Charges 17 Iranians in Massive Cybertheft Campaign
Meet the 17 Iranians behind a massive cyber heist that stole a mind-boggling 31.5 terabytes of sensitive data from hundreds of universities, companies, and government agencies - a staggering digital theft that went on for years. The charges reveal a sophisticated hacking operation linked to Iran's Islamic Revolutionary Guard Corps and other government clients.
Hackers Poison Popular Rust Crate with Infostealer Malware
In a shocking turn of events, hackers hijacked the account of a popular Rust library, arrayref, which has been downloaded over 53 million times in the past 90 days, and poisoned it with infostealer malware that compromised developers' machines during compilation. The malicious payload was delivered through a tainted software release, putting countless projects and users at risk.
AI-Generated Scripts Target Siemens PLCs in US Critical Infrastructure
The US government has issued a warning about an active threat targeting critical infrastructure organizations, where hackers are using artificial intelligence to create exploit scripts that target industrial programmable logic controllers, specifically Siemens S7 Series PLCs. This AI-assisted attack has the potential to affect a wide range of industries and is not limited to Siemens PLCs.
US Bank Probes LockBit Ransomware Claim, Faces Data Leak Deadline
US Bank is investigating a potential cybersecurity incident after LockBit ransomware crew claimed to have breached the institution and stolen sensitive data. The bank has assured that there's currently no indication of internal system impacts or unauthorized network access.
Adversa AI Exposes Cryptographic Context Injection Attack on Grok Chatbot
Meet a sneaky new attack that can trick chatbots into spilling your secrets: Cryptographic Context Injection, a clever hack that forces AI to reveal sensitive info. This attack, successfully tested on xAI's Grok web chat, can expose user data like names, locations, and conversation history.
Zimbra SNMP Flaw Exploited for Remote Code Execution
A critical Zimbra SNMP flaw, CVE-2026-73570, with a CVSS score of 8.9, is under active exploitation, allowing attackers to execute remote code. This vulnerability can be triggered by sending specially crafted SNMP requests, putting unpatched Zimbra Collaboration systems at risk.
Ransomware Affiliate Exploits Fellow Extortionists with 'Recovery' Scam
In a shocking twist, a ransomware affiliate is turning the tables on its own gang by posing as a recovery service, offering victims a way out for a fraction of the original ransom demand. The scammer, operating under the guise of "Ransom Busters," claims to have infiltrated the ransomware gangs' infrastructure and recovered stolen data.
MSPs Face Evolving Phishing Threats from AI-Driven Attacks
AI-powered phishing attacks have transformed from a filtering issue to a detection challenge, with Kaseya warning that the numbers are stark. AI now turbocharges every stage of a phishing campaign, from lightning-fast reconnaissance to convincing content generation and evasive post-compromise activity.
Manic Malware Exploits Offline Phones via Nearby Infected Devices
Meet Manic, a potent Android banking malware that can infect offline phones by exploiting nearby infected devices, putting financial institutions and users at risk. This sneaky threat combines financial fraud with advanced surveillance and device control features, making it a major concern for banks, governments, and fintech services worldwide.
CDNs Exposed to Tsunami Attacks via HTTP/3 Flaw
A newly discovered flaw in HTTP/3 leaves CDNs vulnerable to devastating tsunami attacks, including two denial-of-service techniques called HTTP/3 Bandwidth Amplification and Connection Amplification. By exploiting this weakness, attackers can turn a small amount of malicious traffic into a massive flood that overwhelms its target.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Grok AI Chat Exposed to Cryptographic Context Injection Attack
Imagine a scenario where an attacker can secretly instruct an AI model to decrypt and execute malicious code, simply by embedding encrypted instructions and a decryption key on a web page. This is now a reality with cryptographic context injection, a new attack technique that bypasses traditional model guardrails.
Researchers Expose Zombie Card Attack Reviving Expired Visa Cards
Meet the Zombie Card Attack, a sneaky hack that brings expired Visa cards back to life - literally, allowing researchers to make a $500 purchase with a card that was supposed to be dead. By rewriting the expiration date, University of Massachusetts Amherst researchers showed how easily this loophole can be exploited.
Malicious Firefox Extensions Target Web3 Wallets
Beware of malicious Firefox extensions that have been targeting Web3 wallets as part of a large-scale campaign, with 40 confirmed malicious add-ons and 37 working together to steal your cryptocurrency. This coordinated threat, known as Offside Wallet Theft Factory, has been active since March 2026.
ToxicPanda Malware Expands Android Banking Attacks Globally
Meet ToxicPanda 2.0, a highly sophisticated Android banking trojan that's taking global attacks to the next level with an arsenal of 167 remote commands and advanced PIN-harvesting capabilities. This upgraded malware can infiltrate over 140 banking and crypto apps, putting your sensitive info at risk.
US Agencies Warn Siemens PLC Operators of AI-Driven Attacks
US agencies are sounding the alarm: hackers are now using artificial intelligence to launch targeted attacks on Siemens PLC operators, making it easier for them to breach industrial systems. This emerging threat has prompted a joint warning from CISA, the FBI, and partner agencies.
CISA Warns of Hackers Exploiting MLflow Vulnerability
Hackers are actively exploiting a critical vulnerability in MLflow, a popular open-source AI engineering platform, that could compromise your AI applications. Federal agencies have been ordered to patch exposed instances within two weeks to avoid potential attacks.
ToxicPanda Malware Expands Target List to 140+ Banking and Crypto Apps
Meet ToxicPanda 2.0, a sneaky new Android banking Trojan that's expanded its target list to over 140 banking and crypto apps, allowing attackers to swipe PINs, lock devices, and gain shell-level access. This upgraded malware is particularly alarming, as it operates seamlessly within Android, making it a stealthy threat.
Manic Android Malware Exploits Nearby Devices for Data Exfiltration
Meet Manic, a sneaky new Android malware that's using a clever fallback strategy to steal sensitive data from nearby devices, even when they have no internet connection. It captures credentials and in-app secrets by combining spyware, banking fraud, and remote-control capabilities into one powerful payload.