Ransomware: qilin named GOP (GB)
1. Executive summary On 24 July 2026, the Qilin ransomware group listed "GOP" (www.gopltd.com, GB) as a victim on its leak site.
25 Jul 2026 · 4 min read
read →
// author
Jeff Davies
Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
1. Executive summary Since at least June 2026, threat actors have compromised Wi-Fi gateway devices at hotels and conference centres, modifying DNS settings to redirect
24 Jul 2026 · 6 min read
read →
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
1. Executive summary A sandbox escape vulnerability in Anthropic's Claude Code (CVE-2026-55607) allows an attacker to achieve unsandboxed code execution on a
24 Jul 2026 · 6 min read
read →
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
1. Executive summary A North Korean threat cluster attributed as BlueNoroff (MITRE G0082) is operating an active, operator-driven phishing kit that impersonates Zoom and Microsoft
24 Jul 2026 · 6 min read
read →
Default Azure Automation Setting Enables Cross-Tenant Identity Takeover
1. Executive summary Microsoft has remediated a public-by-default configuration flaw in Azure Automation that, combined with a chain of code-level vulnerabilities, could have
24 Jul 2026 · 4 min read
read →
Clop gang targets Windchill, FlexPLM in data theft attacks
1. Executive summary The Clop ransomware gang (also tracked as Cl0p) is actively exploiting CVE-2026-12569, a critical vulnerability (CVSS 9.3) in PTC Windchill
24 Jul 2026 · 5 min read
read →
Year-long Russian attacks infect users as soon as they look at an email
1. Executive summary A Russia-linked threat actor tracked as Laundry Bear (aka Void Blizzard) has been conducting a year-long espionage campaign — ongoing since July
23 Jul 2026 · 7 min read
read →
UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations
1. Executive summary On 23 July 2026, the UK NCSC and international partners publicly attributed a "zero-click" phishing campaign targeting Western organisations to
23 Jul 2026 · 3 min read
read →
Russian Global Webmail Espionage
1. Executive summary Unit 42 has published details of a persistent cyberespionage campaign (tracked as CL-STA-1114) actively targeting unpatched Zimbra Collaboration Suite (ZCS) webmail
23 Jul 2026 · 5 min read
read →
TAG-195 Upgrades MaaS Ecosystem with Modular Tools
1. Executive summary Recorded Future's Insikt Group published research identifying four new malware families — TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator — developed by
23 Jul 2026 · 7 min read
read →
How attackers hosted a fake Claude download page on the claude.ai domain
1. Executive summary A threat actor abused Anthropic's Claude Artifacts feature to host a fake Claude desktop-app download page on the legitimate claude.
23 Jul 2026 · 5 min read
read →
Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
1. Executive summary Cisco Talos has published analysis of msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware-as-a-service (RaaS)
23 Jul 2026 · 8 min read
read →