Coverage: Last 24 hours

Today’s Highlights

This cycle features active exploitation of critical authentication bypass vulnerabilities, supply chain risk through novel abuse of CI/CD infrastructure, and privacy implications of new identity recovery flows. Ransomware actors and espionage groups continue to evolve their tactics, targeting everything from email platforms to AI-enabled endpoints. Key themes are rapid patch mandates for auth bypass, attacker use of trusted infrastructure, CI/CD and supply chain abuse, AI agent security, and an expanding focus beyond Windows to email and Linux platforms.

Table of Contents

1. Data Breach Confirmed After Australian Energy Giant Origin Is Hacked
2. Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
3. Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
4. Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
5. China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
6. How Synthetic Identity Fraud is Coming for Machine Identities
7. Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
8. Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts
9. Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
10. Critical Check Point SmartConsole Authentication Bypass (CVE‑2026‑16232) Actively Exploited; Federal Agencies Ordered to Patch

Top Stories

Data Breach Confirmed After Australian Energy Giant Origin Is Hacked

Source: SecurityWeek | Risk: Critical | Impacted: Australian energy sector, Origin Energy customer base, Service provider partners, Regulated critical infrastructure operators

Summary: A hacker claims to have stolen the information of 2 million Origin Energy customers and is threatening to leak it. The post Data Breach Confirmed After Australian Energy Giant Origin Is Hacked appeared first on SecurityWeek.

Why it matters: A major breach affecting millions amplifies customer risk and will likely result in regulatory scrutiny, legal impact, and follow-on phishing or fraud attempts targeting affected user populations.

Practitioner Perspective

The confirmed attack on Origin Energy demonstrates persistent interest from attackers in critical infrastructure, and the mass exposure of customer information creates complex fallout. Utility providers must not only respond technically, but also coordinate communications and regulatory notifications while planning for waves of fraud. Consider that attackers may leverage stolen data against both clients and supply chain partners. Monitor for internal pivoting and potential use of compromised records to stage further attacks. The breach highlights the need for comprehensive incident response spanning technology, legal, and communications domains.

Recommended Actions

• Notify affected Origin Energy customers of potential data exposure and recommended mitigation steps
• Deploy anti-phishing controls and monitor for fraud campaigns leveraging leaked customer info

Emerging Signals

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks

Source: The Hacker News | Risk: High | Impacted: Windows workstations, Notepad++ user populations, IT and engineering staff

Summary: The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that’s dressed up as a Notepad++ plugin to compromise Windows systems. The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously observed weaponizing security flaws in

Why it matters: Delivery of malware disguised as trusted software updates can allow adversaries to escalate privileges or maintain persistence on Windows endpoints with minimal user suspicion.

Practitioner Perspective

Organizations relying on Notepad++ or similar widely used software should validate plugin provenance, as high-trust expectations lower the user’s detection threshold for social engineering. This campaign leverages a fake Notepad++ plugin to deploy MATCHBOIL.V2, linked to Russia-aligned UAC-0099, echoing techniques observed in past IT supply chain intrusions. Defenders should be alert to the perennial effectiveness of masquerading malware as software extensions, particularly in environments without enforced code signing or security tooling monitoring plugin DLLs. Consider that small IDE/editor extension ecosystems remain a neglected entry point for serious adversaries. Prioritize proactive baselining of authorized Notepad++ plugins across endpoints involved in code, admin, or sensitive business workflows.

Recommended Actions

• Inventory all Notepad++ installations and enumerate loaded plugins for anomalies tied to untrusted sources
• Deploy application allowlisting to block unauthorized DLLs/plugins in Notepad++ directories

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Source: The Hacker News | Risk: High | Impacted: Windows endpoints with Chrome or Edge, Organizations at risk for ransomware attacks, Environments with remote browser automation

Summary: The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and

Why it matters: By forcing C2 traffic through trusted, local browser processes, attackers reduce the chance of detection by EDR and network tools that focus on direct outbound connections from new or abnormal binaries.

Practitioner Perspective

Chaos ransomware is using msaRAT, which proxies traffic through a victim’s own Chrome or Edge browsers in headless mode. This complicates detection, processes may look like normal browser automation. Just as ‘living off the land’ tools blurred the lines for defenders, browser-abusing implants provide a stealthy pivot for ransomware and intruders. Security teams not monitoring for rare browser invocations risk missing early-stage compromise. Treat unusual headless browser activity on endpoints as a leading indicator of intrusions involving modern malware loaders.

Recommended Actions

• Set up monitoring for headless Chrome and Edge process executions not linked to authorized automation scripts
• Hunt for msaRAT artifacts in memory and on disk within recent incident response windows

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

Source: The Hacker News | Risk: High | Impacted: Government IT teams, Healthcare IT operations, Education sector with cloud assets, Alibaba Cloud tenants

Summary: An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the server in mid-April 2026 in Alibaba Cloud’s Singapore region; it was offline by the time the report

Why it matters: Attackers exploiting cloud misconfiguration and deploying new loaders can result in stealthy persistent access to government and health sector infrastructure, complicating remediation.

Practitioner Perspective

JadeProx, attributed to a China-linked actor, used a novel TriBack Loader delivered via exposed Alibaba Cloud infrastructure, tailored for sectors like government, healthcare, and education. Misconfigurations in cloud environments remain low-hanging fruit for attackers to host or pivot attack infrastructure. Defenders in regulated or high-profile verticals should prioritize external threat intelligence, as toolkit innovation signals ongoing R&D by well-resourced adversaries. Double-check that your attack surface management for cloud instances is resilient to unexpected exposures and credentials can’t be reused across affected services.

Recommended Actions

• Audit Alibaba Cloud server exposures for access from unidentified entities during mid-April 2026
• Hunt for TriBack Loader binaries or traffic on endpoints connected to government, health, or education networks

How Synthetic Identity Fraud is Coming for Machine Identities

Source: The Hacker News | Risk: Medium | Impacted: Digital onboarding platforms, API consumers and service operators, Web applications with automated signup flows

Summary: Most people understand identity theft as an attacker stealing a real person’s sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn’t exist. Since no real victim monitors misuse, a

Why it matters: Synthetic identities blending real and fake data are challenging to detect and may be exploited to manipulate digital trust boundaries for both human and machine accounts.

Practitioner Perspective

Fraud models are moving beyond stolen identities to automated creation of plausible machine or service accounts that pass basic validation. Organizations relying on weak signals for digital identity verification, especially in customer-facing or API-driven environments, are increasingly vulnerable. Unless advanced behavioral or anomaly-based controls are in place, attackers can automate account creation and use resulting cost or reputational harm as leverage. Security teams need to re-examine trust in internal machine identities and APIs. Spending significant resources on human identity monitoring now risks missing the next wave targeting business logic and automation controls.

Recommended Actions

• Deploy synthetic identity detection tools on onboarding and API access flows
• Monitor for abnormal velocity patterns in machine or service account registrations

Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Source: The Hacker News | Risk: High | Impacted: Organizations using GitHub Actions, cPanel and WHM administrators, Developers relying on Packagist PHP packages

Summary: Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances. The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13,

Why it matters: Compromised CI/CD runners and malicious package updates can enable attackers to jump from development environments to production servers, undermining trust in automation pipelines.

Practitioner Perspective

Attackers are abusing GitHub Actions runners tied to legitimate repos and injecting malicious packages into Packagist, targeting cPanel and WHM servers downstream. This supply chain pivot lets an adversary transform CI/CD infrastructure into a distributed attack platform, increasing lateral and vertical movement. Security teams running or consuming open-source PHP packages, or relying on external code for automation, should elevate review posture over any package or repo with recent, unexplained ownership or code changes. Consider automation pipelines and build agents as privileged assets requiring tight ingress controls. The riskiest assumption: that DevOps infrastructure isn’t a primary attack target.

Recommended Actions

• Manually review GitHub Actions runner access for all repos referencing dinushchathurya or the 10 impacted Packagist packages
• Scan cPanel and WHM servers for indicators of unauthorized automation or installation activity between July 12 and 13, 2026

Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts

Source: The Hacker News | Risk: Medium | Impacted: Google account holders, Organizations with Google Workspace, Helpdesk and IT support teams

Summary: Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log in to an account, including an email address or a phone number. The idea is to use a video selfie

Why it matters: The introduction of video-based account recovery introduces a new social engineering and deepfake authentication risk vector that security teams must address before attackers exploit user trust.

Practitioner Perspective

Google’s adoption of selfie video for account recovery will likely reduce helpdesk load but simultaneously opens a target for attackers seeking to bypass identity verification using AI-powered impersonation. Security and support personnel may need new playbooks to respond to fraud reports related to video-based resets, especially as generative media becomes trivial to create. The security implications extend to employee account management in Google Workspace deployments. Begin threat modeling for multimedia authentication abuse, even if organizational policy disables or restricts its use. User education and rapid review/rollback controls become more critical as traditional account recovery vectors erode.

Recommended Actions

• Update account recovery runbooks to include video-based verification monitoring and escalation procedures
• Configure Google Workspace console to restrict or audit account recovery method selections where feasible

Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

Source: The Hacker News | Risk: High | Impacted: Red Hat Enterprise Linux installations, Fedora Server deployments, Amazon Linux environments, Multi-user Linux systems with XFS

Summary: RefluXFS, a Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation. The company demonstrated the race against

Why it matters: Local privilege escalation on default Red Hat, Fedora, and Amazon Linux configurations increases risk of persistent attacker activity and undermines least privilege access assumptions for multi-tenant workloads.

Practitioner Perspective

The RefluXFS bug (CVE-2026-64600) is one of the rare local vulnerabilities that impacts default installs of several major Linux distributions, letting any local user gain root by overwriting root-owned files on XFS filesystems. This is especially dangerous in cloud-hosted, containerized, or shared environments where privilege boundaries are essential. Attackers who land on a box, via any vector, can rapidly escalate and set up long-term persistence or tamper with monitoring. If your operational model relies on OS-level security rather than full hypervisor isolation, prioritize patching and post-exploitation hunting. Assess inherited AMIs or gold images for exposure.

Recommended Actions

• Prioritize patching for CVE-2026-64600 on all RHEL, Fedora Server, and Amazon Linux hosts using XFS
• Scan for anomalies in permissions and recent file modifications in /etc and other root-owned paths

Exploits & CVEs

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

Source: The Hacker News | Risk: Critical | Impacted: Zimbra administrators, Email administrators, Organizations with on-prem or cloud Zimbra deployments

Summary: A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra’s webmail client. The payload goes after the last 90 days of email, the organization’s entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The NSA, CISA and partner agencies

Why it matters: Mass mailbox and 2FA code theft exposes sensitive business communications and may undermine enterprise authentication security across compromised Zimbra environments.

Practitioner Perspective

Zimbra webmail instances should be considered at high risk if unpatched in the relevant timeframe, as this Russian espionage campaign allowed full access to contents, credentials, and recovery data. The attack technique is dangerous: opening a boobytrapped email sufficed to compromise an entire mailbox and facilitate lateral movement, credential harvesting, and onward 2FA bypass. The ongoing targeting of mail platforms demonstrates state-level focus on persistent visibility inside adversary organizations. After response, review account recovery workflows and asset visibility for email-centric attacks. Prep for broad post-compromise investigation and potentially required password and 2FA resets.

Recommended Actions

• Apply the latest Zimbra patches addressing the June-July 2026 zero-day exploitation window
• Analyze Zimbra webmail logs for abnormal access and signs of mass exfiltration between March and July 2026

Critical Check Point SmartConsole Authentication Bypass (CVE‑2026‑16232) Actively Exploited; Federal Agencies Ordered to Patch

Source: reddit / pwnhub (reporting CISA BOD) | Risk: Critical | Impacted: Check Point management server operators, Organizations with SmartConsole endpoints, Government and compliance-bound enterprises

Summary: CVE‑2026‑16232, an authentication bypass in Check Point SmartConsole, is being actively exploited. CISA has issued a Binding Operational Directive ordering U.S. federal agencies to patch by July 25, 2026.

Why it matters: Unauthorized access to management servers is possible, making it urgent for defenders to patch and block this adversary control vector.

Practitioner Perspective

CVE-2026-16232, affecting Check Point SmartConsole, is under active exploitation and exposes management servers to unauthenticated attacker control. Given CISA’s Binding Operational Directive and the nature of authentication bypass, any exposed management interface should be assumed compromised until proven otherwise. This elevates organizational risk from configuration tampering to full network compromise. The attack path is direct and leaves little forensic trace if proper logging isn’t enabled. The deadline for patching is non-negotiable: treat this as a recovery scenario even if initial exploit attempts aren’t observed.

Recommended Actions

• Apply Check Point patch for CVE‑2026‑16232 to all SmartConsole installations immediately, ahead of July 25, 2026 deadline
• Audit SmartConsole server access logs for signs of unauthenticated or anomalous administrative actions

Defensive Actions

• Scan and patch Check Point SmartConsole (CVE-2026-16232) on all affected systems before compliance deadlines
• Hunt for Zimbra webmail compromise, credential theft, and 2FA exposure; analyze webmail logs for suspicious activity
• Audit GitHub Actions runners and Packagist dependencies for unauthorized access or code; revoke exposed tokens where found
• Reassess privilege escalation risk and patch for CVE-2026-64600 in default RHEL, Fedora Server, and Amazon Linux builds
• Monitor for exploitation of browser-based C2 and deployment of fake plugins on endpoints
• Review and restrict new video-based account recovery features in Google Workspace; update playbooks for deepfake abuse
• Deploy synthetic identity detection and behavioral monitoring on API and onboarding flows
• Inventory IDE/editor extensions such as Notepad++ for unauthorized plugins; baseline allowed configurations
• Engage regulatory and legal teams swiftly following public data breach confirmations
• Coordinate with sector ISACs and external partners for intelligence and mitigation of attacks exploiting cloud misconfigurations

What We’re Watching

Defenders should remain vigilant for ransomware actors leveraging new implantation and lateral movement techniques, supply chain attacks on automation and CI/CD infrastructure, and evolving identity recovery vectors. AI agents and assistance platforms are quickly becoming part of attacker toolchains, security teams must evolve monitoring and privilege boundaries across everything from endpoints to SaaS integrations.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: authentication, cybersecurity, daily briefing, Incident Response, Supply Chain, Vulnerabilities