The RedHook Android malware now abuses Wireless ADB to obtain shell (UID 2000) privileges, expanding its control over infected devices. The change lets the malware operate without a computer connection and increases the risk of screen streaming, keystroke interception, and credential theft. It first abuses Accessibility permissions to enable Developer Options and Wireless Debugging, then pairs over 127.0.0.1 to reach the ADB service. The latest release also adds 53 server-issued commands and multiple persistence mechanisms to keep running.

The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on Windows, macOS, and Linux. The package executes without any import or CLI call, so a routine dependency install is enough to trigger theft. The payload targets cloud credentials, browser sessions, wallets, password-manager data, and AI-tool API keys. The release was later replaced by a clean 8.15.0, but any system that already installed 8.14.0 may have exposed secrets.

The Balochistan Police suffered a compromise of servers, network appliances, and a complaints portal, putting police operations and citizen data at risk. The affected environment included systems handling criminal records and biometric records, along with complaint-tracking workflows. The compromise window spanned June 2, 2024 to April 9, 2026, indicating a long-lived foothold. The attacker also extended access into the Complaint Management System, broadening exposure beyond the initially affected assets.

The ACSC issued remediation guidance for CMS operators under active exploitation pressure, telling administrators to install the latest security updates for themes and plugins to reduce webshell deployment risk. The advisory also calls for removing unused components and enabling automatic updates where possible. These steps target exposed sites that can otherwise be used for persistence, credential theft, and deeper network compromise.

The WP-SHELLSTORM campaign exposed its own infrastructure, revealing a webshell access brokerage that targeted WordPress and Joomla sites at scale and backdoored thousands of sites. The exposed files contained webshells, exploit scripts, scan results, command history, and target lists naming more than 1.4 million websites. The operation relied on automated scanning of public flaws such as CVE-2026-3844 to plant backdoors for later resale. Separate files show an earlier phase that harvested cloud credentials and other secrets from corporate Java systems before the large-scale webshell push.

Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The payload hides inside docs/images/build-spec.png instead of plain text, so text-only reviewers miss the instruction while a later coding agent follows it. In one end-to-end run, the agent turned repository secrets into a 311-integer constant that decoded back to the full secret file. The result exposes a structural blind spot in pull-request automation where review tooling, not the model alone, determines whether exfiltration succeeds.

Zimbra fixed a critical stored XSS flaw in the Classic Web Client that could let a specially crafted email run malicious code in a user's session. The weakness could expose mailbox information, session data, or account settings, creating account-compromise risk. Zimbra says customers should upgrade to Zimbra Collaboration Suite 10.1.19 to reduce exposure.

Upstream fixes were accepted for six U-Boot flaws in the FIT signature verification code, advancing the security patch process for a bootloader component used during firmware startup. The issues include paths to arbitrary code execution and denial of service, which can undermine boot-time trust and enable stealthy firmware compromise. Downstream firmware updates are still needed before customers are protected, and some older unsupported devices may never receive a patch.

Karen Serobovich Vardanyan pleaded guilty in a U.S. Ryuk ransomware case after extradition from Kyiv, deepening his exposure in a cybercrime prosecution tied to attacks on multiple organizations. He was previously indicted in February 2024 and had been arrested in Kyiv in April 2025 before being brought to the United States. The case links him to ransomware deployments against a Michigan company, a technology company in Oregon, and a school in Texas. He now faces sentencing in September 2026 and potential restitution tied to the ransomware proceeds.

The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions are used. The tainted release came from a compromised Injective Labs SDK GitHub repository and was published to npm on July 8, 2026. It also spread through 17 additional @injectivelabs packages that pinned the same version, expanding risk to transitive users. The package sent captured wallet derivation material to testnet.archival.chain.grpc-web.injective[.]network, making the release a direct supply-chain theft event.

ShareFile Storage Zone Controller customers lost access when Progress Software temporarily disabled affected accounts and marked them not operational while investigating a credible external security threat. The disruption affects the Windows servers that run the controllers, not standard cloud-only ShareFile accounts. Customers were told to keep the controllers offline, so the service remains constrained until the threat is understood.

Progress Software has told ShareFile customers using Storage Zone Controllers to shut down their servers immediately after detecting a credible external security threat. The instruction affects on-premises Windows servers that bridge the cloud service and customer-managed storage. Progress says it has no indication of unauthorized access to ShareFile accounts or data, but it has temporarily disabled access for affected customers while it investigates.

U-Boot has six newly disclosed flaws in its FIT signature-checking and image-parsing path, putting routers, smart cameras, and data-center server management chips at risk of boot-time crash or code execution. Two of the flaws can let a malicious image run attacker code before signature verification, while four can crash the bootloader. Binarly published proof-of-concept images and reproduction steps, and no real-world exploitation has been reported. Upstream fixes were merged in June, but downstream firmware updates are still needed.

Federal prosecutors charged Rossen G. Iossifov in the Eastern District of Kentucky over a money laundering case involving $290,000 in seized cryptocurrency, pushing a cybercrime prosecution tied to stolen fraud proceeds back into court.

The newly analyzed GigaWiper backdoor combines espionage and destructive wiping functions, giving operators a single implant that can control, sabotage, and erase infected systems. Microsoft said the tool also includes fake ransomware behavior and multiple destructive commands, expanding the impact of a single compromise. The finding raises concern because the malware unifies capabilities that are usually spread across separate tools. The result is a more flexible platform for covert access and system destruction.

Microsoft's July 9 analysis of GigaWiper shows a modular backdoor that merges espionage, C2, and destructive wiping into one implant, widening the damage a single payload can cause. The research concluded the tool was assembled by combining and reimplementing components from Crucio ransomware, FlockWiper, and a third unrecovered framework. The findings provide reusable technical context for spotting similar multi-function malware and understanding how its destructive commands are organized.

A Tangem crypto wallet card vulnerability lets a precisely timed laser pulse reset the card's password, creating a path for a thief with the physical card to take control of the wallet. The flaw sits in the Samsung S3D232A chip recovery logic and affects every card sold because Tangem cards cannot take software updates. The research was disclosed to Tangem on February 10, 2026 and remains unpatchable.

OpenClaw maintainers shipped version 2026.6.6 to fix three security flaws that could enable credential theft, privilege escalation, and arbitrary code execution on the host. Two of the issues are command-injection bugs and the third is a path traversal/link-following flaw. The release reduces risk for deployments where lower-trust input can reach the affected paths.

OpenClaw now has three patched high-severity vulnerabilities that can lead to credential theft, privilege escalation, and arbitrary code execution on the host. The set includes two command-injection flaws and one path traversal/link-following bug, with fixes in version 2026.6.6. A researcher said the issues can be triggered from an external WhatsApp message when lower-trust input reaches the affected paths.

Researchers demonstrated a proof-of-concept exploit that can force remote code execution in Anthropic’s Claude Code and OpenAI’s Codex, exposing a trust-boundary flaw in AI coding agents. The attack uses multi-stage prompt injection inside an untrusted repository to make attacker text look like normal task context. In auto-mode/auto-review, the agents can be pushed to run a supposed security.sh workflow that actually launches hidden code. The result is silent execution on a victim machine during a defensive scan.

The Silver Fox ecosystem has been tied to MODBEACON, a Rust-based remote access trojan that gives operators encrypted C2 and modular control over infected hosts. The malware is being pushed through counterfeit installers and bogus ZIP archives seeded by SEO poisoning, broadening exposure across technology, education, and state-owned enterprises. The design supports plugin loading, scheduled-task persistence, and follow-on payload expansion, raising the risk of stealthy long-term compromise. The C2 transport reuses Xray/V2Ray-style components and runs through Amazon and Cloudflare CDN infrastructure.

Silver Fox is running a counterfeit-installer SEO-poisoning campaign that delivers malware across Asia and puts technology, education, and state-owned enterprise users at renewed risk. The operation uses bogus installer downloads and repeated search poisoning to drive infections. It shows sustained distribution activity rather than a one-off lure.

GodDamn ransomware, part of the Hyadina family, has evolved into a Windows intrusion chain that uses AnyDesk, credential theft, and the PoisonX kernel driver to disable endpoint defenses before encrypting files. Public reporting places the latest variant in May 2026 and ties it to an early June 2026 intrusion in which operators used PsExec for lateral movement and repeated the deployment across at least 10 hosts. The activity shows a reusable ransomware workflow that reduces detection, expands access, and ends with file encryption and ransom notes.

Suspected China- and India-aligned threat actors ran a Feb 2024–Apr 2026 cyberespionage campaign against Pakistani law enforcement, with Balochistan Police and other agencies exposed to intrusions tied to biometric records, criminal case files, personnel records, and public-service systems. The activity was split across PlugX, ShadowPad, Cobalt Strike, and Remcos RAT clusters, and it included fake portal updates and a fake 360Safe.exe loader on the Complaint Management System (CMS).

XQUIC's XRING flaw leaves HTTP/3 servers exposed to remote crashes through valid QPACK traffic, with no patch available. The bug needs no login and no malformed packets, and FoxIO says about 260 bytes of ordinary traffic can take the server process down. Any server embedding XQUIC and serving HTTP/3 with default QPACK settings is exposed, including embedders such as Tengine.

Zimbra's Classic Web Client stored cross-site scripting (XSS) flaw was patched in Zimbra 10.1.19, closing a path that could expose session data, account settings, and mailbox information. The issue is triggered by specially crafted emails opened in the Classic UI and had no CVE ID yet at release time. Zimbra told customers using the Classic Web Client to upgrade as soon as possible.

Zimbra released ZCS v10.1.19 to patch a stored XSS flaw in the Classic Web Client, narrowing exposure for users of that interface. The bug could be triggered through specially crafted emails and could expose session data, account settings, or mailbox information if opened. Zimbra told customers to upgrade as soon as possible because the issue affects only Classic Web Client users and had no CVE ID yet.

The SNOWLIGHT dropper was used to install VShell, giving operators covert remote access on compromised hosts and hiding the backdoor as [kworker/0:2] in process lists. The chain combines delivery and stealth, making post-compromise control harder to spot. It represents a focused malware activity thread centered on persistence and concealment.

Pink is a The Com-linked extortion brand associated with O-UNC-066 that is now being used in a voice-based phishing campaign against Microsoft 365 users. The activity sends targets to a panel-controlled phishing kit that mimics Entra passkey enrollment and captures credentials and MFA responses so the attacker can register an unauthorized passkey and gain account access. Okta says the campaign has targeted food and beverage, technology, healthcare, automotive, construction, and aviation organizations, and the brand is linked to a data leak site operating since April 2026 under the name Pink.

Coinspect disclosed Ill Bloom, a weak-randomness recovery-phrase flaw in crypto wallet software that is actively exploited and can let attackers derive wallet addresses and drain funds. The issue is concentrated in older or lesser-known mobile wallets, while hardware devices and most mainstream software wallets are not affected. A confirmed May 27 sweep drained about $3.1 million from 431 wallets.