Chinese Actors Weaponized Claude Code in Multi-Nation Espionage Op
July 16, 2026
Hunt.io exposed a Chinese state-linked espionage operation that used Claude Code and DeepSeek as direct attack tools, breaching systems in
Threat Actors
Chinese Actors Weaponized Claude Code in Multi-Nation Espionage Op
Hunt.io exposed a Chinese state-linked espionage operation that used Claude Code and DeepSeek as direct attack tools, breaching systems in four countries.
Unit 42 Exposes TuxBot v3 Iranian-Linked IoT Botnet With DDoS-for-Hire
Palo Alto Networks Unit 42 exposed TuxBot v3, an Iranian-linked IoT botnet targeting 17 CPU architectures with DDoS-for-hire capabilities and AI-generated code.
DOJ Charges Three Russians Behind LockBit, Play Hosting Network
The DOJ unsealed charges against three Russians who ran Media Land and ML.Cloud, bulletproof hosting that served LockBit, Blacksuit, and Play ransomware.
Nine-Nation Advisory Flags FSB Center 16 Router Attacks
Cybersecurity agencies from nine countries issued a joint advisory on FSB Center 16 router attacks targeting energy, healthcare, and defense sectors globally.
Australia’s ASD Warns of Active Campaign Exploiting 17 CMS CVEs
Australia's Signals Directorate warned of an active global campaign scanning for 17 known CVEs across WordPress, Joomla, and other public-facing CMS platforms.
SCMBANKER Targets Mexican Banking With AI-Written PowerShell
Elastic Security Labs found REF6045 deploying SCMBANKER, an AI-written PowerShell toolkit that lets operators control Mexican banking sessions live and hijack transfers.
DigitalMint Employee Sentenced for BlackCat Ransomware Conspiracy
A former DigitalMint employee received 70 months in prison for conspiring with BlackCat ransomware operators while posing as a trusted victim recovery advisor.
Threat Actors Use Aged GitHub Accounts to Map Corporate Orgs
Datadog Security Labs found threat actors using aged GitHub accounts to map corporate organization members and repositories before launching targeted attacks.
Helix Group Uses Vishing and Device Code Flow to Steal SharePoint Data
New threat group Helix chains vishing with Microsoft's OAuth Device Code Flow to harvest M365 tokens and exfiltrate SharePoint data for corporate extortion.
OpenMandriva Linux Contributor Attempted Code Sabotage After Dispute
OpenMandriva Linux caught a contributor sabotage attempt before production, disclosing the insider supply chain attack after an internal community dispute.
Unit 42 Exposes TuxBot v3 Iranian-Linked IoT Botnet With DDoS-for-Hire
July 16, 2026
Palo Alto Networks Unit 42 exposed TuxBot v3, an Iranian-linked IoT botnet targeting 17 CPU architectures with DDoS-for-hire capabilities and
DOJ Charges Three Russians Behind LockBit, Play Hosting Network
July 15, 2026
The DOJ unsealed charges against three Russians who ran Media Land and ML.Cloud, bulletproof hosting that served LockBit, Blacksuit, and
Nine-Nation Advisory Flags FSB Center 16 Router Attacks
July 13, 2026
Cybersecurity agencies from nine countries issued a joint advisory on FSB Center 16 router attacks targeting energy, healthcare, and defense
Australia’s ASD Warns of Active Campaign Exploiting 17 CMS CVEs
July 13, 2026
Australia’s Signals Directorate warned of an active global campaign scanning for 17 known CVEs across WordPress, Joomla, and other public-facing
SCMBANKER Targets Mexican Banking With AI-Written PowerShell
July 10, 2026
Elastic Security Labs found REF6045 deploying SCMBANKER, an AI-written PowerShell toolkit that lets operators control Mexican banking sessions live and
DigitalMint Employee Sentenced for BlackCat Ransomware Conspiracy
July 10, 2026
A former DigitalMint employee received 70 months in prison for conspiring with BlackCat ransomware operators while posing as a trusted
Threat Actors Use Aged GitHub Accounts to Map Corporate Orgs
July 10, 2026
Datadog Security Labs found threat actors using aged GitHub accounts to map corporate organization members and repositories before launching targeted
Helix Group Uses Vishing and Device Code Flow to Steal SharePoint Data
July 10, 2026
New threat group Helix chains vishing with Microsoft’s OAuth Device Code Flow to harvest M365 tokens and exfiltrate SharePoint data
OpenMandriva Linux Contributor Attempted Code Sabotage After Dispute
July 10, 2026
OpenMandriva Linux caught a contributor sabotage attempt before production, disclosing the insider supply chain attack after an internal community dispute.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.