AI-Powered Attacks Rise, Critical Vulnerabilities Explored in Daily Brief

Financial Services Sector Faces Double the Cyberattacks of Other Industries, SonicWall Reports

SonicWall Report Reveals Financial Sector Overwhelmed by Attacks Targeting Legacy Flaws like Log4Shell and Heartbleed

According to a new report from SonicWall, the financial services industry is being targeted by cyberattacks at a rate more than double the average of all other sectors combined. The 2026 Financial Services Protect Brief highlights that attackers are deliberately exploiting unpatched legacy infrastructure, with millions of attacks leveraging old but still-effective vulnerabilities like Log4Shell, Heartbleed, and a Telnet server flaw. Ransomware groups such as REvil and Prometheus are also actively targeting the sector, which averaged nearly 40,000 malware hits per firewall.

July 8, 2026

5 min read

Financial ServicesSonicWallLegacy SystemsLog4ShellHeartbleed +2 more

Financial Services Sector Faces Double the Cyberattacks of Other Industries, SonicWall Reports

Icelandic Firm Investigates Unprecedented AI-Assisted Cyberattack in Europe

HIGH

Syndis Probes Highly Complex Cyberattack Likely Developed with AI Assistance

Icelandic cybersecurity company Syndis is investigating a highly sophisticated cyberattack against a European client that shows strong indications of being developed with the aid of a large AI model. The attack weaponized a moderately severe vulnerability (CVSS 7.5) in a uniquely intricate manner, creating a level of persistence and redundancy rarely seen. This incident may signal a new frontier in cyber warfare, where AI is used to overcome exploit complexities and craft advanced attack methodologies that were previously the domain of elite human experts.

July 8, 2026

5 min read

AIArtificial IntelligenceSyndisCyberattackThreat Intelligence +1 more

Icelandic Firm Investigates Unprecedented AI-Assisted Cyberattack in Europe

China Issues 'Backdoor' Security Alert for Anthropic's Claude Code AI Tool

HIGH

China's National Vulnerability Database Alleges Backdoor in Anthropic's Claude Code, Warns of Data Exfiltration

A cybersecurity platform operated by China's industry ministry has issued a serious security alert for Anthropic's AI coding tool, Claude Code. The China National Vulnerability Database (NVDB) alleges that versions 2.1.91 through 2.1.196 of the tool contain a 'backdoor' that can transmit sensitive user data, including geographic location and identity identifiers, to remote servers without consent. The agency has urged Chinese organizations to uninstall or upgrade the affected versions and enhance network monitoring to prevent data leakage.

July 8, 2026

4 min read

ChinaAnthropicClaude CodeAIData Privacy +2 more

China Issues 'Backdoor' Security Alert for Anthropic's Claude Code AI Tool

Critical Gitea Docker Flaw Actively Exploited for Unauthorized Access

CRITICAL

Actively Exploited Gitea Docker Flaw (CVE-2026-20896) Allows Full Admin Takeover

A critical authentication bypass vulnerability, CVE-2026-20896, is being actively exploited in Gitea Docker images. The flaw, rated 9.8 on the CVSS scale, stems from an insecure default configuration that allows a remote, unauthenticated attacker to impersonate any user, including administrators, by spoofing HTTP headers. This grants full, unauthorized access to the Gitea instance. The Cyber Security Agency of Singapore (CSA) has confirmed active exploitation and urges administrators to update to patched versions immediately.

July 8, 2026

5 min read

GiteaCVE-2026-20896VulnerabilityAuthentication BypassDocker +2 more

Critical Gitea Docker Flaw Actively Exploited for Unauthorized Access

Threat Actor UAT-7810 Expands Arsenal with New Backdoors: LONGLEASH, DOGLEASH, and JARLEASH

HIGH

Cisco Talos: UAT-7810 Evolves ORB Network with New Custom Malware for MIPS, ARM, and x64 Devices

According to new research from Cisco Talos, the threat actor UAT-7810 is actively developing and deploying new custom malware to expand its operational relay box (ORB) networks. The group has created 'LONGLEASH,' a new version of its 'SHORTLEASH' backdoor, and has introduced two entirely new backdoors: 'DOGLEASH' (C-based) and 'JARLEASH' (Java-based). These tools target a variety of hardware platforms (MIPS, ARM, x64) and are hosted on newly identified VPS infrastructure, indicating a persistent and evolving threat focused on compromising networking devices for covert operations.

July 8, 2026

5 min read

UAT-7810Cisco TalosMalwareBackdoorLONGLEASH +3 more

Threat Actor UAT-7810 Expands Arsenal with New Backdoors: LONGLEASH, DOGLEASH, and JARLEASH

Attackers Use Fake Microsoft Teams IT Support Calls to Push EtherRAT Malware

HIGH

Live Social Engineering Campaign Uses Microsoft Teams Voice Calls to Deploy EtherRAT Malware

A live social engineering campaign is targeting corporate users by impersonating IT support staff over Microsoft Teams voice calls. According to Unit 42, attackers initiate contact with a phishing email and follow up with a voice call from an external Teams tenant. They socially engineer the victim into installing a supposed remote management tool, which is bundled with a Node.js loader that deploys the EtherRAT malware. This tactic provides attackers with initial access to the corporate network and affects any organization using Microsoft 365 that allows external Teams communication.

July 8, 2026

5 min read

Social EngineeringVishingMicrosoft TeamsEtherRATMalware +2 more

Attackers Use Fake Microsoft Teams IT Support Calls to Push EtherRAT Malware

BeyondTrust Patches Critical Flaws in Remote Support and Privileged Access Tools

CRITICAL

BeyondTrust Urges Immediate Patching for Critical Authentication Bypass Flaws (CVE-2026-40138, CVE-2026-40139)

BeyondTrust has released urgent security patches for two critical authentication bypass vulnerabilities, CVE-2026-40138 and CVE-2026-40139, affecting its Remote Support and Privileged Remote Access platforms. The flaws could allow an unauthenticated remote attacker to gain privileged access to the management appliances. Given that these platforms are high-value targets for ransomware actors and the exploit probability is rated as extremely high, administrators are strongly advised to apply the updates immediately or implement network-level mitigations.

July 8, 2026

4 min read

BeyondTrustVulnerabilityAuthentication BypassCVE-2026-40138CVE-2026-40139 +2 more

BeyondTrust Patches Critical Flaws in Remote Support and Privileged Access Tools

Malicious AI Skills Proliferate, Capable of Data Theft and Malware Execution

HIGH

ESET Report: Thousands of Malicious AI Skills Found Abusing AI Agents for Data Theft and Code Execution

The ecosystem of AI agents is becoming a new battleground, with security researchers from ESET discovering over 3,000 malicious and 25,000 suspicious AI 'skills' in a recent scan. According to ESET's H1 2026 Threat Report, these weaponized skills can abuse AI agents to perform a range of malicious actions, including data theft, malware execution, code injection, and credential harvesting. The report also highlights PromptSpy, the first Android malware to use a generative AI model (Google's Gemini) to interpret the device's screen and maintain its own persistence.

July 8, 2026

5 min read

AIMalicious SkillsESETPromptSpyAndroid +2 more

Malicious AI Skills Proliferate, Capable of Data Theft and Malware Execution

Vidar Stealer Campaign Uses Fake Code Signing, Go Loaders, and File Inflation to Evade Detection

HIGH

Unit 42 Uncovers Vidar Stealer Campaign Using Novel Evasion Techniques, Including Go-Based Loaders and DLL Sideloading

In a financially motivated campaign identified in April 2026, attackers are distributing the Vidar information stealer and the XMRig cryptocurrency miner to a global audience, with a focus on the U.S. and European Union. The operation leverages a complex set of evasion techniques, starting with malvertising that lures victims with cracked software. The malware is delivered via a loader-as-a-service framework known as Factory-v3, which utilizes Go-based loaders. Key evasion tactics include the abuse of code signing with a fabricated certificate impersonating a legitimate company, DLL sideloading via a fake MpClient.dll to hijack Windows Defender, and extreme file inflation (up to 491 MB) to defeat sandboxes. The core Vidar payload also employs an in-memory AMSI bypass to disable endpoint security features, showcasing a sophisticated, multi-layered approach to compromise.

July 8, 2026

10 min read

VidarXMRigMalvertisingDLL SideloadingAMSI Bypass +6 more

Vidar Stealer Campaign Uses Fake Code Signing, Go Loaders, and File Inflation to Evade Detection

AI-Powered Attacks Rise, Critical Vulnerabilities Explored in Daily Brief