Data Breaches, Critical Patches, and New Malware Emerge in Cybersecurity Landscape

This daily summary highlights significant cybersecurity developments, including an update on the Unlimited Technology Systems data breach, which now impacts 3.8 million individuals. The breach, detected in October 2025, saw notification letters sent in July 2026, with the company clarifying that full medical and financial records were not compromised. New inferred attack techniques include phishing and cloud data exfiltration.

In critical updates, Microsoft and Apple have released patches for severe vulnerabilities, including several with CVSS 10.0 scores affecting Azure, Microsoft Teams, and macOS Screen Sharing. Google also addressed numerous flaws in Chrome 151. Organizations are strongly advised to apply these patches immediately.

New threats include the SilentRansomGroup claiming an attack on law firm Mayer Brown, though the claim is currently unsubstantiated. Hackers are also trojanizing TrueConf installers with the PhantomCore backdoor by exploiting two vulnerabilities. A sophisticated AI vishing campaign is targeting Wall Street firms, using AI voice cloning to impersonate IT staff and steal credentials for Microsoft 365 and Okta via adversary-in-the-middle (AitM) phishing sites.

Cryptocurrency users face a dual threat: a phishing campaign targeting Trezor hardware wallet users via sponsored ads and an actively exploited vulnerability in BTCPay Server. A Windows Hello for Business flaw has been disclosed, allowing malware to gain persistent access to Microsoft Entra ID accounts without user interaction. Additionally, a widespread AitM phishing campaign is targeting hundreds of organizations to compromise Microsoft 365 accounts, with attackers focusing on payroll and finance data.

Finally, researchers have detailed two new malware families: 'KansasGroup' ransomware, which encrypts files and drops a ransom note, and 'CNBackdoor,' a stealthy, multi-stage malware designed for long-term persistence by disabling security controls.