Medtronic Data Breach Impacts 3.8 Million People - SecurityWeek
Medical technology company Medtronic reported a data breach involving the ShinyHunters extortion group that compromised the personal and medical information of over 3.8 million individuals. The company is providing affected people with credit monitoring and identity theft restoration services to address the incident.
Fake Google and Cloudflare Verification Pages Spread StealC, HijackLoader, and NetSupport Malware
Threat actors are leveraging ClickFix social engineering campaigns that mimic Google and Cloudflare verification pages to trick users into executing malicious PowerShell commands. These attacks facilitate the deployment of various malware families, including StealC, HijackLoader, and NetSupport RAT, by bypassing traditional security controls.
Alibaba Reportedly Bans Claude Code Over Alleged Backdoor Risk in AI Coding Tool
Alibaba is reportedly banning Anthropic’s Claude Code due to allegations that the AI coding tool contains a hidden mechanism for environmental fingerprinting and data tracking. While Anthropic claims the feature is an anti-abuse control to prevent unauthorized model distillation, the potential security risk remains a subject of intense scrutiny.
JADEPUFFER: First End-to-End AI-Driven Ransomware Operation
JADEPUFFER is the first documented ransomware operation entirely driven by an AI agent, which autonomously exploited vulnerabilities, harvested credentials, and encrypted data without human intervention. The attack demonstrates how large language models can now execute complex, multi-stage extortion campaigns by chaining together known security flaws.
New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild | CSO Online
A CitrixBleed-like memory overread vulnerability (CVE-2026-8451) in NetScaler appliances is currently being exploited in the wild, prompting Citrix to release urgent security patches. Organizations are advised to upgrade their NetScaler ADC and Gateway appliances immediately to mitigate this high-severity threat.
Chinese LLMs Broaden the Gap Between Attackers & Defenders
The emergence of new, high-performing Chinese LLMs such as GLM 5.2 and Tulongfeng has prompted concerns among experts regarding the widening gap between offensive AI-driven vulnerability discovery and corporate defensive capabilities. Experts emphasize that organizations must urgently address security debt and prioritize robust integration over model origin to effectively secure their digital architecture.
New PamStealer Malware Targets macOS Users via Fake Maccy Clipboard App
The PamStealer malware is an infostealer disguised as a fake Maccy clipboard application that compromises macOS devices by stealing passwords, browser data, and clipboard content. This malicious software utilizes an AppleScript infection chain and a Rust payload to exfiltrate sensitive information while masquerading as a legitimate system component.
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
The threat actor Armored Likho is targeting government agencies and the power sector using the BusySnake Stealer to facilitate cyber espionage. The group employs spear-phishing and Windows shortcut vulnerabilities to deploy modular malware designed to bypass security analysis and exfiltrate sensitive data.
Adobe premieres a second Patch Tuesday each month to deliver fixes faster | CSO Online
To address the increasing frequency of software vulnerabilities in the era of frontier AI, Adobe is doubling its patch cycle by issuing security updates on both the second and fourth Tuesday of every month. This change, effective July 14, aims to deliver critical fixes faster and maintain security against evolving cyber threats.
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit
The ARToken PhaaS platform functions as an affiliate of the EvilTokens toolkit, enabling attackers to execute Microsoft 365 account takeovers through device code phishing. This service automates business email compromise and grants unauthorized access to Outlook, SharePoint, and OneDrive by exploiting OAuth 2.0 authentication workflows.
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors linked to North Korea are distributing malicious npm packages that masquerade as Rollup polyfill tools to steal developer secrets and facilitate remote access. These packages employ a layered, multi-stage structure to evade detection and exfiltrate sensitive credentials and cloud keys from developer workstations.
FBI Disrupts Widely Used NetNut Residential Proxy Service
The FBI and global partners recently disrupted NetNut, a massive residential proxy network that hijacked over 2 million home devices to mask cybercriminal activity. This operation effectively degraded the infrastructure used by attackers to route malicious traffic and facilitate various cybercrime campaigns.
Breach Roundup: DeepSeek Sparks Browser Ransomware
A new browser-only ransomware technique generated by the DeepSeek large language model can encrypt local files using browser APIs without requiring malware installation. This incident highlights ongoing cybersecurity threats, alongside reports of AI-driven pen testing trust issues and targeted espionage campaigns against Indian organizations.
How Hackers Just Dumped Apple’s Tightly Guarded iPhone 18 Pro Secrets on the Dark Web
The iPhone 18 Pro secrets were exposed on the dark web after a cybersecurity breach at Tata Electronics, a manufacturing partner for Apple. The World Leaks ransomware group released over 200,000 files, including photos and component lists, prior to the device’s scheduled September 2026 launch.
Micron CEO: Customers driving hard bargain on price contributed to memory shortage
Micron CEO Sanjay Mehrotra attributes the current memory chip shortage to years of aggressive pricing demands from customers that left the industry underinvested before the AI-driven demand surge. This supply constraint is expected to persist beyond 2027 due to the complexity of manufacturing and the long lead times required for building new semiconductor fabrication plants.
London Hydro providing credit monitor in wake of data breach | London Free Press
Following a data breach that exposed personal customer information, London Hydro is providing affected individuals with free credit monitoring services through Equifax. Although an unauthorized party accessed account details, the utility confirmed that sensitive financial information remained secure.
Texas Parks Data Breach Exposes Information of 3M+ Customers
A cybersecurity incident involving a third-party vendor for the Texas Parks and Wildlife Department has potentially exposed the personal information of over 3 million hunting and fishing license customers. While unauthorized access to data such as driver license and passport numbers occurred, the agency confirmed that sensitive items like Social Security numbers and financial details remain secure.
New EvilTokens Attack Exposes Browser Visibility Gap in Enterprise SOCs
The EvilTokens attack utilizes encrypted payloads that remain hidden until browser execution, exposing a visibility gap that complicates threat detection for enterprise SOCs. By leveraging in-browser data investigation, security teams can reveal these obfuscated phishing flows and respond more effectively to potential account takeover attempts.
Meituan has released LongCat-2.0, a massive 1.6-trillion-parameter open-source AI model designed for agentic workflows and advanced reasoning. The company developed this model using domestic Chinese chips and compute clusters to circumvent hardware export restrictions.
Nissan employee data exposed in Oracle PeopleSoft zero-day attacks | IT Pro
Nissan employee personal and financial data was exposed following a zero-day vulnerability exploit within the Oracle PeopleSoft software. The company has since secured its systems and is working with experts to address the data breach linked to the ShinyHunters threat group.
Nissan employee data exposed in Oracle PeopleSoft zero-day attacks | IT Pro
Nissan employee personal and financial data was exposed following a zero-day vulnerability exploit within the Oracle PeopleSoft software. The company has since secured its systems and is working with experts to address the data breach linked to the ShinyHunters threat group.
Anthropic’s Claude Code Reportedly Uses Hidden Code to Detect Chinese Users
The Claude Code CLI tool allegedly contains undisclosed detection logic that uses steganography to identify and flag Chinese users to Anthropic’s servers. This covert surveillance mechanism, discovered through reverse-engineering, has triggered a significant debate regarding developer trust and user privacy.
Microsoft adds smarter bot protection to Teams meetings
Microsoft has introduced a new Teams admin policy that allows organizers to detect and restrict third-party bots by requiring manual approval before they can join meetings. This security feature ensures greater visibility and control over automated participants to prevent potential threats and malicious access.
WhatsApp Usernames Will Let You Chat Without Sharing Your Phone Number
WhatsApp is introducing usernames to allow users to connect without revealing their phone numbers, enhancing privacy for new conversations. Users can now reserve these handles in the app settings ahead of the official launch later in 2026.
SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks
SystemBC is a versatile Windows malware that transforms compromised hosts into SOCKS5 proxies to facilitate ransomware attacks and maintain stealthy remote access. By routing malicious traffic through victim machines, this malware conceals attacker origins and enables lateral movement across enterprise networks.