Bank of Baroda hit by cyberattack; hacker leaks 1TB of data on dark web
A hacking group known as TripleX has reportedly leaked 1TB of Bank of Baroda customer data and internal documents on the dark web. While the bank has yet to officially confirm the cyberattack, it has launched an internal probe to verify the claims regarding the exposed Aadhaar details and sensitive banking information.
Angelina Jolie among celebrities to have contact details ‘leaked’
Contact details of celebrities including Angelina Jolie and Robert de Niro were exposed in a data breach involving Tribeca Film Festival databases. The breach reportedly affected around 666,000 records from 2019 to 2026.
Source: ctrlaltintel.com/research/… (Ctrl-Alt-Intel, 24 Jul 2026)
The Gentlemen ransomware-as-a-service operation rose rapidly in 2026, claiming nearly 500 victims by June and ranking second only to Qilin. The group originated as ArmCorp, a successful Qilin affiliate led by the handle hastalamuerte (also zeta88). After financial disputes with Qilin in mid-2025, the operators rebranded, first appearing publicly via a September 2025 forum advertisement that offered affiliates a 90 % revenue share and minimal infrastructure.
Persistent OPSEC failures—reused monikers, a long-lived residential Russian IP (92.39.211.142 in Izhevsk), Google Maps activity spanning 2017–2025, Rocket.Chat leaks, and forum breach data—allowed researchers to map the suspected leader’s infrastructure and travel across Russia, Dubai, China, Vietnam, and Thailand. Public reporting (including by Brian Krebs) later linked the persona to Alexander Andreevich Yapaev. The research highlights how relatively basic operational mistakes continue to expose even high-volume RaaS operators.
Source: www.microsoft.com/en-us/sec… (Microsoft Security Blog, 23 Jul 2026)
Q2 2026 email threats were dominated by the lingering effects of Microsoft’s March disruption of the Tycoon2FA phishing-as-a-service platform. Phishing volume linked to Tycoon2FA fell 92 % from pre-disruption baselines; both QR-code and CAPTCHA-gated campaigns that previously relied on the service declined sharply and no comparable replacement service emerged at scale. Overall, Microsoft detected ~7.6 billion email-based phishing threats in the quarter (declining modestly from 2.7 B in April to 2.4 B in June). Credential phishing remained the overwhelming payload objective (94–96 %), while traditional malware delivery stayed in the low single digits.
Threat actors continued shifting into Microsoft Teams, with weekly malicious vishing call attempts reaching nearly 10× the mid-2025 baseline by quarter-end. Notable high-velocity campaigns included an automated BEC operation that hit >67 000 users across 42 000 organizations in under three hours and a multi-stage phishing chain that nested EML files inside calendar invitations before abusing a Microsoft authentication redirect. The data illustrate both the measurable impact of infrastructure disruption and the continued migration of social-engineering activity into trusted workplace collaboration tools.
Source: www.bleepingcomputer.com/news/secu… (BleepingComputer, 26 Jul 2026)
GitHub and PyPI have deployed simple time-based controls to shrink the window in which newly published malicious packages can be automatically adopted. Dependabot now applies a default 72-hour cooldown before opening update PRs for new package versions, giving security scanners and maintainers time to detect and remove malicious releases. Users can shorten or lengthen the delay via configuration. Separately, PyPI now rejects any new files uploaded to a release that is more than 14 days old, closing a potential “release-poisoning” path in which an attacker with a stolen token could quietly add malware to an already-trusted version.
These measures follow a string of high-profile incidents (chalk/debug, s1ngularity, Shai-Hulud, GhostAction). GitHub notes the cooldown is not a complete defense against longer-term compromises and continues to recommend lockfiles, least-privilege tokens, and disabling unnecessary install scripts. PyPI observed that legitimate late uploads after 14 days are rare, so the restriction imposes minimal friction while blocking a dangerous technique that has not yet been widely exploited on the platform.
Source: blog.gitguardian.com/shai-hulu… (GitGuardian, 22 Jul 2026)
Between early June and 14 July 2026, four distinct supply-chain campaigns targeted npm and PyPI, all converging on the same objective: harvesting credentials from developer environments and CI pipelines. The Miasma worm continued spreading on npm (reaching packages such as the Vapi server SDK) while a PyPI variant branded “Hades” used *.pth startup files to deploy the same self-propagating credential stealer. Concurrently, JFrog uncovered IronWorm, a Rust-based infostealer planted in 36 npm packages that leveraged an eBPF rootkit and stolen publishing tokens. Two later campaigns used typosquatted payment SDKs (PaySafe, Skrill, Neteller) to silently exfiltrate CI secrets, and a stolen npm token that poisoned multiple versions of the popular jscrambler package and its plugins.
The most damaging incident compromised AsyncAPI’s own CI via a long-known pull_request_target workflow flaw. Attackers stole a high-privilege bot token, published four packages (combined >2.25 million weekly downloads) that carried valid Sigstore/SLSA provenance because the legitimate pipeline itself signed the malware. Payloads across the campaigns targeted cloud keys, GitHub/npm tokens, AI coding assistant credentials, crypto wallets, and browser data, underscoring that ecosystem-level protections (install-script defaults, provenance) still cannot detect a compromised identity.
Security researchers have discovered that malicious custom maps for the indie game Meccha Chameleon are using Steam Workshop to drop malware onto players' PCs. To stay safe, users should avoid downloading suspicious maps and run an antivirus scan if they have recently installed custom content.
Rogers, Quebecor and Hollywood Studios Win Piracy Site-Blocking Order
The Canadian Federal Court has issued a two-year site-blocking order requiring major internet service providers to restrict access to 13 identified piracy streaming platforms. To combat the rapid creation of new pirate domains, the ruling establishes a simplified procedure that allows rights holders to update the blocklist more efficiently.
Telecom Decision CRTC 2026-185 | CRTC
Telecom Decision CRTC 2026-185 approves updated guidelines for switch provisioning and NPAC subscription creation to resolve industry inconsistencies. These changes aim to improve number porting clarity, ensure operational consistency, and enhance fraud prevention measures.
Origin Energy security breach: Potential data hack affects millions of Australian customers
Origin Energy is investigating a data breach following claims that a hacker accessed the personal information of up to 2 million Australian customers. The energy retailer has notified relevant authorities and is working to verify the claims while advising users to stay alert for potential phishing scams.
Dell security advisory (AV26-716) - Canadian Centre for Cyber Security
The Dell security advisory AV26-716 identifies multiple vulnerabilities across various Dell hardware and software products. Users and administrators are encouraged to review the official Dell security notices and apply the necessary updates to secure their systems.
Ubuntu security advisory (AV26-717) - Canadian Centre for Cyber Security
The Ubuntu security advisory AV26-717 outlines vulnerabilities in the Linux kernel across multiple Ubuntu versions identified between July 13 and 19, 2026. The Cyber Centre advises users and administrators to apply the recommended security updates to protect their systems.
[Control systems] CISA ICS security advisories (AV26-718) - Canadian Centre for Cyber Security
The Canadian Centre for Cyber Security advisory identifies vulnerabilities in various ICS products from vendors including ABB, Rockwell Automation, and Siemens. Administrators are urged to review the CISA advisories and apply recommended mitigations or software updates to secure their systems.
Red Hat security advisory (AV26-719) - Canadian Centre for Cyber Security
The Red Hat security advisory (AV26-719) addresses vulnerabilities in the Linux kernel across multiple Red Hat Enterprise Linux products. Administrators should review the official security updates to ensure their systems remain protected.
Windows Bind Link Abuse Lets Attackers Blind EDR and Bypass AMSI, AppLocker, and Sysmon
Attackers with administrative access can abuse Windows bind links to redirect trusted file paths to malicious content, effectively blinding EDR, AMSI, AppLocker, and Sysmon. This post-compromise evasion technique creates a discrepancy between executed processes and security monitoring tools by leveraging memory-resident redirects that bypass traditional file-system detection.
GitHub security advisory (AV26-720) - Canadian Centre for Cyber Security
GitHub security advisory (AV26-720) identifies critical vulnerabilities in various GitHub Enterprise Server versions. Administrators are encouraged to apply the necessary software updates immediately to address these security risks.
Zimbra security advisory (AV26-721) - Canadian Centre for Cyber Security
The Canadian Centre for Cyber Security advisory AV26-721 alerts users to vulnerabilities in Zimbra Collaboration Suite versions prior to v10.1.20. Administrators should promptly apply the latest patch release updates to secure their systems.
US leading economic indicators decline in June as consumer weakness offsets financial gains
The Conference Board’s Leading Economic Index declined by 0.2% in June 2026 as consumer weakness and a drop in building permits offset gains in financial components. Despite this slip, the broader economic trend shows improvement compared to last year, bolstered by a revised upward GDP growth forecast of 1.9%.
ASML plans €20,000 retention grant for employees through 2030 as AI chip war heats up
ASML is offering a €20,000 retention grant to its approximately 45,000 employees in a strategic effort to maintain workforce stability through 2030 amidst the global AI chip war. This share-based incentive requires staff to remain with the company until 2030 to secure the payout as competition for semiconductor talent intensifies.
Researchers Claim LG Monitors are Silently Installing Adware on Windows Using App
Researchers report that LG monitor management software on Windows may silently install adware components without explicit user consent. To mitigate risks, users should carefully review installation prompts and inspect their systems for unauthorized background tasks or bundled promotional software.
Google taps Samsung to help build its next-generation AI chip
Google is reportedly partnering with Samsung to manufacture the interconnect module for its next-generation Icefish TPU using 2nm process technology. This split-manufacturing approach aims to reduce reliance on third-party hardware by leveraging both TSMC and Samsung to scale AI infrastructure.
GPT-5.6 Sol Ultra Discovers WordPress Pre-Auth SQL Injection Leading to RCE A critical vulnerability chain known as wp2shell allows unauthenticated attackers to exploit a pre-authentication SQL injection in WordPress to achieve remote code execution. Security researcher Adam Kues discovered this flaw using GPT-5.6 Sol Ultra by identifying index desynchronization in the REST API Batch endpoint.
Italy fines WINDTRE €1.7 million over security flaws behind two data breaches - Help Net Security
Italy’s data protection authority has fined WINDTRE €1.7 million due to security flaws and data breaches that exposed the personal and payment information of over 365,000 customers. The regulator determined that inadequate digital certificate management and insufficient API protection enabled attackers to successfully execute large-scale data exfiltration.
TELEPUZ Web Injector Can Steal Cookies, Execute JavaScript, and Replace IBAN Details
TELEPUZ is a modular malware family that utilizes ClickFix social engineering and advanced evasion techniques to compromise systems and establish resilient command-and-control communication. Through its WebInjector module, the threat actor can intercept browser sessions to steal cookies, execute malicious JavaScript, and perform financial fraud by replacing IBAN details.
Ernst & Young data breach exposes personal and financial information of tax clients
The Ernst & Young data breach resulted from unauthorized access to a third-party IT support system, exposing sensitive tax documents and Social Security numbers. Attackers compromised external infrastructure between March and April 2026, leading to ongoing legal investigations and regulatory notifications.