Financial Sector
- Zombie Card Attack Can Revive Expired Visa Cards For Contactless Payments
"Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named "Zombie Card," requires physical possession of the expired card or sustained NFC proximity to it, plus a man-in-the-middle (MitM) relay positioned between the card and the terminal. It also requires that the account remain open under the same primary account number (PAN), which is standard practice when an issuer sends a replacement card, and that the issuing bank not independently re-check the expiry during authorization."
https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html
https://www.usenix.org/system/files/usenixsecurity26-anwar.pdf
https://www.helpnetsecurity.com/2026/08/20/zombie-credit-card-attack-expired/
Industrial Sector
- A Brief Overview Of The Main Incidents In Industrial Cybersecurity. Q2 2026
"In Q2 2026, 163 incidents were publicly confirmed by victims. All of these incidents are included in the table at the end of the overview, with select incidents described in detail. In our review of publications by researchers investigating threats to industrial organizations, we noted a significant increase in stories describing attacks on control systems intended to cause physical damage. Unsurprisingly, the number of such incidents confirmed by the attacked parties has also increased. The organizations that suffered most were obviously the ones not paying sufficient attention to the security of their automation systems for a number of reasons, primarily economic ones."
https://ics-cert.kaspersky.com/publications/reports/2026/08/20/a-brief-overview-of-the-main-incidents-in-industrial-cybersecurity-q2-2026/ - Johnson Controls Simplex Incident Manager
"Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected systems."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01
Vulnerabilities
- Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities
"Cisco on Wednesday announced patches for 15 vulnerabilities across its products, including critical- and high-severity flaws in Crosswork and Secure Workload. Crosswork version 7.2.1-SP was released with fixes for four critical-severity CVEs. Three of them, CVE-2026-20030, CVE-2026-20357, and CVE-2026-20358, have a maximum severity rating (CVSS score of 10/10), while the fourth, CVE-2026-20359, has a near-max severity (CVSS score of 9.9/10)."
https://www.securityweek.com/cisco-patches-critical-crosswork-secure-workload-vulnerabilities/ - Critical Unauthenticated File Upload To RCE In Elementor Pro Plugin
"This blog post is about an unauthenticated arbitrary file upload vulnerability in the Elementor Pro plugin that leads to remote code execution. The flaw lives in the Forms module’s File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries. By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory. Patchstack has issued mitigation rules to protect against exploitation of this vulnerability."
https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/
https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/ - Critical Zimbra RCE Flaw Now Actively Exploited In Attacks
"CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). ZCS is a popular email and collaboration software suite used by hundreds of millions of people and organizations worldwide, including thousands of businesses and hundreds of government agencies. The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled."
https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/
https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html
https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/ - Solar Winds Part 2 Avoided: N-Able Passportal Vault Leak
"N-Able's PassPortal extension, on Chrome and Edge allowed any site or iframe a user is presented with to gain complete, persisted access to the decrypted vault for up to 100 days. CVSS v4.0, base 9.4. Fixed within 24hrs. 73k+ affected weekly active users. v3.49.5 is vulnerable, v3.49.6 patched. N-able (formerly SolarWinds MSP) is publicly traded at ~$800M market cap. They provide cloud-based remote monitoring, management, and security platforms specifically designed for Managed Services Providers (MSPs) - and they have a password manager called PassPortal. N-Able's PSIRT were incredibly fast and cooperative throughout the process, giving us an account and publishing a fix within 24 hours of us reporting this to them."
https://amibeingpwned.com/blog/solar-winds-part-2-avoided
https://www.darkreading.com/vulnerabilities-threats/n-able-bug-password-vault-master-keys - Atlassian, Splunk Patch Dozens Of Critical, High-Severity Vulnerabilities
"Atlassian and Splunk this week announced patches for over 250 vulnerabilities across their products, including dozens of critical- and high-severity flaws. On Tuesday, Atlassian published a Security Bulletin detailing 10 critical- and 162 high-severity issues in third-party dependencies, patched with fresh security updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira. Because the vulnerable libraries are used across multiple products, many of the patched security defects affect multiple products. Overall, the fixes appear to address approximately 109 unique CVEs."
https://www.securityweek.com/atlassian-splunk-patch-dozens-of-critical-high-severity-vulnerabilities/ - CISA Adds Two Known Exploited Vulnerabilities To Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability
CVE-2026-72530 TrueConf Server Code Injection Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog - Zero-Click Grok Data Theft: Cryptographic Context Injection Attack Leaks Chat Histories
"A new attack technique we call Cryptographic Context Injection works around guardrails and gets attacker commands processed in a trusted context by shipping those instructions as cryptographically secure ciphertext and inducing the model to decrypt them inside its own code execution runtime. This lets attackers steal data using the access the AI system has, or modify the agent’s behavior, which we demonstrate against Grok and Gemini."
https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft/
https://thehackernews.com/2026/08/new-cryptographic-context-injection.html - GHSA-864f-Rcv7-6rh4: Critical Type Confusion Vulnerability In Isolated-Vm
"We discovered a critical vulnerability (GHSA-864f-rcv7-6rh4; pending CVE assignment) in isolated-vm, a widely used library for running untrusted JavaScript inside a V8 Isolate. A type confusion in ExternalCopy's handling of the transferList option lets code running inside the sandbox corrupt memory in the host process. Starting from nothing but a single ivm.Reference, the standard way hosts hand a sandbox any capability at all, we escalated the bug from a controlled-address crash all the way to hijacking the host's control flow, demonstrating a full guest-to-host sandbox escape."
https://www.endorlabs.com/learn/ghsa-864f-rcv7-6rh4-critical-type-confusion-vulnerability-in-isolated-vm
https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html - CDN Tsunami Attack Abuses HTTP/3 Translation For Up To 350x DoS Amplification
"Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin server. The attacks, collectively named "CDN Tsunami," were evaluated against Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. All six were found susceptible to the bandwidth variant and five to the connection variant, with Cloudflare unaffected by the latter because it buffers the complete request before opening a connection to the origin."
https://thehackernews.com/2026/08/cdn-tsunami-attack-abuses-http3.html
https://arxiv.org/html/2607.26589v1 - JFrog Artifactory Flaws Enable Software Supply Chain Attacks
"Two vulnerabilities in JFrog Artifactory have been found which allow anonymous or low-privileged users to manipulate package metadata without modifying the underlying artifacts, creating a potential route to software supply chain compromise. Oligo Security reported the flaws to JFrog on June 25 and detailed them in research published on August 20. The findings cover CVE-2026-69106 (CVSS score 8.8), which affects the handling of the X-Orig-Client-Uri header, and CVE-2026-65922 (CVSS score 5.4), which allows writes into trusted .jfrog/ metadata paths."
https://www.infosecurity-magazine.com/news/jfrog-flaws-software-supply-chain/
Malware
- One Adversary: Fraud Is a Network, Not a Payment
"The hardest fraud to stop is the one the customer wants to make. In 2025, investment scams were the largest fraud loss category in both Australia and the United States, roughly $8.7 billion combined, with Australian losses of $837.7 million across more than 481,000 reports, US losses of $7.9 billion, average individual losses above $10,000, and the over-65s carrying more than a quarter of Australia’s total. In almost every case, the victim authorised the payment, often over their bank’s warnings. At the transaction, there was nothing to refuse. Behind aggregate numbers like these sit specific, organised operations, and Group-IB’s investigation of the ecosystem profiled two that show how the business works."
https://www.group-ib.com/blog/one-adversary-fraud-network/ - Post-DEF CON Phishing Uses Google Doc Apps Script To Deliver Malware
"Large industry events like Black Hat and DEF CON create a target-rich environment for bad actors, with attendees exchanging new contacts, documents, invitations, and follow-up plans. Attackers are using this activity to make malicious outreach look like just another routine post-conference interaction. Fresh off the heels of "Hacker Summer Camp," there have been several reports of phishing campaigns that target attendees, with one of our own researchers being among those targeted by threat actors. In this case, on August 9, the X account @HartmansDoeke sent a direct message posing as CoinDesk's VP and Head of Marketing and asking for help with their upcoming conference. The account appears to use one person's image with another person's name. The message ultimately directed the recipient to a Google Doc featuring a custom sidebar designed to guide them through the execution of malware."
https://www.huntress.com/blog/defcon-phishing-google-doc-malware
https://www.infosecurity-magazine.com/news/def-con-attendees-persistent/ - Rust Supply-Chain Attack: Arrayref, Internment, And Append-Only-Vec Poisoned By The Proc-Macro1 Build-Time Dropper
"A compromised maintainer account and a same-day impersonator of one of Rust's best-known authors turned a routine cargo update into silent remote code execution. Three crates from the same owner were poisoned in 23 minutes (arrayref, internment, and append-only-vec), alongside six attacker-owned crates now deleted from crates.io. The malicious releases are gone, but the 07:11–09:25 UTC exposure window leaves an open question: who built during it? Verified timeline, IOCs, runtime detection, and remediation inside."
https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack
https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/
https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack
https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/
https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html - Manic: Blend Between Banking Malware & Spyware
"The modern mobile threat landscape includes numerous malware families operated by individual threat actors and organised criminal groups, all competing for ways to infect victims as smoothly and inconspicuously as possible. Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features. Its targeting is strongly focused on Ukraine, covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications."
https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware
https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html
https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/
https://securityaffairs.com/197570/malware/manic-the-android-malware-that-exfiltrates-data-even-when-the-phone-is-offline.html - UAT-10147: Chinese-Speaking Adversary Integrates Agentic AI Into Post-Compromise Operations
"Cisco Talos identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale. UAT-10147 integrated AI-driven tooling into exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos observed AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic supporting real-world intrusions. The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence."
https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ - UAT-10147 Deploys SPECTRE: A Cross-Platform Implant With Linux Rootkit And BYOVD Capabilities
"UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization (SEO) fraud monetization with advanced persistence and defense evasion techniques. The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality."
https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/ - When AI Becomes The Lure: A Fake Gemini Installer Delivers Vidar
"As organizations are increasingly adopting generative AI tools into their daily workflows, attackers are adapting their distribution methods accordingly too. As part of their day-to-day work, users are now searching for AI assistants, programming tools, browser extensions, desktop applications, and productivity integrations. Recent reports have highlighted campaigns that use fake AI software and AI-related installers to distribute malware and steal credentials [1]. Researchers have documented campaigns that exploit fake AI-themed websites and services to distribute information stealers and backdoors [2]. Security researchers have also observed attackers disguising malware as legitimate installers for AI software to increase the likelihood of victim interaction and execution [3]."
https://www.darktrace.com/blog/when-ai-becomes-the-lure-a-fake-gemini-installer-delivers-vidar
https://www.helpnetsecurity.com/2026/08/20/fake-google-gemini-installer-vidar-infostealer/ - The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares Its Next Strike On Mobile
"The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially expands its targets globally. Among the newly added capabilities is a PIN theft mechanism targeting more than 140 banking and cryptocurrency applications. By abusing the Android Accessibility Service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions, compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities. Several commands previously identified as unimplemented in Cleafy’s analysis are now fully operational, expanding the malware’s remote control and fraud capabilities."
https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile
https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html
https://www.infosecurity-magazine.com/news/updated-toxicpanda-140-banking/ - WeedHack Returns: How SEO Poisoning Is Leading Minecraft Fans To Malware
"McAfee Labs’ latest investigation into the WeedHack malware campaign found that the threat has continued to evolve even after its original command-and-control infrastructure was disrupted by McAfee. Researchers identified multiple active websites still distributing WeedHack to gamers, often by impersonating legitimate Minecraft clients, offering paid tools for free, or using trusted platforms to make malicious downloads appear credible."
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning/ - Going With The Flow(s): Distinct Clusters Target Individuals Of Interest To Russia
"Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. Examples of these techniques can be found in our previous blog on UNC6293’s phishing operations. We now track an additional two distinct suspected Russian clusters, UNC7005 and UNC5976, which conduct phishing, abuse OAuth flows, and/or deploy malware to victims. UNC7005 in particular is tied to the hospitality captive portal redirects reported on by Reliaquest and Microsoft. While each group conducts their campaigns differently, they all ultimately demonstrate a focus on abuse of legitimate authentication workflows to compromise accounts."
https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia
https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html - 77 Firefox Extensions Linked To Crypto Wallet And Credential Theft
"The Socket Threat Research team is tracking 77 Firefox extension identities linked through code reuse, cloned extensions, deceptive marketplace descriptions, author-selected add-on ID patterns and domain-like suffixes, cryptocurrency-wallet impersonation, and version histories showing extension repurposing. Extension-level analysis confirms 40 as malicious. Another 37 form a coordinated multi-sport score-shell operation. Their analyzed builds contain no confirmed credential- or wallet-stealing payloads, but their deceptive functionality, shared publishing artifacts, and version histories indicate malicious intent."
https://socket.dev/blog/firefox-crypto-wallet-theft
https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html - Identity Abuse Through Trusted Communication Channels
"Identity has become a primary security boundary for most organizations, reducing the ability to solely trust other boundaries once associated with corporate networks. Users authenticate to cloud services using enterprise identities that provide access to collaboration platforms, business applications and sensitive data. With the adoption of software-as-a-service (SaaS) on the rise, people are shifting to platforms for communication and collaboration."
https://unit42.paloaltonetworks.com/communication-channel-identity-risks/
Breaches/Hacks/Leaks
- Genomics Testing Lab Notifies Nearly 310,000 Of Hack
"Genomics testing firm Baylor Genetics is notifying nearly 310,000 people and counting about a June hack that compromised sensitive patient information including test results and employee data. The incident is the latest in a rash of attacks hitting medical laboratories, biotech and life sciences firms. Baylor Genetics has so far reported to several state attorneys general that nearly 250,000 Texans were affected, as well as nearly 57,000 citizens in Massachusetts and more than 2,600 residents of Vermont."
https://www.bankinfosecurity.com/genomics-testing-lab-notifies-nearly-310000-hack-a-32618 - Reverse Image Search Platform Exposed 9 Million Images
"I recently discovered a publicly exposed database that was neither password-protected nor encrypted. The database contained approximately 9,042,977 image files totaling 450.2GB of data. The exposed records consisted primarily of facial images stored in folders labeled “faces” and “profiles.” In a limited sample of the exposed images I reviewed as part of the investigation, I observed facial images of adults, teens, and children. These included what appeared to be profile images, screenshots, and physical photographs that appeared to have been uploaded for reverse image searches or other identity verification purposes."
https://www.expressvpn.com/blog/clarity-check-data-exposed/
https://www.malwarebytes.com/blog/privacy/2026/08/9-million-images-of-peoples-faces-exposed-by-reverse-lookup-service
General News
- July 2026 Threat Trend Report On APT Groups
"The July 2026 Threat Trend Report on APT Groups summarizes the trend in which state-sponsored threat actors and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques. Key targets include Microsoft 365, webmail accounts, cloud infrastructure, GitHub and development environments, VPN and remote access systems, mobile devices, and credentials stored in browsers."
https://asec.ahnlab.com/en/95040/ - AI Is Making Fraud Harder To Spot And Identity Harder To Prove
"Online fraud has become a routine concern for consumers and businesses that rely on digital accounts, payments and customer service. Experian’s 2026 U.S. Identity & Fraud Report describes a market where scams extend across messages, websites, documents, voices, images and account activity. Fraud used to be treated as an isolated event, such as a forged check, stolen credit card or false invoice. It has become a regular part of digital activity, appearing through phishing emails, scam texts, delivery notices, misleading ads and account alerts."
https://www.helpnetsecurity.com/2026/08/20/experian-digital-identity-fraud-risks-report/ - 8,539 Reasons To Rethink How Vulnerabilities Get Patched
"The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and organizations have a growing number of weaknesses to sort through. Rapid7’s Q2 2026 Threat Landscape Report counted 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded a year earlier. The increase adds pressure to a patching process that requires teams to decide which problems deserve immediate attention. A vulnerability’s severity score can help with that decision, but exposure and reachability also matter. A flaw on an internet-facing system can present a different security problem from one that attackers cannot readily reach."
https://www.helpnetsecurity.com/2026/08/20/rapid7-vulnerability-patch-cycles-report/ - Calling On Cyber Pros To Help Defend City Hall
"A government agency I work with lost nearly a million dollars and never heard an alarm. No ransom note, no locked-up servers. Attackers slipped into a handful of staff email accounts, watched how the agency moved money for a couple of months, and then quietly rerouted a wire meant for an affordable-housing project. Nobody caught it until the money was already gone. This wasn't a federal department or a Fortune 500 company. It was a local housing authority, the kind of place that helps families make rent. And here's the part I keep coming back to: The breach isn't how the story ends."
https://www.darkreading.com/cyber-risk/calling-on-cyber-pros-to-help-city-hall - Money And Mindset: The Two Biggest Roadblocks To Cyber Policing
"Malware silently spread through a Texas law enforcement system—hidden inside body camera footage that police uploaded to the department server and then shared with county officials, prosecutors, and defense attorneys. As the compromised video traveled through the chain of command, the danger of putting highly sensitive data at risk only grew. That is one example that highlights how important it is for various arms of law enforcement to receive adequate cyber training, explains Justin Miller, associate professor of practice of cyber studies at University of Tulsa, and a retired senior special agent with the U.S. Secret Service."
https://www.darkreading.com/cybersecurity-operations/money-and-mindset-the-two-biggest-roadblocks-to-cyber-policing - Surveillance – Everything You Wanted To Know, But Were Afraid To Ask
"We all know they’re watching us. But we don’t know who they are, nor why nor how they are doing it. Nobody does anything without reason. So, organizations watch and track us for a purpose. That purpose is always for their benefit, not ours. But who are they? Why and how do they do it, and how many organizations do it? It may appear as if it is just an assault on our privacy, but it’s wider than that – the collected information is a powerful tool for further data theft, for targeting critical industries, and for disrupting governments."
https://www.securityweek.com/surveillance-everything-you-wanted-to-know-but-were-afraid-to-ask/
อ้างอิง
Electronic Transactions Development Agency (ETDA) 
