Key Takeaways
- Multiple high‑profile organizations suffered data‑related incidents in July, ranging from third‑party IT‑support leaks to ransomware‑induced production halts.
- Supply‑chain attacks continue to thrive, as shown by the compromised Jscrambler npm packages that stole developer and cloud credentials.
- AI‑enabled threat activity is accelerating: threat actors are leveraging large‑language‑model (LLM) assistants to automate exploit generation, credential harvesting, and code exfiltration.
- Vendors rushed out emergency patches for critical vulnerabilities in Microsoft, WordPress, and SonicWall products, underscoring the need for rapid vulnerability management.
- Threat‑intelligence reports highlight evolving tactics such as OAuth abuse, synthetic identity creation, and AI‑driven prompt injection, indicating that defenders must broaden detection beyond traditional malware signatures.
Ernst & Young Data Leak via Third‑Party IT Support
Ernst & Young (EY) disclosed a breach stemming from a compromised third‑party IT‑support platform. Attackers gained access to support tickets that may have contained client documents, tax returns, employee personal data, and other sensitive information submitted while requesting technical assistance. Although EY has not confirmed the exact volume of data exfiltrated, the incident underscores the risk posed by outsourced support tools that often retain privileged access to corporate environments. The company has launched an internal investigation, notified potentially affected parties, and is reviewing its vendor‑risk management processes to prevent similar exposures.
Jscrambler Supply‑Chain Compromise Targets Developers
The JavaScript code‑protection service Jscrambler, which logs over 15,000 weekly npm downloads, experienced a supply‑chain attack after threat actors stole its npm publishing credentials. Malicious versions of the package were released, deploying malware designed to harvest developers’ credentials, cloud service tokens, browser storage data, cryptocurrency wallets, and messaging app secrets. Upon discovery, Jscrambler promptly removed the tainted releases, revoked the compromised keys, and urged users to upgrade to clean versions. The episode highlights how trusted development utilities can become vectors for credential theft when their distribution pipelines are inadequately secured.
Fairlife Ransomware Disrupts U.S. Dairy Production
Coca‑Cola’s US dairy subsidiary Fairlife confirmed a ransomware infection that forced a temporary shutdown of manufacturing operations across the United States. The attackers infiltrated systems that support production lines, prompting Fairlife to activate its incident‑response and business‑continuity protocols. While the company has not publicly stated whether data was exfiltrated, the disruption caused noticeable delays in product distribution. Fairlife is working with cyber‑security firms to eradicate the malware, restore backups, and harden its OT (operational technology) environment against future ransomware threats.
Nihon Kotsu Malware Attack Impairs Taxi Services
Japan’s largest taxi operator, Nihon Kotsu, suffered a malware intrusion after unauthorized access to its internal network was detected. The incident, which began on July 11, led the company to isolate affected systems, disrupting taxi dispatch, telephone services, online bookings, reservations, and car‑rental operations. Nihon Kotsu has not confirmed any theft of customer or corporate data, but the service outage highlighted the operational impact that network‑level malware can have on transportation logistics. The firm is conducting forensic analysis, applying patches, and enhancing network segmentation to limit lateral movement in future incidents.
China‑Linked AI Campaign Automates Attacks
Researchers uncovered a China‑linked threat campaign that abused LLM assistants—specifically Claude Code and DeepSeek—to automate various stages of cyberattacks against government and financial targets. The AI tools generated malicious scripts, adapted failed exploits, crafted credential‑harvesting web pages, and executed commands on compromised hosts. Confirmed victims included government systems in Thailand and Afghanistan, as well as several organizations in Taiwan. The campaign illustrates how adversaries are increasingly using generative AI to lower the technical barrier for sophisticated intrusions, enabling rapid iteration and scaling of attack techniques.
xAI Grok Build Exposes Full Git Repositories
Security analysts identified a privacy flaw in xAI’s Grok Build coding assistant that allowed the model to upload entire Git repositories while processing debugging requests. The unintended transfer included unopened files, complete commit histories, and consequently exposed API keys, secrets, and proprietary source code. Although initial client‑side controls failed to block the uploads, a server‑side restriction was later added to mitigate the risk. The finding serves as a cautionary tale about the data‑exfiltration potential of AI‑powered development aids that interact with users’ codebases.
Anthropic Claude Chrome Extension Impersonation Vulnerability
A weakness was discovered in Anthropic’s Claude for Chrome extension that permitted malicious browser extensions to masquerade as the legitimate Claude add‑on and operate within an authenticated user session. Successful exploitation could grant attackers access to Gmail, Google Drive, or GitHub data through the permissions granted to Claude. Anthropic released patches to address the issue, though researchers noted that a bypass remained possible under certain conditions. The incident underscores the importance of strict extension verification and least‑privilege permission models for browser‑based AI tools.
Microsoft Patch Tuesday Delivers Record‑Volume Fixes
Microsoft’s July Patch Tuesday addressed a record 622 vulnerabilities, the largest monthly release in the company’s history. Two of the flaws were actively exploited in the wild: CVE‑2026-56164 affecting SharePoint Server and CVE‑2026-56155 impacting Active Directory Federation Services (ADFS). Both vulnerabilities enable privilege escalation, potentially allowing attackers to gain administrative control over critical infrastructure. Microsoft urged administrators to apply the updates immediately and highlighted that Check Point IPS provides protection against the SharePoint authentication bypass (CVE‑2026-56164).
WordPress Core Vulnerabilities Trigger Emergency Updates
WordPress issued emergency patches for CVE‑2026-63030 and CVE‑2026-60137, collectively dubbed “wp2shell.” These critical core flaws permit unauthenticated remote code execution, enabling full website takeover. Affected versions span 6.9.0‑6.9.4 and 7.0.0‑7.0.1; the fixed releases are 6.9.5 and 7.0.2. The vulnerabilities are especially dangerous because they can be exploited without any authentication, making rapid patching essential for all WordPress sites. Check Point IPS offers defenses against both the authentication bypass (CVE‑2026-63030) and the SQL‑injection vector (CVE‑2026-60137).
SonicWall Hotfixes Critical Gateway Flaws
SonicWall released a hotfix for CVE‑2026-15409 and CVE‑2026-15410, two critical vulnerabilities affecting its SMA 1000 Series secure‑mobile‑access gateways. The flaws allow unauthenticated attackers to execute arbitrary system commands on the appliances, a capability that has been linked to active Inc ransomware campaigns. SonicWall advises immediate application of the hotfix and notes that Check Point IPS can mitigate both the server‑side request‑forgery (CVE‑2026-15409) and path‑traversal (CVE‑2026-15410) exploits.
Check Point Research AI Security Report Highlights Evolving Threats
Check Point’s 2026 AI Security report concludes that AI has transitioned from a mere attack aid to an active operator in live intrusions and malware development. The study notes a doubling of high‑risk generative‑AI prompts to 4% of observed activity, alongside rising trends in indirect prompt injection, synthetic identity abuse, and inadvertent enterprise data exposure. Organizations are advised to incorporate AI‑specific monitoring, enforce strict prompt‑validation policies, and treat LLM outputs as untrusted input in security controls.
ShinyHunters‑Linked OAuth Abuse Targets Salesforce
Analysts traced a series of campaigns attributed to the ShinyHunters threat actor that abused OAuth application approvals to gain illicit access to Salesforce environments. Attackers employed voice phishing (vishing) to convince users to authorize malicious, look‑alike OAuth apps, thereby obtaining API tokens that allowed reading and modifying CRM data. Additional persistence mechanisms were achieved through compromised third‑party integrations and misconfigured guest access. The findings stress the need for rigorous OAuth consent reviews, continuous monitoring of approved applications, and user education against social‑engineering tactics.
CylindricalCanine Subgroup Exploits DigiCert Portal
Researchers linked a subgroup of the Chinese cybercrime collective GoldenEyeDog—dubbed CylindricalCanine—to the April 2026 compromise of DigiCert’s support portal. The actors stole code‑signing certificates, leading to the revocation of at least 60 certificates, 27 of which were associated with known malware. Beyond the certificate theft, CylindricalCanine has been observed targeting Asia‑Pacific finance teams using the Golden Gh0st RAT for espionage and financial fraud. The incident demonstrates how supply‑chain attacks on trusted certificate authorities can cascade into broad malware distribution and underscores the importance of safeguarding certificate‑management infrastructure.
Spirals Ransomware Encrypts Networks in Under 24 Hours
A Rust‑based ransomware family named Spirals was documented after it attacked a South Asian information‑technology services provider. From initial access to full network encryption, the operation concluded in less than a day. The attackers leveraged an IIS web shell for foothold establishment, then used WMI and PsExec to laterally move, disable security services, disrupt backup mechanisms, and encrypt critical systems. The speed and stealth of Spirals highlight the growing threat posed by ransomware strains built with modern, low‑detectability languages, urging organizations to adopt rapid‑response playbooks, network segmentation, and immutable backup strategies.