VulnHub

A new phishing kit known as Wazza is making waves by targeting banking, government, and manufacturing sectors across the US, Europe, and Australia. Unlike traditional phishing kits that simply mimic login pages, Wazza incorporates advanced features like filtering and session management, which enhance its effectiveness in capturing user credentials. This evolution in phishing tactics poses a significant risk to organizations, as attackers are now better equipped to evade detection and manipulate traffic to their advantage. Companies in the affected sectors need to bolster their security measures and educate employees about recognizing phishing attempts to mitigate these risks. The rise of Wazza is a reminder that cybercriminals are continuously evolving their strategies to exploit vulnerabilities in various industries.

Researchers at Barracuda discovered a new phishing tactic where attackers embed AI prompt injections within phishing emails. These emails are crafted to deceive not only human recipients but also AI systems that may process them. By manipulating AI assistants, attackers aim to bypass security measures and extract sensitive information or execute harmful actions without detection. This dual-targeting approach raises concerns about the effectiveness of current email security protocols, as it highlights vulnerabilities in both human and AI responses to phishing attempts. Organizations need to be vigilant and update their security practices to counteract these evolving threats.

ASOS has confirmed that it was targeted in a cyberattack that compromised a third-party communication platform. As a result, hackers were able to send unauthorized notifications to ASOS users. This incident raises concerns about the security of third-party services that companies rely on for communication, as they can become potential entry points for attackers. Users of ASOS may have received misleading messages, which could lead to confusion or even phishing attempts. The situation underscores the need for companies to closely monitor their third-party vendors and ensure robust security measures are in place to protect customer information.

ASOS, the UK-based fashion retailer, has confirmed a data breach after hackers sent unauthorized push notifications through its mobile app. The attackers claimed to have accessed customer data from ASOS's Snowflake environment, raising concerns over the security of user information. While specific details about the stolen data have not been disclosed, the incident highlights vulnerabilities in the company's app security. Users of the ASOS mobile app should be on alert for potential phishing attempts or unusual activity in their accounts. This breach serves as a reminder for companies to prioritize data protection and for consumers to stay vigilant about their personal information online.

A new cyber campaign is targeting advertising account managers by creating fake websites that mimic popular AI platforms like ChatGPT, Gemini, Claude, and Perplexity. These fraudulent sites are designed to steal login credentials and multi-factor authentication (MFA) codes using browser-in-browser attacks. This method allows attackers to trick users into entering sensitive information, which can lead to unauthorized access to advertising accounts. The impact is significant for those in the advertising industry, as compromised accounts can result in financial losses and reputational damage. Users need to be cautious when entering credentials on unfamiliar sites and ensure they are using legitimate platforms.

Nikkei has reported that two employee cloud accounts were compromised, with one of the accounts being used to send out around 9,000 phishing emails. This incident raises concerns about the security of employee accounts in cloud services and the potential for widespread phishing attacks targeting other organizations or individuals. The unauthorized access could lead to further breaches if sensitive information is exposed or misused. Companies should ensure that their employees are trained on security best practices and that robust measures are in place to protect cloud accounts from unauthorized access. This incident serves as a reminder of the ongoing risks associated with email-based attacks and the importance of vigilance in cybersecurity.

A newly identified cyber espionage group, TA419, believed to be linked to China, is targeting U.S. experts in artificial intelligence. The group has conducted several credential phishing campaigns aimed at professionals in think tanks, universities, and the legal sector. Attackers are impersonating well-known economists, AI policymakers, and even an employee from Anthropic to specifically target these experts. This type of cyber activity raises concerns about the security of sensitive information related to AI policy, especially given the growing importance of AI in global economics and regulation. The attacks indicate an ongoing effort to gather intelligence on U.S. AI initiatives and strategies.

A Chinese espionage group known as TA419 has been impersonating high-profile figures, including a former official from the White House Office of Science and Technology Policy, to target AI policy experts in the United States. In July 2026, they conducted multiple credential phishing campaigns aimed at gaining access to the cloud accounts of these experts. By posing as trusted individuals, the attackers sought sensitive information related to AI policy discussions. This incident raises concerns about the security of communications among policymakers and highlights the ongoing threats posed by state-sponsored hacking groups. Protecting sensitive information in the realm of AI policy is crucial, as it influences future regulations and technological advancements.

A new cybersecurity threat called CloudSyncD is targeting Mac users by using a fake Zoom installer to steal passwords. Once installed, the malware deploys a two-stage backdoor, allowing attackers to gain further control over the infected systems. This tactic not only compromises user credentials but also opens the door for additional malicious activities. Users who think they are downloading a legitimate Zoom app are at risk, making it crucial for them to verify software sources. This incident emphasizes the ongoing need for vigilance against phishing attacks and the importance of downloading applications only from trusted sources.

Armatura LLC's Armatura One software has several critical vulnerabilities that could allow attackers to gain unauthorized access to sensitive systems. Versions prior to 4.7.2 and 4.6.1 for the USA release are affected by issues including the ability to execute arbitrary code and access hard-coded credentials. Specifically, a deserialization flaw in the software's embedded Apache ActiveMQ component is a major concern, as it can allow unauthenticated attackers to execute code with high privileges. Additionally, hard-coded cryptographic keys and passwords could lead to further exploitation if attackers gain access to the installation package. Users are strongly advised to upgrade to the latest versions to mitigate these risks.

ABB Protection and Control IED Manager PCM600 has been found to contain two vulnerabilities that could allow attackers to escalate privileges or overwrite files. Specifically, versions of PCM600 up to and including 2.14 are affected by CVE-2026-15952 and CVE-2026-15953. The first vulnerability allows local users with valid credentials to gain elevated privileges due to improper permission settings in the Scheduler Service. The second vulnerability concerns insufficient validation during the extraction of project archive files, enabling potential path traversal attacks. These vulnerabilities pose significant risks, particularly in critical infrastructure sectors like energy, where ABB's systems are widely deployed. Users are advised to take immediate action to mitigate these risks.

CISA has identified multiple vulnerabilities in its Malcolm product, which is used across critical infrastructure sectors like energy and water. The flaws include issues such as cross-site scripting, command injection, and improper authentication, potentially allowing attackers to execute arbitrary scripts, bypass authentication, and access sensitive internal data. The vulnerabilities affect versions of Malcolm prior to 26.06.0, and CISA urges users to upgrade to the latest version released in September 2026. The presence of these vulnerabilities poses a significant risk to organizations relying on Malcolm, as successful exploitation could lead to unauthorized access and manipulation of sensitive data or system configurations.

Cofense researchers have identified a new tactic employed by the Global Group ransomware gang that targets large enterprises. The group uses payment-themed phishing emails to lure victims into downloading malicious ISO files. Once these files are executed, they deploy WinMerge, a legitimate file comparison tool, to facilitate the encryption of files on the victim's system. This technique allows attackers to bypass some security measures, making detection more difficult. The implications of this attack are significant, as it highlights the evolving methods ransomware groups are using to infiltrate corporate environments and extort money from organizations.

A Russian advanced persistent threat group, known as Star Blizzard, has shifted its tactics by introducing a new method called 'RedFlick.' This approach targets Ukrainian-linked organizations, including NGOs, think tanks, and journalists, to deploy a malicious backdoor known as CosmicPulse. This change in strategy allows attackers to expand their phishing efforts, increasing the risk for individuals and organizations connected to Ukraine. The move is particularly concerning given the ongoing conflict and the vulnerability of these groups to cyber attacks. As this situation develops, it is crucial for affected parties to remain vigilant against potential phishing attempts and other cyber threats.