VulnHub

Cybercriminals are running a phishing campaign disguised as Bank of America communications to deceive users into downloading a harmful script. This script installs ScreenConnect, a remote access tool that allows attackers to control infected systems. Victims of this scam may unknowingly give hackers persistent access to their devices, potentially leading to data theft or further exploitation. It's crucial for users to remain vigilant against such phishing attempts and verify the authenticity of any unexpected emails. This incident serves as a reminder that even well-known brands can be used as bait in cyber attacks.

The phishing-as-a-service toolkit known as Greatness has added a new feature that allows attackers to use device code phishing to bypass Multi-Factor Authentication (MFA). This technique exploits the OAuth 2.0 Device Authorization Grant, a legitimate protocol, to gain unauthorized access to user accounts. By doing so, attackers can steal authentication tokens and control user accounts without needing to compromise passwords directly. This development is concerning as it poses risks to a wide range of applications and services that rely on MFA for security, making it easier for cybercriminals to execute their plans. Organizations and users must be vigilant and update their security practices to mitigate the risks associated with this evolving threat.

A recent analysis highlights how attackers are exploiting cloud services to bypass multi-factor authentication (MFA) using a technique called Account in the Middle (AitM). This involves leveraging service workers and platforms like Ultraviolet to host phishing sites on legitimate cloud infrastructure, making them harder to detect. Major platforms identified include Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS, which are being misused to create convincing phishing pages. This tactic poses a significant risk to users who might unknowingly provide their credentials, as it undermines the security measures intended to protect them. Companies utilizing these services should be aware of this vulnerability and take steps to secure their users against such phishing schemes.

Acrisure's KARR BT and DR-100 vehicle security systems have a serious vulnerability that could allow attackers to control vehicles remotely. The issue stems from a hard-coded Bluetooth authentication key shared among affected devices, which could let someone within range unlock doors or disable the engine. This affects all KARR BT firmware versions before July 20, 2026, and DR-100 firmware versions before the same date. While no public exploitation of this vulnerability has been reported yet, users are urged to update their devices to mitigate the risk. A firmware update has been released on July 20, 2026, to address this flaw, and users can find detailed instructions for the update on the KARR Security website.

South Korean authorities have issued a warning about phishing attacks linked to nation-state actors. These attacks involve individuals posing as job applicants who send resumes embedded with malicious links. In some cases, attackers impersonate recruiters and send password-protected ZIP files that contain malware. This tactic puts job seekers and companies at risk, as malicious actors exploit the trust associated with job applications to deliver harmful software. Organizations and users need to be vigilant and cautious with unsolicited job-related communications, especially those requesting personal information or containing unexpected attachments.

A cyberattack targeting the U.K.'s Police National Legal Database (PNLD) has resulted in the exposure of contact information for over 100,000 police officers and other personnel within the criminal justice system. The breach has raised concerns about the potential misuse of this sensitive data, which includes names, phone numbers, and email addresses of law enforcement staff. The attack highlights vulnerabilities in the security of critical databases that house personal information. With such a large number of individuals affected, there is a heightened risk of phishing attacks and other forms of identity theft. Authorities are investigating the breach to determine the extent of the damage and to implement necessary security measures to prevent future incidents.

ESET's latest threat report reveals that cybercriminals are increasingly using artificial intelligence to enhance their attacks. They are adapting existing malware techniques to exploit new AI technologies and changes in user behavior. This includes the rise of AI-assisted malware and ClickFix attacks, as well as a surge in record quishing incidents—where attackers trick users into divulging sensitive information. Additionally, ransomware tools are now being designed to disable security software, making it harder for victims to defend themselves. This shift in tactics poses significant risks to both individuals and organizations, as they must now contend with more sophisticated and adaptable threats.

XRP, a cryptocurrency, has experienced significant price fluctuations recently, which has been attributed to rising concerns over cybersecurity threats and changes in the market. Reports indicate that increased phishing attempts, attacks on exchanges, and risks associated with automated trading tools are challenging the security measures in place for digital assets. As the popularity of artificial intelligence tools in trading grows, the potential for exploitation by cybercriminals also rises. This situation is concerning for investors and traders who rely on the stability and security of their digital assets. The evolving landscape of threats calls for enhanced vigilance and improved security practices within the cryptocurrency sector.

Device code phishing is rapidly emerging as a significant cybersecurity threat, exploiting the OAuth 2.0 device authorization grant to steal access tokens. This method targets input-constrained devices such as smart TVs and printers, which are becoming increasingly common in various applications. In less than six months, what started as a niche tactic has transformed into a widespread issue, affecting numerous platforms and services. The shift in usage patterns has made it easier for attackers to exploit this vulnerability, putting many users at risk. As more applications adopt this login flow, it becomes crucial for developers and companies to implement stronger security measures to protect users from these phishing attempts.

The Silver Fox group has been targeting a Japanese manufacturer using a method known as Bring Your Own Vulnerable Driver (BYOVD). The attack starts with a phishing email disguised as an invoice, which directs victims to content hosted on legitimate services like QQ and Tencent Cloud. This tactic allows the attackers to bypass security measures and gain access to the victim's systems. Such incidents are concerning as they exploit trusted platforms, making it harder for organizations to defend against these types of attacks. Companies need to be vigilant about phishing threats and ensure their employees are trained to recognize suspicious communications.

AiTM phishing, or Advanced Identity Theft phishing, has emerged as the leading method for cybercriminals to infiltrate law firms, accounting for 56% of the initial access threats faced by these organizations. This type of phishing attack typically involves sophisticated techniques that trick users into revealing sensitive information, such as login credentials. Law firms, which often handle confidential client data, are particularly attractive targets for attackers. The rise of AiTM phishing poses significant risks, as successful breaches can lead to data theft, financial loss, and reputational damage for the firms involved. Legal professionals must remain vigilant and strengthen their cybersecurity measures to combat this growing threat.

NASA's Core Flight System (cFS) Health & Safety (HS) Application has a vulnerability that could lead to denial-of-service attacks. Specifically, versions up to 7.0.1 are affected by a NULL pointer dereference issue, which could cause the application to crash under certain conditions. This flaw is linked to an incomplete fix for a previous vulnerability (CVE-2026-15352). Users are advised to update to the latest development branch available on NASA's GitHub repository, where a fix is in progress. This situation is critical as it impacts systems within the transportation sector and could compromise operational integrity worldwide.