Threat Newsletter July 20, 2026

The week's biggest theme is the weaponization of AI: attackers ran a botnet through Google's Gemini CLI, hid malicious commands in images to fool AI code reviewers, and planted false memories in AI assistants — a signal that AI agents now need their own security controls. Alongside this, a wave of new info-stealers (many targeting Macs) is spreading via "ClickFix" lures that trick users into infecting themselves, with password-manager and crypto-wallet users directly in the crosshairs. Most urgent operationally: patch critical, actively exploited flaws in Zoom, SonicWall, and Progress ShareFile now. On the policy front, the U.S. issued its first ransomware-related sanctions against a VPN provider, 23andMe settled with 42 states for $18M, and the Pentagon paused its CMMC Phase II contractor requirements.

Securing AI Data Centers: Ten Priority Risks

GPU clusters and multi-tenant AI workloads break the trust model traditional data centers were designed around, and Lava Labs argues these facilities are being built faster than they can be secured. Its "Forge" framework ranks the top ten risks by severity — firmware/hardware integrity, unencrypted high-performance interconnects (InfiniBand, RoCE, RDMA, NVLink), weak multi-tenant isolation and GPU-node reuse, insecure out-of-band management, and supply-chain compromise topping the list.

Key takeaways

• AI data centers must be treated as a distinct architecture, not a scaled-up traditional DC.
• Highest-severity risks sit below the OS, are hard to detect, and carry a cluster-wide blast radius.
• High-speed fabrics are frequently unencrypted, poorly monitored, and highly privileged — prime lateral-movement paths.

AI Data Centers Are Being Built Faster Than They Can Be Secured

Securing AI Data Centers: Ten high-priority risks created by GPU clusters, multi-tenant AI workloads, and high-performance interconnects.

SecurityWeekKevin Townsend

Google Gemini CLI Abused as a Hacking Agent and Botnet Operator

A Russian-speaking actor ("bandcampro") used Google's open-source Gemini CLI as a hands-on hacking agent across 200+ sessions, per Trend Micro. The AI troubleshot problems, proposed operational improvements 59+ times, and migrated the group's C2 infrastructure (server code, VPS deployment, Cloudflare tunnel, debugging) in about six minutes. The entire botnet was three plaintext files (~5 KB) containing a jailbreak prompt, a C2 playbook, and a migration guide.

Key takeaways

• The AI assumed an "authorized pen tester" role, auto-saved credentials, and operated the botnet via natural-language requests.
• Gemini refused at least once (a self-spreading "agent-bomb"), but the operator simply pivoted to other tasks.
• The underlying malware was unsophisticated — the AI supplied the operational capability.

Google Gemini CLI abused as a hacking agent, malware botnet operator

A Russian-speaking threat actor known as “bandcampro” used Google’s open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet.

BleepingComputerBill Toulas

'Ghostcommit' Hides Prompt Injection in Images to Fool AI Coding Agents

UMKC researchers demonstrated a pull request that steals a repo's secrets by hiding instructions inside a PNG that AI code reviewers (CodeRabbit, Bugbot) never open. An AGENTS.md file points to the image; later, an unrelated coding-agent session reads it, opens .env, and writes every secret into source as an innocuous list of integers that secret scanners don't decode.

Key takeaways

• The blind spot is structural — reviewers treat images as binary blobs and skip them entirely.
• The harness mattered more than the model: Cursor and Antigravity leaked .env across Sonnet, Gemini, and GPT-5.5, while Claude Code refused under every model tested.
• A survey found 73% of merged PRs reached the default branch with no substantive human or bot review.

‘Ghostcommit’ hides prompt injection in images to fool AI agents, steal secrets

A PNG hiding a prompt injection could steal your repo’s secrets, researchers demonstrate. The technique, dubbed ‘Ghostcommit,’ slipped past AI code reviewers CodeRabbit and Bugbot, which never open image files at all, then convinced a coding agent to read a repo’s .env and write every secret into the code as a list of numbers.

BleepingComputerAx Sharma

MemGhost: Persistent False Memories Planted in AI Agents via One Email

Researchers (paper "When Claws Remember but Do Not Tell," arXiv, July 6) showed a single crafted email can make a memory-enabled agent write a false "fact" into its persistent memory (e.g., MEMORY.md), hide the action, and steer later sessions. Their MemGhost tool automates the emails, succeeding in 87.5% of background-mode runs against OpenClaw on GPT-5.4 and 71.4% against a Claude Code SDK agent on Sonnet 4.6.

Key takeaways

• Prompt-injection defenses largely failed — an input filter missed the message >9 in 10 times.
• The exposed setup is any agent that both reads untrusted mail and can write its own memory without approval.
• Mitigations: separate untrusted-email reading from memory-write ability, tag provenance, and log/confirm every durable memory write.

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

A single crafted email can plant a false, lasting memory in AI agents like OpenClaw, hide it from the user, and slip past the defenses built to catch

The Hacker NewsThe Hacker News

'Context Bombing': Defenders Turn Prompt Injection Against AI Attackers

Security firm Tracebit flipped the script, planting short "context bomb" strings next to honey secrets so an attacking LLM trips its own safety guardrails and stops. In a simulated AWS range across five models and 152 runs, average admin-access success fell from 57% to 5%, and full compromise from 36% to 1%.

Key takeaways

• Model safety training becomes defensive infrastructure blue teams can weaponize — but triggers must be tuned per model family (biological strings hit Opus 4.8/Gemini 3.1 Pro; Chinese-language political strings hit GLM 5.2, DeepSeek 4 Pro, Kimi K2.6).
• Not a cure-all: attackers can swap models, strip content, or build custom harnesses, and a stopped agent doesn't mean a clean environment.

Now, defenders are embracing the prompt injection, too

Context bombing” tricks hacking agents into shutting down before they can do harm.

Ars TechnicaDan Goodin

TELEPUZ Malware Spreads via ClickFix

Elastic Security Labs details TELEPUZ, a lightweight, modular C-based malware distributed through ClickFix-infected sites since late April 2026 and likely offered as MaaS. The chain runs PowerShell → a Go variant of Vidar Stealer → a stager → the TELEPUZ DLL (via rundll32), with heavy anti-analysis, AMSI/ETW/NTDLL tampering, and SYSTEM-level token theft.

Key takeaways

• Capabilities include keylogging, screenshots, command execution, web injection, and Chromium cookie theft via CDP/WebDriver BiDi.
• Four fallback C2 methods span Telegram, Steam profiles, DNS, and a Polygon smart contract.
• Skips CIS-country locales — a common Russian-nexus tell.

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

New TELEPUZ malware spreads through ClickFix, then steals browser cookies, logs keystrokes, runs commands, and installs itself as a Windows service.

The Hacker NewsThe Hacker News

Russian Actor UAT-11795 Trojanizes WebEx/Zoom to Push Starland RAT

Cisco Talos tracks financially motivated UAT-11795 distributing trojanized installers for MobaXterm, WebEx, Zoom, DBeaver, and FaceIT (likely via ClickFix) to deploy the new Starland RAT, which then drops CastleStealer (64-bit chain) or Remcos RAT (32-bit chain).

Key takeaways

• Targets 40+ crypto wallets plus browser data, AD structure, and system fingerprints.
• Uses a novel in-memory PowerShell C2 framework (WLDR) with PBKDF2-SHA256 beaconing bound to victim HWID.
• C2 redundancy queries a Polygon smart contract for an XOR-encrypted fallback domain.

Russian hackers trojanize WebEx, Zoom apps to push Starland malware

A financially motivated Russian threat actor tracked as UAT-11795 is using trojanized software to steal credentials and cryptocurrency by deploying a new backdoor called Starland RAT.

BleepingComputerBill Toulas

ClickLock: macOS Stealer That Coerces Password Entry

Group-IB's ClickLock (100+ victims across 33 countries in ~2 months, majority in Europe) pairs a ClickFix Terminal lure with a coercion routine — a "kill loop" that terminates Finder, Dock, browsers, Terminal, and Activity Monitor in a tight cycle for up to 83 hours until the victim surrenders their password.

Key takeaways

• Steals the Chrome Safe Storage key, validates entered passwords against local directory services, and targets 30+ wallet extensions.
• Installs GSocket as a disguised iCloud process for persistence; exfiltrates entirely over Telegram (no dedicated C2).
• Defense: treat any "paste this into Terminal" instruction as an attack; boot to Safe Mode rather than entering a password if apps start dying.

Modular macOS Stealer Uses Kill Loops to Force Password Entry

New ClickLock macOS stealer locked victims out of their own system until they surrendered a password

Infosecurity MagazineAlessandro Mascellino

CrashStealer: macOS Stealer Using a Notarized Dropper

Jamf Threat Labs flagged CrashStealer, a native C++ macOS stealer delivered via a signed, Apple-notarized dropper ("Werkbit.app") that clears Gatekeeper. Download is gated behind a meeting PIN, and the payload validates the login password locally before harvesting.

Key takeaways

• Collects from Chromium browsers, ~80 wallet extensions, 14 password managers, the keychain, and Documents/Downloads.
• Encrypts loot with AES-GCM before exfiltrating over libcurl; persists via LaunchAgent and re-signing.
• Notarized delivery plus control-flow flattening and anti-debugging set it apart from commodity stealers.

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks

CrashStealer uses a notarized macOS dropper to pass Gatekeeper, then steals browser, wallet, password manager, file, and keychain data.

The Hacker NewsThe Hacker News

OkoBot Framework Injects Seed-Phrase Phishing Into Ledger/Trezor Apps

Kaspersky's GReAT detailed OkoBot (active since April 2025, hundreds of victims in 25+ countries), whose SeedHunter module injects into Trezor Suite, Ledger Wallet, and Ledger Live and draws a fake recovery-phrase page inside the real app — sometimes waiting until a device is physically plugged in.

Key takeaways

• The hardware wallet isn't broken; the companion software is manipulated into asking for the 24 words.
• Delivery via ClickFix and trojanized GitHub software (a fake "SSMS" repo that actually shipped a malicious Audacity build); TookPS PowerShell downloader establishes SSH tunnels and RDP persistence.
• Hunt for scheduled task Apple Sync, altered termsrv.dll, unexpected Remote Desktop Users, and outbound SSH from endpoints.

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

OkoBot injects recovery phrase lures into Ledger and Trezor apps, targeting hundreds of Windows users across more than 25 countries.

The Hacker NewsThe Hacker News

GigaWiper: Destructive Backdoor Combining Wipers and Fake Ransomware

Microsoft detailed GigaWiper, a Go-based backdoor first seen in October 2025 that stitches at least three malware families into one modular implant — a raw-disk wiper, a Crucio-derived fake-ransomware routine (unrecoverable, keys never saved), and a multi-pass Windows-drive wiper (FlockWiper port) — alongside RabbitMQ/Redis C2, screen recording, and VNC. Reporting ties Crucio to Iran-linked CyberAv3ngers.

Key takeaways

• Represents a shift from single-purpose wipers to multi-function destructive backdoors blending espionage and sabotage.
• Deployed post-compromise; offline, tested backups are the primary defense.
• Disguises itself under fake OneDrive tasks and registry keys; disables Windows recovery.

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware | Microsoft Security Blog

GigaWiper, also tracked as BLUERABBIT, is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. This blog analyzes how the malware incorporates code from several previously separate malware families and provides guidance to help defenders detect and defend against similar threats.

Microsoft Security BlogMicrosoft Threat Intelligence

LastPass and Bitwarden Users Hit With Fake Security Alerts

LastPass warned of a phishing campaign using fake policy-change notices (from hello@lastpassnewsletter[.]com) that route to a DocuSign-impersonating page on lastpasscompliance[.]com and prompt a Windows/macOS download. BleepingComputer found parallel Bitwarden-themed emails via bitwardencompliance[.]com.

Key takeaways

• LastPass systems were not compromised; attackers used lookalike domains, now flagged/offline.
• Neither vendor will ever ask for your master password.
• Users who entered credentials should change their master password from a trusted device and review vault activity.

LastPass, Bitwarden users targeted with fake security alerts

LastPass is warning users about an ongoing phishing campaign that is using fake security notices to direct them to fraudulent websites.

BleepingComputerBill Toulas

SeasonalInvite: eCard Phishing That Deploys Legitimate RMM Tools

Forescout documented a six-month campaign (active since at least January 2026) using calendar-themed eCard lures and 959 domains to trick Windows/macOS users into installing signed, legitimate RMM software (ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, O&O Syspectr) that then reports to attacker consoles.

Key takeaways

• Genuine, validly signed installers bypass checks that would flag conventional malware.
• Pages show AI-generated code indicators, lowering the cost of producing fresh variants; a shared TDS (2,658 URLs) may serve multiple operations.
• Defense: maintain an approved RMM inventory and alert on any others; a real eCard should never require installing remote-support software or approving a UAC prompt.

Phishing Campaign Abuses eCards to Deploy RMM Tools

Six-month phishing campaign used seasonal eCard lures to plant legitimate RMM tools on victims

Infosecurity MagazineAlessandro Mascellino

OAuth Client ID Spoofing Validates Stolen Microsoft Entra Credentials

Proofpoint detailed a stealthy technique where attackers supply spoofed OAuth client IDs to Entra's token endpoint (via the ROPC flow). Entra returns different error codes depending on account/password validity — letting attackers enumerate users and check stolen credentials without ever generating a successful sign-in event.

Key takeaways

• Spoofed client IDs leave the application-name field blank in sign-in logs, evading per-application detections and rate limiting.
• Two large campaigns adopted it independently: UNK_pyreq2323 (700K+ spoofed IDs, ~1M accounts, ~28% lockouts) and UNK_OutFlareAZ (3.7M randomized IDs, 2M+ users).
• Conditional Access scoped to specific applications won't trigger on spoofed client IDs.

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

OAuth client ID spoofing lets attackers test Entra accounts and stolen passwords without successful sign-ins, leaving application names blank in logs.

The Hacker NewsThe Hacker News

Zoom Warns of Critical Account-Takeover Flaw (CVE-2026-53412)

Zoom disclosed a critical (CVSS 9.8) improper-input-validation flaw in its Windows Desktop Client, VDI Client, and Meeting SDK that could let an unauthenticated party take over accounts via network access. Three additional high-severity local privilege-escalation flaws were also patched.

Key takeaways

• Affects Zoom Workplace for Windows before 7.0.0, VDI Client before 7.0.10/6.6.15/6.5.18, and Meeting SDK before 7.0.0.
• Found internally; no evidence of exploitation at disclosure. Apply the latest updates.

Zoom warns of critical account takeover vulnerability

Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts.

BleepingComputerBill Toulas

SonicWall SMA1000 Zero-Days Chained in the Wild (CVE-2026-15409 / -15410)

SonicWall confirmed two actively exploited, chainable SMA1000 zero-days — a max-severity authenticated-request flaw and a 7.2-rated command-injection flaw — that together take an attacker from zero access to full appliance compromise. Rapid7 dates first exploitation to June 22, roughly three weeks before disclosure, with ransomware as the likely goal.

Key takeaways

• Both added to CISA's KEV catalog; patch immediately and assume breach.
• SonicWall says patching alone is insufficient — hunt using the published IOCs.
• Continues a multi-year run of SonicWall device exploitation (17 KEV entries since late 2021, 10 tied to ransomware).

SonicWall customers under threat as attackers exploit 2 zero-days

Researchers said the vulnerabilities, which attackers are chaining together, were first exploited three weeks before the vendor disclosed and patched the defects.

CyberScoopMatt Kapko

URGENT: Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers

Progress ordered ShareFile customers to power off Windows servers running Storage Zone Controllers while responding to a "credible external security threat," temporarily disabling affected accounts. Only self-hosted controllers (typically internet-facing) are affected, not cloud-only accounts.

Key takeaways

• Ordering full offline shutdown rather than patching is a notably aggressive step.
• Confirm you're on 5.12.4+/6.x, but don't treat that as permission to restart.
• Treat internet-reachable controllers as possible incidents: preserve logs and check for unfamiliar .aspx files. (Progress later linked the threat to a ShareFile zero-day and began restoring access.)

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

Progress ordered ShareFile customers to shut down their Storage Zone Controllers while it investigates a credible external security threat.

The Hacker NewsThe Hacker News

Australia Warns of Global CMS Exploitation Campaign

The ACSC warned of a large-scale campaign deploying webshells on vulnerable CMS platforms and plugins worldwide, with many Australian SMBs already affected. Targeted products span WordPress plugins (Simple File List, Ninja Forms, Gravity Forms, WPvivid, ACF Extended, and more), Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE.

Key takeaways

• Webshells give persistent access for service disruption, credential theft, and lateral movement.
• The campaign may be AI-assisted, accelerating exploitation of emerging flaws.
• Defense: patch CMS/themes/plugins, remove unused components, enable auto-updates, make web directories read-only where possible, and monitor for unauthorized file creation.

Australia warns of global campaign targeting vulnerable CMS platforms

The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting vulnerable content management systems (CMS) and plugins.

BleepingComputerBill Toulas

13 Nations Warn on Russian FSB Targeting of Network Devices

A joint advisory from the U.S. and 12 partner countries warns that Russia's FSB Center 16 (aka Berserk Bear, Static Tundra, Dragonfly, and others) is breaching critical infrastructure by exploiting poorly configured and vulnerable networking devices — including old Cisco flaws (CVE-2008-4128, CVE-2018-0171) and the Smart Install feature.

Key takeaways

• Sectors hit include defense, communications, energy, financial services, government, and healthcare.
• Guidance: disable Cisco Smart Install, use stronger authentication/passwords, and monitor for unusual local-account logins.
• Coincided with EU/UK sanctions and EU attribution of a December 2025 attack on Poland's energy grid to the same group.

Officials once again warn defenders that Russian hackers are targeting network devices

State-sponsored attackers are targeting critical infrastructure networks in defense, communications, energy, finance, government and health care.

CyberScoopMatt Kapko

NSA Revives 'Tailored Access Operations' Name for Its Elite Hacking Unit

The NSA renamed its Office of Computer Network Operations back to Tailored Access Operations (TAO), reversing part of the 2016 "NSA21" reshuffle. The change is part of a leadership-driven reorganization aimed at facing evolving threats from China, Russia, and others.

Key takeaways

• TAO historically built custom implants and helped craft Stuxnet; it was exposed via the Shadow Brokers leaks a decade ago.
• The move restores TAO as a distinct identity to improve speed, creativity, and integration of developers and operators.

NSA revives ‘Tailored Access Operations’ name for elite hacking unit

NSA last week changed the moniker of its Office of Computer Network Operations (CNO) back to Tailored Access Operations (TAO), a name that is sure to elicit nostalgia among the broader digital community for a group with roots in the early 1990s.

The RecordMartin Matishak

DHS Network Intrusion Twice Ruled a False Positive Before Breach Confirmed

Per an internal readout seen by Nextgov/FCW, DHS analysts twice dismissed intruder activity on the Homeland Security Information Network (HSIN) as benign before a breach was declared June 4, letting hackers dwell for weeks and steal credential files. HSIN supports World Cup and America250 events.

Key takeaways

• Attackers altered files, ran malicious code via a legitimate web-server program, and deleted logs across two detection windows (May 15–24 and May 25–June 3).
• Attribution is undetermined; DHS says no classified networks were impacted and the system remains operational.
• Illustrates how a mistaken false-positive assessment can hand attackers significant additional dwell time.

DHS network intrusion was twice ruled a false positive before breach confirmed

Suspicious activity on the Homeland Security Information Network, which is being used to support World Cup games around the U.S., was first detected around mid-to-late May.

Nextgov/FCWDavid DiMolfetta

Pentagon Suspends CMMC Phase II Requirements

The DoD suspended CMMC Phase II — which would have required independent third-party (C3PAO) assessments against NIST SP 800-171's 110 controls, originally effective November 10, 2026 — pending a 60-day review, citing "prohibitive compliance costs and bureaucratic burdens" pushing firms out of the defense industrial base.

Key takeaways

• Level 1 self-assessment requirements remain in place; interim compliance runs on NIST SP 800-171 Rev 2 self-assessments plus select government-led reviews.
• Only ~1% of contractors felt fully prepared for Phase II audits (CyberSheath, Oct 2025).
• Experts caution the delay is breathing room, not permission to abandon compliance — the underlying legal obligation to protect CUI stands.

Pentagon Suspends CMMC Phase II Requirements for Defense Contractors

The US Department of Defense announced the immediate suspension of the CMMC Phase II requirements until further review

Infosecurity MagazineKevin Poireault

Treasury Sanctions First VPN for Abetting Ransomware

OFAC sanctioned First VPN Services and its alleged Ukrainian administrator (with the UK), plus a Belarusian national selling "cryptors," for providing anonymizing infrastructure to ransomware operators. Europol said 1VPNS appeared in virtually every recent major cybercrime investigation.

Key takeaways

• Victims tied to 1VPNS infrastructure include U.S. businesses, financial firms, hospitals, and municipal governments.
• The service advertised on cybercrime forums for a decade, touting non-cooperation with law enforcement.
• TRM Labs noted subscriptions were cheap ($58–$723), but named enabler-to-group payments on public chains leave a traceable trail.

Treasury sanctions First VPN Service, others for abetting ransomware gangs

The U.S. Treasury sanctioned First VPN (1VPNS) and its administrator for selling anonymizing infrastructure to ransomware operators targeting U.S. businesses.

CyberScoopTim Starks

23andMe Reaches $18M Settlement With 42 States Over 2023 Breach

A coalition of 42 state attorneys general reached an $18M settlement with 23andMe over the 2023 credential-stuffing breach that exposed 6.9M people's data, including genetic ancestry information — on top of a separate $46.75M class-action settlement.

Key takeaways

• The settlement requires new data-protection measures from the 23andMe Research Institute (the nonprofit that absorbed the assets after bankruptcy), including risk assessments and a data-security oversight board.
• Customers retain the right to delete personal data and discard genetic samples indefinitely.
• Underscores regulatory exposure for firms holding immutable, highly sensitive data — DNA can't be changed if leaked.

23andMe reaches $18 million settlement with states for massive breach

A coalition of 42 state attorneys general reached an $18 million settlement with 23andMe for cybersecurity failings that led to a data breach.

The RecordSuzanne Smalley