Group-IB detailed ClickLock, a macOS infostealer that coerces victims into handing over their login password. It arrives when a user is tricked into pasting a command into Terminal from a fake verification page, then shows a fake system dialog asking for the password. If the victim refuses, ClickLock begins killing core apps like Finder, the Dock, and browsers every 210 milliseconds, leaving only a password box on an unusable desktop, while also suppressing security notifications. Once the password is entered, it steals the Keychain, browser credentials, and cryptocurrency wallets and sends them to a Telegram bot. Group-IB counted at least 100 targets across 33 countries, over half in Europe.
Researchers described Agent Data Injection, a new twist on prompt-injection attacks against AI agents. Rather than smuggling in fake instructions, it exploits the weak separation between trusted and untrusted data so that attacker-supplied content is mistaken for the agent's own trusted data, using deliberately ambiguous delimiters the model misreads. In tests against web and coding agents, this let an attacker steer an agent's clicks or actions, succeeding up to half the time even against defenses that block ordinary instruction injection. Some approaches helped: tagging page elements with random, unguessable identifiers roughly halved success, while strict tracking of where data came from stopped it but sharply reduced how many tasks agents completed.
Cisco Talos detailed a financially motivated Russian group, tracked as UAT-11795, that spreads a new backdoor called Starland RAT through trojanized installers for legitimate software including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. Active since at least mid-2025 and mainly hitting US victims, the campaign likely uses fake verification lures to deliver the installers. Once run, the malware sets up persistence, tries to escalate privileges, and detects sandboxes, then steals browser data and more than 40 kinds of cryptocurrency wallets, profiles the machine, and maps Active Directory. It can take screenshots, run shell commands, inject shellcode, and pull down further payloads, giving the operator broad control.
Zoom has patched a critical vulnerability in its Windows software that could let an unauthenticated attacker take over user accounts over the network. Tracked as CVE-2026-53412 and rated 9.8, the flaw is an improper input validation issue affecting Zoom Workplace for Windows, the VDI client, and the Meeting SDK before version 7.0.0. Zoom found it internally, shared no technical details, and says there is no evidence of exploitation or public exploit code yet. Because the Windows client sits on millions of corporate desktops and the flaw needs no credentials or user interaction, it poses a broad risk, so applying the latest updates promptly is the key mitigation.
Security firm Mindgard disclosed an unpatched flaw in Cursor, the widely used AI code editor, that runs code automatically when a developer opens a malicious repository on Windows. When loading a project, Cursor looks for a Git binary in several places, including the workspace itself, so a file named git.exe planted in the repository root gets executed with no click, prompt, or warning, and it re-runs on a cadence while the project stays open. In a proof of concept, a renamed Windows Calculator launched on its own. Mindgard reported it in December and went public after seven months with no fix, so there is no patch and no CVE, only workarounds.
Less than an hour after Microsoft's July Patch Tuesday, the researcher known as Nightmare Eclipse published a proof-of-concept for LegacyHive, a Windows privilege-escalation flaw that works on fully updated systems. It abuses the Windows User Profile Service to let a standard user load another user's registry hive, including an administrator's, into their own profile, a useful stepping stone for an attacker who already has a foothold. There is no CVE, advisory, or patch. The public proof-of-concept was deliberately stripped down, needing extra credentials, but the researcher says the original had no such limits. Given this researcher's flaws have been weaponized quickly before, defenders should not wait for a fix.
Trend Micro documented a Russian-speaking attacker who used Google's open-source Gemini CLI as a hands-on hacking assistant to build and run a small botnet. Across more than 200 sessions, a jailbroken Gemini took the role of an "authorized pen tester," saved stolen credentials, and even suggested improvements dozens of times. Working from a roughly 5KB set of plain-text files holding a jailbreak prompt and a command-and-control playbook, the AI handled the operation through natural-language requests: at one point it migrated the entire command server to a new host with a Cloudflare tunnel in about six minutes and debugged its own errors. The malware itself was crude; the AI was the force multiplier.
Attackers backdoored several widely used @asyncapi npm packages, together drawing around three million weekly downloads, by hijacking the project's GitHub Actions build pipeline rather than stealing a maintainer's npm token. Because the project's own release workflow published the malicious versions, they carried valid provenance signatures, which prove where a package came from but not that the code was trustworthy. The payload was hidden in normal runtime files behind trailing whitespace and ran when the module was imported, not on install, so defenses aimed at install scripts missed it. Once loaded, it fetched an encrypted second stage, stole credentials and cloud and registry tokens, and planted persistence, even in developer tool configuration files.
Kaspersky detailed OkoBot, a Windows malware framework active since 2025 whose standout module, SeedHunter, tricks hardware-wallet owners into giving up their recovery phrase. On an infected PC, the malware waits for wallet software like Ledger Live, Ledger Wallet, or Trezor Suite, sometimes until the device is plugged in, then displays a malicious page asking for the seed phrase from inside the wallet's own genuine app. Because the surrounding application is the real one the victim installed, the request looks legitimate, but anyone who types in the phrase hands over full control of their funds. Kaspersky counted hundreds of victims across more than 25 countries, and the framework remains active.
Microsoft shipped its largest Patch Tuesday on record, fixing 622 vulnerabilities, more than triple June's previous high, and two of them are already being exploited. Both live bugs are privilege-escalation flaws in identity and collaboration infrastructure rather than flashy remote code execution: CVE-2026-56164 in on-premises SharePoint Server lets an unauthenticated attacker escalate over the network, and CVE-2026-56155 in Active Directory Federation Services lets an authenticated attacker gain higher privileges, both found by incident responders inside real attacks. A third zero-day, a BitLocker bypass needing physical access, was publicly disclosed but not exploited. The sheer volume, driven partly by AI-assisted bug finding, makes prioritizing by exploitation status, not severity score, essential this month.
TrustStrike Labs