Researchers at XLab detailed NadMesh, a Go based botnet spreading since early July that hunts exposed AI and automation services rather than raw computing power. A reconnaissance module queries a public device search engine for internet facing instances of tools like Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio, then works through more than twenty exploitation paths. What it ships home is credentials: cloud access keys pulled from environment variables, Kubernetes service account tokens, and the contents of files like .env and Docker configuration. Callable tool endpoints on AI integration servers sit at the top of the operator's priority list, above Kubernetes and exposed Docker APIs.
Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.
CISA has added two critical Fortinet FortiSandbox vulnerabilities to its exploited-vulnerabilities catalog and ordered federal agencies to patch them by July 19. Tracked as CVE-2026-39808 and CVE-2026-25089, both are operating-system command injection flaws that let an unauthenticated attacker run commands remotely with low complexity and no user interaction. Fortinet disclosed and fixed them in April and June, and threat intelligence firm Defused reported in-the-wild abuse of FortiSandbox flaws in June. FortiSandbox is a threat-detection appliance, and Fortinet gear sits at many network edges, so these devices are a recurring target in espionage and ransomware campaigns, making prompt patching important.
A vulnerability in the workflow automation platform n8n could let an attacker log in as another user without their password. Tracked as CVE-2026-59208, the flaw sits in n8n's Enterprise token exchange feature, which lets embedded deployments avoid a second login by accepting tokens from partner identity providers. Because the code did not properly bind an identity to its issuer, a valid token from one issuer that carried the identifier of a user under a different issuer would log the attacker in as that user. n8n shipped a fix on June 24, and there is no evidence of exploitation. The bug was found by an AI penetration-testing agent.
A researcher disclosed an unpatched flaw in internet-connected Shark robot vacuums that lets an attacker take control of other owners' units across the same cloud region. The certificate a vacuum uses to authenticate to its maker's Amazon cloud broker was never restricted to that one device, so a certificate pulled from a vacuum's flash memory can send root commands to any Shark vacuum the broker serves. That means watching the camera, driving the robot, reading the stored map of a home, and taking the Wi-Fi password in plaintext. No memory corruption or password guessing is needed. The researcher says the maker has had the report since March with no fix.
Coca-Cola disclosed in a securities filing that a ransomware attack on its Fairlife dairy subsidiary has disrupted operations and temporarily suspended production across the United States. The company said Fairlife detected unauthorized access to some systems, including production-related systems, and that it activated incident response and business continuity plans, brought in outside experts, and notified law enforcement. It says product quality and safety were not affected, and Canadian operations continue. The full impact is still being investigated, and no ransomware group has been named. Ransomware at food and beverage producers has caused weeks-long shutdowns and empty shelves in past incidents.
Group-IB detailed ClickLock, a macOS infostealer that coerces victims into handing over their login password. It arrives when a user is tricked into pasting a command into Terminal from a fake verification page, then shows a fake system dialog asking for the password. If the victim refuses, ClickLock begins killing core apps like Finder, the Dock, and browsers every 210 milliseconds, leaving only a password box on an unusable desktop, while also suppressing security notifications. Once the password is entered, it steals the Keychain, browser credentials, and cryptocurrency wallets and sends them to a Telegram bot. Group-IB counted at least 100 targets across 33 countries, over half in Europe.
Researchers described Agent Data Injection, a new twist on prompt-injection attacks against AI agents. Rather than smuggling in fake instructions, it exploits the weak separation between trusted and untrusted data so that attacker-supplied content is mistaken for the agent's own trusted data, using deliberately ambiguous delimiters the model misreads. In tests against web and coding agents, this let an attacker steer an agent's clicks or actions, succeeding up to half the time even against defenses that block ordinary instruction injection. Some approaches helped: tagging page elements with random, unguessable identifiers roughly halved success, while strict tracking of where data came from stopped it but sharply reduced how many tasks agents completed.
Cisco Talos detailed a financially motivated Russian group, tracked as UAT-11795, that spreads a new backdoor called Starland RAT through trojanized installers for legitimate software including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. Active since at least mid-2025 and mainly hitting US victims, the campaign likely uses fake verification lures to deliver the installers. Once run, the malware sets up persistence, tries to escalate privileges, and detects sandboxes, then steals browser data and more than 40 kinds of cryptocurrency wallets, profiles the machine, and maps Active Directory. It can take screenshots, run shell commands, inject shellcode, and pull down further payloads, giving the operator broad control.
Zoom has patched a critical vulnerability in its Windows software that could let an unauthenticated attacker take over user accounts over the network. Tracked as CVE-2026-53412 and rated 9.8, the flaw is an improper input validation issue affecting Zoom Workplace for Windows, the VDI client, and the Meeting SDK before version 7.0.0. Zoom found it internally, shared no technical details, and says there is no evidence of exploitation or public exploit code yet. Because the Windows client sits on millions of corporate desktops and the flaw needs no credentials or user interaction, it poses a broad risk, so applying the latest updates promptly is the key mitigation.
TrustStrike Labs