Researchers at Blackpoint Cyber detailed LabubaRAT, a previously undocumented Rust-based remote access trojan that disguises itself as NVIDIA software to blend into target systems. It arrives as an executable impersonating NVIDIA's container runtime, then profiles the host, identifying installed browsers and security products such as Microsoft Defender, CrowdStrike, and SentinelOne. From there it can run commands and scripts, capture screenshots, move files, and proxy traffic, and it communicates over multiple channels, including HTTPS, WebView2, and DNS tunneling, so access survives if one path is blocked. Its command server details are supplied at runtime, letting attackers reuse the same binary across campaigns, and there are signs it is sold as a service.
LastPass is warning that attackers are impersonating it and Bitwarden with fake security alerts to lure password-manager users to phishing sites. The emails, sent from look-alike domains rather than the real services, mimic corporate notices about updated security policies and push recipients to a page impersonating DocuSign. LastPass stresses its systems were not breached and the messages did not come from its infrastructure. Password managers are attractive phishing targets because compromising one can unlock every stored credential, and users often trust vendor-branded alerts. Related campaigns have pushed fake more-secure desktop apps that actually install remote-access tools, and similar lures have impersonated other password managers.
CISA has added a Cisco IOS vulnerability to its Known Exploited Vulnerabilities catalog after confirming it is being used in real attacks, requiring federal agencies to patch it under a binding deadline. Cisco IOS and IOS XE run the routers and switches behind many enterprise and service-provider networks, so a flaw here can give attackers a foothold deep in the network path. The listing lands amid heightened warnings, including a joint US-and-allies advisory this week urging better router hygiene against Russian state-sponsored targeting of network devices. Network gear is attractive because it often sits unmonitored, stays online for years, and rarely runs endpoint security; timely patching is the main defense.
Discount supermarket chain Lidl has notified online shop customers in Germany, Belgium, and the Netherlands of a data breach that stemmed from a hack at one of its service providers rather than Lidl's own systems. According to the company, the exposed information involves customer contact and order-related details, while payment card data was not affected. The incident is another example of third-party or supply-chain risk, where attackers compromise a vendor to reach a larger brand's customer data. Even without financial data, the exposed details can fuel convincing phishing and scams that impersonate Lidl, especially messages referencing real orders to make fraudulent requests look legitimate to shoppers who recently used the online shop.
Researchers demonstrated MemGhost, an attack that uses one email to plant a false, persistent memory in an AI personal assistant with inbox access. Because these assistants keep notes about the user and reload them every session, a crafted message can trick the agent into saving a fabricated fact while keeping its reply innocuous, so the tampering goes unnoticed and steers later answers. The team trained an attacker model to write such emails automatically, reporting high success against open-source and commercial agents and showing it transfers across memory backends and survives several defenses. Unlike earlier one-shot injection that leaked data only in the moment, MemGhost's memory persists long after the email is gone.
Jamf detailed CrashStealer, a macOS infostealer delivered through a signed, Apple-notarized app called Werkbit that passes Gatekeeper, since it carried a valid developer ID before Apple revoked it. Distributed as a disk image and gated behind a meeting PIN so it is served only to targeted visitors, the malware validates the victim's login password locally, then harvests broadly from browsers, cryptocurrency wallets, password managers, and the keychain, encrypting the loot before sending it out. It persists by copying and re-signing itself. There is no zero-click stage: a victim still runs the app and enters their password, but the notarized delivery and careful targeting make it more convincing than typical Mac stealers.
Google and Microsoft removed ModHeader, a header-editing browser extension popular with developers, with about 1.6 million installs, after researchers at Stripe OLT found a hidden browsing-history collector inside the official, signed store version. The collector was dormant, gated off by an empty allow-list, and no evidence has emerged that it ever sent data, but its presence in a trusted, signed extension is the concern. Its design frustrated automated review: the data was encrypted, the upload was switched off so sandboxes saw nothing leave, and malicious code was blended into a legitimate codebase, so scanners rated it low risk. It is a reminder that a store signature proves origin, not safe behavior.
A phishing operator left a Python web server exposed with directory listing on, letting researchers at Lexfo lift the entire toolkit and pivot to two more operators running three Microsoft 365 phishing campaigns. Each used a custom fork of the open-source Evilginx proxy to steal live session cookies and tokens, defeating multi-factor authentication by relaying the real login. The largest campaign ran over a year, logging 218 captured accounts, mostly corporate mailboxes, and a token file left in a public repository held 97 live Microsoft tokens. The report stresses two different MFA-bypass methods appeared, one proxying the real login and one abusing the device-code flow, which require different defenses to stop.
Nihon Kotsu, Japan's largest taxi operator, shut down internal systems after a cyberattack, disrupting parts of its operations while it investigates and recovers. Precautionary shutdowns like this are a common response to intrusions such as ransomware, aimed at containing an attacker and limiting damage while forensic work proceeds, though they also interrupt normal business. The incident fits a broader pattern of attacks against transportation and logistics providers, whose real-time operations and large customer bases make downtime costly and pressure on victims high. Full details, including whether customer data was accessed, were not yet available, but the disruption underscores how operational technology and business systems in transport are increasingly targeted.
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, both in popular Joomla extensions and both allowing attackers to upload dangerous files. The iCagenda event calendar flaw (CVE-2026-48939, rated 10.0) lets an attacker upload arbitrary files through its attachment feature, ending in PHP code execution, while the Balbooa Forms flaw (CVE-2026-56291) allows unauthenticated upload of executable files leading to full remote code execution. Federal agencies were ordered to fix them by July 13. The additions line up with a broader campaign, recently flagged by Australia's cyber agency, in which attackers scan the internet and exploit known content-management-system and plugin flaws to plant web shells on vulnerable sites.
TrustStrike Labs