Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, supply-chain attacks, phishing innovations, nation-state campaigns, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
Published: 2026-08-04
The commercial phishing-as-a-service (PhaaS) toolkit Greatness has added support for device code phishing, abusing the legitimate OAuth 2.0 Device Authorization Grant flow to bypass multi-factor authentication (MFA) and seize control of accounts. It now combines this with adversary-in-the-middle (AiTM) token theft and OAuth consent abuse, targeting platforms including Microsoft 365, iCloud, Yahoo, and Google Workspace from a single operator panel.
2. Massive ChainDrop npm Supply-Chain Attack Infects Hundreds of Packages
Published: 2026-08-04
A self-propagating credential-stealing worm dubbed ChainDrop (a variant of the Shai-Hulud family) compromised hundreds of npm packages—reports range from over 400 to more than 1,300 versions—with a combined footprint of roughly 2 billion monthly downloads. The attack began with the compromise of a maintainer’s GitHub account for popular packages including Keyv and Cacheable; malicious preinstall scripts stole cloud, npm, GitHub, Kubernetes, and other credentials while spreading further and planting hooks in developer tools.
3. New XCSSET Variant Targets macOS Developers via Compromised Xcode Projects
Published: 2026-08-04
A new version of the XCSSET malware is actively targeting thousands of macOS users, primarily developers, by compromising Xcode projects and GitHub repositories. The campaign leverages supply-chain style infection of development environments to achieve persistence and data theft.
4. 77 Open VSX Extensions Found Harvesting Developer Information
Published: 2026-08-04
Researchers identified 77 malicious or impersonating extensions on the Open VSX marketplace that posed as legitimate developer tools while silently transmitting details about the systems and development environments on which they were installed. This highlights ongoing risks in open-source extension ecosystems used by many developers.
5. Hotel Wi-Fi Attacks by Midnight Blizzard Use Custom Malware to Breach Microsoft 365 Accounts
Published: 2026-08-03
Microsoft linked a global campaign targeting hospitality Wi-Fi networks and captive portals to the Russian threat actor Midnight Blizzard (APT29). Attackers deliver custom malware (including families such as CornFlake and ChocoShell) via fake updates and phishing pages to achieve persistent access, credential theft, surveillance, and exfiltration of Microsoft 365 tokens.
6. CISA Adds Exploited N-able N-central Flaw to Known Exploited Vulnerabilities Catalog
Published: 2026-08-04
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity authentication bypass vulnerability (CVE-2026-18577, CVSS 8.2) in N-able N-central to its KEV catalog after confirmed active exploitation. The flaw, stemming from incomplete prior patching, allows remote attackers to gain administrative access, pivot to managed endpoints, and establish persistence.
7. TP-Link Patches Omada ZTP Flaws Enabling Full Network Takeover
Published: 2026-08-04
TP-Link has released patches for 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada networking devices. Researchers showed these flaws can be chained with previously disclosed issues to achieve remote code execution and complete network compromise.
8. UK Police National Legal Database Breach Exposes Contact Details of Over 100,000 Officers and Staff
Published: 2026-08-04 (disclosure and reporting)
The Police National Legal Database (PNLD), used by forces across England and Wales, confirmed a data security incident detected in late July. Names, organizations, and work email addresses of more than 100,000 police officers, staff, criminal justice professionals, government partners, and some members of the public who used the “Ask the Police” service were accessed and published on the dark web by the group ExfilSquad. Passwords and operational case data were not reported as compromised, but the exposure significantly elevates phishing and social-engineering risks.
Stay Vigilant
Cyber threats continue to evolve rapidly—supply-chain worms, MFA-bypassing phishing kits, nation-state hotel Wi-Fi campaigns, and large-scale contact data exposures all underscore the need for layered defenses, rapid patching, phishing-resistant authentication, and continuous monitoring of developer environments and third-party dependencies. Subscribe to our newsletter for daily or weekly updates, review your npm/dependency hygiene, treat public and hotel networks as untrusted, and ensure critical management platforms (such as remote monitoring tools) are fully patched. Stay safe online!