Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, data breaches, ransomware developments, and defensive advancements to help you navigate the rapidly evolving digital threat landscape. Cybersecurity remains a high-stakes domain influenced by state actors, cybercriminals, AI integration, and supply chain complexities.
1. Russian Espionage Group Exploits Zimbra Zero-Day for Email Theft and 2FA Codes
Published: July 23, 2026
The FBI, CISA, NSA, and international allies warned of “LAUNDRY BEAR” (also known as Void Blizzard), a Russian state-backed group exploiting a Zimbra Collaboration flaw (CVE-2025-66376) since at least July 2025. The “view-based” attack uses malicious JavaScript in emails to steal recent emails, address books, passwords, and 2FA codes from unpatched systems. Organizations in government, defense, and commercial sectors are urged to patch immediately.
2. Chaos Ransomware Uses msaRAT to Hide C2 Traffic via Headless Chrome/Edge Browsers
Published: July 23, 2026
Cisco Talos detailed how the Chaos ransomware group deploys msaRAT, a Rust-based implant that routes command-and-control communications through the victim’s own Chrome or Edge browser in headless mode using WebRTC and services like Twilio. This blends malicious traffic with legitimate browser activity, complicating detection.
3. New RefluXFS Linux Kernel Flaw (CVE-2026-64600) Allows Local Root Privilege Escalation
Published: July 23, 2026
A nine-year-old race condition in the XFS filesystem enables unprivileged local users to overwrite root-owned files and gain persistent root access on default installs of RHEL, Fedora, and Amazon Linux. Qualys demonstrated exploitation; patches are available.
4. China-Nexus JadeProx Group Uses New TriBack Loader in Espionage Attacks
Published: July 23, 2026
Group-IB exposed JadeProx operations targeting government, healthcare, and education sectors in Asia and Latin America. An OPSEC error on an Alibaba Cloud server revealed the new TriBack Loader used in intrusions against hospitals and foreign ministries.
5. Hackers Abuse Notepad++ Plugins for Stealthy Malware Delivery
Published: July 23, 2026
Ukraine’s CERT uncovered campaigns bundling legitimate Notepad++ with a malicious “LunchPoke” utility disguised as a plugin to establish persistence. This supply-chain-like tactic evades traditional detection.
6. Dolphin X Malware Leverages AI to Profile and Prioritize High-Value Victims
Published: July 23, 2026
This new remote access trojan (RAT) steals credentials from over 300 apps and uses AI to score infected users for targeted follow-up attacks. It highlights the growing sophistication of AI-assisted cybercrime tools.
7. GitHub Actions Abused in Large-Scale Campaign Targeting cPanel/WHM Servers
Published: July 23, 2026
Attackers compromised Packagist packages to weaponize GitHub repositories, scanning for and exploiting cPanel/WHM instances to steal cloud credentials. This turns open-source infrastructure into distributed attack platforms.
8. Google Introduces Selfie Video Recovery for Locked Accounts; Other Updates
Published: July 23, 2026
Google rolled out a new “selfie video” feature requiring guided head movements for identity verification during account recovery. Separately, reports emerged of Australian energy provider Origin Energy suffering a data breach exposing customer PII, and ongoing concerns around AI-driven attacks on US companies.
Additional Context and Implications
These incidents underscore several trends: state-sponsored espionage (Zimbra, JadeProx) targeting email and critical sectors; evasion techniques blending with legitimate tools/browsers; AI’s dual role in both defense and offense; and supply chain vulnerabilities in software ecosystems like GitHub, plugins, and kernels. Edge cases include unpatched legacy systems amplifying risks and the challenges of detecting browser-routed C2 traffic. Organizations should prioritize patching, monitor for anomalous browser behavior, enforce least-privilege access, and invest in AI-aware threat detection.
Stay Vigilant Cyber threats evolve daily with geopolitical tensions and technological advances. Subscribe to our newsletter for more roundups, and implement proactive measures like multi-factor authentication, regular audits, and employee training. Tools for vulnerability scanning and endpoint protection are essential. Stay safe online!