Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, significant data breaches, state-sponsored campaigns, and evolving malware tactics to keep you informed and secure in the ever-evolving digital landscape.
1. Australian Energy Giant Origin Confirms Customer Data Breach
Published: 2026-07-24
Origin Energy, one of Australia’s largest electricity and gas retailers (serving roughly 4.8 million customers), confirmed unauthorized access and disclosure of some customer data. Impacted information may include names, addresses, dates of birth, phone numbers, account details, and partial payment card or bank account numbers (last four digits of cards or last three of bank accounts). A person claiming responsibility alleged access to records of about 2 million customers and initially threatened to leak the data, though later reports suggested a possible private settlement. Origin is working with Australian authorities including the Cyber Security Centre and Federal Police, contacting affected customers, and engaging independent experts.
2. Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild (CVE-2026-16232)
Published: 2026-07-23
Check Point disclosed a critical authentication bypass vulnerability (CVSS 9.3) in its Security Management and Multi-Domain Management products that allows an unauthenticated remote attacker to obtain an application login token and gain full administrator privileges via SmartConsole. This enables changes to security policies and configurations. Exploitation requires the management server to be internet-exposed without Trusted Client IP restrictions. Check Point confirmed a handful of customers were affected, released a jumbo hotfix on July 22, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a July 25 remediation deadline for federal agencies. Mitigations include restricting Trusted Clients and firewall rules protecting management access.
3. Russian State-Supported Actors (Laundry Bear) Conduct Zero-Click / Half-Click Phishing Against Zimbra Users
Published: 2026-07-23
CISA, NSA, FBI, and international partners (including the UK NCSC) warned of ongoing activity by the Russian APT group known as Laundry Bear (also tracked as Void Blizzard). The group exploits a previously zero-day XSS vulnerability in Zimbra Collaboration Suite (CVE-2025-66376, patched November 2025 but still actively targeted on unpatched systems). The “beehive”/Ulej technique requires only viewing or previewing a malicious email in a vulnerable webmail client—no clicks needed—to execute JavaScript, steal the last 90 days of emails, passwords, contact lists, 2FA tokens, and create application passcodes that bypass MFA. Targets include Western government, defense, education, energy, media, and technology organizations, with earlier focus on Ukrainian entities.
4. Clop Ransomware Gang Targets PTC Windchill and FlexPLM in Data-Theft Extortion Campaign
Published: 2026-07-24
The Clop (Cl0p) ransomware group is actively exploiting a critical unsafe deserialization vulnerability (CVE-2026-12569, CVSS ~9.3) in internet-exposed PTC Windchill and FlexPLM product lifecycle management platforms. Exploitation enables unauthenticated remote code execution, deployment of JSP webshells, and exfiltration of sensitive engineering, manufacturing, and design data for extortion. PTC released patches starting mid-June; CISA later added the flaw to its KEV catalog. ReliaQuest and others observed active campaigns matching Clop’s established data-theft-first playbook. Organizations should patch immediately, restrict internet exposure, and hunt for indicators of compromise.
5. OpenAI Patches Critical “AgentForger” Flaw Allowing Rogue AI Agents via Single Phishing Link
Published: 2026-07-23/24
Zenity Labs disclosed AgentForger, a CSRF-style vulnerability in OpenAI’s ChatGPT Workspace Agents. A single malicious link could silently create, authorize, publish, and schedule an autonomous AI agent inside a victim organization’s workspace. The forged agent inherited the employee’s identity and connectors (Outlook, Slack, SharePoint, Google Drive, etc.), disabled approval prompts, and polled attacker-controlled email for ongoing “TASK” instructions. OpenAI fixed the issue within four days of responsible disclosure in early June (by removing the over-permissive URL parameter). The research highlights emerging risks of autonomous AI agents becoming persistent insider threats.
6. US Agencies Update Warning: Iranian-Affiliated Actors Targeting Siemens, Schneider Electric, and Rockwell ICS/PLC Devices
Published: 2026-07-22/23
CISA, FBI, EPA, and partners updated their advisory on Iranian-affiliated cyber actors (linked to groups such as CyberAv3ngers) targeting internet-connected programmable logic controllers. The campaign has expanded beyond Rockwell Automation (CompactLogix, Micro850) to include Schneider Electric (Modicon M340/BMX P34) and Siemens (S7-1200 series) devices, with possible targeting of other manufacturers. Attackers use legitimate vendor engineering software (Studio 5000, EcoStruxure Control Expert, TIA Portal) via leased infrastructure to download, modify, and delete project logic, manipulate HMI/SCADA displays, and cause operational disruption. Recommended actions include disconnecting PLCs from the internet and monitoring for anomalous connections on relevant ports.
7. North Korean BlueNoroff Operates Advanced Zoom/Teams Phishing Kit Targeting Crypto Users
Published: 2026-07-24
Researchers (including JUMPSEC) analyzed an active phishing kit used by the North Korean BlueNoroff group (linked to Lazarus). It impersonates Zoom and Microsoft Teams meetings via typosquatted domains, leverages compromised industry contacts and Telegram accounts, uses AI-generated faces, profiles victims’ crypto wallets via webcam/browser checks, and delivers malware through ClickFix-style “SDK update” lures. The kit demonstrates sophisticated social engineering and selective targeting of high-value crypto executives and holders.
8. New Dolphin X Infostealer/RAT Uses AI Profiler to Rank High-Value Victims
Published: 2026-07-22/23
Varonis Threat Labs analyzed Dolphin X, a Windows information stealer and remote access trojan advertised on cybercrime forums. It targets credentials and data from more than 300 applications (browsers, crypto wallets/extensions, password managers, cloud CLIs, SSH keys, .env files, DevOps secrets, etc.). Its standout “AI Profiler” feature scores infected users based on installed software, application usage, and browsing history, then delivers daily ranked summaries so operators can prioritize high-value targets (developers, admins, crypto users) among potentially thousands of infections.
Stay Vigilant
Cyber threats continue to evolve rapidly—combining state-sponsored zero-click techniques, AI-assisted malware and agents, critical infrastructure targeting, and large-scale data extortion. Prioritize timely patching of exposed management interfaces, PLM/ICS systems, and collaboration platforms; restrict internet exposure of sensitive services; monitor for anomalous AI agent activity; and maintain strong identity and email defenses. Subscribe for ongoing daily or weekly updates, and consider layered monitoring and automated patching tools appropriate to your environment. Stay safe online!