Breach of the Day

A hacker is claiming to have stolen 3.6 million account records tied to Microsoft Azure — Microsoft's cloud computing platform used by businesses worldwide — from a number of large organisations, according to Bleeping Computer.

The details available are limited, but the scale of the claim is significant. Azure underpins the login infrastructure, storage, and internal tools for companies across every major industry. If the records are genuine, the exposed data could include account credentials and other identifiers that attackers use to gain further access — think of it like getting a master key list for a building, then working out which doors each key opens.

What is not yet confirmed: whether the data has been verified, which companies are affected, or exactly how the records were obtained.

That uncertainty is not a reason to wait. If you use any service that runs on Azure infrastructure — which covers a broad sweep of enterprise software — now is a good time to change passwords for work accounts, enable multi-factor authentication (MFA) where it is not already active, and watch for any unexpected login alerts.

What to do: Change passwords on any work or business accounts, enable MFA on everything you can, and check your email for breach notification messages over the coming days.

Salesforce and ServiceNow are business software platforms used by thousands of companies to manage customer records, support tickets, and internal workflows. According to Help Net Security, researchers at security firm Reco uncovered a campaign — dubbed City-Forum — where an unknown party spent 17 months siphoning records from these portals worldwide.

What makes this story unusual is that nothing was broken into. The portals functioned exactly as designed. The attacker appeared to operate through a domain registered back in 2002, since abandoned, now pointing to a rented server in Germany. From there, someone was methodically pulling records out of corporate portals, one query at a time.

Think of it like a janitor who was never removed from the building's keycard system. No alarms, no broken locks — just access that should have been revoked long ago.

The same week, Framework — the company behind repairable, upgradeable laptops — confirmed attackers exploited a zero-day vulnerability (a flaw with no patch available at the time of attack) in Metabase, a business intelligence tool used to analyse data. Customer names, email addresses, phone numbers, physical addresses, and login IP addresses were accessed. Payment details were not.

What you should do: If you use Salesforce or ServiceNow at work, ask your IT team when user access was last audited. Old accounts with lingering access are a common and overlooked entry point.

RingCentral, a cloud-based business communications platform used by over 600,000 companies for calls, messaging, and voicemail, confirmed a breach after the ShinyHunters extortion group claimed responsibility and made good on their threat, according to Bleeping Computer.

The attackers got in through a social engineering campaign (manipulating people rather than breaking code — tricking employees into handing over access). From there, ShinyHunters claimed to have pulled 623GB of data. When RingCentral refused to pay a ransom to have it destroyed, the group published 280GB of that data on a dark web leak site.

Have I Been Pwned, the free breach-notification database, analysed the leaked files and confirmed records for 1.6 million accounts — including names, email addresses, phone numbers, and physical addresses.

ShinyHunters is not new to this. The group has been linked to breaches at dozens of Snowflake customers, Salesforce-connected platforms, and recently, organisations hit through an Oracle PeopleSoft zero-day (a previously unknown flaw with no available fix at the time of exploitation). The pattern is consistent: target a third-party integration, steal at scale, demand payment, publish when refused.

RingCentral says the core platform was not disrupted and that affected customers are being contacted directly.

What you should do: Visit Have I Been Pwned and search your email address to find out whether your data appeared in this or any other known breach. If you use RingCentral, watch for phishing emails using your personal details — attackers now know your name, email, and phone number.

VMware vCenter Server is centralised management software that IT teams use to control entire fleets of virtual machines and servers from one place. According to Bleeping Computer, a critical flaw in its Syslog component is being actively exploited in the wild.

The vulnerability, CVE-2026-59310, is a directory traversal flaw (a weakness that lets an attacker navigate to files on a server they are not permitted to access) in vCenter's Syslog server. An attacker with basic network access, no login required, can trigger it to run any code they choose.

Broadcom disclosed and patched the flaw on July 29. By August 3, attackers were already in. By August 5, over 340 compromised servers had connected to attacker-controlled infrastructure. The final count reached 361 victim IP addresses across 47 countries.

Once inside, the attackers deployed reverse_ssh, an open-source tool that creates an outbound connection back to the attacker. Because the connection goes out rather than in, it slips past firewalls watching for incoming threats.

Incident response firm QUIRSO believes an advanced persistent threat (APT) group is behind the campaign. Broadcom has released no workarounds. A patch is the only fix.

What to do: If your organisation runs VMware vCenter, update immediately to version 9.1.0.0300, 9.0.2.0100, 8.0 U3k, or 8.0 U2f depending on your branch.

North Korea's Lazarus Group has been caught running a new wave of Operation Dream Job, a long-running campaign, according to Check Point Research, that tricks professionals in defence and aerospace into thinking they are being headhunted by companies like Lockheed Martin and Enveil. Targets in France, Germany, Brazil, and India received convincing LinkedIn messages from fake recruiters before being handed malicious files.

The attack runs two parallel infection paths. In the first, victims download what looks like a legitimate PDF viewer called SecurityPDF. When a specially marked document is opened through it, the app quietly loads a backdoor called Troy directly into memory, giving attackers remote access and 17 commands to control the machine. In the second path, victims download an encrypted archive that triggers a DLL side-loading chain (where a legitimate application is tricked into loading a malicious code library instead of a legitimate one). This installs a downloader called MISTPEN, which communicates back to attacker-controlled servers through Microsoft OneDrive before deploying a second backdoor called ForestTiger.

Both paths eventually exploit CVE-2026-68820 (CVSS 7.0, High), a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock. Think of it like a thief who already slipped inside your building using a borrowed keycard, then finds a filing cabinet exploit to print themselves a master key for every room. Once triggered, the attacker jumps from limited access to full SYSTEM-level control of the machine, the kind of control normally reserved for the operating system itself.

What you should do: Apply Microsoft's August 2026 Patch Tuesday updates now. A device restart is required — there is no workaround.

Two fake versions of LiteLLM — an open-source tool used to connect apps to AI model providers like OpenAI and Anthropic — were uploaded to PyPI (the public Python package registry) on March 24, 2026, according to The Hacker News. They stayed live for roughly 40 minutes before being pulled. In that window, any system that installed them got a lot more than an AI gateway.

The malicious versions (1.82.7 and 1.82.8) included a file that ran automatically whenever Python started — not just when LiteLLM was imported. It silently harvested cloud API keys, SSH keys, Kubernetes tokens (credentials for container orchestration systems), and database passwords, then sent everything to an attacker-controlled server.

Threat intelligence firm CloudSEK analysed a dataset of roughly 434,000 captured files and identified over 2,500 organisations potentially exposed, including NVIDIA, Cisco, Deloitte, and FedEx. That is not a confirmed victim list — it is a map of whose credentials may have been taken. There is an important difference. High-confidence matches required the organisation's domain to appear in the captured data; medium-confidence matches relied on repository namespaces alone.

The campaign is linked to a wider supply-chain operation Google tracks as UNC6780. The FBI issued a formal warning in July 2026 advising that attackers are likely to use stolen credentials long after the initial theft — a long-lived static key copied in March could still work today.

What to do: If your team uses Python and installed anything from PyPI on March 24 before 16:00 UTC, treat that environment as compromised. Rotate all cloud credentials, SSH keys, and API tokens immediately. The FBI's guidance applies broadly: move away from long-lived static secrets toward short-lived temporary credentials wherever possible.

A Polish combined heat and power plant lost a steam turbine and its water treatment system in December 2025 after attackers found an unexpected bridge between two entirely separate facilities. CERT Polska disclosed the incident on August 8 after three months of investigation.

The entry point was not the plant itself. It was a wind farm next door — or rather, the FortiGate firewall and VPN concentrator protecting the wind farm's network. That device was internet-facing and allowed accounts to connect without multi-factor authentication. Once inside, the attacker had administrative access to every network segment the VPN could reach.

Here is where it gets novel. The wind farm and the CHP plant shared a private APN (a dedicated cellular data network, think of it as a private mobile broadband lane reserved for grid equipment). That APN was configured to allow any device on the network to talk to any other device — no barriers. The attacker used that open lane to pivot from the compromised wind farm into the power plant's OT (operational technology, the systems that physically control industrial equipment) environment. A WAGO controller inside the plant still had its factory-default admin credentials set, and that was all it took to reach the turbine controls.

CERT Polska calls this the first confirmed real-world attack delivered through a private APN. Investigators found no exploitable software vulnerability to blame — the path in was entirely made of bad configurations, default passwords, and missing access controls working exactly as set up.

The plant serves roughly 50,000 residents. Recovery began that morning while the attackers were still inside, and customers lost no heat or power.

What you should do: If your organisation connects remote equipment over a private cellular APN, treat that network as untrusted, enable client isolation so devices cannot communicate freely with one another, change every default credential on internet-reachable hardware, and require multi-factor authentication on any VPN that touches operational systems.

VS Code is a free code editor made by Microsoft, used by millions of developers worldwide. A pair of malicious extensions named "Solidity Pro" lurked inside it, quietly draining credentials, crypto wallets, and API keys from anyone who installed them, according to The Hacker News.

The extensions targeted Ethereum developers by impersonating legitimate coding tools. Early versions quietly contacted external servers to download and run hidden code. Later versions upgraded to full information-stealing malware, capable of harvesting browser profiles, cryptocurrency wallet vaults, SSH private keys, GitHub and GitLab tokens, AWS credentials, OpenAI API keys, and more. Everything collected was sent directly to the attackers via a Telegram bot.

What made this campaign particularly difficult to catch was deliberate patience. The malicious code sat dormant for hours or days after installation. By the time it activated, both the user and automated security scanners had already moved on. The attackers also released clean versions in between to build trust, making detection even harder.

The extensions have been removed from the Open VSX marketplace, but the GitHub repository for one of them remains publicly accessible.

This campaign shares tactics with WhiteCobra, a known threat group previously linked to distributing credential-stealing malware through VS Code extensions.

What you should do: If you have installed any Solidity-related VS Code extensions recently, remove them immediately and audit your installed extension list. Rotate any API keys, tokens, or passwords stored in your development environment. Check your crypto wallet for unauthorised transactions.

TrueConf is a video conferencing platform popular in Russian enterprise and government organisations as an on-premise alternative to Zoom or Microsoft Teams. According to Bleeping Computer, the hacktivist group Head Mare broke into unpatched TrueConf servers and replaced the software installer employees would download with a malicious version carrying a backdoor (a hidden program that gives attackers persistent, remote access to your system).

The attackers got in through TCP port 4307, which TrueConf leaves open by default and requires no login to access. From there, they used two internal flaws to escape the server's sandboxed environment (an isolated container designed to keep processes from affecting the wider system) and reach the underlying operating system with the highest possible privileges.

Once inside, they planted a web shell (a browser-accessible remote control panel hidden on the server) and swapped the legitimate TrueConf client installer for one bundled with the PhantomCore backdoor. Every employee who connected and downloaded what looked like a routine update was, in fact, installing malware. A second backdoor, PhantomGraph, ran hidden inside two files and received commands through a Microsoft OneDrive account — making its traffic harder to spot.

The flaws affect TrueConf Server versions 5.3.x, 5.4.x, and 5.5.x. Patches were released on June 18 in versions 5.3.9, 5.4.9, and 5.5.5. Kaspersky notes that even employees connecting to a partner organisation's compromised TrueConf server could pick up the infected installer.

What to do: If your organisation runs a TrueConf server, upgrade to version 5.3.9, 5.4.9, or 5.5.5 immediately. If you recently installed a TrueConf update, verify the installer's digital signature — the malicious versions are unsigned.

Switzerland's Federal Office for Information Technology and Telecommunication (BIT) confirmed that attackers exploited vulnerabilities in its Microsoft SharePoint servers — the document management and collaboration platform used across the Swiss federal government — compromising roughly 200 employee accounts, according to Bleeping Computer.

Security analysts spotted the unusual activity on 28 July. BIT confirmed the breach three days later, then immediately blocked external access to SharePoint, patched the relevant flaws, and reset all affected passwords.

The likely culprits are two vulnerabilities Microsoft fixed in its July 2026 Patch Tuesday release. The first, CVE-2026-56164, is a privilege escalation flaw (a bug that lets an attacker gain more access than they should have). The second, CVE-2026-50522, is a remote code execution vulnerability — meaning an attacker who exploits it can run their own commands on the server. BIT has not confirmed which flaw was used.

The good news: no evidence of data theft beyond the login credentials, and BIT says sensitive or confidential data was not permitted on that SharePoint environment. Servers are being rebuilt from scratch as a precaution.

The uncomfortable truth: the patches were already available. BIT just had not applied them yet when the attackers arrived.

What you should do: If your organisation uses Microsoft SharePoint, confirm July's Patch Tuesday updates have been applied. If external access to SharePoint is not required, restrict it at the network level. If it is required, block it temporarily until patching is confirmed.