Breach of the Day

Security researchers at ThreatBook and Imperva have confirmed active exploitation attempts targeting a critical vulnerability in Fastjson, according to The Hacker News. Fastjson is a popular Java library built by Alibaba that converts data between JSON format and Java objects. It is widely used in enterprise web applications across finance, healthcare, and retail.

The flaw, tracked as CVE-2026-16723, allows an attacker to send a crafted JSON request to a vulnerable application and execute arbitrary code on the server without needing to log in. The attack requires no special setup on the attacker's side — no pre-existing access, no special tools.

Here is the uncomfortable part: as of July 25, Alibaba had not released a patched version of Fastjson 1.x. The latest release, version 1.2.83, remains vulnerable. Imperva observed exploitation attempts hitting organisations in financial services, healthcare, and retail, primarily in the United States, with activity also recorded in Singapore and Canada.

While neither firm has confirmed a successful compromise of a real-world target, the activity is real and the window of exposure is open.

What you should do: If you or your team maintain Java applications, check whether Fastjson 1.2.68 through 1.2.83 is a dependency — direct or transitive. Until a patch exists, enable SafeMode by adding -Dfastjson.parser.safeMode=true to your startup configuration. The longer-term fix is migrating to Fastjson2, which is not affected by this flaw.

North Korea's BlueNoroff hacking group has built what cybersecurity firm JUMPSEC calls a full victim acquisition platform, according to The Hacker News. It's not just a phishing page. It's a pipeline.

The attack begins when a target receives a Calendly invite from someone they already know and trust — because that contact's Telegram account has already been hijacked. The link leads to a convincing fake Zoom page that asks for camera permissions. Grant them, and your webcam feed goes straight to the attackers.

Here's the twist: before any malware is deployed, the kit quietly scans your browser for installed cryptocurrency wallets. Only high-value targets get the full treatment. Everyone else is catalogued for later.

When the fake meeting begins, the victim sees a pre-recorded AI-generated video of a familiar face — composited using ChatGPT-generated headshots over real body footage captured from previous victims. The "your mic isn't working" message is fake. The Zoom SDK update prompt it leads to is the malware delivery step.

Every compromised Telegram account feeds the next attack. One victim becomes the lure for their own contacts.

The campaign targets Windows and macOS users in the cryptocurrency industry. If you receive an unexpected meeting invite, even from a known contact, verify it through a separate channel before clicking anything.

Zimbra is an email and collaboration platform used by governments and businesses worldwide. For at least five months in 2025, a Russian state-backed espionage group — tracked as TA488 by Proofpoint and CL-STA-1114 by Palo Alto Networks' Unit 42 — read Western mailboxes through a then-unknown flaw in Zimbra's webmail client, according to a joint advisory from the NSA, CISA, and partner agencies.

The flaw, CVE-2025-66376, is a stored cross-site scripting (XSS) vulnerability — a technique where attackers inject malicious code into a webpage that then runs inside another user's browser session. In this case, attackers sent crafted HTML emails that executed JavaScript the moment the message rendered. The victim did not need to click anything. Unit 42 calls this zero-click (requiring no interaction from the target whatsoever).

Once triggered, a payload called ZimReaper went to work silently. It stole saved passwords, two-factor recovery codes, and 90 days of the victim's emails, then packaged and sent the whole archive to attacker-controlled servers. It also created an app-specific password inside Zimbra, granting the attackers persistent email access without triggering two-factor prompts.

Targets spanned government, defence, transportation, and financial organisations in NATO member states, Ukraine, and the US — including nuclear installations.

Zimbra patched the flaw on 6 November 2025. CISA added it to its Known Exploited Vulnerabilities catalogue in March 2026.

What you should do: If your organisation uses Zimbra Collaboration, verify you are running version 10.0.18 or 10.1.13 or later. Patching closes the hole — but it does not undo any access already gained. Check for unexpected app-specific passwords inside Zimbra settings and rotate credentials for any account that may have been exposed.

Check Point, which makes firewall and network security software used by enterprises worldwide, has patched a critical authentication bypass flaw that attackers were already exploiting, according to The Hacker News.

The vulnerability, CVE-2026-16232 (CVSS 9.3, Critical), lives inside the login process of SmartConsole, the management interface administrators use to control Check Point security systems. An attacker needed no username or password. Instead, they could reach across the internet, grab a valid login token, and walk straight in with full administrative rights.

Once inside, they could rewrite security policies, change firewall rules, and reconfigure defences entirely. Think of it as someone not just picking your lock, but then being handed the keys to every room in the building.

The catch: exploitation only works when the Management Server is exposed directly to the internet without IP restrictions in place. Check Point says a small number of customers were targeted and have been notified.

Patches are now available via the July 22 Jumbo hotfix. Two related flaws were patched at the same time: CVE-2026-62144 (CVSS 9.3), which also allows unauthenticated attackers to run administrative commands remotely, and CVE-2026-62145 (CVSS 7.5), which lets a low-privilege user escalate to root-level control.

What to do: If your organisation runs Check Point Security Management, apply the July 22 Jumbo hotfix immediately. Restrict Management Server access to trusted IP addresses only, and place it behind a firewall rather than exposing it directly to the internet.

German and US law enforcement have taken down the infrastructure behind Kratos, according to The Hacker News, seizing more than 200 servers and arresting the Indonesian developer believed to have built and operated it. German investigators describe it as one of the most widely deployed criminal phishing kits in the world.

The numbers are not small. Around 1,800 paying customers used Kratos to run approximately 15,000 phishing campaigns every month, targeting hundreds of thousands of victims across more than 30 countries since late 2024.

What made Kratos genuinely dangerous was its session-stealing capability. Most phishing kits grab your password and stop there. Kratos went further by also capturing the session cookie — the small file your browser holds after a successful login that tells Microsoft's servers you are already authenticated. An attacker holding that cookie can walk straight into your account without ever needing your password or your two-factor code, because to Microsoft's systems, they look exactly like you.

The kit offered two modes. A basic version harvested credentials only. The advanced version used an adversary-in-the-middle attack (where a hidden proxy sits between you and Microsoft, relaying your real login while quietly copying everything, including the live session) to capture that post-login cookie in real time. The whole thing was sold as a subscription service, paid in cryptocurrency, managed through a Telegram shop — low skill required.

Microsoft tracked the same kit under the name SneakyLog and caught a campaign in February targeting about 100 US organisations in manufacturing, retail, and healthcare, using fake W-2 tax documents with personalised QR codes.

The servers are offline. The roughly 1,800 customers and the kit code they already downloaded are not.

What you should do: If Microsoft contacts you about this campaign, do not just reset your password. Check whether any active sessions need to be revoked — especially for Microsoft 365 accounts. You can do this under your Microsoft account security settings at account.microsoft.com.

Palo Alto Networks' GlobalProtect VPN software — a product used by over 70,000 organisations worldwide, including 90% of Fortune 10 companies — has a critical authentication bypass flaw that the Qilin ransomware gang is now weaponising at scale, according to Arctic Wolf.

The flaw, CVE-2026-0257, lets an attacker skip the login process entirely and connect to a corporate VPN as if they belong there. Once inside, Qilin affiliates have been deploying full ransomware encryption across entire corporate networks, with some victims facing double-extortion (where attackers both encrypt files and threaten to publish stolen data publicly).

Arctic Wolf investigated multiple separate incidents during June 2026, all tracing back to this same vulnerability. The activity is assessed as ongoing.

Internet threat watchdog Shadowserver tracks over 167,000 GlobalProtect instances currently exposed to the public internet. There is no confirmed figure for how many remain unpatched.

Qilin is a ransomware-as-a-service (RaaS) operation — meaning the group behind it rents their attack tools to other criminals, who then run their own campaigns and share the proceeds. Past victims include Nissan, pathology provider Synnovis, and Australia's Court Services Victoria.

CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, ordering federal agencies to patch within three days.

What you should do: If your organisation uses Palo Alto Networks GlobalProtect, confirm with your IT team that the May 13 patch has been applied. If you are unsure, assume it has not been and escalate today.

SonicWall, a company that makes network security hardware used by businesses to manage remote access, disclosed this week that attackers had already exploited two zero-days (security flaws that are unknown to the vendor at the time of attack) in its SMA series appliances before any patch existed, according to The Hacker News.

The attackers used these flaws to gain root access — the highest level of control over a system, equivalent to having a master key to every room in a building. From there, they could install persistent backdoors (hidden access points built into a compromised system), intercept credentials, and move freely through the networks the devices were supposed to be protecting.

SMA appliances are commonly used by businesses to let employees connect securely from outside the office. That makes them a high-value target: compromise the gateway, and you own the door.

The number of affected organisations has not been confirmed in the source material. SonicWall has now issued patches.

What you should do: If your organisation uses SonicWall SMA appliances, check with your IT team today. The patches are out — apply them immediately. If you manage these devices yourself, visit the official SonicWall advisory and upgrade before the end of the day.

Microsoft has flagged a significant rise in attacks using a piece of malware called ACR Stealer, according to Bleeping Computer. Between late April and mid-June, attackers used it to raid saved browser passwords, session tokens (the digital keys that keep you logged in without re-entering your password), and sensitive documents from enterprise systems.

ACR Stealer operates as malware-as-a-service (MaaS), meaning attackers rent access to the tool rather than building it themselves — think of it like a criminal franchise. It is believed to be a rebranded version of an older tool called Amatera Stealer.

The most common delivery method is ClickFix, a social engineering (psychological manipulation) trick where a fake error message or CAPTCHA prompts you to paste a command into your computer's terminal. Once you do, the malware installs itself, creates a disguised scheduled task to survive reboots, wipes its own tracks from PowerShell history, and quietly injects its payload into a legitimate system process to avoid detection.

One particularly clever variant hides its actual payload inside a publicly hosted JPEG image — a technique called steganography — then decrypts and runs it entirely in memory, leaving little trace on disk.

Once inside, it goes after everything: passwords, cookies, authentication tokens, PDF files, Microsoft 365 documents, and anything sitting in your Downloads or Desktop folders. OneDrive and SharePoint directories are also targeted.

What to do: Never paste commands into a terminal window because a website tells you to — no legitimate service works this way. If you manage a network, restrict tools like PowerShell and MSHTA from loading content from remote or user-writable locations.

Abbott Laboratories, the global medical device and diagnostics company, is currently investigating two separate security incidents at the same time, according to Bleeping Computer.

The first involves ShinyHunters, an extortion gang that gained access through a vishing (voice phishing — where attackers call employees by phone and impersonate trusted figures to extract credentials) attack on Abbott staff in mid-June. The group claims it compromised a Microsoft Entra SSO (single sign-on — a system that lets one login unlock many connected apps) account, then moved through connected services including ServiceNow, SharePoint, and Databricks. ShinyHunters claims to have stolen over 30 million rows of customer data including names, addresses, dates of birth, and more than one million Social Security numbers. They also claim 22 million doctor-patient conversation notes and 20 million medical orders. Abbott has confirmed unauthorised access to legacy Exact Sciences systems in its Cancer Diagnostics business, though it says operations have not been affected.

The second incident is a separate claim from a group called ShadowByt3$, which says it accessed Abbott's LabCentral customer portal on July 4 using compromised customer credentials. They claim to have taken internal technical and regulatory documents rather than patient data.

Abbott says it has engaged cybersecurity experts and notified law enforcement. Neither group's claims have been independently verified.

What you should do: If you have ever used Abbott or Exact Sciences health services, monitor your accounts for unusual activity, consider placing a credit freeze with the major bureaus, and be alert for phishing messages using your personal details as bait.

Coca-Cola filed an SEC disclosure this week confirming that Fairlife, its ultra-filtered milk and protein shake brand, was hit by a ransomware attack that has suspended all US production, according to Bleeping Computer.

Attackers gained unauthorised access to Fairlife's systems, including the production infrastructure that keeps the factory lines running. Once ransomware encrypts those systems, operations grind to a halt until they are restored or rebuilt. Canadian facilities are still running, but US output of Core Power protein shakes, Nutrition Plan drinks, and Ultra-Filtered Milk is on ice.

No ransomware group has claimed responsibility yet. Coca-Cola has not confirmed whether data was stolen or whether an extortion demand has been received. That silence is not unusual — early-stage ransomware incidents typically follow a pattern: encrypt, steal, then threaten to publish the stolen data unless a ransom is paid.

Product safety has not been compromised. The business impact, however, is still being calculated.

What you should do: If you rely on Fairlife products professionally, plan for short-term supply disruption. More broadly, this is a good reminder that ransomware hits physical production, not just data. If your organisation has operational technology connected to the internet, that is a risk worth reviewing.