Security News · thehackernews.com

ThreatsDay Roundup Covers AI-Enabled Attacks, Malware Campaigns and Security Incidents

Jul 30, 2026 · Original article ↗

Summary

This week's bulletin covers an AI-enabled campaign using seven CVEs, GenieLocker ransomware activity, credential-stuffing and DNS-hijacking incidents, Origin Energy's report that information on about 900,000 customers was accessed, and patches for 370 Chrome flaws.

Key points

Unit 42 reported that actor knaithe/KnYuan used Hermes Agent and DeepSeek to automate target enumeration, exploit-tool sourcing and attacks involving seven CVEs.
Kaspersky described Toy Ghouls using GenieLocker against Russian organizations; in at least one case, attackers entered through a partner's VPN, moved laterally, and encrypted Windows, Linux and ESXi systems.
Researchers reported malware delivery through campaigns including CastleLoader's crypto-focused payloads and fake Mac installation instructions that lead to MacSync Stealer.
Huntress observed successful SonicWall credential-stuffing logins affecting 92 accounts across 30 organizations.
CubePilot said attackers hijacked its DNS settings and obtained TLS certificates for its subdomains; credentials entered on its services on July 24 may have been captured. The company regained control and revoked the certificates.
Origin Energy said its review found information on approximately 900,000 current and former customers was accessed; potentially affected information includes contact and partial payment details.
Google patched 370 Chrome flaws, including seven rated critical; none of the patched flaws had been flagged as actively exploited. GitHub also outlined supply-chain safeguards, and the U.K. NCSC urged device makers to improve forensic visibility.

Article Details

Event Type: Multi-incident cybersecurity bulletin covering malware and ransomware campaigns, AI-assisted vulnerability exploitation, credential stuffing, DNS hijacking, phishing, and customer-data exposure.
Impact: Reported impacts include ransomware encryption of compromised Windows, Linux, and ESXi systems; successful credential-stuffing logins affecting 92 accounts across 30 organizations; and access to information belonging to approximately 900,000 Origin Energy customers. CubePilot said its domain DNS settings were hijacked and credentials entered on its services may have been captured. Google patched 370 Chrome flaws, including seven rated critical; none of the patched vulnerabilities were reported as actively exploited.

MITRE ATT&CK

T1021.001 · Remote Desktop ProtocolToy Ghouls reportedly used RDP for lateral movement in at least one intrusion.T1021.004 · SSHToy Ghouls reportedly used SSH for lateral movement in at least one intrusion.T1059.007 · JavaScriptThe MedusaHVNC infection chain began with wscript.exe executing a JavaScript launcher.T1078 · Valid AccountsThe SonicWall campaign resulted in successful unauthorized logins, and ShinyHunters' reported activity included SSO account takeover.T1105 · Ingress Tool TransferReported campaigns downloaded intermediate or additional payloads, including through an attacker WebDAV share and from jsDelivr.T1110.004 · Credential StuffingThe SonicWall campaign was described as an automated credential-stuffing attack.T1204.004 · Malicious Copy and PasteA ClickFix variant tricked victims into pasting a command into the Windows Run dialog.T1218.011 · Rundll32The ClickFix variant used rundll32.exe to load a remote payload and invoke its first export.T1486 · Data Encrypted for ImpactGenieLocker encrypted files on compromised Windows machines and disks on compromised Linux and ESXi servers.T1496 · Resource HijackingA reported Linux campaign deployed a customized XMRig implant for cryptomining.T1555.003 · Credentials from Web BrowsersThe malicious application disguised as the Relay meeting tool reportedly attempted to steal browser credentials.T1566.002 · Spearphishing LinkAPT-C-60 reportedly used spear-phishing emails containing a Proton Drive link to deliver an archive that deploys SpyGlace.T1566.004 · Spearphishing VoiceHealth-ISAC described vishing as part of the reported ShinyHunters intrusion pattern.

CVE

CVE-2025-68613infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987),CVE-2026-0300Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).CVE-2026-17650In an update released on July 29, 2026, Google shipped patches to address 370 flaws in its Chrome browser, including seven that are rated critical in severity (from CVE-2026-17650 through CVE-2026-17656).CVE-2026-17656In an update released on July 29, 2026, Google shipped patches to address 370 flaws in its Chrome browser, including seven that are rated critical in severity (from CVE-2026-17650 through CVE-2026-17656).CVE-2026-21858campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook CVE-2026-3055vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS CVE-2026-33017autonomous hacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat CVE-2026-33824(CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).CVE-2026-34486n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows CVE-2026-39987CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).

People

Eaton ZveareSecurity researcher who disclosed the My Eicher vulnerability that exposed unauthenticated internal and admin APIs and could enable account takeover.

Threat Actors

APT-C-60JPCERT/CC reported that this threat actor continued to target Japanese organizations with spear-phishing emails delivering SpyGlace.BearlyfyThe source explicitly identifies Bearlyfy as an alias of Toy Ghouls, which Kaspersky reported used GenieLocker ransomware against organizations in Russia.knaitheUnit 42 reported that the Chinese-speaking actor involved in an AI-enabled autonomous exploitation campaign operated under this alias; the same actor was also reported to use the alias KnYuan.KnYuanUnit 42 reported that the Chinese-speaking actor involved in an AI-enabled autonomous exploitation campaign operated under this alias; the same actor was also reported to use the alias knaithe.LabubuThe source explicitly identifies Labubu as an alias of Toy Ghouls, which Kaspersky reported used GenieLocker ransomware against organizations in Russia.ShinyHuntersHealth-ISAC warned of an increase in successful attacks attributed to this group, reportedly involving identity compromise, SaaS account takeover, and data exfiltration for extortion leverage.The ComEuropol described The Com online ecosystem as linked to extremist content and reported that members of the loose-knit collective also participate in cybercrime and extortion.Toy GhoulsKaspersky reported that this financially motivated extortion group targeted organizations in Russia with GenieLocker ransomware. The source explicitly identifies Bearlyfy and Labubu as aliases of Toy Ghouls.xplogs22F6 reported that this cybercrime group targeted Russia and other CIS countries with phishing emails delivering XWorm; F6 believed the group had been active since November 2023.

Malware

Amatera Stealer“Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer,” Malwarebytes said.CastleLoaderIt also highlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and GenieLockerIt also highlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and LunaSpyIn recent months, Russian customers of the banking sector have also been targeted by an Android trojan called LunaSpy as part of social engineering attacks.MacSync StealerIt also highlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and MedusaHVNCmajor campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and Chrome.Raccoon StealerThe activity uses a pay-per-install (PPI) loader masquerading as software installers that delivers Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig cryptocurrency miner, while a second,SpyGlacehighlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and XMRigsoftware installers that delivers Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig cryptocurrency miner, while a second, targeted operations layer relies on a bespoke, multi-operator XWormIt also highlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and

Vendors

Citrixusing seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Eicher Motorsdetails of a vulnerability in My Eicher, a fleet management system developed by the Volvo Group and Eicher Motors for Indian commercial vehicle customers, that enabled the discovery of unauthenticated internal and.GitHub“It initially surveyed 10 product families, scanning GitHub for trending proofs of concept (PoCs) and prioritizing vulnerabilities by attack surface.”GoogleVictims searching Google for how to install Claude on a Mac are being served sponsored results that lead them to a weaponized claude.ai/share conversation dressed up as an Apple Support install guide.Microsoft(CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).Oktavishing (voice social engineering) â helpdesk/MFA reset or device re-enrollment â Microsoft Entra (or Okta/Google) SSO account takeover â pivot into connected SaaS platforms â rapid data exfiltration for Palo Alto NetworksCitrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).SonicWallSpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and Chrome.Volvo Grouphas disclosed details of a vulnerability in My Eicher, a fleet management system developed by the Volvo Group and Eicher Motors for Indian commercial vehicle customers, that enabled the discovery of

Products

Apache Tomcatin Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Citrix NetScalerusing seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Google ChromeMedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and Chrome.Langflowout an AI-enabled autonomous hacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat Marimo Notebook(CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions Microsoft Entrachain: vishing (voice social engineering) â helpdesk/MFA reset or device re-enrollment â Microsoft Entra (or Okta/Google) SSO account takeover â pivot into connected SaaS platforms â rapid data Microsoft Windows IKE ExtensionsMarimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).My EicherCastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and Chrome.n8nhacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Oktavishing (voice social engineering) â helpdesk/MFA reset or device re-enrollment â Microsoft Entra (or Okta/Google) SSO account takeover â pivot into connected SaaS platforms â rapid data exfiltration for PAN-OS(CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824).SonicWall VPNAn active, broad, and opportunistic credential stuffing campaign has been observed since July 25, 2026, resulting in successful unauthorized logins to SonicWall VPN and firewall accounts.

Tools

Claude CodeAdditionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity.CodeMenderGoogle has launched a preview of CodeMender, an AI agent designed to scan codebases for security flaws, confirm they are exploitable and eliminate false positives, and generate fixes for developers to review.CodexAdditionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity.DeepSeekAI-enabled attackers are automating exploitation across multiple CVEs using Hermes Agent and DeepSeek.Hermes AgentAI-enabled attackers are automating exploitation across multiple CVEs using Hermes Agent and DeepSeek.LogoKitBarracuda has revealed that LogoKit has evolved from a standard phishing kit into a “real-time deception platform” capable of building customized phishing pages for each victim.Qwen CodeAdditionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity.

Countries

RussiaA cybercrime group known as xplogs22 has been observed targeting Russia and other CIS countries with phishing emails that deliver Xworm.

Industries

EnergyXWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with exposed flaws in My Eicher, SonicWall, and Chrome.Financial Servicesand Labubu) has targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March HealthcareHealthcare SaaS accounts targeted Manufacturing(aka Bearlyfy and Labubu) has targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called Retailhas targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March 2026.Technologyin the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March 2026.

Related Articles