Open Cyber Threat Intelligence

Cryptocurrency hardware wallet provider SafePal suffered a data breach affecting approximately 39,798 customers due to an authorization flaw in an order-tracking plugin, which allowed unauthorized access to customer order information. The exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details, but not wallet seed phrases, private keys, or payment information. A threat actor is now claiming to sell the stolen data on a cybercrime forum, and customers have reported receiving phishing emails and phone calls impersonating SafePal, warning of a firmware vulnerability in the X1 device to trick users into compromising their wallets.

Threema, a secure messaging service, was disrupted by large-scale distributed denial-of-service (DDoS) attacks that targeted both its infrastructure and its colocation partner, Nine. The attacks caused intermittent outages and service degradation for users in Switzerland, India, and China, despite internal status pages showing normal operations. The threat actor continuously changed attack patterns, making mitigation difficult, and an unrelated technical issue prevented timely status updates. Threema has since implemented specialized upstream DDoS protection to reduce future impact.

AmnesiaStealer is a macOS-targeting information-stealing malware distributed via ClickFix campaigns using fake GitHub download pages. It steals browser profiles, passwords, cryptocurrency wallets, Apple Notes, keychain data, and documents. A key capability is its 'stream_module' component, which enables remote operators to control a headless browser instance loaded with the victim's cloned Chromium profile, allowing interactive access to authenticated web sessions via WebSocket-based remote control. This provides attackers with live screencast access and full input control (keyboard, mouse) over the victim's active sessions.

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducts parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web. The group targets government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises, while simultaneously running a for-profit crypto fraud scheme targeting Chinese-speaking users. Their primary malware includes the Antino Windows backdoor and a malicious 'PDF Viewer' browser extension, both deployed via fake software installers and HTA downloaders. The group leverages compromised hosting providers to scale attacks, stealing over 580,000 browser cookies and more than one million implant check-ins in under three months.

Microsoft's August 2026 Patch Tuesday addresses 421 vulnerabilities across various products, including 62 labeled as 'critical'. One actively exploited vulnerability, CVE-2026-68820, is an elevation of privilege issue in the Windows Ancillary Function Driver for WinSock. Multiple remote code execution vulnerabilities are present in Windows, SharePoint, Office, Azure, and other Microsoft services, with several rated high or critical severity. Cisco Talos has released Snort rules to detect exploitation attempts against some of these vulnerabilities, emphasizing those deemed more likely to be exploited, such as CVE-2026-62893 in Windows Deployment Services and CVE-2026-65665 in SharePoint Server.

Evooo1Bot is a new Mirai-based modular Linux botnet targeting internet-facing routers and gateway devices to turn them into SOCKS5 traffic relay nodes. It exploits known vulnerabilities in devices from vendors including Alcatel, NETGEAR, Tenda, and D-Link, and includes capabilities such as SSH brute-forcing, credential sniffing, DDoS attacks, and encrypted C2 communications over port 443. The malware performs anti-analysis checks, establishes persistence via multiple methods, and supports file transfer and interactive shell access for remote control by attackers.

In Q2 2026, mobile threats continued to evolve with a notable presence of banking Trojans, particularly variants of Mamont and Creduz. Attackers increasingly used malicious loaders distributed through Google Play, including trojanized apps like a PDF reader and the Cleanova app, to deliver banking malware such as Anatsa. These loaders employed sophisticated evasion techniques, including conditional payload delivery based on installation source telemetry, to bypass app store reviews and target specific users.

A large-scale malicious Chrome extension campaign involving 737 extensions has been identified, primarily targeting Russian-speaking users seeking access to blocked services like Instagram and YouTube. These extensions impersonate 66 legitimate VPN brands—including Proton VPN, NordVPN, and AmneziaVPN—and route all browser traffic through attacker-controlled SOCKS5 proxies on port 1082, enabling man-in-the-middle attacks. The campaign uses DNS-over-HTTPS for evasion, falsely advertises premium server locations that do not exist, and employs post-approval code substitution to bypass store review. One threat actor behind the operation runs a subscription-based business under the name 'Myxa VPN', which also sells access to the malicious extensions.

The Netherlands' National Cyber Security Centre (NCSC) has issued a warning that attackers are actively exploiting a macOS Screen Sharing vulnerability, CVE-2026-65400, to gain unauthorized access to systems with exposed port 5900. The flaw allows network-based attackers to bypass authentication and obtain root access without valid credentials. In confirmed attacks, the threat actors have deployed Monero cryptocurrency miners on compromised systems. Apple has patched the vulnerability in recent macOS updates, including Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

A critical remote code execution vulnerability, CVE-2026-58231, in SAP Commerce Cloud is being actively exploited in the wild just three days after the patch was released. The flaw, which has a CVSS score of 10.0, stems from improper authorization in the Data Hub Adapter extension, allowing unauthenticated attackers to execute arbitrary code by exploiting a default authentication client. Threat intelligence firm Defused confirmed exploitation attempts are already occurring, as observed through honeypot traffic, despite the absence of a public proof-of-concept. The vulnerability affects internet-exposed SAP Commerce Cloud instances, with over 4,200 such systems identified globally, primarily in Europe and North America.