# Archive
Browse past daily curated stories
Monday, July 27, 2026
-
1SecurityWeek generalMCBS Data Breach Affects 1.2 Million Individuals
The PEAR ransomware group claimed responsibility for a breach at MCBS, a medical business management company, stealing 3 TB of data affecting 1.2 million individuals. Healthcare sector breaches of this scale carry significant HIPAA exposure and downstream risk for patients whose medical and financial records may be compromised. Security teams at healthcare vendors and their business associates should review third-party risk posture in light of this incident.
-
2BleepingComputer generalGitHub, PyPI add time-absed defenses against supply chain attacks
GitHub and PyPI have introduced time-based defenses in the Dependabot tool to limit exposure from supply chain attacks targeting open-source dependencies. The mechanism adds temporal constraints to dependency updates, reducing the window of opportunity for attackers who compromise upstream packages. Developers and security engineers managing Python or GitHub-based pipelines should review the new Dependabot configurations to harden their CI/CD environments.
-
3The Hacker News generalDevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
PRODAFT researchers tracking the DevMan ransomware-as-a-service operation (internally dubbed Funky Mantis) have detailed a centralized web portal enabling affiliates to build custom payloads, manage victims, and track affiliate payouts in one dashboard. The platform's consolidation of build generation, finance tracking, and victim management reflects increasing professionalization of RaaS infrastructure. Threat intelligence teams should monitor for DevMan/Funky Mantis indicators as the lowered operational barrier for affiliates likely expands the group's attack volume.
-
4BleepingComputer generalSteam forum ClickFix attacks infect gamers with XMRig cryptominers
Steam discussion forums are being weaponized in ClickFix-style social engineering attacks, where posts posing as game or PC troubleshooting guides direct users to execute commands that install XMRig cryptomining malware. The campaign exploits user trust in community-generated content on a platform with hundreds of millions of accounts. Endpoint detection teams should add XMRig delivery via ClickFix lures to their hunting queries, particularly for gaming-adjacent environments.
-
5The Hacker News generalCTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
CTM360 research documents a shift in insurance-sector phishing operations from credential harvesting to real-time account hijacking, where adversary-in-the-middle infrastructure intercepts sessions immediately upon victim login rather than storing credentials for later use. This technique bypasses SMS-based MFA and renders traditional credential-theft detection less effective, since account takeover occurs within seconds of the phishing interaction. Financial services security teams should evaluate phishing-resistant MFA (FIDO2/passkeys) and real-time session anomaly detection as mitigations.
-
6BleepingComputer generalMalicious sites use JavaScript to build malware in browser memory
A large-scale malvertising campaign is deploying fake Solana, Luno, and TradingView websites that use malicious JavaScript to assemble malware directly in browser memory, bypassing traditional file-based detection. The fileless assembly technique makes the attack harder to detect with conventional AV scanning, as no payload is written to disk during staging. Security teams should ensure endpoint solutions with memory scanning capabilities are deployed and consider blocking lookalike domains for these cryptocurrency platforms.
-
7BleepingComputer generalShinyHunters data leaks fuel $2,000 sextortion email scam
Threat actors are leveraging email addresses from data breaches attributed to the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin, targeting victims with personalized details sourced from the leaked data. The campaign demonstrates how breach data monetization extends beyond direct account takeover into secondary extortion schemes. Organizations whose user data was exposed in ShinyHunters-linked breaches should proactively notify affected users to reduce susceptibility to these follow-on attacks.
-
8SecurityWeek generalRockwell Patches Code Execution Flaws in Arena Simulation Software
Rockwell Automation has patched code execution vulnerabilities in its Arena Simulation Software, which is used in industrial manufacturing and process modeling environments. A researcher detailed exploitation paths that could allow attackers to target industrial organizations through the simulation tool, raising OT/ICS risk concerns. ICS security teams running Arena should apply the patches immediately and review network segmentation between engineering workstations and operational technology networks.
-
9Ars Technica Security generalBig Tech accused of stonewalling European social media researchers
European researchers accuse TikTok, X (formerly Twitter), and Meta of failing to provide data they are legally obligated to share under EU regulations, obstructing academic study of social media's societal effects. While not a direct technical security issue, non-compliance with the EU Digital Services Act has implications for platform transparency and regulatory enforcement that affect how threat intelligence researchers access abuse data. The stonewalling creates gaps in independent monitoring of disinformation and coordinated inauthentic behavior on major platforms.
-
10BleepingComputer generalOpenAI confirms ChatGPT is down worldwide
OpenAI confirmed a worldwide outage affecting ChatGPT, with users experiencing connectivity failures across regions. While the root cause details were limited at time of publication, widespread unavailability of a heavily integrated AI service has operational implications for organizations that have embedded ChatGPT APIs into security workflows, helpdesks, or productivity tooling. Teams relying on OpenAI API endpoints for security automation should have fallback procedures documented for service disruptions.