Full Daily Digest

The UAC-0145 campaign demonstrates a multi-faceted approach to malware delivery, combining social engineering with advanced technical methods. By compromising at least 10 websites, attackers inject fake CAPTCHA prompts that trick users into executing PowerShell commands, leading to the installation of malicious scripts like GHETTOVIBE and SCOUTCURL. These tools harvest system details and facilitate further exploitation. The use of SMARTAXE and EtherHiding allows dynamic content manipulation, ensuring payloads are tailored to specific victims. Android devices are also targeted via APK files masquerading as security tools, embedding the COWARDDUCK backdoor to exfiltrate sensitive data. Defenders should prioritize user education, endpoint monitoring, and web application security to mitigate these threats.

The Hacker News · 2026-07-19 · Incidents: UAC-0145 employs fake CAPTCHAs and Android APKs to deliver malware, targeting Ukrainian systems with advanced reconnaissance and data-stealing tools.

The attack path began with the exploitation of CVE-2026-15409, a critical vulnerability allowing arbitrary command execution, followed by CVE-2026-15410, a path traversal flaw enabling root access. UTA0533 deployed custom malware, including ROOTRUN and KNUCKLEBALL, to establish persistence and interact with the compromised devices via web shells. The threat actor leveraged CouchDB to bypass authentication and access less-hardened services. While root access provided significant control, the attacker's lateral movement was limited. Organizations using SonicWall SMA 1000 series appliances should immediately apply the latest patches, monitor for suspicious activity, and review system configurations to prevent similar exploits.

The Hacker News · 2026-07-19 · Vulnerability: UTA0533 exploited SonicWall SMA zero-days pre-disclosure to gain root access, deploying custom malware and leveraging CouchDB for persistence.

The WordPress 7.0.2 release addresses critical and high-severity flaws, likely involving RCE or privilege escalation, requiring immediate deployment. Attackers spoof OAuth client IDs to evade Microsoft Entra ID telemetry, exploiting gaps in unfamiliar identifier handling—a technique enabling stealthy account enumeration. Cynative's read-only approach mitigates cloud research risks, but its effectiveness depends on strict policy enforcement. Finance phishing leverages mundane workflows to bypass AI email filters, emphasizing the need for behavioral training. UEFI Secure Boot's reliance on shims introduces unresolved risks, as legacy vulnerabilities persist. Mitigations include patch prioritization, OAuth log scrutiny, and multi-factor authentication for critical systems.

Help Net Security · 2026-07-19 · Vulnerability: WordPress vulnerabilities and fake OAuth IDs bypass logs, while finance phishing and UEFI risks persist, highlighting the need for human vigilance alongside AI tools.