The tools you trust are being turned against you. |
From fake VPN downloads to critical software flaws and major breaches, threats are evolving while everything still appears normal. Take Cisco’s quick survey to share how you’re securing access. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Comcast to Pay $117.5M After Massive Breach |
Comcast agreed to a $117.5 million settlement following a 2023 cyberattack in which a third party accessed sensitive customer data, with over 30 million people potentially affected. Eligible claimants can recover up to $10,000 for documented losses, plus free credit monitoring and identity theft insurance. |
Comcast denied wrongdoing but agreed to the settlement, with final approval hearings set for July 7, 2026.
Submit your claim before the Aug. 14, 2026 deadline and flag this to any Comcast-using employees who may qualify. |
NWHStealer Hits Users via Fake Proton VPN Downloads |
Multiple campaigns have been found that use fake Proton VPN sites and game mods to trick users into downloading infected files from GitHub, SourceForge, and YouTube.
Once executed, NWHStealer harvests browser credentials, crypto wallet data, and session tokens, using encryption and Telegram-based fallback channels to maintain persistence. Its layered delivery — via DLL hijacking, process injection, and UAC bypass — makes detection and remediation more difficult for defenders.
Restrict software downloads to verified sources and enforce application allowlisting to block unauthorized executables. |
OpenAI Rolls Out GPT-5.4-Cyber for Security Teams |
OpenAI launched GPT-5.4-Cyber, a fine-tuned model built for security work — supporting vulnerability research, binary reverse engineering, and defensive workflows. Access is limited to vetted professionals through its Trusted Access for Cyber (TAC) program, with higher tiers unlocking fewer capability restrictions. The model is in limited iterative deployment with no general availability timeline announced at the time of publication. If your team handles red team ops or vulnerability research, start the TAC verification process now to get ahead of the access queue. |
|
|
What would your org do after a third-party data breach? |
|
|
Yesterday's Pulse Check Results |
How locked down is your phone? |
|
|
Security Tools You Can Use |
|
|
Nginx UI Flaw Lets Attackers Skip Authentication |
An authentication bypass in Nginx UI lets unauthenticated attackers invoke privileged MCP actions, potentially leading to full takeover. The /mcp_message endpoint was left unprotected, and with a public PoC now available, exploitation requires nothing more than network access and a session ID. |
A patch has been released for the vulnerability.
Patch to the latest version, restrict public exposure of management interfaces, and block unauthenticated access to MCP endpoints at the network level. |
AgingFly Malware Targets Ukraine Government, Hospitals |
A new C# malware, AgingFly, targets Ukraine’s government, hospitals, and defense, stealing browser and WhatsApp data via phishing. AgingFly compiles its command handlers at runtime from source code fetched from its C2 server, keeping its initial payload small and helping it evade static detection. CERT-UA has attributed the campaign to threat cluster UAC-0247 and the campaign is ongoing at the time of publication. Block execution of LNK, HTA, and JS files via group policy, monitor for scheduled task creation, and alert on unexpected outbound WebSocket connections to unknown hosts.
|
|
|
Don't just fix security breaches. Prevent them.
Security breaches are rising, and a detection-first model creates an added burden as teams manually remediate errors that should have been prevented. CNAPP platforms provide you visibility to what's misconfigured, but they need a partner to prevent problems upfront.
Turbot pairs with your CNAPP to introduce a prevention-first model that blocks errors in build, at the cloud APl, and auto-remediates in runtime. Use PSPM (Preventive Security Posture Management) to cut your alerts in half. |
|
|
Are Your Browser Extensions Putting You at Risk? |
Malicious browser extensions can quietly steal credentials, hijack sessions, and siphon off sensitive data. |
How to lock down browser extensions: |
-
Enforce strict extension controls with allowlists, no sideloading, and removal of high-risk permissions.
- Monitor extension risk by scanning behavior, tracking changes, and logging activity for detection.
-
Protect sessions and data with OAuth controls, device trust, and CASB/SSE visibility.
|
Uncontrolled extensions can create a direct path to account compromise — tightening controls helps reduce overall risk. |
|
|
| Eric Ruiz is a Senior Staff Writer with experience writing across multiple technology domains. He helps write the Cybersecurity Insider newsletter. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
