Year: 2026 - RH-ISAC Blog

Executive Summary A SOCRadar Threat Research Unit report published on 3 August 2026 detailed DOUBLECUP, a Russian Loader-as-a-Service designed to support ClickFix campaigns. The service enables operators to configure malicious lure pages that instruct victims to copy and execute commands from fake verification prompts. DOUBLECUP retrieves hidden code from a steganographic PNG cached by the victim’s browser…

Overnight, a retailer’s support agent issues hundreds of refunds. At a hospitality group, a guest-services agent comps dozens of rooms across the portfolio and reinstates loyalty points to match. Every action clears a standard business rule: valid order or reservation, plausible reason, amount under the threshold that would route it to a human. By morning,…

Executive Summary A JFrog report published on 21 July 2026 detailed a typosquatted NuGet package, Newtonsoftt.Json.Net, that impersonated the legitimate Newtonsoft.Json library. The malicious package delivered a trojanized JSON library designed specifically to manipulate game results within Digitain’s BetOnGames FG-Crash betting platform. JFrog identified seven malicious versions that evolved across three generations, with later versions capable of…

Executive Summary A ThreatLocker report published on 21 July 2026 detailed two critical deserialization vulnerabilities, CVE-2026-50522 and CVE-2026-58644, affecting on-premises Microsoft SharePoint Server deployments. The flaws can allow an authenticated attacker to submit malicious serialized data that is processed by vulnerable SharePoint components, resulting in remote code execution within the SharePoint server context. Successful exploitation could enable command execution, malware…

Executive Summary On 21 July 2026, Cyber Security News reported a novel AI-themed malware distribution campaign (AgentBaiting) has emerged alongside a sustained wave of data breaches and ransomware attacks targeting retail organizations across Europe and North America. Threat actors are exploiting both cutting-edge AI tooling ecosystems and traditional third-party/supply-chain weaknesses to exfiltrate customer data at scale. Key…

Executive Summary In the last two years, ClickFix tactics have moved from a one-off social engineering trick into an industrialized attack ecosystem that is outpacing conventional antivirus and endpoint defenses. The technique first appeared in late 2023 and early 2024, and it skips exploits and vulnerabilities entirely as a fake webpage impersonating a CAPTCHA check, browser update…

Executive Summary On 9 June 2026, Group-IB Threat Intelligence reported a malicious shell script uploaded to VirusTotal assessed as a new modular macOS stealer likely distributed via ClickFix phishing pages, relying on compromised WordPress domains and Telegram infrastructure, with a strong European victim focus. According to Group-IB, a ClickLock Stealer operation has already targeted at least 100…

Executive Summary On 13 July 2026, Microsoft researchers published details of a ShinyHunters campaign active between mid-2025 and mid-2026 targeting customer SaaS-based applications, especially Salesforce instances, through voice phishing (vishing), supply chain compromise, and misconfigured guest access. The threat actors abused trusted OAuth relationships for unauthorized access, data exfiltration, and persistence.  ShinyHunters has demonstrated a consistent pattern…

Accertify, a fraud decisioning platform provider, has identified a sustained shift in account takeover (ATO) infrastructure: attackers are moving away from datacenter/hosting IPs and toward commodified residential proxy networks, allowing credential-stuffing and login-based attacks to pass through perimeter security without triggering velocity or reputation-based controls. Analysis of internal Accertify client data from 2024–2025 shows this…

Executive Summary The retail and hospitality sectors operate on high-velocity human interaction, making their front lines a major target for sophisticated social engineering attacks. Historically, organizations have relied on annual compliance videos and predictable phishing simulations to train frontline workers. While they were initially valuable, this type of traditional training no longer matches how attacks…