VulnHub

SafePal, a cryptocurrency wallet provider, has reported a data breach that has affected approximately 40,000 customers. Hackers took advantage of a vulnerability found in the order-tracking feature of a plugin, allowing them to access sensitive customer information. This breach raises significant concerns for users, as it may expose personal data and financial information. SafePal has not specified what particular data was compromised, but the incident highlights ongoing vulnerabilities within digital wallet services. Users are advised to monitor their accounts for any suspicious activity and take necessary precautions to protect their information.

Recently, a vulnerability in macOS screen sharing has been exploited by attackers to gain root access to affected systems. Once inside, they deployed a Monero miner, which utilizes the system's resources to mine the cryptocurrency without the owner's consent. This incident raises concerns for macOS users, particularly those who rely on screen sharing features for remote work or support. The exploitation of this vulnerability not only compromises the integrity of the systems involved but also highlights the need for users to stay vigilant about software updates and security practices. As the attacks are ongoing, users should be particularly cautious and monitor their systems for unusual activity.

A serious vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, has been actively exploited just three days after its disclosure. This flaw allows attackers to execute arbitrary code, which can compromise internal components of the affected systems. Organizations using SAP Commerce Cloud should be particularly vigilant, as the rapid exploitation indicates a high level of risk. The urgency for companies to patch their systems is critical to prevent unauthorized access and potential data breaches. Users and administrators need to prioritize updates to safeguard their environments against this vulnerability.

In the first half of 2026, infostealers have compromised a staggering 1.7 billion credentials, according to data from Flashpoint. These infostealers are malicious programs designed to collect sensitive login information from users across various platforms. The scale of this credential theft could have far-reaching implications for individuals and organizations alike, as stolen credentials can lead to unauthorized access to personal accounts, financial data, and corporate networks. As users continue to rely on digital services, the need for robust security measures, like two-factor authentication and regular password updates, becomes increasingly vital. Companies must also enhance their monitoring and detection capabilities to mitigate the risks associated with these types of attacks.

Threema, a secure messaging service from Switzerland, experienced significant outages due to large-scale DDoS attacks. These attacks disrupted communication for many users, but organizations using Threema On-Prem were not impacted because their deployments operate on their own infrastructure. The incidents raise concerns about the reliability of online communication services, especially for users who depend on secure messaging for sensitive conversations. As DDoS attacks become more common, companies need to consider additional protective measures to safeguard their services from similar disruptions in the future.

The latest edition of the Security Affairs Malware newsletter features significant developments in malware tactics, particularly focusing on the Kimsuky group. Researchers report that Kimsuky has integrated artificial intelligence into its operations, employing AI-generated decoy documents to mislead targets and utilizing a local language model for enhanced attack capabilities. Additionally, the newsletter discusses the evolution of the Kimwolf botnet, now at version 7, which poses a growing risk to various organizations. Agencies like CISA and the FBI are urging companies to stay vigilant against these emerging threats. The evolution of these malware tactics underscores the need for organizations to bolster their cybersecurity measures to protect sensitive information.

Threema, a secure messaging platform, experienced significant disruptions earlier this week due to multiple distributed denial-of-service (DDoS) attacks. These attacks overwhelmed Threema's servers, causing service outages and making it difficult for users to send messages. While the company worked to restore normal operations, the incident raised concerns about the security of communication platforms and the potential for similar attacks in the future. Such disruptions can affect users' ability to securely communicate, particularly in sensitive situations where privacy is paramount. This event serves as a reminder of the vulnerabilities that even well-regarded secure services can face from malicious actors.

Mustang Panda, also known as HoneyMyte, has enhanced its CoolClient backdoor by deploying a signed kernel-mode driver that can conceal processes, files, and network activity. This upgrade makes it significantly harder for security software to detect and remove the malware from infected Windows systems. Kaspersky's recent analysis indicates that this new variant of CoolClient deepens the malware's integration into the operating system, raising concerns for users and organizations relying on Windows. The implications are serious, as this could allow attackers to maintain prolonged access to compromised systems while evading detection. Users and organizations need to remain vigilant and implement security measures to protect against this evolving threat.

France's tax agency has reported a significant cyberattack that compromised the personal data of approximately 678,000 taxpayers. The breach, which occurred in late June, involved hackers stealing sensitive information including income and tax details. This incident has prompted the agency to launch a criminal investigation to identify the perpetrators and assess the extent of the breach. The exposure of such sensitive data raises serious concerns about identity theft and privacy for those affected. As authorities work to secure the system and protect citizens, this attack serves as a reminder of the ongoing risks posed by cybercriminals targeting government institutions.

A recent cybersecurity concern involves attackers purchasing expired domain names and using them to distribute malware. This tactic allows them to exploit the trust users have in familiar web addresses, potentially leading to security breaches and data theft. Companies and individuals who own domains should monitor their registrations closely to avoid falling victim to this scheme. Additionally, organizations need to educate users about the risks associated with clicking on links from unknown or expired domains. The implications of this practice are significant as it not only affects the victims directly but also undermines overall internet security trust. Staying vigilant and proactive in domain management is essential to mitigate these risks.