To meet Android developer verification and updated Play Console Requirements, Play developers must register their Play apps in Play Console. While 99% of apps on Play have been registered automatically, you should check your Play Console Home page to register any remaining apps by September 30, 2026 to avoid global removal from Google Play and ensure a seamless user installation experience.

You can also use Play Console to register apps you distribute outside of Google Play to ensure they can be installed on certified Android devices.

Last year, we introduced Android developer verification to strengthen ecosystem security and stop malicious actors from hiding behind anonymity to release harmful apps. Millions of apps have been registered since the verification launched in March, covering nearly all installs on Google Play and a large majority of installs from outside of Google Play. We appreciate the feedback and partnership from industry leaders, developers, and Android communities that helped us design this experience and drive strong adoption.

Initial launch across seven stores and four countries

These new developer verification protections will take effect on September 30, 2026, starting with users in Brazil, Indonesia, Singapore, and Thailand.

This rollout is an industry-wide effort to create a safer ecosystem. We will begin by verifying app installations from the following stores:

• Google (Google Play)
• Honor (HONOR App Market)
• OPlus (OPPO App Market)
• Samsung (Galaxy Store)
• Transsion (Palm Store)
• vivo (V-Appstore)
• Xiaomi (GetApps)

Following this initial phase with our partners, we will expand these protections globally for all apps on certified Android devices in 2027.

Automate your workflow with new APIs

To further streamline app registration, we are launching a suite of developer-requested APIs to help you register apps in bulk or directly through your continuous integration and deployment (CI/CD) pipelines. The Android Developer ID Status API will let you check if a package name has already been registered, and the Android Developer Console API will let you register and manage package names directly within your development environment. Both APIs also support OAuth delegation, allowing third-party platforms, like Android app stores, to perform these operations natively on your behalf.

We'll launch these APIs over the next few months.

What’s next

• June 2026: Starting this month, we are rolling out a new system service that will be automatically installed on most Android devices. This service will be used later this year to verify developer registration.
• July 2026: We’ll launch the Android Developer ID Status API globally and begin early access for the Android Developer Console API. Early access also starts for limited distribution accounts on Android Developer Console. This new type of Android developer account is designed for students, hobbyists, and learners and lets you share your apps to up to 20 devices without a government-issued ID or a fee.
• August 2026: Limited distribution accounts and the new Android Developer Console API will launch globally. We’ll also launch an advanced flow for installing apps from unverified developers, which includes security checkpoints to resist coercion scams, while allowing power users to maintain the ability to sideload apps from unverified developers.
• September 30, 2026: App registration becomes required for participating stores in Brazil, Indonesia, Singapore, and Thailand. Unregistered apps can be sideloaded with Android Debug Bridge (adb) or advanced flow.
• 2027 and beyond: After incorporating the feedback from our partners, users, and developer community, we’ll expand the Android verification requirement globally.
  

Get started with Android developer verification

If you distribute apps in Brazil, Indonesia, Singapore, or Thailand via the stores listed above, please ensure your verification is complete by the September deadline.

• Google Play developers: Most Play developers are already verified, and over 99% of their apps have been registered. Go to your Play Console Home page to see your app’s verification status, and register apps you want to continue distributing that weren't automatically registered.
• Developers who distribute only outside of Google Play: Sign up for the Android Developer Console today to register your apps.

• Students and hobbyists: Sign up here for early access to limited distribution accounts to help us refine the feature with your feedback.

Thank you for helping us build a safer Android ecosystem. Stay tuned for more updates as we approach September and the 2027 global rollout.

Read more →

The post Don’t get fooled by TikTok resin art scams appeared first on IT Security News.

The Cyber Express Weekly Roundup 

U.S. Accounts for Nearly Half of Global Ransomware Attacks in H1 2026 

Dubai Police Warns Against Online Visa Fraud Schemes 

Craneware Data Breach Exposes Employee and Customer Information 

U.S. Targets Illegal FIFA World Cup Streaming Networks 

Chick-fil-A Customer Accounts Targeted in Credential Attack 

South Korea Diplomatic System Breach Lasted Nearly 10 Months 

Weekly Cybersecurity Takeaway 

The recommendation? Easy. Avast One.

The recommendation? Easy. Avast One.

Summary

Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.

The following versions of Rockwell Automation ThinManager are affected:

• ThinManager >=13.0.0|<13.0.7, >=13.1.0|<13.1.5, >=13.2.0|<13.2.4, >=14.0.0|<14.0.2

Background

• Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-14

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.

The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:

• C-CURE 9000 and victor <=v2.90_v3.0 
• victor Web <=v7.1 

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Ireland

Vulnerabilities

Acknowledgments

• Harrison Neal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-23

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.

The following versions of MZ Automation libIEC61850 are affected:

• libIEC61850 >=v1.0.0|<=v1.6.1 

Background

• Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Germany

Vulnerabilities

Acknowledgments

• Abhinav Agarwal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-23

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.

The following versions of MZ Automation lib60870 are affected:

• lib60870 <=2.4.0

Background

• Critical Infrastructure Sectors: Chemical, Energy, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Germany

Vulnerabilities

Acknowledgments

• Lars Tray reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies).

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-23

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.

The following versions of Panduit IntraVUE are affected:

• IntraVUE <=3.2.1a14 

Background

• Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Netherlands

Vulnerabilities

Acknowledgments

• Phlebas of Lumintel reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-23

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.

The following versions of Weintek cMT3092X are affected:

• cMT3092X firmware <20210218 
• EasyWeb <v2.1.20

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Taiwan

Vulnerabilities

Acknowledgments

• Vincenzo Giuseppe Colacino of Secoore reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take the following measures to protect themselves from social engineering attacks:

Practice principles of least privilege.

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-23

Legal Notice and Terms of Use

Read more →

The post FBI Warns Scammers Use AI Deepfakes and Fake IC3 Sites to Re-Victimize Fraud Victims appeared first on IT Security News.

The post FBI Warns Scammers Use AI Deepfakes and Fake IC3 Websites to Target Fraud Victims appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post FBI Warns Scammers Use AI Deepfakes and Fake IC3 Sites to Re-Victimize Fraud Victims appeared first on Cyber Security News.

The FBI IC3 scam has evolved into a broader fraud scheme in which criminals impersonate FBI personnel and the Internet Crime Complaint Center (IC3) to target people who have already fallen victim to scams. According to an updated Public Service Announcement (PSA), scammers are using AI-generated videos, fake social media profiles, and spoofed websites to create a false sense of trust while attempting to steal personal and financial information.

The updated warning describes several exploitation tactics, including targeting previous scam victims, using artificial intelligence to create fictitious or misleading promotional materials, and building fake websites designed to collect personally identifiable information. The scammers falsely claim to be affiliated with government agencies or law enforcement and often promise to help victims recover lost funds.

FBI IC3 Scam Targets Previous Fraud Victims

In one version of the FBI IC3 scam, criminals create fake social media profiles and pages that impersonate FBI personnel. The goal is to lure previous scam victims into what the PSA describes as "re-targeting" scams.

After realizing they have been defrauded, victims may tell the original scammers they plan to report the incident to the FBI and submit an IC3 complaint. The victim is then contacted by someone pretending to be an FBI agent through platforms such as Facebook Messenger and Telegram.

The impersonator may send a link claiming to update an existing IC3 complaint. The link could contain malicious code or collect additional financial information, allowing criminals to further exploit the victim.

In other cases, scammers approach victims through email, phone calls, social media advertisements, or online forums. They claim to have recovered lost funds or offer assistance in recovering money. The FBI warning states these claims are a ruse designed to revictimize people who have already lost money.

AI-Generated Videos Promote Spoofed IC3 Websites

Another version of the scheme involves AI-generated videos or deepfakes featuring individuals impersonating FBI personnel. The videos are used on social media to promote spoofed versions of the official IC3 website.

One reported example involved an AI-generated video depicting a senior FBI leader encouraging users to submit complaints through a fake IC3 website. The spoofed site was designed to resemble the legitimate government website, but its functionality was limited to complaint submission.

The fake complaint form requested information including a user's name, phone number, email address, scam type, and estimated financial loss. After submission, the site provided a reference number and claimed someone would contact the individual.

How to Spot AI-Generated Videos and Fake Messages

The PSA warns that scammers can use AI-generated videos and cloned voices to impersonate company executives, law enforcement personnel, and other authority figures. These materials may be used during real-time video chats or private communications to convince victims they are speaking with a legitimate person.

People are advised to carefully examine email addresses, phone numbers, URLs, and spelling for subtle inconsistencies. Potential warning signs in manipulated images and videos include distorted hands or feet, unrealistic facial features, irregular faces, unusual accessories, inaccurate shadows, watermarks, unnatural movements, and voice call delays.

The FBI also advises people to be cautious when online content triggers strong emotions such as fear, anger, or disbelief. Users should verify surprising videos or images through reputable news sources or known official channels before responding.

IC3 does not maintain a social media presence and will not contact individuals directly through phone, email, social media, messaging apps, online chats, or public forums. The agency also does not recover funds for victims through Facebook or Telegram and will never request payment for fund recovery.

People seeking to file an IC3 complaint should type www.ic3.gov directly into their browser and verify that the website address ends in ".gov." Victims should avoid sponsored search results and suspicious links, and should never share sensitive information with websites they cannot verify.

Anyone who has fallen victim to the scam should report it through the legitimate IC3 website and provide details about the person or company involved, communication methods, financial transactions, and interactions with the scammer.

The U.S. Department of Justice has seized more than 1,000 illegal World Cup streaming domains accused of broadcasting FIFA World Cup 2026 matches without authorization, marking a major enforcement action against digital piracy during the tournament. The domains were seized in three separate actions under U.S. copyright law as part of Operation Offsides, an initiative targeting websites involved in unauthorized World Cup broadcasts.

The latest action includes nearly 400 websites seized by the end of June, according to the Department of Justice. The investigation was carried out by U.S. Immigration and Customs Enforcement Homeland Security Investigations (HSI) Washington Field Office and the National Intellectual Property Rights Coordination Center.

Illegal World Cup Streaming Domains Targeted

According to an affidavit filed in support of a seizure warrant in the U.S. District Court for the Eastern District of Virginia, the seized domains were used to offer copyright-protected content through real-time streams of 2026 World Cup matches as they were being played and first broadcast.

HSI special agents confirmed that the domains were actively broadcasting World Cup matches without authorization. The domains were identified with assistance from FIFA, with additional information provided by beIN Media Group, NBC Universal, the Motion Picture Association’s Alliance for Creativity and Entertainment (ACE), Ultimate Fighting Championship (UFC), and Warner Brothers.

FIFA holds the exclusive rights to sanction and stage the FIFA World Cup 2026, which is being hosted across multiple cities in the United States, Canada and Mexico.

Operation Offsides Targets Illegal Streaming

The U.S. action is part of Operation Offsides, which focuses on identifying and seizing websites facilitating unauthorized broadcasts of World Cup matches.

The operation is led by the National Intellectual Property Rights Coordination Center and is being conducted with HSI Washington, D.C., HSI Attaché offices, private sector organizations and law enforcement partners globally.

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the effort to seize more than 1,000 domains was aimed at protecting intellectual property rights and reducing risks to consumers from malicious software associated with some illicit streaming services.

HSI Deputy Executive Associate Director Matthew Millhollin also warned that users accessing unauthorized streaming platforms could face risks including malware and payment information theft.

Operation Red Card Expands Global Crackdown

The U.S. enforcement action was accompanied by international efforts under Operation Red Card, which targeted digital piracy and counterfeiting connected to the World Cup across the Western Hemisphere.

The Justice Department’s International Computer Hacking and Intellectual Property (ICHIP) program coordinated enforcement efforts involving Argentina, Brazil, Chile, Colombia, the Dominican Republic, Ecuador, Paraguay and Peru.

The coordinated actions resulted in hundreds of illegal streaming sites being blocked, including 14 in Argentina, 223 in Ecuador, 28 in Peru, 309 in Brazil, 256 in the Dominican Republic and 1,140 in Colombia.

Colombian authorities also conducted 13 nationwide search-and-seizure operations targeting counterfeit sports apparel, resulting in 11 arrests and convictions.

Cybercrime Group Arrested in Colombia

On July 10, authorities launched Phase II of Operation Red Card in Colombia, conducting simultaneous operations in Bogotá, Soacha, Maríalabaja, Manatí and Sincerín.

An ICHIP-mentored cybercrime prosecutorial team from the Colombian Attorney General’s Office arrested four members of the cybercriminal group Los Ciberinfiltrados. According to the Justice Department, the group had illegally accessed telecommunications systems since 2024 and sold pirated streaming content, including World Cup matches.

The group allegedly used fraudulent credentials, VPNs, interception of security codes and manipulation of corporate system profiles to distribute the pirated content.

In Europe, ICHIP Bucharest also coordinated with Europol and international counterparts to address illegal streaming activities during the World Cup.

World Cup Streaming Crackdown Intensifies

The latest action follows a June 2026 announcement by the U.S. Department of Justice involving the seizure of nearly 400 websites accused of illegally broadcasting FIFA World Cup 2026 matches.

That earlier enforcement action, also conducted under Operation Offsides, targeted websites accused of copyright infringement by offering unauthorized live streams of World Cup matches for profit.

With more than 1,000 domains now seized in the U.S. actions, authorities continue to target unauthorized streaming platforms and digital piracy networks linked to the tournament.

Summary

Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations.

The following versions of Rockwell Automation FactoryTalk Services Platform are affected:

• FactoryTalk Directory (FTSP) 6.60 

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

Revision History

• Initial Release Date: 2026-07-21

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code.

The following versions of Rockwell Automation Studio 5000 Logix Designer are affected:

• Studio 5000 Logix Designer V36.00 (CVE-2026-9108)
• Studio 5000 Logix Designer V35.00 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128)
• Studio 5000 Logix Designer V35.01 (CVE-2026-9108)
• Studio 5000 Logix Designer >=V34.00|<=V34.03 (CVE-2026-9108)
• Studio 5000 Logix Designer >=V33.00|<=V33.03 (CVE-2026-9108)
• Studio 5000 Logix Designer >=V32.00|<=V32.04 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128)
• Studio 5000 Logix Designer V34.00 (CVE-2026-9127)
• Studio 5000 Logix Designer V34.01 (CVE-2026-9127)
• Studio 5000 Logix Designer V33.00 (CVE-2026-9127)
• Studio 5000 Logix Designer V33.02 (CVE-2026-9127)
• Studio 5000 Logix Designer >=V34.00|<=V34.02 (CVE-2026-9128)
• Studio 5000 Logix Designer >=V33.00|<=V33.02 (CVE-2026-9128)

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities have a high attack complexity.

Revision History

• Initial Release Date: 2026-07-21

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.

The following versions of Rockwell Automation 1718-AENTR/1719-AENTR are affected:

• 1718/ 1719 Ex I/O 3.011 

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-21

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.

The following versions of Rockwell Automation 1734 POINT I/O are affected:

• 1734 POINT I/O 3.023 

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-21

Legal Notice and Terms of Use

Read more →

The post Fake FBI Agents Use IC3 Complaint Scams to Target Fraud Victims appeared first on IT Security News.

Used to each cycle moving at the speed of hype? Don’t crash and burn 🚲

Your digital life is complicated enough — your protection shouldn't be.

Avast One is an all-in-one app that brings together everything you need to stay safe, private, and running smoothly online. No more juggling separate apps, overlapping tools, or rigid bundles. Just one clean dashboard, one smart app, and full control over what protects you.

Here's what's inside Avast One: ✔ Advanced antivirus & real-time threat detection ✔ AI-powered scam protection that spots suspicious links before you click ✔ A VPN that encrypts your connection and hides your IP address ✔ Device cleanup tools to clear junk and speed things up ✔ Identity monitoring to check for your info on the dark web

Start with award-winning free antivirus — then add only the modules you actually need, when you need them. Available on Windows, Mac, Android, and iOS.

Because staying protected shouldn't feel like a second job.

🔒 Download Avast One free today → avast.com

#AvastOne #Avast #CyberSecurity #OnlineSafety #DigitalPrivacy #AntiVirus #VPN #ScamProtection #MalwareProtection #InternetSecurity #PrivacyProtection #CyberProtection #TechTips #DigitalSecurity #FreeAntivirus

Follow us:

YouTube @Avast
Instagram @AvastOfficial
Facebook @Avast
TikTok @Avast

The post The Odyssey piracy scams surface hours after its theatrical debut appeared first on Help Net Security.

Read more →

The post The Odyssey piracy scams surface hours after its theatrical debut appeared first on IT Security News.

Read more →

The post IT Security News Hourly Summary 2026-07-20 21h : 5 posts appeared first on IT Security News.

Read more →

The post The Odyssey piracy scams appear within hours of the movie’s release appeared first on IT Security News.

Read more →

The post Odyssey piracy scams appear within hours of the movie’s release appeared first on IT Security News.

Read more →

The post IT Security News Hourly Summary 2026-07-20 18h : 17 posts appeared first on IT Security News.

Dieser Beitrag Dubai Police warnt vor Fake-Visa-Angeboten auf Social Media und Messengern erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

The post Scams Now Drive Almost Half of All Malware Detections as Attackers Weaponise Everyday Trust appeared first on IT Security Guru.

Read more →

The post Scams Now Drive Almost Half of All Malware Detections as Attackers Weaponise Everyday Trust appeared first on IT Security News.

Dubai Police Fraudulent Visa Ads Circulating on Social Media

Authorities Urge Public to Verify Visa Offers

How to Report Fraud Attempts

You have had an X account for years, since it was known as Twitter. When an email arrives about a new login from a location nowhere near where you live, alarm bells begin to ring.

“We noticed a login to your account from a new device. Was this you?” the email asks.

Read more →

The post Cyber Briefing: 2026.07.17 appeared first on IT Security News.

Officials Vow Crackdown on Chinese Money Laundering Operations 

Investigation and Legal Proceedings Continue 

The post Scammers weaponize FaceTime to drain bank accounts appeared first on Help Net Security.

The UK's communications regulator has launched a formal investigation into TikTok age verification, raising questions over whether the platform is adequately protecting children online under the country's Online Safety Act. The move comes as Britain prepares to introduce a social media ban for under-16s, with regulators warning that current age assurance methods used by some platforms may not be sufficient to prevent children from accessing harmful content.

The investigation follows the publication of a new Ofcom report that found age checks are becoming more common across online services, but significant gaps remain, particularly on social media platforms and some pornography websites.

Ofcom Questions TikTok Age Verification Method

According to Ofcom, some social media companies rely primarily on age inference methods to identify child users. These systems estimate a user's age based on their online behavior rather than verifying it directly.

The regulator said it has "serious doubts" about whether these methods are capable of meeting the standards required under the Online Safety Act. Ofcom believes some companies may be failing to correctly identify a significant number of children, potentially exposing them to harmful content, including pornography, self-harm, and suicide-related material.

As a result, Ofcom has launched a formal investigation into whether TikTok is complying with its legal duties to protect children from harmful content.

The regulator also warned that age inference alone will not be considered sufficient for enforcing the government's planned restrictions on social media use by children under 16. Platforms using such methods have been urged to adopt more effective age assurance technologies or provide compelling evidence demonstrating their effectiveness.

Age Checks Increase Across Online Services

The report found significant progress in the adoption of age checks since the Online Safety Act's child protection duties came into force in July 2025.

Between July 2025 and January 2026, the proportion of children encountering highly effective age checks increased from 25% to 43%.

Ofcom said more than 69 million age checks were completed across a sample of 32 UK services during the second half of 2025, representing a 23-fold increase compared to the previous six months.

The regulator also reported that all of the UK's top 10 pornography websites and most of the top 100 now have age verification measures in place.

Among children aged 8 to 14 who attempted to access pornography, only 8% visited such services. Half of those children reached only websites with age checks, while nearly 87% of their visits lasted less than 30 seconds, suggesting age verification discouraged continued access.

Search Engines Also Face Scrutiny

Despite the wider rollout of age assurance, Ofcom found that children can still easily discover pornography websites without age checks through Google Search and Bing.

Its analysis found that 33% of first-page Google search results and 54% of Bing results directed users to pornography websites lacking age verification or equivalent protections.

Following discussions with the regulator, Google and Bing have agreed to work with Ofcom on practical measures to reduce the visibility of such websites in search results.

Meanwhile, Ofcom continues enforcement against adult services that fail to comply with the law. The regulator has opened 23 investigations involving 88 adult service providers, with many either introducing age assurance or blocking UK users after enforcement action.

UK Moves Toward Social Media Ban for Under-16s

The investigation comes as the UK government advances plans to introduce a social media ban for under-16s, modeled on Australia's approach.

Under the proposal, platforms including TikTok, Snapchat, Instagram, Facebook, YouTube, and X would be prohibited from offering social media services to users under 16. Messaging services such as WhatsApp and Signal are not expected to be included.

The government also plans to introduce additional protections, including restrictions on livestreaming and communication with strangers for children under 16 across social media and certain gaming platforms. Similar safeguards would apply by default to users aged 16 and 17 to avoid what officials describe as a "cliff-edge" at age 16.

The proposed measures are expected to be presented to Parliament before the end of the year, with implementation targeted for Spring 2027.

Ofcom said it will submit a rapid assessment to Parliament by the end of October outlining what constitutes highly effective age assurance for verifying whether someone is over 16, helping shape future enforcement of the planned restrictions.

Get help spotting fake ticket sites this summer with AI scam protection 👀

Summary

Successful exploitation these vulnerabilities could allow an attacker to execute arbitrary code in the context of the current process.

The following versions of Rockwell Automation Arena are affected:

• Arena <=V17.00.00 (CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314)

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Michael Heinzl reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the affected product.

The following versions of Rockwell Automation Flex 5000 Adapter are affected:

• Flex 5000 Adapter 6.011 (CVE-2026-12659)

Background

• Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.

The following versions of AutomationDirect Productivity Suite are affected:

• Productivity Suite <=v4.6.2.2 (CVE-2026-60063, CVE-2026-61389, CVE-2026-60140, CVE-2026-57896, CVE-2026-60073, CVE-2026-61378)

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Luca Borzacchiello of Nozomi Networks reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.

The following versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix are affected:

• CompactLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• Compact GuardLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• ControlLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• GuardLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• CompactLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• CompactLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• Compact GuardLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• Compact GuardLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• CompactLogix 5480 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• CompactLogix 5480 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• ControlLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• ControlLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• GuardLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• GuardLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• CompactLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• Compact GuardLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• CompactLogix 5480 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• ControlLogix 5580 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
• GuardLogix 5580 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

The following versions of Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT are affected:

• 1756-EN3 <=V12.001 (CVE-2026-9653)
• 1756-EN2 <=V12.001 (CVE-2026-9653)
• 1756-ENBT V6.006 (CVE-2026-9653)

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Tyler Lentz of Idaho National Laboratory reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

The following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected:

• Core Flight System (cFS) Health & Safety (HS) Application

Background

• Critical Infrastructure Sectors: Transportation Systems
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Grady DeRosa reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

Summary

Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server.

The following versions of Rockwell Automation FactoryTalk DataMosaix are affected:

• DataMosaix Private Cloud <=8.02 (CVE-2026-9292)

Background

• Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-16

Legal Notice and Terms of Use

AI isn't just being used for good. Dark AI — artificial intelligence weaponized for malicious purposes — is behind a new wave of scams, phishing attacks, deepfakes, and cybercrimes that are harder than ever to detect.

Scammers are now using AI to clone voices, fake video calls, impersonate people you trust, and generate convincing phishing messages at massive scale — all powered by dark GPTs built without safety restrictions.

The result? Scams that don't feel technical. They feel personal.

In this video, you'll learn:

What Dark AI actually is and how it works

How AI-powered scams use your routines, writing style, and social posts against you

The warning signs to watch for — voicemails from your "bank," urgent requests from your "manager," or a family member suddenly needing money

Simple habits that help you slow down and stay one step ahead

The smartest defense starts with awareness — and the right tools. Avast One helps detect phishing attempts, flags suspicious links, and blocks fake websites before you interact with them.

Download Avast One free today and stay safer online without having to think like a scammer.

#DarkAI #CyberSecurity #Phishing #Deepfakes #OnlineSafety #AIScams #CyberAwareness #Avast #AvastOne #ScamProtection #DigitalSafety #VoiceCloning #CyberCrime #StaySafeOnline #AIThreats

Follow us:

YouTube @Avast
Instagram @avast
Facebook @Avast
TikTok @avast

Read more →

The post Apple Warns Millions of iPhone Users: FaceTime Scams Are Spreading appeared first on IT Security News.

Read more →

The post IT Security News Hourly Summary 2026-07-15 21h : 13 posts appeared first on IT Security News.

The post Apple Warns Millions of iPhone Users: FaceTime Scams Are Spreading appeared first on TechRepublic.

The post Hackers Abuse FaceTime Calls to Impersonate Banks and Hijack Victims’ Accounts appeared first on Cyber Security News.

The post FaceTime Scams Impersonate Apple Support and Banks to Steal Account Credentials appeared first on Cyber Security News.

Scam protection, antivirus, VPN, and privacy tools — all in one app 🔐 Check out the new Avast One: https://bit.ly/4bK70M3

Read more →

The post Turkish Banks Targeted by 8,400 Phishing Domains and 6,600 Social Media Scam Ads appeared first on IT Security News.

The post Turkish Banks Targeted by 8,400 Phishing Domains and 6,600 Social Media Scam Ads appeared first on Cyber Security News.

Read more →

The post World Cup scams are a glimpse of the cybersecurity future appeared first on IT Security News.

Read more →

The post How mule betting scams recruit ordinary people appeared first on IT Security News.

The post Interpol cybercrime crackdown nets 5,800 arrests across 97 countries appeared first on CyberScoop.

Read more →

The post How World Cup crypto prediction sites take your money appeared first on IT Security News.

Summary

Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to the filesystem and escalate this into arbitrary native code execution through the normal OpenPLC program compilation process, potentially resulting in code execution as the OpenPLC runtime user.

The following versions of OpenPLC v3 are affected:

• OpenPLC v3

Background

• Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Grady DeRosa reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-09

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow attackers to overwrite critical files, forge or inject malicious log data, gain unauthorized account access, trigger denial‑of‑service conditions, truncate or alter logging information, reset user credentials, or expose sensitive information.

The following versions of Schneider Electric PowerChute Serial Shutdown are affected:

• PowerChute Serial Shutdown <=1.4 

Background

• Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Information Technology, Transportation Systems
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: France

Vulnerabilities

Acknowledgments

• Schneider Electric reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-04-14

Legal Notice and Terms of Use

Read more →

The post 5,811 arrests, $293 million seized over social engineering scams appeared first on IT Security News.

The post 5,811 arrests, $293 million seized over social engineering scams appeared first on Help Net Security.

Read more →

The post Helix Data Extortion Group Uses Vishing and Device Code Phishing to Steal SharePoint Data appeared first on IT Security News.

The post Helix Data Extortion Group Uses Vishing and Device Code Phishing to Steal SharePoint Data appeared first on Cyber Security News.

The dark web is no longer just a hidden marketplace for stolen credentials; it has grown far beyond that point and now affects nearly every phase of the cyberattack lifecycle. Markets that once traded only compromised accounts now also sell ransomware services, initial network access, exploit kits, phishing infrastructure, and even AI-powered attack tools. What used to be a place for selling stolen data has become the operational backbone of modern cybercrime. 

Take the first half of 2026 as an example. The dark web trend for this year has evolved into a highly organized ecosystem that facilitates cybercrime, underpins ransomware supply chains, fuels geopolitical campaigns, and accelerates identity-based attacks. Instead of serving as the endpoint for stolen data, it now functions as an operational hub where access, intelligence, and malicious services are traded before attacks even begin. The pace of activity reflects this shift: March 2026 alone recorded 702 ransomware attacks and 54 major publicly reported data breaches and leaks worldwide. 

Enterprise security teams must watch this underground activity; it's now not optional as an intel exercise but rather an essential capability for spotting threats before they materialize. The dark web trends observed during the first half of 2026 reveal how underground ecosystems are reshaping the cyber threat landscape. 

Ransomware Operations Top the Dark Web Trends of 2026

During the first six months of 2026, ransomware remained one of the most disruptive cyber threats, but the infrastructure supporting it became noticeably more organized. Rather than hundreds of equally active groups competing for victims, five ransomware operations—Qilin, Akira, The Gentlemen, DragonForce, and INC Ransom—were responsible for more than 56% of ransomware activity recorded in March 2026.  

This concentration stresses the growing consolidation of the ransomware ecosystem, where a handful of established operators dominate attacks while relying on affiliates and underground service providers to scale their campaigns. 

Modern ransomware campaigns rarely center on the encryption of systems. Data theft has increasingly become a standard component in most attack scenarios, as it allows threat actors to pressure their victims with the threat of public exposure, even if the victims have proper backups and can restore their systems. The dark web leak sites play a major role in this, as they are the places where stolen information is published or auctioned when organizations do not want to make a payment.  

This shift will require businesses to monitor underground forums for underground forum trends in H1 2026, including discussions around leaked data, targeted organizations, and early chatter on upcoming campaigns. Regional data reinforces the same trend. In the Americas alone, 1,305 cyber incidents were reported during Q1 2026, including 1,138 publicly claimed ransomware attacks. Nearly 58% of those attacks were attributed to just five ransomware groups. 

Access Brokers Are Powering the Underground Economy 

Many cyberattacks are now starting long before ransomware. Initial access brokers have become major players, specializing in one activity: network compromise and then selling that access to other threat actors. 

Underground marketplaces also showed growing demand for initial access. In March 2026, researchers observed 20 separate listings advertising access to compromised corporate networks. Professional services accounted for 25% of those listings, while retail represented another 20%. Even more concerning, three sellers—vexin, holyduxy, and algoyim—accounted for more than 55% of the observed access sales. 

Ransomware groups and espionage operators don’t need to spend time and effort to breach organizations themselves; they can simply buy verified entry points to corporate environments. This new division of labor has made cybercrime much faster and more effective. 

Access is typically sold soon after a compromise, so the time window for defenders to catch exposed credentials or infrastructure that has been compromised is shrinking. As such, dark web intelligence is valuable not only in the identification of stolen data but also indications that access to a network of an organization is already being traded in underground markets. 

To see how Cyble’s threat intelligence can help your organization detect external exposure and track threat activity, book a personalized demo. 

Identity Has Become the Primary Attack Surface 

With the rise of credential-based attacks over malware, the security perimeter is pretty much irrelevant. The most common enterprise infiltration paths include credential theft, session hijacking, bypass techniques for multi-factor authentication, and abuse of third-party access. All those have one thing in common: valid credentials. 

From an attacker's perspective, logging in with legitimate credentials generates far less suspicion than exploiting software vulnerabilities. As organizations expand cloud adoption and remote work, identities have effectively become the new perimeter. 

The shift toward identity-focused attacks is reflected in breach statistics as well. Technology and financial services accounted for approximately 44% of reported breach activity across North America during the first half of 2026. 

This trend also explains why stolen usernames, passwords, authentication tokens, and corporate accounts remain among the most valuable assets traded across dark web communities. Monitoring for exposed credentials allows organizations to respond before compromised identities are weaponized. 

Geopolitical Events Are Driving Cyber Activity 

The connection between global conflicts and dark web activity has become increasingly apparent during the first half of 2026. State-sponsored groups, hacktivists, and financially motivated criminals frequently operate in parallel during periods of geopolitical tension, creating a more complex threat environment. 

Rather than focusing exclusively on immediate disruption, many sophisticated actors are investing in long-term access to critical infrastructure, telecommunications, transportation, and energy systems. During the February 2026 escalation in the Middle East, cyber operations demonstrated how geopolitical events now extend into the digital domain.  

Internet connectivity in affected regions reportedly dropped to between 1% and 4% of normal levels, more than 70 hacktivist groups became active, over 8,000 conflict-themed domains were registered for scams and malware campaigns, and disruptions to navigation systems affected more than 1,100 vessels near the Strait of Hormuz. 

This convergence of political objectives and cybercrime makes attribution more difficult and raises the importance of monitoring underground discussions that may signal emerging campaigns before they reach production environments. 

AI Is Accelerating Both Attackers and Defenders 

Artificial intelligence has moved from experimentation to operational use across the cybersecurity landscape. Threat actors are increasingly using AI-assisted techniques to automate reconnaissance, accelerate vulnerability exploitation, and scale phishing campaigns with greater precision. 

The dark web has become a marketplace for sharing AI-enabled attack tools alongside traditional malware, making advanced capabilities accessible to less experienced operators. This lowers the barrier to entry while increasing the overall speed of cyber operations. 

Dark web threat intelligence in 2026 is becoming increasingly AI-driven, with defenders using automated analysis to process large volumes of dark web data, identify indicators of compromise, and prioritize threats in near real time. As attacks unfold more rapidly, automation is becoming necessary to reduce detection and response times. 

The question is no longer whether your organization appears on the dark web. The real question is whether you'll discover it before your attackers do. 

Subscribe to access the upcoming H1 2026 report by Cyble 

Conclusion 

The first half of 2026 stresses that the dark web is no longer simply where stolen information appears after an incident. The new dark web trends suggest that it has evolved into a live intelligence environment where attacks are planned, infrastructure is traded, identities are monetized, and emerging tactics become visible before they reach production networks. 

Organizations that incorporate dark web intelligence into broader security operations gain more than visibility into compromised data; they gain early warning of evolving threats. As ransomware groups become more coordinated, identity attacks continue to rise, and AI reshapes offensive capabilities. Proactive monitoring will play an important role in reducing cyber risk during the remainder of 2026. 

References: 

• https://cyble.com/blog/monthly-threat-landscape-march-2026/ 

• https://cyble.com/blog/2026-threat-intelligence-trends/ 

The post Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape appeared first on Cyble.

Financial scams targeting older adults are on the rise — and the most dangerous ones don't start with a threat. They start with a relationship. Romance scams, fake emergency calls, and slow emotional manipulation are some of the most common tactics used to exploit seniors before anyone notices something is wrong.

In this video, we break down how elder financial abuse actually works, the early warning signs to watch for (like sudden cash withdrawals, unpaid bills, or unusual secrecy around finances), and the practical steps families can take to protect their loved ones — without taking away their independence.

You'll learn:

Why urgency and isolation are scammers' most powerful tools

The behavioral red flags that often appear before financial loss

How to have open, proactive conversations with older family members about scams

Why having a trusted emergency contact and a plan in place makes all the difference

Most people don't think about identity protection until it's too late. Avast Secure Identity helps monitor for suspicious activity, supports recovery if something does go wrong, and helps protect against the financial impact of scams and theft.

Protecting your family starts before scammers get the chance.

🔒 Learn more about Avast Secure Identity and start protecting your family today.


#ElderFinancialAbuse #ScamAwareness #CyberSafety #OnlineScams #IdentityTheft #SeniorSafety #FinancialScams #RomanceScam #AvastSecureIdentity #Avast #CyberProtection #FamilySafety #ScamPrevention #DigitalSafety #OnlineSafety

Follow us:
YouTube: @Avast
Instagram: @avast
Facebook: @Avast
LinkedIn: Avast

Summary

Successful exploitation of these vulnerabilities could disclose information and allow a malicious user to execute arbitrary code on affected installations.

The following versions of Labcenter Proteus 9 are affected:

• Proteus 9.1_SP4_Build_42914

Background

• Critical Infrastructure Sectors: Communications, Critical Manufacturing, Defense Industrial Base, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United Kingdom

Vulnerabilities

Acknowledgments

• Michael Heinzl reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

Revision History

• Initial Release Date: 2026-07-07

Legal Notice and Terms of Use

Read more →

The post Fake Netflix, Coca-Cola, and FIFA job scams target marketers appeared first on IT Security News.

Read more →

The post Savi’s app aims to protect consumers from realistic AI scams like kidnappers demanding ransom appeared first on IT Security News.

According to Google’s legal filing, Outsider Enterprise operates through Telegram. The group offers phishing-as-a-service to individuals who may not be technically savvy enough to set up fraudulent websites and text campaigns on their own. In its Telegram channels, Outsider Enterprise reportedly provided instructions on how to use Google’s Gemini AI to create websites that imitate those of Google, YouTube, and government agencies such as New York’s E-ZPass. The group offered nearly 300 scam templates...

Read more →

The post Scammers are using AI to sell impossible flowers appeared first on IT Security News.

Infostealer malware is malicious code designed to infiltrate users' systems and secretly extract sensitive data such as browser information, system details, account credentials, cryptocurrency wallets, and screenshots. This stolen data is often sold or leaked on dark web platforms. While many victims are innocent, some are involved in criminal activities, which our research focuses on uncovering. Preliminary analysis of stealer logs revealed distinct behavioral patterns like multiple similar accounts and criminal conduct indicators, suggesting links to scams and illegal operations.

To better analyze these vast and complex datasets, we integrated Large Language Models (LLMs) that assist in organizing, classifying, and enriching loosely structured or ambiguous textual data within stealer logs. The LLM helped normalize vague entries and group related data, which was then stored in relational databases for efficient querying and visual interpretation. This method improves investigative efficiency and reveals actionable intelligence.

Importantly, our data collection adhered strictly to ethical standards by only using publicly accessible data without purchasing illicit sources. Although infostealers are inherently malicious, this research demonstrates how their leaked data can serve as valuable leads in tracking underground criminals. Future research aims to fully automate stealer log analysis using LLMs, enhancing the speed and accuracy of cybercrime investigations.

By:
HyunPyo Choi | Researcher, StealthMole
DoHyun Hwang | Researcher, StealthMole
Yejin Kang | Assistant Researcher, StealthMole
SangMyung Choi | CTO, StealthMole

https://blackhat.com/eu-25/briefings/schedule/?#not-just-victims-the-hidden-villains-inside-infostealer-logs-48668

Read more →

The post ClickFix Scams Abuse Google, Cloudflare Checks to Deliver 7 Malware Families appeared first on IT Security News.

The first half of 2026 has given security teams little room to breathe. Ransomware operators kept up a punishing pace. If that wasn’t enough, access brokers turned network intrusions into a marketplace, and nation-state activity blurred further into hacktivism and organized cybercrime. Taken together, the numbers point to a threat landscape that isn't just growing louder; it's becoming faster, more coordinated, and harder to attribute. 

Cyble's monthly and quarterly research has tracked this shift in real time, and the pattern across regions is consistent. In short, attackers are scaling operations while defenders are still catching up. These threat intelligence trends 2026 also provide an early look at the top cyber threats 2026 and what organizations should expect during the remainder of the year. 

Ransomware Set the Pace for Threat Intelligence Trends in 2026 

Ransomware was one of the biggest threat intelligence trends by far in 2026, in terms of visibility. In just the month of March, a total of 702 ransomware attacks and 54 major data breaches and leaks were registered worldwide. More than 56% of that activity was brought by five groups-Qilin, Akira, The Gentlemen, Dragonforce, and INC Ransom- showing how much consolidation has taken place in the ecosystem. 

 The pattern was consistent across regions. In the Americas, there were 1,305 cyber incidents in Q1 2026, of which 1,138 were publicly claimed ransomware attacks — and, once again, just five groups drove 58% of that volume. The most affected were construction, professional services, manufacturing, healthcare, and government bodies, primarily because downtime in these sectors has immediate operational or public-safety consequences. 

Dual-extortion tactics, pairing data theft with system disruption, have become close to standard practice. 

Access Brokers Are Quietly Powering the Ecosystem 

The purchase and sale of access to compromised networks is a huge driver behind the ransomware and espionage campaigns. In March 2026, 20 distinct incidents of the sale of access were observed on underground forums, and the most commonly listed sectors were professional services (25%) and retail (20%).  

Three of these sellers, vexin, holyduxy, and algoyim, accounted for over 55% of this activity, effectively forming a supply chain for the larger attacks. This is one of the markets upstream that makes response time matter; the access is usually sold and exploited long before a breach is detected publicly. 

Identity Has Replaced the Perimeter 

Perhaps the biggest change over the past year has been the shift from malware-first breaches to attacks based on identities. Credential theft, MFA bypass, session hijacking, and third-party access abuses have all become key vectors. Instead of breaking in, attackers are logging in -- and that has some serious implications for the design of monitoring and access controls. 

The numbers back this up. In North America, technology and financial services accounted for 44% of all breach activity in the first half of 2026 — sectors where identity and access sit right at the center of daily operations. Nearly 300 domains were also hit by hacktivist campaigns in the region over that same time, reminding everyone that disruption doesn't always have to come from a super-sophisticated intrusion; sometimes all it takes is one exposed login or an edge system that's gone unpatched. 

Geopolitics Is Now a Cyber Multiplier 

State-sponsored activity has grown more strategic, with actors focused on mapping dependencies and pre-positioning access rather than pursuing immediate disruption. Regional tensions have accelerated this further, with hybrid operations blending cyberattacks, disinformation, and kinetic action in ways that ripple well beyond the immediate conflict zone.  

During the February 2026 escalation in the Middle East, internet connectivity in targeted regions dropped to as low as 1–4% of normal levels, more than 70 hacktivist groups joined the fray, and disruption to navigation systems affected over 1,100 vessels near the Strait of Hormuz. More than 8,000 conflict-themed domains were also registered during this period to run scams, malware, and disinformation campaigns.  

Critical infrastructure, energy, water, transportation, and communications have emerged as the common target across nearly every regional threat report published this year, and India's own H1 tally from 2024 (593 attacks, including 388 breaches, 107 leaks, and 39 ransomware incidents) shows the same dynamics playing out closer to home. 

AI Is Reshaping Both Sides of the Fight 

AI-driven tooling has moved from experimental to operational. An open-source AI-native testing framework was used to compromise more than 600 Fortinet FortiGate appliances across 55 countries, while 26 malicious npm packages linked to North Korean actors distributed RAT malware through Pastebin- and Vercel-based infrastructure. These incidents also reflect broader vulnerability exploitation trends, where exposed security infrastructure is weaponized rapidly after vulnerabilities become known. 

This tracks with a broader trend flagged going into the year: AI-driven ransomware activity jumped 50%, and October 2025 alone saw software supply chain attacks spike 32% above the previous record. On the defensive side, organizations are beginning to lean on AI-assisted monitoring to keep pace with attacks that no longer unfold on human timescales. 

Cyble Blaze AI accelerates these threat investigations with AI-powered analysis, helping security teams quickly understand, prioritize, and respond to cyber threats. 

Turn threat signals into actionable intelligence with Cyble Blaze AI. See how faster investigations and autonomous analysis can transform your SOC. Request a demo today!

Conclusion 

The first half of the year highlights a few things about threat intelligence trends that need to be cleared up. First, threat actors are operating with more coordination. Second, less patience, and overlapping motives, financial, political, and strategic. And lastly, organizations that treat cybersecurity as a purely technical function are recalibrating, with boards and executives now directly involved in risk decisions. 

Taken together, these developments provide a clear mid-year threat intelligence trends forecast and shape the broader cyber risk outlook for 2026. Security teams should expect attackers to continue scaling operations, exploiting identities, and leveraging AI throughout the remainder of the year. 

Cyble's full H1 2026 Threat Landscape Report will bring together this data with deeper sector, regional, and actor-level analysis to help security teams prioritize what actually matters for the second half of the year. 

Subscribe to get early access to the full H1 2026 report the moment it's released, along with Cyble's ongoing threat intelligence coverage across ransomware, dark web activity, and emerging attack trends.   

References: 

• https://cyble.com/blog/monthly-threat-landscape-march-2026/ 

• https://cyble.com/blog/critical-infrastructure-cyberattack-threats-2026/ 

• https://cyble.com/blog/hybrid-warfare-2026-cyber-kinetic-threats/ 

The post Mid-Year Threat Trends: What H1 2026 Signals for the Rest of the Year appeared first on Cyble.

iOS 27’s new Trust Insights feature flags suspicious behavior during calls, texts and payments to help stop scams before they happen.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Tags: #Bedrohung | #Scam

Summary

Successful exploitation of this vulnerability could allow an attacker to upload arbitrary malicious firmware to the device.

The following versions of CubeSpace CW0057 Reaction Wheel are affected:

• CW0057 Reaction Wheel

Background

• Critical Infrastructure Sectors: Communications
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: South Africa

Vulnerabilities

Acknowledgments

• Anthony Rose reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

Revision History

• Initial Release Date: 2026-07-02

Legal Notice and Terms of Use

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition.

The following versions of ST Engineering iDirect iQ-Series Terminals are affected:

• Evolution iQ‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057)
• 3315‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057)
• 9‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057)

Background

• Critical Infrastructure Sectors: Communications, Defense Industrial Base, Energy, Government Services and Facilities, Transportation Systems
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities

Acknowledgments

• Ahmed Alqahtani of Aramco reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-02

Legal Notice and Terms of Use

Read more of this story at Slashdot.