McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records
A threat actor going by “TheHatman” has been flooding underground forums with employee directory data pulled from at least nine major corporations’ Azure and Entra tenants using compromised credentials, with McDonald’s alone accounting for more than 1.7 million exposed records alongside troves from Vodafone, Tata Consultancy Services, and other multinationals. Researchers say infostealer-harvested session tokens appear to be the likely entry point, and the leaked data includes job titles, reporting lines, and administrator account details that could fuel convincing spear-phishing and business email compromise campaigns.
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
The China-linked espionage group known as HoneyMyte has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit capable of hiding malicious processes, files, registry entries, and command-and-control traffic from security tools. The driver is deployed as a secondary implant following a PlugX infection and has been observed against confirmed government targets in Myanmar, Mongolia, Pakistan, and Russia, continuing a pattern of kernel-level stealth upgrades the group has rolled out across its malware family over the past year.
New Mirai variant adds stealth capabilities to notorious botnet code
A previously undocumented Linux botnet dubbed Evooo1Bot, built on Mirai’s leaked source code, has been quietly compromising routers and other internet-facing hardware from vendors including Alcatel, D-Link, Netgear, and Tenda for at least a month. Beyond standard DDoS functions, it adds encrypted command-and-control communications, honeypot detection, credential sniffing, and SOCKS proxy abuse that let attackers mask their origin and pivot into victim networks, with infected devices tracked across North America, South America, Europe, India, China, and Japan.
Apple Delivers First Lock Screen Spyware Warning to Users in 110 Countries
Apple sent its largest-ever single wave of mercenary spyware threat notifications to iPhone users across 110 countries, and for the first time delivered the warning directly to the Lock Screen rather than relying solely on email, a change researchers say makes the alerts far harder to miss or dismiss as phishing. The notifications, tied to tools like NSO Group’s Pegasus, are typically aimed at journalists, activists, and officials, and Apple maintains that no device running its Lockdown Mode defense has ever been confirmed compromised by this class of attack.
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
Microsoft’s August update addressed roughly 400 vulnerabilities across Windows and its supported software, including one flaw already under active exploitation and two others that were publicly disclosed before a patch was available. The release included 42 critical-rated vulnerabilities, the large majority of which allow remote code execution, marking another unusually large patch cycle for the company.
