Daily Hunt Feed - 2026-07-07

Threat Hunt Feed (2026-07-07)

Hacker News: Best

• OpenWrt One – Open Hardware Router — Mon, 06 Jul 2026 18:23:12 +0000
  • Matched TTPs: JavaScript (T1059.007), Hardware (T1592.001), Server (T1584.004), At (T1053.002)
• Show HN: Homegames. An open-source game platform I’ve been making for 8 years — Sun, 05 Jul 2026 21:32:44 +0000
  • Matched TTPs: JavaScript (T1059.007), Hardware (T1592.001), At (T1053.002)

BleepingComputer

• Phishing poses as big-brand job interview to steal Google accounts — Mon, 06 Jul 2026 16:27:37 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Domains (T1584.001), Email Addresses (T1589.002), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
• Fake IT support calls on Microsoft Teams push EtherRAT malware — Mon, 06 Jul 2026 16:23:45 -0400
  • Matched TTPs: Embedded Payloads (T1027.009), Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Software (T1592.002), At (T1053.002)
• Software Is Now Written at the Speed of Thought. Security Isn’t. — Mon, 06 Jul 2026 10:00:10 -0400
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Software (T1592.002), At (T1053.002)

Darkreading

• JadePuffer: The First Complete LLM-Driven Ransomware Attack — Mon, 06 Jul 2026 16:36:50 GMT
  • Matched TTPs: Databases (T1213.006), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), Python (T1059.006), At (T1053.002)

The Hacker News

• 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems — Mon, 06 Jul 2026 23:07:01 +0530
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Escape to Host (T1611), Proxy (T1090), Tool (T1588.002), Compute Hijacking (T1496.001), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More — Mon, 06 Jul 2026 18:31:14 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), SSH (T1021.004), DLL (T1574.001), Botnet (T1584.005), Domains (T1584.001), Masquerading (T1036), Vulnerability Scanning (T1595.002), Server (T1584.004), Proxy (T1090), Shell History (T1552.003), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Compute Hijacking (T1496.001), Multi-Factor Authentication (T1556.006), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Impersonation (T1656), Python (T1059.006), Conditional Access Policies (T1556.009), HTML Smuggling (T1027.006), SEO Poisoning (T1608.006), At (T1053.002), Dead Drop Resolver (T1102.001)
• Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT — Mon, 06 Jul 2026 16:28:16 +0530
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Windows Service (T1543.003), Vulnerabilities (T1588.006), SSH (T1021.004), DLL (T1574.001), Botnet (T1584.005), Masquerading (T1036), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Compute Hijacking (T1496.001), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Malicious Link (T1204.001), At (T1053.002)
• New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions — Mon, 06 Jul 2026 14:20:54 +0530
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Proxy (T1090), Tool (T1588.002), Compute Hijacking (T1496.001), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS — Mon, 06 Jul 2026 13:43:33 +0530
  • Matched TTPs: Screen Capture (T1113), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Compute Hijacking (T1496.001), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing — Mon, 06 Jul 2026 12:03:56 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Proxy (T1090), Tool (T1588.002), Compute Hijacking (T1496.001), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)