Daily Hunt Feed - 2026-07-16

Threat Hunt Feed (2026-07-16)

Hacker News: Best

• Running Gemma 4 26B at 5 tokens/sec on a 13-year-old Xeon with no GPU — Wed, 15 Jul 2026 15:34:05 +0000
  • Matched TTPs: Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)

BleepingComputer

• Zoom warns of critical account takeover vulnerability — Wed, 15 Jul 2026 16:16:02 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• Google Gemini CLI abused as a hacking agent, malware botnet operator — Wed, 15 Jul 2026 14:33:48 -0400
  • Matched TTPs: Password Guessing (T1110.001), Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Botnet (T1584.005), Server (T1584.004), PowerShell (T1059.001), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• AsyncAPI npm packages infected with credential-stealing malware — Wed, 15 Jul 2026 11:37:27 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001)
• We built a vulnerability vending machine: AI tokens in, zero-days out — Wed, 15 Jul 2026 10:01:11 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• CISA warns admins to patch actively exploited SharePoint flaws — Wed, 15 Jul 2026 05:44:52 -0400
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002)

Darkreading

• Identity Attacks Overtake Exploits as Top Ransomware Cause — Wed, 15 Jul 2026 20:16:13 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Phishing (T1566), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)

The Hacker News

• TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development — Thu, 16 Jul 2026 00:13:08 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Brute Force (T1110), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), Systemd Service (T1543.002), At (T1053.002)
• OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps — Wed, 15 Jul 2026 21:00:30 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), DLL (T1574.001), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Server (T1584.004), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws — Wed, 15 Jul 2026 18:48:53 +0530
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. — Wed, 15 Jul 2026 17:20:01 +0530
  • Matched TTPs: Malware (T1588.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution — Wed, 15 Jul 2026 16:25:22 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware — Wed, 15 Jul 2026 14:46:13 +0530
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands — Wed, 15 Jul 2026 11:00:21 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Escape to Host (T1611), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)