Daily Hunt Feed - 2026-07-24

Threat Hunt Feed (2026-07-24)

Hacker News: Best

• Tell HN: Namecheap gave my account to an unverified third party — Thu, 23 Jul 2026 21:05:29 +0000
  • Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), WHOIS (T1596.002), Databases (T1213.006), Domains (T1584.001), Control Panel (T1218.002), Server (T1584.004), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Software rendering in 500 lines of bare C++ — Thu, 23 Jul 2026 14:17:40 +0000
  • Matched TTPs: Software (T1592.002), At (T1053.002)
• I Inspected My Take-Home Interview Project. It Was a Whole Operation — Wed, 22 Jul 2026 20:33:44 +0000
  • Matched TTPs: Malware (T1588.001), Browser Extensions (T1176.001), SSH (T1021.004), Server (T1584.004), Software (T1592.002), Python (T1059.006), At (T1053.002)

BleepingComputer

• New Dolphin X malware uses AI to rank high-value targets — Thu, 23 Jul 2026 17:20:34 -0400
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), SSH (T1021.004), Password Managers (T1555.005), Domains (T1584.001), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001)
• Fake Claude app promoted by Bing ads pushes SectopRAT malware — Thu, 23 Jul 2026 15:48:30 -0400
  • Matched TTPs: Scheduled Task (T1053.005), Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Hardware (T1592.001), DLL (T1574.001), Domains (T1584.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Russian hackers exploit Zimbra zero-click flaw for email theft — Thu, 23 Jul 2026 12:49:27 -0400
  • Matched TTPs: Adversary-in-the-Middle (T1557), Sharepoint (T1213.002), IP Addresses (T1590.005), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Email Accounts (T1585.002), Domains (T1584.001), Email Account (T1087.003), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Multi-Factor Authentication (T1556.006), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Hackers abuse Notepad++ plugins to stealthily install malware — Thu, 23 Jul 2026 12:32:35 -0400
  • Matched TTPs: Scheduled Task (T1053.005), Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), DLL (T1574.001), Tool (T1588.002), Software (T1592.002)
• Microsoft 365 outage affects Teams, SharePoint and other services — Thu, 23 Jul 2026 11:34:43 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• New msaRAT malware uses Chrome, Edge browsers to route C2 traffic — Thu, 23 Jul 2026 06:00:00 -0400
  • Matched TTPs: Sharepoint (T1213.002), JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), DLL (T1574.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Encrypted Channel (T1573), Software (T1592.002), At (T1053.002)
• Check Point warns of SmartConsole zero-day exploited in attacks — Thu, 23 Jul 2026 04:13:07 -0400
  • Matched TTPs: Sharepoint (T1213.002), IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002)

Darkreading

• Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets — Thu, 23 Jul 2026 21:23:18 GMT
  • Matched TTPs: JavaScript (T1059.007), Malvertising (T1583.008), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Password Spraying (T1110.003), Phishing (T1566), Software (T1592.002), At (T1053.002)
• Agentic AI Challenges Progress in Confidential Computing — Thu, 23 Jul 2026 11:17:51 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), At (T1053.002)

The Hacker News

• China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks — Thu, 23 Jul 2026 17:50:23 +0530
  • Matched TTPs: Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs — Thu, 23 Jul 2026 13:34:35 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access — Thu, 23 Jul 2026 12:04:36 +0530
  • Matched TTPs: IP Addresses (T1590.005), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)