Daily Hunt Feed - 2026-07-25

Threat Hunt Feed (2026-07-25)

Hacker News: Best

• If coding has been solved, why does software keep getting worse? — Fri, 24 Jul 2026 09:08:17 +0000
  • Matched TTPs: JavaScript (T1059.007), Software (T1592.002), At (T1053.002)
• Show HN: Echo – Fable-level results at 1/3 the cost using open-weight models — Thu, 23 Jul 2026 19:26:01 +0000
  • Matched TTPs: Search Engines (T1593.002), Tool (T1588.002), Brute Force (T1110), Software (T1592.002), Python (T1059.006), At (T1053.002)
• Why Software Factories Fail (or: harness engineering is not enough) — Thu, 23 Jul 2026 15:18:48 +0000
  • Matched TTPs: Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), Python (T1059.006), At (T1053.002)

BleepingComputer

• Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts — Fri, 24 Jul 2026 13:50:37 -0400
  • Matched TTPs: Sharepoint (T1213.002), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Credential Stuffing (T1110.004), Multi-Factor Authentication (T1556.006), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Chick-fil-A data breach affects more than 13,000 customers — Fri, 24 Jul 2026 10:04:29 -0400
  • Matched TTPs: Sharepoint (T1213.002), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Email Addresses (T1589.002), Tool (T1588.002), Credential Stuffing (T1110.004), Software (T1592.002), Credentials (T1589.001)
• Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack — Fri, 24 Jul 2026 10:01:11 -0400
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Botnet (T1584.005), Domains (T1584.001), Trap (T1546.005), Tool (T1588.002), Phishing (T1566), Credential Stuffing (T1110.004), Software (T1592.002), Exploits (T1588.005), At (T1053.002)

Darkreading

• Escape Artists: ‘Incorrigible’ AI Models Resist Rehabilitation — Fri, 24 Jul 2026 19:45:02 GMT
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), Python (T1059.006), At (T1053.002)
• Vatican’s Official Prayer App Leaks 700K+ Global Users’ PII — Fri, 24 Jul 2026 13:00:00 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Trap (T1546.005), Email Addresses (T1589.002), Exploits (T1588.005), At (T1053.002)
• Default Azure Automation Setting Enables Cross-Tenant Identity Takeover — Fri, 24 Jul 2026 12:48:16 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)

The Hacker News

• BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery — Fri, 24 Jul 2026 20:42:35 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Keychain (T1555.001), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), PowerShell (T1059.001), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller — Fri, 24 Jul 2026 19:45:21 +0530
  • Matched TTPs: DNS (T1071.004), Domain Account (T1136.002), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), DCSync (T1003.006), At (T1053.002)
• ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link — Fri, 24 Jul 2026 17:23:55 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry — Fri, 24 Jul 2026 15:45:29 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Vulnerability Scanning (T1595.002), Web Shell (T1505.003), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Golden Chickens Resurfaces With Four New Malware Families and Modular Implants — Fri, 24 Jul 2026 15:39:24 +0530
  • Matched TTPs: Screen Capture (T1113), Keylogging (T1056.001), Audio Capture (T1123), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats — Fri, 24 Jul 2026 13:11:06 +0530
  • Matched TTPs: Local Account (T1136.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks — Fri, 24 Jul 2026 12:20:57 +0530
  • Matched TTPs: Scheduled Task (T1053.005), JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Visual Basic (T1059.005), At (T1053.002)