Daily Hunt Feed - 2026-07-26

Threat Hunt Feed (2026-07-26)

BleepingComputer

• Malicious sites use JavaScript to build malware in browser memory — Sat, 25 Jul 2026 11:21:09 -0400
  • Matched TTPs: Keylogging (T1056.001), Sharepoint (T1213.002), JavaScript (T1059.007), DNS (T1071.004), Malvertising (T1583.008), Malware (T1588.001), Hardware (T1592.001), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• ShinyHunters data leaks fuel $2,000 sextortion email scam — Sat, 25 Jul 2026 10:16:26 -0400
  • Matched TTPs: Sharepoint (T1213.002), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Email Account (T1087.003), Email Addresses (T1589.002), Tool (T1588.002), Software (T1592.002)
• OpenAI confirms ChatGPT is down worldwide — Sat, 25 Jul 2026 05:31:09 -0400
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Credential Stuffing (T1110.004), Software (T1592.002), At (T1053.002)

The Hacker News

• Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable — Sun, 26 Jul 2026 00:18:44 +0530
  • Matched TTPs: Keylogging (T1056.001), JavaScript (T1059.007), Malvertising (T1583.008), Malware (T1588.001), Malicious File (T1204.002), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git — Sat, 25 Jul 2026 15:44:26 +0530
  • Matched TTPs: Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Trap (T1546.005), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking — Sat, 25 Jul 2026 15:44:21 +0530
  • Matched TTPs: Databases (T1213.006), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Cloud Services (T1021.007), Phishing (T1566), Multi-Factor Authentication (T1556.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Impersonation (T1656), At (T1053.002)
• Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE — Sat, 25 Jul 2026 15:44:03 +0530
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Web Shell (T1505.003), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)