Daily Hunt Feed - 2026-08-05

Threat Hunt Feed (2026-08-05)

BleepingComputer

• TP-Link patches Omada ZTP flaws allowing hackers to breach networks — Tue, 04 Aug 2026 18:18:20 -0400
  • Matched TTPs: JavaScript (T1059.007), Network Devices (T1584.008), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Cloud Services (T1021.007), Tool (T1588.002), Phishing (T1566), Multi-Factor Authentication (T1556.006), Firmware (T1592.003), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Phishing service spoofs RingCentral to steal Microsoft 365 accounts — Tue, 04 Aug 2026 17:45:36 -0400
  • Matched TTPs: Adversary-in-the-Middle (T1557), Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Email Spoofing (T1672), At (T1053.002)
• New XCSSET variant targets macOS devs via compromised Xcode projects — Tue, 04 Aug 2026 15:03:09 -0400
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), AppleScript (T1059.002), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Massive ChainDrop npm supply-chain attack infects hundreds of packages — Tue, 04 Aug 2026 11:24:35 -0400
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Private Keys (T1552.004), Code Repositories (T1213.003), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)

Darkreading

• AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls — Tue, 04 Aug 2026 13:00:00 GMT
  • Matched TTPs: Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Domains (T1584.001), Email Addresses (T1589.002), Tool (T1588.002), At (T1053.002)
• Device Code Phishing Up 1,500% in 2026; Vishing Doubles — Tue, 04 Aug 2026 07:00:00 GMT
  • Matched TTPs: Adversary-in-the-Middle (T1557), Vulnerabilities (T1588.006), Device Registration (T1098.005), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)

The Hacker News

• Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens — Tue, 04 Aug 2026 22:57:39 +0530
  • Matched TTPs: Adversary-in-the-Middle (T1557), Sharepoint (T1213.002), IP Addresses (T1590.005), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Proxy (T1090), Phishing (T1566), Multi-Factor Authentication (T1556.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Conditional Access Policies (T1556.009), At (T1053.002)
• Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks — Tue, 04 Aug 2026 19:00:23 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access — Tue, 04 Aug 2026 18:41:22 +0530
  • Matched TTPs: Sharepoint (T1213.002), JavaScript (T1059.007), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), PowerShell (T1059.001), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), Data Destruction (T1485), Visual Basic (T1059.005), At (T1053.002)
• When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted — Tue, 04 Aug 2026 17:00:00 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Vulnerability Scanning (T1595.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent — Tue, 04 Aug 2026 16:46:23 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root — Tue, 04 Aug 2026 16:06:27 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malvertising (T1583.008), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT — Tue, 04 Aug 2026 14:33:23 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Sharepoint (T1213.002), JavaScript (T1059.007), DNS (T1071.004), Malvertising (T1583.008), Malware (T1588.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Server (T1584.004), PowerShell (T1059.001), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Steganography (T1001.002), Python (T1059.006), Environmental Keying (T1480.001), At (T1053.002), Dead Drop Resolver (T1102.001)
• CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises — Tue, 04 Aug 2026 12:30:13 +0530
  • Matched TTPs: Sharepoint (T1213.002), IP Addresses (T1590.005), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), At (T1053.002)