r/SecOpsDaily

A former Member of the European Parliament, Stelios Kouloglou, was repeatedly hacked with Pegasus spyware while serving on a committee investigating the abuse of commercial surveillance tools. This compromise, confirmed by Citizen Lab's forensic analysis, highlights the persistent threat posed by sophisticated state-grade malware against high-value targets, even those directly engaged in anti-surveillance efforts.

• Threat: Sophisticated mobile device compromise via Pegasus spyware (likely zero-click exploits).
• Target: High-value individual (Member of the European Parliament) with sensitive roles.
• TTPs: Persistent and repeated compromise of the target's mobile device, indicating a determined adversary and the use of advanced initial access vectors. Attackers potentially gained full access to the device's data and communications.
• Attribution (Implied): Commercial spyware typically sold to government agencies, suggesting state-sponsored or a powerful entity behind the attack.

Defense: Organizations with high-risk individuals should deploy robust Mobile Threat Defense (MTD) solutions and emphasize regular device security audits and strong operational security practices.

Source: https://thehackernews.com/2026/07/european-parliament-member.html

An aggressive password-spraying campaign has targeted Microsoft 365 environments, generating over 81 million login attempts in a two-week period.

Technical Breakdown

• TTPs: This campaign employs password spraying (MITRE T1110.003), leveraging common passwords against a vast number of Microsoft 365 accounts. This tactic is designed to evade typical brute-force protections that lock accounts after several failed attempts by distributing attempts across many accounts.
• Scope: The observed activity involved millions of distinct user accounts, indicating a broad targeting approach rather than a focused attack on a few organizations. Attackers are aiming for "low-hanging fruit" — accounts without strong protections.
• Affected: Any organization using Microsoft 365 without robust preventative controls is vulnerable to credential compromise via this method.

Defense

Enforce Multi-Factor Authentication (MFA) for all accounts. Implement Conditional Access policies to block or challenge suspicious login attempts, and actively monitor for unusual login patterns or high failed login rates from specific IPs or geographies.

Source: https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-365-accounts-with-81-million-login-attempts/

The SOCRadar Threat Research team just uncovered a staggering, active hacking campaign exposing over 30,000 verified Fortinet firewall credentials.

Here is the damage report:

🌍 Global Reach: 194 countries affected, with the US sitting at the #2 most targeted spot.

🏦 High-Value Targets: The victim roster includes major banks, telecom giants, and government agencies.

🛠️Full Visibility: We tracked the entire operation—the attacker infrastructure, the tools, and the complete victim list.

⚠️ Status: STILL active as of this publication.

Don't wait for an incident to react. Dive into the full discovery, grab the IoCs, and take immediate steps to mitigate the risk and strengthen your posture.

Read the full FortiBleed breakdown here: https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/

#ThreatIntelligence #Fortinet #CyberSecurity #InfoSec #SOCRadar

86,644 Fortinet firewalls hit across 194 countries. Active campaign, verified credentials, victims spanning critical infrastructure globally: banks, hospitals, governments. India and the US account for nearly a third of affected assets. Russian-speaking operators, NATO-focused targeting. Critical severity.

Fortinet users: rotate creds, enable 2FA, audit logins, restrict admin access, patch firmware now.

AI Coding Agents Vulnerable to Stealthy GitHub Repo Malware

Security researchers have demonstrated a novel method where AI coding agents can be tricked into executing malware from seemingly benign GitHub repositories, with the malicious payload remaining invisible to security scanners and human reviewers.

Technical Breakdown:

• TTPs: The attack leverages standard Git features, specifically:
  • git config url.<base>.insteadOf rewrites: These can trick Git into fetching content from a malicious server when a legitimate URL is requested, effectively performing a supply chain attack.
  • git submodule functionality combined with post-checkout hooks: Malicious commands are embedded within Git hooks that are automatically triggered during submodule initialization (git submodule update --init --recursive) or after a checkout.
• Execution Flow: An AI agent tasked with cloning and setting up a repo executes these Git commands, inadvertently triggering the hidden malicious code within the .git/config or hook scripts.
• Evasion: The malicious logic is contained within Git's configuration and hooks, not in typical executable files, allowing it to bypass most static analysis and security scanning tools.
• Impact: This technique enables remote code execution on the system hosting the AI agent or developer environment, establishing persistence or further exploiting the environment.

Defense: Exercise extreme caution when cloning and initializing GitHub repositories, especially with automated tooling or AI agents. Manually inspect all Git configuration (.git/config) and hook scripts (.git/hooks/*) before allowing automatic execution. Consider disabling Git hooks in untrusted environments.

Source: https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/