Phishing
Researchers Document "Text Salting" — Hidden-Text Technique Reportedly Bypasses AI-Based Email Security Filters at Scale
A scale-significant AI-filter-bypass research beat — defender review for AI-heavy email-security stacks this week.
Latest
Vulnerabilities
Unit 42 Publishes “Three Steps to the Terminal” Analysis of Chained Siemens ROX II Zero-Day Vulnerabilities
Three chained OT zero-days in Siemens ROX II — a defender review for industrial operators this week, with Unit 42's analysis and Siemens's fixed firmware as the anchors.
Nation-State Cyber Threats
Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats
Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.
Vulnerabilities
Google Publishes Patch for Android Lock Screen Bug That Reportedly Let Gemini Send SMS Without a PIN
A mobile lock-screen bypass involving Gemini — defender verification across managed Android fleets this week.
Mobile Security
Apple Publishes Warning on FaceTime-Based Social Engineering Targeting iPhone and iPad Users
An Apple advisory on FaceTime-based social engineering — defender-team end-user awareness this week.
Ransomware
Armenia Detains Russian National Aleksandr Ermakov on US REvil Extradition Request; Family Disputes Identity
A cross-border REvil extradition drama - an identity dispute and the Armenian judicial process take center stage this week, with a Russian tourist detained on a US warrant his lawyers say names a different man.
Threat Intelligence
Microsoft Defender Experts Documents ACR Stealer Delivered via ClickFix Lures Targeting Browsers and Microsoft 365
Another named stealer joins the ClickFix pattern — a defender posture review across Microsoft 365 environments after Microsoft's published analysis this week.
Nation-State Cyber Threats
Ars Technica Reports Russia's Sandworm Cluster Now Using ClickFix Technique
ClickFix migrates from financially motivated crime to nation-state activity, according to Ars Technica's report on Russia's Sandworm cluster - a defender-awareness read for this week.
Ransomware
Symantec Documents "Spirals" Ransomware Reportedly Locking Systems in Under 24 Hours
A fast-moving Rust-based ransomware family — defender detection-engineering review this week.
Policy & Government
CyberScoop Reports US Authorities Attribute 120+ Attacks to Scattered Spider Defendant Thalha Jubair
More detail on Scattered Spider's TfL leaders: US authorities have Jubair on the record for 120 attacks, and defender pattern-tracking continues this week.
Vulnerabilities
CISA Adds SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog With July 19 Patch Deadline
A CVSS 9.8 SharePoint zero-day joins CISA's KEV catalog with a two-day patch deadline — defender teams accelerate verification this week.
Ransomware
ReliaQuest: “The Gentlemen” Overtakes Qilin as Most Prolific Ransomware Operation
The ransomware leaderboard shifts — The Gentlemen tops the chart in ReliaQuest’s latest tracking, and defender-team pattern-watching continues this week from the analyst’s chair, not the attacker’s.