The Threat Codex

CJP protests: India tells GitHub to block Bitchat app, Jack Dorsey leaks notice

The Indian government has ordered GitHub to remove all repositories of Jack Dorsey's Bitchat, alleging that the Bluetooth messaging app could be used to bypass internet shutdowns and hinder investigations amid the ongoing CJP protests in Delhi.

Hackers abuse Notepad++ plugins to stealthily install malware

Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US

Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release

Malwarebytes

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Extortion groups ShinyHunters and ShadowByt3$ claim they stole vast amounts of patient data. Those allegations have not been verified.

Zoom warns of critical account takeover vulnerability

Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts.

OCCRP

Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport

Spyware company NSO Group’s co-founder Shalev Hulio used an Israeli diplomatic passport to enter Panama in 2013, raising questions over the firm’s claims of independence from the Israeli state.

Hugging Face warns an autonomous AI agent hacked its network

The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system.

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants

Russia accuses Telegram founder of aiding terrorism, seeks international arrest

Russia is seeking to place Telegram founder Pavel Durov on an international wanted list, alleging that the app has been used by Ukrainian intelligence to organize terrorist attacks and conduct espionage inside Russia.

ExfilSquad hackers leak info of over 100,000 UK police officers, staff

A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals.

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

Securelist

PAYLOAD ransomware attacks through Active Directory GPO

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.

Bing Images RCEs: How XBOW Found Three Critical Flaws | XBOW

See how XBOW autonomously uncovered three critical Microsoft RCEs by tracing ordinary image-processing and file-upload paths to proven code execution.

Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

A coordinated Unified Threat Advisory covering active Cl0p ransomware affiliate exploitation of internet-exposed PTC Windchill and FlexPLM deployments.

Security Affairs

CVE-2026-42533: Critical NGINX Bug Could Turn HTTP Requests Into Server Takeovers

F5 fixes critical nginx flaw CVE-2026-42533 that can crash servers and, in some cases, allow remote code execution through crafted HTTP requests.

picussecurity.com

FrigidStealer Explained: macOS Infostealer and Gatekeeper Bypass

Understand how FrigidStealer infects macOS through fake updates and how to validate your defenses against this infostealer with Picus.

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.