Cyber Security News

Hacking Editorial Brief — July 9, 2026

Chinese APT Expands Infrastructure with LONGLEASH Malware; Active Exploitation Targets Adobe, Joomla

Chinese threat actor UAT-7810 is deploying new LONGLEASH malware to expand its Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily targeting unpatched Ruckus routers. The campaign represents an evolution in the group's infrastructure tactics, using compromised edge devices to facilitate follow-on operations. Meanwhile, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including critical flaws in Adobe ColdFusion and Joomlack Page Builder actively exploited by threat actors. The catalog also includes a Langflow vulnerability and confirms ongoing targeting of enterprise platforms. Separately, researchers disclosed a new phishing technique called "Ghost Phishing" that uses AES-GCM encrypted HTML and Microsoft Device Code Phishing to evade traditional email security, with the EvilTokens campaign specifically targeting Microsoft 365 account takeovers.

Accenture Breach Confirmed; Windows Telemetry Aids Scattered Spider Investigation

Accenture confirmed an isolated security incident after a threat actor using the handle "888" claimed to be selling 35 GB of stolen data, including source code. The company has not disclosed the scope of compromised systems or the attack vector used. In a separate development, federal investigators used Windows device identifiers to track an alleged Scattered Spider member, raising operational security questions about enterprise telemetry data collection. The case demonstrates how device-level tracking mechanisms can provide law enforcement with forensic leads, though it also highlights privacy implications of Windows telemetry for organizations and threat actors alike.

Sources: The Hacker News · WIU Cybersecurity Center · CRN · Security Boulevard