Cyber Security News

Hacking Editorial Brief — July 3, 2026

NSO Group's Pegasus Used Against EU Lawmaker Investigating Surveillance Abuses

Multiple investigations confirmed that former Member of the European Parliament Stelios Kouloglou was repeatedly hacked with NSO Group's Pegasus spyware while serving on Parliament's committee investigating abusive surveillance practices. The targeting of a lawmaker actively investigating spyware abuses represents a direct operational overlap—Kouloglou was investigating the same tool being used against him during his inquiry. Researchers documented multiple intrusion attempts during his tenure on the committee, raising questions about who authorized the surveillance and whether it was intended to compromise the investigation itself. The disclosure adds to mounting evidence of Pegasus deployments against journalists, activists, and political figures across Europe.

ToddyCat Deploys OAuth-Abusing Malware; DHS Network Breached; North Korean Groups Drive Crypto Theft

Kaspersky identified a new malware strain called Umbrij, linked to the ToddyCat advanced persistent threat group, that abuses OAuth tokens to access Gmail accounts through Google's API—bypassing traditional authentication controls. Separately, threat actors breached a Department of Homeland Security network used to coordinate security and emergency response information across government agencies for major events including World Cup and other high-profile U.S. security operations. Analysis from multiple sources indicates North Korean-linked hacking groups were responsible for approximately two-thirds of global cryptocurrency theft losses in the first half of 2026, continuing Pyongyang's pattern of using cybercrime to generate regime revenue. Meanwhile, CISA added SharePoint RCE vulnerability CVE-2026-45659 to its Known Exploited Vulnerabilities catalog after Microsoft discovered active exploitation during a ransomware investigation, with federal agencies ordered to patch by July 4. Researchers also documented the first practical AI-generated browser-based ransomware, created using DeepSeek, that abuses Chromium APIs across Windows, Linux, macOS, and Android platforms.

Sources: The Guardian · POLITICO · The Hacker News · Inc · Chosun Biz