Weekly Threat Intel Report — 2026-W29

TL;DR

Week 29 of 2026 delivered a dense mix of identity-driven intrusions, supply-chain compromises, and a very large Patch Tuesday. Microsoft published detailed guidance on ShinyHunters-associated OAuth abuse against SaaS applications, layering vishing, guest-access misconfigurations, and supply-chain pivots. INC Ransomware operators are reportedly chaining two SonicWall SMA1000 zero-days for root access to internet-edge appliances, while CISA ordered emergency patching of actively exploited Fortinet FortiSandbox flaws. Microsoft's July Patch Tuesday shipped fixes for 622 vulnerabilities including two exploited zero-days, and researchers documented fresh supply-chain risk in the npm (AsyncAPI compromise; post-Shai-Hulud wormable malware) and UEFI (11 vulnerable Microsoft-signed shim bootloaders) ecosystems. Ransomware disruption struck consumer manufacturing when a Fairlife/Coca-Cola incident halted US dairy production, and Ernst & Young disclosed a breach via a third-party support ticket system. Cisco Talos exposed a new financially motivated Russian-speaking actor, UAT-11795, running novel malware since mid-2025.

Notable Activity by Actor

ShinyHunters — SaaS OAuth abuse at scale

Microsoft Threat Intelligence published a defender-focused analysis on 13 July describing activity with tradecraft overlapping ShinyHunters targeting SaaS-based applications. The operators combined voice phishing (vishing) for initial access, OAuth application consent abuse to obtain persistent tokens (T1528), and supply-chain pivots plus misconfigured guest accounts (T1199) to move between tenants. Once OAuth tokens were in hand, attackers leveraged them as alternate authentication material (T1550.001), sidestepping password and MFA controls that never re-fire against a valid token. The write-up reinforces a pattern seen throughout 2025-2026: adversaries are treating the identity plane — not the endpoint — as the primary battleground for SaaS-heavy enterprises.

INC Ransomware — SonicWall SMA1000 zero-days

DarkReading and Sophos reported on 15-17 July that INC Ransomware affiliates chained two SonicWall SMA1000 zero-days to gain root-level capabilities on mobile access appliances. Sophos characterised the vulnerabilities as being under active exploitation. Because SMA1000 devices sit at the network edge and broker remote access, root compromise offers durable footholds ideally suited to ransomware pre-encryption reconnaissance.

UAT-11795 — new Russian-speaking financially motivated cluster

Cisco Talos disclosed UAT-11795 on 16 July: a Russian-speaking, financially motivated actor active since at least June 2025, targeting users in the US and Europe. The group deploys a novel Starland RAT and a bespoke WLDR C2 implant for command-and-control. The naming and toolset are new; Talos has not yet linked UAT-11795 to previously tracked criminal families.

Emerging Threats

The Great Patching (July 2026)

Cisco Talos characterised this month's patch cycle as "the Patch Wars." Microsoft shipped 622 fixes, of which 57 are rated Critical and two are being exploited in the wild (CrowdStrike, Talos, 14 July). Alongside that:

• CISA ordered federal agencies to patch two actively exploited Fortinet FortiSandbox flaws by Sunday (BleepingComputer, 17 July).
• 7-Zip 26.02 patched a remote code execution flaw triggered by malicious archives (BleepingComputer, 18 July).
• Public exploits landed for the WordPress Core "wp2shell" RCE flaws (BleepingComputer, 18 July).
• A researcher published "LegacyHive," a Windows zero-day privilege-escalation exploit that reportedly works on up-to-date systems (BleepingComputer, 17 July).
• "HollowByte" — an 11-byte payload can DoS OpenSSL servers via memory bloat (BleepingComputer, 17 July).

Defenders should assume threat actors are working the same patch diffs in parallel and prioritise edge, identity, and archive-handling components.

Supply-chain: npm, PyPI, and UEFI

• Microsoft dissected the AsyncAPI npm compromise, in which attackers weaponised trusted CI/CD workflows and delivered a malicious payload at package-import time (15 July).
• Unit 42 updated its npm threat-landscape analysis, noting the post-Shai Hulud ecosystem is trending toward wormable malware and CI/CD persistence rather than one-shot typosquats (15 July).
• Talos published a deep-dive on the full Python package lifecycle — from PyPI hosting through wheel installation — mapping where defenders can intervene (14 July).
• ESET disclosed 11 Microsoft-signed UEFI shim bootloaders that can be abused to bypass Secure Boot using decade-old vulnerabilities (14 July). This is a durable, hard-to-detect persistence primitive.

Identity attacks eclipse exploitation as the top ransomware root cause

DarkReading, citing new industry telemetry, reported that email-borne identity attacks overtook vulnerability exploitation as the top ransomware root cause in 2025. MFA was deployed in 97% of credential-based intrusions studied yet still failed to prevent compromise, largely due to token theft, MFA fatigue, and adversary-in-the-middle proxies (15 July).

ACR Stealer surge via ClickFix

Microsoft observed a surge in ACR Stealer activity from late April through mid-June 2026, using ClickFix social-engineering lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments (16-18 July). DarkReading separately described ClickFix as a rentable ecosystem that evades AV and EDR, leaving YARA-style content analysis as one of the more reliable detection surfaces.

AI-agent attack surface

A vulnerability dubbed "PromptFiction" in Anthropic's Claude for Chrome extension allowed a malicious extension to simulate user clicks and trigger AI actions against connected services (Gmail, Google Docs, Salesforce). Anthropic has fixed the flaw. Microsoft published guidance on least-privilege identity and tool binding for AI agents, and Check Point's AI Security Report 2026 characterised AI as having crossed from "assistant to operator" in offensive operations.

Consumer and enterprise incidents

• Coca-Cola / Fairlife — ransomware attack disrupted US dairy production (16 July).
• Ernst & Young — breach via third-party IT support ticket system (17 July).
• Abbott Laboratories — investigating two separate incidents: legacy Exact Sciences system access and a LabCentral portal extortion claim (17 July).
• AssuranceAmerica — data breach affecting ~7 million people originating from a compromised employee credential (Check Point, 13 July).

State-nexus signals

• UK NCSC and allied agencies issued a joint advisory on Russian intelligence targeting of poorly configured routers across critical sectors (13 July).
• Recorded Future assessed that Iran has integrated AI into its asymmetric playbook — cyber operations, influence, and domestic surveillance — during the 2026 conflict.

Defender Takeaways

1. Assume the identity plane is the attack surface. Audit OAuth application consents, restrict guest tenant access, and monitor for tokens being used from unexpected IPs or user agents. Microsoft's ShinyHunters guidance is a strong baseline.
2. Patch edge appliances first. SonicWall SMA1000 and Fortinet FortiSandbox are actively exploited this week. Anything internet-facing that brokers remote access or inspection is a top-priority target.
3. Prioritise Windows July 2026 cumulative updates. With 622 fixes and two exploited zero-days, delaying deployment materially widens the exposure window.
4. Instrument your CI/CD pipeline. The AsyncAPI compromise fired at package-import time inside build workflows. Pin dependencies, require reproducible builds, and monitor for outbound connections from build agents.
5. Revoke Secure Boot's trust in the vulnerable shims and validate UEFI posture against ESET's disclosure.
6. Detect ClickFix. The lure funnels users into pasting commands into Run dialogs or terminals. Restrict clipboard-to-shell workflows, alert on suspicious Run-dialog use, and deploy content-inspection rules.
7. Treat AI browser extensions and agents as privileged apps. Enforce least privilege, bind tools to identities, and log every agent action.
8. Third-party risk is a first-party problem. The Ernst & Young support-system compromise and the CISA GitHub credential leak underscore that contractor and SaaS-vendor hygiene directly become your exposure.

Sources

• Microsoft Threat Intelligence — ShinyHunters OAuth abuse (2026-07-13)
• Microsoft Threat Intelligence — AsyncAPI npm compromise (2026-07-16)
• Microsoft Threat Intelligence — ACR Stealer intrusion chains (2026-07-16)
• Cisco Talos — UAT-11795 / Starland RAT / WLDR (2026-07-16)
• Cisco Talos — Microsoft Patch Tuesday July 2026 (2026-07-14)
• Cisco Talos — Python package lifecycle deep-dive (2026-07-14)
• CrowdStrike — Patch Tuesday July 2026 (2026-07-14)
• Unit 42 — npm Threat Landscape (updated) (2026-07-15)
• Unit 42 — Siemens ROX II zero-day trilogy (2026-07-17)
• Sophos — SonicWall SMA1000 in active exploitation (2026-07-15)
• DarkReading — INC Ransomware exploits SonicWall SMA zero-days (2026-07-17)
• DarkReading — Identity attacks overtake exploits (2026-07-15)
• DarkReading — ClickFix ecosystem (2026-07-14)
• ESET — Forgotten UEFI shims undermining Secure Boot (2026-07-14)
• BleepingComputer — CISA urges immediate Fortinet patching (2026-07-17)
• BleepingComputer — Fairlife/Coca-Cola ransomware attack (2026-07-16)
• BleepingComputer — Ernst & Young breach (2026-07-17)
• BleepingComputer — Abbott Laboratories cyber incidents (2026-07-17)
• BleepingComputer — 7-Zip RCE fix (2026-07-18)
• BleepingComputer — WordPress "wp2shell" RCE (2026-07-18)
• BleepingComputer — LegacyHive Windows zero-day (2026-07-17)
• BleepingComputer — HollowByte OpenSSL DoS (2026-07-17)
• BleepingComputer — ClickLock macOS malware (2026-07-16)
• BleepingComputer — Claude Chrome extension flaw (2026-07-16)
• UK NCSC — Russian intelligence targeting of routers (2026-07-13)
• KrebsOnSecurity — Lessons from CISA's GitHub leak (2026-07-13)
• Check Point Research — AI Security Report 2026 (2026-07-14)
• Recorded Future — Iran's AI-enhanced asymmetric playbook (2026-07-16)