Cybersecurity briefing — July 3, 2026.

The FBI, working with industry partners, says it seized hundreds of domains associated with NetNut, a residential proxy service linked to the Popa botnet. Prior reporting connected NetNut to at least two million compromised devices used for anonymity and follow-on cybercrime. The disruption highlights how proxy-broker ecosystems are increasingly intertwined with botnets, making infrastructure takedowns a major operational lever for defenders.

For security teams, the takeaway is that “anonymity layers” are not static services—once you can map their SDKs, C2 backends, and reseller networks, coordinated action can degrade both evasion and downstream attack capability.

Source: KrebsOnSecurity

A newly released WinRAR update addresses a serious security vulnerability, but automatic updates may not be enabled for many users. That gap creates a predictable window for exploitation, especially via phishing and drive-by delivery that relies on vulnerable archive handling. Organizations should treat end-user software patch coverage as a living control, not a one-time task.

Actionable follow-up: validate which WinRAR versions are running across endpoints, prioritize patching on high-risk user groups, and confirm that detection/response can flag suspicious archive-based execution attempts.

Source: MalwareBytes Blog

CISA added a Microsoft SharePoint Server remote code execution flaw (CVE-2026-45659, CVSS 8.8) to its Known Exploited Vulnerabilities (KEV) catalog. KEV listings typically signal that real-world threat actors are already using the vulnerability, compressing the time organizations have to remediate. The danger is amplified in environments where SharePoint is internet-facing or where access controls are weak.

Security leaders should ensure SharePoint patch deployment is treated like an incident response task—prioritize verification, hunt for indicators of exploitation, and confirm least-privilege access for accounts that can interact with vulnerable components.

Source: Security Week

Researchers report that FortiBleed exposed roughly 430,000 FortiGate firewalls and was directly linked to ransomware activity by INC Ransom and Lynx. The campaign’s scale—credential harvesting across many organizations—turns the initial foothold into an authentication pipeline for follow-on intrusions. This pattern reinforces that “credential access at scale” is increasingly the bridge between mass scanning and ransomware deployment.

Defenders should focus on authentication hygiene (reset/rotate exposed credentials), network segmentation limiting blast radius from perimeter devices, and detection for abnormal FortiGate/management-plane behavior around the campaign timeline.

Source: Security Affairs

Malware researchers uncovered ClickFix-style campaigns using fake Google and Cloudflare verification pages to deliver malware. The delivery chain spans “infostealers” and a newly observed loader, demonstrating attackers’ continued ability to weaponize user trust and browser workflows. As these lures often rely on social cues and timing, user interaction remains a critical risk factor.

Practical defense: tighten browser isolation and script controls where possible, monitor for suspicious downloads initiated from verification-themed pages, and ensure endpoint controls block common loader behaviors even when the initial page looks legitimate.

Source: MalwareBytes Blog

Reporting on JADEPUFFER describes an “agentic ransomware” workflow that reached production database impact rapidly, including automated recovery from failed steps and real-time decision-making. The account reinforces that attackers are increasingly treating compromise as an iterative, automated process rather than a linear playbook. Even if payment is delayed or declined, the operational damage phase can be fully automated.

For defenders, that means assuming faster dwell times and validating that containment controls work under automation pressure—especially around identity compromise, database access paths, and rapid privilege containment.

Source: Security Week