Latest cybersecurity reporting from selected sources.

Malware Targeted macOS Users Visiting Patel Foundation Merchandise PageTwo months after Iran-linked hackers exfiltrated FBI Director Kash Patel's personal email, the government official's name is tangled up in another cyber incident, this time through a MAGA swag shop he co-founded. ClickFix malware on the site tried to trick shoppers into running a malicious command.

Unit 42 Says Iranian Operators Target Aerospace and Government StaffPalo Alto Networks' Unit 42 said Iran-linked operators tied to Screening Serpens are using fake recruiting campaigns, cloned aerospace hiring portals and malware-laced job materials to infiltrate defense, satellite communications and government networks.

Eset Researchers Discover Trove of Go-Based MalwareResearchers uncovered a Chinese-linked cyberespionage group after attackers left command and control credentials embedded in malware, exposing internal operations, testing environments and thousands of messages tied to campaigns targeting a Mongolia government agency.

Ink Dragon Compromised IIS Networks to Relay ShadowPad MalwareA Chinese hacking group is using compromised European government networks as relay nodes to route commands and support other hacking operations. Security firm Check Point attributed the campaign to a Chinese espionage group it tracks as "Ink Dragon."

3 'Young IT Specialists' Arrested After Malware Tied to Government Agency InfectionRussian police have arrested "three young IT specialists" in Moscow, charging them with developing and selling the notorious Meduza information-stealing malware, and members of their group using the infostealer to breach a Russian government institution in May and exfiltrate data.

Government Agencies Targeted With Infostealers and Cryptomining MalwareA fake police alert is the social engineering cornerstone of an ongoing phishing campaign targeting Ukrainian government agencies, warn security researchers. They're tracking a surge in malicious SVG file attachments, in this case leading to information-stealing and cryptocurrency-mining malware.

Old Visuals, AI Deepfakes and Fake Claims Go Viral Amid Escalating ConflictMisinformation is going viral in India as the New Delhi government called Friday on the financial sector to strengthen cyber defenses amid growing military activity along the Pakistani border. Tensions between the two countries ratcheted significantly upward Friday.

Goffee Targets Russian Entities With USB-Based PowerShell MalwareA threat actor that focuses on Russian targets is spreading a new PowerShell implant that includes modules for stealing files from thumb drives and propagating itself through a USB worm. Its targets include critical infrastructure sectors such as energy, telecommunications and government.

Mustang Panda Uses MAVInject to Evade Antivirus DetectionA Chinese state-sponsored hacking group is abusing a legitimate Microsoft tool to evade security and install backdoors on government systems in the Asia-Pacific region. The threat actor uses MAVInject.exe to inject malware into waitfor.exe.

Chinese State-Sponsored Cyber Group Deploying Fileless Malware to PersistChinese state-sponsored cyber group APT40 intensified its attacks on government and critical infrastructure networks in the Pacific region by deploying fileless malware and modified commodity malware, prompting Samoa's cybersecurity agency to issue an urgent advisory.

Espionage and Cybercrime Campaign Tied to 7-Zip Mark-of-the-Web Bypass HitsRussian hackers targeting Ukrainian government agencies and businesses - including a major automotive manufacturer - have been targeting a zero-day vulnerability in the open source and widely used 7-Zip archive utility, to infect systems with credential-stealing SmokeLoader malware.

Also: Infostealer Malware Compromises Mexican Government ComputersThis week, DeepSeek exposed sensitive data, hackers exploited unpatched Zyxel flaws, infostealer malware on Mexican government computers, Smiths Group incident, PowerSchool breach notifications, an Apple zero-day, XWorm RAT backdoor, and Credit Control Corporation settled a lawsuit.

Campaign Uses Updated Version of the Malware Plugin, Kaspersky SaysHackers are deploying an updated strain of EagerBee malware to target internet service providers and government organizations in the Middle East, warn security researchers. EagerBee operates in memory and comes with advanced stealth and security evasion capabilities.

Malware Targets Vulnerable Web Cameras and DVRs WorldwideHackers are deploying brute force attacks and using unpatched vulnerabilities to target Chinese-manufactured web cameras and DVRs, the FBI is warning. Targets include a range of organizations in Taiwan and at least one U.S. government server.

Australian Government Warns of Nation-State Actors' Plans to Weaponize MalwareThe Australian government is alerting critical infrastructure providers that state-sponsored actors are positioning malware in their networks that can be weaponized to disrupt operations during major crises or a military conflict. The hackers employ living-off-the-land technique to avoid detection.

Unsealed Complaint Charges Maxim Rudometov With Developing and Selling MalwareAn international crackdown against two prominent strains of information-stealing malware continues, as the U.S. government unsealed an indictment charging Russian national Maxim Rudometov with being a developer and administrator of the Redline infostealer tied to millions of stolen credentials.

Stephen Doughty Says Cybersecurity Vital to National And Economic SecurityThe British government will continue disruptive actions against ransomware and malware operators, a top U.K. government official vowed Wednesday. Stephen Doughty, Minister of State, said the recently elected U.K. government views security as a core pillar of economic and strategic growth.

Targets Includes Technology, Government and Telecommunications SectorsCybercriminals are using a critical remote code execution vulnerability in an open-source geospatial data platform to spread malware globally across several industries. GeoServer Project maintainers released a patch on July 1. The vulnerability has a CVSS score of 9.8 out of 10.

US Critical Infrastructure, NATO Also Targeted by Russian Threat Actors, Feds SayThe U.S. government charged Russian civilian Amin Stigal with assisting Moscow's GRU military intelligence unit in its use of WhisperGate malware against Ukraine beginning in the weeks leading up to Moscow's all-out invasion, as well as probing America's critical infrastructure.

Espionage Group Using Linux-based Espionage Tools to Nab Defense SecretsA politically motivated hacking group aligned with Pakistani interests is matching the Indian military's shift away from the Windows operating system with a heavy focus on malware encoded for Linux. BlackBerry observed the cyberespionage group targeting government agencies and the defense industry.