Weekly Cyber Update: 31 July 2026

The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecurity news, trends and indicators, curated by our CISO, Nick Harris. Here’s our pick of the top stories, and why you should care.

---

Hackers target Microsoft 365 accounts via WiFi attacks

Possible Russian state-sponsored threat actors have been harvesting Microsoft 365 credentials by targeting Wi-Fi users at hotels and conference centres, according to ReliaQuest. A new report from the security vendor revealed that the campaign has been ongoing since at least June and is linked to the APT 28 (Fancy Bear) group. The threat actors changed the DNS settings of Wi-Fi devices at various locations around the world to redirect users to fake Microsoft login pages, bypassing multi-factor authentication (MFA) protection. It’s unclear how they gained initial access.

Why it matters

The campaign is a reminder of the dangers of using public Wi-Fi. Since the devices serve corporate events, execs and sales teams are particularly exposed. Hijacking their Microsoft 365 accounts could give attackers access to sensitive business information and communications.

Assured’s recommended action

Enforce always-on VPN with full-tunnel configuration (not split tunnel). Disable Web Proxy Auto-Discovery (WPAD) where not required. Configure a conditional access policy in Entra ID, which blocks device-code authentication flow. Update employee guidance to ensure staff verify the URL and certificate of login pages when using Wi-Fi, and to discourage use of public Wi-Fi without VPN protection.

---

Cl0p launches new extortion campaign targeting PLM customers

The notorious Cl0p extortion group is back with a new campaign targeting data stored in product lifecycle management (PLM) systems. The group has been exploiting a critical improper input validation vulnerability (CVE-2026-12569), enabling it to execute arbitrary code on PTC Windchill and FlexPLM instances. From there, they deploy JSP webshells and exfiltrate corporate data before sending extortion emails to employees at the targeted organisations.

Why it matters

The incident shows that any internet-exposed enterprise applications that store sensitive company data will be a target for potential theft and extortion. Prompt patching is vital. Affected companies will likely suffer immediate financial and reputational damage, as well as a potential long-term hit to competitive advantage (depending on what is taken).

Assured’s recommended action

Apply PTC’s patch. Where possible, place Windchill and FlexPLM interfaces behind a VPN or trusted access gateway. If exploitation is suspected, isolate the affected server, preserve forensic artefacts, and rotate exposed credentials before restoring.

---

OpenAI models hacked accounts from multiple companies in Hugging Face incident

OpenAI has revealed that rogue models which escaped a sandbox to hack Hugging Face also compromised accounts on four third-party services. One of the four was used as an “outbound relay and staging path”, while another was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and not used to compromise Hugging Face, OpenAI claimed. The entire incident lasted four days, with OpenAI unaware what its models had done before Hugging Face had contained the breach, using open source AI to help it. Anthropic later revealed that its own models had accessed three companies in a similar sandbox breakout.

Why it matters

The AI agents found publicly exposed credentials and exploited a zero-day vulnerability to further their attack, highlighting the dangers of exposed secrets and the ability of AI to discover novel flaws and compress the attack lifecycle.

Assured’s recommended action

Assume publicly exposed credentials will be found and used by rogue or malicious AI. Review secrets exposure across GitHub, GitLab, public repositories, container images, CI/CD pipelines and other sources. Rotate long-lived credentials and review third-party service accounts for excessive privileges. Transition to automated, risk-based patching to close the exploitation window.

---

Health-ISAC warns of escalating Shiny Hunter attacks on healthcare

The healthcare industry’s global cyber information-sharing organisation has published an advisory warning that notorious extortion group Shiny Hunters is aiming its sights at the sector. Health-ISAC pointed to an increase in successful attacks from the threat actor, claiming that its focus is “identity compromise and SaaS access over traditional ransomware deployment”. The attack chain highlighted in the report starts with vishing of employees or helpdesk staff, with purpose-built C2 panels enabling attackers to control authentication flows in real time. Once a single SSO account is compromised, the hackers use it as a springboard to connected SaaS platforms (Salesforce, Microsoft 365 etc).

Why it matters

Real-time control of authentication dialogues during a live call dramatically reduces the need for pre-compromised credentials. The attacker adapts the lure dynamically as the call progresses, rendering static awareness training insufficient. The kill chain has to be broken at the helpdesk procedure level, not just the user awareness level.

Assured’s recommended action

Follow Health-ISAC’s recommended mitigations. Enforce out-of-band verification for all password and MFA resets. Implement a “no same-call” policy at the helpdesk, which means no changes are processed during an inbound call – users must raise a ticket or call back on a verified number. Deploy phishing-resistant MFA (FIDO2/WebAuthn) for high-risk user groups. And treat SSO systems as Tier-0 assets with corresponding access controls.