North Korea, 737 Fake VPNs, and the Patch You Really Can't Skip
Thursday, August 13, 2026 · 5-minute read
North Korea's Lazarus Group is running a campaign called Operation Dream Job, sending fake LinkedIn recruiter messages to workers at defense and aerospace companies in France, Germany, Brazil, and India. If a target takes the bait and opens a file, attackers install a backdoor — a never-before-seen piece of malware that gives them full control of the victim's machine. The lure? Convincing fake job offers from household names like Lockheed Martin.
↗ The Hacker NewsConnor Riley Moucka, a 26-year-old from Ontario, has pleaded guilty to hacking more than 165 organizations that used the cloud storage service Snowflake. He and his crew stole billions of customer records — including AT&T call logs, Social Security numbers, and financial data — then demanded ransom money to keep quiet. The Justice Department says he and his co-conspirators pocketed over $2.5 million in payments before Canadian police arrested him in October 2024.
↗ Krebs on SecurityThe FBI has issued a warning that criminals are specifically targeting adults' and children's social media accounts to steal sexually explicit photos and videos. Once thieves have those images, they typically use them to extort victims for money or more content — a crime called sextortion. The FBI says to use strong, unique passwords and turn on two-factor authentication on every account that holds personal photos.
↗ BleepingComputerA critical flaw in Microsoft SharePoint (CVE-2026-55040) was patched back in July, but this week a security firm published working proof-of-concept code showing exactly how to abuse it. Real attackers immediately picked it up and started using it. The flaw lets someone bypass login checks entirely, impersonate legitimate users, and access or alter files stored in SharePoint — without ever needing a password.
If your organization runs SharePoint on-premises and hasn't applied the July 2026 Patch Tuesday updates yet, you are currently exposed. The good news: a patch exists and fixes the problem completely.
Researchers found 737 free VPN extensions in the Chrome Web Store that aren't actually protecting users — they're doing the opposite. Instead of encrypting your traffic, they route everything through a single proxy controlled by one unknown provider. Many of the extensions impersonate trusted brands like NordVPN, ProtonVPN, and ExpressVPN, with fake icons and names designed to look identical to the real thing. Together they racked up over 75,000 installs.
SharePoint has a broken login check that lets an attacker pretend to be a legitimate user — no password needed. Once in, they can read files and change data. This flaw is actively being exploited right now using publicly available attack code.
Status: Patch available — included in Microsoft's July 2026 Patch Tuesday update. Apply immediately.
This flaw lives inside a core Windows networking driver called afd.sys. An attacker who already has basic access to your machine can use this bug to promote themselves to SYSTEM level — essentially becoming the owner of the entire machine. North Korea's Lazarus Group is already using this flaw in real attacks against defense companies. It requires the attacker to already be inside, so it's typically step two after a phishing attack.
Status: Patch available — included in Microsoft's August 2026 Patch Tuesday update. Install Windows updates now.
Attackers are actively probing online stores built on Adobe Commerce and Magento, trying to use this flaw to hijack customer accounts. If successful, they could access stored payment details, order history, and personal information belonging to shoppers. This is particularly dangerous for e-commerce businesses that store customer data.
Status: Patch available from Adobe. If you run an online store on these platforms, update immediately and check for any unauthorized account access.
A researcher known as Nightmare Eclipse released a working zero-day exploit called "ShieldBreak" for Microsoft Defender — the built-in antivirus on every Windows PC — the same day Microsoft released its August patches. The exploit grants SYSTEM-level access, meaning an attacker could fully take over any Windows machine running a vulnerable version of Defender.
Status: Microsoft's August 2026 Patch Tuesday update addresses the related underlying flaw. Install all pending Windows updates now.
Signal, the encrypted messaging app, just rolled out a feature called Automatic Key Verification. Here's the problem it solves: in rare cases, a sophisticated attacker could secretly position themselves between two people having a conversation and read messages that are supposed to be private — a trick called a man-in-the-middle attack. Previously, catching this required users to manually compare safety numbers with their contacts — something almost nobody does. The new feature handles that check automatically in the background, alerting you if something looks wrong without any extra steps. It's a meaningful upgrade to an already strong security tool, and it's free for all Signal users.
↗ BleepingComputerA new ransomware group called DeadLock has built its operation on top of blockchain infrastructure, making it far harder for law enforcement to shut them down. Normally, when authorities seize a ransomware gang's servers, the operation collapses. DeadLock routes its victim communications and data leak site through decentralized blockchain services that have no central server to seize. It's a worrying new blueprint that other criminal groups are likely to copy.
↗ BleepingComputerNew research from Picus Labs analyzed more than 338 million real attack simulations run inside actual company networks in the first half of 2026 — and the headline finding sounds like good news. Organizations are getting better at blocking attacks at the front door: average prevention effectiveness jumped from 62% to 69%. So why are breaches still happening constantly?
Because the front door isn't where attackers are winning anymore. The Picus Blue Report 2026 found that once an attacker gets past the perimeter — however they manage it, whether through phishing, a stolen password, or an unpatched vulnerability — the inside of most corporate networks is dramatically under-defended. Defenses that look strong from the outside turn soft on the inside. The weakest spots of all? Reconnaissance and credential theft — the quiet, early moves attackers make before anyone notices anything is wrong. Think of it like a bank with a great vault door but no security cameras inside once you're through it.
This matters for regular people because it explains why data breaches keep happening even at companies with large security budgets. Attackers have learned to be patient and quiet. They don't kick the front door in — they find a window, slip through, and then move slowly and silently through the building. By the time anyone notices, they've already reached the safe. The report found that logging — actually recording what happens inside a network — only reached 58%, meaning four in ten significant internal security events produce no record at all.
The takeaway for organizations: investing more in perimeter defenses while ignoring internal monitoring is like installing a deadbolt and leaving all the interior doors wide open. Security teams should watch for August's patch releases addressing the Windows and SharePoint flaws covered above — both are exactly the kind of bugs attackers use to get that initial foothold before going quiet. For individuals, the best protection remains the same boring advice that actually works: unique passwords, two-factor authentication, and keeping software updated.