Verified status as of August 6, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-63077 in Jetbrains Teamcity is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-05; federal remediation due 2026-08-08). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.
TL;DR
Nearly 800 malicious npm packages delivering cross-platform RAT/infostealer malware; Metabase SQL injection zero-day exploited in customer breaches; UNC6671 vishing group rebrands after millions in extortion. Patch WordPress pre-auth XSS and apply latest npm security updates immediately.
Executive Summary
- A cluster of nearly 800 malicious npm packages has been published to the npm registry, distributing cross-platform malware (RAT/infostealer) targeting Windows, macOS, and Linux.
- A critical Metabase SQL injection vulnerability was actively exploited in zero-day attacks to breach customer instances at Framework and Tally.
- UNC6671, a data extortion group previously known as BlackFile, has rebranded across multiple operations (Redact, Pink, Helix, Falcon) after generating millions in revenue through vishing attacks.
- WordPress fixed a pre-authentication reflected XSS flaw affecting all versions that can be chained to PHP code execution; ClickFix-style attacks now deliver macOS stealers capable of draining cryptocurrency wallets.
- Levi Strauss & Co. disclosed that hackers used social engineering on three employees to steal corporate data; North Carolina Ports Authority confirmed operational disruption from a cyberattack.
Top Threats Today
1. Nearly 800 Malicious npm Packages Deliver Cross-Platform Malware
Severity: HIGH Affected: Technology
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems [1]. The packages appear to use AI-generated or typo-squatting names to evade detection [1].
Sources:[1] The Hacker News
Recommended Action
- Audit npm dependencies immediately for any packages installed from suspicious or newly-created sources
- Enable npm audit and dependency scanning tools in your CI/CD pipeline
- Monitor for unusual process spawning or network connections on developer and production machines
- Implement network segmentation to isolate compromised systems
2. Metabase SQL Injection Actively Exploited in Customer Data Breaches
Severity: HIGH Affected: Technology
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances, with confirmed victims including Framework and Tally [1].
Sources:[1] BleepingComputer
Recommended Action
- Immediately verify your Metabase version and apply the latest security patch
- Review database access logs for suspicious SQL queries or data exfiltration
- Rotate database credentials and review user permissions
- Isolate affected Metabase instances from the network until patched
3. UNC6671 Vishing Extortion Group Expands Operations Under Multiple Brands
Severity: HIGH Affected: Finance
A data extortion group known as UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff to facilitate unauthorized access [1]. Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands after making millions in extortion revenue [2]. Recent attacks have targeted financial services, private equity, and professional services [1].
Sources:[1] The Hacker News[2] SecurityWeek
Recommended Action
- Deploy voice phishing detection and employee call verification protocols
- Mandate multi-factor authentication on all enterprise accounts and enforce hardware keys for privileged access
- Conduct voice phishing awareness training, emphasizing verification of IT requests through secondary channels
- Monitor for exfiltration of SaaS credentials and implement endpoint detection and response (EDR)
4. WordPress Pre-Auth XSS and macOS ClickFix Malware
Severity: HIGH Affected: Technology
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen affecting every version of the content management system [2]. Security researchers demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with a malicious link ⚠ [2]. Separately, ClickFix-style attacks are being used to deliver a Go-based macOS malware capable of stealing cryptocurrency assets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials [1].
Sources:[1] The Hacker News[2] The Hacker News
Recommended Action
- Update WordPress immediately to the latest patched version
- Review WordPress server logs for suspicious administrator account activity or file modifications
- Educate users not to click links in unsolicited messages, especially those claiming to require re-authentication
- Monitor macOS systems for unusual credential access or cryptocurrency wallet activity
5. Data Breaches Impact Millions; Social Engineering Gains Ground
Severity: HIGH Affected: Healthcare, Retail
Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach that occurred in October 2025 [1]. Apparel company Levi Strauss & Co. disclosed that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines [2].
Sources:[1] BleepingComputer[2] BleepingComputer
Recommended Action
- Review breach notification requirements and regulatory obligations; coordinate disclosure with legal and privacy teams
- Implement or upgrade endpoint detection and response (EDR) to catch lateral movement from compromised employee machines
- Deploy security awareness training focused on social engineering and credential hygiene
- Enforce principle of least privilege and monitor for unusual data access patterns
Today’s Action Checklist
- ☐ URGENT: Audit npm dependencies and repository configurations; implement dependency scanning for malicious packages
- ☐ URGENT: Patch Metabase instances immediately and review database access logs for compromise indicators
- ☐ URGENT: Update WordPress to latest version; review login screen for malicious redirects
- ☐ HIGH: Deploy voice phishing awareness training and implement call verification protocols
- ☐ HIGH: Enable MFA with hardware keys on critical accounts; segment developer and production environments
- ☐ MEDIUM: Review CVSS scores and patch guidance for Microsoft and Apple updates released this week