Full Daily Digest

The attack path involved compromising web servers and network appliances, including a Fortinet FortiMail appliance, to deploy malware like PlugX and ShadowPad. The Complaint Management System was weaponized to deliver implants masquerading as updates, extending the threat actor's reach to both police staff and citizens. Mitigations include isolating critical systems, implementing strict access controls, and monitoring for unusual network activity. The convergence of multiple threat actors suggests a coordinated effort to exploit Pakistan's internal security apparatus, emphasizing the need for robust incident response plans.

The Hacker News · 2026-07-11 · Incidents: China- and India-aligned threat actors compromised Pakistani law enforcement systems, deploying custom malware to steal sensitive data.

The attack path begins with the exploitation of ghost GitHub accounts, registered years ago but left dormant, to avoid suspicion. These accounts are used to send API requests targeting public data such as repositories, user followers, and organizational memberships. The attackers blend their activity with legitimate traffic, leveraging GraphQL and REST routes to map organizational structures. In some cases, they escalate to cloning repositories or using exposed tokens to access private data. The campaigns operate in bursts, spanning weeks, and employ user agents mimicking legitimate tools to evade detection. Mitigation strategies include enabling GitHub audit log streaming, baselining user agent behavior, and proactively hunting for anomalies in API traffic. Organizations should also monitor for data exfiltration from private repositories and investigate any unusual activity.

SecurityWeek · 2026-07-11 · Incidents: Dormant GitHub accounts are being exploited in mass reconnaissance campaigns via API abuse, blending with normal traffic and escalating to data exfiltration.

The vulnerability stems from improper input validation in Zimbra's Classic Web Client, allowing attackers to embed malicious scripts in emails that execute upon opening. This stored XSS flaw can lead to session hijacking, credential theft, and unauthorized access to sensitive data. Attackers could exploit this without user interaction, as the payload persists on the server. The lack of a CVE identifier complicates tracking, but Zimbra's prompt patch (version 10.1.19) is critical. Organizations should prioritize updates, monitor for suspicious email activity, and consider disabling the Classic Web Client if feasible. Historical exploits, such as CVE-2023-37580, demonstrate the real-world risk of delayed patching.

The Hacker News · 2026-07-11 · Vulnerability: Zimbra's Classic Web Client has a critical stored XSS flaw enabling arbitrary code execution via malicious emails.