Morning Review in IT Security — August 8, 2026

The cybersecurity landscape continues to evolve with critical vulnerabilities, supply chain attacks, and sophisticated social engineering campaigns dominating threat intelligence feeds. Today's briefing covers zero-day exploits, malware campaigns targeting developers, and breaches impacting millions of individuals across healthcare and financial sectors.

Metabase SQLi Zero-Day Exploited in Customer Data-Theft Attacks

A critical SQL injection vulnerability in Metabase has been actively exploited in zero-day attacks targeting customer instances. The vulnerability was leveraged to conduct data theft operations against known victims including Framework and Tally. Source: Metabase SQLi zero-day exploited in customer data-theft attacks

Organizations running Metabase deployments should prioritize immediate assessment of their instances for signs of compromise and apply available security patches. This incident underscores the importance of monitoring for exploitation of business intelligence tools that often have direct access to sensitive databases.

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A massive campaign has introduced approximately 800 malicious packages into the npm registry, employing AI-generated and typo-squatting techniques to evade detection. These packages deliver a powerful remote access trojan and infostealer capable of compromising Windows, macOS, and Linux systems. The malware infrastructure includes command and control domains such as wel1.ru, cloudpayments.ru, and tcsbank.ru, with payloads identified as Sliver and WEL1DROPPER. Source: Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

This supply chain attack represents a significant threat to the developer community, as compromised dependencies can propagate malware across numerous downstream projects. Organizations should implement strict npm package vetting procedures and monitor their dependency trees for suspicious or newly published packages.

Unlimited Technology Systems Breach Impacts 3.8 Million People

Healthcare software provider Unlimited Technology Systems disclosed a data breach affecting more than 3.8 million individuals. The breach occurred in October 2025 but was only recently reported, exposing sensitive patient information managed through the company's healthcare software platform. Source: Unlimited Technology Systems breach impacts 3.8 million people

This incident highlights the ongoing vulnerability of healthcare infrastructure to data theft and raises concerns regarding HIPAA compliance and notification timelines. Affected individuals should monitor their personal information for signs of misuse and consider credit monitoring services.

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

Social engineering attacks leveraging the ClickFix technique are now delivering a Go-based malware targeting macOS systems. The malware, identified as Atomic Stealer and MacSync, is designed to steal cryptocurrency assets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The infection chain uses shell scripts to profile the host system before delivering architecture-specific payloads. Source: ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

macOS users should exercise caution when responding to pop-up notifications claiming security threats and verify system alerts through official Apple channels. The targeting of cryptocurrency wallets indicates attackers are prioritizing high-value targets with readily transferable assets.

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

A data extortion group designated UNC6671 is conducting voice phishing attacks against employees in financial services, private equity, and professional services sectors. The threat actors impersonate IT help desk staff and contact employees on personal phones to facilitate fraudulent security migrations, ultimately stealing SaaS credentials and multi-factor authentication tokens. The attacks employ PowerShell and Python scripts for credential harvesting. Source: UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

This campaign demonstrates the effectiveness of targeting employees outside traditional corporate communication channels. Organizations should implement security awareness training emphasizing verification procedures for unexpected IT requests and establish clear protocols for credential management during system migrations.

More Than Half of AI-Generated Patches Are Broken

Research reveals that artificial intelligence-generated security patches fail to fully remediate vulnerabilities in more than half of cases and may introduce new exploitable flaws in the process. This finding raises significant concerns about the reliability of AI-assisted patch development and vulnerability remediation. Source: More than half of AI-generated patches are broken

Organizations should maintain human oversight in patch development and validation processes rather than relying exclusively on automated AI-generated solutions. Security teams must conduct thorough testing of all patches, regardless of their origin, before deploying them to production environments.

Real Emails, Hijacked Payments: Two H1 2026 Attack Chains

Gen's H1 2026 Threat Report documents two distinct attack chains exploiting different vectors for financial gain. The first chain compromised business email accounts and manipulated browser behavior to distribute banking malware including GepyS, Remcos RAT, and XWorm. The second attack chain employed clipboard hijacking techniques to redirect cryptocurrency payments to attacker-controlled wallets. Source: Real emails, hijacked payments: Two H1 2026 attack chains

These sophisticated attack chains highlight the convergence of email compromise and endpoint manipulation tactics. Organizations should implement email authentication mechanisms, monitor for unauthorized account access, and deploy endpoint protection capable of detecting clipboard manipulation and browser injection attacks.

In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street

Several noteworthy security incidents warrant attention including restrictions on AI-generated content in Apple's bug bounty program, supply chain attacks involving QuickFox VPN, phishing-based compromise of IEH Corporation's mailbox, and emerging malware families including CountLoader, DeviceManager RAT, DoubleCup, EndlessDoors, and FDMTP. Additionally, discussions continue regarding bans on Chinese data center technology and targeting of Wall Street infrastructure. Source: In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street

These diverse threats underscore the multi-faceted nature of the current threat landscape, spanning AI-generated vulnerabilities, supply chain compromises, and infrastructure targeting. Security professionals should maintain awareness of emerging malware families and adjust defensive strategies accordingly.

Today's threat landscape reflects a sophisticated adversary ecosystem leveraging both technical exploits and social engineering to achieve financial and data theft objectives. Organizations should prioritize patch management, supply chain security, employee awareness training, and continuous monitoring of their infrastructure and endpoints.