================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, July 1, 2026 - 9:05 AM EDT ================================================================ A phishing-as-a-service platform now industrializes Microsoft 365 account takeover while more than 900 Oracle E-Business Suite servers sit exposed to active exploitation. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Frontier AI keeps cutting both ways as Commerce lifted Claude export controls even while hundreds of iPhone chatbot apps spilled the plaintext keys powering those same models. see: Frontier AI Models Cut Both Ways; Hundreds of iOS AI Apps Leak Model Keys * [TREND] Phishing has industrialized into subscription platforms, with ARToken renting 80-plus API endpoints to hijack Microsoft 365 while ClickFix serves polymorphic payloads from its own API-driven servers. see: ARToken Phishing-as-a-Service Targets Microsoft 365; ClickFix Adds API-Driven Malware Delivery * [UPDATE (new)] More than 900 Oracle E-Business Suite servers sit exposed weeks after a patch as attackers actively exploit the critical payments flaw CVE-2026-46817. see: Oracle E-Business Suite Servers Exposed to Active Attacks * [TREND] The Reading list debates AI's economics as Zitron argues the industry is losing, Newport warns of productivity paradoxes, and Figma's Dylan Field calls AI a tailwind. see: The AI Industry Is Losing; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] Locally, Kroger agreed to buy Giant Eagle for $1.65 billion while PublicSource weighs whether the region's AI data-center boom scars the landscape or cleans the power grid. see: Kroger to Buy Giant Eagle for $1.65 Billion; Data Centers and Southwestern Pennsylvania Power * [UPDATE (new)] PennDOT set detours for the coming 25-day Parkway East closure, routing primary traffic through Wilkinsburg, Point Breeze, and Oakland. see: Parkway East Closure Detour Set SECURITY ---------------------------------------------------------------- 1. FRONTIER AI MODELS CUT BOTH WAYS AI Security · [ai, llm, policy] Latest developments: The U.S. Commerce Department lifted its jailbreak-linked export controls on Anthropic's Claude Fable 5 and Mythos 5 on June 30, returning both worldwide July 1, as Anthropic shipped Sonnet 5 with safeguards against dangerous cyber use and Wired reported a researcher used Claude Opus 4.7 to breach Front Gate and issue any ticket he chose. Front Gate's ticketing platform serves nearly every major U.S. music festival, from Lollapalooza to Bonnaroo, and the researcher could freely mint tickets. The export-control reversal, Sonnet 5's new guardrails, and the Front Gate break-in show frontier models arming attackers as fast as they help defenders. - The Hacker News: https://thehackernews.com/2026/07/anthropic-restores-claude-fable-5-after.html - Wired Security: https://www.wired.com/story/claude-helped-a-hacker-find-a-way-to-issue-tickets-to-almost-every-us-music-festival/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/01/anthropic-claude-sonnet-5/ 2. ARTOKEN PHISHING-AS-A-SERVICE TARGETS MICROSOFT 365 Ransomware and Cybercrime · [phishing, bec, credential-theft] Latest developments: Cisco Talos named ARToken on July 1, an EvilTokens affiliate panel that exposes more than 80 API endpoints for device-code phishing, Primary Refresh Token persistence, mailbox access, business email compromise, and SharePoint exfiltration. ARToken sells ready-made attacks on Microsoft 365 accounts; operators send invoice emails impersonating vendors a target already pays, as one did to a Wisconsin contractor's billing contact at a life-sciences company in April 2026. Enforce phishing-resistant multi-factor authentication and block device-code sign-in flows. - Cisco Talos: https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/ 3. CLICKFIX ADDS API-DRIVEN MALWARE DELIVERY Ransomware and Cybercrime · [malware, social-engineering] Latest developments: The Hacker News detailed July 1 research analyzing 3,000 live ClickFix payloads, showing the fake 'prove you're human' pages now pull their malicious commands from API-driven servers that hand each visitor the same malware in a different disguise, alongside a new delivery method built to slip past Windows script scanning. ClickFix tricks people into pasting and running malware by hand through bogus verification prompts. Train staff to distrust copy-and-run instructions and restrict clipboard-to-terminal execution. - The Hacker News: https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html 4. ORACLE E-BUSINESS SUITE SERVERS EXPOSED TO ACTIVE ATTACKS Vulnerabilities and Exploits · [exploit, patch, oracle] Latest developments: BleepingComputer reported July 1 that more than 900 Oracle E-Business Suite instances sit exposed online as attackers actively exploit the critical payments flaw CVE-2026-46817. Oracle E-Business Suite runs finance, procurement, and human resources for large enterprises, and the flaw lets attackers reach unpatched servers over the internet. Apply Oracle's May 2026 patch and pull exposed instances off the public internet. - BleepingComputer: https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/ 5. HUNDREDS OF IOS AI APPS LEAK MODEL KEYS AI Security · [ai, mobile, api] Latest developments: The Hacker News reported June 30 that researchers tested 444 AI chatbot apps for iPhone and found 282, nearly two-thirds, exposing paid AI access in their network traffic through plaintext API keys, reusable tokens, or backends that accept requests with no key at all. Whoever captures one of these keys can send model requests on the developer's account and run up the bill. Developers should proxy AI calls through an authenticated backend and rotate any exposed keys. - The Hacker News: https://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.html 6. HOUSE PASSES KIDS ACT Policy and Regulation · [policy, privacy] Latest developments: The House passed the Kids Internet and Digital Safety Act on June 30 by a 267-117 margin, clearing the two-thirds majority its fast-track process required, though Senate approval looks unlikely. The KIDS Act would impose new online-safety duties on platforms serving minors. Its momentum stalls once it reaches the Senate. - The Record: https://therecord.media/house-passes-kids-online-safety-bill-senate-unlikely PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 98F. Tonight: Mostly Clear, low 75F. Thursday: Sunny, high 100F. Business: * Kroger to Buy Giant Eagle for $1.65 Billion Latest developments: Kroger announced a definitive agreement July 1 to acquire Pittsburgh-based Giant Eagle for $1.65 billion in cash and assumed liabilities. The deal puts Giant Eagle, one of Western Pennsylvania's most recognizable food and pharmacy chains, under Cincinnati-based Kroger; Kroger Chief Executive Greg Foran praised Giant Eagle for its fresh products, pharmacy, private label, and customer loyalty. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/pittsburgh-company-news/2026/07/01/giant-eagle-kroger/stories/202607010034 - KDKA: https://www.cbsnews.com/pittsburgh/news/kroger-buying-giant-eagle/ * Data Centers and Southwestern Pennsylvania Power Latest developments: PublicSource examined July 1 how the AI data-center boom sweeping the region could either scar the landscape or push the power sector toward cleaner generation. The analysis frames data centers rising on former steel-mill brownfields across southwestern Pennsylvania, tracing the choice between straining the grid and greening it back to the 1875 opening of the Edgar Thomson Works in Braddock. - PublicSource: https://www.publicsource.org/data-centers-could-brown-the-landscape-or-green-the-power-sector/ Around town: * Parkway East Closure Detour Set Latest developments: PennDOT laid out detour options July 1 for the coming 25-day Parkway East closure, routing the primary detour through Wilkinsburg, Point Breeze, and Oakland. Senior Assistant Construction Manager John Myler said drivers will move through Wilkinsburg, Point Breeze, and Oakland during the shutdown, which follows Swissvale business owners' warnings that the closure will choke deliveries and supplier routes. - KDKA: https://www.cbsnews.com/pittsburgh/video/penndot-laying-out-detour-options-for-upcoming-25-day-parkway-east-closure/ * Pitt Studies Dopamine and Teen Substance Use Latest developments: The Post-Gazette reported July 1 on a University of Pittsburgh study examining whether low dopamine levels are tied to substance use among teenagers. Pitt researchers are probing a possible link between diminished dopamine and adolescent drug and alcohol use, work that could reshape how clinicians identify teens at risk. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/07/01/pitt-study-dopamine-teens/stories/202607050015 * Allegheny County Vector Control Fights Bug-Borne Disease Latest developments: Pittsburgh City Paper profiled July 1 the Allegheny County Vector Control program as the county's first line of defense against insect-borne illness. The program screens and treats mosquitoes and ticks across Allegheny County for pathogens including West Nile virus and Lyme disease, a routine summer defense as heat and standing water raise the risk. - Pittsburgh City Paper: https://www.pghcitypaper.com/news-2/environment/allegheny-county-vector-control-program-fights-west-nile-virus-lyme-disease-arboviruses/ Events: * Inside Out Opens at Carnegie Museum of Art Latest developments: Pittsburgh City Paper's July guide detailed the DJ lineup for Inside Out, the Carnegie Museum of Art summer series that opens Thursday, July 2, in Oakland. Inside Out kicks off Thursday, July 2, at the Carnegie Museum of Art in Oakland with a DJ dance party featuring Delta, Ricky Mawzlin, Madame Trio, Keebs, TIZA, and special guest Kelman Duran; later editions add a Hill Dance Academy Theatre performance. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/the-big-pittsburgh-july-events-guide/ SPORTS ---------------------------------------------------------------- Pirates (43-43) Tue Jun 30 · Pirates 0 · Phillies 8 · Final Sánchez fans 9 in 7 innings, becomes 1st starter to reach 10 wins in 8-0 victory over Pirates https://plaintextsports.com/mlb/2026-06-30/pit-phi Up Next · Pirates @ Phillies · Wed Jul 1, 6:40 PM https://plaintextsports.com/mlb/2026-07-01/pit-phi Around the Teams: * Marcus Freeman on Not Just Football Latest developments: Notre Dame head coach Marcus Freeman joined Cam Heyward's Not Just Football podcast, released July 1, to trace his path from Ohio State linebacker to the Fighting Irish sideline. Freeman, once a teammate of Heyward's, talked leadership, recruiting, handling pressure, and developing NFL talent, along with faith and family, on the Steelers captain's show. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=rfvLY672_Zo Team USA: * USMNT Faces Bosnia in Round of 32 Latest developments: ESPN's July 1 scouting warned that Bosnia and Herzegovina's set-piece specialty will demand full focus as the United States plays its World Cup round-of-32 match on home soil Wednesday, July 1. Mauricio Pochettino's side, with Christian Pulisic declaring himself fit to go the distance, meets Bosnia and Herzegovina in the knockout round; ESPN framed the tie as the moment a team with a world-class coach and players in their primes can make its mark. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49227242/opposition-scouting-bosnia-herzegovina-set-piece-specialty-require-usmnt-full-focus-world-cup-round-32 - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49229496/riding-high-world-cup-home-soil-now-usmnt READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry's economics are collapsing under enormous spending against thin revenue, and that the sector is losing the case it has made for itself. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport warns that tools seemingly poised to be productivity slam dunks, like the personal computer, often fail to deliver expected gains, a caution he applies to today's technology hype. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Field discusses building Figma and his case that AI acts as a tailwind rather than a threat to the design software company. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,401.90 ▼ -0.7% Dow 52,029.51 ▲ +0.7% Nasdaq 25,633.34 ▼ -1.9% WTI crude 70.35 ▼ -6.8% EUR/USD 1.1381 ▼ -1.0% GBP/USD 1.3201 ▼ -0.6% USD/JPY 161.78 ▲ +0.4% ================================================================ Generated 2026-07-01 09:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================