================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, July 2, 2026 - 9:06 PM EDT ================================================================ An AI agent ran a ransomware attack from break-in to database wipe without human hands, while a Scattered Spider suspect landed in a U.S. courtroom and CISA flagged flaws in satellite hardware. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Sysdig's JADEPUFFER became the first ransomware an LLM ran end to end, while ConsentFix steals Microsoft 365 tokens and ToddyCat's Umbrij abuses OAuth to read Gmail. see: AI Agent Runs Full Ransomware Attack; ConsentFix and ClickFix Hijack Microsoft 365 in Seconds; ToddyCat's Umbrij Malware Steals Gmail via OAuth * [UPDATE (new)] A dual U.S.-Estonian Scattered Spider suspect arrived to face charges over an $8 million luxury jewelry-store ransom demand. see: Scattered Spider Extradition and Interpol Ransomware Lure * [UPDATE (new)] CISA flagged maximum-severity hard-coded credentials in the Gardyn IoT Hub plus firmware-upload holes in CubeSpace satellite reaction wheels. see: CISA Flags Satellite and IoT Hardware Flaws * [TREND] Zitron argues the AI industry is losing on economics while Newport warns of productivity paradoxes and Figma's Dylan Field sees AI as a design tailwind. see: The AI Industry Is Losing; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] Pittsburgh preps its largest-ever fireworks and Anthrocon's 20th downtown as dangerous heat holds through the Fourth of July weekend. see: Pittsburgh's Biggest-Ever Fireworks on July 4; Anthrocon Turns 20 Downtown; Dangerous Heat Holds Through July 4 Weekend SECURITY ---------------------------------------------------------------- 1. SCATTERED SPIDER EXTRADITION AND INTERPOL RANSOMWARE LURE Ransomware and Cybercrime · [ransomware, arrest, social-engineering] Latest developments: A dual United States and Estonian citizen arrived in the U.S. July 2 to face charges as an alleged Scattered Spider member behind an $8 million cryptocurrency ransom demand against a luxury jewelry retailer, the same day Dark Reading detailed a separate crew impersonating Interpol to extort small businesses across the United States, Europe, and the Middle East. Scattered Spider has hit U.S. companies with data theft and extortion for over a year; the retailer's team ejected the attackers before paying yet still absorbed at least $2 million in disruption losses. The Interpol-branded campaign leans on plain social engineering, so staff should verify unexpected law-enforcement demands before acting. - Help Net Security: https://www.helpnetsecurity.com/2026/07/02/scattered-spider-criminal-group-suspect-extradited/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/alleged-scattered-spider-hacker-extradited-to-the-united-states/ - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/attackers-use-interpol-lure-target-small-businesses 2. CONSENTFIX AND CLICKFIX HIJACK MICROSOFT 365 IN SECONDS Ransomware and Cybercrime · [phishing, mfa-bypass, clickfix] Latest developments: BleepingComputer detailed ConsentFix on July 2, an attack that pairs fake prompts with malicious OAuth consent flows to steal Microsoft 365 tokens and bypass multifactor authentication in about three seconds, as Opera shipped Paste Protect, a default clipboard defense against the ClickFix commands that drove more than half of 2025's malware deliveries. ConsentFix tricks users into approving a rogue OAuth app that hands attackers session tokens, defeating multifactor prompts. Administrators should restrict user consent to vetted apps, and Opera desktop users now get clipboard warnings by default. - BleepingComputer: https://www.bleepingcomputer.com/news/security/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/opera-rolls-out-paste-protect-feature-to-fight-clickfix-attacks/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/02/opera-blocks-clickfix-attacks-with-new-clipboard-protection-feature/ 3. CISA FLAGS SATELLITE AND IOT HARDWARE FLAWS Vulnerabilities and Exploits · [ics, iot, patch] Latest developments: CISA published three advisories July 2: hard-coded credentials in the Gardyn IoT Hub rate a maximum 10.0 (CVE-2026-13768, CVE-2026-55726, CVE-2026-54477), a signature-verification gap lets attackers upload malicious firmware to CubeSpace CW0057 satellite reaction wheels, and flaws in ST Engineering iDirect iQ-Series satellite terminals (CVE-2026-38059, CVE-2026-38057) expose device data or force denial of service. The advisories span consumer gardening hardware and satellite communications gear. Operators should apply vendor firmware updates and isolate affected devices from untrusted networks. - CISA Advisories: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 - CISA Advisories: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-02 - CISA Advisories: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01 4. AI AGENT RUNS FULL RANSOMWARE ATTACK AI Security · [ai, ransomware, rce] Latest developments: Sysdig's Threat Research Team disclosed July 2 the first ransomware intrusion a large language model executed start to finish, naming the operator JADEPUFFER, which exploited a Langflow remote-code-execution flaw and then stole credentials, spread through the network, and encrypted and wiped a company's production database. Autonomous AI has moved from surfacing vulnerabilities to conducting entire intrusions. Teams running Langflow and similar AI orchestration platforms should patch the remote-code-execution flaw and watch for machine-speed reconnaissance and encryption. - The Hacker News: https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html 5. TODDYCAT'S UMBRIJ MALWARE STEALS GMAIL VIA OAUTH Nation-State Activity · [apt, espionage, oauth] Latest developments: Kaspersky attributed a new malware family called Umbrij to the espionage group ToddyCat this week, detailing how it abuses OAuth access to read corporate Gmail correspondence through the Google API. ToddyCat runs cyberespionage against corporate and government targets. Umbrij's OAuth abuse sidesteps passwords and multifactor checks, so defenders should audit Google Workspace app grants and revoke stale tokens. - The Hacker News: https://thehackernews.com/2026/07/toddycat-linked-umbrij-malware-abuses.html 6. UK DELAYS NATIONAL CYBER ACTION PLAN Policy and Regulation · [policy, government] Latest developments: The Record reported July 2 that Britain postponed the launch of its National Cyber Action Plan, due for publication that Monday, amid uncertainty over the governing Labour Party's leadership contest opening July 9. The plan sets Britain's cybersecurity priorities for the coming years. The delay leaves its timing uncertain until Labour resolves its leadership contest. - The Record: https://therecord.media/launch-of-uk-national-cyber-action-plan-delayed BUSINESS AND POLITICS ---------------------------------------------------------------- * Investors Pull From Private-Credit Funds Latest developments: Investors are seeking to withdraw nearly $16 billion from private-credit funds, and more managers have begun rationing redemptions to slow the outflow. The Wall Street Journal reported July 2 that private-credit fund managers, wary of a prolonged redemption cycle, are rationing withdrawals as investors try to pull nearly $16 billion, an early stress signal in a fast-grown market that pensions and insurers now hold widely. - WSJ Markets: https://www.wsj.com/finance/investing/investors-seek-to-pull-nearly-16-billion-from-private-credit-funds-81b6fe37?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Mostly Clear, low 77F. Friday: Sunny, high 98F. Friday Night: Chance Showers And Thunderstorms, low 76F. Business: * 'Mayor of Kingstown' Wrap Pumped $325 Million Into Region Latest developments: The Pittsburgh Film Office put a figure on the production's local impact: more than $325 million injected and over 10,000 jobs created across 457 shoot days since 2022. The Paramount+ series 'Mayor of Kingstown' finished filming its fifth and final season in western Pennsylvania, capping a run the Pittsburgh Film Office says began in 2022 and pumped more than $325 million into the regional economy. - KDKA: https://www.cbsnews.com/pittsburgh/news/mayor-of-kingstown-wraps-pittsburgh/ * CMU Snakebots Aid Venezuela Earthquake Search Latest developments: Carnegie Mellon University's robotics team deployed its articulated 'snakebots' to help search for survivors after earthquakes struck Venezuela. A Carnegie Mellon University robotics team sent its 'snakebots'—articulated search-and-rescue robots that thread through rubble—to help find survivors of the Venezuelan earthquakes, TribLive reported July 2. - TribLive: https://triblive.com/news/education-classroom/cmu-robotics-team-and-snakebots-assist-venezuelan-earthquake-victims/ Around town: * Allegheny County Launches Vision Zero Plan Latest developments: Allegheny County unveiled a countywide Vision Zero plan July 2 aiming to eliminate traffic deaths and serious injuries by 2050, alongside a study naming the county's ten most dangerous roads. Allegheny County leaders launched the Vision Zero safety action plan, which targets zero traffic fatalities by 2050 through fixes to the county's most dangerous corridors; a companion Post-Gazette study identified the ten roads with the worst safety records. - WTAE: https://www.wtae.com/article/pennsylvania-allegheny-county-vision-zero-traffic-safety/71810793 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/07/02/road-safety-study-allegheny-county/stories/202607020068 * Dangerous Heat Holds Through July 4 Weekend Latest developments: The dangerous heat wave will persist through the Fourth of July weekend with afternoon storms developing, and western Pennsylvania utilities are watching the electric grid closely. Temperatures topping 90 degrees will grip western Pennsylvania into the Independence Day weekend, prompting power companies to monitor the grid and forecasters to warn of developing thunderstorms. - WPXI: https://www.wpxi.com/news/local/heat-wave-continues-through-end-week-storms-begin-developing/V4SIDR7WNZGF7MQUXG2PA4OKWI/ - KDKA: https://www.cbsnews.com/pittsburgh/video/power-companies-keep-close-eye-on-electric-grid-amid-dangerous-heat-wave/ * PennDOT Work Narrows Freeport Road in Harrison Latest developments: A PennDOT drainage project has cut long stretches of Freeport Road in Harrison Township to one lane, work that began in February and continues. Long sections of Freeport Road in Harrison Township are down to a single lane as a PennDOT drainage project that started in February grinds on, TribLive reported July 2. - TribLive: https://triblive.com/local/valley-news-dispatch/penndot-work-continues-in-harrison-limits-large-sections-of-freeport-road/ Events: * Pittsburgh's Biggest-Ever Fireworks on July 4 Latest developments: Final setup is underway for Pittsburgh's Fourth of July celebration Saturday, billed as the largest fireworks show in city history, with heightened downtown security for an expected record crowd. Pittsburgh marks America's 250th on Saturday, July 4, with what organizers call the city's largest fireworks show ever—a 25-minute display launched from five barges on the Ohio River—plus a drone show, a performance by the Plain White T's, line dancing, a Ferris wheel and a hot air balloon on the North Shore, and the South Side Street Fest on East Carson Street; the events are free. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-fourth-of-july-america-250-celebration-schedule/ - TribLive: https://triblive.com/news/july-4-fireworks-show-promises-a-panorama-of-light-over-pittsburgh/ * Anthrocon Turns 20 Downtown Latest developments: Anthrocon, one of the world's largest furry conventions, runs Thursday, July 2, through Sunday, July 5, at the David L. Lawrence Convention Center downtown, marking its 20th anniversary. Anthrocon draws tens of thousands of costumed attendees to the David L. Lawrence Convention Center in downtown Pittsburgh from July 2 through July 5, celebrating the furry convention's 20th year. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/17-things-to-do-for-4th-of-july-weekend-in-pittsburgh/ * Westmoreland Arts and Heritage Festival Opens Latest developments: The Westmoreland Arts and Heritage Festival opened its run July 2 at Twin Lakes Park, drawing vendors and visitors through 90-degree heat. The Westmoreland Arts and Heritage Festival got underway July 2 at Twin Lakes Park in Westmoreland County, an outdoor arts fair of vendors and performers running across the holiday weekend. - WTAE: https://www.wtae.com/article/pennsylvania-westmoreland-arts-heritage-festival/71810825 SPORTS ---------------------------------------------------------------- Pirates (44-44) Wed Jul 1 · Pirates 6 · Phillies 10 · Final Phillies beat Paul Skenes and the Pirates 10-6 as Turner hits a 3-run homer https://plaintextsports.com/mlb/2026-07-01/pit-phi Thu Jul 2 · Pirates 6 · Phillies 1 · Final Valdez helps Pirates beat Phillies 6-1 to split their four-game series https://plaintextsports.com/mlb/2026-07-02/pit-phi Up Next · Pirates @ Nationals · Fri Jul 3, 6:45 PM https://plaintextsports.com/mlb/2026-07-03/pit-wsh Around the Teams: * Skenes Vows to Fix His Struggles Latest developments: After a string of rough outings capped by a career-high eight runs against the Phillies, Pirates ace Paul Skenes told the Post-Gazette he is determined to get a grip on his mechanics. Pirates ace Paul Skenes, rocked for a career-high eight runs by the Philadelphia Phillies, promised to work out of a stretch of bumpy starts, the Post-Gazette reported July 2. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/02/mlb-skenes-struggles-pitching/stories/202607020033 * Pirates Post Worst Month in June Latest developments: The Post-Gazette's June report card graded the Pirates their worst month of the season, blaming teamwide pitching failures even as Esmerlyn Valdez emerged as a bright spot. The Pittsburgh Pirates stumbled through their worst month of 2026 in June, the Post-Gazette's report card found, as pitching woes across the staff dragged the club down and rookie Esmerlyn Valdez supplied rare offense. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/01/skenes-nl-central-bullpen-jones-reynolds-esmerlyn/stories/202607010037 * Film Study: Rookie Heidenreich Needs Seasoning Latest developments: A Post-Gazette film study concluded Steelers rookie receiver Eli Heidenreich, out of Navy, shows playmaking flashes that still need development. The Post-Gazette's film study of Steelers rookie wide receiver Eli Heidenreich, drafted from Navy, praised his playmaking instincts while cautioning he needs more seasoning before he contributes, published July 1. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/01/film-study-analysis-heidenreich-navy-nfl-draft/stories/202606300037 Team USA: * Balogun Cannot Appeal Red Card, Faces Extended Ban Latest developments: ESPN reported the USMNT has no route to appeal Folarin Balogun's red card against Bosnia and Herzegovina and that he could face an extended ban, even as a VAR review found the sending-off misapplied protocol. Folarin Balogun, the United States' top scorer, was sent off in the World Cup last-32 win over Bosnia and Herzegovina; ESPN reported July 2 the U.S. cannot appeal and he risks an extended suspension as the team readies to face Belgium in the round of 16 without him. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49248052/usmnt-cannot-appeal-folarin-balogun-red-card-face-extended-world-cup-ban-sources - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49244156/world-cup-var-review-misapplied-protocols-leave-usmnt-folarin-balogun-wrongly-red-carded-world-cup-vs-bosnia-herzegovina * USMNT Win Sets Viewership Record Latest developments: The United States' win over Bosnia and Herzegovina drew 33.5 million U.S. viewers, the most-watched soccer broadcast on record, the Guardian reported July 2. The USMNT's dramatic World Cup win over Bosnia and Herzegovina averaged 24.4 million viewers on Fox and 9.1 million on Telemundo—33.5 million combined—the most-watched soccer broadcast in U.S. history, topping the averages of the NBA Finals and Sunday Night Football. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/02/usmnt-world-cup-most-watched-viewership-record * USWNT's Emma Sears Requests Trade Latest developments: USWNT winger Emma Sears has asked Racing Louisville for a trade, and several NWSL clubs have shown serious interest, ESPN reported. Emma Sears, a winger for the U.S. women's national team, requested a trade from Racing Louisville, with multiple NWSL teams pursuing her, sources told ESPN on July 2. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49251790/uswnt-emma-sears-trade-request-racing-louisville-nwsl READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry is losing on the economics, with its leading companies spending far more than they earn and the promised returns failing to arrive. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport examines why transformative tools like the personal computer often fail to deliver the productivity gains they promise, and what that history warns about the current AI moment. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Thompson interviews Figma CEO Dylan Field about building the company and why he believes AI gives Figma a tailwind in design software. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 70.00 ▼ -5.9% EUR/USD 1.1392 ▼ -0.2% GBP/USD 1.3234 ▲ +0.2% USD/JPY 162.14 ▲ +0.4% ================================================================ Generated 2026-07-02 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================