================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 12, 2026 - 9:07 AM EDT ================================================================ A poisoned jscrambler npm release seeding a cross-platform infostealer led a day dominated by software supply-chain attacks, China- and India-aligned espionage against Pakistani police, and fresh bootloader flaws. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep targeting developers, planting a native infostealer in the jscrambler npm release while disposable ghost accounts abuse the GitHub API to map organizations for reconnaissance. see: Poisoned jscrambler npm Release; Ghost Accounts Map GitHub Orgs * [TREND] China-linked crews expanded their reach as Silver Fox fielded the Rust-based MODBEACON trojan while China- and India-aligned actors breached Balochistan Police networks in Pakistan. see: Silver Fox Deploys MODBEACON RAT; China and India Spy on Balochistan Police * [TREND] Binarly disclosed six new U-Boot bootloader flaws, two of which let an attacker plant a malicious image and run code before a device even boots. see: Six U-Boot Bootloader Flaws * [UPDATE (new)] U.S. forces struck Iranian military sites after Tehran declared the Strait of Hormuz closed and claimed retaliatory strikes on American bases in neighboring Gulf countries. see: U.S. and Iran Escalate Fight Over Strait of Hormuz * [TREND] Updated Reading essays frame the AI build-out's strains, from Zitron's memory-chip crisis to Thompson's verifiable data race and Newport's productivity paradox warning. see: Premium: The Hater's Guide To The Memory Crisis; Muse Image, Grok 4.5, Alex Karp on CNBC; Beware of Productivity Paradoxes SECURITY ---------------------------------------------------------------- 1. CHINA AND INDIA SPY ON BALOCHISTAN POLICE Nation-State Activity · [apt, espionage] Latest developments: The Record and The Hacker News reported July 10 and 11, 2026 that suspected China- and India-aligned threat actors ran separate espionage campaigns against Pakistani law enforcement, chiefly the Balochistan Police, breaching servers that hold criminal and citizen records between February 2024 and April 2026 and in some cases hitting the exact same systems. The targeted force polices Pakistan's southwestern province, the site of a long-running separatist insurgency; the compromised assets ran web applications managing police and citizen data, so investigators should assume broad credential and record theft. - The Hacker News: https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html - The Record: https://therecord.media/china-india-ran-separate-spy-campaigns-against-same-police-force 2. POISONED JSCRAMBLER NPM RELEASE Ransomware and Cybercrime · [supply-chain, malware, npm] Latest developments: The Hacker News reported July 11, 2026 that attackers compromised the jscrambler npm package so its 8.14.0 release runs a native infostealer on install through a preinstall hook that drops one build each for Windows, macOS, and Linux, with Socket flagging the release six minutes after publication. jscrambler is a widely used JavaScript obfuscation and protection tool; anyone who installed version 8.14.0 ran the stealer, so teams should remove it, pin to a known-good release, and rotate exposed credentials. - The Hacker News: https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html 3. GHOST ACCOUNTS MAP GITHUB ORGS Ransomware and Cybercrime · [recon, cybercrime] Latest developments: SecurityWeek reported July 11, 2026 that multiple campaigns run disposable ghost accounts to abuse the GitHub API, mapping organizations along with their repositories and members at scale for pre-attack reconnaissance. The throwaway accounts pull repository and membership data through GitHub's API to profile targets before striking; organizations should tighten API rate limits and audit who can enumerate their members. - SecurityWeek: https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/ 4. SIX U-BOOT BOOTLOADER FLAWS Vulnerabilities and Exploits · [firmware, patch] Latest developments: Firmware security firm Binarly disclosed six new flaws July 10, 2026 in the U-Boot bootloader; four can crash a device, and two let an attacker who plants a malicious image run code before the device boots, opening the door to stealthy, persistent firmware implants. U-Boot starts the hardware inside home routers, smart cameras, and the management chips in data-center servers; vendors need to ship firmware fixes, because code planted at boot survives operating-system reinstalls. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-u-boot-flaws-could-enable-stealthy-firmware-attacks/ - The Hacker News: https://thehackernews.com/2026/07/six-new-u-boot-flaws-could-let.html 5. SILVER FOX DEPLOYS MODBEACON RAT Nation-State Activity · [apt, malware] Latest developments: Chinese security firm QiAnXin attributed a new Rust-based remote access trojan called MODBEACON to the China-linked Silver Fox group on July 10, 2026, describing malware that uses gRPC streaming to encrypt its command-and-control traffic and spreads through counterfeit installers pushed by search-engine poisoning. Silver Fox looks like a low-sophistication, high-volume operation, though QiAnXin says its organization runs deeper; users should avoid installers surfaced through search results and verify software sources. - The Hacker News: https://thehackernews.com/2026/07/new-modbeacon-rat-uses-grpc-streaming.html BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. and Iran Escalate Fight Over Strait of Hormuz Latest developments: American forces launched fresh strikes on Iranian military sites after Tehran again declared the strait closed following a warning shot at a commercial vessel, and Iran said it struck U.S. bases in neighboring Gulf countries. The United States and Iran traded attacks over the Strait of Hormuz, the chokepoint for roughly a fifth of the world's seaborne oil, with Iran firing on shipping and on targets in Jordan, Oman, Kuwait, Bahrain, and Qatar while U.S. Central Command hit Iranian sites; Washington insists the waterway stays open, keeping a fragile ceasefire near collapse. - WSJ World News: https://www.wsj.com/world/middle-east/u-s-launches-new-strikes-on-iran-after-hormuz-tensions-escalate-d6903c7f - FT World: https://www.ft.com/content/6b6c23e9-f24e-4c3e-bb1a-e5cb6860008d * Senator Lindsey Graham Dies at 71 Latest developments: Graham died Saturday evening, July 11, of a brief and sudden illness, his office said, leaving his South Carolina Senate seat open for the governor to fill. Lindsey Graham, the South Carolina Republican who chaired the Senate Judiciary Committee and became one of President Trump's closest allies and the chamber's leading hawk on Iran and Israel, died at 71 after evolving from an early Trump critic into a central pillar of the president's agenda. - WSJ Politics: https://www.wsj.com/politics/lindsey-graham-longtime-republican-senator-dies-of-brief-and-sudden-illness-bd02a353 - FT World: https://www.ft.com/content/b3b93565-652a-41e9-aabd-9ed35309bdeb PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 87F. Tonight: Mostly Clear, low 67F. Monday: Sunny, high 87F. Business: * Pennsylvania Joins $45 Million Cash App Settlement Latest developments: Attorney General Dave Sunday announced Sunday, July 12, a $45 million multistate settlement with the owner of the mobile-payment app Cash App, with Pennsylvania set to collect $1,137,695.72. A national settlement resolves state claims against the company behind Cash App; the Commonwealth of Pennsylvania will receive $1,137,695.72 of the $45 million pot. - WPXI: https://www.wpxi.com/news/local/attorney-general-sunday-announces-45-million-national-settlement-with-cash-app-owner/JTYVKD6BFVAKBP4BVE7VULBR7M/ * West Overton Distillery Bottles America 250 Cherry Bounce Latest developments: The distillery at West Overton Village in Westmoreland County launched a historic cherry bounce to mark the nation's 250th anniversary. West Overton Village's distillery revived cherry bounce, a colonial cherry-infused whiskey, as its contribution to the semiquincentennial, betting on whiskey-making as a draw for the historic site. - TribLive: https://triblive.com/local/westmoreland/west-overton-village-distillery-launches-historic-cherry-bounce-for-america-250/ Around town: * Parkway East Closure Snarls Homestead as Big Boy Draws Crowds Latest developments: On the closure's first full day, thousands who came to Homestead to watch Union Pacific's Big Boy No. 4014 steam locomotive pass through compounded detour gridlock for hours Saturday. PennDOT's 25-day closure of the Parkway East (I-376) for the Commercial Street Bridge replacement is funneling roughly 100,000 daily vehicles onto detours through Homestead and Munhall, where the Big Boy's passage layered a crowd worse than Christmas onto already jammed streets, Munhall emergency management coordinator Daryyl Hunt said. - KDKA: https://www.cbsnews.com/pittsburgh/news/parkway-east-closure-big-boy-traffic-homestead/ - WTAE: https://www.wtae.com/article/parkway-east-closure-prompts-traffic-backups-around-pittsburgh/71908113 * PennDOT Launches Aggressive-Driving Crackdown Latest developments: PennDOT and its safety partners kicked off an aggressive-driving enforcement campaign targeting speeding, tailgating, and running red lights. The statewide campaign steps up police enforcement against speeding, tailgating, and red-light running across Pennsylvania roads. - WPXI: https://www.wpxi.com/news/local/penndot-safety-partners-kick-off-aggressive-driving-enforcement-campaign/D5Z6IRVOIZDGBMMMT3D67MNW6A/ * Jeannette Hires Three Officers to Curb Overtime Latest developments: The Westmoreland County city of Jeannette hired three new police officers this week, which officials said should ease the department's ballooning overtime costs. Jeannette added three officers to its police force in a move officials framed as a way to rein in overtime spending. - TribLive: https://triblive.com/local/westmoreland/jeannette-hires-3-police-officers-to-help-rein-in-ballooning-overtime-costs/ Events: * Picklesburgh Returns for 11th Year Latest developments: Picklesburgh comes back for an 11th year with a bigger festival and new pickle creations. Picklesburgh, Pittsburgh's pickle-themed food festival, returns larger with fresh pickle concoctions, extending a local obsession the Senator John Heinz History Center traces to Henry John Heinz's 1869 Anchor Pickle and Vinegar Works. - TribLive: https://triblive.com/lifestyles/food-drink/picklesburgh-returns-for-11th-year-with-bigger-festival-new-pickle-creations/ SPORTS ---------------------------------------------------------------- Pirates (49-47) Sat Jul 11 · Brewers 6 · Pirates 7 · Final Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader https://plaintextsports.com/mlb/2026-07-11/mil-pit Sat Jul 11 · Brewers 2 · Pirates 3 · Final Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders https://plaintextsports.com/mlb/2026-07-11/mil-pit Up Next · Brewers @ Pirates · Sun Jul 12, 12:15 PM https://plaintextsports.com/mlb/2026-07-12/mil-pit Around the Teams: * Post-Gazette: Pirates Are Misusing Carmen Mlodzinski Latest developments: Columnist Noah Hiles argued the Pirates and general manager Ben Cherington must give right-handed reliever Carmen Mlodzinski a bigger role. In a Post-Gazette column, Noah Hiles wrote that the Pirates are wasting Carmen Mlodzinski in the bullpen and should lean on him more heavily as the club sorts out its late-inning arms. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/hiles-column-mlodzinski-bullpen-mlb-kelly-cherington/stories/202607110014 * Off The Bat: How the Pirates Found Power Latest developments: The Post-Gazette's 'Off The Bat' detailed how the Pirates have already passed their entire 2025 home run total. The Post-Gazette charted how Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn have driven the Pirates past last season's full home run count, a jolt of power for a lineup that lacked it a year ago. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/pirates-mlb-home-run-reynolds-lowe-o-hearn/stories/202607100074 READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron dissects the memory-chip crisis—the surging cost and scarcity of memory hardware—casting it as another symptom of an overheated AI build-out. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the battle for verifiable data increasingly defines the AI race, tying together Meta's Muse Image, xAI's Grok 4.5, and Palantir chief Alex Karp's CNBC remarks. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Cal Newport -- Beware of Productivity Paradoxes Newport warns that transformative tools like the personal computer often fail to deliver the productivity gains they promise, and reads today's AI enthusiasm against that history. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3382 ▲ +0.9% USD/JPY 162.21 ▲ +0.1% ================================================================ Generated 2026-07-12 09:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================