================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 26, 2026 - 6:05 AM EDT ================================================================ Attackers handed hands-on-keyboard intrusion work to an unattended AI agent inside Thailand's finance ministry as a browser-built malvertising wave and an unpatched Fastjson flaw drew live exploitation. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are handing offensive work to autonomous AI, running the unattended Hermes agent across Thailand's Ministry of Finance while a reading unpacks OpenAI's accidental Hugging Face intrusion. see: Hackers Automate a Ministry Breach With an Unattended AI Agent; OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips * [TREND] Unauthenticated remote code execution keeps surfacing server-side, from live attacks on Alibaba's unpatched Fastjson library to crafted SVGs running as SYSTEM on Bing's image workers. see: Fastjson RCE Draws Live Attacks Before a Patch; Crafted SVGs Run as SYSTEM on Bing's Image Servers * [TREND] Malware-as-a-service is regrouping as SourTrade builds executables inside browsers, PRODAFT exposes the DevMan ransomware portal, and BlueNoroff's kit profiles crypto wallets. see: SourTrade Malvertising Builds Malware Inside the Browser; Malware-as-a-Service Ecosystems Regroup; BlueNoroff Phishing Kit Profiles Crypto Wallets * [UPDATE (new)] The US-Iran war drove oil higher and pushed investors to price in a live Federal Reserve rate increase at next week's meeting. see: Oil Surge Puts a Fed Rate Rise in Play * [TREND] Pittsburgh is grappling with recurring spontaneous teen takeovers even as the region nears an annual tornado record after a stormy summer. see: Pittsburgh Seeks Answers on Teen Takeovers; Pittsburgh Nears Annual Tornado Record SECURITY ---------------------------------------------------------------- 1. SOURTRADE MALVERTISING BUILDS MALWARE INSIDE THE BROWSER Ransomware and Cybercrime · [malvertising, malware] Latest developments: Confiant detailed SourTrade on July 23, 2026, a malvertising operation running since late 2024 that impersonates TradingView, Solana, and Luno and makes victims' browsers assemble the final Windows executable from pieces using the legitimate Bun runtime, defeating scanners that expect one complete malicious file at a fixed URL. SourTrade targets retail cryptocurrency traders through fake ad-driven pages whose JavaScript builds malware directly in browser memory. Block the impersonated domains and flag unexpected Bun runtime execution on endpoints. - The Hacker News: https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/ 2. MALWARE-AS-A-SERVICE ECOSYSTEMS REGROUP Ransomware and Cybercrime · [ransomware, malware] Latest developments: PRODAFT exposed a centralized DevMan ransomware-as-a-service portal it tracks as Funky Mantis, where affiliates build payloads, manage victims, and track payouts, while the Golden Chickens malware-as-a-service crew resurfaced with four new families: TinyEgg, ChonkyChicken, a modular ChonkyChicken variant, and a reworked browser-credential stealer. Both operations sell turnkey attack infrastructure to affiliates, lowering the bar for ransomware and credential theft. Monitor for the named families and treat commodity service portals as active threats. - The Hacker News: https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html - The Hacker News: https://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.html 3. FASTJSON RCE DRAWS LIVE ATTACKS BEFORE A PATCH Vulnerabilities and Exploits · [rce, exploit] Latest developments: ThreatBook and Imperva report attackers exploiting CVE-2026-16723, a 9.0-rated flaw in Alibaba's Fastjson Java library, where a single malicious JSON request runs code without authentication at the privileges of the Java process, and no fix is yet available. Fastjson parses JSON inside countless Spring Boot applications, exposing affected servers to unauthenticated remote code execution. Filter untrusted JSON, apply Alibaba's mitigations, and move off the 1.x branch. - The Hacker News: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html 4. HACKERS AUTOMATE A MINISTRY BREACH WITH AN UNATTENDED AI AGENT AI Security · [ai, breach] Latest developments: A threat actor installed the open-source Hermes AI agent on a rented server, switched off its permission prompts, and ran it in unattended "YOLO" mode to automate post-exploitation across Thailand's Ministry of Finance, checking hosts for root, hunting through file systems, and working the treasury-and-tax network on its own. The Ministry of Finance runs Thailand's treasury and tax collection, and the case marks attackers handing live intrusion work to a commodity AI agent. Restrict outbound access from AI tooling and treat agent activity as privileged. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/ - The Hacker News: https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html 5. CRAFTED SVGS RUN AS SYSTEM ON BING'S IMAGE SERVERS Vulnerabilities and Exploits · [rce, patch] Latest developments: XBOW showed that a crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers and as root on the Linux machines in the same fleet, prompting Microsoft to issue two critical CVEs, including CVE-2026-32194. The flaws sat in Bing's image-processing tier, letting attacker-controlled SVG files execute at the highest privilege across Microsoft's server fleet. Microsoft has patched its infrastructure, so customers need take no action. - The Hacker News: https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html 6. BLUENOROFF PHISHING KIT PROFILES CRYPTO WALLETS Nation-State Activity · [apt, phishing] Latest developments: Researchers found the North Korean group BlueNoroff running an active phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains and profiles a target's cryptocurrency wallets before it delivers malware. BlueNoroff blends compromised industry contacts with ClickFix-style social engineering to steal from crypto holders. Verify meeting links out of band and block typosquatted videoconferencing domains. - The Hacker News: https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Oil Surge Puts a Fed Rate Rise in Play Latest developments: Investors sharply raised bets on a Federal Reserve rate increase after the US-Iran war drove oil prices up, and they now call next week's Fed meeting "live." The energy-price spike from the conflict with Iran has revived US inflation fears, pushing markets to price in a possible interest-rate increase when the Federal Reserve meets next week, a reversal from earlier expectations of steady or falling rates. - FT Markets: https://www.ft.com/content/5019e030-796d-47e8-9f13-bee34de1d374?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Patchy Fog then Mostly Sunny, high 86F. Tonight: Partly Cloudy, low 66F. Monday: Partly Sunny then Scattered Showers And Thunderstorms, high 88F. Business: * United Trims Some Middle Seats Latest developments: United Airlines is removing some middle seats as it reconfigures cabins, a move driven by premium-seating economics rather than passenger comfort. United Airlines is cutting some middle seats to make room for higher-margin premium seating, the Pittsburgh Post-Gazette reported, reshaping the cabin layout on a carrier that flies out of Pittsburgh International Airport. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/07/25/airline-passengers-hate-middle-seats-united/stories/202607250006 Around town: * Pittsburgh Seeks Answers on Teen Takeovers Latest developments: Pittsburgh officials are searching for a response to large, spontaneous teen gatherings that have repeatedly formed in public spaces across the city. The Pittsburgh Post-Gazette reported that the city is grappling with mass teen gatherings, weighing curfews and other measures as leaders look for a way to manage the crowds. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/26/pittsburgh-teen-takeovers/stories/202607230044 * Pittsburgh Nears Annual Tornado Record Latest developments: The Pittsburgh region is on pace to set an annual record for tornadoes after a summer of repeated severe storms, the Post-Gazette reported. Western Pennsylvania has logged an unusual number of tornadoes this year, and the Pittsburgh Post-Gazette reported the region could break its annual record, with more storms forecast into next week. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/07/26/pittsburgh-western-pennsylvania-tornadoes/stories/202607260063 SPORTS ---------------------------------------------------------------- Pirates (53-52) Sat Jul 25 · Cubs 11 · Pirates 0 · Final Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates https://plaintextsports.com/mlb/2026-07-25/chc-pit Up Next · Cubs @ Pirates · Sun Jul 26, 1:35 PM https://plaintextsports.com/mlb/2026-07-26/chc-pit Around the Teams: * Pittman Jr. Seen Unlocking McCarthy's Passing Game Latest developments: The Post-Gazette's training-camp countdown cast newly added receiver Michael Pittman Jr. as a key to opening up Mike McCarthy's passing attack. The Pittsburgh Post-Gazette's Steelers camp countdown argued wideout Michael Pittman Jr. gives quarterback Aaron Rodgers a big possession target opposite DK Metcalf, a fit central to head coach Mike McCarthy's offense as camp opens in Latrobe. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/26/nfl-training-camp-pittman-mccarthy-metcalf-aaron-rodgers/stories/202607260061 Team USA: * Barcelona Signs U.S. Keeper Tyler McCamey Latest developments: Barcelona signed American goalkeeper Tyler McCamey for its European-champion women's team, the Spanish club announced July 25. Barcelona, the reigning European women's champion, added United States goalkeeper Tyler McCamey to its roster, giving the young American a place at one of the sport's biggest clubs. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49447813/barcelona-sign-us-goalkeeper-tyler-mccamey * One Year to the 2027 Women's World Cup Latest developments: With one year until the 2027 Women's World Cup final, ESPN weighed five reasons the United States women's national team will or won't reach it. ESPN marked the one-year countdown to the 2027 Women's World Cup final by assessing the United States women's national team's path, laying out arguments for and against a US run to the title match. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49435317/5-reasons-uswnt-in-women-world-cup-final-one-year READING ---------------------------------------------------------------- * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Argues OpenAI accidentally "hacked" Hugging Face and that the episode's lessons about AI alignment and safety are more encouraging than the alarmed public reaction suggests. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Ed Zitron -- The Subprime Data Center Crisis Contends that the AI data-center buildout rests on shaky, subprime-style financing that could unravel, drawing a pointed parallel to the 2008 mortgage crisis. https://www.wheresyoured.at/the-subprime-data-center-crisis/ * Cal Newport -- Why Reading Matters Responds to claims that deep reading is dying, arguing that sustained reading remains essential to serious thinking and defending its lasting cognitive value. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.28 ▲ +0.6% ================================================================ Generated 2026-07-26 06:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================