# Daily Intelligence Briefing — Thursday, August 6, 2026

> On 2026-08-06, Threadlinqs published 19 new threat reports and updated 8, 12 rated critical and 14 high, spanning 199 MITRE ATT&CK techniques and 8 named threat actors. Coverage that day added 243 new detection rules and 721 extracted indicators.

- **Edition:** 2026-08-06 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-08-06
- **Last updated:** 2026-08-12
- **New threats:** 19 (8 updated)
- **Critical / high:** 12 critical, 14 high, 1 medium, 0 low
- **ATT&CK techniques:** 199
- **Threat actors:** 8
- **Indicators (count only):** 721
- **New detection rules (count only):** 243

## Summary & highlights

OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applications. Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate. CVE-2026-54876 — OpenSSL Client-Side Memory Leak in OCSP Response Checking (Denial of Service).

- [TL-2026-1907](https://intel.threadlinqs.com/threat/TL-2026-1907) — Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
- [TL-2026-1909](https://intel.threadlinqs.com/threat/TL-2026-1909) — CVE-2026-54876 — OpenSSL Client-Side Memory Leak in OCSP Response Checking (Denial of Service)
- [TL-2026-1911](https://intel.threadlinqs.com/threat/TL-2026-1911) — Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations
- [TL-2026-1914](https://intel.threadlinqs.com/threat/TL-2026-1914) — Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation
- [TL-2026-1916](https://intel.threadlinqs.com/threat/TL-2026-1916) — Cardiology Associates of Port Huron (Port Huron Heart Center) Breached by Orova Ransomware Group — 144.00 GB of Patient Data Exfiltrated

## Theme of the day

Supply-chain compromise via hijacked maintainer accounts and destructive wiper attacks on critical infrastructure dominate, alongside active exploitation of multiple zero-days and pre-auth RCE chains.

credential-theft, privilege-escalation, authentication-bypass, persistence, infostealer

## Threats published

- [TL-2026-1905](https://intel.threadlinqs.com/threat/TL-2026-1905) — CRITICAL — Multiple Critical Vulnerabilities in Cisco Catalyst SD-WAN Software (CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20312, CVE-2026-20313)
- [TL-2026-1906](https://intel.threadlinqs.com/threat/TL-2026-1906) — CRITICAL — ENDLESSDOORS: Zbtlink Router Firmware Contains rctl Backdoor (CVE-2026-66747) Across 20+ Models
- [TL-2026-1908](https://intel.threadlinqs.com/threat/TL-2026-1908) — CRITICAL — Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)
- [TL-2026-1910](https://intel.threadlinqs.com/threat/TL-2026-1910) — CRITICAL — Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM Access
- [TL-2026-1912](https://intel.threadlinqs.com/threat/TL-2026-1912) — CRITICAL — Critical Cisco IMC Argument Injection (CVE-2026-20200) Enables Root RCE on UCS C-Series M7/M8 Standalone Servers — Public PoC (CIMCown)
- [TL-2026-1921](https://intel.threadlinqs.com/threat/TL-2026-1921) — CRITICAL — Odysseus AI Workspace Remote Code Execution via Authorization Bypass — GHSA-xwhc-f36c-v5vm (CVSS 9.9)
- [TL-2026-1924](https://intel.threadlinqs.com/threat/TL-2026-1924) — CRITICAL — "When Agentic Glue Melts": Five workerd Memory-Corruption Flaws Enable Cross-Tenant Secret Theft and Code Mode Sandbox Escape on Cloudflare Workers
- [TL-2026-1083](https://intel.threadlinqs.com/threat/TL-2026-1083) — CRITICAL — JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) (update)
- [TL-2026-1334](https://intel.threadlinqs.com/threat/TL-2026-1334) — CRITICAL — Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155) (update)
- [TL-2026-1462](https://intel.threadlinqs.com/threat/TL-2026-1462) — CRITICAL — SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware Precursor (update)
- [TL-2026-1750](https://intel.threadlinqs.com/threat/TL-2026-1750) — CRITICAL — OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face (update)
- [TL-2026-1892](https://intel.threadlinqs.com/threat/TL-2026-1892) — CRITICAL — Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports (update)
- [TL-2026-1907](https://intel.threadlinqs.com/threat/TL-2026-1907) — HIGH — Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
- [TL-2026-1909](https://intel.threadlinqs.com/threat/TL-2026-1909) — HIGH — CVE-2026-54876 — OpenSSL Client-Side Memory Leak in OCSP Response Checking (Denial of Service)
- [TL-2026-1911](https://intel.threadlinqs.com/threat/TL-2026-1911) — HIGH — Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations
- [TL-2026-1914](https://intel.threadlinqs.com/threat/TL-2026-1914) — HIGH — Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation
- [TL-2026-1916](https://intel.threadlinqs.com/threat/TL-2026-1916) — HIGH — Cardiology Associates of Port Huron (Port Huron Heart Center) Breached by Orova Ransomware Group — 144.00 GB of Patient Data Exfiltrated
- [TL-2026-1917](https://intel.threadlinqs.com/threat/TL-2026-1917) — HIGH — GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334 Organizations
- [TL-2026-1918](https://intel.threadlinqs.com/threat/TL-2026-1918) — HIGH — Researcher Demonstrates Full C2 Inside ChatGPT Secure Sandbox via Chained Attack Techniques at Black Hat USA 2026
- [TL-2026-1919](https://intel.threadlinqs.com/threat/TL-2026-1919) — HIGH — CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host
- [TL-2026-1920](https://intel.threadlinqs.com/threat/TL-2026-1920) — HIGH — ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials
- [TL-2026-1922](https://intel.threadlinqs.com/threat/TL-2026-1922) — HIGH — AI Recommendation Poisoning: Prompt Injection via Deep-Linked 'Ask AI' Buttons Silently Alters LLM Memory
- [TL-2026-1954](https://intel.threadlinqs.com/threat/TL-2026-1954) — HIGH — TONTOU: Interrupt-Injection Attack Bypasses Spectre v2 (eIBRS/Safe RET) Defenses on Intel and AMD CPUs
- [TL-2026-1787](https://intel.threadlinqs.com/threat/TL-2026-1787) — HIGH — SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD (update)
- [TL-2026-1899](https://intel.threadlinqs.com/threat/TL-2026-1899) — HIGH — Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign (update)
- [TL-2026-1915](https://intel.threadlinqs.com/threat/TL-2026-1915) — HIGH — VMware Aria Operations Vulnerabilities — CVE-2026-22719 Command Injection (Active Exploitation), CVE-2026-22720 Stored XSS, CVE-2026-22721 Privilege Escalation (update)
- [TL-2026-1913](https://intel.threadlinqs.com/threat/TL-2026-1913) — MEDIUM — OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applications

## Techniques observed

AML.T0034, [AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), AML.T0051.000, [AML.T0051.001](https://intel.threadlinqs.com/technique/AML.T0051.001), [AML.T0054](https://intel.threadlinqs.com/technique/AML.T0054), AML.T0056, [T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1007](https://intel.threadlinqs.com/technique/T1007), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1037](https://intel.threadlinqs.com/technique/T1037), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1055.001](https://intel.threadlinqs.com/technique/T1055.001), [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.002](https://intel.threadlinqs.com/technique/T1059.002), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1069.003](https://intel.threadlinqs.com/technique/T1069.003), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1195.003](https://intel.threadlinqs.com/technique/T1195.003), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1205](https://intel.threadlinqs.com/technique/T1205), T1205.001, [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1218.010](https://intel.threadlinqs.com/technique/T1218.010), [T1219](https://intel.threadlinqs.com/technique/T1219), T1475, [T1480](https://intel.threadlinqs.com/technique/T1480), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499.003](https://intel.threadlinqs.com/technique/T1499.003), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), T1505.002, [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1537](https://intel.threadlinqs.com/technique/T1537), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1543](https://intel.threadlinqs.com/technique/T1543), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.004](https://intel.threadlinqs.com/technique/T1543.004), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1547.006](https://intel.threadlinqs.com/technique/T1547.006), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), T1555.006, [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), T1557.003, [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.001](https://intel.threadlinqs.com/technique/T1588.001), T1588.004, [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1592.004](https://intel.threadlinqs.com/technique/T1592.004), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1601.001](https://intel.threadlinqs.com/technique/T1601.001), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1609](https://intel.threadlinqs.com/technique/T1609), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1613](https://intel.threadlinqs.com/technique/T1613), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), T1647, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1685](https://intel.threadlinqs.com/technique/T1685)

## Threat actors

[Orova](https://intel.threadlinqs.com/actor/Orova), [GOLD ENCOUNTER](https://intel.threadlinqs.com/actor/GOLD%20ENCOUNTER), [Shenzhen Zhibotong Electronics](https://intel.threadlinqs.com/actor/Shenzhen%20Zhibotong%20Electronics), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group), [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne), [JADEPUFFER](https://intel.threadlinqs.com/actor/JADEPUFFER), [INC Ransomware](https://intel.threadlinqs.com/actor/INC%20Ransomware), Autonomous OpenAI frontier-model agent (GPT-5.6 Sol / unreleased model) operating inside the ExploitGym/CyberGym evaluation harness

Nation-state attribution: China, North Korea

Threat categories: THREAT_INTEL, MALWARE, VULNERABILITY, SUPPLY_CHAIN, DATA_BREACH, RANSOMWARE

## Severity breakdown

- critical: 12
- high: 14
- medium: 1
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 721 (network 248, file 208, behavioral 92, infrastructure 61, tool 36, entity 34, malware 22, technique 13, package 7)
- New detection rules: 243 (100% of the day’s threats covered)

## More editions

- Previous: [2026-08-05](https://intel.threadlinqs.com/debrief/2026-08-05)
- Next: [2026-08-07](https://intel.threadlinqs.com/debrief/2026-08-07)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-08-06