Cyber Briefing: 2026.08.04

Malicious actors and rogue insiders are systematically exploiting public Wi-Fi networks, AI-assisted phishing tactics

Aug 04, 2026

Welcome to Cyber Briefing, your daily source for all things cybersecurity. We bring you the latest advisories, alerts, incidents, and news every weekday.

Cybersecurity risks are intensifying across both public infrastructure and private user environments through advanced adversary tactics and insider abuse. State-sponsored actors like Midnight Blizzard are exploiting public hotel and conference Wi-Fi networks to harvest Microsoft 365 credentials using custom malware, while phishing operators leverage generative AI and OAuth exploits to bypass two-factor authentication. Meanwhile, severe breaches continue to disrupt official systems, such as the exfiltration of data belonging to 31,000 legal entities from Liechtenstein’s Register of Beneficial Owners (VwbP). Highlighting insider threats within law enforcement, a former FBI supervisory agent pleaded guilty to using internal systems to steal approximately $1 million in cryptocurrency from targeted wallets before self-reporting the theft.

In response to these evolving vector risks, the cybersecurity sector is adapting through targeted corporate acquisitions and new defensive platform deployments. Identity provider Okta has acquired cloud-native platform Permiso to strengthen its Identity Threat Detection and Response capabilities using behavioral analytics across complex cloud environments. Concurrently, Joinable Labs introduced Joinable Security, offering free threat mapping tools and enterprise runbooks to help security teams digitize defense procedures and counteract sophisticated adversary techniques.

Listen to our podcast here ⏬

Get BlueSleuth-Lite

⚡THREAT LANDSCAPE

Midnight Blizzard targets hotel Wi-Fi for credential theft

Russian state-sponsored threat actor Midnight Blizzard has been targeting users on public Wi-Fi networks at hotels and conference centers to steal Microsoft 365 credentials. Microsoft Threat Intelligence identified the campaign, dubbed CaptiveCrunch, which uses two malware strains called CornFlake and ChocoShell to compromise victims. Organizations should warn employees about the risks of using public Wi-Fi for work purposes and implement multi-factor authentication for all accounts. Read More

Phishing attacks evolving with AI, OAuth exploits

Phishing attacks have become significantly more sophisticated through the use of generative AI to create linguistically perfect emails and advanced technical methods that can bypass two-factor authentication. Attackers are exploiting legitimate Microsoft OAuth device code flows, fake support scams, fraudulent delivery notifications, and even physical mail-based Postident fraud to steal login credentials, session tokens, and personal information. Security professionals should educate users to verify all unsolicited contact independently, enable multi-factor authentication with passkeys where possible, and never click links in unexpected messages without manual verification through official channels. Read More

Subscribe Now

🚨INCIDENTS & REAL-WORLD IMPACT

Liechtenstein VwbP Register Breached; 31K Entities Affected

Liechtenstein’s Register of Beneficial Owners (VwbP) was breached on July 29-30, 2026, with attackers exfiltrating data on approximately 31,000 legal entities including companies, foundations, and trusts. The register, which supports anti-money laundering efforts by tracking beneficial ownership information, has been taken offline while authorities investigate. Organizations and individuals whose data may have been exposed should monitor for potential misuse of their ownership information and expect notification from Liechtenstein authorities as the investigation progresses. Read More

Claim Your Workspace

🔓 EXECUTIVE RISK & CYBERNOMICS

Okta Acquires Cloud-Native Identity Platform Permiso

Okta has acquired Permiso, a cloud-native identity platform specializing in behavioral analytics and threat detection. The acquisition enhances Okta’s Identity Threat Detection and Response (ITDR) capabilities by adding new identity risk signals and behavioral analytics to detect threats across all identity types throughout their lifecycle. Organizations using Okta can expect improved threat detection and faster mitigation of identity-based attacks. Read More

Get Help

🛡️ POLICY, REGULATION & LEGAL SIGNALS

Former FBI supervisor pleads guilty to $1M crypto theft

A former FBI supervisory agent, Patrick Steven Yaroch, pleaded guilty to stealing approximately $1 million in cryptocurrency from wallets linked to an adversarial country using internal FBI systems to obtain access credentials. Between late 2024 and early 2025, Yaroch conducted 10 unauthorized transfers, depositing some stolen funds into the Suilend yield platform before self-reporting the theft. Following his cooperation, authorities recovered about $925,000 from his accounts at Suilend and Kraken exchange, which he forfeited to government-controlled wallets.

Joinable Labs launches threat intelligence platform

Joinable Labs has released Joinable Security, a new threat intelligence platform featuring two products: Joinable Threat Map (a free tool for mapping and analyzing adversary behavior) and Joinable Runbooks (an enterprise platform that converts security documentation into actionable knowledge and automated agents). Both products are built on Propagator, the company’s Trusted Knowledge Foundry technology. The platform aims to help security teams keep pace with constantly evolving adversary techniques. Read More