Monthly Threat Report July 2026

Introduction

The Monthly Threat Report from Hornetsecurity by Proofpoint brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. This edition of the Monthly Threat Report focuses on industry events from the month of June 2026. As a news and commentary edition, this month’s report prioritizes depth on emerging threats and industry research over statistical data sections.

A single theme connects most of what we cover this month: artificial intelligence is now a working participant on both sides of the security equation. Researchers documented the first ransomware operation run end to end by an autonomous AI agent, Microsoft shipped the largest Patch Tuesday in the program’s history with the volume increase attributed in part to AI-assisted vulnerability discovery, and our own Threat Intelligence Lab tracked a brand-impersonation phishing kit built for account takeover at scale. We close with an overview of the next-generation DMARC specification, which arrives at a useful moment as impersonation and authentication pressures continue to rise.

Executive Summary

• Researchers documented JadePuffer, the first publicly reported ransomware operation driven end to end by an autonomous large language model (LLM) agent. The agent handled reconnaissance, credential theft, lateral movement, privilege escalation, and encryption without human operation, exploiting CVE-2025-3248 in Langflow for initial access and CVE-2021-29441 in Alibaba Nacos during the intrusion. It encrypted 1,342 service configuration items and, in one documented sequence, diagnosed and fixed a failed login in 31 seconds.
• Microsoft’s June Patch Tuesday addressed more than 200 vulnerabilities, the largest single release in the program’s history, including an actively exploited Exchange Server zero-day. CVE-2026-42897 allows an unauthenticated attacker to execute arbitrary JavaScript in a victim’s Outlook Web Access session through a specially crafted email. On-premises Exchange Server 2016, 2019, and Subscription Edition are affected.
• Our Threat Intelligence Lab analyzed a Meta verification phishing campaign targeting French-speaking Facebook Page owners and administrators. The kit abuses the credibility of verification badges to harvest not just credentials but multi-factor authentication (MFA) codes and identity documents, indicating a full account-takeover objective rather than simple credential theft.
• The record patch volume was attributed in part to AI-assisted vulnerability discovery, the same class of capability we covered in last month’s reporting on Anthropic’s Project Glasswing. The convergence of AI-accelerated discovery and AI-operated intrusion narrows the window between a flaw becoming known and a flaw being exploited.
• The IETF published a next-generation DMARC specification (RFC 9989), replacing the original RFC 7489. The update standardizes organizational domain discovery, clarifies policy inheritance and alignment, and splits reporting into companion specifications. It lands as mailbox providers continue tightening sender authentication requirements.

Threat Overview

Meta Verification Phishing: Brand Trust Weaponized for Account Takeover

Our Threat Intelligence Lab identified and analyzed a phishing campaign that impersonates Meta to target French-speaking Facebook Page owners, administrators, small businesses, and marketing teams. Our full technical breakdown is available on the Hornetsecurity security blog. The campaign is notable for two reasons: it leads with a positive pretext rather than a threat, and it reaches well beyond credential theft into the territory of complete account takeover.

Most phishing that impersonates a platform opens with fear, typically a warning that an account has been suspended or will be deleted. This campaign inverts that pattern. The lure offers the recipient something desirable, the opportunity to obtain a verification badge, and pairs it with a soft deadline (a prompt to “activate within 24 hours”). Trust, reward, and mild urgency combine into a pretext that is harder for a busy Page administrator to dismiss.

The Attack Chain

The campaign proceeds through a structured, multi-stage workflow:

Stage 1: The attacker distributes phishing emails through Google’s AppSheet platform, borrowing the sending reputation of a legitimate Google service to improve deliverability and evade basic reputation filters.

Stage 2: Recipients who click are redirected through the sw[.]run domain to a fake Meta Accounts Centre interface hosted on attacker infrastructure at finn2[.]xyz.

Stage 3: The landing page requests information progressively rather than all at once, asking in sequence for Page details, personal information, Facebook credentials, MFA codes, and identity documents. The staged approach mirrors a legitimate verification workflow and reduces the chance that a victim abandons the process.

Stage 4: Collected data is encrypted client-side using hardcoded Advanced Encryption Standard (AES) keys and staged in the browser’s localStorage under keys __ck_clv1 through __ck_clv6, then exfiltrated as encrypted victim profiles to a backend endpoint at /api/authentication. The kit also performs external IP and geolocation lookups (via apip[.]cc) to enrich each victim record.

The kit ships with configuration support for twelve languages, including English, German, French, Spanish, Italian, Dutch, Portuguese, Russian, Chinese, Vietnamese, Japanese, and Korean, which indicates an operation built for reuse across regions well beyond the French-speaking targets we observed.

Indicators of Compromise (IOCs)

Attacker-controlled infrastructure: – hxxps://sw[.]run (redirect) - hxxps://finn2[.]xyz (fake Meta Accounts Centre)

Delivery and enrichment: – Phishing emails delivered via Google AppSheet – Victim enrichment via apip[.]cc

Host artifacts: – localStorage staging keys __ck_clv1 through __ck_clv6 – Exfiltration endpoint /api/authentication

Why It Matters

The collection of MFA codes and identity documents is the detail that separates this campaign from routine credential phishing. Harvesting a password gives an attacker one factor. Harvesting the password, a live MFA code, and a government identity document gives an attacker everything needed to seize an account, satisfy step-up verification, and, in many cases, pass a platform’s account-recovery process later. For a business that runs customer engagement, advertising, and brand presence through a Facebook Page, the loss of that Page is a direct operational and reputational hit.

The use of a positive, reward-based pretext also matters for awareness training. We have spent years teaching users to be suspicious of threats and urgency. A verification-badge offer trips none of those alarms. The durable lesson for users is simpler and platform-agnostic: legitimate platform notifications do not ask you to enter your password, your MFA code, or a photo of your ID through a link in an email. Verification status should be checked directly on the official platform using a bookmarked URL or the mobile app, never through an emailed link.

Major Incidents and Industry Events

JadePuffer: The First Ransomware Attack Run Entirely by an AI Agent

On July 4, Bleeping Computer reported on JadePuffer, describing it as the first ransomware operation on record to be carried out from start to finish by an LLM agent rather than a human operator, based on research published by Sysdig’s Threat Research team on July 1. Infosecurity Magazine independently covered the same findings. The reporting uses the term “agentic threat actor” (ATA) for this class of adversary: rather than a human working through a toolkit, the AI agent itself carries out the intrusion.

The distinction is not marketing. Across the intrusion, the agent did everything itself: it scouted the environment, pulled credentials, pivoted to neighboring systems, planted persistence, worked its way up to higher privileges, and encrypted the data at the end. It adapted to failures in real time, in a way that reads like a human operator working through obstacles.

The Attack Chain

Stage 1: The intrusion began with CVE-2025-3248, a flaw in Langflow, a popular open-source framework for building LLM applications, that lets an unauthenticated attacker run arbitrary code. The agent used this foothold as its delivery channel for the entire operation, pushing its subsequent payloads through it.

Stage 2: Once inside, the agent mapped the host and went hunting for secrets. LLM provider API keys, cloud provider credentials, and database logins all made the list. It exported the PostgreSQL database behind Langflow, then worked through an adjacent MinIO object store to pull configuration and environment files.

Stage 3: To keep its foothold, the agent scheduled a cron job on the Langflow host that checked in with attacker infrastructure at 30-minute intervals.

Stage 4: From there, the agent pivoted to a production server hosting a MySQL database and Alibaba Nacos (Naming and Configuration Service). The Nacos instance was vulnerable to CVE-2021-29441, an authentication bypass, which the agent used to forge an administrator account under its own control.

Stage 5: For the final stage, the agent turned the victim’s own database against it. It ran MySQL’s AES_ENCRYPT() function across the full set of 1,342 service configuration items Nacos held, deleted the original configuration and history tables, and left its payment demand behind in a newly created ransom table.

The strongest evidence that no human was at the keyboard comes from a 31-second window during the Nacos takeover, when the agent hit a failed administrator login and had it working again in roughly half a minute. The reporting also notes that the agent left running commentary on its own goals inside the payloads, spelling out what each step was meant to accomplish. Human operators do not annotate throwaway one-liners this way.

The ransom note itself gives the game away. Its Bitcoin address is the illustrative example address used throughout Bitcoin developer documentation, which the agent apparently reproduced from its training data. Any victim who paid would have sent funds to an address the attacker never controlled. The encryption key is a second dead end: the agent generated it randomly and neither saved nor exfiltrated it, so the encrypted configuration data is unrecoverable whether or not anyone pays.

Why Is This a Big Deal?

JadePuffer is the indicator that many in the security community were waiting for. The environment it hit was a self-hosted AI and data stack with internet-exposed administrative access and unrotated default credentials, which is to say a target that a competent human attacker would also have compromised. What changed is who did the work. The broader takeaway in the reporting is that agentic tooling drops the bar for pulling off a serious attack: an operation like this no longer demands ransomware expertise, only an agent pointed at exposed infrastructure.

This connects directly to a trend we covered last month. In our June reporting on Anthropic’s Project Glasswing, we noted that the first generation of AI-discovered vulnerabilities to appear in active exploitation, rather than coordinated disclosure, would mark the point at which the offensive side of AI security had caught up. An autonomous agent that chains two known vulnerabilities into a working extortion operation is a related marker. The two capabilities, AI-accelerated discovery and AI-operated intrusion, compress the timeline between a flaw becoming known and that flaw being weaponized against exposed infrastructure.

The defensive takeaways are conventional, which is the point. Everything JadePuffer abused had a boring fix: patch known flaws such as CVE-2025-3248, rotate default credentials and signing keys, and keep administrative interfaces off the open internet. What agentic tooling changes is not the checklist but the tempo. Misconfigurations that once waited for a human attacker to stumble across them now get found and exploited with machine speed and machine consistency.

Microsoft June Patch Tuesday: A Record Release and an Actively Exploited Exchange Zero-Day

Microsoft’s June 9 Patch Tuesday was the largest in the program’s history. Bleeping Computer reported the release as fixing 200 Microsoft vulnerabilities, while The Hacker News and Dark Reading counted a record 206 including a small number of non-Microsoft items. The outlets agree on the material point: this was a record-setting month, with more than 30 vulnerabilities rated Critical, and the volume increase was attributed in part to AI-assisted vulnerability discovery.

CVE-2026-42897 Affecting On-Prem Exchange

As we cover a lot of M365-related security info in this publication, this CVE is worth pointing out. Readers may see coverage of CVE-2026-42897 and assume the worst, but this vulnerability only impacts on-prem versions of Exchange. Exchange Online is NOT impacted.

CVE-2026-42897 is an actively exploited Exchange Server spoofing vulnerability. The flaw is a cross-site scripting (XSS) weakness that allows a remote, unauthenticated attacker to execute arbitrary JavaScript in a victim’s Outlook Web Access session. Exploitation requires only that the attacker send a specially crafted email and that the recipient open it in Outlook Web Access under certain interaction conditions. Affected products are on-premises Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition.

The timeline is worth noting, because exploitation predates the patch. CISA added CVE-2026-42897 to its Known Exploited Vulnerabilities catalog on May 15, 2026, directing Federal Civilian Executive Branch agencies to apply mitigations, and The Hacker News reported that same week that Microsoft was providing a temporary mitigation through the Exchange Emergency Mitigation Service (EEMS) while it prepared a permanent fix. Microsoft shipped that fix on June 9. One deployment detail matters for older versions: the June updates for Exchange Server 2016 and Exchange Server 2019 are available only to organizations enrolled in Period 2 of the Extended Security Update (ESU) program, while Exchange Server Subscription Edition receives the update directly. Again, organizations running hosted Exchange Online are not the target here; this is a vulnerability in the on-premises Exchange Server product, and it is precisely the kind of internet-facing messaging flaw that ransomware affiliates have repeatedly weaponized.

Other Notable Fixes

Beyond the Exchange flaw, the release included several publicly disclosed zero-days that both Bleeping Computer and The Hacker News highlighted:

• CVE-2026-45586: an elevation of privilege flaw in the Windows Collaborative Translation Framework (CTFMON) that can grant SYSTEM privileges.
• CVE-2026-49160: a denial-of-service vulnerability in Windows HTTP.sys, reported as an “HTTP/2 Bomb” attack in which small crafted requests force the server into disproportionate memory allocation.
• CVE-2026-50507: a BitLocker security feature bypass.

Bleeping Computer also reported multiple Critical remote code execution flaws affecting Microsoft Office, Outlook, Word, and Excel, the client-side surfaces most relevant to M365-centric organizations. Because these can be triggered through malicious documents delivered by email, they belong in the same priority tier as the Exchange fix for any organization whose primary risk is inbound email.

Why It Matters 

Two things stand out this month. The first is the actively exploited Exchange zero-day, which is a top-priority patch by any measure. An unauthenticated attacker who can run JavaScript in a user’s authenticated webmail session is well positioned to read mail, manipulate the interface, and pivot into further account compromise. Organizations that cannot patch immediately should confirm that the EEMS mitigations are in place and treat this as an emergency change.

The second is the record patch volume itself, and the reason for it. Both The Hacker News and Dark Reading tie the growth in patch counts to AI-assisted vulnerability discovery, the same capability class behind the Project Glasswing results we covered in June. This is the defender’s side of the coin that JadePuffer represents on the attacker’s side. More discovery produces more patches, which is good, but it also widens the exposure window for organizations whose patching cadence cannot keep pace with the volume of critical fixes now shipping each month. Patching velocity, particularly for internet-facing systems, is becoming the variable that most directly determines exposure.

The IETF Publishes Next-Generation DMARC (RFC 9989)

The most consequential email-authentication development of the period is the arrival of a next-generation DMARC specification. Domain-based Message Authentication, Reporting, and Conformance (DMARC) is the policy layer that tells receiving mail servers what to do when a message fails alignment checks against SPF and DKIM, and it has governed sender authentication since the original specification in 2015. The IETF has now published an updated DMARC specification, designated RFC 9989, which replaces the original RFC 7489.

Proofpoint has published an overview of what is changing in Next generation DMARC: what’s changing and why it matters, authored by Craig Temple on June 11, alongside a deeper multi-part series covering domain and policy discovery and preparing for enforcement. What follows is an overview rather than a full walkthrough; practitioners planning a migration should work from those posts and the RFC itself.

According to Proofpoint’s summary, the update is best understood as a decade of operational refinement rather than a reinvention. The headline changes fall into three areas:

• Standardized organizational domain discovery. RFC 9989 replaces reliance on inconsistent, provider-specific lookup behavior with a standardized method for determining a domain’s organizational boundary. This directly affects how subdomains inherit policy from their parent domains and closes gaps that attackers have used to slip past inconsistent spoofing protection.
• Clearer alignment and indirect mail handling. The specification tightens alignment logic, particularly around relaxed versus strict handling, and standardizes the treatment of indirect mail flows such as forwarding and mailing lists, which have long been a source of false failures.
• Reporting split into companion specifications. Aggregate reporting (RUA) and failure reporting (RUF) have been separated from the core specification into their own documents so they can evolve independently. Reports gain new context reflecting RFC 9989, including fields for the discovery method and testing state, and DKIM selectors are now required when DKIM results are reported.

Why It Matters

The timing is the story. Major mailbox providers have spent the past two years steadily raising the bar on sender authentication, pushing domain owners toward enforcement-level policies. RFC 9989 accelerates that shift by removing long-standing ambiguities, which means receivers will interpret policies more consistently and authentication failures will become more visible and less dependent on any single provider’s implementation quirks.

For defenders, this is a net positive against exactly the kind of impersonation we covered earlier in this report. Brand-impersonation and verification-badge phishing succeed in part because inconsistent authentication enforcement leaves room for lookalike and spoofed sending domains. Tighter, standardized DMARC evaluation reduces that room. The practical cost is that organizations with sprawling or poorly inventoried sending infrastructure may see legitimate mail flagged more aggressively during the transition if their alignment is not in order. The work to do now is unglamorous and familiar: inventory every sending source, validate alignment under the new discovery rules, and move toward an enforcement posture before receivers finish adopting the standard. A trusted DMARC management solution can help with this process.

Predictions for the Coming Months

• Agentic threat actors will move from proof of concept to routine tooling. JadePuffer demonstrates that an AI agent can chain known vulnerabilities into a complete extortion operation. We expect follow-on activity to concentrate on internet-facing application frameworks, AI and data tooling, configuration stores, and exposed database administrative interfaces, since these are the targets an automated operator can sweep at scale. The economics favor volume, so expect more attempts against more targets rather than more sophisticated single intrusions.
• AI-assisted vulnerability discovery will keep inflating patch volumes, and patching velocity will separate resilient organizations from exposed ones. June’s record Patch Tuesday is unlikely to be an outlier. As discovery scales faster than remediation, the exposure window between disclosure and exploitation becomes the decisive variable, particularly for internet-facing systems.
• On-premises Exchange Server will remain a priority target. With CVE-2026-42897 actively exploited and a long history of Exchange flaws drawing ransomware attention, organizations that have not completed their migration away from on-premises Exchange, or that cannot patch quickly, will continue to feature in incident reports through the second half of 2026.
• Brand-verification lures will spread beyond Meta and beyond credentials. The account-takeover model we analyzed this month, harvesting MFA codes and identity documents rather than passwords alone, is portable to any platform that offers a verification or trust badge. Expect the pretext to migrate across social, financial, and marketplace brands.
• DMARC RFC 9989 adoption will be uneven through the transition. As receivers implement the new organizational domain discovery and alignment rules on their own timelines, organizations with incomplete sending-source inventories should expect intermittent deliverability surprises, and attackers will probe for domains where old and new interpretations diverge.

Monthly Recommendations

• Harden and inventory internet-facing application and AI tooling. Patch CVE-2025-3248 in Langflow, rotate default credentials and signing keys (including default Nacos JWT keys and default MinIO credentials), and restrict database and configuration administrative interfaces to known networks. Agentic attackers enumerate these surfaces first, and the controls that stop a human operator stop an agent just as well.
• Patch the June Microsoft updates now, prioritizing the actively exploited Exchange Server zero-day. Treat CVE-2026-42897 as an emergency change on any on-premises Exchange Server 2016, 2019, or Subscription Edition deployment, and confirm that Exchange Emergency Mitigation Service (EEMS) mitigations are active where immediate patching is not possible. Prioritize the Critical Office, Outlook, Word, and Excel remote code execution fixes in the same cycle for organizations whose primary risk is inbound email.
• Train users to recognize reward-based and verification-badge lures, not just threats. The Meta campaign we analyzed leads with an offer rather than a warning, and it asks for MFA codes and identity documents. Reinforce through Security Awareness Training that legitimate platforms never request passwords, MFA codes, or identity documents through an emailed link, and that verification status should always be checked directly on the official platform.
• Revalidate your DMARC posture ahead of RFC 9989 adoption. Inventory every legitimate sending source, confirm SPF and DKIM alignment under the new organizational domain discovery rules, upgrade your reporting to capture the new RFC 9989 fields, and move toward an enforcement policy (p=reject) before receivers finish rolling out the standard. Consistent, standardized DMARC evaluation is one of the more effective structural defenses against the brand impersonation covered in this report.
• Fold agentic attack scenarios into your patch prioritization and exposure management. Assume that the gap between public disclosure and active exploitation of internet-facing flaws will continue to shrink. Maintain an accurate inventory of external attack surface, tie patch prioritization to real exposure rather than severity score alone, and rehearse rapid emergency patching for internet-facing systems.

---

About Hornetsecurity

Hornetsecurity is a leading global provider of next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organisations of all sizes around the world. Its flagship product, 365 Total Protection, is the most comprehensive cloud security solution for Microsoft 365 on the market. Driven by innovation and cybersecurity excellence, Hornetsecurity is building a safer digital future and sustainable security cultures with its award-winning portfolio. Hornetsecurity operates in more than 120 countries through its international distribution network of 12,000+ channel partners and MSPs. Its premium services are used by more than 125,000 customers.