The PasteSwitch campaign used HBO Max's verified Reddit account to run 108 malicious adverts, turning a legitimate corporate account into a distribution channel for fake download prompts. The JeetBot Twitch extension took a different route, remaining on the official Chrome and Firefox stores for months while sending roughly 31,000 users' OAuth tokens to a Russian bot service. Its Chrome listing and privacy policy stated that no data was collected. Neither campaign required a compromise of the underlying platform: the attackers instead used the visibility and reach those platforms already provided.

DDRop takes the problem down to the hardware layer. Intel TDX, Scalable SGX and AMD SEV-SNP encrypt memory but do not verify that its contents are current. Researchers showed that a low-cost interposer could silently drop DDR5 writes and feed a confidential VM stale, attacker-controlled data without breaking the encryption itself. They then used the technique to force a Trust Domain into debug mode and forge its attestation report. The finding extends the attack surface of confidential computing beyond the software and hypervisor layers normally considered when assessing these systems.

Revolut notified a subset of users that their personal and financial information was exposed after attackers impersonated a government agency using a legitimate-looking domain email. Compromised data included names, addresses, dates of birth, identity document copies, verification selfies, IBANs, account statements and full transaction history. Revolut said customer funds and systems were unaffected and confirmed it has notified relevant law enforcement, data protection and financial regulators.

GitLab disclosed CVE-2026-85706, a maximum-severity path traversal flaw in the repository commits API letting unauthenticated attackers read arbitrary server files. CISA added the flaw to its Known Exploited Vulnerabilities catalog after detecting active exploitation, setting a federal remediation deadline of 14 September 2026. The same patch release fixes CVE-2026-87719, a separate critical deserialization bug in GitLab Enterprise Edition exposing stored search credentials.

Researchers uncovered a malvertising campaign in which attackers hijacked the verified HBO Max Reddit account to push 108 fraudulent adverts over 48 hours. The ads lured victims to fake download pages using "ClickFix" prompts, tricking them into pasting malicious terminal commands. The operation, dubbed PasteSwitch, delivered macOS and Windows malware, fake cryptocurrency wallets, and clipboard-hijacking tools controlled via Binance Smart Chain contracts.

Researchers found a Chrome and Firefox extension, "Twitch Enhanced Viewer | JeetBot," forwarding users' live Twitch OAuth session tokens to proxy servers run by a Russian bot service. Roughly 31,000 users across both stores are affected, with tokens exposed via cleartext URL parameters during video-stream redirects. Earlier versions of the extension had posted tokens directly to a dedicated collection endpoint before switching to the current forwarding method.

Researchers disclosed DDRop, a low-cost DDR5 memory interposer that silently drops writes to server memory, causing processors to read stale data as current. The attack breaks integrity guarantees in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP by exploiting their lack of freshness protection despite memory encryption. On Intel TDX, researchers used DDRop to force a confidential virtual machine into debug mode and forge its attestation reports.