Monthly Threat Report July 2026

This Hornetsecurity monthly threat report (June/July 2026) outlines emergent AI-driven risks and active incidents: JadePuffer, an LLM-agent-run ransomware that exploited CVE-2025-3248 and CVE-2021-29441 to encrypt service configurations; a Meta verification phishing campaign that collects credentials, MFA codes, and identity documents for account takeover; Microsoft’s record Patch Tuesday including an actively exploited on-premises Exchange XSS (CVE-2026-42897); and publication of RFC 9989 (next-generation DMARC). The report includes technical attack chains, IOCs, and prioritized recommendations for patching, exposure management, user training, and DMARC readiness.