ISC Stormcast For Thursday, July 2nd, 2026 https://isc.sans.edu/podcastdetail/9992, (Thu, Jul 2nd)
2026-07-06T07:23:47Z•96f3085f750d57ebc2a4480db646219fc3c6a8e66682566c3f3d443734da0a3b
T1036apple-updatesautomationcredential-theftcrypto-walletfavicon.icohost-reconioslinuxmacosmalware-obfuscationmetamaskphishingpodcastprocess-masqueradingrootkitsafarithreat-actor-velvet-antyarayara-x
What happened
This ISC SANS diary collection (late June–early July 2026) highlights multiple operational security items: a phishing campaign targeting MetaMask cryptocurrency wallets that attempts to harvest credentials (including an unusual ‘secret codes’ prompt); Apple’s June 2026 security updates for iOS/iPadOS, macOS and Safari; YARA-X 1.18.0 and 1.19.0 releases with improvements and bugfixes; a write-up on Linux process-name masquerading (MITRE ATT&CK T1036) including references to Velvet Ant activity and rootkit/obfuscation techniques; automation techniques for host reconnaissance using favicon.ico; a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 96f3085f750d57ebc2a4480db646219fc3c6a8e66682566c3f3d443734da0a3b
- Enrichment time
- 2026-07-06T07:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.