FBI disrupts residential proxy network used by botnet.

Summary

By the N2K CyberWire staff

FBI disrupts residential proxy network used by botnet.

The US Federal Bureau of Investigation (FBI), assisted by Google, Lumen, and others, seized hundreds of domains belonging to NetNut, a residential proxy service operated by Israeli company Alarum Technologies, KrebsOnSecurity says. Krebs reported two weeks ago that NetNut was linked to the Android-based botnet "Popa," which used "millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts."

The Google Threat Intelligence Group (GTIG) said in a blog post, "We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions."

Alarum's legal counsel said in a statement, "Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account."

The research breaks at Black Hat first. Be there this August.

If you follow the research, you already know a lot of it breaks at Black Hat first. Hundreds of peer-reviewed Briefings, more than a hundred hands-on Trainings, and the largest Business Hall in Black Hat's history, across AI, cyber conflict, resilience, and identity. Six days in Las Vegas, August 1–6. Prices increase July 17. Register now with code CYBERWIRE for $200 off your Briefings pass.

New macOS infostealer poses as a clipboard manager.

Jamf has published a report on a macOS infostealer dubbed "PamStealer" that impersonates the legitimate open-source clipboard manager Maccy. The malware is delivered via social engineering, using a disk image that appears to install Maccy while hiding the malicious code far down below a block of empty lines.

The researchers call the malware "PamStealer" because it uses the macOS Pluggable Authentication Modules (PAM) to validate that stolen passwords are legitimate. Jamf explains, "As part of its run, it shows a native password prompt, an NSAlert with a secure text field made to resemble a system authorization request: the dialog is titled after the lure and reads 'Maccy wants to make changes. Enter your password to allow this,' with the account name pre-filled. It then validates what the victim types locally through the PAM API...supplying the entered password when PAM asks for it. If validation fails, it re-focuses the field and prompts again, only continuing once the password is confirmed correct."

Your crisis plan exists. But will it work under pressure?

Most organizations have a plan. Fewer have prepared for the decisions, tradeoffs, and uncertainty that come with a real crisis.

In a recent conversation with Dave Bittner, Courtney Guss of Semperis explains why compliance alone doesn't create resilience and how organizations can better prepare for the moments that matter most.

Listen now for practical guidance on strengthening your incident response program.

AdaptHealth discloses data breach affecting patient information.

Pennsylvania-headquartered medical equipment supplier AdaptHealth has disclosed a data breach affecting "internal patient management systems and document storage platforms," the Register reports. The incident also exposed "passwords associated with insurance billing and certain personally identifiable information and protected health information of patients."

The breach occurred via a social engineering attack that compromised an account used by a third-party contractor. It's unclear if an extortion gang was behind the attack, but AdaptHealth says it "has since taken steps intended to mitigate the risk of dissemination of the exfiltrated data."

Notes.

Today's issue includes events affecting Israel, the UK, and the United States.

Attacks, Threats, and Vulnerabilities

Max severity Adobe ColdFusion flaw now exploited in attacks (BleepingComputer) Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, according to vulnerability intelligence company KEVIntel.

Spyware found on phone of European Parliament member probing it (The Record) Stelios Kouloglou, formerly a member of the European Parliament's committee investigating abuses of commercial spyware, was twice infected with Pegasus while serving, researchers said.

Russian hackers steal government logins (The Telegraph) Credentials for Foreign Office and council staff being offered on dark web for more than £40,000

Litigation, Investigation, and Law Enforcement

Japanese teen arrested for cyberattack that unsubscribed over 46,000 anime accounts (The Straits Times) He had used a program he created with the assistance of ChatGPT to disrupt the Bandai Channel streaming service. Read more at straitstimes.com. Read more at straitstimes.com.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CSA Regulated Industries for Cloud & AI Summit 2026 (Virtual, Jul 16, 2026) Trust at Scale: Securing Cloud & AI in the World’s Most Regulated Industries As AI adoption and cloud modernization accelerate across energy, healthcare, government, and other highly regulated sectors, organizations face a critical question: how do you innovate at speed without compromising compliance, resilience, and trust? The Regulated Industries for Cloud & AI Summit brings together global leaders, practitioners, and policymakers to address the real-world security, governance, and regulatory challenges shaping mission-critical environments. This free, high-impact, one-day virtual event delivers actionable insights on building secure cloud and AI ecosystems, governing AI responsibly, managing third-party and supply chain risk, and preparing for emerging global regulations. If you are responsible for protecting critical infrastructure, sensitive data, or public trust, this is the forum to learn what’s working now—and what’s coming next.

Interviewing Essentials: Grow Interviewing Muscle with Mock Interviews on The Dev Difference Tool (Virtual, USA, Jul 17, 2026) This session will introduce members to The Dev Difference, a free mock interview tool designed to help candidates practice, build confidence, and prepare for real interviews.

Breaking Barriers: Navigating Your Early Career as Women in STEM (Virtual, USA, Jul 21, 2026) Starting a career in tech can feel exciting, challenging, and uncertain. This session is designed to help women in STEM navigate the early years of their careers with more clarity and confidence. You’ll hear from Hayley Murphy, Senior Campus Recruiter on CBRE’s Campus Digital & Technology team, along with women working in Digital & Technology at CBRE.

Tech for Good: When Moments Matter with Axon (Virtual, USA, Jul 28, 2026) This session will explore career pathways in mission-driven technology and give members a closer look at how technical teams at Axon build products that support public safety, accountability, and real-world impact.

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2026) The premier cybersecurity event of the year returns to Mandalay Bay with a re-engineered, six-day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert-led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two-day main conference packed with groundbreaking Briefings, open-source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 07.06.26

Top stories.

FBI disrupts residential proxy network used by botnet.

New macOS infostealer poses as a clipboard manager.

AdaptHealth discloses data breach affecting patient information.

Notes.

Attacks, Threats, and Vulnerabilities

Litigation, Investigation, and Law Enforcement

Events