⚡ Global Cyber Intel Digest: July 21, 2026

Coverage window: July 20, 2026, 08:00 — July 21, 2026, 08:00 UTC+8

This edition prioritises developments published or materially updated during the reporting window. Official advisories and original security research were given precedence. Where exploitation, impact or attribution has not been confirmed by the affected vendor, that limitation is stated explicitly.

---

📝 Executive Summary — 10-Second Read

• 🔴 Third-party threat intelligence now links CVE-2026-6875 affecting the ServiceNow AI Platform to suspected in-the-wild exploitation. The pre-authentication chain turns user-controlled query input into sandboxed JavaScript execution before escaping the sandbox. ServiceNow says it has not observed the reported activity against instances it hosts.

• 🟠 HOLLOWGRAPH turns a compromised Microsoft 365 calendar into a covert command-and-control channel. Commands and encrypted stolen files are hidden in calendar events dated May 13, 2050, while DNS tunnelling refreshes the implant’s Microsoft Entra ID credentials.

• 🟠 Rapid7 uncovered an exposed WebDAV malware-delivery laboratory containing 1,048 files. The operator systematically tested ClickFix lures, filename spoofing, trusted Windows binaries and WebDAV working-directory hijacking, with evidence consistent with LLM-assisted development.

• 🟠 OpenSSL’s “HollowByte” flaw allows an 11-byte unauthenticated input to trigger disproportionate memory allocation before the TLS handshake completes. Repeated requests can fragment process memory and eventually terminate exposed services.

---

🔍 Major Incidents: Technical Analysis

1. CVE-2026-6875: ServiceNow Pre-Authentication Sandbox Escape

Operational priority: 🔴 Critical
Impact: Unauthenticated, highly privileged code execution within an affected ServiceNow instance
Exploitation status: Reported by third-party threat intelligence; not confirmed by ServiceNow on hosted instances

Incident Overview

ServiceNow disclosed CVE-2026-6875 after Searchlight Cyber researchers identified a pre-authentication remote-code-execution chain affecting the ServiceNow AI Platform.

Searchlight Cyber reported the issue on April 1, 2026. ServiceNow deployed immediate mitigations to its cloud-hosted instances and subsequently released updates addressing the underlying weaknesses.

During the latest reporting window, threat intelligence firm Defused reported observing exploitation attempts against the same unauthenticated endpoint used in the public research:

/assessment_thanks.do

However, the reported payloads used a different sandbox-escape gadget from the one demonstrated in the published proof of concept.

ServiceNow stated that its investigation had not identified evidence linking the reported activity to instances hosted by ServiceNow.

Self-hosted environments—and any instance whose update status cannot be independently verified—should nevertheless be treated as urgent.

Technical Deep-Dive

The attack begins with ServiceNow’s GlideRecord query API.

A pre-authentication page passes the user-controlled sysparm_assessable_type parameter directly into a query:

/assessment_thanks.do?
sysparm_assessable_type=<attacker-controlled-input>

ServiceNow query filters support values prefixed with:

javascript:

This causes the supplied expression to be evaluated as JavaScript before its result is passed into the database query.

The initial code executes inside GlideSystemSandbox, which restricts access to dangerous functions, Java classes and sensitive tables. Direct use of eval, the Function constructor and function declarations is blocked.

The researchers then identified a weakness in the gs.include() mechanism.

Script includes are loaded through a separate evaluation context so that their functions can be defined normally. That context does not apply the same restrictions as the additional-filter sandbox.

The exploitation chain abuses this difference by:

1. Retrieving the JavaScript Function constructor through an existing included function.

2. Using Object.defineProperty() to replace Object.clone with that constructor.

3. Replacing AbstractAjaxProcessor.prototype with attacker-controlled JavaScript.

4. Loading the ItemViewElementsProvider script include.

5. Triggering its inheritance code, which passes the attacker-controlled prototype into the overwritten Object.clone.

6. Converting the attacker’s string into an executable function outside the intended sandbox restrictions.

Successful exploitation can provide highly privileged access within the affected ServiceNow instance.

Researchers reported that an attacker could:

• Read sensitive platform tables

• Create administrator accounts

• Modify scripts and application logic

• Execute commands through connected MID or proxy servers

• Use ServiceNow integrations as a pathway into internal corporate systems

Mitigation and Threat Hunting

1. Apply all ServiceNow security updates addressing CVE-2026-6875.

2. Self-hosted customers should verify the installed build directly rather than relying solely on change-management records, update policies or administrative-console status.

3. Confirm that Guarded Script protections are enabled where supported.

4. Review requests to:

/assessment_thanks.do

particularly those containing:

• sysparm_assessable_type

• javascript:

• Encoded JavaScript expressions

• Unusually long or obfuscated query values

5. Hunt for:

• Unexpected administrator-account creation

• New or modified script includes

• Changes to platform security settings

• Abnormal access to sensitive ServiceNow tables

• Unusual MID Server jobs

• Shell-command execution from MID or proxy servers

• Outbound connections initiated through ServiceNow automation

• New OAuth applications, integration credentials or service accounts

6. Compare current ServiceNow administrators and privileged roles against a known-good baseline.

7. Review MID Server activity for command execution that does not correspond to an approved workflow or automation task.

8. Rotate credentials, tokens and secrets accessible through compromised workflows if suspicious activity is identified.

9. Where exploitation cannot be confidently excluded, treat the affected instance as a potentially compromised identity and automation platform—not merely a vulnerable web application.

References

ServiceNow — Security Advisory KB3137947
support.servicenow.com/kb

Searchlight Cyber — Smashing the ServiceNow Sandbox: Pre-Authentication RCE
slcyber.io/research-center/sma...

BleepingComputer — Critical ServiceNow Code-Execution Flaw Reportedly Exploited in Attacks
www.bleepingcomputer.com/news/security/criti...

---

2. HOLLOWGRAPH: Microsoft 365 Calendars Used as a Covert C2 Channel

Operational priority: 🟠 High
Category: Cyber espionage / SaaS abuse
Observed targeting: Primarily Israeli-linked systems
Attribution: No definitive public attribution to a named threat actor

Incident Overview

Group-IB identified a previously undocumented Windows implant called HOLLOWGRAPH.

The malware uses a compromised Microsoft 365 mailbox and the Microsoft Graph API to exchange commands and exfiltrate files.

Instead of communicating directly with a conventional command-and-control server, it treats the mailbox calendar as a two-way dead drop.

Group-IB identified 12 systems carrying the implant, with approximately three actively communicating with attacker infrastructure during the analysis period.

Available telemetry suggests focused interest in Israeli entities rather than broad opportunistic deployment.

Technical Deep-Dive

HOLLOWGRAPH is compiled as a .NET NativeAOT DLL and supports two principal commands:

• get — retrieve tasking from the operator

• send — encrypt and exfiltrate a selected file

For inbound commands, the malware searches the compromised mailbox for calendar events containing a specific task identifier.

For outbound data, it:

1. Encrypts the selected file.

2. Creates a new calendar event.

3. Uploads the encrypted data as one or more text-file attachments.

4. Changes the event subject to a format recognised by the operator.

The events are scheduled for:

May 13, 2050

Placing them decades into the future reduces the likelihood that the mailbox owner will encounter them during ordinary calendar use.

Communications over Microsoft Graph are protected using hybrid encryption:

• RSA-OAEP for key handling

• AES-256-GCM for payload encryption

• Separate RSA key pairs for incoming tasking and outgoing exfiltration

HOLLOWGRAPH also uses a secondary DNS channel.

IPv6 AAAA queries to the attacker-controlled domain:

cloudlanecdn[.]com

are used to obtain refreshed Microsoft Entra ID credentials.

Updated tenant IDs, client secrets and related configuration are written to:

logAzure.txt

This design combines trusted SaaS traffic, application credentials and DNS tunnelling, reducing reliance on conventional attacker-controlled infrastructure and making network-based detection more challenging.

Defensive Significance

HOLLOWGRAPH demonstrates that compromising a SaaS identity or application credential can provide an attacker with a resilient control channel without requiring a conspicuous external C2 protocol.

Microsoft Graph traffic may appear operationally legitimate because it uses:

• Trusted Microsoft endpoints

• Standard HTTPS

• Valid tenant and application credentials

• Ordinary calendar and attachment functions

As a result, domain allow-listing and basic network reputation controls are unlikely to be sufficient.

Detection depends on understanding whether the application identity’s behaviour is consistent with an approved business workflow.

Mitigation and Threat Hunting

1. Audit Microsoft Graph activity for applications performing:

• Automated calendar searches

• Repeated event creation

• Attachment uploads or downloads

• Frequent subject-line changes

• Access to mailboxes unrelated to the application’s expected function

2. Search mailboxes for events scheduled unusually far into the future, particularly around:

May 13, 2050

3. Review application registrations and service principals with calendar, mailbox or file-attachment permissions.

4. Investigate Microsoft Graph activity performed by an application identity where no corresponding business automation exists.

5. Hunt endpoints for:

• logAzure.txt

• Unrecognised NativeAOT DLLs

• Embedded tenant IDs

• Embedded client secrets

• Unusual Microsoft Graph API calls from non-browser processes

6. Monitor unusual volumes or patterns of IPv6 AAAA queries to rare or newly observed domains.

7. Review DNS queries to:

cloudlanecdn[.]com

8. Revoke affected refresh tokens, application secrets and certificates rather than only resetting the mailbox user’s password.

9. Review whether Graph applications have broader mailbox access than operationally necessary.

10. Restrict application permissions using least privilege and, where feasible, scope applications to specific mailboxes.

11. Alert when application identities create calendar events with:

• Distant future dates

• Repeated encrypted attachments

• Machine-generated subjects

• No visible business purpose

References

Group-IB — HOLLOWGRAPH: Microsoft 365 as a Covert Command-and-Control Channel
www.group-ib.com/blog/hollowgraph-mi...

BleepingComputer — HOLLOWGRAPH Malware Uses Microsoft Graph for Stealthy C2
www.bleepingcomputer.com/news/security/new-h...

The Hacker News — HOLLOWGRAPH Hides C2 and Stolen Data in Microsoft Calendars
thehackernews.com/2026/07/hollowgraph...

---

3. Exposed WebDAV Malware Lab Reveals an AI-Assisted Attack Pipeline

Operational priority: 🟠 High
Category: Malware delivery / ClickFix / LOLBin abuse
Confirmed active targeting: Windows users in Mexico

Incident Overview

A Rapid7 MDR investigation began after a user executed a file retrieved from a WebDAV server through rundll32.exe.

Endpoint telemetry showed the Windows WebClient service starting, followed by davclnt.dll connecting to the remote infrastructure.

The investigation led Rapid7 to an exposed attacker-controlled server containing 1,048 files.

The collection included:

• 453 LNK delivery launchers

• 236 filename-spoofing tests

• 146 URL and LOLBin execution experiments

• 89 encrypted droppers

• WebDAV scripts

• ClickFix pages

• Builder notes

• Test documentation

The exposed infrastructure resembled a malware-development and quality-assurance environment where the operator systematically evaluated delivery chains, visual-deception techniques and execution reliability across multiple Windows configurations.

It was not merely a payload repository.

The environment showed repeated experimentation with:

• Alternative launchers

• Signed Windows utilities

• User-interface deception

• Filename manipulation

• Browser and Explorer behaviour

• WebDAV delivery

• Detection avoidance

• Payload compatibility

Technical Deep-Dive

The most developed testing set focused on CVE-2025-33053, a Windows working-directory hijacking vulnerability previously used by the Stealth Falcon threat actor.

The technique uses a malicious .url Internet Shortcut that:

1. Launches a legitimate Microsoft binary such as:

C:\Program Files\Internet Explorer\iediagcmd.exe

2. Sets its working directory to an attacker-controlled WebDAV share.

3. Causes the legitimate binary to launch child utilities using only their filenames, such as:

route.exe
ipconfig.exe
netsh.exe
ping.exe

4. Allows Windows to search the attacker-controlled working directory before resolving the expected local system executable.

5. Executes the attacker’s replacement binary from the WebDAV share.

The exposed documentation claimed that this approach could avoid SmartScreen and Mark-of-the-Web warnings.

It also showed that the operator was testing alternative signed binaries for systems where iediagcmd.exe was unavailable.

Other delivery mechanisms included:

• search-ms: queries

• .library-ms containers

• mshta

• bitsadmin

• certutil

• PowerShell download cradles

• Right-to-left override characters

• Double extensions

• Whitespace padding

• Fake Cloudflare verification pages

• Fake Microsoft authentication prompts

• Fake Adobe update pages

• Fake Chrome security warnings

• ClickFix instructions that persuaded users to execute commands manually

LLM-Assisted Development Assessment

Rapid7 reported evidence consistent with LLM-assisted development, including generated code, structured documentation and large-scale lure creation.

The more significant development is not simply that generative AI may have accelerated malware development.

The exposed environment suggests that AI tooling helped the operator streamline:

• Code generation

• Debugging

• Documentation

• Lure variation

• Test-case creation

• Cross-environment compatibility checks

• Campaign refinement

The workflow resembled a modern software product team more than a traditional collection of manually assembled malware scripts.

Generative AI did not eliminate the need for technical knowledge. It appears to have increased the operator’s ability to test, document and iterate across a larger number of attack variants.

Observed Campaign

One observed campaign impersonated Mexico’s government CURP identity-record service.

The malicious site used a search-ms: workflow and WebDAV-hosted payloads to deliver an information stealer.

Rapid7 cautioned that recorded “launch events” represented executable-file access or attempted invocation—not confirmed successful infections.

This distinction is important:

• Payload access does not confirm execution.

• Execution does not confirm persistence.

• A launch attempt does not confirm that the endpoint was successfully compromised.

Mitigation and Threat Hunting

1. Ensure Microsoft’s June 2025 fixes for CVE-2025-33053 are installed.

2. Disable or restrict the Windows WebClient service where WebDAV is not operationally required.

3. Block outbound WebDAV access to untrusted Internet hosts.

4. Alert on:

• rundll32.exe loading davclnt.dll

• WebClient starting immediately after browser or Explorer activity

• Executables launched from DavWWWRoot

• Executables launched from remote UNC paths

• .url, .lnk, .library-ms or search-ms: content received externally

5. Detect signed Windows utilities spawning unexpected binaries from remote working directories.

6. Review command-line and process telemetry involving:

• iediagcmd.exe

• mshta.exe

• bitsadmin.exe

• certutil.exe

• rundll32.exe

• powershell.exe

• cmd.exe

7. Display full file extensions and detect:

• RTLO characters

• Double-extension filenames

• Excessive whitespace padding

• Files whose displayed extension differs from their actual type

8. Block or inspect Internet-originated shortcut formats, including:

• .url

• .lnk

• .library-ms

9. Alert when trusted Windows binaries execute child processes from:

• Remote WebDAV shares

• UNC paths

• User-writable directories

• Temporary Internet locations

10. Train users that document portals, software updates and CAPTCHA systems should never require them to copy commands into PowerShell, Run or Command Prompt.

11. Incorporate ClickFix scenarios into phishing simulations and security-awareness exercises.

References

Rapid7 — Exposed WebDAV Malware-Delivery Lab Analysis
www.rapid7.com/blog/post/tr-expose...

The Hacker News — Exposed Server Reveals AI-Assisted Malware Development Pipeline
thehackernews.com/2026/07/exposed-ser...

Microsoft Security Response Center — CVE-2025-33053
msrc.microsoft.com/update-guide/vulner...

---

4. HollowByte: An 11-Byte OpenSSL Payload That Exhausts Server Memory

Operational priority: 🟠 High for Internet-facing deployments, particularly memory-constrained or resource-limited services
Primary impact: Remote denial of service
CVE status: No dedicated CVE; addressed as a hardening change

Incident Overview

Okta’s Red Team disclosed HollowByte, a denial-of-service weakness affecting older OpenSSL versions.

An unauthenticated attacker can send an 11-byte TLS input that claims a much larger handshake message is about to arrive.

OpenSSL allocates memory based on the attacker-controlled declared length before receiving or validating the claimed message body.

Repeated requests can progressively increase process memory usage and eventually cause the service to be terminated by the operating system.

The attack depends on repeatedly triggering this allocation behaviour rather than a single malformed request.

Technical Deep-Dive

A TLS handshake message includes a four-byte header:

• One byte identifying the message type

• Three bytes declaring the message length

Older OpenSSL code trusted this attacker-controlled length early in the state machine.

The vulnerable path was effectively:

Read handshake header
        ↓
grow_init_buf()
        ↓
OPENSSL_clear_realloc()
        ↓
malloc(attacker-controlled size)

The attacker sends only enough data to trigger parsing of the header.

OpenSSL then allocates as much as approximately 131 KB and waits for a message body that never arrives.

The more significant impact comes from glibc memory-management behaviour.

When the connection closes, OpenSSL frees the allocated buffer. However, glibc may retain small and medium-sized allocations inside the process rather than immediately returning the memory to the operating system.

By repeatedly varying the declared message length, an attacker can make it difficult for the allocator to reuse previously freed chunks.

The heap becomes fragmented, and the process’s resident memory continues to rise even though individual connections are closed.

In Okta’s testing:

• A server with 1 GB of memory was terminated by the OOM killer after accumulating hundreds of megabytes of fragmented memory.

• On a 16 GB system, the attack immobilised roughly one-quarter of system memory while remaining below ordinary connection ceilings.

This means that simple concurrent-connection limits may reduce exposure but may not fully prevent the attack.

Defensive Significance

HollowByte is operationally important because the resource asymmetry begins before the TLS handshake is completed.

An attacker does not need:

• Valid credentials

• An established TLS session

• A completed application request

• A large outbound bandwidth commitment

The server may allocate significantly more memory than the attacker transmits.

However, practical denial of service requires sustained or repeated triggering of the allocation pattern. A single 11-byte payload does not immediately exhaust server memory.

Mitigation

Upgrade OpenSSL—or the relevant operating-system package—to a release containing the incremental-buffer-growth fix:

• OpenSSL 4.0.1

• OpenSSL 3.6.3

• OpenSSL 3.5.7

• OpenSSL 3.4.6

• OpenSSL 3.0.21

The patched implementation grows the receive buffer only as bytes arrive rather than allocating memory based on the untrusted declared length.

Additional controls:

1. Inventory statically linked and appliance-embedded OpenSSL versions.

2. Confirm fixes through operating-system and appliance vendors because package version numbers may differ from upstream OpenSSL releases.

3. Apply handshake and idle timeouts.

4. Rate-limit incomplete TLS handshakes per source, service and network segment.

5. Monitor:

• Process resident memory

• Allocator fragmentation

• Swap usage

• Repeated incomplete handshakes

• OOM-killer events

• Unexpected service termination

6. Establish memory and process limits appropriate to the service.

7. Restart affected long-running processes after patching if memory has already become heavily fragmented.

8. Confirm whether reverse proxies, load balancers or upstream network controls terminate incomplete TLS sessions before they reach vulnerable services.

9. Do not rely solely on total connection limits; the attack may operate below ordinary concurrency thresholds.

References

Okta Red Team — HollowByte: A DoS Hiding in 11 Bytes
sec.okta.com/articles/2026/06/op...

SecurityWeek — OpenSSL Silently Fixes HollowByte DoS Vulnerability
www.securityweek.com/openssl-silently-fi...

---

🔐 Data-Breach Watch

Third-Party Support Platforms and Enterprise Applications Continue to Concentrate Sensitive Data

Ernst & Young

EY has begun notifying clients after attackers accessed a third-party service-management platform used to support tax-related work.

Attackers reportedly had access between March 28 and April 12, 2026, and downloaded documents attached to support tickets.

Potentially exposed information includes:

• Names

• Addresses

• Social Security numbers

• Account information

• Payment-card data

• Documents used for tax preparation

EY has not publicly identified the threat actor or disclosed the precise intrusion method.

No known ransomware group had publicly claimed the incident at the time of reporting.

Estée Lauder

Estée Lauder disclosed that an unauthorised party accessed an Oracle E-Business Suite system used for HR management and obtained employee-related personal information.

Potentially affected data includes:

• Names and addresses

• Dates of birth

• Social Security numbers

• Passport information

• Financial-account details

• Health information

• Payroll records

• Performance records

The intrusion occurred around August 9, 2025, but Estée Lauder said it determined the data impact on June 19, 2026.

The company did not identify the exploited vulnerability.

The timing correlates with the Clop campaign involving CVE-2025-61882, but this connection remains an analytical inference rather than a confirmed attribution by Estée Lauder.

Defensive Takeaway

1. Treat ticketing, support and HR platforms as repositories of regulated data—not low-risk collaboration tools.

2. Prevent users from attaching complete tax returns, identity documents or payment-card information unless operationally necessary.

3. Encrypt sensitive ticket attachments and enforce short retention periods.

4. Apply field-level access control to sensitive HR, financial and identity data.

5. Review third-party OAuth tokens, support integrations and dormant service accounts.

6. Monitor bulk downloads and unusual access to ticket attachments.

7. Patch Oracle E-Business Suite and hunt for historical exploitation rather than assuming older incidents are no longer relevant.

8. Prepare for targeted phishing that uses stolen tax, HR or employment information to appear credible.

9. Ensure breach-response procedures include third-party SaaS providers, support platforms and enterprise business applications.

References

SecurityWeek — Ernst & Young Data Breach Affects Personal and Financial Information
www.securityweek.com/ernst-young-data-br...

BleepingComputer — Ernst & Young Discloses Data Breach Following Support-System Intrusion
www.bleepingcomputer.com/news/security/ernst...

BleepingComputer — Estée Lauder Discloses Data Breach Involving Oracle E-Business Suite
www.bleepingcomputer.com/news/security/est-e...

---

🛡️ Today’s Defensive Action Items

P0 — Act Immediately

• Verify whether every self-hosted ServiceNow instance has received the updates addressing CVE-2026-6875.

• Independently confirm installed ServiceNow builds rather than relying solely on change records.

• Investigate suspicious requests to /assessment_thanks.do.

• Hunt for unauthorised ServiceNow administrators, script changes and MID Server command execution.

• Revoke suspicious Microsoft Graph application credentials.

• Investigate anomalous calendar automation performed by application identities.

• Review whether compromised SaaS credentials could provide access to connected internal systems.

P1 — Complete Today

• Search Microsoft 365 mailboxes for far-future events, unexpected attachments and machine-generated subjects.

• Review Microsoft Graph service principals with calendar or mailbox access.

• Update all exposed OpenSSL services to fixed vendor packages.

• Confirm Windows endpoints have the June 2025 CVE-2025-33053 patch.

• Restrict Internet-facing WebDAV.

• Disable the Windows WebClient service where it is unnecessary.

• Review whether ticketing and HR platforms retain excessive sensitive attachments.

P2 — Strengthen Detection

• Detect application identities creating or modifying mailbox calendar events.

• Alert on unusual IPv6 AAAA DNS-query patterns.

• Monitor rundll32.exe, davclnt.dll and remote WebDAV execution chains.

• Detect RTLO filenames, double extensions and externally delivered .url or .library-ms files.

• Alert on browsers or document portals immediately followed by PowerShell, Run or Command Prompt execution.

• Add ClickFix scenarios to user-awareness exercises.

• Monitor process-memory growth, allocator fragmentation and repeated incomplete TLS handshakes.

Governance Priority

• Review what sensitive information is stored in ITSM, help-desk and HR platforms.

• Reduce attachment retention and excessive third-party integration permissions.

• Apply least privilege to Microsoft Graph applications and ServiceNow integrations.

• Maintain an inventory of service principals, application secrets and non-human identities.

• Ensure incident-response plans cover compromised SaaS applications, automation platforms and service principals—not only traditional endpoints.

---

📌 Final Assessment

Today’s incidents reinforce a consistent defensive theme:

Trusted enterprise platforms are increasingly being repurposed as execution, command-and-control and data-concentration layers rather than being attacked solely through traditional malware-delivery paths.

• ServiceNow’s internal scripting environment became a pathway to pre-authentication code execution.

• Microsoft 365 calendars became an encrypted espionage channel.

• Legitimate Windows binaries became loaders for malware stored on WebDAV.

• OpenSSL trusted an attacker-declared length before receiving the claimed data.

• Support and HR platforms concentrated enough sensitive information to make a single compromise highly damaging.

These incidents also show that trust can fail at several distinct layers:

• A trusted application can contain exploitable logic.

• A legitimate SaaS API can be used for malicious communications.

• A signed binary can execute attacker-controlled content.

• A widely deployed cryptographic library can allocate resources based on untrusted input.

• A business platform can become a high-value data repository without being treated as one.

The operational lesson is clear:

Patching closes known flaws. Visibility into trusted application behaviour is what reveals when the trust boundary has already failed.

#CyberSecurity #ThreatIntelligence #CISO #SOC #ServiceNow #Microsoft365 #MicrosoftGraph #OpenSSL #ClickFix #WebDAV #ThreatHunting #DFIR #SaaSSecurity #VulnerabilityManagement