The week in breach news Aug 26, 2026

A sophisticated phishing campaign is using the Greatness phishing-as-a-service (PhaaS) platform to target Microsoft 365 accounts by impersonating RingCentral notifications.

Greatness is a subscription-based PhaaS platform that has been active since at least 2022, providing cybercriminals with ready-to-use phishing toolkits. The platform has now expanded beyond credential phishing to adversary-in-the-middle (AiTM) attacks and device-code phishing targeting Microsoft 365 accounts. In a recent campaign observed by researchers, Greatness operators are abusing the RingCentral communications platform to bypass recipients' email security filters. Attackers impersonate RingCentral by claiming messages originate from service@ringcentral[.]com and target actual users of the service with fake voicemail and performance-review notifications designed to entice them to open the emails.

Although the messages originate from an unknown IONOS mail server, fail SPF and DMARC checks and lack a DKIM signature, they are still accepted by receiving systems because RingCentral is whitelisted. The emails also include a fraudulent banner claiming the sender has been verified through the organization's safe-sender list, further reducing suspicion and making the phishing messages appear more credible to recipients.

The federal administration of Switzerland confirmed that more than 200 accounts were compromised in a data breach after attackers exploited a vulnerability in Microsoft SharePoint.

Attackers breached SharePoint servers operated by Switzerland's Federal Office for Information Technology and Telecommunication (FOITT) and stole login credentials associated with roughly 200 accounts. The servers were operated by FOITT within the federal government's own data centers. According to the federal administration, unknown attackers exploited an unpatched SharePoint vulnerability to compromise the user and technical accounts.

As a precautionary measure, FOITT is reinstalling the affected SharePoint servers. Internet access for external users remains blocked until the work is completed.

A coordinated cyberattack targeting popular Bitcoin wallet COLDCARD reportedly resulted in estimated losses of more than $100 million across thousands of users.

COLDCARD is a popular Bitcoin-only hardware wallet developed by Canadian company Coinkite. A major cyberattack in late July and early August 2026 reportedly compromised multiple COLDCARD hardware wallet models, including MK2, MK3, MK4, Q and MK5, resulting in the theft of more than $100 million in Bitcoin. The attackers reportedly exploited a firmware flaw traced to a March 2021 firmware integration error that made supposedly unguessable seed phrases computationally enumerable, allowing attackers to reconstruct private keys without physically accessing the devices.

The incident is the latest in a wave of attacks targeting the cryptocurrency sector this year. TRM Labs has counted more than 200 incidents and nearly $950 million in losses in 2026, while Blockaid estimates losses exceeded $1 billion during the first half of the year alone.

Colombia's Ministry of Justice was hit by a ransomware attack on August 2, 2026, affecting part of its technology infrastructure and reducing the availability of several public-facing digital services.

According to the ministry, the attack affected several services, including those related to illicit-drug monitoring and legal processes. After detecting the attack, the ministry isolated compromised systems to prevent it from spreading to other parts of the network. It also began working with Colombia's Ministry of Information and Communications Technologies and other authorities to investigate the incident.

The attack came just one day after Colombia's national cybersecurity emergency response team (ColCERT) published a threat intelligence warning that ransomware groups had increased their focus on the country. Colombia has faced an increasing number of cyberattacks targeting government agencies and government-backed or government-owned organizations in recent times. In March, the country's national tax authority was allegedly compromised, while in July, Colombia's largest oil and gas company, Ecopetrol SA, acknowledged a breach.

Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers.

The supply chain attack has affected packages associated with major enterprise software ecosystems, including keyv, flat-cache and cache-manager. The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload. The malware typically executes automatically via an npm preinstall lifecycle hook before package installation completes.

Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for npm, GitHub, cloud and infrastructure credentials, potentially exposing sensitive access credentials across development environments.