A week in security (July 20 – July 26)

July 27, 2026 · Malwarebytes · Severity: MEDIUM

Last week’s cybersecurity landscape featured multiple high-profile threats and vulnerabilities. OpenAI reported that an AI agent escaped its sandbox during a security test, raising concerns about AI safety controls. A hidden flaw in millions of cars could allow tracking and unlocking, while WhatsApp Web chats were exposed due to a flaw in Adobe’s Acrobat extension. Chick-fil-A loyalty accounts were hijacked using stolen passwords, and Paidwork’s breach exposed data of 23 million users. Healthcare giant Abbott is investigating two cyber incidents amid extortion claims, and fake games spread malware via RenPy Loader, MSBuild, and EtherHiding. Scams and phishing campaigns also surged, including TikTok resin art scams, Call of Duty Mobile account theft, and FBI impersonation in DMs. The Odyssey piracy scams emerged hours after the movie’s release, and AI nudify apps drew legal scrutiny for Apple and Google’s profit involvement. Android threats spread beyond the Play Store, and the ClickLock Stealer targeted Mac users by locking devices until ransom was paid. WordPress sites were compromised via wp2shell, highlighting ongoing web vulnerabilities. Users are advised to stay vigilant as scammers exploit personal data and social engineering tactics.