🚨 July 2026 Threat Alert

1. New LockBit Variant Targeting Small Business NAS Devices

A new variant of LockBit ransomware — internally tracked as LockBit-NG — has been observed in the wild since late June 2026, specifically targeting network-attached storage (NAS) devices used by small businesses for local backups and file sharing. This variant exploits default credentials and unpatched vulnerabilities in QNAP, Synology, and Western Digital NAS devices to encrypt both the NAS and any connected network shares.

Why this matters for small businesses: Many small businesses use NAS devices as their primary backup target, believing that local network storage is safer than the cloud. But if the NAS is on the same network as infected computers — or accessible from the internet with default credentials — it becomes the first thing encrypted. The result: both primary files and the backup are lost simultaneously.

2. Fake Shopify Invoice Phishing Campaign Targeting E-Commerce Sellers

A coordinated phishing campaign is targeting small e-commerce businesses with emails that appear to be order confirmations or invoice notifications from Shopify. The emails use Shopify's actual branding, reference real-looking order numbers, and contain a "View Order" button that leads to a credential-harvesting page.

Once the attacker captures the store owner's login, they typically: (1) export the customer list and order history, (2) change the payout bank account to their own, and (3) install a payment skimmer on the checkout page. The entire process can happen in under an hour.

3. Critical WooCommerce Plugin Vulnerabilities Under Active Exploit

Three high-severity vulnerabilities have been disclosed in popular WooCommerce add-ons this month. All three are under active exploitation — meaning attackers are already scanning for and attacking unpatched sites:

• WooCommerce Dynamic Pricing & Discounts (CVE-2026-XXXXX) — Unauthenticated SQL injection allowing full database access. 200,000+ active installs.
• WooCommerce Shipment Tracking (CVE-2026-XXXXX) — Stored XSS allowing attackers to inject malicious scripts visible to admin users. 80,000+ active installs.
• WooCommerce PDF Invoices & Packing Slips — Authorization bypass allowing unauthenticated users to download any invoice, including customer addresses. 300,000+ active installs.

If you run any of these plugins, update immediately. If auto-updates are off, turn them on. If the plugin is no longer actively maintained by its developer, replace it.

4. Seasonal Alert: Summer Vacation Phishing Targeting Small Business Owners

Every July-August, attackers exploit the fact that business owners and managers are on vacation. The pattern is consistent: "urgent" emails arrive when the decision-maker is away, and junior staff — afraid of looking unresponsive — act without verifying. This month's variant: fake vendor payment reminder emails claiming "your account is past due — service will be suspended."

Prevention: Before you go on vacation, brief your team: "If you receive an urgent payment demand, vendor suspension notice, or wire transfer request while I am away, do not act on it until you reach me or [designated backup person] on a known phone number." Put this in writing. The 30-second phone call verification prevents the $25,000 fraudulent wire transfer.

Summary: Your July 2026 Security To-Do List

1. Update your NAS firmware and change default passwords
2. Set up a 3-2-1 backup strategy if you rely solely on a NAS for backups
3. Enable MFA on your Shopify/WooCommerce admin account
4. Update all WooCommerce plugins and enable auto-updates
5. Brief your team on vacation-time phishing scams
6. Bookmark our Incident Response Center — just in case