---
title: "Microsoft Patch Records, Ransomware Hits Fairlife, Spirals Moves Fast  | DMARC Report"
description: "Stay updated on Microsoft Patch Tuesday, Fairlife ransomware, Spirals attacks, phishing scams, AI threats, and the latest DMARC, DKIM & SPF security updates."
image: "https://dmarcreport.com/og/blog/microsoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast.png"
canonical: "https://dmarcreport.com/blog/microsoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast/"
---

Quick Answer

This week's cybersecurity roundup covers Microsoft's record-breaking July Patch Tuesday, the Fairlife ransomware attack, Spirals' rapid ransomware operations, active phishing campaigns, AI-powered cyber threats, CISA KEV updates, and the latest DMARC, DKIM, and SPF email security developments.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fmicrosoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Microsoft%20Patch%20Records%2C%20Ransomware%20Hits%20Fairlife%2C%20Spirals%20Moves%20Fast%20&url=undefined%2Fblog%2Fmicrosoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fmicrosoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fmicrosoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast%2F&title=Microsoft%20Patch%20Records%2C%20Ransomware%20Hits%20Fairlife%2C%20Spirals%20Moves%20Fast%20 "Share on Reddit") [ ](mailto:?subject=Microsoft%20Patch%20Records%2C%20Ransomware%20Hits%20Fairlife%2C%20Spirals%20Moves%20Fast%20&body=Check out this article: undefined%2Fblog%2Fmicrosoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast%2F "Share via Email") 

![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-analyzer-9711-1784633010221.jpg) 

## Microsoft’s July Patch Tuesday breaks records

Microsoft’s [July 2026 Patch Tuesday](https://www.computerworld.com/article/4198400/julys-patch-tuesday-sees-an-end-of-support-collision-amidst-a-massive-record-setting-patch-wave.html) addressed roughly 570 vulnerabilities, including two actively exploited zero-days — CVE-2026-56164 in SharePoint Server and **CVE-2026-56155** in [Active Directory Federation Services](https://plurilock.com/glossary/active-directory-federation-services/) — plus a publicly disclosed BitLocker bypass bug. One of the largest single-month patch batches on record.

## Coca-Cola’s Fairlife dairy unit hit by ransomware

The Coca-Cola Company disclosed that a [ransomware attack](https://www.michiganfarmnews.com/coca-cola-company-s-fairlife-targeted-in-ransomware-attack) impacting its Fairlife dairy subsidiary disrupted operations, temporarily suspending production of Fairlife products across the **United States**.

## New ransomware crew “Spirals” moves at record speed

A new ransomware actor called Spirals completed a **corporate intrusion** — from initial access to [data theft and encryption](https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/) — in less than 24 hours.![What Is Dmarc 3225](https://media.mailhop.org/dmarcreport/what-is-dmarc-3225-1784633316084.jpg)

## Scattered Spider hackers finally jailed

Thalha Jubair, 20, and Owen Flowers, 18, were each sentenced to five years and six months in prison for the 2024 [cyberattack on Transport for London](https://www.computerweekly.com/news/366645859/Scattered-Spider-hackers-sentenced-over-TfL-attack), in what UK authorities called the largest cybercrime prosecution ever brought before a UK court, with damages estimated at **£29 million**. The attack originated through [social engineering](https://www.wusa9.com/article/news/nation-world/carnival-data-breach-nearly-6-million-impacted-social-engineering-attack-personal-information/507-30f14c52-3e93-4fc6-a7e7-26a807ec16d8) targeting the organization’s helpdesk.

## LastPass warns of active phishing campaign

[LastPass](https://cybernews.com/security/lastpass-bitwarden-fake-compliance-emails/) alerted customers to an active phishing campaign identified on July 13, with emails sent from a lookalike domain directing recipients to a fraudulent site designed to steal LastPass master passwords. _LastPass’s own systems were not affected_.

## CISA adds actively exploited plugin flaws to its KEV catalog

CISA added unrestricted file-upload vulnerabilities affecting iCagenda and **Balbooa Forms** to its [Known Exploited Vulnerabilities catalog](https://www.technadu.com/cisa-adds-4-actively-exploited-adobe-joomla-and-langflow-flaws-to-kev-catalog/630567/).

## Lidl customer data stolen via third-party vendor

Hackers stole [Lidl customer data](https://www.teiss.co.uk/news/lidl-notifies-customers-in-germany-belgium-and-netherlands-after-data-breach-at-it-service-provider-17828) from an **external service provider**.

## Wrongful detention in REvil manhunt

![Dmarc Record 1970](https://media.mailhop.org/dmarcreport/dmarc-record-1970-1784633164355.jpg)

Armenia detained a [Russian tourist on a US](https://www.cbsnews.com/news/china-us-scientist-youlin-chen-wrongfully-detained/) extradition request tied to a REvil ransomware suspect, though his lawyers say authorities have the wrong man.

## AWS billing bug shows trillion-dollar charges

An **AWS Cost Explorer** error displayed inaccurate estimated charges reaching [trillions of dollars](https://www.wsj.com/business/the-trillions-of-dollars-of-u-s-investment-at-stake-in-the-gulf-f66f7883), although customers were not actually billed those amounts.

## IIS server compromise leads to same-week ransomware

_Attackers used a compromised Microsoft IIS server as an initial foothold before deploying ransomware throughout the victim’s network the next day._

## Nation-state hackers weaponize AI coding tools

[China-linked hackers](https://www.businessinsider.com/z-ai-zcode-ai-coding-tool-chinese-startup-lower-cost-2026-7) weaponized Claude Code and DeepSeek against government networks, while researchers detailed an exploit chain combining **GPT-5/6-era** AI models with Chrome browser vulnerabilities to illustrate emerging AI-assisted attack techniques.

## New “GhostCommit” AI-prompt-hiding technique

A novel technique dubbed [GhostCommit](https://gbhackers.com/new-ghostcommit-technique-hides-exploits/) was found hiding malicious AI instructions inside images and code commits, part of a growing trend of attackers targeting **AI-integrated developer workflows**.![Dmarc Record Generator 3199](https://media.mailhop.org/dmarcreport/dmarc-record-generator-3199-1784633193715.jpg)

## DPRK-aligned hackers target developers for crypto theft

[Cybersecurity](https://dmarcreport.com/blog/email-security-meets-cybersecurity-understanding-the-role-of-dmarc-reports/) researchers uncovered a campaign, tracked as **REF9403**, targeting software developers with _North Korean state-sponsored hackers aiming to steal sensitive data and plunder cryptocurrency wallets._

## Bandcamp phishing campaign hits musicians and developers

A phishing campaign began targeting musicians and developers on Bandcamp, abusing legitimate contact forms and spoofed _“[noreply@bandcamp.com](mailto:noreply@bandcamp.com)”_ emails to bypass [spam filters](https://www.malwarebytes.com/blog/news/2025/11/phishing-emails-disguised-as-spam-filter-alerts-are-stealing-logins) — bearing a striking resemblance to a 2025 Pixiv phishing scam.![What Is Dmarc 8110](https://media.mailhop.org/dmarcreport/what-is-dmarc-8110-1784633113326.jpg)

## Independence-Day-themed scams targeted mobile users

[Bitdefender](https://www.bitdefender.com/en-us/blog/hotforsecurity/independence-day-scams-2026-alert) flagged a wave of holiday-lure scams spreading via WhatsApp and SMS, impersonating major retailers with fake gift offers — _roughly 90% coming from contacts already saved in victims’ phones, making them unusually convincing._

Stay informed about the latest cybersecurity threats, ransomware attacks, phishing campaigns, and [DMARC](https://dmarcreport.com/), [DKIM](https://dmarcreport.com/what-is-dkim/), and [SPF](https://dmarcreport.com/what-is-spf/) **email security** updates.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) 

## Related Articles

[  Intermediate 4m  10 Reasons Why DKIM Fails  Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[  Intermediate  Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows  Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[  Intermediate 8m  Best DMARC Reporting Tools in 2026: Honest Comparison  Mar 25, 2026 ](/blog/best-dmarc-reporting-tools-2026/)[  Intermediate 12m  DMARC Passed. The Email Was Still an Attack. Inside the Blesta Ransom Incident  Jun 28, 2026 ](/blog/blesta-ransom-email-dmarc-passed-authenticated-abuse/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Microsoft Patch Records, Ransomware Hits Fairlife, Spirals Moves Fast ","description":"Stay updated on Microsoft Patch Tuesday, Fairlife ransomware, Spirals attacks, phishing scams, AI threats, and the latest DMARC, DKIM & SPF security updates.","url":"https://dmarcreport.com/blog/microsoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast/","datePublished":"2026-07-21T00:00:00.000Z","dateModified":"2026-07-21T00:00:00.000Z","dateCreated":"2026-07-21T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/microsoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-analyzer-9711-1784633010221.jpg","caption":"cybersecurity news"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Microsoft Patch Records, Ransomware Hits Fairlife, Spirals Moves Fast ","item":"https://dmarcreport.com/blog/microsoft-patch-records-ransomware-hits-fairlife-spirals-moves-fast/"}]}
```