UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCEWEDNESDAY, 8 JULY 2026
Master Spy List
▌ INTELLIGENCE BRIEF

Trump-Ordered Master Spy List Sparks Revolt Inside CIA, FBI

◆ MODERATEIntelligence Community8 JUL 2026

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

ALSO FILED
▌ INTELLIGENCE BRIEF

Hormuz Ceasefire Collapses as Iran Strikes Bahrain, Kuwait

The US-Iran ceasefire has effectively collapsed after tanker attacks in the Strait of Hormuz drew retaliatory US strikes on more than 80 Iranian targets and an IRGC missile-and-drone response against American and allied positions in Bahrain and Kuwait, raising the probability of a wider Gulf war.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Network Guarding World Cup Security

The Department of Homeland Security has confirmed hackers breached the Homeland Security Information Network, the platform coordinating security for the 2026 World Cup across sixteen host cities, and has not yet identified the intrusion's source or the scope of any data exfiltrated.

◆ MODERATECyber and Information Warfare
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

Hormuz Ceasefire Collapses as Iran Strikes Bahrain, Kuwait

The US-Iran ceasefire has effectively collapsed after tanker attacks in the Strait of Hormuz drew retaliatory US strikes on more than 80 Iranian targets and an IRGC missile-and-drone response against American and allied positions in Bahrain and Kuwait, raising the probability of a wider Gulf war.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Network Guarding World Cup Security

The Department of Homeland Security has confirmed hackers breached the Homeland Security Information Network, the platform coordinating security for the 2026 World Cup across sixteen host cities, and has not yet identified the intrusion's source or the scope of any data exfiltrated.

◆ MODERATECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Ukraine Strikes Russian Oil Terminal, Naval Base Ahead of NATO Summit

Ukraine's coordinated strikes on Russia's St. Petersburg oil terminal and Kronstadt naval base, days before a NATO summit expected to pledge $80 billion in aid, signal Kyiv is escalating economic and military pressure on Moscow even as Washington pushes both sides toward ceasefire talks.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare7 JUL 2026
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

◆ MODERATECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026
▌ INTELLIGENCE BRIEF

CIA and FBI Refuse White House Demand for Centralized Foreign Spy Registry

The CIA and FBI are defying a White House and ODNI directive to compile a centralized master registry of all known foreign intelligence operatives, citing catastrophic operational security risks if such a list were ever compromised.

◆ HIGH CONFIDENCEIntelligence Community4 JUL 2026
▌ INTELLIGENCE BRIEF

Divided House: DIA and CIA Split on Iran Nuclear Strike Damage as Doha Talks Resume

Contradictory DIA and CIA assessments of US strike effectiveness on Iran's nuclear programme have exposed a structural intelligence dispute at the moment most consequential to ongoing ceasefire negotiations.

◆ MODERATEIntelligence Community4 JUL 2026