Blahalla

Infected Cisco firewalls need cold start to clear persistent Firestarter backdoor

www.csoonline.com · 2 months ago

Security experts have identified a persistent backdoor, dubbed Firestarter, targeting Cisco ASA and Firepower devices. The malware exploits vulnerabilities CVE-2025-20333 and CVE-2025-20362 to maintain access even after patching, allowing attackers to access administrative credentials and control device configurations. To remove the backdoor, a "cold start" is required, completely disconnecting the device from all power sources for one minute before rebooting, or reimaging the device. The threat group UAT-4356, also known as Storm-1849 and ArcaneDoor, is linked to the campaign.

[ Removed by Reddit ]

www.reddit.com · 2 months ago

false

72% of enterprise users have at least one browser extension with a known CVE. Pulled the numbers on our org and it tracks.

go.layerxsecurity.com · 2 months ago

A new report indicates that browser extensions have become a significant security risk for businesses. Nearly all enterprise users have at least one extension installed, with about 15 percent using AI extensions. AI extensions pose a greater threat, being more likely to have Common Vulnerabilities and Exposures, access cookies, and execute remote scripts. Additionally, 34 percent of all extensions increased their permissions in the last year, with AI extensions exhibiting a six-fold higher rate of this behavior.

Robinhood account creation flaw abused to send phishing emails

www.bleepingcomputer.com · 2 months ago

Threat actors exploited a flaw in Robinhood’s account creation process to send phishing emails to customers. The attackers injected malicious HTML into legitimate emails, making them appear as genuine login alerts about unrecognized device activity. These emails directed users to a fraudulent website designed to steal Robinhood credentials. Robinhood has since addressed the vulnerability by removing the field that allowed this manipulation, emphasizing that customer data and funds were not compromised.

GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions

www.bleepingcomputer.com · 2 months ago

A new GlassWorm malware campaign is targeting the OpenVSX ecosystem through 73 extensions. These extensions initially appear benign but deliver malicious payloads through updates. The attacker is using clones of legitimate extensions to trick developers, with subtle differences in publisher names and identifiers. The payloads are fetched through methods including downloading VSIX packages from GitHub, loading compiled modules, or using obfuscated JavaScript, previously targeting cryptocurrency wallet data and developer credentials.

Sergey Brin Moves to the Right, With a ‘MAGA Girlfriend’ by His Side

www.nytimes.com · 2 months ago

false

UNC6692 Combines Social Engineering, Malware, Cloud Abuse

www.darkreading.com · 2 months ago

A newly tracked threat actor, designated UNC6692, is employing a sophisticated attack chain combining social engineering, custom malware, and abuse of legitimate cloud infrastructure. The group initiates attacks with phishing emails and Microsoft Teams messages, leading victims to download malicious AutoHotkey scripts from an AWS S3 bucket. This facilitates the installation of the SNOWBELT browser extension, Snowglaze Python tunneler, and Snowbasin backdoor, enabling reconnaissance, credential theft via LSASS memory extraction, and lateral movement within the network. Google researchers suspect the group is financially motivated and recommend defenders enhance visibility into browser activity and cloud traffic.

Canada arrests three for operating “SMS blaster” device in Toronto

www.bleepingcomputer.com · 2 months ago

Canadian authorities have arrested three men in connection with an illegal device dubbed an "SMS blaster," which mimics cellular towers to send fraudulent text messages. The device, operated from vehicles, targeted phones in the Toronto area and potentially affected millions, disconnecting them from legitimate networks and hindering access to emergency services. Police seized multiple SMS blasters and related equipment during searches in Markham and Hamilton. Users are advised to disable 2G downgrades on Android devices and treat SMS as an insecure channel to avoid phishing attempts.

Alleged Silk Typhoon hacker extradited to US for cyberespionage

www.bleepingcomputer.com · 2 months ago

A Chinese national, Xu Zewei, has been extradited to the United States to face charges related to cyberespionage. He is accused of being a contract hacker for China’s Ministry of State Security, participating in breaches between 2020 and 2021. The indictment links Xu to the Silk Typhoon hacking group, also known as Hafnium, which targeted COVID-19 research organizations and exploited Microsoft Exchange Server zero-day vulnerabilities. Authorities allege Xu acted under the direction of MSS officials and through a company called Shanghai Powerock Network Co., Ltd.

China says it will reverse major AI acquisition by Meta

www.washingtonpost.com · 2 months ago

false

Kaspersky recently disclosed PhantomRPC, a privilege escalation technique affecting all Windows versions (tested on Server 2022/2025)

securelist.com · 2 months ago

Researchers have identified privilege escalation vulnerabilities in Windows, stemming from flaws in the Remote Procedure Call architecture. Attackers can impersonate legitimate Windows services, such as TermService, to gain SYSTEM-level access, often triggered by Group Policy updates. The vulnerabilities exploit a lack of verification in RPC connections, enabling attackers to deploy fake servers and coerce systems into connecting to them. Microsoft considers the issues to have moderate severity and has declined to release a patch.

Elon Musk and Sam Altman Bring OpenAI Trial Spectacle to Oakland

www.nytimes.com · 2 months ago

false

Why a Decade of Writing Detection Logic Makes the Mythos Exploit Numbers Less Scary

www.magonia.io · 2 months ago

Recent increases in vulnerability findings are not as critical as they seem, as adversaries often leverage older exploits and exploit creation is a continuous process. Layered behavioral detection, focused on activity patterns, is more effective than relying on exploit signatures or machine learning due to high false positive rates. Prioritizing accuracy and understanding network behavior are more valuable than machine learning-driven intrusion detection. The expanded attack surface and potential for abuse related to large language models presents a long-term cybersecurity concern.

FTC: Americans lost over $2.1 billion to social media scams in 2025

www.bleepingcomputer.com · 2 months ago

The Federal Trade Commission reports Americans lost over two point one billion dollars to social media scams in 2025, an eightfold increase since 2020. Facebook was the platform most frequently linked to these scams. Meta has introduced new security features across WhatsApp, Facebook, and Messenger to help detect and prevent fraudulent activity. The Federal Bureau of Investigation received over one million complaints of internet crime last year, totaling nearly twenty-one billion dollars in losses.

Google workers petition CEO to refuse classified AI work with Pentagon

www.washingtonpost.com · 2 months ago

Google employees have petitioned CEO Sundar Pichai, requesting he prevent the Pentagon from utilizing Google's artificial intelligence for classified projects. The employees expressed concern that the AI technology could be used in inhumane or harmful ways. This action follows a similar situation with Anthropic, another AI company, which was previously rejected by the Defense Department for requesting limitations on its use. The employees want to ensure AI benefits humanity.

From Indiana to Idaho, a Backlash Against A.I. Gathers Momentum

www.nytimes.com · 2 months ago

false

Unpatched 'PhantomRPC' Flaw in Windows Enables Privilege Escalation

www.darkreading.com · 2 months ago

A new vulnerability, dubbed PhantomRPC, allows attackers to escalate privileges on Windows systems. The flaw lies in how Remote Procedure Call, or RPC, handles connections to unavailable services, enabling a malicious RPC server to impersonate legitimate Windows services. Microsoft classified the issue as moderate severity and ineligible for a bounty, and has not issued a CVE, despite five known exploit paths. Kaspersky recommends implementing Event Tracing for Windows and limiting the use of the SeImpersonatePrivilege to mitigate the risk.

PyPI package with 1.1M monthly downloads hacked to push infostealer

www.bleepingcomputer.com · 2 months ago

A malicious actor compromised the elementary-data package on the Python Package Index, pushing a version 0.23.3 designed to steal sensitive developer data. The attacker exploited a GitHub Actions script injection flaw to forge a signed release and distribute a backdoored package and Docker image. The malicious package, elementary.pth, targeted sensitive data including SSH keys, crypto wallets, and cloud credentials. Users who downloaded version 0.23.3 or related Docker images are advised to rotate secrets and restore environments.

The unflattering secrets revealed so far in Elon Musk’s latest legal feud

www.washingtonpost.com · 2 months ago

Hundreds of court filings have revealed cringeworthy texts, emails and private diary entries from Elon Musk, Sam Altman, other OpenAI founders and public figures. Elon Musk’s lawsuit, filed in 2024, accuses Altman and others of betraying OpenAI’s founding nonprofit mission and seeks to remove them and restore the company to a full nonprofit while OpenAI says Musk aims to undercut its business and a competitor, xAI. The filings show claims that Shivon Zilis acted as a conduit between Musk and OpenAI, messages of Mark Zuckerberg offering help, Musk insulting Jeff Bezos, and Greg Brockman’s personal notes imagining extracting personal wealth including a line about reaching one billion dollars, and a judge limited drug-related testimony but allowed questioning about Musk’s attendance at Burning Man.

Home security giant ADT data breach affects 5.5 million people

www.bleepingcomputer.com · 2 months ago

Home security giant ADT recently experienced a data breach impacting 5.5 million people. The ShinyHunters extortion group claimed responsibility, alleging the breach occurred after compromising an employee's Okta single sign-on account through a voice phishing attack, giving them access to Salesforce data. Stolen information includes names, addresses, phone numbers, dates of birth, and partial Social Security numbers for some individuals. ADT confirmed the incident and stated payment information and customer security systems were not affected.

Webinar: Spotting cyberattacks before they begin

www.bleepingcomputer.com · 2 months ago

false

Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack

thehackernews.com · 2 months ago

Checkmarx has confirmed a data breach involving its GitHub repository, with evidence suggesting data was posted on the dark web. The breach is linked to a March 23rd supply chain attack, initially impacting the Trivy software. Compromised data includes source code, employee database information, API keys, and credentials for MongoDB and MySQL. Checkmarx is investigating the incident and will notify customers if customer data is involved.

China Will Require Meta to Unwind Acquisition of AI Start-Up Manus

www.nytimes.com · 2 months ago

false

Medtronic confirms breach after hackers claim 9 million records theft

www.bleepingcomputer.com · 2 months ago

Medical device manufacturer Medtronic has confirmed a data breach after the hacker group ShinyHunters claimed responsibility and said they stole over 9 million records. The company reports that the incident affected corporate IT systems but did not impact customers, products, or operations. ShinyHunters claims to have compromised terabytes of internal data and is demanding a ransom. Medtronic is currently investigating the incident and will notify customers if personal data was exposed.

New Malware Hides Behind Obfuscation and Staged Payloads

gbhackers.com · 2 months ago

A new malware campaign is targeting government organizations in Pakistan using highly targeted spear-phishing emails. The attack begins with malicious attachments, a Word document and a PDF, that trigger a multi-stage infection chain. The malware utilizes Microsoft Visual Studio Code tunnels and Discord webhooks for command and control and data exfiltration, blending malicious traffic with trusted infrastructure. Security analysts have assigned a high malicious score and are advising organizations to disable macros and monitor the use of developer tools.

⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More

thehackernews.com · 2 months ago

Cybersecurity experts warn of evolving threats including sophisticated malware frameworks like Fast16, which predate Stuxnet. Attackers are employing social engineering tactics, exploiting vulnerabilities in Cisco devices, and using custom tools for ransomware attacks. Concerns are also rising over supply chain compromises, such as the recent incident affecting the Bitwarden CLI. A range of vulnerabilities have been disclosed, requiring urgent patching and reinforcing the need for strong security measures.

EU Proposes Forcing Google to Share Search Data With Rivals Under DMA

gbhackers.com · 2 months ago

false

Context windows are breaking multi-agent security workflows

www.extrahop.com · 2 months ago

Cybersecurity teams are deploying AI agents for alert triage, investigation, and response, but a lack of shared memory between these agents creates a significant vulnerability. Each agent operates within its own limited context window, leading to fragmented reasoning and missed indicators of compromise, as demonstrated by the 2023 Booking.com campaign. A persistent, network-based source of truth is needed to provide continuous context and prevent agents from acting in isolation. Addressing this architectural flaw is critical to avoid future automation-driven breaches.

20-Year-Old Malware Rewrites History of Cyber Sabotage

www.darkreading.com · 2 months ago

Researchers have uncovered a previously unknown malware framework called fast16, considered the earliest example of a cyber tool designed to sabotage high-precision calculations. Dating back to 2005, fast16 corrupts mathematical outputs to undermine systems relying on accurate results, potentially impacting fields like physics, cryptography, and nuclear research. The malware utilized a "cluster munition" delivery method and targeted software suites like LS-DYNA, PKPM, and MOHID, with LS-DYNA possibly linked to Iran's nuclear program. Although it primarily ran on obsolete Windows XP systems, the attack vector remains relevant for modern systems performing high-precision calculations.

Incomplete Windows Patch Opens Door to Zero-Click Attacks

www.securityweek.com · 2 months ago

A flaw in a Windows patch has created a new vulnerability enabling zero-click attacks. The initial vulnerability, CVE-2026-21510, allowed remote code execution through malicious files, and an incomplete fix led to CVE-2026-32202, an authentication coercion vulnerability. Attackers, specifically the Russia-linked APT28, exploited these vulnerabilities, along with CVE-2026-21513, to steal credentials and gain remote code execution without user interaction, targeting Ukraine and European Union countries. Microsoft has since released fixes for CVE-2026-32202.

Fake YouTube Downloads Spread Vidar Malware to Steal Corporate Logins

gbhackers.com · 2 months ago

Cybercriminals are using fake software download links on YouTube to spread the Vidar infostealer, targeting corporate employees and stealing login credentials. Victims are redirected through file-sharing services like MediaFire to download a malicious installer disguised as a legitimate tool, NeoHub. Once executed, Vidar steals credentials, cookies, and cryptocurrency wallet information, and operators use dead drop resolvers on platforms like Steam and Telegram to hide their command-and-control infrastructure. Stolen data is then sold on Russian cybercrime marketplaces, enabling further attacks like corporate email compromise.

Money launderer linked to $230M crypto heist gets 70 months in prison

www.bleepingcomputer.com · 2 months ago

A California man, Evan Tangeman, has been sentenced to 70 months in prison for laundering over three and a half million dollars connected to a massive 230 million dollar cryptocurrency heist. Tangeman and several other individuals were involved in a racketeering conspiracy to steal over 4,100 Bitcoin from a victim in Washington, D.C., using methods like spoofed phone numbers and remote access software. The group used cryptocurrency mixers, exchanges, and virtual private networks to conceal their identities while funding lavish spending including private jets and expensive vehicles. Several other suspects remain charged with racketeering conspiracy, money laundering, and obstruction of justice.

Deepfake Voice Attacks are Outpacing Defenses: What Security Leaders Should Know

www.bleepingcomputer.com · 2 months ago

A new type of fraud is rapidly increasing, with deepfake voice and video attacks costing organizations billions of dollars. In March 2025, a finance director authorized a $499,000 transfer after being fooled by a completely AI-generated call, and Arup lost $25.6 million earlier in 2024 using a similar tactic. These attacks exploit vulnerabilities by targeting employees in finance and HR, often bypassing traditional security measures, and require only three seconds of audio and minimal technical expertise to execute. Organizations are advised to train employees to verify requests and implement simple protocols like verbal passcodes and callback requirements to prevent financial losses.

Microsoft Releases Enterprise Policy Option to Disable Windows 11 Copilot

gbhackers.com · 2 months ago

Microsoft has released a new enterprise policy setting to allow administrators to silently uninstall the Microsoft Copilot app from Windows 11 devices. The policy, available through Group Policy and Microsoft Intune, removes the app only if Microsoft 365 Copilot is installed, the app was not user-installed, and it hasn't been used in 28 days. This change comes as a response to enterprise feedback and user concerns regarding AI feature bloat within Windows 11. The policy initially appeared in Build 26220.7535 (KB5072046) and has limitations; future updates or user reinstallation can reintroduce the app.

Parsing Agentic Offensive Security's Existential Threat

www.darkreading.com · 2 months ago

The emergence of large language models like Anthropic’s Mythos and OpenAI’s GPT-5.5 is accelerating the pace of vulnerability discovery and exploitation. While these models automate tasks like reconnaissance and exploit chaining, human expertise remains crucial for identifying and validating exploitable bugs and assessing their real-world impact. Organizations must improve their “shifting left” practices to address the increasing speed at which vulnerabilities are found and used. Key technical advancements for defenders include improved reasoning, tool calling, harness engineering, and system building.

[arXiv] Enhancing REST API Fuzzing with Access Policy Violation Checks and Injection Attacks

arxiv.org · 2 months ago

Researchers have developed new techniques to enhance REST API fuzzing, moving beyond simply identifying server crashes. The method uses automated oracles to detect access policy violations, along with traditional attacks like SQL Injection and Cross-Site Scripting. This technique, integrated with the EvoMaster fuzzer, generates executable test cases in languages like Java, Kotlin, Python, and JavaScript. Testing was performed on a variety of APIs, demonstrating the ability to identify security vulnerabilities.

Microsoft patched an ‘agent-only’ role that was not

www.csoonline.com · 2 months ago

A misconfigured administrative role within Microsoft Entra ID, known as Agent ID Administrator, recently allowed users to assume ownership of unrelated service principals. This misconfiguration, stemming from a failure to properly define boundaries between agent and non-agent objects, enabled potential privilege escalation and tenant-wide attacks. The role’s improper scope effectively mirrored the capabilities of higher-privileged roles, like Application Administrator. Microsoft has implemented a patch, rolled out by April 9, 2026, to prevent this issue and no user action is required.

OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

www.securityweek.com · 2 months ago

A flaw has been identified in OpenSSH versions released over the past 15 years that could allow attackers to gain root shell access. The vulnerability, tracked as CVE-2026-35414, occurs due to a mishandling of certificate principals involving comma characters. Attackers can exploit this by using a comma in a certificate principal name to bypass access controls and authenticate as root without triggering authentication failures in logs. Organizations are urged to update to OpenSSH version 10.3 or later to resolve the issue.

Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google

www.securityweek.com · 2 months ago

Google researchers have observed a rise in malicious indirect prompt injection attacks targeting generative AI tools like Gemini, Copilot, and ChatGPT. These attacks, which trick AI into bypassing security measures, are currently relatively unsophisticated, involving data exfiltration attempts and prompts designed to cause destruction. While some attacks aim to steal data like IP addresses and credentials, Google noted a 32% increase in malicious attempts between November 2025 and February 2026. Experts anticipate that the scale and complexity of these attacks will continue to increase in the future.

Microsoft says Outlook.com outage is causing sign‑in failures

www.bleepingcomputer.com · 2 months ago

Microsoft is investigating an ongoing outage impacting Outlook.com, causing sign-in failures and preventing users from accessing their mailboxes. Affected customers are experiencing unexpected sign-outs and "too many requests" errors, with client sign-in scenarios potentially contributing to the problem. Microsoft has labeled the incident as "service degradation," indicating a noticeable impact on users. Researchers recently discovered that four unpatched zero-day vulnerabilities can be chained together to bypass security protections.

Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren't Ready for the Remediation Side

thehackernews.com · 2 months ago

The emergence of AI tools like Anthropic’s Mythos highlights a critical gap in cybersecurity: the ability to efficiently remediate discovered vulnerabilities. Organizations often struggle with disorganized workflows, leading to findings languishing in spreadsheets or tickets, with unclear ownership and verification processes. To address this, security programs need centralized findings management, risk-contextualized prioritization, and dynamic remediation tracking. Without these improvements, increased vulnerability discovery will simply overwhelm existing systems and create a larger backlog of unresolved issues.

Fake Income Tax Notices Used to Spread Malware

gbhackers.com · 2 months ago

Cybercriminals are using fake income tax notices to distribute malware, specifically targeting multinational organizations with operations in India. The phishing campaign, active since October 2025, impersonates the Income Tax Department and uses deceptive emails referencing Section 271(1)(c) of the Income Tax Act to pressure victims into downloading malicious files. These files deploy the XRed trojan, a backdoor malware that allows attackers to steal data, log keystrokes, and remotely control compromised systems. Authorities advise taxpayers to verify information through the official Income Tax Department website and avoid suspicious links.

PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

thehackernews.com · 2 months ago

A pro-Ukrainian hacktivist group, PhantomCore, has been actively targeting Russian organizations since September 2025, exploiting vulnerabilities in TrueConf video conferencing software to gain access to networks. Researchers identified a chain of three vulnerabilities used in the attacks, including CVE-2025-10114, CVE-2025-10115, and CVE-2025-10116, allowing for remote command execution and lateral movement. The group employs custom tools and techniques to remain undetected while stealing data and disrupting operations, and often utilizes phishing campaigns for initial access. Other threat actors, such as CapFIX, Geo Likho, and Paper Werewolf, are also actively targeting Russian entities.

Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware

thehackernews.com · 2 months ago

Researchers have discovered 73 fake Visual Studio Code extensions distributing GlassWorm v2 malware. These extensions are clones of legitimate software, with six confirmed as malicious and others acting as sleeper packages to gain user trust before delivering malware via updates. The malicious extensions, published recently, deploy a secondary VSIX extension from GitHub that infects multiple development environments and steals data, installs a remote access trojan, and deploys a rogue Chromium extension. The attackers are using obfuscated JavaScript to evade detection and specifically avoid Russian systems.

Energy and Water Management Firm Itron Hacked

www.securityweek.com · 2 months ago

Itron, a company providing energy and water management solutions, is investigating unauthorized access to its systems detected on April 13. The company reports that operations have continued normally, and no unusual activity was observed in customer systems. Itron is determining what legal or regulatory notifications are necessary and expects most incident response costs to be covered by insurance. The motivation behind the attack and potential data compromise remain unknown.

Itron Discloses Data Breach After Hackers Access Internal Systems

gbhackers.com · 3 months ago

Itron, a technology company specializing in smart metering, recently experienced a data breach after unauthorized access to portions of its internal corporate network. The company quickly responded by engaging cybersecurity advisors, notifying law enforcement, and remediating affected systems. Customer data environments and business operations were reportedly unaffected, and significant costs are expected to be covered by cyber insurance. The investigation is ongoing, and the full scope of the compromised data remains undetermined.

Medieval Encrypted Letter Decoded

www.schneier.com · 3 months ago

false

Linux ELF Malware Generator Evades ML Detection With Semantic-Preserving Changes

gbhackers.com · 3 months ago

Researchers have developed a tool to generate Linux malware that can evade machine learning-based detection systems. The tool uses semantic-preserving transformations, modifying the malware's structure without impacting its functionality. Testing against the MalConv detector resulted in a 67.74 percent evasion rate, with modifications to the.strtab string table proving particularly effective. The findings highlight vulnerabilities in machine learning models and the need for security vendors to improve detection methods beyond basic string analysis.

Researchers Warn macOS textutil, KeePassXC Can Fuel Automation Attacks

gbhackers.com · 3 months ago

Researchers have identified potential security risks arising from the unexpected behavior of common tools within automated systems. macOS’s textutil, typically used for file conversion, can initiate network requests when processing HTML with external references, creating a Server-Side Request Forgery risk. KeePassXC, a password manager, is vulnerable to manipulation of key derivation function parameters, which can cause significant performance degradation or denial-of-service conditions within automated processes. These issues stem not from flaws in the tools themselves, but from how they interact with attacker-controlled input within automated workflows.

UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware

www.securityweek.com · 3 months ago

A threat actor, tracked as UNC6692, is using a sophisticated multi-stage attack to compromise networks. The campaign begins with email bombing and social engineering, impersonating IT support to trick victims into installing a fake mailbox repair utility that delivers the Snowbelt malware. This malware, comprised of Snowbelt, Snowglaze, and Snowbasin, establishes a foothold, facilitates lateral movement, and harvests credentials, including dumping LSASS memory and exfiltrating Active Directory data. Attackers are leveraging trusted cloud platforms to bypass security filters and blend into legitimate traffic.