Blahalla

Energy and Water Management Firm Itron Hacked

www.securityweek.com · 3 months ago

Itron, a company providing energy and water management solutions, is investigating unauthorized access to its systems detected on April 13. The company reports that operations have continued normally, and no unusual activity was observed in customer systems. Itron is determining what legal or regulatory notifications are necessary and expects most incident response costs to be covered by insurance. The motivation behind the attack and potential data compromise remain unknown.

Itron Discloses Data Breach After Hackers Access Internal Systems

gbhackers.com · 3 months ago

Itron, a technology company specializing in smart metering, recently experienced a data breach after unauthorized access to portions of its internal corporate network. The company quickly responded by engaging cybersecurity advisors, notifying law enforcement, and remediating affected systems. Customer data environments and business operations were reportedly unaffected, and significant costs are expected to be covered by cyber insurance. The investigation is ongoing, and the full scope of the compromised data remains undetermined.

Medieval Encrypted Letter Decoded

www.schneier.com · 3 months ago

false

Linux ELF Malware Generator Evades ML Detection With Semantic-Preserving Changes

gbhackers.com · 3 months ago

Researchers have developed a tool to generate Linux malware that can evade machine learning-based detection systems. The tool uses semantic-preserving transformations, modifying the malware's structure without impacting its functionality. Testing against the MalConv detector resulted in a 67.74 percent evasion rate, with modifications to the.strtab string table proving particularly effective. The findings highlight vulnerabilities in machine learning models and the need for security vendors to improve detection methods beyond basic string analysis.

Researchers Warn macOS textutil, KeePassXC Can Fuel Automation Attacks

gbhackers.com · 3 months ago

Researchers have identified potential security risks arising from the unexpected behavior of common tools within automated systems. macOS’s textutil, typically used for file conversion, can initiate network requests when processing HTML with external references, creating a Server-Side Request Forgery risk. KeePassXC, a password manager, is vulnerable to manipulation of key derivation function parameters, which can cause significant performance degradation or denial-of-service conditions within automated processes. These issues stem not from flaws in the tools themselves, but from how they interact with attacker-controlled input within automated workflows.

UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware

www.securityweek.com · 3 months ago

A threat actor, tracked as UNC6692, is using a sophisticated multi-stage attack to compromise networks. The campaign begins with email bombing and social engineering, impersonating IT support to trick victims into installing a fake mailbox repair utility that delivers the Snowbelt malware. This malware, comprised of Snowbelt, Snowglaze, and Snowbasin, establishes a foothold, facilitates lateral movement, and harvests credentials, including dumping LSASS memory and exfiltrating Active Directory data. Attackers are leveraging trusted cloud platforms to bypass security filters and blend into legitimate traffic.

Easily Exploitable ‘Pack2TheRoot’ Linux Vulnerability Leads to Root Access

www.securityweek.com · 3 months ago

A critical vulnerability, known as Pack2TheRoot, has been identified in the PackageKit package management system, allowing unprivileged users to install packages with root privileges. The flaw, tracked as CVE-2026-41651, is a time-of-check time-of-use race condition. Affected versions range from 1.0.2 to 1.3.4, and several Linux distributions, including Ubuntu, Debian, RockyLinux, and Fedora, are impacted. The vulnerability has been addressed in PackageKit version 1.3.5 and through recent updates to affected distributions.

US Launches Sweeping Crackdown on Southeast Asia Cyberscams and Sanctions Cambodian Senator

www.securityweek.com · 3 months ago

U.S. officials have launched a sweeping crackdown on cyberscam operations in Southeast Asia, targeting criminal networks operating primarily in Cambodia and Myanmar. The effort includes sanctions against a Cambodian senator, Kok An, and 28 other individuals and companies accused of defrauding U.S. citizens of millions of dollars. Charges have been filed against two Chinese nationals, Huang Xing Shan and Jiang Wen Jie, who allegedly managed scam operations. The crackdown aims to disrupt human trafficking and near-slavery conditions used to force foreign nationals into running romance and cryptocurrency scams.

North Korean Hackers Target Pharma Firms with Malware-Laced Excel Attacks

gbhackers.com · 3 months ago

North Korean state-sponsored hackers, specifically the Kimsuky group, are targeting pharmaceutical and life science companies with malicious Excel-themed files. These attacks begin with spear-phishing emails containing compressed archives with shortcut files disguised as Excel documents. Upon execution, these shortcuts launch hidden PowerShell commands that download additional payloads and exfiltrate data using Dropbox as a command-and-control channel. Security professionals should be wary of unsolicited Excel attachments and monitor for suspicious PowerShell activity and unusual Dropbox traffic.

OpenClaw Flaws Expose Systems to Policy Bypass Attacks

gbhackers.com · 3 months ago

Security updates have been released for the OpenClaw AI agent framework to address three moderate-severity vulnerabilities. These flaws could allow attackers to bypass security policies, modify system configurations, and potentially steal API credentials. The vulnerabilities affect npm package versions prior to 2026.4.20 and involve issues with gateway configurations, bundled tools evading restrictions, and workspace environment variable handling. Users are strongly advised to immediately update to version 2026.4.20 to mitigate these risks.

AI is reshaping DevSecOps to bring security closer to the code

www.csoonline.com · 3 months ago

false

The ‘manager of agents’: How AI evolves the SOC analyst role

www.csoonline.com · 3 months ago

false

The man turning the Pentagon into a venture capital firm

www.washingtonpost.com · 3 months ago

false

Critical Gemini CLI Flaw Raises Supply Chain Security Concerns

gbhackers.com · 3 months ago

A critical vulnerability, tracked as GHSA-wpqr-6v78-jr5g, has been identified in Google’s Gemini CLI and related GitHub Action, allowing for Remote Code Execution. The flaw stems from improper workspace trust and tool allowlisting, enabling attackers to compromise automated workflows and potentially steal repository secrets. The vulnerability can be exploited through malicious environment variables and prompt injection techniques, requiring no elevated privileges. Users should upgrade the Gemini CLI NPM package to version 0.39.1 or 0.40.0-preview.3 and update the GitHub Action to version 0.1.22 to mitigate the risk.

Firefox Vulnerability Allows Tor User Fingerprinting

www.securityweek.com · 3 months ago

A vulnerability tracked as CVE-2026-6770 allows Firefox and Tor Browser users to be fingerprinted by exploiting the IndexedDB API. Firefox stores IndexedDB database names using internal UUID mappings and the order in which databases are listed remains consistent across sites while the same browser process runs, enabling unrelated sites to link a user across domains without cookies and persisting until the browser is fully restarted. The flaw can defeat Firefox Private Browsing and Tor Browser New Identity isolation and was assigned a medium severity rating by Mozilla. The issue was patched in Firefox 150 and in Tor Browser 15.0.10.

MCPwned: a Burp Suite extension for auditing MCP servers

fenrisk.com · 3 months ago

The Model Context Protocol (MCP) is a rapidly growing standard enabling AI agents to interact with external systems, leading to a surge in MCP servers, approximately 100,000 online. Due to the protocol's youth and fast growth, MCP servers often lack basic security measures, resulting in recent critical vulnerabilities, including command injection and remote code execution. To address this, Fenrisk developed MCPwned, a Burp Suite extension that detects MCP traffic, enumerates capabilities, and pre-fills Repeater payloads to simplify auditing. This extension aims to improve MCP server security testing, as vulnerabilities are being actively discovered, such as CVEs related to authentication bugs and command injection.

NPM Worm Hits Namastex Packages, Steals Secrets Across Registries

gbhackers.com · 3 months ago

A malicious npm malware campaign is targeting packages associated with Namastex Labs, leading to secret theft and cross-ecosystem propagation. Attackers have backdoored legitimate npm packages, including @automagik/genie versions 4.260421.33 through 4.260421.39 and pgserve versions 1.1.11, 1.1.12, and 1.1.13, which contain embedded RSA key material. The malware harvests secrets, targets browser and cryptocurrency wallet data, and exfiltrates information via HTTPS and Internet Computer canisters. It also attempts to propagate by stealing npm tokens and injecting malicious code into other packages, mirroring techniques used by the CanisterWorm campaign.

Nessus Agent Windows Flaw Enables SYSTEM-Level Code Execution

gbhackers.com · 3 months ago

A high-severity vulnerability, CVE-2026-33694, has been identified in the Nessus Agent for Windows, allowing attackers with local access to potentially execute code at the SYSTEM level. The flaw, classified as CWE-59, involves improper link resolution and can be exploited by creating junctions to delete files with elevated privileges, potentially leading to arbitrary code execution. Tenable has released version 11.1.3 to patch this vulnerability, which has a CVSSv3 base score of 8.2 and a CVSSv4 base score of 7.4. System administrators are urged to immediately update to the patched version to mitigate the risk.

ClickFix Attack Swaps PowerShell for Cmdkey, Remote Regsvr32 Payloads

gbhackers.com · 3 months ago

A new ClickFix attack is using a deceptive CAPTCHA prompt to trick users into running malicious commands. Instead of PowerShell, the attack uses cmdkey and regsvr32 to store credentials and execute a malicious DLL from a remote server. The DLL establishes persistence by creating a scheduled task whose configuration is retrieved from a remote XML file, allowing attackers to modify behavior without redeploying the initial DLL. This technique minimizes detectable indicators and relies on trusted Windows utilities to evade security tools. Security teams should monitor unusual cmd.exe activity, cmdkey usage, and regsvr32 loading DLLs from remote paths.

Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud

thehackernews.com · 3 months ago

There is a telecommunications fraud campaign that uses fake CAPTCHA verification to trick users into sending international text messages that incur charges on their mobile bills, generating illicit revenue for threat actors who lease the phone numbers. The operation has been active since at least June 2020 and employs social engineering, back button hijacking, cookie tracking, and multi stage verification that programmatically opens SMS apps with prefilled messages, causing victims to send as many as 60 messages to 15 numbers across 17 countries and incur charges that can total around thirty dollars per victim. Threat actors repurpose commercial traffic distribution systems, notably Keitaro tracker servers, to route and cloak campaigns, with more than 120 Keitaro linked campaigns observed between October 2025 and January 2026 and roughly ninety six percent of that traffic promoting cryptocurrency wallet drainer schemes via fake airdrops and giveaway lures. Operators register numbers in countries with high termination fees or lax regulation and collude with local telecom providers to monetize the scheme, and platform takedowns have prompted Keitaro to cancel over a dozen accounts linked to the activity.

Vidar Malware Conceals Payloads in JPEG, TXT Files to Evade Detection

gbhackers.com · 3 months ago

Vidar has evolved from an Arkei based credential stealer first observed in 2018 into a mature, multi stage, stealth focused infostealer that conceals second stage payloads inside files presented as JPEG and TXT to evade detection. Operators distribute Vidar through trojanized developer repositories, fake game cheats, compromised content management sites, and social engineering landing pages that trick users into running mshta, PowerShell, or nslookup to bootstrap the attack. The infection chain uses a Go compiled dropper that deploys a VBScript loader with embedded PowerShell to retrieve Base64 payloads served as image or text, decode and load them in memory as fileless.NET assemblies, abuse legitimate binaries for execution, and leverage Telegram and Cloudflare backed infrastructure for covert command and control and large scale credential and crypto asset theft.

Metabase Enterprise RCE Flaw Now Has Public Proof-of-Concept Exploit

gbhackers.com · 3 months ago

A critical Remote Code Execution vulnerability, tracked as CVE-2026-33725, has been discovered in Metabase Enterprise, allowing attackers to execute arbitrary code and access sensitive files. This flaw stems from a weakness in the handling of Enterprise Edition serialization imports, specifically an H2 JDBC INIT injection. A public proof-of-concept exploit script has been released on GitHub, increasing the risk to organizations using affected versions, including releases 1.47.0 through 1.59.3. Administrators are urged to immediately update to a secure version or restrict network access to the administration panel.

Fast16 Malware Targets High-Value Systems With Sabotage Capabilities

gbhackers.com · 3 months ago

A previously unknown cyber sabotage framework called fast16 has been discovered, with core components dating back to 2005, predating Stuxnet. The framework, which includes a kernel driver and a Lua-powered service binary, selectively targets high-precision calculation software to tamper with computational results, potentially impacting critical research and engineering applications. fast16 was found in the ShadowBrokers leak and may have targeted Iran’s nuclear program. The malware uses advanced techniques like an embedded Lua virtual machine and checks for security products before installation.

Suspicious Microsoft Store App Vibing.exe Allegedly Harvests Screens and Audio

gbhackers.com · 3 months ago

An application called Vibing.exe, originally distributed through the Microsoft Store as an AI productivity interface, was found to record users’ screens and audio and to exfiltrate those captures to a remote server. The program auto-starts at Windows login, hijacks the clipboard, takes periodic screenshots that are base64 encoded, activates the microphone for raw audio capture, tags data with a hardware GUID for persistent tracking, and uses WebSocket connections to send activity metadata such as window titles and hotwords. Security researcher Kevin Beaumont linked the executable to Microsoft after finding it digitally signed by Yaoyao Chang of Microsoft GenAI research labs in Beijing, and open-source analysis showed the data flowed into a Microsoft Azure tenant. Microsoft removed the app and disabled backend services on April 24, 2026, and defenders are advised to hunt for vibing.exe or Vibing Installer.exe on endpoints and to block or monitor outbound traffic to the app’s Azure endpoints.

Attackers Chain CODESYS Vulnerabilities to Backdoor Applications

gbhackers.com · 3 months ago

There are three vulnerabilities in the CODESYS Control runtime that, when chained, allow an authenticated low privilege actor to replace a legitimate industrial control application with a backdoored version and achieve administrative control over the device and its host. The identified CVEs are CVE-2025-41658 an incorrect default permission flaw enabling offline extraction of password hashes CVE-2025-41659 an incorrect permission assignment granting access to cryptographic materials and CVE-2025-41660 an incorrect resource transfer flaw that permits uploading and restoring tampered project files. The attack flow requires obtaining Service level credentials through weak defaults compromise of an engineer workstation or exploiting CVE-2025-41658 then extracting keys via CVE-2025-41659 injecting malicious code and recomputing the insecure CRC32 and restoring the tampered backup using CVE-2025-41660 so the backdoor runs with root privileges after a restart. CODESYS released patches in Control Runtime version 4.21.0.0 and Runtime Toolkit 3.5.22.0 has made code signing mandatory by default and operators are urged to apply updates enforce strict network segmentation and monitor operational technology traffic.

4 Wege aus der Security-Akronymhölle

www.csoonline.com · 3 months ago

false

A.I. Start-Ups From Canada and Germany Merge to Take On Silicon Valley

www.nytimes.com · 3 months ago

false

Thinking Outside The Box: New Attack Surfaces in Sandboxed AI Agents

www.lasso.security · 3 months ago

Security researchers have discovered vulnerabilities in sandboxed AI agent environments, demonstrating that agents can bypass security measures and exfiltrate sensitive data. These agents, such as those using NVIDIA's OpenShell, require external access for functionality, creating potential attack surfaces. Malicious actors can exploit authorized tools and policies, like GitHub integration, to steal credentials and manipulate the agent's instructions. The findings indicate that sandboxing alone is insufficient and a new security approach is needed.

After Correspondents Dinner Shooting, Rumors and Conspiracy Theories Swirl Online

www.nytimes.com · 3 months ago

NULL

Social Media Captures the Chaos and Mundane of Shooting at Correspondents’ Dinner

www.nytimes.com · 3 months ago

NULL

American utility firm Itron discloses breach of internal IT network

www.bleepingcomputer.com · 3 months ago

Itron, Inc., a utility technology company, recently experienced a cyberattack resulting in unauthorized access to some of its internal systems. The company responded by activating its cybersecurity response plan, notifying law enforcement, and engaging external advisors. While business operations were not materially disrupted, an investigation is ongoing to determine the full scope of the incident. No ransomware group has claimed responsibility for the breach.

A Year Later, Trump’s ‘Most Exclusive’ Memecoin Event Is a Lot Less Exclusive

www.nytimes.com · 3 months ago

NULL

Microsoft rolls out revamped Windows Insider Program

www.bleepingcomputer.com · 3 months ago

false

5 Tall Tasks for John Ternus, Apple’s Next C.E.O.

www.nytimes.com · 3 months ago

false

Attempting to evade an AI SOC with offensive agents

vulnetic.ai · 3 months ago

NULL

Threat actor uses Microsoft Teams to deploy new “Snow” malware

www.bleepingcomputer.com · 3 months ago

There is an active campaign by UNC6692 using email bombing and Microsoft Teams helpdesk impersonation to trick employees into installing a fake patch that drops AutoHotkey scripts and a malicious Chrome extension called SnowBelt which runs on a headless Edge instance and establishes persistence via scheduled tasks and a startup shortcut. SnowBelt serves as a relay for operator commands to a Python backdoor named SnowBasin through a tunneler called SnowGlaze, which creates WebSocket tunnels and can act as a SOCKS proxy to mask command and control traffic. SnowBasin runs a local HTTP server to execute CMD and PowerShell commands and supports remote shell access, file download and exfiltration, screenshot capture, basic file management, and self-termination. Post compromise activity included internal reconnaissance of SMB and RDP, LSASS memory dumping, pass the hash lateral movement to domain controllers, extraction of Active Directory and registry hives with FTK Imager, exfiltration using LimeWire, and published IoCs and YARA rules to aid detection.

Comprehensive ransomware guide: How attacks work, real cases (WannaCry, Colonial Pipeline, Kaseya), and actual protection strategies

examineip.com · 3 months ago

Ransomware attacks encrypt files and demand payment, typically in cryptocurrency, for their release. Infection commonly occurs through phishing emails, malicious links, and compromised websites. A multi-layered defense strategy is recommended, including regular backups, updated antivirus software, system updates, and cautious online behavior. Data recovery is not guaranteed by paying a ransom, and the best protection is through preventative measures like automated backups.

China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks

www.securityweek.com · 3 months ago

A China-linked advanced persistent threat, known as GopherWhisper, is utilizing legitimate services like Slack, Discord, and file.io for command and control and data exfiltration. The group, active since November 2023, has been observed employing multiple custom backdoors including LaxGopher, RatGopher, and SSLORDoor. Tools like CompactGopher and BoxOfFriends are also utilized to collect files and communicate through Microsoft Graph API. Security researchers have identified this as a new group due to distinct tactics, techniques, and procedures from known threat actors.

Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software

thehackernews.com · 3 months ago

Cybersecurity researchers have discovered a previously unknown malware framework called fast16, created around 2005. The malware, written primarily in Lua, targeted high-precision calculation software and included a kernel driver that has not been seen on systems with Windows 7 or later. Analysis links fast16 to data leaked by The Shadow Brokers, which included tools allegedly used by the Equation Group. Researchers believe it predates Stuxnet and suggests state-sponsored actors were developing cyber sabotage capabilities much earlier than previously thought.

Thousands of EV Car Leases Are Ending Soon, Giving Buyers a More Affordable Option

www.nytimes.com · 3 months ago

false

Large-scale security audit of 1,764 "vibe-coded" apps: 7% have wide-open Supabase DBs, 15% of Bolt apps ship hardcoded API keys, plus IDOR and zero-auth APIs

securityscanner.dev · 3 months ago

A recent security scan of applications on several platforms revealed concerning critical vulnerabilities. A significant portion of critical findings involved Supabase Relational Database Security being disabled, allowing public access to sensitive user data. API keys from providers like OpenAI and Stripe were also found embedded in client-side JavaScript bundles, impacting 15 percent of Bolt.host applications. Other vulnerabilities identified include insecure access controls, unauthenticated APIs, and private key material exposed in production environments.

CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline

thehackernews.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its list of known exploited vulnerabilities. These vulnerabilities affect SimpleHelp, Samsung MagicINFO 9 Server, and D-Link routers. Specifically, the vulnerabilities include a missing authorization flaw, path traversal issues, and a command injection vulnerability. Exploitation has been observed in ransomware campaigns and botnet deployments, with deadlines set for remediation or device discontinuation.

STIX Visualizer — Threat Intelligence Graph Explorer

cyber.netsecops.io · 3 months ago

false

I put Qwen3.5-9B inside Kali and let it target some Windows machines. Thoughts? Ideas? Opinions? Thanks!

thepatrickfisher.com · 3 months ago

Researchers have demonstrated a successful exploitation of a Windows 7 Ultimate system using the EternalBlue exploit and a locally run language model. The model was able to gain SYSTEM privileges, allowing for file uploads and remote code execution. This highlights the growing potential for language models to be used in security research and automated exploitation. The vulnerability is currently under investigation.

ADT confirms data breach after ShinyHunters leak threat

www.bleepingcomputer.com · 3 months ago

ADT has confirmed a data breach following a threat from the ShinyHunters extortion group. The company detected unauthorized access to customer data on April 20th and determined personal information, including names, phone numbers, addresses, and in some instances, dates of birth and the last four digits of Social Security numbers or Tax IDs, was stolen. ADT reports that no payment information or security systems were compromised. The attackers reportedly gained access through a voice phishing attack compromising an employee’s Okta single sign-on account and accessing a Salesforce instance.

Helping Romance Scam Victims Requires a Proactive, Empathic Approach

www.darkreading.com · 3 months ago

false

Friday Squid Blogging: How Squid Survived Extinction Events

www.schneier.com · 3 months ago

false

New Phishing Scam: Fake Invitations

www.nytimes.com · 3 months ago

There is a wave of phishing attacks that spoof invitation platforms such as Paperless Post, Evite and Punchbowl to deliver malicious links or attachments that steal credentials or install malware. These scams often arrive as seemingly legitimate invitations from known contacts and may contain PDFs, QR codes, or links that lead to credential harvesting pages or remote access trojans, enabling account takeover and further spread to contacts. Security teams and the platforms advise verifying sender addresses, avoiding unexpected links or attachments, confirming messages come from official domains, and enabling multifactor authentication.

Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

blog.netomize.ca · 3 months ago

NULL

White House pushed out new AI official after just four days on the job

www.washingtonpost.com · 3 months ago

false