Blahalla

Helping Romance Scam Victims Requires a Proactive, Empathic Approach

www.darkreading.com · 3 months ago

false

Friday Squid Blogging: How Squid Survived Extinction Events

www.schneier.com · 3 months ago

false

www.nytimes.com · 3 months ago

There is a wave of phishing attacks that spoof invitation platforms such as Paperless Post, Evite and Punchbowl to deliver malicious links or attachments that steal credentials or install malware. These scams often arrive as seemingly legitimate invitations from known contacts and may contain PDFs, QR codes, or links that lead to credential harvesting pages or remote access trojans, enabling account takeover and further spread to contacts. Security teams and the platforms advise verifying sender addresses, avoiding unexpected links or attachments, confirming messages come from official domains, and enabling multifactor authentication.

Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

blog.netomize.ca · 3 months ago

NULL

White House pushed out new AI official after just four days on the job

www.washingtonpost.com · 3 months ago

false

Firestarter malware survives Cisco firewall updates, security patches

www.bleepingcomputer.com · 3 months ago

U.S. and U.K. cybersecurity agencies are warning of a persistent backdoor called Firestarter affecting Cisco Firepower and Secure Firewall devices. The threat actor, known as UAT-4356, exploited vulnerabilities CVE-2025-20333 and CVE-2025-20362 to gain initial access. Firestarter maintains persistence by modifying system files and hooking into the LINA process, allowing continued access even after patching. Cisco recommends re-imaging devices and has provided indicators of compromise and YARA rules for detection.

TGR-STA-1030: New Activity in Central and South America

unit42.paloaltonetworks.com · 3 months ago

A threat group known as TGR-STA-1030 continues to be active, with increased activity observed since February. Their operations are currently concentrated in Central and South America. This group is using tactics, techniques, and procedures previously attributed to them. They pose an ongoing concern for security professionals.

New US House privacy bills raise hard questions about enterprise data collection

www.csoonline.com · 3 months ago

false

Windows Update gets new controls to reduce forced restarts

www.bleepingcomputer.com · 3 months ago

false

Google Commits to Invest Up to $40 Billion in Anthropic

www.nytimes.com · 3 months ago

false

Media player pivot: How I got back into my own server

addadi.github.io · 3 months ago

A home server administrator experienced a critical failure when a kernel update broke the ZFS storage layer, preventing SSH access. Unable to physically access the server, they utilized a Jellyfin plugin's REST API to remotely diagnose the issue and eventually regain root access. The root cause was a ZFS module incompatibility with the new kernel, resulting in a missing home directory and preventing SSH authentication. The administrator then used the plugin's endpoint to restore SSH access by creating a temporary.ssh directory and copying their public key.

Scattered Spider co-conspirator pleads guilty

www.csoonline.com · 3 months ago

A member of the cybercriminal group Scattered Spider has pleaded guilty to conspiring to hack into company computer systems and steal virtual currency. The group uses SMS phishing attacks, posing as suppliers, to trick employees into revealing information. Recently, they’ve adopted a new tactic, impersonating fellow employees to gain access through help desks. Authorities have made several arrests, but the group continues to be active and pose a threat to businesses.

New BlackFile extortion group linked to surge of vishing attacks

www.bleepingcomputer.com · 3 months ago

A new hacking group, BlackFile, is targeting retail and hospitality organizations with data theft and extortion attacks. They use vishing, or voice-based phishing, impersonating IT support staff to steal employee credentials and bypass multi-factor authentication. The group is linked to "The Com," a network associated with cybercrime and exploitation. BlackFile is also using stolen credentials to access Salesforce and SharePoint servers, exfiltrating data before demanding ransoms.

CISA last in line for access to Anthropic Mythos

www.csoonline.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, is currently awaiting access to Anthropic’s new AI model, Claude Mythos. Unauthorized users, including members of a Discord channel, have already gained access to the model. Anthropic has restricted access to Mythos through Project Glasswing, limiting it to government agencies, industry groups, and software providers. Other government agencies, such as the Department of Commerce and the National Security Agency, currently have access and are evaluating the tool.

Microsoft to roll out Entra passkeys on Windows in late April

www.bleepingcomputer.com · 3 months ago

false

What Are Prediction Markets, and Why Are They Causing Controversy?

www.nytimes.com · 3 months ago

NULL

Health Records of 500,000 UK Biobank Volunteers Listed Online in China

www.techrepublic.com · 3 months ago

Sensitive health data from 500,000 UK Biobank participants was discovered listed for sale on Alibaba, a Chinese e-commerce platform. The data includes details like age, gender, and biological measures, though names and phone numbers were not included. The UK government believes the data was obtained through legitimate channels and accuses Chinese research institutions of violating agreements by attempting to sell the information. The UK Biobank has suspended access to its research platform and is working with authorities to investigate the incident.

New ‘Pack2TheRoot’ flaw gives hackers root Linux access

www.bleepingcomputer.com · 3 months ago

A new vulnerability, identified as CVE-2026-41651, has been discovered in the PackageKit daemon, potentially allowing local users to gain root access on Linux systems. The flaw, which has existed for nearly twelve years, stems from a weakness in how the PackageKit handles package management requests. Researchers at Deutsche Telekom Red Team found that commands could be executed without authentication under certain conditions. Affected distributions include Ubuntu, Debian, RockyLinux, and Fedora, and users are urged to update to PackageKit version 1.3.5.

FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

thehackernews.com · 3 months ago

A federal agency's Cisco Firepower device was compromised in September 2025 by a backdoor malware called FIRESTARTER, which persists even after security patches are applied. The malware, linked to the threat actor UAT4365 and previously associated with the ArcaneDoor campaign, exploits vulnerabilities CVE-2025-20333 and CVE-2025-20362. FIRESTARTER utilizes a post-exploitation toolkit called LINE VIPER to gain elevated access and modify the device’s core engine, requiring a hard power cycle to fully remove. Authorities are recommending reimaging devices or performing a cold restart as mitigation steps.

Meta to Lay Off 10 Percent of Work Force in A.I. Push

www.nytimes.com · 3 months ago

false

US Busts Myanmar Ring Targeting US Citizens in Financial Fraud

www.darkreading.com · 3 months ago

US authorities have taken action against a criminal network operating scam compounds in Southeast Asia, targeting American citizens with financial fraud. "Operation Level Up" and the Scam Center Strike Force have intervened in nearly 9,000 cases, recovering an estimated $562 million. The US government sanctioned 29 individuals, including a Cambodian senator, seized infrastructure like a Telegram channel and website domains, and indicted two Chinese nationals managing a compound in Myanmar. Authorities say these operations often involve coerced labor and are linked to casinos and human trafficking, with the potential for relocation to countries like Sri Lanka.

Bitwarden CLI compromesso: attacco supply chain viola npm Trusted Publishing

deafnews.it · 3 months ago

A supply chain attack compromised the Bitwarden CLI version 2026.4.0, making it malicious and distributing it between 5:57 PM and 7:30 PM Eastern Time on April 22, 2026. The attack exploited a compromised GitHub Action within Bitwarden’s CI/CD pipeline and is linked to the Checkmarx campaign and potentially TeamPCP. The malware steals GitHub tokens, SSH keys, environment variables, and cloud secrets, exfiltrating them through private domains and GitHub commits, and includes a kill switch for systems localized in Russian. This marks the first documented compromise of a package using npm Trusted Publishing.

Backdoor FIRESTARTER: CISA aggiorna la direttiva dopo violazione federale

deafnews.it · 3 months ago

A U.S. government agency suffered a breach beginning in September 2025, exploiting vulnerabilities in Cisco firewalls. The Cybersecurity and Infrastructure Security Agency, or CISA, has updated Emergency Directive 25-03 and issued an advisory regarding the FIRESTARTER malware, which allowed persistent access even after security patches were applied. The attackers also used a second malware, Line Viper, to establish unauthorized VPN sessions and access credentials. CISA has added CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133 to its Known Exploited Vulnerabilities catalog. Federal agencies must now confirm malware controls and complete device inventories by specific deadlines.

UNC6692: nuova minaccia Teams colpisce decisori aziendali

deafnews.it · 3 months ago

A new threat cluster, UNC6692, is using email bombing and Microsoft Teams impersonation to distribute the SNOW malware suite. The attackers frequently target senior employees, likely to gain access to sensitive information. These tactics resemble those previously employed by the Black Basta ransomware group, indicating a persistence in effective methods. Security experts recommend strengthening identity verification, network segmentation, and monitoring network access to help mitigate these attacks.

App UE verifica età hackerata in 2 minuti: il gap tra promesse e realtà

deafnews.it · 3 months ago

A new European Union app intended to verify online age has been compromised quickly, revealing design weaknesses. The app, promoted as a privacy-respecting solution, uses a locally stored PIN that is easily bypassed. This incident underscores the challenge of balancing privacy regulations like GDPR with the necessity for robust age verification. Concerns have been raised by experts regarding the app's security and the future of EU-wide age verification.

Exploit su LMDeploy CVE-2026-33626: attacco SSRF immediato dopo disclosure

deafnews.it · 3 months ago

A Server-Side Request Forgery vulnerability, CVE-2026-33626, has been exploited in LMDeploy just twelve hours after public disclosure. Attackers, originating from Hong Kong, used the vulnerability in the loadimage() function to access internal networks and cloud metadata services. The vulnerability was addressed in version 0.12.3 with the addition of the issafeurl() function, which blocks requests to private IP ranges. Researchers noted that detailed advisory information, rather than a public proof-of-concept, was sufficient to create a working exploit.

DeepSeek’s Sequel Set to Extend China’s Reach in Open-Source A.I.

www.nytimes.com · 3 months ago

false

Glasswing Secured the Code. The Rest of Your Stack Is Still on You

www.darkreading.com · 3 months ago

A new AI model, Project Glasswing, has identified a 16-year-old vulnerability in FFmpeg that evaded five million automated scans, highlighting a critical flaw in current security practices. Existing security tools primarily rely on enumeration, identifying known patterns, rather than understanding the intent of code or configurations. This approach leaves organizations vulnerable to misconfigurations, leaked credentials, and overlooked assets, which are often the root cause of security incidents. The broader security stack needs to shift from enumeration to understanding to address vulnerabilities beyond code. CVE data was not mentioned.

Pre-Stuxnet Sabotage Malware ‘Fast16’ Linked to US-Iran Cyber Tensions

www.securityweek.com · 3 months ago

Security researchers have uncovered a previously unknown malware named Fast16, a Lua-based sabotage tool created before Stuxnet. This malware, referenced in the ShadowBrokers leak, was used in an attack in 2005 and likely developed by the United States. Fast16 targets Windows systems prior to Windows 7, tampering with high-precision calculation software used in fields like civil engineering and physics to introduce systematic errors and potentially cause damage. It employed weak passwords for network propagation and featured a wormable component to avoid detection.

In Other News: Unauthorized Mythos Access, Plankey CISA Nomination Ends, New Display Security Device

www.securityweek.com · 3 months ago

A Tennessee man received probation for unauthorized access to Supreme Court and other government systems, posting screenshots online. The UK deployed military assets to safeguard undersea communications cables amid concerns of Russian naval threats. A startup, Lovable, initially denied a data exposure vulnerability before admitting a backend change re-enabled access to project chats. Additionally, Iranian infrastructure experienced simultaneous equipment failures potentially due to firmware backdoors, and unauthorized users accessed Anthropic’s Claude Mythos through a third-party portal. A data breach at France Titres may have exposed millions of user records, while Sean Plankey has withdrawn his nomination for CISA director.

Cohere Terrarium (CVE-2026-5752) and OpenAI Codex CLI (CVE-2025-59532): a cross-CVE analysis of AI code sandbox escapes

blog.barrack.ai · 3 months ago

Recent failures in AI sandbox security at OpenAI and Cohere have revealed significant vulnerabilities. These issues occurred because sandboxes incorrectly treated model-controlled values as defining their boundaries, and in one case, relied on an inadequate tool like Pyodide. The response to a security advisory from CERT/CC was delayed, ultimately leading to the project’s archiving. Experts recommend stronger isolation methods such as gVisor, Firecracker, or Sysbox to address the evolving threat model.

NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software

thehackernews.com · 3 months ago

A Chinese national, Song Wu, is accused of orchestrating a multi-year phishing scheme targeting NASA employees and collaborators to obtain sensitive U.S. defense software. Posing as a U.S. researcher, Wu and his co-conspirators gained access to proprietary software and source code from NASA, the Air Force, the Navy, the Army, the Federal Aviation Administration, universities, and private companies. The scheme, which occurred between 2017 and 2021, violated U.S. export control laws and involved the Aviation Industry Corporation of China. Song Wu, who remains at large, faces charges including wire fraud and aggravated identity theft, and is on the FBI's Most Wanted List.

DORA and operational resilience: Credential management as a financial risk control

www.bleepingcomputer.com · 3 months ago

The Digital Operational Resilience Act, or DORA, requires financial institutions in the EU to strengthen credential management as a financial risk control. Stolen credentials are a major cause of data breaches, costing institutions millions and often going undetected for extended periods, sometimes over 186 days. DORA mandates controls like limiting access, using strong authentication such as FIDO2/WebAuthn, and implementing privileged access management. Institutions must also ensure vendors meet these standards, as a vendor's security gaps can expose customer data.

Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks

www.bleepingcomputer.com · 3 months ago

Over ten thousand Zimbra Collaboration Suite servers are currently vulnerable to attacks exploiting a cross-site scripting vulnerability. This flaw, identified as CVE-2025-48700, affects several Zimbra versions and allows attackers to access sensitive information without user interaction. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and has mandated Federal agencies to patch within three days. Attackers, including APT28 and APT29, have previously exploited Zimbra vulnerabilities in phishing campaigns and to steal email credentials.

AI Phishing Is No. 1 With a Bullet for Cyberattackers

www.darkreading.com · 3 months ago

Phishing attacks have surged to the top of cyberattack vectors, now accounting for over a third of initial compromises. Attackers are leveraging artificial intelligence to create highly convincing, personalized, and multilingual phishing emails, making detection significantly more difficult. This rise in AI-powered attacks is evident in increased click-through rates, a decrease in email variations per campaign, and a focus on compromising privileged user credentials. Security experts recommend that organizations implement AI-driven defenses to counter these evolving threats, while also recognizing that MFA alone is insufficient protection.

How Elon Musk Used SpaceX to Benefit Himself and His Businesses

www.nytimes.com · 3 months ago

false

Cisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerability

sec.cloudapps.cisco.com · 3 months ago

A vulnerability exists in the Cisco ACI Multi-Site CloudSec encryption feature on Cisco Nexus 9000 Series switches running ACI mode, potentially allowing an unauthorized attacker to read or modify encrypted traffic. This is due to an implementation flaw in the ciphers used by the feature, enabling attackers with an intermediary position to exploit it. Cisco has deprecated and removed the affected feature in recent releases and will not provide software updates to address the issue. Customers utilizing the feature are advised to disable it and explore alternative encryption methods for site-to-site connections.

North Korea's Lazarus Targets macOS Users via ClickFix

www.darkreading.com · 3 months ago

North Korean state-sponsored hackers, specifically the Lazarus Group, are employing a technique called ClickFix to compromise macOS devices. Attackers lure targets, often business leaders, with fake meeting invitations via platforms like Zoom or Microsoft Teams and instruct them to execute malicious commands or download files to resolve perceived connection issues. This allows the deployment of a new macOS malware kit, "macrasv2," which steals sensitive data such as credentials, browser data, and Keychain information before exfiltrating it via Telegram. Despite the sophisticated attack chain, the malware itself exhibits several operational security flaws and is considered poorly written.

ShinyHunters Claims Sale of Anthropic Claude Mythos AI Model Data and Internal Documents

breachnews.com · 3 months ago

The threat actor group ShinyHunters is claiming to sell internal data related to an experimental Anthropic AI model called Claude Mythos. The listing, priced between $300,000 and $500,000, reportedly includes approximately 3,000 documents, technical specifications, and claims of access to administrative systems. ShinyHunters also alleges the package contains a zero-day vulnerability and restricted model access, though these claims remain unverified and no proof of concept has been provided. Anthropic has not yet confirmed the breach.

Why Cybersecurity Must Rethink Defense in the Age of Autonomous Agents

www.securityweek.com · 3 months ago

false

Locked Shields 2026: 41 Nations Strengthen Cyber Resilience in World’s Biggest Exercise

www.securityweek.com · 3 months ago

false

Bridging the AI Agent Authority Gap: Continuous Observability as the Decision Engine

thehackernews.com · 3 months ago

false

26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases

thehackernews.com · 3 months ago

Cybersecurity researchers have identified 26 malicious applications, dubbed FakeWallet, distributed through the Apple App Store, primarily targeting users with accounts set to China. These apps impersonate popular cryptocurrency wallets like Bitpie, Coinbase, and MetaMask, redirecting users to fake App Store pages to install trojanized versions and steal recovery phrases and private keys. Attackers also discovered apps mimicking benign services, using provisioning profiles to install wallet apps, and the campaign may be linked to the SparkKitty trojan. Separately, a sophisticated Android malware framework called MiningDropper combines cryptocurrency mining with information theft and remote access, distributed through fake websites impersonating banking institutions.

Microsoft now lets admins uninstall Copilot on enterprise devices

www.bleepingcomputer.com · 3 months ago

false

Hackers Exploit Agent ID Administrator Role to Hijack Service Principals

gbhackers.com · 3 months ago

A scoping vulnerability was recently found in Microsoft Entra ID’s Agent Identity Platform. The Agent ID Administrator role, designed to manage AI agent identities, could be exploited to hijack any service principal within an organization’s tenant, allowing for privilege escalation. Attackers could assign unauthorized ownership, generate new credentials, and then authenticate as the hijacked service principal. Microsoft has since patched the vulnerability, preventing the Agent ID Administrator role from modifying non-agent service principals.

US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor

www.securityweek.com · 3 months ago

A widespread espionage campaign linked to China has infected Cisco firewalls, impacting at least one US federal agency. The campaign, known as ArcaneDoor, exploited vulnerabilities resulting in CVE-2025-20333 and CVE-2025-20362. A backdoor named Firestarter was deployed, allowing attackers remote access and control, and firmware updates alone do not remove it. Federal agencies are now required to perform checks, apply patches, and consider hard resets of affected devices by specific deadlines.

GPT-5.5 Bio Bug Bounty Program Aims to Improve AI Safety and Performance

gbhackers.com · 3 months ago

OpenAI has launched a new bug bounty program called GPT-5.5 Bio Bug Bounty to proactively address potential biological risks from advanced artificial intelligence models. The program focuses on identifying a “universal jailbreak,” a prompt that bypasses safety filters to elicit dangerous biological information. Researchers can earn up to $25,000 for successfully completing a five-question biosafety challenge using a single prompt. Applications are being accepted through June 22, 2026, with testing running until July 27, 2026, and require a strict non-disclosure agreement.

Trump Administration Vows Crackdown on Chinese Companies ‘Exploiting’ AI Models Made in US

www.securityweek.com · 3 months ago

The U.S. government is taking action to protect American artificial intelligence models from exploitation, particularly by Chinese entities. Officials allege that foreign companies are using techniques like “distillation” to extract capabilities from U.S. AI systems, narrowing the performance gap. A bipartisan bill in the House aims to identify and penalize those engaging in such practices, including potential sanctions. Several U.S. AI developers, including OpenAI and Anthropic, have accused Chinese companies like DeepSeek of improperly copying their models.

What Is Cloud Security? A 2026 Guide

www.techrepublic.com · 3 months ago

false

Claude Desktop Reportedly Adds Browser Access Bridge for Chromium Browsers

gbhackers.com · 3 months ago

A recent cybersecurity report details a significant privacy and security risk associated with Anthropic's Claude Desktop application for macOS. The application silently installs a Native Messaging bridge across seven Chromium-based browsers, including Google Chrome, Brave, and Microsoft Edge, without user consent. This bridge allows for powerful browser automation capabilities, such as accessing sensitive website data and recording screens, and runs outside the browser sandbox with full user privileges. Experts recommend Anthropic implement an opt-in model for browser integrations to mitigate the potential for malicious exploitation.