Blahalla

US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor

www.securityweek.com · 3 months ago

A widespread espionage campaign linked to China has infected Cisco firewalls, impacting at least one US federal agency. The campaign, known as ArcaneDoor, exploited vulnerabilities resulting in CVE-2025-20333 and CVE-2025-20362. A backdoor named Firestarter was deployed, allowing attackers remote access and control, and firmware updates alone do not remove it. Federal agencies are now required to perform checks, apply patches, and consider hard resets of affected devices by specific deadlines.

GPT-5.5 Bio Bug Bounty Program Aims to Improve AI Safety and Performance

gbhackers.com · 3 months ago

OpenAI has launched a new bug bounty program called GPT-5.5 Bio Bug Bounty to proactively address potential biological risks from advanced artificial intelligence models. The program focuses on identifying a “universal jailbreak,” a prompt that bypasses safety filters to elicit dangerous biological information. Researchers can earn up to $25,000 for successfully completing a five-question biosafety challenge using a single prompt. Applications are being accepted through June 22, 2026, with testing running until July 27, 2026, and require a strict non-disclosure agreement.

Trump Administration Vows Crackdown on Chinese Companies ‘Exploiting’ AI Models Made in US

www.securityweek.com · 3 months ago

The U.S. government is taking action to protect American artificial intelligence models from exploitation, particularly by Chinese entities. Officials allege that foreign companies are using techniques like “distillation” to extract capabilities from U.S. AI systems, narrowing the performance gap. A bipartisan bill in the House aims to identify and penalize those engaging in such practices, including potential sanctions. Several U.S. AI developers, including OpenAI and Anthropic, have accused Chinese companies like DeepSeek of improperly copying their models.

What Is Cloud Security? A 2026 Guide

www.techrepublic.com · 3 months ago

false

Claude Desktop Reportedly Adds Browser Access Bridge for Chromium Browsers

gbhackers.com · 3 months ago

A recent cybersecurity report details a significant privacy and security risk associated with Anthropic's Claude Desktop application for macOS. The application silently installs a Native Messaging bridge across seven Chromium-based browsers, including Google Chrome, Brave, and Microsoft Edge, without user consent. This bridge allows for powerful browser automation capabilities, such as accessing sensitive website data and recording screens, and runs outside the browser sandbox with full user privileges. Experts recommend Anthropic implement an opt-in model for browser integrations to mitigate the potential for malicious exploitation.

Hiding Bluetooth Trackers in Mail

www.schneier.com · 3 months ago

A Dutch journalist successfully tracked a naval ship by concealing a Bluetooth tracker inside a postcard. The device allowed observation of the vessel’s movements as it sailed through the Mediterranean Sea, potentially revealing sensitive information about a carrier strike group. Navy officials located and disabled the tracker within a day during mail sorting. As a result, Dutch authorities have prohibited electronic greeting cards from being delivered to naval vessels.

Fake CAPTCHA Scam Triggers Costly SMS Fraud

gbhackers.com · 3 months ago

Hackers are exploiting fake CAPTCHA pages to commit SMS fraud and generate revenue through international revenue share fraud, or IRSF. Victims are tricked into repeatedly sending SMS messages to multiple international numbers, often unknowingly, resulting in unexpected charges of around 30 USD per session. This artificially inflated traffic, or AIT, is now the most financially damaging form of messaging fraud worldwide, impacting telecom carriers with both payouts and potential refunds. The scam utilizes traffic distribution systems and JavaScript to manipulate users and obscure the operation, making detection and disruption difficult.

Hackers Exploit Cisco Firepower N-Day Flaws for Unauthorized Access

gbhackers.com · 3 months ago

A state-sponsored threat actor known as UAT-4356 is exploiting vulnerabilities in Cisco Firepower devices to gain unauthorized access and deploy a custom backdoor called FIRESTARTER. The group is using previously patched but unmitigated flaws, specifically CVE-2025-20333 and CVE-2025-20362m. FIRESTARTER injects malicious code into the LINA process, enabling remote code execution and uses a configuration file to maintain persistence through reboots. Organizations are advised to apply software updates and check for suspicious files and processes on affected devices.

Hackers Exploit Pastebin PowerShell Script to Hijack Telegram Sessions

gbhackers.com · 3 months ago

Security researchers have uncovered a new Telegram session stealer disguised as a Windows telemetry update script hosted on Pastebin. The PowerShell script targets Telegram Desktop's data, specifically MTProto authorization keys, to hijack user sessions without passwords or SMS codes. The script utilizes a Telegram Bot API to exfiltrate stolen data and is linked to a separate web-based Telegram stealer, suggesting both are in a testing phase with limited activity and a controlled environment. Investigators observed clear-text bot tokens and chat IDs, along with a private LAN server, indicating the tools are not yet widely deployed.

Vulnerabilities Patched in CrowdStrike, Tenable Products

www.securityweek.com · 3 months ago

Security researchers have addressed serious vulnerabilities in products from CrowdStrike and Tenable. CrowdStrike resolved CVE-2026-40050, a critical path traversal flaw in its LogScale product, which could allow unauthorized file access. Tenable patched CVE-2026-33694, a high-severity vulnerability in its Nessus vulnerability scanner that could lead to file deletion and code execution. CrowdStrike reports no evidence of exploitation, and both companies have advised customers to update to the patched versions.

What Really Happened In There? A Tamper-Evident Audit Trail for AI Agents

nono.sh · 3 months ago

Researchers have developed a system called nono to create tamper-proof audit trails for artificial intelligence agents. The system uses separation of duties, Merkle trees, and hash chaining to secure the recording of agent actions and executable binaries. Nono also calculates filesystem roots and uses cryptographic signing for session integrity verification. This system strengthens agent accountability by providing cryptographic proof of actions and reducing reliance on the agent's reporting.

Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2

thehackernews.com · 3 months ago

A hacking group known as Tropic Trooper is targeting Chinese-speaking individuals, and those in South Korea and Japan, in a new campaign. The attackers are using a modified version of SumatraPDF to deploy the AdaptixC2 Beacon agent, leveraging GitHub as a command-and-control platform. The threat actors also use Microsoft Visual Studio Code tunnels to gain remote access to compromised systems and have previously used Cobalt Strike Beacon and a backdoor called EntryShell. The staging server involved has hosted Cobalt Strike Beacon and EntryShell.

Xiongmai IP Camera Flaw Lets Attackers Bypass Authentication

gbhackers.com · 3 months ago

A critical security vulnerability has been found in Hangzhou Xiongmai Technology’s XM530 IP cameras, potentially impacting commercial facilities worldwide. The flaw, identified as CVE-2025-65856, allows attackers to bypass authentication and access sensitive information. A proof-of-concept exploit is publicly available, increasing the risk of attacks. Network administrators are advised to isolate vulnerable devices behind firewalls and restrict remote access to prevent unauthorized access.

Void Dokkaebi Hackers Spread Malware Through Fake Job Interviews

gbhackers.com · 3 months ago

Cybercriminals known as Void Dokkaebi are using fake job interviews to distribute malware to developers. Attackers compromise developers through malicious Visual Studio Code configurations and direct code injection, then use infected developers to spread malware through shared code repositories, creating a worm-like effect. Researchers have identified over 750 infected repositories, 500 malicious VS Code configurations, and 101 repositories with commit tampering tools, impacting organizations like DataStax and Neutralinojs. The malware, including a DEVPOPPER variant, is delivered via blockchain networks, making takedowns difficult.

A secretive AI hacking system has sparked a global scramble

www.washingtonpost.com · 3 months ago

Security researchers at Mozilla discovered a new artificial intelligence model called Mythos by Anthropic significantly improves AI's capabilities in software security. The AI system, used to review Firefox code, has been described as elevating AI to the level of a world-class security engineer. Mozilla's chief technology officer called the experience "vertigo" due to the tool's advanced performance. The system represents a notable advancement in the application of AI to software development and security.

Sam Altman’s Next High-Wire Act: Getting OpenAI to Make More Money

www.nytimes.com · 3 months ago

false

How Elon Musk Used SpaceX to Benefit Himself and His Businesses

www.nytimes.com · 3 months ago

false

Elon Musk’s near-daily online posts about race are turning off some fans

www.washingtonpost.com · 3 months ago

Elon Musk, the world’s wealthiest individual, has significantly increased his online discussions concerning race and Whiteness. Recent posts indicate a focus on rallying White people. Over the past few months, he has posted about this topic approximately three times more often than in the previous two years. A record-setting initial public offering could soon make Musk a trillionaire.

Bitwarden NPM Package Hit in Supply Chain Attack

www.securityweek.com · 3 months ago

A supply chain attack compromised the Bitwarden command-line interface NPM package, version 2026.4.0, inserting malicious code designed to steal credentials and secrets. The malware targets secrets and tokens across various platforms like Azure, AWS, GitHub, and GCP, and attempts to exfiltrate data via HTTPS or GitHub. This attack appears linked to a recent compromise of Checkmarx and may be connected to the Shai-Hulud worm campaign, with possible involvement of the hacking group TeamPCP. Bitwarden confirmed the incident, stating that end-user vault data was not accessed.

Copperhelm Raises $7 Million for Agentic Cloud Security Platform

www.securityweek.com · 3 months ago

false

LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure

thehackernews.com · 3 months ago

A critical Server-Side Request Forgery vulnerability, CVE-2026-33626, has been identified in the LMDeploy toolkit, and exploitation attempts were detected within 13 hours of public disclosure. The vulnerability allows attackers to access sensitive data, potentially including cloud credentials and internal resources. Attackers have been observed using the vulnerability to port scan internal networks and exfiltrate data. Researchers have noted a trend of rapid exploitation of newly disclosed AI infrastructure vulnerabilities, often with no publicly available proof-of-concept.

Python Vulnerability Enables Out-of-Bounds Write on Windows

gbhackers.com · 3 months ago

A high-severity security vulnerability, CVE-2026-3298, has been identified in Python’s asyncio module on Windows. This flaw allows for out-of-bounds writes due to a missing boundary check within the sockrecvfrominto() method, potentially leading to memory corruption or code execution. The vulnerability impacts Windows systems using asyncio for networking, particularly those utilizing UDP sockets or receiving variable-length data. A patch has been submitted to address the issue and users are advised to update their Python installations and avoid using the vulnerable function in untrusted environments.

Hackers Exploit Ollama Model Uploads to Leak Server Data

gbhackers.com · 3 months ago

A critical vulnerability has been identified in the Ollama platform, tracked as CVE-2026-5757. This flaw in the model quantization engine allows attackers to steal sensitive server data by uploading a malicious AI model file. The exploit leverages issues with file metadata validation, unsafe memory operations, and the unintentional writing of leaked memory to a new model layer. Organizations are advised to restrict model uploads, isolate deployments, and only use trusted sources to mitigate the risk.

China-Linked Hackers Hide Behind Compromised Routers

gbhackers.com · 3 months ago

China-linked hackers are increasingly using compromised routers and other edge devices to build covert networks for cyber operations. These networks allow for stealthy reconnaissance, malware delivery, and data exfiltration, making detection difficult due to constantly changing infrastructure. Security experts recommend baselining network traffic, implementing multi-factor authentication, and adopting zero trust architectures to mitigate the risk. Organizations worldwide, particularly in the UK, should strengthen defenses against these evolving threats.

Hackers Track 900+ React2Shell Exploits via Telegram Bots

gbhackers.com · 3 months ago

Hackers have exploited the React2Shell vulnerability (CVE-2025-55182) to compromise over 900 organizations. A sophisticated operation utilized Telegram bots and AI tools, including Claude Code and OpenClaw, to scan for and exploit vulnerable systems. Stolen credentials targeted a wide range of services, including AI providers, cloud platforms, and financial institutions, and were archived using Filebase S3 buckets. The attackers also leveraged a Telegram bot to manage and prioritize exploitation targets, with one operator identified as @BonJoviGoesHard.

Hackers Exploit SS7 and Diameter Flaws to Track Mobile Users Globally

gbhackers.com · 3 months ago

Researchers have uncovered global surveillance campaigns exploiting vulnerabilities in mobile networks’ SS7 and Diameter protocols. These campaigns, conducted by suspected commercial surveillance vendors, allow for covert tracking of individuals by manipulating signaling requests to reveal device locations. Attackers often impersonate legitimate operators, blending malicious queries with normal roaming data to evade detection. Securing only one protocol is insufficient; telecom carriers need comprehensive, unified signaling firewalls to effectively block these unauthorized tracking attempts.

The Top 8 Enterprise VPN Solutions

www.techrepublic.com · 3 months ago

false

Ransomware Gang Unveils Custom Data-Theft Tool

gbhackers.com · 3 months ago

Ransomware affiliates linked to the Trigona Ransomware-as-a-Service platform are now using a custom-built data exfiltration tool to steal sensitive information. This tool, uploaderclient.exe, utilizes parallel data transfer, connection rotation, selective data targeting, and built-in authentication to enhance speed, efficiency, and evasion. Attackers also disabled security defenses using tools like HRSword, PCHunter, and PowerRun before exfiltration, and gained access with AnyDesk and Mimikatz. The use of custom tools suggests a growing trend toward tailored malware and highlights the need for behavior-based detection.

Hackers Impersonate IT Helpdesk Staff to Breach Firms via Microsoft Teams

gbhackers.com · 3 months ago

A cyber threat group, UNC6692, is targeting companies using a sophisticated attack involving Microsoft Teams and custom malware. Hackers impersonate IT support to trick employees into downloading malware disguised as a “Mailbox Repair Utility,” stealing credentials and establishing a persistent backdoor. The “SNOW” malware ecosystem, including SNOWBELT, SNOWGLAZE, and SNOWBASIN, facilitates remote control, data extraction, and network scanning. Attackers then steal administrative password hashes and exfiltrate Active Directory data using legitimate services like Amazon Web Services and LimeWire.

Bitwarden CLI Compromised After Malicious GitHub Actions Workflow

gbhackers.com · 3 months ago

Cybersecurity researchers discovered a supply chain compromise affecting the Bitwarden CLI, specifically the @bitwarden/cli version 2026.4.0. Attackers injected malicious code into the npm package through a compromised GitHub Action as part of a broader Checkmarx campaign. The malware harvests credentials, including GitHub tokens and cloud platform credentials, and exfiltrates data to public GitHub repositories with Dune-themed names. Developers are advised to remove the affected package, rotate credentials, and audit systems for unauthorized activity.

Security-KPIs und -KRIs: So messen Sie Cybersicherheit

www.csoonline.com · 3 months ago

Cybersicherheit zu messen, ist kein Kinderspiel. Foto: Ultraskrip, shutterstock.com Eine wichtige Säule jedes ausgereiften Cyberrisk-Programms ist die Fähigkeit, die Performance der IT-Security und registrierte Bedrohungen zu messen, zu analysieren und zu melden. Die Cybersecurity zu messen, ist allerdings kein leichtes Unterfangen: Einerseits, weil sich viele Führungskräfte ohne entsprechenden Background schwer tun, IT-Risiken zu verstehen. Andererseits verstricken sich Sicherheitsprofis auch zu oft in technische Details, die die Stakeholder verwirren und auf den falschen Weg führen. Das ideale Szenario: Security-Experten messen und reporten die Cybersicherheit auf eine Art und Weise, die für Führungskräfte leicht verständlich und nützlich ist, was zu umsetzbaren Ergebnissen führt. Klingt gut? Dieser Artikel vermittelt Ihnen, wie Sie das anstellen. Messkategorien der IT-Sicherheit Die meisten Stakeholder beschäftigen Fragen zu Risiken, Compliance oder Sicherheit. Diese lassen sich jedoch in der Regel nicht mit einem einzigen Datenpunkt beantworten. Doch es gibt eine Reihe von Dingen, die Security-Profis messen können, um auf die Fragen und Bedenken der Stakeholder einzugehen. Diese lassen sich (grob) in folgende Kategorien einordnen: Kontrollen: Maßnahmen, die ergriffen werden, um Bedrohungen abzuwehren und Risiken zu reduzieren. Assets: Jeder Gegenstand, der für die Organisation einen Wert besitzt, beziehungsweise sich in ihrem Besitz befindet. Vulnerabilities: Schwachstellen in einem System, die ausgenutzt werden können. Threat Events: Von einer Bedrohung ausgelöste Ereignisse, die Assets potenziell Schaden zufügen können. Sicherheitsvorfälle: Ereignisse, die “erfolgreich” Wirkung auf das Unternehmen entfaltet haben, etwa in Form von (System-)Ausfällen, Datenschutzverletzungen oder Cyberangriffen. Diese Kategorien lassen sich weiter nach verschiedenen Faktoren aufschlüsseln: Zahlen, Zeit oder Kosten. Zahlen könnten beispielsweise in Form des Prozentsatzes der ungepatchten Server gemessen werden. Eine weitere Möglichkeit: Sie messen die Zeit, die benötigt wurde, um einen Sicherheitsvorfall zu identifizieren. Schließlich könnten Kosten, zum Beispiel in Form von Wiederherstellungs- oder Ausfallkosten, Aufschluss über die finanziellen Auswirkungen von Security-Ereignissen geben. Cybersicherheits-Metriken, -KPIs und -KRIs Wenn Security-Profis oder -Entscheider an Business Teams berichten, sollten sie dazu möglichst relevante Messerwerte wählen. Dabei konzentrieren sich die meisten Sicherheitsteams auf Metriken, die Low-Level-Messungen bezüglich Assets, Schwachstellen und Threat Events abbilden. Auf Führungs- und Vorstandsebene sind hingegen vor allem KPIs (Key Performance Indicators) und KRIs (Key Risk Indicators) entscheidend, weil diese dazu beitragen können, spezifische Fragen in Bezug auf IT-Risiko, -Status und -Vorbereitung zu beantworten. Beispielsweise: Sind wir sicher? Liefern die Sicherheitsinvestitionen dem Unternehmen Mehrwert? Erfüllen wir aus Sicherheitsperspektive alle regulatorischen Anforderungen? Wie gut sind wir auf Ransomware- oder Supply-Chain-Angriffe vorbereitet? Deshalb sollten sich Security-Praktiker auch auf KPIs und KRIs konzentrieren. Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox. Jetzt CSO-Newsletter sichern Cybersecurity messen in 5 Schritten Der Aufbau des richtigen Messrahmens ist ein schrittweiser, iterativer Prozess. Im Folgenden die fünf wichtigsten Schritte, um einen Security Measurement Cycle aufzubauen. 1. Anforderungen definieren Sprechen Sie mit relevanten Stakeholdern, um deren Bedürfnisse zu definieren und zu verstehen. Diese haben zu diesem Zeitpunkt möglicherweise noch kein umfassendes Verständnis über IT-Risiken, oder ihre eigenen Anforderungen. Deshalb ist für Security-Praktiker ein Bottom-Up-Ansatz empfehlenswert, bei dem sie selbst die Initiative ergreifen und Fragen zu stellen, um die Anforderungen definieren zu können. 2. Key Indicators auswählen Sobald die Anforderungen der Stakeholder definiert sind, sollten Sicherheitsexperten diejenigen Key Indicators auswählen, die auf diese einzahlen. Dabei sollten die Stakeholder konsultiert und über die beabsichtigten, späteren Messungen informiert werden. Wenn die Stakeholder die Key Indicators kennen, können sie Maßnahmen ergreifen oder Entscheidungen treffen. Die Schlüsselindikatoren sollten auf hoher Ebene angesiedelt sein, und ihre Anzahl überschaubar bleiben. Das Ziel besteht schließlich darin, die Entscheidungsfindung zu erleichtern. 3. Metriken identifizieren Nachdem Ziele und Key Indicators festgelegt sind, gilt es für die Sicherheitsteams, die Low-Level-Messgrößen zu fokussieren, die dabei unterstützen, die Indikatoren zu reporten. Das kann, je nach Art des Indikators, bedeuten, dass Dutzende von Metriken aus den verschiedenen oben beschriebenen Messkategorien erforderlich sind. 4. Metriken sammeln und analysieren Da die Anforderungen nun feststehen, die Schlüsselindikatoren ausgewählt und die Messgrößen festgelegt sind, können die Praktiker nun damit beginnen, Daten auf dieser Grundlage zu sammeln und zu analysieren. Metriken dürfen dabei nur aus Daten abgeleitet werden, die akkurat, aktuell, relevant und vertrauenswürdig sind. Anderenfalls kann es zu Entscheidungen kommen, die schwerwiegende Folgen für die Sicherheitslage des Unternehmens nach sich ziehen. Es ist die Aufgabe der Security-Teams, Wege zu finden, Daten kontinuierlich zu sammeln (die meisten Messungen erfordern einen Überblick über Trends im Zeitverlauf) und den Prozess vorzugsweise so weit wie möglich zu automatisieren (ein manueller Prozess kann ermüdend und zeitaufwändig sein). 5. Key Indicators reporten Key Indicators müssen zeitnah an die Entscheidungsträger reported werden. Dabei sollten sich Security-Profis und Stakeholder auf einen zeitlichen Rhythmus einigen, ebenso wie über die Art der Berichterstattung: Sind Dashboards erforderlich oder reichen Powerpoint-Präsentationen aus? Die Schlüsselindikatoren sollten deutlich sichtbar und leicht verständlich sein, um zu Entscheidungen oder Maßnahmen zu führen. Darüber hinaus ist es wichtig, nach jedem Berichtszyklus die Key Indicators zu überprüfen und sie (unter Einbeziehung der Stakeholder) neu zu bewerten. Haben sich die geschäftlichen Anforderungen tatsächlich geändert, müssen die Anforderungen erneut definiert und ein anderer Satz von Indikatoren und Messgrößen erarbeitet werden. Unternehmen, Stakeholder und Sicherheitsexperten sollten keine Angst vor Rückwärts- oder Vorwärtsschritten haben: Die Fähigkeit, nach einem schnellen Fail direkt weiterzumachen, zu improvisieren oder sich neu auszurichten sind entscheidende Fähigkeiten, wenn es darum geht, Cybersicherheit erfolgreich zu messen. (fm) Dieser Beitrag basiert auf einem Artikel unserer US-Schwesterpublikation CSO Online.

How a simple consumer data breach spiralled into a national security crisis in US-South Korea relations

www.theguardian.com · 3 months ago

A data breach at the South Korean online retailer Coupang, which has significant operations and listings in the United States, has escalated into a diplomatic dispute between the US and South Korea. Following the breach affecting millions of users, South Korean authorities launched investigations and summoned Coupang’s Korean-American CEO, Bom Kim, for questioning. The US has reportedly linked the issue to high-level diplomatic consultations and support for South Korea’s nuclear submarine development, and US lawmakers have accused Seoul of discriminatory actions. Several US investment firms have initiated arbitration against South Korea, claiming a disproportionate response to the data breach.

Fixing the Exploit Didn’t Fix the System: An Exploration of Trust Boundaries

fermiparadox.substack.com · 3 months ago

A small IT team, facing pressure to do more with limited resources, created an internal tool, "DevOps Helper," to streamline server management. The tool, built with assistance from an LLM, lacked security considerations, prioritizing convenience over secure coding practices. A critical SQL injection vulnerability allows unauthorized access to the entire database, exposing sensitive information like API keys and infrastructure details. Attackers can easily enumerate database tables and potentially execute code on the host, highlighting the dangers of "shadow systems" and insecure-by-design tools.

Why Pure-LLM CTFs Don't Work: A Hybrid Architecture for AI Security Challenges

wraith.sh · 3 months ago

false

Tropic Trooper APT Takes Aim at Home Routers, Japanese Targets

www.darkreading.com · 3 months ago

The China-linked advanced persistent threat, Tropic Trooper, is expanding its targeting beyond Taiwan, the Philippines, and Hong Kong to include Japan, South Korea, and other new geographies. Researchers have observed the group compromising home Wi-Fi routers to deliver malware and modify software updates through DNS hijacking. The group is rapidly adopting open-source tools and malware, including DaveShell, Donut loader, Merlin Agent, Apollo Agent, C6DOOR, and variants of Xiangoop, alongside familiar tools like Cobalt Strike. Recent investigations revealed new phishing pages mimicking Signal and other apps, demonstrating a growing sophistication and wider operational scope.

Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia

www.darkreading.com · 3 months ago

A newly identified Chinese advanced persistent threat called GopherWhisper has been targeting Mongolian government networks, with ESET finding 12 backdoored systems in one institution and evidence suggesting dozens more victims. ESET researchers discovered multiple custom backdoors beginning with LaxGopher and its injector JabGopher on January 2, 2025, and later identified CompactGopher, RatGopher, BoxOfFriends with its loader FriendDelivery, and SSLORDoor, each designed to provide different command and control options. The tools abused mainstream cloud services for command and control and data theft, using Slack for LaxGopher, Discord for RatGopher, Microsoft Outlook email drafts for BoxOfFriends, and the public file sharing service file.io for CompactGopher, and researchers say the group does not appear highly sophisticated and may be new to malware development.

Bitwarden CLI password manager trojanized in supply chain attack

www.csoonline.com · 3 months ago

Attackers have compromised the npm registry, publishing a trojanized version of the Bitwarden CLI password manager, specifically version 2026.4.0. The malicious code harvests a wide range of developer and cloud credentials, including GitHub tokens, AWS keys, and more, attempting to escalate access through GitHub Actions. Bitwarden reports no access to user vault data or production systems, and the compromised version was quickly removed. Users who installed the malicious version are urged to immediately rotate credentials and implement security best practices to prevent further compromise.

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ...

socket.dev · 3 months ago

The Bitwarden CLI has been compromised as part of an ongoing supply chain campaign linked to Checkmarx. The malicious code, found in the @bitwarden/cli2026.4.0 package’s bw1.js file, leveraged a compromised GitHub Action within Bitwarden’s CI/CD pipeline. This payload shares infrastructure with the Checkmarx mcpAddon.js malware, but includes unique branding and ideological messaging, suggesting a potential splinter group or evolving campaign. Organizations should remove the affected package, rotate exposed credentials, and review GitHub and cloud environments for unauthorized access and activity.

Intel’s Revenues Soar, Aided by A.I. Boom

www.nytimes.com · 3 months ago

false

UK Biobank Health Data of 500K Listed for Sale in China

www.verity.news · 3 months ago

Sensitive health data from approximately 500,000 individuals in the UK Biobank has reportedly been offered for sale in China. This data includes genetic information and detailed health records. The listing suggests potential privacy risks and unauthorized access to personal information. The incident highlights concerns about data security and the potential misuse of valuable health data.

Hackers exploit file upload bug in Breeze Cache WordPress plugin

www.bleepingcomputer.com · 3 months ago

Hackers are exploiting a critical vulnerability in the Breeze Cache WordPress plugin, tracked as CVE-2026-3844, to upload files and potentially take control of websites. The vulnerability, discovered by Hung Nguyen, stems from a lack of file-type validation and affects versions up to 2.4.4. Cloudways released version 2.4.5 to fix the issue, and users are strongly advised to upgrade or disable the “Host Files Locally - Gravatars” add-on to mitigate the risk. The plugin has over 400,000 active installations, and exploitation attempts have already been observed.

China-Backed Hackers Are Industrializing Botnets

www.darkreading.com · 3 months ago

Cybersecurity agencies are warning of China-nexus threat actors increasingly using covert botnets comprised primarily of compromised SOHO routers and other IoT devices to conduct attacks. These botnets are being used for reconnaissance, malware delivery, data exfiltration, and even deniable internet browsing, making attribution difficult. The advisory highlights a shift toward industrialization of botnets, with specialized teams compromising and maintaining these networks, often leased to other groups. Experts recommend organizations map network edge devices, baseline normal connections, and implement zero-trust policies to mitigate the risk.

Frontier AI and the Future of Defense: Your Top Questions Answered

unit42.paloaltonetworks.com · 3 months ago

false

3 practical ways AI threat detection improves enterprise cyber resilience

www.csoonline.com · 3 months ago

false

The curious case of Sean Plankey’s derailed CISA nomination

www.csoonline.com · 3 months ago

Sean Plankey has withdrawn his nomination for CISA director after thirteen months of delays and mounting resistance in the Senate. His nomination stalled due to concerns raised by Senators Rick Scott and Ron Wyden, alongside allegations regarding his financial ties to a government contracting firm, which the firm's CEO denies. Experts warn that the lack of confirmed leadership at CISA weakens US cybersecurity, especially during heightened tensions like the ongoing conflict with Iran. The situation highlights a broader problem of instability and underfunding within the agency.

Bitwarden CLI npm package compromised to steal developer credentials

www.bleepingcomputer.com · 3 months ago

The Bitwarden CLI npm package was briefly compromised when a malicious @bitwarden/cli release version 2026.4.0 was published and available between 5:57 PM and 7:30 PM Eastern Time on April 22, 2026, and Bitwarden says the issue was limited to their npm distribution with no evidence of end user vault or production system compromise. Investigators say threat actors likely used a compromised GitHub Action in Bitwarden's CI CD pipeline to inject a loader named bwsetup.js that downloaded the Bun runtime and launched an obfuscated payload bw1.js. The payload collected npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials for AWS Azure and Google Cloud, encrypted the data using AES 256 GCM, and exfiltrated it by creating public GitHub repositories that contained the string Shai Hulud The Third Coming. The malware could self propagate by using stolen npm credentials to inject other packages, shared indicators with a recent Checkmarx supply chain incident including the same telemetry endpoint and obfuscation routine, and security firms advise treating systems that installed the affected version as compromised and rotating CI CD and cloud credentials.

OpenAI Unveils Its New, More Powerful GPT-5.5 Model

www.nytimes.com · 3 months ago

false

Trigona ransomware attacks use custom exfiltration tool to steal data

www.bleepingcomputer.com · 3 months ago

There are Trigona ransomware attacks using a custom command line exfiltration tool named uploaderclient.exe that connects to a hardcoded server and was employed in March 2026 attacks by a gang affiliate to avoid detection by public tools. The utility supports five simultaneous connections per file to speed uploads, rotates TCP connections after two gigabytes of traffic to evade monitoring, can selectively exclude large low value media files, and uses an authentication key to restrict access to stolen data. Attack chains install the Huorong HRSword kernel driver, deploy utilities to disable security products, run tools with elevated privileges via PowerRun, use AnyDesk for remote access, and execute Mimikatz and Nirsoft utilities for credential theft. Trigona launched in October 2022 as a double extortion operation demanding Monero, was disrupted by Ukrainian cyber activists in October 2023, and has indicators of compromise published by Symantec to aid detection.

Elon Musk and Sam Altman’s Epic Fight Heads to Court

www.nytimes.com · 3 months ago

A jury trial in federal court in Oakland, California is scheduled to begin with jury selection on April 27, 2026, and is expected to run for about four weeks. Elon Musk alleges that OpenAI and its leaders, including Sam Altman, betrayed the nonprofit’s founding mission by converting the organization into a for profit structure and is seeking tens of billions to more than one hundred billion dollars in damages as restitution for alleged ill gotten gains. OpenAI has described the damages demand as unserious, and the case will turn on whether early contributions were charitable gifts rather than investments that would have entitled Musk to a share of the company’s later value.

CVE-2026-34621: Adobe Acrobat Reader zero-day was on VirusTotal for 136 days before Adobe named it a CVE

nefariousplan.com · 3 months ago

There was a public VirusTotal upload on November 28, 2025 of a PDF that thirteen of sixty four antivirus engines flagged and which used obfuscated JavaScript in the document open handler to invoke privileged Acrobat APIs, exfiltrate data, and enable remote code execution. Adobe assigned CVE-2026-34621 and shipped a patch on April 12, 2026 after a 136 day gap in which similar samples targeted Russian oil and gas entities and a researcher published a mechanism writeup and proof of concept. The root cause was prototype pollution in Acrobat’s JavaScript runtime that allowed attackers to mutate Object prototype state and bypass sandbox trust checks, and public exploit code demonstrated the class on Windows and macOS; subsequent patches also addressed CVE-2026-34622 and CVE-2026-34626. The incident illustrates a trust inversion where vendor advisory text saying no known exploits lagged community telemetry, misleading defenders about real in the wild exploitation.