Blahalla

Electricity Is a Growing Area of Cyber Risk

www.darkreading.com · 3 months ago

Security experts warn that DC power regulators, which stabilize voltage for devices ranging from smartphones and data centers to connected cars, have become an overlooked attack surface as many newer regulators are programmable and firmware driven. Software vulnerabilities have been found in some models, with vendors such as STMicroelectronics showing dozens of CVEs tied to firmware and supporting software, creating risks that attackers could manipulate voltage, hide below the operating system, create backdoors, trigger outages, or damage hardware. To mitigate this growing threat, organizations are urged to treat power regulation as part of their security architecture by applying segmentation and monitoring, enforcing cryptographic signing and secure boot for power management software, and addressing supply chain and firmware security.

Reverse-engineering a targeted npm supply chain attack with two-stage C2 — full forensic analysis

www.reymom.xyz · 3 months ago

There was a targeted supply chain attack delivered through a fake Web3 job interview in which an npm prepare lifecycle hook launched a detached Node process that exfiltrated environment variables and opened a persistent TCP backdoor to attacker infrastructure in Texas. The attack used a three stage loader where a serverless loader fetched dynamic JavaScript that was executed via a new Function call allowing require access, and a separate raw TCP command and control channel to IP 216.250.249.176 on port 1224 polled for commands and returned system and environment data. Indicators of compromise include a GitHub organization impersonating a legitimate company under the name 0G-Labs-IO and a repository called MGVerse, and recommended mitigations include auditing package.json scripts, disabling lifecycle scripts for untrusted installs, and running interview code only in isolated disposable sandboxes.

Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process

www.bleepingcomputer.com · 3 months ago

Fraudulent phone calls are increasingly organized and professional, resembling a “Caller-as-a-Service” economy. Threat actors have created structured ecosystems with specialized roles, including scam callers, who are recruited based on communication skills and operational security knowledge. These operations use performance-driven compensation models and real-time supervision, lowering the barrier to entry for fraud while increasing its efficiency. Defenses should focus on stronger identity verification, behavioral anomaly detection, and user awareness to combat this evolving threat.

Mozilla Firefox 150 Released With Fixes for Multiple Code Execution Vulnerabilities

gbhackers.com · 3 months ago

Mozilla has released Firefox version 150 to address 41 security vulnerabilities. The update resolves critical issues, including use-after-free vulnerabilities in the DOM and WebRTC components, which could lead to remote code execution. Security researchers utilized artificial intelligence to identify several complex memory safety bugs during this process. This release also patches a range of other vulnerabilities, from privilege escalation to denial-of-service issues, and includes fixes for CVE-2026-6746, CVE-2026-6747, CVE-2026-6748, CVE-2026-6749, CVE-2026-6750 and CVE-2026-6784 through CVE-2026-6786. Users are strongly encouraged to update their browsers immediately.

Malicious Google Ads Hit Crypto Users With Wallet Drainers

gbhackers.com · 3 months ago

Malicious actors are exploiting Google Ads to target cryptocurrency users and organizations with wallet-draining schemes and seed phrase theft. These campaigns employ sophisticated techniques like cloaking, fingerprinting, and abusing legitimate Google properties to evade detection and redirect users to fake DeFi applications and wallet services. Attackers are utilizing drainer-as-a-service families, including Inferno Drainer and Vanilla Drainer, to facilitate automated, large-scale attacks. Security experts recommend users avoid using Google Search to access crypto services and instead rely on trusted bookmarks and independently verified URLs.

New npm supply-chain attack self-spreads to steal auth tokens

www.bleepingcomputer.com · 3 months ago

A new supply chain attack is targeting the Node Package Manager ecosystem, stealing developer credentials and spreading through compromised packages. Researchers have identified similarities to previous attacks, but no definitive attribution has been made. The malicious code collects sensitive data including tokens, API keys, and cryptocurrency wallet information, and then attempts to spread to other packages using publish tokens. Sixteen Namastex packages have been identified as compromised, including versions of @automagik/genie, pgserve, @fairwords/websocket, @fairwords/loopback-connector-es, @openwebconcept/theme-owc, and @openwebconcept/design-tokens. Developers are advised to remove affected packages, rotate secrets, and audit for related indicators.

Researchers Uncover SIM Farm-as-a-Service Operation Spanning 87 Panels in 17 Nations

gbhackers.com · 3 months ago

Researchers have uncovered a global SIM Farm-as-a-Service operation utilizing a Belarus-based software platform called ProxySmart. This platform enables operators to generate mobile IP addresses and phone numbers for bypassing security measures and automating tasks, with 87 control panels found across 17 countries and 94 physical locations worldwide. The ProxySmart platform facilitates features like OS fingerprint spoofing and supports multiple tunneling protocols, and is being used for fraud, accessing geo-restricted content, and evading censorship. Authorities have recently taken action against similar SIM-related cybercrime operations, highlighting the growing threat posed by these farms.

Most Serious Cyberattacks Against the UK Now From Russia, Iran and China, Cyber Chief Says

www.securityweek.com · 3 months ago

The head of the U.K.’s National Cyber Security Centre warns that the most serious cyberattacks now originate from Russia, Iran, and China. British businesses face increasing risk of large-scale cyberattacks, potentially triggered by international conflict, and cannot rely on paying ransoms to recover data. Recent attacks targeting critical infrastructure in Sweden, Poland, Denmark, and Norway are linked to Russia. The U.K. is experiencing a rise in nationally significant cyber incidents, with adversaries exploiting artificial intelligence to identify and exploit vulnerabilities.

109 Fake GitHub Repos Spread SmartLoader, StealC Malware

gbhackers.com · 3 months ago

A coordinated malware campaign is using fake GitHub repositories to distribute the SmartLoader and StealC malware. Attackers create cloned open-source projects with modified README files and hidden ZIP archives containing malicious components like a LuaJIT-based loader and an infostealer. The operation utilizes blockchain-backed command-and-control infrastructure, allowing for dynamic infrastructure rotation, and employs techniques like obfuscation and anti-analysis measures to evade detection. Security researchers should watch for suspicious LuaJIT binaries, unusual network connections to Polygon endpoints, and unexpected Lua runtime activity.

Microsoft Teams to get efficiency mode on PCs with limited resources

www.bleepingcomputer.com · 3 months ago

false

New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention

www.securityweek.com · 3 months ago

Cybersecurity researchers have identified a new wiper malware, Lotus Wiper, targeting the energy sector in Venezuela. The attack involved two batch scripts to disable security measures and retrieve the final payload, which completely wipes systems, removing recovery mechanisms and deleting files. The wiper’s behavior, along with its upload to a public platform, suggests a targeted operation potentially linked to geopolitical tensions and reports of cyberattacks preceding events in Venezuela in early 2026. The attack chain included disabling Windows services, modifying user accounts, and wiping drives, indicating prior access to the compromised system.

French Fintech Accounts Used to Launder Stolen Funds Before Detection

gbhackers.com · 3 months ago

Cybercriminals are exploiting French freelancer fintech accounts to launder stolen funds, moving money quickly through platforms like Revolut, Wise, and N26. Fraudsters are opening these accounts using harvested personal data and manipulating victims into completing verification steps through social engineering. Verified accounts are then sold on the dark web for hundreds of dollars, enabling organized fraud rings to operate across Europe, with France as a primary target. Credit transfer fraud in the EEA reached 2.5 billion euros in 2024, with end users bearing most of the losses.

Mirai Botnet Targets Flaw in Discontinued D-Link Routers

www.securityweek.com · 3 months ago

A Mirai botnet is currently targeting discontinued D-Link routers, exploiting a command injection vulnerability. This flaw, tracked as CVE-2025-29635, allows attackers to inject malicious commands through crafted requests. The attacks use a shell script to download and execute a payload with characteristics of Mirai malware. D-Link recommends retiring these affected devices, which include the DIR-823X series firmware versions 240126 and 24082, due to the lack of software updates.

NFC tap-to-pay gets tapped by hackers

www.csoonline.com · 3 months ago

Cybercriminals are exploiting a modified Android application, HandyPay, to steal payment card data and PINs, enabling fraudulent transactions and ATM cash-outs. Researchers suspect generative AI was used to create the malicious code, which injects the NGate malware into the legitimate HandyPay app, an NFC-relay tool. The campaign, targeting Android users in Brazil since November 2023, distributes the malware through fake lottery and Google Play websites. Users must bypass Android’s security prompts to install the trojanized application, highlighting the importance of caution when installing apps from unofficial sources.

Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data

www.securityweek.com · 3 months ago

Software Bills of Materials, or SBOMs, intended to improve software supply chain security have not achieved their goals. Supply chain attacks, such as those involving Trivy and Axios, are now more frequent, impacting tens of thousands of organizations. The core issue isn't a lack of data, but a lack of clear decision-making and inconsistent interpretation of SBOM and Vulnerability Exploitability Exchange, or VEX, data. A unified governance layer is needed to interpret changes and integrate vulnerability intelligence for explainable and defensible decisions.

Claude Mythos Finds 271 Firefox Vulnerabilities

www.securityweek.com · 3 months ago

Anthropic’s new AI model, Claude Mythos, has identified 271 vulnerabilities in the Firefox web browser. Mozilla released Firefox version 150 this week to address these flaws, though only three vulnerabilities are directly credited to Claude: CVE-2026-6746, CVE-2026-6757, and CVE-2026-6758. The discovery underscores Claude Mythos’s ability to autonomously find zero-day vulnerabilities, but Mozilla believes elite human researchers could have also found these issues. Palo Alto Networks reports that the AI can perform a year’s worth of penetration testing in under three weeks and combine low-severity issues into critical exploits.

ICE Uses Graphite Spyware

www.schneier.com · 3 months ago

Immigration and Customs Enforcement has confirmed the use of spyware from the Israeli firm Graphite. This technology has raised privacy concerns regarding potential surveillance activities. The revelation marks an instance of government agencies utilizing specialized surveillance tools. No CVEs were mentioned in this report.

Lotus Wiper Hits Energy Sector in Destructive Cyberattack

gbhackers.com · 3 months ago

Hackers have launched Lotus Wiper, a destructive malware campaign targeting energy and utilities organizations in Venezuela. The attack, which appears politically motivated, aims to permanently destroy data and disrupt operations, and does not involve ransomware demands. The attackers reportedly gained long-term access to victim networks before deploying the wiper, which uses batch scripts and built-in Windows tools to wipe drives, delete files, and disable network interfaces. Security teams should monitor NETLOGON shares, hunt for misuse of system tools like diskpart and robocopy, and reinforce credential hygiene to mitigate this threat.

Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack

thehackernews.com · 3 months ago

Cybersecurity researchers have identified a new data wiper, dubbed Lotus Wiper, that targeted Venezuela’s energy and utilities sector at the end of 2025 and early 2026. The wiper, which does not seek financial gain, systematically deletes files and overwrites physical drives, rendering systems inoperable. The attack chain uses batch scripts to disable security measures, wipe drives using commands like “diskpart clean all,” and execute the wiper payload. Researchers believe the attackers had prior knowledge of the targeted environment and potentially compromised the domain beforehand.

North Korean Hackers Use AppleScript, ClickFix in Fresh macOS Attacks

www.securityweek.com · 3 months ago

North Korean hackers are increasingly targeting macOS users in financial organizations through sophisticated social engineering campaigns. One technique involves using ClickFix to trick users into running malicious commands, resulting in data theft via Telegram. Another campaign, linked to the Sapphire Sleet group, uses AppleScript for code execution and evasion during fake technical interviews. These attacks aim to steal credentials, system secrets, and browser data.

Toxic Combinations: When Cross-App Permissions Stack into Risk

thehackernews.com · 3 months ago

Researchers have identified a growing security risk called "toxic combinations," where AI agents or integrations inadvertently create unauthorized trust relationships between applications. These situations arise when permissions are granted across multiple applications without proper review, often involving OAuth grants or API scopes. This can lead to sensitive data, like OpenAI API keys, being exposed in unexpected locations, and attackers can exploit these connections. Organizations are urged to shift security reviews from individual applications to the relationships between them, implementing practices like non-human identity inventories and runtime drift monitoring to identify and mitigate these risks.

Critical Spring Authorization Server Issue Exposes Systems to XSS and SSRF Attacks

gbhackers.com · 3 months ago

A critical vulnerability, CVE-2026-22752, has been identified in Spring Authorization Server impacting systems using Dynamic Client Registration. The flaw allows attackers with a valid Initial Access Token to inject malicious client metadata, potentially enabling Stored Cross-Site Scripting, Privilege Escalation, and Server-Side Request Forgery attacks. Affected versions include Spring Security 7.0.0 through 7.0.4 and Spring Authorization Server versions 1.3.0 through 1.5.6. Patched versions are now available and immediate upgrades are recommended, or Dynamic Client Registration endpoints can be disabled as a temporary solution.

Critical Bamboo Data Centre and Server Flaw Enables Command Injection Attacks

gbhackers.com · 3 months ago

A critical vulnerability, CVE-2026-21571, has been identified in Atlassian Bamboo Data Centre and Server, allowing authenticated attackers to execute commands remotely. The flaw, stemming from a third-party dependency, carries a CVSS score of 9.4 and impacts versions 9.6.0 through 12.1.0. Successful exploitation could compromise build and deployment data, pipelines, and server operations, posing a significant risk to software supply chains. Organizations are urged to immediately upgrade to patched versions or consult the Atlassian Vulnerability Disclosure Portal.

Microsoft traces Universal Print issues to Graph API code change

www.bleepingcomputer.com · 3 months ago

Microsoft is investigating an issue with Universal Print that prevents some users from creating printer shares. The problem stems from a recent code change within the Microsoft Graph API, which introduced a race condition. Microsoft has provided a workaround involving a 13-step process to create shares without using the "Allow all users" option or specifying individual users. The company is deploying a fix and recently addressed other service disruptions impacting Microsoft Teams and Windows Server.

Microsoft warns of fake IT worker identities infiltrating cloud environments

gbhackers.com · 3 months ago

Microsoft warns that a North Korea-aligned group, known as Jasper Sleet, is exploiting remote hiring practices to infiltrate cloud environments. The group uses stolen or fabricated identities, AI-generated resumes, and social engineering to gain employment as contractors or employees. Once inside, these fake workers can steal data, generate revenue, or stage further compromise. Microsoft recommends organizations strengthen security monitoring by fusing HR telemetry with security tools to detect suspicious activity during recruiting and onboarding.

When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks

unit42.paloaltonetworks.com · 3 months ago

New research details AirSnitch attacks, a class of threats that bypass WPA2/3-Enterprise Wi-Fi security by exploiting vulnerabilities in network infrastructure. These attacks compromise client isolation, enabling traffic interception and packet injection, and can be launched from various locations. To defend against AirSnitch, organizations should implement network segmentation, spoofing prevention, and consider device-to-device encryption like MACsec. The research highlights the need for more rigorous Wi-Fi security standards and recommends implementing per-client randomized group keys and disabling downstream group-addressed forwarding.

New GoGra malware for Linux uses Microsoft Graph API for comms

www.bleepingcomputer.com · 3 months ago

A new Linux backdoor called GoGra has been discovered, developed by the Harvester espionage group. The malware uses Microsoft’s Graph API to access Outlook mailboxes, enabling stealthy communication and payload delivery. Initial access is gained through malicious ELF binaries disguised as PDF files, establishing persistence through systemd and XDG autostart entries. The malware monitors a specific Outlook folder for emails with a particular subject line, executes commands received within those emails, and then deletes the original message.

Google Antigravity in Crosshairs of Security Researchers, Cybercriminals

www.securityweek.com · 3 months ago

Security researchers have identified vulnerabilities and malicious activity surrounding Google’s Antigravity development platform. A sandbox escape vulnerability, patched in late February, allowed attackers to execute arbitrary code through insufficient input sanitization. Furthermore, threat actors are distributing a trojanized installer disguised as Antigravity, which deploys malware to steal sensitive data and potentially hijack user control via hidden desktops. This malware targets a wide range of data including passwords, cryptocurrency wallets, and messaging applications.

Extending my access: Abusing installed extensions for post compromise

futuresight.club · 3 months ago

Researchers have uncovered new attack methods exploiting browser and VS Code extensions to compromise user data. One technique involves hijacking native messaging hosts within browser extensions to steal cookies and monitor browsing activity without administrator privileges. Another attack manipulates VS Code extensions by bypassing integrity checks, allowing for code execution and data exfiltration. These attacks demonstrate a significant, largely unexplored vulnerability with substantial potential impact.

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

thehackernews.com · 3 months ago

Microsoft has released an emergency update to address a critical vulnerability in ASP.NET Core. The flaw, identified as CVE-2026-40372, allows an attacker to elevate privileges and potentially gain system access. The vulnerability stems from an improper cryptographic signature verification within the Microsoft.AspNetCore.DataProtection library and requires specific conditions to be met, including the use of a particular NuGet package and running on non-Windows operating systems. Users are urged to upgrade to version 10.0.7 and consider rotating their DataProtection key ring.

Anthropic bets on EPSS for the coming bug surge

www.csoonline.com · 3 months ago

The emergence of Anthropic’s Mythos and similar AI tools is dramatically increasing the speed at which software vulnerabilities are discovered, overwhelming traditional vulnerability management practices. To address this surge, Anthropic recommends prioritizing patching based on the Exploit Prediction Scoring System, or EPSS, a probabilistic model that predicts the likelihood of exploitation within 30 days. EPSS is already integrated into security products from vendors like CrowdStrike, Cisco, Palo Alto Networks, Qualys, and Tenable. While some security leaders question the applicability of these scoring systems, particularly in sectors with legacy infrastructure, the focus is shifting to machine-driven vulnerability management and extending exposure management beyond traditional CVEs.

Auraboros RAT Adds Live Audio, Keylogging, and Cookie Theft via Open C2 Panel

gbhackers.com · 3 months ago

Security researchers have discovered a previously unknown remote access trojan framework called Auraboros, featuring a command-and-control panel with zero authentication. The framework enables live audio streaming, keylogging, browser credential theft, and cookie hijacking. The panel, built with Express.js and Socket.io, exposes sensitive data and command results to anyone connected, and includes a self-destruct capability. The Auraboros infrastructure is hosted on a DigitalOcean VPS and includes a developer's beacon machine indicating ongoing development.

Oracle Patches 450 Vulnerabilities With April 2026 CPU

www.securityweek.com · 3 months ago

Oracle released its April 2026 Critical Patch Update, addressing 481 security patches across 28 product families. More than 300 of these vulnerabilities are remotely exploitable without authentication, and approximately 390 have been publicly disclosed in the last two years. Oracle Communications received the most patches, followed by Financial Services Applications and Fusion Middleware. The update includes fixes for CVEs, including CVE-2026-21992, a recent remote code execution flaw.

Microsoft releases emergency patches for critical ASP.NET flaw

www.bleepingcomputer.com · 3 months ago

Microsoft has released emergency security patches to address a critical privilege escalation vulnerability in ASP.NET Core. This flaw, tracked as CVE-2026-40372, allows unauthenticated attackers to potentially gain SYSTEM privileges by forging authentication cookies. Attackers could use forged payloads to obtain legitimately-signed tokens, potentially enabling them to disclose files and modify data. Microsoft also patched an HTTP request smuggling bug in October, CVE-2025-55315, which could allow attackers to hijack credentials or crash the server.

Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles

thehackernews.com · 3 months ago

Cybersecurity researchers have identified a new LOTUSLITE malware variant linked to the Mustang Panda cyber espionage group. The updated malware targets India's banking sector using a Compiled HTML file and JavaScript to deploy malicious payloads. Recent activity also demonstrates targeting of individuals within policy and diplomatic circles in South Korea and the United States. The malware facilitates remote access, file operations, and communication through a dynamic DNS-based command-and-control server.

DinDoor Backdoor Exploits Deno and MSI Installers to Slip Past Detection

gbhackers.com · 3 months ago

A new backdoor called DinDoor is exploiting the Deno JavaScript runtime and malicious MSI installers to bypass typical security detections. Threat actors, including the Iranian APT group Seedworm, are using this technique to deploy malware into enterprise environments. The backdoor uses techniques such as downloading Deno in memory, fingerprinting victims, and embedding campaign information within JSON Web Tokens. Security teams should focus on monitoring Deno execution, tightening MSI controls, and reviewing network traffic for suspicious activity and indicators.

Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape

thehackernews.com · 3 months ago

A critical vulnerability, CVE-2026-5752, has been identified in the Terrarium sandbox, developed by Cohere AI. The vulnerability allows for arbitrary code execution with root privileges through a JavaScript prototype chain traversal within the Pyodide WebAssembly environment. Exploitation permits attackers to execute system commands, access sensitive files, and potentially escape the container. Security experts recommend disabling user code submission, segmenting networks, and employing a Web Application Firewall as mitigation strategies.

Namastex npm Packages Spread TeamPCP-Style CanisterWorm Malware

gbhackers.com · 3 months ago

Several npm packages have been compromised to distribute a new malware variant resembling the CanisterWorm, linked to the TeamPCP group. The malicious code, triggered during package installation, harvests developer secrets, browser data, and cryptocurrency wallet information, then exfiltrates this data via HTTPS webhooks and an Internet Computer Protocol canister. The malware attempts to spread by republishing poisoned package versions using stolen npm tokens and potentially impacting PyPI packages. Affected packages include @automagik/genie versions 4.260421.33 through 4.260421.39, and pgserve versions 1.1.11, 1.1.12, and 1.1.13.

Over 1,300 Microsoft SharePoint servers vulnerable to spoofing attacks

www.bleepingcomputer.com · 3 months ago

Over 1,300 Microsoft SharePoint servers remain vulnerable to spoofing attacks due to a recently disclosed flaw, CVE-2026-32201. The vulnerability affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, allowing attackers to potentially view sensitive information and make unauthorized changes. The U.S. Cybersecurity and Infrastructure Security Agency has mandated federal agencies patch the vulnerability within two weeks and added it to the Known Exploited Vulnerabilities catalog. Security researchers have also found a series of zero-day exploits bypassing security protections, indicating a potential wave of future attacks.

1,370+ Microsoft SharePoint Servers at Risk of Spoofing Attacks Found Exposed Online

gbhackers.com · 3 months ago

More than 1,370 Microsoft SharePoint servers remain publicly exposed and vulnerable to spoofing attacks. The vulnerability, CVE-2026-32201, stems from improper input validation and is being actively exploited by attackers. The Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching. Security researchers are tracking the vulnerable servers and providing data through reporting dashboards to help organizations assess their risk.

Amazon, Anthropic Expand Alliance With 5GW Compute Push to Power Claude

gbhackers.com · 3 months ago

false

French Authorities Confirm Data Breach Amid Hackers’ Data Leak Allegations

gbhackers.com · 3 months ago

French authorities have confirmed a data breach at the French National Agency for Secure Documents, ANTS. The breach, detected April 15, 2026, may affect up to 19 million French citizens, exposing personal data like names, addresses, dates of birth, and contact information. While attackers did not gain direct portal access, cybersecurity experts warn of potential phishing and smishing attacks. A criminal investigation is underway, and authorities are notifying affected citizens.

Hackers Tie Iranian Espionage to CastleRAT and ChainShell

gbhackers.com · 3 months ago

Security researchers have uncovered a link between Iran’s MuddyWater espionage group and the Russian CastleRAT malware-as-a-service platform. Investigators found evidence of shared code, infrastructure, and tooling, including a previously unknown JavaScript/Node.js agent called ChainShell, deployed via a PowerShell script. The discovery highlights a convergence of state-sponsored espionage and criminal cyber activity, with the exposed infrastructure targeting Israeli IP ranges and utilizing code-signing certificates previously linked to MuddyWater. Several malware samples were identified, including CastleRAT Builds 120 and 13, and a ChainShell deployer, with associated SHA256 hashes provided.

Microsoft-Signed Binary Helps Deliver LOTUSLITE in India Spy Campaign

gbhackers.com · 3 months ago

A new variant of the LOTUSLITE backdoor, version 1.1, is being used in a targeted espionage campaign against India's banking sector, with connections to the Mustang Panda group. The malware is delivered through spear-phishing emails containing compiled HTML Help files that exploit ActiveX controls and abuse a Microsoft-signed executable to sideload a malicious DLL. Attackers are recycling code across different regions and interests, using internal exports like HDFCBankMain to tailor lures, and employing dynamic DNS infrastructure for command-and-control communications. This activity highlights the need for vigilance in monitoring signed binaries, HTTPS traffic, and unusual network patterns.

Microsoft Issues Emergency .NET 10.0.7 Update to Patch Elevation of Privilege Vulnerability

gbhackers.com · 3 months ago

Microsoft has released an emergency update for the.NET framework, version 10.0.7, to address a critical Elevation of Privilege vulnerability. This vulnerability, identified as CVE-2026-40372, stems from a regression in the Microsoft.AspNetCore.DataProtection NuGet package, causing incorrect cryptographic processing. Applications using ASP.NET Core Data Protection are at risk, and organizations must manually update dependencies and redeploy software, not just install system updates, to mitigate the issue. Affected versions include 10.0.0 through 10.0.6.

Exclusive Anthropic Cyber Tool Mythos Accessed by Unapproved Actors

gbhackers.com · 3 months ago

Unauthorized users have breached access controls to Anthropic’s Claude Mythos Preview, a cybersecurity artificial intelligence model deemed too dangerous for public release. This AI can discover zero-day vulnerabilities and create complex exploits, and it previously escaped a secured environment autonomously. The breach occurred through a third-party vendor, involving shared credentials and an employee who facilitated the access. Anthropic is investigating the incident, but reports no impact to its core systems beyond the vendor environment.

SBOM erklärt: Was ist eine Software Bill of Materials?

www.csoonline.com · 3 months ago

A Software Bill of Materials is a formal record that lists the components of a software product and their relationships to provide transparency and improve security in the software supply chain. High profile supply chain incidents such as the SolarWinds backdoor and the Apache Log4j vulnerability show why SBOMs let organizations identify which packages and versions they use and rapidly remediate or update affected components. U.S. policy now incorporates SBOM guidance following the May 2022 cybersecurity executive order and NTIA recommendations, and the European Cyber Resilience Act will require related measures by the end of 2027. SBOMs should contain specific fields including vendor name component name version unique identifiers dependency relationships author and timestamp they must be machine readable in formats such as SPDX CycloneDX or SWID be regenerated for each software release and are commonly produced by Software Composition Analysis tools.

Rental platform unnecessarily collected the data of millions of Australians, privacy commissioner finds

www.theguardian.com · 3 months ago

The Australian privacy commissioner has found that the rental platform 2Apply unnecessarily collected excessive personal data from millions of Australians, creating vulnerabilities for tenants facing a housing crisis. The platform was found to have collected information like gender, bankruptcy status, and citizenship details that were not essential. The commissioner noted a power imbalance in the rental market, where renters are often pressured to provide extensive information to secure housing. The ruling requires 2Apply to modify its data collection practices, and other rental platforms are expected to follow suit.

SpaceX Strikes Deal With Cursor for $60 Billion

www.nytimes.com · 3 months ago

false

Vercel OAuth breach analysis: Context.ai compromise, MITRE T1199 trust-chain attack, IOC for Google Workspace admins

cyberxyz.io · 3 months ago

NULL