Blahalla

53 DDoS Domains Taken Down by Law Enforcement

www.securityweek.com · 3 months ago

Law enforcement agencies in 21 countries coordinated an operation against DDoS for hire services, resulting in the takedown of 53 domains and the arrest of four individuals. Authorities sent 75,000 warning emails and letters, executed 25 search warrants, seized infrastructure that exposed over three million criminal user accounts, and will transition Operation PowerOff into a prevention phase involving removal of 100 URLs from search engines, targeted ads for potential users, and warnings placed on blockchains. Operation PowerOff, active for nearly a decade, has disrupted dozens of booter services, including Webstresser, DigitalStress and Stresser.tech.
Payouts King Emerges: New Ransomware Operation Tied to Ex-BlackBasta Members

gbhackers.com · 3 months ago

Payouts King is emerging as a technically sophisticated ransomware operation believed to be run by former BlackBasta affiliates, first observed in April 2025 and tracked ramping up through early 2026. Operators rely on spam bombing, phishing and vishing that impersonate internal IT and pressure targets into Microsoft Teams sessions and Quick Assist remote support to gain initial access. The malware uses layered obfuscation including per binary FNV1 hashing with unique seeds, API resolution by hash, a custom CRC to hide command line configuration, and a range of switches to control backup, elevation, targeting, timing and stealth. Encryption combines 4,096 bit RSA with 256 bit AES in counter mode using per file AES keys and an RSA protected header, employs selective and partial block encryption for large files, and uses EDR evasion such as process name hashing, avoiding core system files, and renaming files via SetFileInformationByHandle to sidestep detection.
Recently leaked Windows zero-days now exploited in attacks

www.bleepingcomputer.com · 3 months ago

There are three recently disclosed Windows vulnerabilities being exploited in attacks aimed at gaining SYSTEM or elevated administrator permissions. A researcher using the aliases Chaotic Eclipse and Nightmare-Eclipse published proof of concept exploit code for BlueHammer, RedSun, and UnDefend, with BlueHammer and RedSun abusing Microsoft Defender to achieve local privilege escalation and UnDefend allowing a standard user to block Defender definition updates. Huntress Labs reported seeing all three exploited in the wild with BlueHammer observed since April 10, and Microsoft patched BlueHammer as CVE-2026-33825 in the April 2026 security updates while RedSun and UnDefend remain unpatched.
Anthropic Introduces Claude Opus 4.7 for Advanced Problem-Solving

gbhackers.com · 3 months ago

false
ZionSiphon Malware Hits Israeli Desalination Plants

gbhackers.com · 3 months ago

There is new malware called ZionSiphon designed to sabotage Israeli desalination and water treatment plants, but the observed sample appears to be a faulty or developmental build rather than an operational weapon. The binary embeds Base64 encoded propaganda and hardcoded Israeli IPv4 ranges and checks for desalination and water treatment indicators such as process names, program directories, configuration files, and national utility site names to confirm targets. If a host passes checks the code attempts to overwrite configuration parameters to increase chlorine dosing and set reverse osmosis pressure, scans local subnets probing Modbus, DNP3, and S7comm ports and can issue write commands, and it includes USB propagation and user-level persistence mechanisms. However its country validation logic is broken so targeting always fails and triggers a self-destruct routine while some protocol branches are stubbed, leading researchers to conclude the sample is developmental yet indicative of politically motivated operational technology sabotage intent.
Google Deploys Gemini AI to Stop Threat Actors, Blocking 8.3 Billion Ads

gbhackers.com · 3 months ago

Google deployed Gemini AI deep into its ad safety systems to neutralize malicious advertising campaigns, intercepting more than 99 percent of policy violating ads before they reached end users. In 2025 Gemini powered tools blocked or removed over 8.3 billion ads and suspended 24.9 million advertiser accounts, including 602 million scam related ads and four million accounts tied to fraud. Gemini analyzes hundreds of billions of signals such as account age, behavioral cues and campaign patterns to understand intent, enabling instant review of most Responsive Search Ads, reducing incorrect advertiser suspensions by 80 percent and allowing safety teams to act on four times as many user reports.
Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts

thehackernews.com · 3 months ago

Operation PowerOFF seized 53 DDoS domains and exposed more than 3 million criminal user accounts. Four people were arrested and authorities disrupted DDoS-for-hire services used by over 75,000 cybercriminals, issuing 25 search warrants and sending warning notices to identified users. The coordinated action involved agencies from 21 countries and removed the technical infrastructure supporting the services to prevent further attacks.
Censys Warns 6 Million Public-Facing FTP Servers Are Still Exposed in 2026

gbhackers.com · 3 months ago

Nearly 6 million public facing hosts were still running legacy FTP protocols as of April 2026, down from about 10.1 million in 2024. These servers are concentrated in shared hosting and broadband networks with the United States showing over 1.2 million visible hosts, and China, Germany, Hong Kong and Japan accounting for more than half of the global total. Encryption adoption is mixed, with roughly 59 percent of FTP hosts completing a TLS handshake while about 2.45 million showed no evidence of TLS, and over 150,000 Microsoft IIS FTP deployments can appear to require SSL yet accept cleartext credentials when a certificate is not bound. Recommended mitigations include disabling FTP where possible, migrating to SFTP, verifying that valid certificates are bound to IIS FTP sites so TLS is actually enforced, and addressing legacy software such as the 1,744 internet facing hosts still running the backdoored vsftpd 2.3.4 release.
Top 5 Disaster Recovery Companies in 2026

www.techrepublic.com · 3 months ago

There are five top Disaster Recovery as a Service providers recommended: Unitrends, Acronis, Druva, Arcserve, and Zerto, with honorable mentions Microsoft Azure Site Recovery and Kamatera. Each provider is highlighted for strengths such as Unitrends for overall backups and ransomware alerts, Acronis for managed service providers and anti ransomware features, Druva for SaaS and database backup with air gapped immutable backups, Arcserve for data protection and data loss prevention, and Zerto for continuous replication and cloud data management. Common capabilities across these offerings include automated disaster recovery testing, ransomware protections, support for virtual and cloud environments, multiple storage destinations, and free trials to evaluate the services.
Cargo Hackers Hit Trucking Firms to Steal Physical Shipments

gbhackers.com · 3 months ago

Hackers are increasingly breaking into trucking and freight companies to quietly hijack physical cargo by compromising broker load board and carrier accounts, allowing criminals to bid on and reroute legitimate shipments. Researchers tracked campaigns that begin with phishing and account takeover, deliver executable or MSI installers that install remote monitoring and management software or information stealers such as DanaBot, NetSupport, Lumma Stealer, and StealC, and abuse legitimate RMM products including ScreenConnect, SimpleHelp, N-able, and PDQ Connect to maintain persistent access. Insurers and risk experts warn losses are growing and advise tightly controlling which RMM tools are allowed, blocking unknown installers from email, improving monitoring of remote access traffic, and training staff to spot suspicious load offers and unexpected software prompts; while Proofpoint highlighted North America, hotspots include Brazil, Mexico, India, Germany, Chile, and South Africa.
EU Age Verification App Breached in Just 2 Minutes, Researchers Claim

gbhackers.com · 3 months ago

There are severe cryptographic and design flaws in the European Union Age Verification application that allow an attacker to hijack user identity credentials after a researcher demonstrated a bypass in under two minutes. The app encrypts the user PIN locally and stores it in the shared preferences directory but the PIN is not cryptographically tied to the secure vault holding identity data, allowing an attacker with local file system access to delete the stored encryption values named PinEnc and PinIV, create a new PIN, and gain full access to the original user's identity. Additional flaws let attackers defeat rate limiting by resetting an incrementing counter to zero and disable biometric checks by changing the UseBiometricAuth setting to false. These vulnerabilities contradict official claims about the app's privacy posture and indicate the application needs a complete architectural overhaul before safe deployment.
Positiv denken für Sicherheitsentscheider: 6 Mindsets, die Sie sofort ablegen sollten

www.csoonline.com · 3 months ago

false
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

thehackernews.com · 3 months ago

There is a high severity flaw in Apache ActiveMQ Classic tracked as CVE-2026-34197 with a CVSS score of 8.8 that is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to remediate by April 30, 2026. The vulnerability stems from improper input validation that can lead to code injection and arbitrary code execution via ActiveMQ’s Jolokia management API, and while it typically requires credentials default credentials such as admin colon admin are common and some 6.0.0 through 6.1.1 versions are exposed without authentication due to CVE-2024-32114, making CVE-2026-34197 effectively an unauthenticated remote code execution in those builds. Impacted releases include ActiveMQ Broker before version 5.19.4 and 6.0.0 before 6.2.3, and users are advised to upgrade to 5.19.4 or 6.2.3 to address the issue. Threat intelligence shows attackers are actively targeting exposed Jolokia endpoints and recalls prior ActiveMQ exploits including CVE-2023-46604 which was weaponized in 2025 to deploy malware, highlighting collapsing exploitation timelines and the need to audit, restrict, and secure management interfaces.
Cisco Webex SSO flaw needs manual certificate update to fix

www.csoonline.com · 3 months ago

Administrators using Cisco Webex Services with single sign on integrated to Control Hub must install a new identity provider SAML certificate to remediate a critical vulnerability tracked as CVE-2026-20184 with a CVSS score of 9.8, because without it an unauthenticated remote attacker could impersonate any user. Cisco has applied a server side patch for the cloud service, but customers must update the certificate in Webex Control Hub and there are no workarounds. Cisco also released critical patches for Identity Services Engine and ISE Passive Identity Connector addressing CVE-2026-20147 and CVE-2026-20148 with CVSS scores of 9.9 that could permit remote code execution or path traversal when an attacker has valid administrative credentials. Two additional ISE vulnerabilities, CVE-2026-20180 and CVE-2026-20186, could allow remote code execution with Read Only Admin credentials and similarly require patching with no available workarounds.
Operation PowerOFF identifies 75k DDoS users, takes down 53 domains

www.bleepingcomputer.com · 3 months ago

There are more than 75,000 individuals using DDoS-for-hire platforms who were warned during the latest phase of Operation PowerOFF. The coordinated action, supported by Europol across 21 countries, resulted in four arrests, the takedown of 53 domains, and 25 search warrants. Authorities say the operation is moving into a prevention phase that includes awareness campaigns, search engine ads aimed at young people, removal of more than 100 URLs that promote illegal services, and adding on-chain warning messages tied to illicit payments, building on earlier phases that seized databases with over three million criminal accounts.
RCE by design: MCP architectural choice haunts AI agent ecosystem

www.csoonline.com · 3 months ago

AI agent building tools that support the Model Context Protocol may expose systems to remote code execution because the STDIO transport in Anthropic’s reference implementation allows client-supplied commands to be executed without safe defaults. With STDIO, clients can launch MCP servers as subprocesses and pass parameters that, if not filtered, run with the parent process permissions and are only reported as errors after execution. Researchers testing many IDEs, frameworks, and services found more than 30 RCE issues across live deployments and open source projects, with attack vectors including changing transport types in MCP configurations and prompt injection, while many maintainers treat the behavior as intentional or rely on other mitigations. Ten of the reported issues have received CVE identifiers, and researchers recommend SDKs adopt safer defaults such as command allowlisting and require developers to sanitize STDIO parameters.
ZionSiphon malware designed to sabotage water treatment systems

www.bleepingcomputer.com · 3 months ago

A new malware named ZionSiphon has been designed to target operational technology in water treatment and desalination environments with the intent to sabotage operations. It contains routines to adjust hydraulic pressures and maximize chlorine dosing by appending configuration entries such as Chlorine Dose 10, Chlorine Pump ON, Chlorine Flow MAX, Chlorine Valve OPEN and RO Pressure 80 and it scans for industrial protocols including Modbus, DNP3 and S7comm. It also spreads via USB by copying itself as a hidden svchost.exe and creating malicious shortcut files to execute when clicked, and its Modbus code is only partially functional while other protocol support remains placeholder. Researchers found a flawed encryption validation and an XOR mismatch in the country targeting logic that causes the current build to self destruct and prevents it from activating but they warn a future fixed release could make it operational and dangerous with apparent focus on Israeli targets.
A Deep Dive Into Attempted Exploitation of CVE-2023-33538

unit42.paloaltonetworks.com · 3 months ago

There are active automated scans attempting to exploit CVE-2023-33538, a command injection flaw affecting end of life TP Link Wi Fi routers including TL WR940N v2 and v4, TL WR740N v1 and v2, and TL WR841N v8 and v10. Observed exploit attempts seek to download and run a Mirai like arm7 binary by injecting commands into the router web interface to download a binary, change permissions, and execute it, and many requests used Basic Authentication with username admin and password admin which makes default credentials a practical infection vector. Firmware emulation and reverse engineering confirm that the ssid1 parameter in the userRpm WlanNetworkRpm endpoint is unsanitized and can permit command injection leading to arbitrary system command execution, though many in the wild exploit payloads were flawed and would fail. Affected devices are end of life with no vendor patches available, so replacement and avoidance of default credentials are recommended.
NIST cuts down CVE analysis amid vulnerability overload

www.csoonline.com · 3 months ago

There are significant operational changes at the National Institute of Standards and Technology to address an escalating volume of security flaws, with the agency now prioritizing enrichment only for the most critical vulnerabilities. NIST will focus enrichment on items appearing in CISA's Known Exploited Vulnerabilities catalog and other high priority software used by the federal government and critical software, aiming for enrichment within one business day while marking other entries as not scheduled and stopping recalculation of severity scores when a reporting organization provides one. The backlog began accumulating in early 2024 after submissions grew 263 percent between 2020 and 2025, NIST enriched nearly 42,000 vulnerabilities in 2025 and now reports a backlog of more than 30,000, while industry forecasts expect about 59,427 vulnerabilities for 2026 and warn that AI driven flaw discovery is accelerating the problem.
NIST Revamps CVE Framework to Focus on High-Impact Vulnerabilities

www.darkreading.com · 3 months ago

NIST is changing its criteria for which software flaws receive detailed analysis in the Common Vulnerabilities and Exposures framework, adopting a risk based model after falling behind under a rapidly growing backlog. Beginning April 15, 2026, NIST will continue to add all submitted vulnerabilities to the National Vulnerability Database but will only prioritize and provide detailed scoring for a subset, focusing on vulnerabilities on the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities list and flaws in critical software defined under Executive Order 14028. NIST cited a 263 percent increase in submissions between 2020 and 2025 and higher volumes in early 2026, and experts say the change shifts remediation toward threat intelligence and real world exploitability while potentially disrupting legacy auditing workflows.
Pentagon Seeks Help From Ford and G.M.

www.nytimes.com · 3 months ago

false
RedSun: How Windows Defender's Remediation Became a SYSTEM File Write

nefariousplan.com · 3 months ago

RedSun is a local privilege escalation chain that abuses Windows Cloud Files sync roots and a mount point reparse to cause Windows Defender, running as SYSTEM, to follow a tracked origin path into System32 and overwrite a service binary. The chain registers a sync provider and placeholder, stamps a mount point reparse pointing to C:\Windows\System32, then triggers Defender to remediate the placeholder and copy the attacker binary over TieringEngineService.exe, which is then launched as SYSTEM. A previous independent exploit called BlueHammer was patched as CVE-2026-33825, but RedSun was unpatched as of April 16, 2026, and the researcher warns similar variants are likely because the root cause is Defender remediating paths without validating canonicalized write targets. Short term mitigations include applying attack surface reduction rules, auditing and alerting on unexpected CfRegisterSyncRoot registrations and FSCTLSETREPARSEPOINT operations against Cloud Files roots, and monitoring unexpected modifications to TieringEngineService.exe.
World Leaks: RDP Access Leads to Custom Exfiltration and Personalized Extortion

breachcache.com · 3 months ago

A two day intrusion began with an RDP brute force using a company specific wordlist, allowing operators to run an open source privacy hardening script to disable endpoint defenses, deploy a Cobalt Strike stager and a Go based loader named lactenin.exe, and move laterally to the domain controller and backup server. Operators then ran a Rust based exfiltration platform called RustyRocket agent.exe in normal mode to index and copy files over SMB and stream data over HTTPS to more than 6,900 unique Cloudflare backed IP addresses, and recovered operator documentation describing three operating modes and a companion pivoting proxy for segmented networks. Following exfiltration they placed personalized extortion notes addressed by name to each employee with separate leadership and staff templates, directed the victim to a negotiation portal, initially demanded 200,000 in Bitcoin and negotiated down to 85,000 with full negotiation chats and indicators of compromise provided.
New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges

www.bleepingcomputer.com · 3 months ago

A researcher known as Chaotic Eclipse published a proof-of-concept exploit for a Microsoft Defender zero-day called RedSun and said the release was a protest over how Microsoft handles vulnerability disclosures. The exploit is a local privilege escalation that grants SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server when Microsoft Defender is enabled. The proof of concept abuses the Cloud Files API by writing an EICAR test string, using an opportunistic lock to win a volume shadow copy race, and leveraging a directory junction to redirect a Defender file rewrite to the system TieringEngineService executable so the attacker-planted binary is executed as SYSTEM, and some vendors initially detected the exploit because of the embedded EICAR but detections were reduced by encrypting it. A prior related exploit called BlueHammer was tracked as CVE-2026-33825 and was fixed by Microsoft in April Patch Tuesday.
I Feel So Sorry for My A.I. Sunglasses

www.nytimes.com · 3 months ago

false
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555)

r3verii.github.io · 3 months ago

There is a vulnerability CVE-2026-33555 in HAProxy HTTP 3 standalone QUIC handling where a single QUIC STREAM frame with zero payload and the FIN bit set can cause HAProxy to forward a request with a Content-Length header indicating a body that contains zero bytes. The backend then waits for the declared body bytes that never arrive and the next user request on the same pooled TCP connection has its first bytes consumed as the missing body, enabling cross-user cross-protocol HTTP request smuggling. Affected versions include HAProxy 2.6 through 3.3.5 when compiled with QUIC support, and fixes are available in versions 3.3.6, 3.2.15, 3.0.19, 2.8.20 and 2.6.25.
North Korea Uses ClickFix to Target macOS Users' Data

www.darkreading.com · 3 months ago

Sapphire Sleet is using ClickFix techniques to target macOS users by posing as recruiters and directing targets to run a compiled AppleScript named Zoom SDK Update.scpt during bogus technical interviews. The staged payloads use curl to execute multiple AppleScript modules that install credential harvesters, a data stealer that targets cryptocurrency wallets, browsers, keychains, Apple Notes, and Telegram, and multiple backdoors, while bypassing Apple’s Transparency, Consent, and Control protections by renaming and modifying TCC files and database entries to suppress prompts. Microsoft reported the campaign to Apple, which implemented mitigations, and recommends educating users about ClickFix social engineering, blocking or restricting.scpt files and unsigned Mach-O binaries downloaded from the Internet, exercising caution when copying and pasting sensitive data, and protecting wallets and browser credential stores.
McGraw-Hill Confirms Data Exposure, Hackers Claim 45M Salesforce Records Leaked

www.techrepublic.com · 3 months ago

McGraw Hill confirmed unauthorized access to a limited set of internal data after a reported Salesforce misconfiguration, while the extortion group ShinyHunters claimed it had obtained up to 45 million Salesforce records including personally identifiable information. The company says its investigation found only limited non sensitive data exposure and that the incident did not involve unauthorized access to its Salesforce accounts, customer databases, courseware, or internal systems. Security experts warned that extortion actors frequently inflate scope to increase leverage and that SaaS misconfigurations create downstream risks such as impersonation, credential harvesting, identity fraud, and harassment, and they recommended continuous configuration audits, stronger identity and access controls, least privilege, multifactor authentication, data loss prevention, and centralized logging and monitoring.
'Harmless' Global Adware Transforms Into an AV Killer

www.darkreading.com · 3 months ago

An update pushed by Dragon Boss on March 22, 2025 converted its adware into malware that disabled multiple antivirus products including ESET, McAfee, Kaspersky, and Malwarebytes, established persistence via scheduled tasks, and arranged for future payloads to be excluded from Windows Defender. Researchers at Huntress sinkholed the campaign after identifying its update infrastructure and found the adware on more than 23,500 systems in 124 countries, with roughly half of the infections in the United States, priming those machines for follow on attacks such as ransomware or botnets. Among the infected were 35 government entities, 41 operational technology networks, 221 higher education institutions, and several Fortune 500 companies, and researchers noted the malicious update used Advanced Installer update functionality and included inline comments suggesting possible AI assistance.
NTT Research Launches Scale Academy to Bring Lab Technology to Market

www.techrepublic.com · 3 months ago

NTT Research launched Scale Academy to turn lab and R and D innovations into market ready products, with Bennett Indart leading the incubator and SaltGrain as its inaugural offering. Scale Academy operates with product style governance, funding gates, timelines, and a fail fast discipline to identify commercially viable technologies and pursue spinouts or external partners. SaltGrain combines attribute based encryption that embeds access policies in ciphertext with an AI driven data classification engine and recent optimizations aimed at post quantum resistance to enable fine grained, zero trust data sharing. NTT will be measured by whether SaltGrain wins paying reference customers in regulated industries and whether the incubator transparently meets milestones and attracts external partners over the next 18 to 24 months.
Cisco Webex Services Certificate Validation Vulnerability

sec.cloudapps.cisco.com · 3 months ago

There is a vulnerability in the integration of single sign on with Control Hub in Cisco Webex Services that could have allowed an unauthenticated remote attacker to impersonate any user. The issue was caused by improper certificate validation and could be exploited by connecting to a service endpoint and supplying a crafted token, and while the service has been patched affected customers using SSO must upload a new identity provider SAML certificate to Control Hub because there are no workarounds. Security Impact Rating Critical, CVE CVE-2026-20184.
Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

thehackernews.com · 3 months ago

There is an active malicious campaign targeting workers in the Czech Republic with a previously undocumented botnet dubbed PowMix that has been observed since at least December 2025. The infection chain begins with a malicious ZIP file likely delivered by phishing and uses a Windows shortcut to launch a PowerShell loader that extracts, decrypts, and runs the malware in memory, then establishes persistence via a scheduled task while checking the process tree to avoid duplicate instances. PowMix facilitates remote access, reconnaissance, and remote code execution, embeds encrypted heartbeat data and unique victim identifiers in C2 URL paths, uses randomized beaconing intervals to evade network detection, supports commands that enable self deletion and C2 migration, and shows tactical overlap with prior ZIP based campaigns while its ultimate payload and motives remain unclear.
What Is ‘Jagged Intelligence’ and How Can It Reframe the AI Debate?

www.nytimes.com · 3 months ago

false
Government Can’t Win the Cyber War Without the Private Sector

www.securityweek.com · 3 months ago

There is a growing consensus that governments cannot secure national digital infrastructure alone and that securing national resilience now depends on faster and deeper partnerships with the private sector. Cyber threats have risen in scale and sophistication, commonly targeting multiple attack surfaces such as endpoints, networks, cloud infrastructure, applications, and identity, while AI is accelerating attack timelines and widening risk. Because critical technology and infrastructure are largely built and operated by private companies, public private coordination is required for faster threat intelligence sharing, secure by design AI, aligned governance, and joint disruption of criminal infrastructure across borders. Cybercrime has become industrial and persistent with strong financial incentives, so coordinated offensive measures against the broader criminal ecosystem are necessary rather than isolated defensive actions.
Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face

www.bleepingcomputer.com · 3 months ago

Hackers are exploiting critical remote code execution vulnerability CVE-2026-39987 in the Marimo reactive Python notebook to deliver a new NKAbuse malware variant hosted on Hugging Face Spaces. Attackers create typosquat Spaces such as vsccode-modetx to host a dropper script named install-linux.sh and a kagent binary, which is fetched and executed to install the payload and establish persistence via systemd, cron, or macOS LaunchAgent. The NKAbuse variant functions as a remote access trojan that executes shell commands, exfiltrates output, leverages NKN and WebRTC technologies for command and control, and operators have used stolen environment credentials to pivot to PostgreSQL and Redis instances. Mitigations include upgrading Marimo to version 0.23.0 or later immediately or blocking external access to the terminal websocket endpoint.
Malicious WordPress Plugins with Backdoors Compromise Thousands of Websites

www.techrepublic.com · 3 months ago

31 WordPress plugins in the Essential Plugin portfolio contained hidden backdoors that compromised thousands of websites and were permanently closed by WordPress. A security researcher found the plugins had been sold to a new owner and that, beginning August 8, 2025, modified releases such as version 2.6.7 of Countdown Timer Ultimate added 191 lines of malicious code that lay dormant for eight months and affected installations including one plugin with over 20,000 active installs. The backdoor resolved its Command and Control servers via an Ethereum smart contract to persistently update the infrastructure, and site owners are advised to delete the affected plugins, apply researcher patches if available, and audit installed plugins regularly.
Building your cryptographic inventory: A customer strategy for cryptographic posture management

www.microsoft.com · 3 months ago

Post quantum cryptography readiness starts with building a comprehensive cryptographic inventory that catalogs certificates, keys, protocols and cipher suites, cryptographic libraries, algorithms in code, encrypted session metadata, secrets, and hardware security modules. A cryptographic posture management lifecycle is a continuous cycle of Discover, Normalize, Assess risk, Prioritize, Remediate, and Continuous Monitoring applied across code, network, runtime, and storage domains. Maintaining an inventory enables governance, compliance, and risk prioritization, and around 15 countries and the European Union already recommend or require cryptographic inventorying through regulations such as DORA, OMB M-23-02, and PCI DSS 4.0. Organizations should implement customer-led operating models that combine tooling, automation, continuous monitoring, and partner solutions to accelerate cryptographic modernization and quantum-safe readiness.
Sometimes changing the password on your email mailbox isn’t enough

www.fortra.com · 3 months ago

New research shows roughly one in ten Microsoft 365 accounts compromised in Q4 2025 had malicious mailbox rules added shortly after access, in some cases within five seconds of the initial breach. Attackers create rules that silently forward, hide, or delete messages to exfiltrate data, suppress security alerts, and intercept communications, and those rules can persist through a password reset. Attacker created rules are often given short nonsensical names such as a single dot, sequences of dots, or semicolons, and one case involved a hidden rule that concealed payment related messages and enabled a phishing campaign that led to additional compromises. Recommended defenses include disabling automatic external forwarding, enforcing multi factor authentication and conditional access, monitoring OAuth app grants, revoking active sessions and refresh tokens, removing unexpected mailbox rules, and reviewing sign in logs.
Two-Factor Authentication Breaks Free from the Desktop

www.darkreading.com · 3 months ago

Two-factor authentication is expanding beyond desktop IT systems into the physical world to protect connected cars, medical devices, HVAC systems, and other Internet of Things targets. Automakers and vendors are testing solutions such as in-vehicle hardware paired with mobile one-time passwords, ultra-wideband proximity keys, biometrics, and pin-to-drive models to counter relay attacks and key cloning, but usability and the absence of clear standards slow adoption. Healthcare organizations are adding multifactor controls for clinicians interacting with devices and patient records because SMS-based codes remain vulnerable to interception and SIM swapping. Regulators are unlikely to mandate specific authentication methods immediately, yet industry groups and broader cybersecurity requirements are driving increased uptake.
Google expands Gemini AI use to fight malicious ads on its platform

www.bleepingcomputer.com · 3 months ago

Google is increasingly using its Gemini AI models to detect and block harmful ads across its advertising platforms as scammers use generative AI and evasive techniques such as cloaking and redirects. In 2025, 8.3 billion ads were blocked or removed and 24.9 million advertiser accounts were suspended globally, including 602 million scam-related ads, and in the United States 1.7 billion ads were removed and 3.3 million accounts suspended. Gemini analyzes billions of signals beyond keywords, including advertiser behavior, account history, campaign patterns, and intent, enabling real-time blocking at submission for many Responsive Search Ads, reducing incorrect advertiser suspensions by 80 percent, and Google plans to expand Gemini to additional ad formats and enforcement systems.
Microsoft's Original Windows Secure Boot Certificate Is Expiring

www.darkreading.com · 3 months ago

The original 2011 UEFI Secure Boot certificates for Windows will start expiring on June 24, 2026, and Microsoft is urging IT and security teams to update the certificates on all Windows PCs made before 2024 so they continue to receive security updates. Secure Boot serves as the hardware based root of trust that verifies cryptographic signatures at startup to block unauthorized firmware and bootloaders, and Microsoft warned that expired certificates will prevent updates to the UEFI databases DB and DBX, increasing exposure to UEFI bootkits such as BlackLotus, FinSpy, and MoonBounce. Microsoft has added a Secure Boot certificate status indicator in the Windows Security app and plans to add notifications next month to help users and administrators identify devices that need the refresh, while advising organizations to consult its playbook, inventory endpoints, and confirm OEM firmware prerequisites. Windows 10 devices enrolled in Microsoft s Extended Security Update program will receive the new certificates, but Windows 10 systems not in ESU may not automatically get them and older devices could gradually lose Secure Boot functionality if not updated.
Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

www.microsoft.com · 3 months ago

A North Korean threat actor known as Sapphire Sleet ran a macOS intrusion campaign that relied on social engineering to trick users into manually executing a compiled AppleScript disguised as a legitimate software update. Attackers hid malicious logic in large decoy comment blocks so users would not see it, used Script Editor to run shell commands and launched signed system binaries, then fetched additional AppleScript with curl and executed it with osascript to deliver multi stage payloads. The campaign used fake system dialogs to harvest credentials, manipulated the macOS Transparency Consent and Control database, established persistence via launch daemons, and exfiltrated credentials, sensitive data, and cryptocurrency assets while operating outside Gatekeeper and quarantine protections. Apple was informed and implemented mitigations, and defenders are advised to keep macOS up to date, use layered security controls, and apply the provided detections and hunting guidance to identify similar intrusion activity.
They Were YouTube’s First Stars. Here’s What They Wish They’d Known.

www.nytimes.com · 3 months ago

There are early YouTube creators MatPat, Miranda Sings, Grace Helbig and WheezyWaiter who built major followings before the platform became a behemoth. They offer insights about what it takes to succeed on YouTube today, stressing authenticity, adaptability and consistent creative output. They say long term success depends on evolving with the platform while maintaining a direct connection with fans.
OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

www.securityweek.com · 3 months ago

OpenAI is expanding its Trusted Access for Cyber program to thousands of verified defenders and hundreds of security teams, granting vetted users access to GPT 5.4 Cyber, a fine tuned variant of GPT 5.4 that relaxes standard guardrails to support legitimate cybersecurity work. The model adds capabilities such as binary reverse engineering and will be rolled out iteratively to vetted security vendors, organizations, and researchers, with individuals able to apply through an identity verification process and enterprise teams enrolling via their OpenAI account representatives. OpenAI cites principles of democratized access, iterative deployment, and ecosystem resilience, and says its Codex Security platform has already helped identify over three thousand critical and high severity vulnerabilities, while the move follows Anthropic restricting access to its Claude Mythos model amid concerns it could autonomously discover thousands of zero day vulnerabilities.
New ATHR vishing platform uses AI voice agents for automated attacks

www.bleepingcomputer.com · 3 months ago

A new cybercrime platform named ATHR automates voice phishing attacks to harvest credentials by combining human operators with AI voice agents. It is marketed on underground forums for four thousand dollars plus a ten percent commission and targets services including Google, Microsoft, Coinbase, Binance, Gemini, Crypto.com, Yahoo, and AOL. The platform automates the full telephone oriented attack delivery from customized lure emails through Asterisk and WebRTC calls to scripted AI agents that imitate account recovery processes to extract six digit verification codes while operators monitor and control campaigns from a centralized dashboard. Defenses include modeling normal communication behavior to flag anomalous messages that contain phone numbers or similar lures sent repeatedly within an organization.
Most "AI SOCs" Are Just Faster Triage. That's Not Enough.

www.bleepingcomputer.com · 3 months ago

Most AI SOC tools largely speed triage by summarizing alerts, enriching events, and suggesting next steps without solving the coordination and execution work that actually reduces analyst workload. Real workload reduction comes from embedding AI into deterministic end to end workflows that gather context across tools, trigger actions across systems, and involve humans only where judgment is required, with vendors reporting outcomes such as Jamf handling 90 percent of alerts end to end and saving 150 hours in the first month. Organizations evaluating AI for the SOC are advised to test whether systems can execute multi step processes across their actual tools, behave reliably at scale, provide audit logs and human override, and consider that 99 percent of SOCs use AI while many report increased workloads and large shares of time spent on automatable tasks.
Cisco Secure Web Appliance Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 3 months ago

There is a vulnerability in the authentication service feature of Cisco AsyncOS for Cisco Secure Web Appliance that could allow an unauthenticated remote attacker to bypass authentication policy requirements. The flaw is improper validation of user supplied authentication input in HTTP requests and can be exploited by sending specially crafted HTTP requests to bypass policy enforcement, allowing an attacker to send HTTP requests that should be restricted through the device. Software updates have been released to address the issue, there are no workarounds, the Security Impact Rating is Medium, and the vulnerability is tracked as CVE-2026-20152.
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories

thehackernews.com · 3 months ago

A targeted breach at cryptocurrency wallet provider Zerion led to about 100,000 dollars being stolen from internal hot wallets after an AI enabled social engineering attack attributed to a North Korean actor known as UNC1069. A new Microsoft Defender privilege escalation exploit codenamed RedSun was disclosed following a prior BlueHammer issue that was fixed as CVE-2026-33825, and researchers report RedSun can reliably escalate to SYSTEM on Windows 10 and Windows 11 when Defender is enabled. The U S Cybersecurity and Infrastructure Security Agency added a 17 year old Microsoft Excel remote code execution vulnerability CVE-2009-0238 to its Known Exploited Vulnerabilities catalog with federal remediation required by April 28, 2026, and Microsoft rolled out April 2026 protections to harden against phishing that abuses RDP files addressing CVE-2026-26151. Security researchers also reported a sharp rise in brute force attacks targeting SonicWall and FortiGate edge devices, a fake Ledger app on the Apple store that drained about 9.5 million dollars from users, and a WordPress plugin supply chain compromise used to push backdoors.
UAC-0247 Hits Hospitals, Governments With Browser and WhatsApp Data Theft

gbhackers.com · 3 months ago

There is a surge of targeted cyberattacks against local governments and municipal healthcare institutions attributed to threat cluster UAC-0247 that begin with phishing emails posing as humanitarian aid proposals which deliver archive files containing shortcut files that trigger mshta.exe and HTA scripts to silently deploy executables via scheduled tasks. Attackers use a sophisticated two stage loader that delivers a TCP reverse shell called RAVENSHELL encrypted with a nine byte XOR key, deploy a C Sharp remote administration tool named AGINGFLY that downloads and compiles command handlers at runtime, and operate a PowerShell component called SILENTLOOP that maintains C2 via Telegram. For data theft they use CHROMELEVATOR to harvest browser credentials and cookies and ZAPIXDESK to exfiltrate WhatsApp desktop data, while conducting reconnaissance and lateral movement with tools such as RUSTSCAN, LIGOLO NG and CHISEL and in some cases loading an XMRIG miner through a patched WireGuard client, and CERT UA recommends restricting execution of LNK HTA and JS files and limiting mshta powershell and wscript to reduce exposure.
Open dataset: 100k+ multimodal prompt injection samples with per-category academic sourcing

huggingface.co · 3 months ago

Researchers have compiled a vast collection of adversarial payloads designed to jailbreak large language models like GPT-4 and Claude. These techniques range from iterative prompt refinement to exploiting gradient-based optimization and visual obfuscation methods, categorized by approach such as universal attacks and code injection. The collection tracks attack success rates across different models and highlights the evolving landscape of prompt injection vulnerabilities, showcasing a continuous arms race between developers and attackers. Datasets are also available to train and evaluate AI prompt injection detectors, including multimodal attacks and evasion strategies.