Blahalla

US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers

www.securityweek.com · 3 months ago

Allied nations warn that Russian APTs are targeting critical infrastructure routers globally. These actors compromise poorly secured devices using techniques like SNMP set-requests transferred over TFTP. Attackers also exploit known vulnerabilities, including CVE-2008-4128 and CVE-2018-0171, to achieve arbitrary code execution on network equipment.

Phishing for dummies: Forg365 lowers barrier to M365 account takeovers

www.csoonline.com · 3 months ago

A newly documented phishing-as-a-service platform distributed through Telegram is lowering the technical barrier to Microsoft 365 account takeovers by giving less-skilled attackers automated tools to evade some authentication controls and retain access after compromise.

Greenhat Announces Successful Delegation at Web Summit Vancouver 2026

gbhackers.com · 3 months ago

Canada's cyber zone showed off its security strength at Web Summit Vancouver 2026. Experts showcased quantum crypto, compliance, and app security. International ties deepened via collaboration with tech leaders from Korea through the China Canada Blockchain & Cybersecurity Alliance.

US sanctions VPN, malware providers for enabling ransomware attacks

www.bleepingcomputer.com · 3 months ago

US Treasury OFAC sanctioned First VPN Service (1VPNS) and Dmytro Rashevskyi for ransomware attacks. Yegeniy Silayev was also sanctioned for selling evasion cryptors. These actions target services used by cybercriminals to hide identities and bypass defenses.

Valarian Raises $50 Million for Sovereign Infrastructure Control Layer

www.securityweek.com · 3 months ago

UK-based firm Valarian announced a $50 million Series A funding round to expand its sovereign infrastructure solutions. The company developed ACRA, an infrastructure control layer governing AI models and agents within dedicated organizational enclaves. This cloud-agnostic platform provides regulated industries runtime isolation, detailed policy enforcement, and workload auditing.

Multiple Jscrambler Packages Impacted by Supply Chain Attack

www.securityweek.com · 3 months ago

Poisoned Jscrambler's NPM packages using compromised credentials in a supply chain attack. Malicious code activates via preinstall hooks, dropping cross-platform binaries designed to steal secrets, API keys, and wallet data. Users must immediately remove affected package versions and rotate all stored credentials and tokens to mitigate the risk.

Grok Build Uploads Entire Git Repositories to xAI Storage, Not Just Files It Reads

thehackernews.com · 3 months ago

xAI's Grok Build CLI leaked full Git repos via Google Cloud Storage. A researcher (cereblab) tested v0.2.93 and retrieved private files from an intercepted upload request containing a git bundle. The vulnerability allowed unauthorized data exposure.

AI incidents need a new playbook. Here’s how to build one

www.csoonline.com · 3 months ago

Seventy-one percent of organizations say AI has access to core business systems. Only 16% govern that access effectively, according to the 2026 CISO AI Risk Report.

SAP July 2026 Patch Day Fixes Critical NetWeaver, Approuter, and Commerce Cloud Vulnerabilities

gbhackers.com · 3 months ago

SAP issued critical patches for July 2026 addressing flaws like CVE-2026-44747 (NetWeaver memory corruption), CVE-2026-27690 (AppRouter HTTP smuggling), and CVE-2026-44761. The update fixed numerous vulnerabilities, including CVE-2026-33454 and CVE-2026-40860.

U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support

thehackernews.com · 3 months ago

The U.S. Treasury Department's Office of Foreign Assets Control designated two individuals and a VPN service provider for enabling cybercriminals. Authorities targeted First VPN Service (1VPNS), accusing it of furnishing tools to ransomware groups that attack Americans. This action restricts entities aiding malicious digital activities across national borders.

WinFsp Race Condition Flaw Allows Attackers to Gain SYSTEM-Level Access on Windows

gbhackers.com · 3 months ago

CSA published an advisory detailing CVE-2026-3006, a race condition flaw in WinFsp affecting versions 2.1.25156 and earlier. Attackers can exploit this vulnerability to trigger a kernel heap overflow via local access. This critical local privilege escalation grants unauthorized SYSTEM-level access on affected Windows systems.

The ransomware negotiator who was working for the other side

www.bitdefender.com · 3 months ago

Former negotiator Angelo John Martino III illegally shared client data, including insurance policy and negotiation strategy details, with the BlackCat (ALPHV) ransomware group. He secretly operated this double life, receiving payments from ransom totals exceeding $75 million across multiple victim companies. A federal judge sentenced Martino to 70 months in prison for his cybercrime scheme.

Writing an Evasive .NET Shellcode Loader

slashsec.at · 3 months ago

Bad actors evade EDR by using DLL Sideloading and.NET AppDomain Manager Hijacking for memory-based shellcode execution in trusted processes.

148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

thehackernews.com · 3 months ago

JFrog researchers analyzed a campaign involving 148 npm packages disguised as student web proxies. The attackers used these packages to turn visitors' browsers into a distributed denial-of-service botnet over two weeks in May. Operators leveraged the registry as free hosting for a booby-trapped proxy site, targeting general users rather than developers.

Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules

www.securityweek.com · 3 months ago

Pentagon suspends CMMC Phase 2 requirements for 60 days pending a review. This targets streamlining compliance for manufacturers handling federal data. No CVEs or victim counts are cited in this summary.

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

thehackernews.com · 3 months ago

Attackers mimicking data-extortion group ShinyHunters infiltrated corporate Salesforce environments over the past year without exploiting any technical flaws. Instead, they bypassed security mechanisms by leveraging existing organizational trust. These successful attacks targeted OAuth connections linking Salesforce to third-party applications and vendors.

Why programming true randomness in emulators is a developer worst nightmare

gbhackers.com · 3 months ago

Emulator developers must deterministically recreate analog, non-precise hardware functions using modern software. Retro consoles generated "randomness" by hashing counter values or button press timing rather than true entropy. Maintaining strict cycle accuracy remains critical; even a single missed clock cycle desynchronizes the emulator and corrupts subsequent game states.

ShinyHunters Hackers Abuse Salesforce OAuth to Bypass MFA and Exfiltrate CRM Data

gbhackers.com · 3 months ago

ShinyHunters targeted retail/education (2025-2026) via OAuth abuse. They bypassed MFA using vishing to trick users into authorizing malicious apps with stolen vendor credentials for data exfiltration. Attacks hit multiple tenants.

Enhancing IIoT Security Using Digital Twins in Industry

research.torrens.edu.au · 3 months ago

Torrens University reviewed 110 studies, finding Digital Twins vital for IIoT defense. Low-bandwidth sensors are weak points as system lag lets attackers exploit real-world gaps before twins update, challenging Industry 5.0 security.

Pro-Iran Hacktivist Groups Launch DDoS and Hack-and-Leak Attacks Against Critical Infrastructure

gbhackers.com · 3 months ago

Pro-Iran hacktivists target Western allies via DDoS attacks and credential leaks. Groups include the Islamic Cyber Resistance in Iraq (targeting Canonical) and Handala (claiming action against Stryker).

ModHeader Chrome Extension Exposes 900,000 Users to Potential Browsing History Theft

gbhackers.com · 3 months ago

ModHeader v7.0.187.0.187.0.18 collected browsing history from ~900k users via device fingerprinting/AES-GCM encryption. Google removed the extension after disclosure; remove all instances now.

Critical ServiceNow AI Platform Flaw Allows Unauthenticated Attackers to Escape Sandbox and Execute Remote Code

gbhackers.com · 3 months ago

ServiceNow deployed security updates addressing a critical sandbox-escape flaw, CVE-2026-6875, affecting its AI Platform. This vulnerability allows unauthenticated attackers to execute remote code within impacted environments. Customers must promptly upgrade self-hosted instances or verify that vendor-deployed patches are applied to hosted platforms.

Telegram’s t.me Domain Suspended, Breaking Invite and Channel Links Worldwide

gbhackers.com · 3 months ago

The me registry suspended Telegrams core short-link domain, t.me, by placing it under a serverHold status. This action removes the domain from global DNS, rendering associated links, including invite URLs and bot addresses, inaccessible worldwide. While native messaging may bypass this disruption, link redirection systems face severe operational challenges affecting communication channels.

NSA Warns Russian State-Sponsored Hackers Exploiting Vulnerable Routers to Target Critical Infrastructure

gbhackers.com · 3 months ago

NSA warns Russian state-sponsored groups (FSB's Center 16) exploit routers in energy/finance. Attack targets infrastructure via unpatched gear. Upgrade firmware, use strong creds, block TFTP/SNMPv3 at firewalls. Defend critical sectors now.

Governments to enterprises: Improve your router security hygiene

www.csoonline.com · 3 months ago

Russian state actors exploit poor router hygiene in energy/healthcare. Attackers use SNMPv1/v2 or target Cisco via CVE-2008-4128 and CVE-2018-0171, risking credential theft across sectors. Secure old network devices immediately.

AXON Body camera 3 of 4 hardware reverse cracking output video！

b23.tv · 3 months ago

Individuals are selling second-hand AXON body cameras in China, often activating them illegally due to regional market restrictions. This practice presents a serious security risk because these devices may contain confidential video footage from American enterprises and police departments. Such illicit trade poses a threat of leaking sensitive, unpublished law enforcement data.

US authorities warn of Russian attacks on critical infrastructure

www.csoonline.com · 3 months ago

US authorities NSA, FBI, and CISA warned that Russian hackers launched attacks on critical infrastructure across North America and Europe. Hackers exploit vulnerable or misconfigured routers to breach sectors including energy, healthcare, communication, and defense. International partners, including Australia and Canada, support these warnings regarding necessary security patching efforts.

ExporTheft: 11 "AI Chat Exporter" Chrome extensions upload full chat content on PDF export, while the store listing says "No uploads to external servers"

malext.io · 3 months ago

Eleven extensions, using a single codebase for ChatGPT, Claude, and Gemini chat exporting, advertise local-only operation. Researchers analyzed these tools and found that the default PDF export posts entire conversations to a developer's Cloud Run backend. Furthermore, Markdown/Text/JSON exports beacon titles and source URLs to an external usage API.

Defending SaaS-based applications against ShinyHunters OAuth abuse

www.microsoft.com · 3 months ago

Microsoft Threat Intelligence identified threat activity linked to ShinyHunters. The group uses overlapping tradecraft that includes supply-chain compromise and voice phishing (vishing). Attackers specifically target SaaS applications by exploiting misconfigured guest access or abusing OAuth protocols.

Weak Security Continues to Fuel Russian Cyberattacks

www.darkreading.com · 3 months ago

UK/EU sanctioned Russian GRU officials for cyberattacks, election interference. US warns FSB's Center 16 exploits weak routers globally, threatening critical infra. Basic router hygiene is key to defending against these state actors.

CET-Compliant Callstack Spoofing via Thread Pool & Enum Callback Trampolining (Rust PoC)

mrtiz.github.io · 3 months ago

Researcher bypassed EDR on Intel hardware with CET callstack spoofing. It uses thread pool execution for bases, enum callback trampolining for frames, and indirect syscalls. Compliance relies on jmp-based context switches and shadow stack pointer reconciliation via RDSSPQ/INCSSPQ. This exploit bypasses security controls.

Japan's largest taxi operator shuts systems after cyberattack

www.bleepingcomputer.com · 3 months ago

Japan's largest taxi operator, Nihon Kotsu, reported its systems suffered a cyberattack involving malware infection. The company implemented emergency measures, shutting down key infrastructure including dispatch services to prevent further damage. Experts are now assisting the firm in recovering operations and investigating potential data leaks resulting from the incident.

Hackers backdoor Jscrambler npm package with infostealer malware

www.bleepingcomputer.com · 3 months ago

Jscrambler's npm package (v8.14-8.20) was compromised via stolen credentials, allowing an infostealer to target source code and secrets. Socket detected it, leading to deprecation within two hours. Jscrambler has since improved its release pipeline security controls.

New CrashStealer malware poses as Apple crash reporting tool

www.bleepingcomputer.com · 3 months ago

CrashStealer macOS malware uses a notarized installer to bypass Gatekeeper. It steals browser credentials, MetaMask keys, and 14+ password manager secrets via an admin password prompt. The data is encrypted with AES-256-GCM.

'Yellow Teams' Are Defining the Future of AI Security

www.darkreading.com · 3 months ago

Yellow teams are using AI like Anthropic's Project Glasswing and OpenAI's Daybreak to build standards. Red teams test models such as Claude Mythos and GPT 5.5 against systems. Human analysts are still vital for spotting missed, context-specific vulnerabilities.

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks

thehackernews.com · 3 months ago

Cybersecurity researchers flagged CrashStealer, a new macOS information stealer capable of harvesting sensitive data. Unlike existing stealers using AppleScript or Objective-C wrappers, CrashStealer implements its payload in native C++. The malware validates the victim’s login password directly on compromised systems.

Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found

thehackernews.com · 3 months ago

Google and Microsoft pulled ModHeader, a popular header-editing extension with 1.6 million installs on Chrome and Edge. Researchers found a hidden browsing-history collector built into the official store version. Although authorities report the collector remained dormant, Google and Microsoft removed the tool over security concerns.

Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID

www.microsoft.com · 3 months ago

Microsoft Entra ID makes passkeys the default sign-in experience for users. The platform also introduces a new model governing SMS and voice authentication methods. These changes strengthen overall security within Microsoft's identity infrastructure.

GigaWiper Lets Threat Actors Choose Their Own Destructive Attack

www.darkreading.com · 3 months ago

Modular malware GigaWiper combines backdoor command-and-control with wiper activities into a single implant. This modular design allows attackers to select destructive payloads on demand while retaining extensive operational capabilities via backdoor commands. Microsoft identified the versatile tool, calling it BlueRabbit, after tracking its disruptive activity starting in October 2025.

Meta Removes Muse Image Instagram Feature After Consent Backlash

www.techrepublic.com · 3 months ago

Meta scrapped its Muse Image feature shortly after launch amid backlash regarding user privacy and consent. The removal followed concerns that the tool utilized public Instagram photos for image generation, prompting ethical scrutiny. This incident highlights growing industry focus on AI model data sourcing and usage rights.

Torq and Criminal IP Partner to Deliver Decision-Ready Threat Intelligence for Autonomous SOC Operations

gbhackers.com · 3 months ago

CyberNewswire announced a partnership integrating Criminal IP's intelligence with Torq’s AI SOC Platform. This integration enables organizations to automatically enrich indicators by connecting decision-ready threat data directly into security workflows. The system helps teams accelerate response times, analyzing assets and determining appropriate actions for malicious IPs or suspicious domains.

CISA warns of actively exploited RCE flaws in Joomla extensions

www.bleepingcomputer.com · 3 months ago

CISA warns of actively exploited flaws in two Joomla extensions that allow remote code execution (RCE). The vulnerabilities are CVE-2026-48939, affecting iCagenda, and CVE-2026-56291, impacting Balbooa Forms. Attackers exploit these plugins through arbitrary file uploads, enabling full website compromise by executing malicious scripts.

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More

thehackernews.com · 3 months ago

Automated security tools rapidly discover vulnerabilities faster than human remediation processes can fix them. Attackers utilize these same powerful tools, often exploiting older flaws because patches sit in development queues. The weekly recap specifically warns users about threats targeting ShareFile and Citrix systems.

Lessons Learned from CISA’s Recent GitHub Leak

krebsonsecurity.com · 3 months ago

A contractor leaked dozens of internal CISA credentials and AWS GovCloud keys in a public GitHub repository for months. GitGuardian discovered the sensitive leak, but CISA’s postmortem reported the agency needed over 48 hours to invalidate many key secrets due to system complexities. The report urges organizations to establish clear reporting channels and maintain key management capabilities.

U.S. Electric Vehicle Sales are Down but E.V. Chargers are Booming

www.nytimes.com · 3 months ago

Electric vehicle chargers are proliferating in Southern states as fast food restaurants, stores and other businesses try to lure customers.

Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption

www.securityweek.com · 3 months ago

Jesse McGraw recounts his early hacking journey, noting he initially used social engineering rather than complex tools. He admitted pursuing system breaches solely for the thrill, developing his blackhat hacker tendencies without understanding morality. After serving eleven years in prison for his actions, McGraw now works as a cybersecurity advocate.

Lidl discloses online shop breach after service provider hack

www.bleepingcomputer.com · 3 months ago

Lidl suffered a data breach from a service provider hack, exposing customer PII (names, emails, DOBs, phone numbers) for German, Belgian, and Dutch online shoppers. Consumers are warned about identity fraud risks.

Fake Bank Apps Let Scammers Control Android Phones in Southeast Asia

www.techrepublic.com · 3 months ago

Group-IB found RedHook malware targeting Southeast Asia Android phones via fake banking/gov apps. Scammers trick users into installing it and granting permissions like Accessibility access/Wireless Debugging, allowing data theft and remote control. The malware steals one-time codes from exposed financial accounts.

Breach at the Beach: Play the Ultimate Entra ID CTF

www.bleepingcomputer.com · 3 months ago

Varonis developed Breach at the Beach CTF to educate defenders on detecting attacks exploiting Entra ID. The training simulates real-world steps to uncover data exfiltration techniques in cloud environments. Developers emphasize that non-human identities increasingly expand the attack surface, complicating detection across modern AI infrastructures.

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

thehackernews.com · 3 months ago

Attackers can exploit AI assistants that connect to a user's inbox and maintain memory. A single malicious email tricks the agent into saving false "facts" about the user. This implant modifies system knowledge, allowing attackers to secretly steer future answers without raising suspicion.