Blahalla

Russian FSB-Linked Turla Hackers Target French Ministries, Embassies, and Defense Entities

gbhackers.com · 3 months ago

French authorities link cyber-espionage targeting government/defense entities to Turla, linked to Russia's FSB 16th Center. The operation, using malware like Uroburos, affected French ministries since the 2010s in an intelligence mission.

UK charges suspects linked to Russian Coms call spoofing platform

www.bleepingcomputer.com · 3 months ago

UK authorities charged five people after a National Crime Agency investigation into Russian Coms, a major caller ID spoofing platform. Criminals used the site to execute over 1.3 million scam calls globally, stealing funds from an estimated 170,000 victims. Charges against the suspects include fraud conspiracy and transferring criminal property.

Hackers Can Exploit RabbitMQ OAuth Flaw to Access Every Message, Queue, and User

gbhackers.com · 3 months ago

Miggo Security found two RabbitMQ flaws: CVE-2026-57219 lets unauthenticated attackers steal OAuth secrets for admin control. A second bug lets low-privilege users enumerate queues in multi-tenant setups. Update immediately to secure your broker.

Adaptive Malware Could Evade Signature Detection by Regenerating Its Attack Capabilities

gbhackers.com · 3 months ago

AI malware challenges defenses by regenerating attack logic. POCs used recursive reasoning on mixed networks. Full autonomous zero-day generation still faces reliability hurdles.

Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

thehackernews.com · 3 months ago

Phishing-as-a-Service operation Forg365 targets Microsoft 365 accounts, distributing its services via Telegram for a monthly fee. The group employs attack chains combining device code phishing and adversary-in-the-middle tactics. These schemes further leverage AI-assisted lure creation and anti-bot evasion for post-compromise mailbox operations.

Turning the Tables on Email Scammers With 'ScamBuster'

www.darkreading.com · 3 months ago

ScamBuster, an open-source AI from Laurent Giovannoni, uses victim personas (e.g., widow, small business owner) to engage phishing emails. This allows law enforcement to collect key forensic data on cybercriminals.

Attackers Combine MCP Recon With Cloud Metadata SSRF to Steal Service Account Tokens

gbhackers.com · 3 months ago

Attackers target Model Context Protocol (MCP) and local LLM endpoints. They probe MCP init combined with SSRF attacks on cloud metadata to steal AI config/service tokens.

Cybersecurity M&A Roundup: 37 Deals Announced in June 2026

www.securityweek.com · 3 months ago

SecurityWeek reported thirty-seven cybersecurity M&A deals announced in June 2026. Key transactions include Accenture acquiring Dragos and runZero for $4.175 billion to build an integrated OT platform. Additionally, Cisco intends to acquire WideField Security to boost Splunk’s identity threat detection capabilities while 1Password acquires Apono to enhance its identity security platform.

RabbitMQ flaws expose OAuth secrets, risk complete takeover of the broker

www.csoonline.com · 3 months ago

RabbitMQ has two flaws: CVE-2026-57219 lets unauthenticated users steal OAuth secrets risking takeover; CVE-2026-57221 allows low-privs to find queue metadata. Upgrade to patched versions like 4.2.6 and rotate secrets immediately.

RabbitMQ Vulnerability Threatens Enterprise Systems

www.securityweek.com · 3 months ago

Miggo: RabbitMQ has two flaws. CVE-2026-5721 leaks OAuth secrets via unauthenticated endpoint, enabling broker impersonation. CVE-2026-57221 lets any authenticated user read exchange stats, risking multitenancy data exposure. Users should apply patches immediately.

Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling

thehackernews.com · 3 months ago

Meta patented an AI system designed to continuously monitor users' voices throughout the day. The technology assesses a person’s emotional state based solely on vocal tone and records every interaction in a timestamped log. This detailed log links events to precise location, time, and current phone usage.

Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots

thehackernews.com · 3 months ago

A security expert observed a Fortune 50 company planning AI agent integration into their Security Operations Center. The team connected Claude to detection tools, already realizing value in specific investigations. Mapping out the wider architecture revealed potential architectural challenges for the program.

EU sanctions Russian GRU military hackers over cyberattacks

www.bleepingcomputer.com · 3 months ago

EU/UK sanctioned Russian entities over hacking. Accusations target FSB's 16th Centre for groups like Turla, hitting Poland's critical infra since 2010. Sanctions also hit Lumma Stealer and IMPULS. Officials claim Russia runs these coordinated attacks.

Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory

thehackernews.com · 3 months ago

Researchers flagged an intrusion where an unknown group used a PowerShell script for Active Directory enumeration. The attacker mapped Domain Controllers and extracted information regarding users and computers across the domain. This process involved creating a directory, exporting files, and generating ADReport.html to measure the successful activity.

AI Data Centers and the Concentration of Wealth

www.schneier.com · 3 months ago

Local opposition to AI data centers reflects legitimate concerns regarding resource allocation and environmental impact. However, this focus obscures the deeper threat of power concentration as AI companies target entire industries for monopolization. These corporations aim to capture value in sectors including legal services, creative design, and enterprise software development.

Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More

gbhackers.com · 3 months ago

The Debian Project released 13.6, a point update with critical bug fixes for its stable "trixie" distribution. The release patches vulnerabilities across core packages like Apache HTTP Server, Curl, and QEMU while updating the kernel ABI to version 6.12.94+. Additionally, Debian updated fwupd to address expiring Secure Boot Certificate Authority keys, urging users to install OEM-provided updates.

BusySnake Stealer Uses Reverse SSH Tunnels and AI-Generated Loaders to Evade Detection

gbhackers.com · 3 months ago

Armored Likho (Eagle Werewolf) hit govt/power orgs in Russia, Brazil, & Kazakhstan with BusySnake Python infostealer. It steals credentials, crypto files, and session data via spear-phishing using AI loaders and reverse SSH tunnels.

Zimbra Patches Critical Code Execution Vulnerability

www.securityweek.com · 3 months ago

A critical stored Cross-Site Scripting vulnerability affects the Zimbra Classic Web Client, allowing attackers to execute malicious code through opened crafted emails. Google Threat Analysis Group reported this zero-click flaw, which could compromise user session data and account settings. Zimbra urges all customers to upgrade immediately to version 10.1.19 to patch the defect.

Jurassic Park, cybersecurity and the dangerous myth of control

www.csoonline.com · 3 months ago

The article uses Jurassic Park to warn that cybersecurity teams mistake mere visibility for actual system control. Security groups often assume success based on compliance reports and monitoring tools, neglecting fundamental resilience planning. Defenders must anticipate nation-state attacks and AI-driven exploit discovery while accepting compromise as inevitable rather than exceptional.

EU Targets Russian Intelligence Officers Accused of Running a Yearslong Cyber Spying Campaign

www.securityweek.com · 3 months ago

EU sanctioned Russian intelligence officers and four entities over cyber espionage targeting 9 governments since 2010. The alleged sabotage hit critical infrastructure like power plants, linked to FSB activities.

Europe Takes Step Toward Possible Social Media Ban for Children

www.nytimes.com · 3 months ago

The European Commission considers changing rules across its 27 member nations following a new report release. These proposed changes affect technology regulation within the bloc, targeting stricter policies around social media access for minors.

Europe Takes Step Toward Possible Social Media Ban for Children

www.nytimes.com · 3 months ago

The European Commission considers revising technology regulations across its 27-nation bloc following a new report release. This potential rule change signals regulatory shifts affecting digital platforms within the EU.

Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

blog.amberwolf.com · 3 months ago

Researchers disclosed multiple vulnerabilities affecting Dell systems, impacting both BIOS security and operating environments. Weak XOR encryption within the BIOS allows attackers to recover passwords directly from SPI flash, documented as CVE-2026-40639. Additionally, another flaw, CVE-2025-32752, exposes unencrypted memory dumps within Dell ThinOS systems.

US and allies warn of Russian critical infrastructure attacks

www.bleepingcomputer.com · 3 months ago

U.S. and allied nations warned that Russian state hackers from FSB Center 16 target vulnerable routers to infiltrate critical infrastructure networks. These groups scan for default SNMP strings and exploit flaws like CVE-2018-0171 affecting Cisco IOS XE software. Defenders must harden networks by upgrading to SNMPv3, blocking TFTP/SNMP traffic at firewalls, and updating device firmware promptly.

Organizations Warned of Exploited Joomla Extension Vulnerabilities

www.securityweek.com · 3 months ago

Exploitation of vulnerabilities in the Balbooa Forms (CVE-2026-56291) and iCagenda Joomla extensions allowed unauthenticated attackers to achieve remote code execution through arbitrary file upload features. CISA added both extension defects to its Known Exploited Vulnerabilities catalog, urging organizations to patch immediately.

The eBay Scandal Gets a Thriller-Like Documentary

www.nytimes.com · 3 months ago

The documentary 'Whatever It Takes' examines a plot involving eBay workers to cyberstalk journalists and critics. The exposé revealed how company employees monitored and harassed individuals who criticized the platform.

Your AI risk register is not an incident response plan

www.csoonline.com · 3 months ago

Risk registers lack actionable AI failure plans for live workflows. Teams need incident response protocols: identifying system shutdown authority and containment methods for inaccurate model output. Organizations must implement procedures for evidence preservation, impact assessment, and operational readiness when incidents occur.

CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws

gbhackers.com · 3 months ago

CISA added two file upload vulnerabilities in iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. These flaws permit unrestricted uploads, allowing malicious scripts via CVE-2026-48939 and CVE-2026-56291. Organizations must urgently patch these vulnerabilities to prevent potential remote code execution or system compromise.

Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace

gbhackers.com · 3 months ago

APT-C-60 targets Japanese orgs with spear-phishing using Proton Drive/LNK files for SpyGlace malware. Attackers use multi-stage infection, tricking victims into running shortcuts launching mshta.exe to fetch payloads via jsDelivr and git.exe. They are actively targeting these organizations.

Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns

www.securityweek.com · 3 months ago

Progress Software told ShareFile customers to manually shut down Storage Zone Controller servers while investigating a security issue. The company warned that linking potential flaws in CVE-2026-2699 and CVE-2026-2701 could enable remote code execution without authentication. Access restrictions remain temporary as Progress continues its assessment with cybersecurity experts.

Critical WordPress OAuth SSO Plugin Flaw Allows Unauthenticated Attackers to Gain Admin Access

gbhackers.com · 3 months ago

miniOrange OAuth SSO (v <= 38.5.8) has critical auth bypass (CVE-2026-57807) via password recovery, granting unauthenticated admin access. Also note CVE-2024-10111. Deactivate the plugin immediately for all affected sites.

Centers Laboratory Data Breach Affects 540,000 Individuals

www.securityweek.com · 3 months ago

WorldLeaks claimed responsibility for stealing 720 GB of data from Centers Laboratory, a healthcare testing provider. The breach affected over 542,377 individuals and exposed protected health information, including names, SSNs, and medical records. Access occurred between August 9 and August 14.

Persistence via Fake AMSI Provider | Playbook & Detection Strategies

ipurple.team · 3 months ago

Individuals exploit the Antimalware Scan Interface (AMSI) by registering fake third-party providers with elevated permissions on Windows systems. AMSI directs potentially malicious PowerShell content through these registered providers for analysis before execution. Attackers abuse this behavior, executing code when defined trigger strings appear in the console to establish persistence.

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

thehackernews.com · 3 months ago

An attacker running a Microsoft 365 phishing operation inadvertently left evidence of their activities on a public server. Specifically, the command python3 -m http.server 8080 remained in the readable.bashhistory file. French security firm Lexfo capitalized on this lapse, exploiting the operator's toolkit and pivoting through it to gain further access.

Can AI narrow cybersecurity’s class divide?

www.csoonline.com · 3 months ago

At Amazon Web Services (AWS), artificial intelligence is already compressing security work that once took months into minutes. In the old world, human red teams would find vulnerabilities, write reports, refine those reports, and eventually hand them to defenders, who would then begin building detections or fixes, Steve Schmidt, chief security officer at AWS, tells CSO.

New VEXAIoT AI Agents Autonomously Exploit IoT Vulnerabilities With 95% Success Rate

gbhackers.com · 3 months ago

VEXAIoT, an autonomous multi-agent framework designed to discover and exploit vulnerabilities in the Internet of Things (IoT) within controlled test environments. In 200 attack trials against the intentionally vulnerable IoTGoat platform, the system completed 189 attacks, achieving an overall success rate of 94.5% (rounded to 95%).

Jscrambler npm Supply Chain Attack Steals Cloud Credentials and Crypto Wallet Secrets

gbhackers.com · 3 months ago

A malicious actor compromised the Jscrambler npm package and published several trojanized versions that included a hidden, cross-platform credential-stealing payload. The attack targeted developers, build pipelines, and CI/CD systems, where npm installations could access source code, cloud credentials, deployment tokens, and sensitive environment variables.

Exposed Server Unmasks Evilginx Operators Stealing Microsoft 365 Sessions and OAuth Tokens

gbhackers.com · 3 months ago

A misconfigured server in Budapest exposed a live phishing operation built to bypass Microsoft 365 multi-factor authentication and retain access to compromised accounts. The server, hosted at 185.163.204[.]7185.163.204[.]7185.163.204[.]7, was running python3 -m http.server 8080 with directory listing enabled, making its operational files publicly accessible.

LIEF 1.0.0 is out featuring a brand-new Runtime API

lief.re · 3 months ago

LIEF 1.0.0 is officially out with a brand-new Runtime API and DWARF/PDB to C/C++ generation!

Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT

gbhackers.com · 3 months ago

Operation Capsule Vault began with spear-phishing emails sent on June 22, 2026, posing as notices distributing materials from a legitimate academic event. The lures referenced the “Why Wonsan-Kalma Tourism Now?” conference, held at Seoul COEX on June 12, and incorporated publicly available event details, including its subject matter and host organizations.

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

thehackernews.com · 3 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.

Microsoft Tests AI-Powered Copilot Tool to Diagnose Windows 11 Performance Issues

gbhackers.com · 3 months ago

Microsoft is gradually rolling out an optional Copilot feature called PC Insights, which provides the AI assistant with access to real-time information about Windows 11 hardware and performance. This feature, first reported by Windows Latest, is currently being tested with users in the United States and is not yet widely available.

New GhostCommit Technique Hides Exploits in Images to Evade AI Code Reviewers

gbhackers.com · 3 months ago

Researchers have revealed a technique called “GhostCommit,” which involves prompt injection by hiding malicious instructions within images included in pull requests. This technique has the potential to bypass text-only AI code reviewers and later manipulate coding agents into exposing repository secrets.

OpenAI temporarily relaxes GPT-5.6 Sol usage limits

www.bleepingcomputer.com · 3 months ago

OpenAI temporarily lifted the five-hour usage restriction for Plus, Pro, and Business plans after facing high demand for its most powerful model over 48 hours. The company also reset current usage limits across all plans. Additionally, OpenAI improved GPT-5.6 Sol's efficiency to reduce token consumption, helping users work longer before hitting their allotted cap.

Vulnerability in Realtek driver allows DMA controller abuse from user mode with no additional hardware or driver

zwclose.github.io · 3 months ago

A vulnerability in the Realtek SD card reader driver exposes device registers to non-privileged users. This flaw permits user mode applications to program the DMA controller, enabling arbitrary physical memory reads and writes. Researchers successfully developed a complex proof-of-concept demonstrating direct access to the host's first 4GB of physical memory.

Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time

www.bleepingcomputer.com · 3 months ago

Anthropic extended paid subscriber access to Claude Fable 5 until July 19. The promotion applies across Pro, Max, Team, and premium Enterprise subscriptions. Anthropic warns users that Fable 5 consumes the weekly usage limit quickly compared to other available models.

CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.sys

byteray-ai.github.io · 3 months ago

Critical RCE in Windows HTTP.sys (CVE unknown) via unauthenticated exploit. Integer overflow in UlpParseNextRequest causes kernel pool buffer overflow, overwriting memory.

RedHook Android malware now uses Wireless ADB for shell access

www.bleepingcomputer.com · 3 months ago

RedHook malware abuses Android's Wireless Debugging, tricking victims for Accessibility permissions. It activates ADB via the loopback interface and uses Shizuku to gain shell privileges (UID 2000) for data theft and screen streaming.

Cybersecurity Newsletter Weekly – The 40 Biggest Cybersecurity Stories – Accenture Breach, AI Attack, Exploits Releases, Data Breaches & More

gbhackers.com · 3 months ago

CVE-2025-5777 in CitrixBleed 2 allows MFA session hijacking for lateral movement. Claude AI prompt injection turns chatbots into C2 agents with RCE. IonStack exploit chain grants root on Android 17 via one link click. Threat actors must patch these vulnerabilities immediately.

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

thehackernews.com · 3 months ago

The jscrambler npm package version 8.14.0 ships with a malicious preinstall hook. This hook silently drops and executes a native infostealer build for Windows, macOS, and Linux during installation. Users only need to install this specific version to run the payload without further commands or imports.