Blahalla

MITRE Releases Fight Fraud Framework

www.securityweek.com · 3 months ago

MITRE released the Fight Fraud Framework, a behavior based knowledge base that models the tactics, techniques and procedures fraudsters use, informed by real world attacks. The framework adds two fraud specific tactics, positioning which covers post compromise actions to collect and manipulate data and prepare follow up execution, and monetization which covers converting compromised assets into usable value, and it revises definitions of tactics such as reconnaissance, resource development, initial access, defense evasion and execution. The resource is open and free, includes a website and a visual representation, documents design principles and methodology, and provides a GitHub repository for additional resources and collaboration.
Critical Marimo Flaw Exploited Hours After Public Disclosure

www.securityweek.com · 3 months ago

A critical unauthenticated remote code execution vulnerability in Marimo, tracked as CVE-2026-39987 with a CVSS score of 9.3, allowed attackers to obtain a full interactive shell via the terminal WebSocket endpoint because authentication validation was skipped. An attacker built a working exploit from the public advisory and began exploiting the flaw roughly nine hours and forty-one minutes after disclosure to connect to the unauthenticated endpoint, perform quick reconnaissance, and steal credential-containing files. Sysdig observed exploitation activity from a single IP with an additional 125 addresses conducting reconnaissance, and the attack captured by a honeypot lasted about three minutes during which the actor attempted to read every file in the targeted directory and search for SSH keys. All Marimo releases up to version 0.20.4 are affected and users are advised to update to version 0.23.0 or newer where the bug is fixed.
Middle East Espionage Attack Uses Fake Secure Messaging Apps to Deliver ProSpy

gbhackers.com · 3 months ago

Hackers impersonate popular secure messaging apps to deliver an Android spyware family called ProSpy against journalists, activists, and political figures across the Middle East in a hack for hire campaign linked to the BITTER APT group. The campaign has been active since at least 2022 and primarily targets civil society and potential government figures in countries including Egypt, Lebanon, Bahrain, the United Arab Emirates, Saudi Arabia, and the wider MENA region. Operators use social engineering on platforms such as LinkedIn, messaging apps, or email to lure victims to fake download pages that deliver malicious APKs outside official stores under names like ToTok Pro, Botim Pro, or Signal Encryption Plugin. Once installed, ProSpy gains broad permissions, uses a modular worker design to collect and exfiltrate contacts, SMS, call data, device information, documents, images, audio, video, archives and chat backups, and communicates with command and control servers to upload stolen content.
HPE Aruba Private 5G Vulnerability Opens Door to Credential Theft Attacks

gbhackers.com · 3 months ago

A newly disclosed security flaw in HPE Aruba Networking Private 5G Core On-Prem allows threat actors to silently harvest administrative login credentials through the platform graphical user interface. The defect is documented in security bulletin HPESBNW05032ENUS and tracked as CVE-2026-23818. Enterprises running the on-premises Private 5G Core face severe risk of credential theft and are advised to apply vendor mitigations and updates from the security bulletin promptly.
The cyber winners and losers in Trump’s 2027 budget

www.csoonline.com · 3 months ago

Federal civilian cybersecurity spending is proposed to decline from 12.455 billion dollars in 2026 to 12.228 billion dollars in 2027, a drop of about 227 million dollars, with uneven gains and losses across agencies. The biggest winners are the Department of Justice, which would gain 312 million dollars to reach 1.27 billion dollars, and the State Department, which would gain 174 million dollars to reach 809 million dollars. Largest cuts hit the Department of Homeland Security, down 222 million dollars to 3.05 billion dollars largely driven by a proposed 707 million dollar reduction at CISA, while the Department of Veterans Affairs, the National Science Foundation, the Department of Health and Human Services, and the Department of the Treasury face sizeable reductions and the Securities and Exchange Commission and the Federal Communications Commission are shown with zero cyber funding in the proposal. The CISA reductions would eliminate roughly 867 positions representing about 766 full time equivalents and slash stakeholder engagement staff and budget, and observers warn the cuts will weaken federal support for private sector cyber defense and urge organizations to audit CISA dependencies, expand private threat intelligence relationships, and revisit compliance assumptions.
CMMC compliance in the age of AI

www.csoonline.com · 3 months ago

CMMC 2.0 is forcing federal contractors to demonstrate how they protect controlled unclassified information by documenting scope, justifying chosen safeguards, and showing consistent operation under assessor scrutiny, increasing accountability for CISOs. Many organizations still fail to fully map CUI and rely on manual administrative processes that scatter evidence and create inconsistencies, while automation of workflows is presented as the path to stable, verifiable control execution. AI can help summarize evidence, correlate signals and flag anomalies but must be governed to prevent data exposure and to avoid amplifying problems from poor quality inputs, so resilient programs combine clear data scope, standardized automated administrative controls, governed AI use, and evidence woven into daily operations.
TP-Link Devices at Risk as Multiple Security Flaws Enable Takeover

gbhackers.com · 3 months ago

Five significant security vulnerabilities have been found in the TP-Link Archer AX53 v1.0 router that, if unpatched, can let attackers gain full control of the device, steal network data, and compromise connected systems. The flaws include operating system command injection in the OpenVPN and dnsmasq modules tracked as CVE-2026-30815 and CVE-2026-30818 with CVSS v4.0 scores of 8.5, a stack based buffer overflow in the tmpServer module tracked as CVE-2026-30814 with a CVSS score of 7.3, and two file access vulnerabilities tracked as CVE-2026-30816 and CVE-2026-30817 that permit arbitrary file reads. These issues affect firmware versions older than 1.7.1 Build 20260213 and require local network access to exploit, but their severity makes immediate remediation urgent. Users are advised to install the latest firmware from TP-Link to patch these vulnerabilities and protect connected devices; the affected hardware version is not sold in the United States but is widely deployed in other markets.
Renovate & Dependabot: The New Malware Delivery System

blog.gitguardian.com · 3 months ago

Supply chain attacks are increasing and dependency update automation is now being used as a rapid malware distribution channel. A malicious axios release uploaded on March 31, 2026 triggered hundreds of automated upgrades by Renovate and Dependabot, with at least 895 public repositories moving to the malicious version and dozens of bot-opened pull requests merged into main branches within an hour. Automated merge workflows and bots that update pinned workflow commit SHAs can execute malicious code and expose secrets, especially when workflows run with pull request target privileges. Defenses include applying three to five day cooldowns, configuring Renovate minimumReleaseAge and Dependabot cooldown settings, preventing automated updates of pinned SHAs, inventorying machines and AI agents that install dependencies, and improving secret observability and honeytokens.
Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows

thehackernews.com · 3 months ago

Device Bound Session Credentials are now generally available to Windows users on Chrome 146, with macOS expansion planned in an upcoming release. DBSC cryptographically ties authentication sessions to a device using hardware backed key stores such as the Trusted Platform Module on Windows and the Secure Enclave on macOS, requiring Chrome to prove possession of a private key before new short lived session cookies are issued so exfiltrated cookies become useless. If a device lacks secure key storage DBSC falls back to standard behavior to avoid breaking authentication, and early deployment has shown a significant reduction in session theft according to the vendor. The architecture is designed to be privacy preserving by not leaking device identifiers or attestation data beyond the per session public key, and the standard was developed in collaboration with Microsoft to be an open web standard.
Google Rolls Out Cookie Theft Protections in Chrome

www.securityweek.com · 3 months ago

Google rolled out cookie theft protections in Chrome that introduce Device Bound Session Credentials which cryptographically bind authentication and render stolen session cookies unusable. This ties session credentials to the original device so cookies cannot be replayed from other devices, reducing the risk of account takeover.
Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure

thehackernews.com · 3 months ago

A critical pre-authenticated remote code execution vulnerability in Marimo, tracked as CVE-2026-39987 with a CVSS score of 9.3, impacts all versions prior to and including 0.20.4 and was fixed in version 0.23.0. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands through a single WebSocket connection. Sysdig observed exploitation of the flaw within 9 hours and 41 minutes of public disclosure, with an attacker harvesting credentials and reading the.env file on a honeypot, although no miners or backdoors were installed. The incident shows that internet facing applications with critical advisories can be weaponized rapidly, compressing the time defenders have to respond between disclosure and patch adoption.
Microsoft Finds Vulnerability Exposing Millions of Android Crypto Wallet Users

www.securityweek.com · 3 months ago

Microsoft security researchers discovered that a widely used third party Android SDK for messaging and push notifications, EngageLab's EngageSDK, contains an intent redirection vulnerability that can be exploited to manipulate intents and expose highly sensitive data in mobile apps. The SDK is integrated into crypto wallet applications with more than 30 million installations, and a malicious app on a device can send crafted intents to bypass the Android security sandbox and access personal information, user credentials, and financial data. Microsoft reported the flaw to EngageLab in April 2025 and to the Android Security Team in May 2025, affected apps were removed from Google Play, and EngageLab released a patch in early November 2025 as version 5.2.1 while Android mitigations should protect previously downloaded users. Microsoft found no evidence of exploitation in the wild and published technical details urging developers to update to the fixed SDK version.
New React Server Components Flaw Could Let Attackers Trigger DoS

gbhackers.com · 3 months ago

A high severity vulnerability in React Server Components tracked as CVE-2026-23869 can allow unauthenticated attackers to trigger denial of service against web applications that use certain server side rendering packages. The flaw requires no privileges and involves low attack complexity, making it easy for threat actors to exploit. Administrators of affected systems are urged to apply available patches or mitigations and to monitor logs and network activity for signs of exploitation.
GitHub, GitLab Abused for Malware and Phishing Campaigns

gbhackers.com · 3 months ago

Hackers are increasingly abusing trusted software development platforms GitHub and GitLab to host malware and credential phishing campaigns, exploiting the platforms' deep integration with developer and business workflows to bypass traditional network and email defenses. About 95 percent of these operations leverage GitHub while about 5 percent use GitLab, with abuse growing year over year and roughly 45 percent of observed campaigns in 2025 alone; attackers stage malware via core domains and raw content URLs and use GitHub Pages and GitLab Pages to host credential phishing sites. More than 30 malware families have been observed, with Remcos responsible for about 21 percent of campaigns and other RATs such as Byakugan, Async RAT, and DcRAT widely used, prompting recommendations for fine grained URL inspection, behavioral analysis, and user awareness training.
MuddyWater Uses Russian MaaS in New ChainShell Attack

gbhackers.com · 3 months ago

MuddyWater is weaponizing a Russian malware as a service platform to run a new operation named ChainShell, blending Iranian state targeting with commercially developed criminal tooling. Investigators recovered a misconfigured command and control server and 15 malware samples, including a previously undocumented JavaScript Node.js agent called ChainShell that resolves its C2 via an Ethereum smart contract and communicates over AES 256 CBC encrypted WebSocket channels. The campaign also deployed multiple CastleRAT and CastleLoader builds from the TAG 150 ecosystem, used code signing certificates tied to MuddyWater linked infrastructure, and continued delivering updated installers and JavaScript RAT samples through March, prompting defenders in defense, energy, aerospace, and government sectors to treat these artifacts as strong indicators of MuddyWater activity.
Juniper Networks Default Credential Vulnerability Allows Unauthorized Full Access

gbhackers.com · 3 months ago

There is a critical default credential vulnerability in Juniper Networks Support Insights Virtual Lightweight Collector that allows remote, unauthenticated attackers to gain full control of affected network devices. The flaw is tracked as CVE-2026-33784 and Juniper internal JDEF-1032, affects all vLWC releases prior to 3.0.94, and carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. Juniper advises upgrading to release 3.0.94 or later to remediate the issue and recommends manually changing the default password as a temporary workaround.
Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers

thehackernews.com · 3 months ago

Unknown threat actors hijacked the update system for the Smart Slider 3 Pro plugin and distributed a poisoned Pro build, version 3.5.1.35 for WordPress, during a window on April 7, 2026 that lasted about six hours. The trojanized update installed a multi stage backdoor that enables pre authenticated remote code execution via custom HTTP headers, runs arbitrary PHP and operating system commands, creates hidden administrator accounts, and exfiltrates site and credential data. Nextend removed the malicious build, shut down its update servers, and advised users to update to version 3.5.1.36 and follow cleanup steps including removing unknown admin accounts and persistence files, reinstalling a clean plugin copy, resetting credentials, and enabling two factor authentication.
ChatGPT, Claude, and Gemini Among 11 AI Models Vulnerable to One-Line Jailbreak

gbhackers.com · 3 months ago

There is a newly discovered jailbreak technique named sockpuppeting that forces 11 leading AI models including ChatGPT, Claude, and Gemini to bypass safety guardrails by exploiting the assistant prefill API feature with a single line of code. The technique injects a fake acceptance response into the model response stream so the model, seeking self consistency, continues to produce restricted outputs including functional exploit code such as cross site scripting and in some cases leaks internal system prompts and metadata. Blocking prefilled assistant messages at the API layer and enforcing strict message ordering are the most effective mitigations and major providers have deployed such defenses while self hosted inference servers that do not validate message order remain at risk.
GlassWorm Trojan Hits VS Code, Cursor, Windsurf via OpenVSX Extension

gbhackers.com · 3 months ago

A supply chain campaign is spreading GlassWorm malware across developer environments by abusing the OpenVSX extension marketplace and has been tracked since March 2025 after attackers hid malicious payloads in npm packages using invisible Unicode characters. The operation uses a trojanized OpenVSX extension named code-wakatime-activity-tracker that executes a native Zig‑compiled Node addon which loads a DLL on Windows or a Mach O binary on macOS, scans for IDEs including Visual Studio Code, Cursor, Windsurf, VSCodium, and Positron, and then downloads and silently installs a malicious.vsix that impersonates popular extensions such as Auto Import. The installed extension acts as a dropper that connects to command and control infrastructure leveraging the Solana blockchain to deliver RATs and browser credential theft, selectively avoids certain regions, and affected users should remove suspicious extensions, rotate API keys and credentials, scan for persistence mechanisms, and monitor outbound connections.
DesckVB RAT Uses Fileless .NET Loader to Evade Detection

gbhackers.com · 3 months ago

DesckVB RAT is a highly active, stealthy remote access trojan that leverages layered obfuscation and a fileless.NET loader to execute payloads entirely in memory, minimizing forensic traces and evading antivirus detection. The attack chain starts with heavily obfuscated JavaScript that replicates its logic into PowerShell, uses execution policy bypass to run, checks internet connectivity, and then loads a.NET assembly into memory via a living-off-the-land utility to execute a DLL payload. Runtime analysis shows process creation and injection techniques, encrypted HTTPS command and control communications, and in-memory modules such as a keylogger and antivirus-detection component that enable data theft and persistent C2 connectivity.
AWS Fixes Severe RCE, Privilege Escalation Flaws in Research and Engineering Studio

gbhackers.com · 3 months ago

There are three major vulnerabilities in AWS Research and Engineering Studio that stem from unsanitized inputs and improper access controls and can enable remote code execution and privilege escalation. The flaws affect RES versions 2025.12.01 and earlier and are tracked as CVE-2026-5707, CVE-2026-5708, and CVE-2026-5709, with impacts including arbitrary command execution as root on virtual desktop hosts, command injection on the cluster-manager EC2 instance, and the ability to assume Virtual Desktop Host instance profile permissions via crafted API requests. AWS resolved the issues in RES version 2026.03 and recommends immediate upgrades or applying the documented patches and workarounds for environments that cannot upgrade.
WhatsApp Adds Username Feature to Boost Privacy and Reduce Number Sharing

gbhackers.com · 3 months ago

false
Slipping up Slippi with spectator RCE

khang06.github.io · 3 months ago

A remote code execution vulnerability in Slippi spectator mode allowed replay events that include Gecko codes to execute arbitrary guest code inside the emulator when a spectator connected. The root cause was an unchecked EXI DMA SRAM handling in older Ishiiruka and Faster Melee based playback builds, which produced an out of bounds read and write that corrupted a global SRAM structure and adjacent data. By abusing predictable Fastmem placement and the absence of ASLR in those legacy builds, an exploit forged fake CEXIChannel structures and virtual table entries to build a ROP chain and run shellcode on the host. The issue was fixed in Slippi Playback Dolphin version 3.5.2 released January 14, 2026 and the launcher updates it automatically.
Was CISOs von Moschusochsen lernen können

www.csoonline.com · 3 months ago

Cybersecurity experts suggest a new approach to third-party risk management, drawing inspiration from muskoxen behavior. This strategy involves companies collaborating to support and bolster the security of vulnerable vendors, as many assessments and response plans are not enough. This collective effort could share information and coordinate improvements for shared dependencies, although legal considerations may arise. The aim is to build a more robust cybersecurity posture, acknowledging that even this approach cannot eliminate all threats.
Hackers have been exploiting an unpatched Adobe Reader vulnerability for months

www.csoonline.com · 3 months ago

An unpatched Adobe Reader vulnerability has been exploited for months to fingerprint computers by running JavaScript in malicious PDFs that read language settings, the Reader version, the exact operating system version, and local PDF file paths and then exfiltrate that data to remote servers. Findings dated April 7, 2026 show the exploit worked against Adobe Reader version 26.00121367, and a variant traced to November 2025 indicates active use since at least then. Security experts warn this is a high risk zero click exploit that currently steals data but could enable follow on remote code execution and recommend disabling Acrobat JavaScript and filtering PDFs at email gateways and web proxies. A related use after free vulnerability was previously tracked as CVE-2025-54257.
New ‘LucidRook’ malware used in targeted attacks on NGOs, universities

www.bleepingcomputer.com · 3 months ago

There is a new Lua based malware called LucidRook being used in spear phishing campaigns targeting non governmental organizations and universities in Taiwan, with attacks observed in October 2025 and attributed by Cisco Talos to a threat group tracked as UAT 10362. Two infection chains were observed: an LNK shortcut that delivered a dropper named LucidPawn, and an executable that impersonated Trend Micro Worry Free Business Security Services; LucidPawn decrypts and deploys a legitimate executable renamed to mimic Microsoft Edge along with a malicious DLL named DismCore.dll to sideload LucidRook. LucidRook embeds a Lua interpreter to retrieve and execute Lua bytecode so operators can update functionality without altering the core loader, and it performs system reconnaissance, heavily obfuscates components, encrypts collected data with RSA into password protected archives, and exfiltrates data via FTP while a related tool called LucidKnight has been observed abusing Gmail GMTP for exfiltration.
How A.I. Helped One Man (and His Brother) Build a $1.8 Billion Company

www.nytimes.com · 3 months ago

false
New VENOM phishing attacks steal senior executives' Microsoft logins

www.bleepingcomputer.com · 3 months ago

Threat actors are using a previously undocumented phishing-as-a-service platform named VENOM to target Microsoft credentials of C-suite executives across multiple industries. The operation has been active since at least November 2025 and appears closed-access, using highly personalized emails that impersonate Microsoft SharePoint notifications, inject fake email threads, and include a Unicode QR code that pushes victims to mobile devices. The campaign double Base64-encodes target emails in URL fragments to evade logs and reputation feeds, filters out researchers by redirecting non-targets to legitimate sites, and either proxies a live Microsoft login to capture credentials, multi-factor authentication codes, and session tokens or uses device-code phishing to obtain access. Researchers warn that MFA can be bypassed by these techniques and recommend switching to FIDO2 authentication, disabling the device code flow when not needed, and enforcing stricter conditional access policies.
Russia's 'Fancy Bear' APT Continues Its Global Onslaught

www.darkreading.com · 3 months ago

There is an ongoing global campaign by Fancy Bear, also known as APT28, Pawn Storm, and Forest Blizzard, a cyber espionage group tied to Russian military intelligence, targeting governments, defense suppliers, energy organizations and other critical entities with phishing, credential theft and router compromises that include both espionage and destructive wiper capabilities. Trend Micro found two concurrent campaigns, Prismex which leverages multiple Windows vulnerabilities including a confirmed zero-day CVE-2026-21513 and Microsoft Office bug CVE-2026-21509 and uses steganography, COM hijacking and cloud service abuse, and NTLMv2 hash relay attacks that exploited Outlook vulnerability CVE-2023-23397 while the FBI warned of TP-Link router compromises via CVE-2023-50224 enabling DNS hijacking. Security experts advise focusing on fundamentals such as multifactor authentication, timely patching including of Microsoft Office, updating router firmware and changing default credentials, implementing zero trust and least privilege, and using managed detection or sector information sharing to limit the actor's ability to move after initial access.
'BlueHammer' Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues

www.darkreading.com · 3 months ago

A proof of concept exploit for a Windows zero day called BlueHammer was published under the alias Chaotic Eclipse on April 2, with the poster citing frustration with Microsoft and claiming the flaw was unpatched. The vulnerability combines a time of check to time of use race condition and path confusion in Windows Defender’s signature update system, allowing a local user to access the Security Account Manager database, obtain password hashes, and escalate to administrator privileges via pass the hash. Researchers report the exploit works on desktop Windows but not currently on Windows Server, its reliability is imperfect, and security experts warn that public exploit code increases the risk of rapid weaponization while urging organizations to apply mitigations, practice credential hygiene, and monitor systems until a patch is available.
Healthcare IT solutions provider ChipSoft hit by ransomware attack

www.bleepingcomputer.com · 3 months ago

On April 9, 2026, Dutch healthcare software vendor ChipSoft was hit by a ransomware attack that forced the company to take its website and patient and provider digital services offline. ChipSoft, operator of the HiX electronic health record platform used by many Dutch hospitals, circulated an internal memo warning of possible unauthorized access and advised institutions to disconnect from affected systems while cleanup proceeds. The national healthcare computer emergency response team Z CERT confirmed the ransomware incident and said it is working with ChipSoft and affected institutions, while ChipSoft disabled connections to its Zorgportaal, HiX Mobile, and Zorgplatform services. While some patient facing systems remained functional, outages were reported at several hospitals and ChipSoft had not responded to requests for comment at the time of the report.
The agentic SOC—Rethinking SecOps for the next decade

www.microsoft.com · 3 months ago

false
Cloudflare ‘actively adjusting’ quantum priorities in wake of Google warning

www.csoonline.com · 3 months ago

Google has moved its post quantum cryptography migration timeline forward to 2029 and is adding PQC support across Chrome, Android, and cloud services, prompting other industry leaders to accelerate their plans. Cloudflare is actively adjusting priorities, already protects more than half of its traffic against harvest now decrypt later attacks using ML KEM, and plans to deploy post quantum certificates in 2027. Experts warn that quantum computers threaten legacy public key systems such as RSA and elliptic curve cryptography, that adversaries may be collecting encrypted data to decrypt later, and that organizations should inventory cryptographic uses and build crypto agility across systems and supply chains.
Google Chrome adds infostealer protection against session cookie theft

www.bleepingcomputer.com · 3 months ago

Google rolled out Device Bound Session Credentials protection in Chrome 146 for Windows to block infostealer malware from harvesting session cookies. The feature cryptographically binds each session to hardware backed keys stored in a device security chip such as the Windows Trusted Platform Module or the macOS Secure Enclave, making the private keys non exportable so exfiltrated cookies expire or become unusable without the key. Issuance of new short lived session cookies requires Chrome to prove possession of the corresponding private key, testing with partners including Okta showed a notable decline in session theft, and the DBSC protocol is being developed as an open web standard with Microsoft while macOS support will arrive in a future Chrome release.
Hackers Exploit Adobe PDF Flaw for Months to Steal Data, No Fix Yet

www.techrepublic.com · 3 months ago

A critical zero day in Adobe Acrobat Reader has been actively exploited since at least December 2025 via malicious PDF files that silently steal local data and can enable remote code execution and sandbox escape, with no patch available as of April 9, 2026. The exploit triggers simply by opening a crafted PDF and abuses legitimate Acrobat APIs including util.readFileIntoStream and RSS.addFeed to access files and fingerprint the environment to tailor its actions. Campaigns identified so far used Russian language lures tied to the oil and gas sector, indicating targeted operations, though the technique could be adapted to other targets. Recommended mitigations include avoiding untrusted PDFs, disabling JavaScript and embedded content, enforcing protected or sandboxed modes, isolating PDF viewing in virtual desktops or sandboxes, restricting outbound connections, applying least privilege and privileged access management, and monitoring for unusual API calls and Adobe synchronizer user agent activity.
Do Ceasefires Slow Cyberattacks? History Suggests Not

www.darkreading.com · 3 months ago

With the United States and Iran reaching a fragile ceasefire this week, security researchers and executives are watching whether Iranian linked actors will pause cyber operations. History and expert analysis indicate military ceasefires rarely translate to a digital stand down, with cyber operations often remaining steady or flaring as an asymmetric pressure valve. The group Handala announced a temporary pause against the United States while saying attacks will continue against Israel, and lower level Iran aligned groups such as 313 Team and Conquerors Electronic Army have continued nuisance and targeted operations including an attack on an Australian government authentication portal and distributed denial of service attacks against Israeli targets and a US freelancer website. One notable exception occurred during negotiations for the 2015 Iran nuclear deal when malicious probes against US critical infrastructure dropped to zero but resumed after the agreement ended.
EngageLab SDK Flaw Exposed 50M Android Users, Including 30M Crypto Wallet Installs

thehackernews.com · 3 months ago

A now patched intent redirection vulnerability in the EngageLab Android SDK could have allowed malicious apps to bypass the Android security sandbox and access private data, potentially affecting more than fifty million installations including over thirty million cryptocurrency wallet installs. Microsoft Defender researchers said the issue was introduced in EngageLab version 4.5.4 and that vulnerable apps detected using the SDK have been removed from the Google Play Store. EngageLab released version 5.2.1 in November 2025 after responsible disclosure in April 2025, there is no evidence the flaw was exploited in the wild, and developers are urged to update immediately.
The NaClCON (Salt Con) speaker list is out! May 31–June 2, Carolina Beach NC

naclcon.com · 3 months ago

There is an intentionally small conference called NaClCON with a 300 person cap that focuses on hacker history and culture rather than zero days or AI hype, held at a beach venue with open bars and a capture the flag event and priced at 495 dollars all in. The speaker roster includes many scene builders such as Lee Felsenstein, Chris Wysopal, G. Mark Hardy, Richard Thieme, Brian Harden, Izaac Falken, Mei Danowski, Josh Corman, Casey John Ellis, Jericho, Andrew Brandt, Johnny Shaieb, B.K. DeLong, Jamie Arlen, Heidi and Bruce Potter, and Dustin Heywood. Fireside chats will feature DEF CON war stories, old school phone phreaking, and a grog night, and the conference hotel has a room block at 139 dollars per night that expires May first.
UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns

thehackernews.com · 3 months ago

A previously undocumented threat cluster called UAT-10362 is conducting spear-phishing campaigns against Taiwanese non governmental organizations and suspected universities to deliver a new Lua based stager named LucidRook. LucidRook is a heavily obfuscated 64 bit Windows DLL that embeds a Lua 5.4.8 interpreter and Rust compiled libraries to collect system information, exfiltrate it, and download encrypted Lua bytecode payloads for execution. Infection occurs via two chains that use DLL side loading: a shortcut file with a PDF icon that runs a PowerShell script to execute a legitimate binary which sideloads a malicious DLL, and an executable masquerading as a Trend Micro cleanup program that acts as a.NET dropper; the dropper LucidPawn also performs geofencing by checking for Traditional Chinese system locales associated with Taiwan. The actor abuses out of band application security testing services and compromised FTP servers for command and control, and at least one dropper variant deploys a reconnaissance DLL called LucidKnight that exfiltrates data via Gmail to a temporary email address, indicating a tiered modular toolkit and mature operational tradecraft.
Smart Slider updates hijacked to push malicious WordPress, Joomla versions

www.bleepingcomputer.com · 3 months ago

There was a hijack of the Smart Slider 3 Pro update system that pushed a malicious plugin version 3.5.1.35 for WordPress and Joomla, installing multiple backdoors, creating a hidden administrator account, and exfiltrating site data. The malicious toolkit enables unauthenticated remote command execution via crafted HTTP headers, contains a second authenticated backdoor with PHP eval and operating system command execution, automates credential theft, and maintains persistence through a must use plugin, injected theme and core files, and a backdoor that reads an authentication key from a cache file so it works even if database credentials change. The compromised update was distributed on April 7, 2026, and vendors advise restoring backups dated April 5, 2026 or earlier, or installing a clean plugin version 3.5.1.36 and treating affected sites as fully compromised by removing malicious users and files, rotating all credentials, reinstalling core components, scanning for remaining malware, and enabling two factor authentication.
Threat Model Discrepancy: Google Password Manager leaks cleartext passwords via Task Switcher (Won't Fix) - Violates German BSI Standards

drive.google.com · 3 months ago

There is a vulnerability in Google Password Manager on Android tested on Pixel 8 running Android 16 where viewed cleartext passwords remain visible in the Recent Apps preview when the app is minimized because the app does not set FLAGSECURE or blur the background. This leaves cleartext passwords exposed even when the app displays a foreground biometric prompt, rendering the secondary biometric lock ineffective. Google closed the report as Won't Fix citing a threat model that treats physical access to an unlocked device as game over, while the German Federal Office for Information Security requires protection against background snapshots for temporary access scenarios and iOS built in password manager blurs the screen when losing focus.
Half of Gen Z Uses AI, but Their Feelings Are Souring, Study Shows

www.nytimes.com · 3 months ago

false
New Apple Scam Hits Millions of iPhone Users Worldwide, Draining Bank Accounts

www.techrepublic.com · 3 months ago

Apple warns of a global social engineering scam targeting iPhone users that begins with an official looking text about a suspicious Apple Pay charge or a locked account and provides a phone number that connects victims to fraudsters who pressure them to move or withdraw money, with some victims nearly persuaded to withdraw large sums. Scammers ask for passwords, device passcodes, or two factor authentication codes, may urge users to disable security features, and sometimes direct victims to fake Apple sign in pages to harvest credentials. Users are advised to ignore unsolicited messages, do not click links or call numbers in those texts, verify account activity through the official Apple app or website, hang up on suspicious callers, and report fraud to Apple Support through official channels.
Massive Data Breach Exposes 337K LAPD-Linked Records

www.techrepublic.com · 3 months ago

There are roughly 337,000 LAPD linked files totaling about 7.7 terabytes exposed, including internal affairs investigations, unredacted criminal complaints, witness identities, and officers medical information. The breach resulted from unauthorized access to a third party discovery system used by the Los Angeles City Attorney to transfer discovery, and while the LAPD says its systems were not directly compromised the data was posted online by a hacking group and later removed. The incident was noticed on March 20 and is under investigation with the FBI involved, while police unions say they were not properly notified. Security experts recommend tightening third party risk management, enforcing strong access controls and multi factor authentication, encrypting sensitive data, and testing incident response plans to reduce similar risks.
Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees

www.microsoft.com · 3 months ago

An emerging financially motivated threat actor tracked as Storm-2755 compromised Canadian employee accounts to access profiles and divert salary payments to attacker controlled accounts, causing direct financial loss. The actor used SEO poisoning and malvertising to serve malicious Microsoft 365 sign in pages, conducted adversary in the middle session hijacking to capture session cookies and OAuth tokens that bypassed non phishing resistant multifactor authentication, and replayed tokens using the Axios HTTP client version 1.7.9 to maintain persistent non interactive access. The campaign exploited a known Axios vulnerability tracked as CVE-2025-27152 that can lead to server side request forgery, produced recurring non interactive sign ins until tokens expired or were revoked, and recommended mitigations include implementing phishing resistant MFA such as FIDO2 and revoking compromised sessions.
A tiny experiment using Artemis II astronaut cells could reshape medicine

www.washingtonpost.com · 3 months ago

Chips about the size of USB thumb drives seeded with bone marrow cells from the four Artemis II astronauts circled the moon to probe how increased radiation and microgravity affect human biology. Researchers purified immature bone marrow cells from preflight platelet donations, froze them, then thawed and seeded them into organ-on-a-chip devices that include a vascular channel and placed matched sets in a Space Tango life support unit on Orion and on Earth for comparison. After splashdown teams will fix and analyze the flown chips alongside Earth controls and astronaut health measurements to search for DNA damage, telomere changes, and markers of inflammation and to validate whether these avatar chips can forecast health risks and guide personalized medical countermeasures for future deep space missions.
When attackers already have the keys, MFA is just another door to open

www.bleepingcomputer.com · 3 months ago

In February 2026 a breach at a financial services company exposed 967,200 email addresses that attackers can use as inputs for large scale credential stuffing, AI-assisted targeted phishing, and help-desk social engineering. Legacy multifactor methods such as push notifications, SMS one-time codes, and TOTP are vulnerable to real-time phishing relay attacks that proxy credentials and MFA challenges in real time, and publicly available toolkits like Evilginx, Modlishka and Muraena automate these attacks. True phishing-resistant authentication requires three properties together cryptographic origin binding so signatures only validate for the specific domain, hardware-bound private keys that never leave secure hardware, and live biometric verification proving the authorized individual was physically present at the moment of authentication. A hardware token that enforces all three properties and removes recovery flow or help-desk overrides prevents relay, replay and delegation attacks by completing authentication only when the origin domain, the protected key and a live biometric match are all satisfied.
Apple Intelligence AI Guardrails Bypassed in New Attack

www.securityweek.com · 3 months ago

Researchers from RSAC demonstrated an attack that bypasses Apple Intelligence guardrails by combining Neural Execs prompt injection with Unicode right-to-left override encoding to force malicious outputs. In testing the technique succeeded on seventy six percent of one hundred random prompts and could coerce the on device LLM to produce offensive content or manipulate private data and third party app functionality, with an estimated one hundred thousand to one million installed apps potentially vulnerable and at least two hundred million Apple Intelligence capable devices as of December 2025. Apple was notified in October 2025 and protections were rolled out in iOS 26.4 and macOS 26.4, and researchers reported no evidence of active exploitation.
ClickFix, Malicious DMGs Push notnullOSX to macOS Users

gbhackers.com · 3 months ago

There are hackers abusing ClickFix commands and booby-trapped DMG installers to distribute a new macOS stealer called notnullOSX that targets high-value cryptocurrency wallets on Mac systems. The stealer is delivered through maliciously crafted disk image installers that trick users into running them and then harvest wallet data and credentials. The campaign has been linked to a developer known as 0xFFF who abruptly left a Russian-speaking hacking forum in 2023 amid claims of being investigated and accusations against the forum.
Can We Trust AI? No – But Eventually We Must

www.securityweek.com · 3 months ago

There are systemic problems with modern large language models because they operate on statistical probabilities rather than objective truth, which produces hallucinations, entrenches bias, and fosters sycophancy that can mislead vulnerable users. Researchers, including Ilia Shumailov, warn of model collapse where models trained on data increasingly influenced by prior AI generations degrade over time unless continuously corrected. Enterprises are deploying AI rapidly without adequate security or provenance controls, creating operational, reputational, and adversarial risk and spurring a growing market of defender firms offering guardrails such as drift detection, prompt injection protection, and data leakage prevention. The recommended response is to engineer trust through data provenance, rigorous testing, and external guardrails while expecting individual users and corporate owners to apply caution and stronger security throughout the AI lifecycle.