Blahalla

DeepZero: An automated LLM/Ghidra pipeline for finding BYOVD zero-days in Windows drivers

blog.ahmadz.ai · 3 months ago

Researchers have developed an automated pipeline named DeepZero to identify potential vulnerabilities in Windows kernel drivers. The pipeline utilizes a combination of tools, including Ghidra for decompilation, Semgrep for pattern matching, and Google’s Gemini 2.5 for analysis, to flag exploitable drivers. During its initial run, the pipeline successfully identified a zero-day vulnerability in an ASUS driver, which is currently undergoing responsible disclosure. The system prioritizes drivers with Windows 10/11 compatibility, deduplicates drivers by SHA256 hash, and relies on a filter based on dangerous APIs like MmMapIoSpace and IoAllocateMdl.

German authorities identify REvil and GandCrab ransomware bosses

www.bleepingcomputer.com · 3 months ago

German authorities have identified two Russian nationals as leaders of the GandCrab and REvil ransomware operations, which occurred between 2019 and 2021. Daniil Shchukin and Anatoly Kravchuk are accused of orchestrating over 130 extortion cases, resulting in over two point two million dollars in ransom payments and more than forty million dollars in total financial damage. REvil, also known as Sodinokibi, utilized tactics established by GandCrab and targeted organizations including Texas local governments and Kaseya. Both suspects are believed to be in Russia and are now listed on the EU’s Most Wanted portal.

German authorities identify REvil and GandCrab ransomware bosses

www.bleepingcomputer.com · 3 months ago

German authorities have identified two Russian nationals, Daniil Shchukin and Anatoly Kravchuk, as the leaders of the GandCrab and REvil ransomware operations spanning 2019 to 2021. Shchukin, using the alias UNKN/UNKNOWN, and Kravchuk allegedly orchestrated at least 130 extortion cases, resulting in over $2.2 million in ransom payments and an estimated $40 million in financial damage. REvil, built on the affiliate model of GandCrab, notably impacted Acer, Texas local governments, and was involved in the Kaseya supply-chain attack. Both suspects are believed to be in Russia and are now on the EU’s Most Wanted portal.

Understanding Current Threats to Kubernetes Environments

unit42.paloaltonetworks.com · 3 months ago

Kubernetes environments are experiencing a significant increase in threat actor activity, with a 282 percent rise in the last year, often targeting the IT sector. Attackers are exploiting misconfigurations and vulnerabilities, including CVE-2025-55182, to steal credentials, escalate privileges, and compromise cloud infrastructure. Compromise typically results from a combination of weaknesses like overly permissive access and long-lived credentials. Security recommendations include enforcing strict role-based access control, using short-lived service account tokens, and implementing continuous runtime monitoring for malicious activity.

New GPUBreach attack enables system takeover via GPU rowhammer

www.bleepingcomputer.com · 3 months ago

Researchers have developed a new attack, called GPUBreach, that exploits Rowhammer vulnerabilities in GDDR6 memory on GPUs to gain system-level control. This technique allows an attacker to corrupt GPU page tables, enabling arbitrary memory access and potentially escalating privileges to the CPU. The attack bypasses IOMMU protections and may lead to complete system compromise, even without disabling IOMMU. NVIDIA is expected to update its security advisories, and consumer GPUs are currently unmitigated without ECC memory.

What Teens Are Doing With Those Role-Playing Chatbots

www.nytimes.com · 3 months ago

NULL

AI-Assisted Supply Chain Attack Targets GitHub

www.darkreading.com · 3 months ago

A threat actor has been using AI-assisted automation to target open-source software repositories on GitHub in a campaign called "prt-scan," beginning March 11. The attacker opened over 475 malicious pull requests in a short period, attempting to steal credentials and compromise NPM packages, with a roughly 10% success rate. This campaign follows a similar February attack, "hackerbot-claw," exploiting the pullrequesttarget workflow trigger to access sensitive data. Experts note the attacker’s payload, while ambitious, contained illogical elements, demonstrating a lack of full understanding of GitHub’s permissions model.

Axios Attack Shows How Complex Social Engineering Is Industrialized

www.darkreading.com · 3 months ago

A recent cyberattack on the Axios NPM package exposed a sophisticated and industrialized social engineering campaign likely conducted by the North Korean threat group UNC1069. Attackers spent weeks building rapport with a lead maintainer, using cloned personas and a convincing Slack workspace to gain access through a malicious Microsoft Teams file containing a remote access Trojan. This technique, previously reserved for high-value targets, now poses a significant risk to the open-source software community due to the potential for widespread compromise through commonly used packages. The attackers exploited advances in AI and delivery mechanisms, highlighting a permanent shift in the threat landscape.

Fortinet Issues Emergency Patch for FortiClient Zero-Day

www.darkreading.com · 3 months ago

Fortinet has released an emergency patch to address a zero-day vulnerability, CVE-2026-35616, in its FortiClient Endpoint Management Server software. This improper access control flaw allows an unauthenticated attacker to execute code and has been exploited in the wild. The vulnerability received a severity score of 9.1 and versions 7.4.5, 7.4.6, and 7.4.7 are affected; a hotfix is available. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to address it by April 9.

Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit

www.bleepingcomputer.com · 3 months ago

A security researcher has publicly released exploit code for a Windows privilege escalation vulnerability, known as BlueHammer. The flaw allows attackers to gain SYSTEM or elevated administrator permissions and access the Security Account Manager database. The researcher expressed frustration with Microsoft’s handling of the vulnerability disclosure process, leading to the public release. While the exploit code contains bugs and may not function reliably on all systems, it represents a significant risk if local access is achieved.

Microsoft fixes Classic Outlook bug causing email delivery issues

www.bleepingcomputer.com · 3 months ago

false

Responsible disclosure is structurally dead — not dying. Here's the analysis and what replaces it.

www.thecrucible.systems · 3 months ago

This report discusses the concept of responsible disclosure. It emphasizes that findings should be considered a starting point for verification rather than a final verdict. The report was produced using a reasoning methodology called Crucible. A PDF document of this whitepaper is available for download.

New Mexico’s Meta Ruling and Encryption

www.schneier.com · 3 months ago

A recent New Mexico court ruling against Meta raises concerns about the future of end-to-end encryption and overall security. The state argues that Meta’s implementation of encryption in Facebook Messenger enabled harmful activity, like the exchange of child sexual abuse material, and is seeking changes to protect minors. This “design liability” framework could discourage companies from implementing security improvements if those improvements can be portrayed as shielding bad actors. The ruling may lead to companies avoiding internal risk assessments and documentation, ultimately making everyone less safe.

Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations

thehackernews.com · 3 months ago

A password-spraying campaign targeting Microsoft 365 environments in Israel and the U.A.E. has impacted over 300 organizations, with activity also observed in Europe, the United States, the United Kingdom, and Saudi Arabia. This campaign, attributed to an Iran-nexus threat actor, uses a technique where a single password is tested against multiple usernames to discover weak credentials. Simultaneously, the Iranian ransomware group Pay2Key recently targeted a U.S. healthcare organization, deploying a new ransomware variant with enhanced evasion capabilities, and previously offered affiliates increased ransom shares for attacks against Iran's enemies. The activity aligns with Iranian hacking groups like Peach Sandstorm and Gray Sandstorm.

Microsoft removes Support and Recovery Assistant from Windows

www.bleepingcomputer.com · 3 months ago

false

Microsoft links Medusa ransomware affiliate to zero-day attacks

www.bleepingcomputer.com · 3 months ago

A China-based cybercriminal group known as Storm-1175 is rapidly exploiting vulnerabilities, including zero-day exploits, to deploy Medusa ransomware. The group moves quickly from initial network access to data exfiltration and ransomware deployment, often within 24 hours. Storm-1175 has exploited over 16 vulnerabilities across 10 software products, including Microsoft Exchange (CVE-2023-21529), Papercut (CVE-2023-27351 and CVE-2023-27350), Ivanti (CVE-2023-46805 and CVE-2024-21887), and ConnectWise (CVE-2024-1709 and CVE-2024-1708), among others. This activity has impacted healthcare, education, professional services, and finance organizations in multiple countries, and has affected over 300 critical infrastructure organizations in the United States.

Drift $280M crypto theft linked to 6-month in-person operation

www.bleepingcomputer.com · 3 months ago

A sophisticated cyberattack has resulted in the theft of over 280 million dollars from the Solana-based Drift Protocol. Investigations by blockchain intelligence firms indicate North Korean hackers, specifically the group UNC4736, were responsible for the theft, which involved a six-month operation including in-person interactions with Drift contributors at industry conferences. The attackers reportedly compromised contributor accounts through a malicious code repository possibly exploiting a VSCode/Cursor vulnerability and a compromised TestFlight application. The group has also been linked to the 3CX supply-chain attack, the Radiant cryptocurrency theft, and Chrome zero-day exploitation.

Inside an AI‑enabled device code phishing campaign

www.microsoft.com · 3 months ago

Security researchers have uncovered a complex phishing campaign targeting users of Microsoft services. Attackers are leveraging AI and automation to generate device codes on demand, bypassing multi-factor authentication and extending the timeframe for successful credential theft. The phishing attacks use personalized lures and redirect traffic through trusted cloud services to evade detection, allowing for data exfiltration and account persistence. Mitigations include disabling the Device Code flow, strengthening anti-phishing policies, and using phishing-resistant MFA.

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

thehackernews.com · 3 months ago

North Korean state-sponsored hackers are increasingly using GitHub as command-and-control infrastructure to target organizations in South Korea. Attackers distribute malicious Windows shortcut files via phishing emails, which then deploy decoy documents and PowerShell scripts. These scripts evade detection by checking for security tools and establish persistence through scheduled tasks, ultimately exfiltrating host data to a GitHub repository. Security firms have also observed similar campaigns using Dropbox and a Python-based backdoor, alongside a shift to HWP OLE-based droppers to deliver RokRAT.

CISA orders feds to patch exploited Fortinet EMS flaw by Friday

www.bleepingcomputer.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency is directing U.S. federal agencies to quickly address a security vulnerability in Fortinet’s Enterprise Management Server. The flaw, tracked as CVE-2026-35616, allows attackers to bypass authentication and potentially execute code. Fortinet has released fixes, and Shadowserver reports nearly two thousand exposed instances are currently online. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and urges all organizations to patch promptly.

Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations

www.microsoft.com · 3 months ago

Security experts have identified the Storm-1175 ransomware group using the Medusa ransomware to aggressively target organizations. The group quickly exploits recently discovered vulnerabilities in web-facing systems, such as those from Microsoft Exchange, Papercut, and Ivanti, to gain access. Their attacks involve rapid deployment of ransomware within a week, utilizing tools like RMM software and Impacket for lateral movement. Microsoft advises organizations to prioritize patching vulnerabilities and adopting a layered defense strategy, including utilizing AI-powered security tools.

New Fortinet Flaw Allows Unauthorized Access to Enterprise Systems

www.techrepublic.com · 3 months ago

A critical zero-day vulnerability has been identified in Fortinet's FortiClient EMS, allowing attackers to bypass authentication and execute unauthorized commands. The flaw, CVE-2026-35616, stems from improper access control within the API, granting access without credentials and resulting in a CVSS score of 9.1. Fortinet has released a hotfix, and organizations are urged to apply it, restrict access, review logs, and audit privileged accounts to mitigate risk. This marks the second exploited vulnerability affecting FortiClient EMS in recent months, CVE-2026-21643.

Google DeepMind Researchers Map Web Attacks Against AI Agents

www.securityweek.com · 3 months ago

Google DeepMind researchers have identified six types of attacks, termed "AI Agent Traps," that can manipulate autonomous AI agents interacting with web content. These traps involve content injection, semantic manipulation, corruption of long-term memory, behavioral control, systemic exploitation of multiple agents, and attacks targeting human users. Attackers can utilize hidden commands, manipulate data distributions, and exploit cognitive biases to achieve objectives such as data exfiltration or information dissemination. Researchers suggest technical defenses, content governance, and standardized benchmarks are needed to address this evolving threat.

Automated Credential Harvesting Campaign Exploits React2Shell Flaw

www.darkreading.com · 3 months ago

A global cyber campaign is exploiting a React Server Components vulnerability, CVE-2025-55182, also known as React2Shell, to steal credentials and system data. Attackers, tracked as UAT-10608, are using an automated framework called NEXUS Listener to compromise at least 766 hosts across various industries and cloud providers. After gaining initial access, the attackers deploy NEXUS Listener, which acts as a command-and-control platform and collects credentials, SSH keys, and cloud tokens. The tool's GUI allows attackers to easily sift through the stolen data, enabling further malicious activity. Organizations are advised to patch the vulnerability, rotate credentials, and implement least-privilege access.

Using Cloudflare’s Post-Quantum Tunnel to Protect Plex Remote Access on a Synology NAS

infosecwriteups.com · 3 months ago

false

Forget the A.I. Apocalypse. Memes Have Already Nuked Our Culture.

www.nytimes.com · 3 months ago

false

Trivy supply chain attack enabled European Commission cloud breach

www.helpnetsecurity.com · 3 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown Mode. These techniques involve manipulating the system clipboard, leveraging Universal Control, and exploiting vulnerabilities in HomeKit. Successful exploitation could allow unauthorized access to sensitive data or control of a device. The vulnerabilities identified are CVE-2023-40920, CVE-2023-41055, and CVE-2023-41069.

Apple Rolls Out Fix: New macOS Update Could Protect 100M Mac Users

www.techrepublic.com · 3 months ago

Apple has released a macOS update to protect users from a growing cyberattack called ClickFix. Attackers are exploiting users’ tendency to copy and paste commands from untrusted sources into the Terminal, often found in tutorials or AI-generated responses. The new macOS safeguard displays a warning before users paste commands, encouraging them to double-check the instructions and avoid potentially malicious actions. While this isn’t a response to a specific software vulnerability, Bitdefender reports a rise in Apple-targeted cyberattacks, emphasizing the importance of verifying command sources and avoiding urgent requests.

Shadow AI in Healthcare Is Here to Stay

www.darkreading.com · 3 months ago

false

Why Simple Breach Monitoring is No Longer Enough

www.bleepingcomputer.com · 3 months ago

Organizations often underestimate the risk of stolen credentials, despite recognizing them as a top security concern. Traditional security measures like MFA and zero-trust solutions are insufficient when devices are unmanaged. A recent survey revealed that many enterprises rely on inadequate tools with stale data and limited investigation capabilities, leading to delayed detection and significant financial losses, costing upwards of $4.81 to $4.88 million per breach. Continuous monitoring, automation, and integrations are crucial for a mature breach monitoring program to address evolving infostealer threats, such as those from LummaC2, Rhadamanthys, Atomic macOS Stealer, and others.

OWASP GenAI Security Project Gets Update, New Tools Matrix

www.darkreading.com · 3 months ago

The Open Web Application Security Project, or OWASP, has released updated security recommendations for artificial intelligence systems, specifically focusing on generative AI and agentic AI. New guidance addresses 21 data security risks, including sensitive data leakage and exposure of agent credentials. OWASP is shifting to a six-month update schedule to keep pace with the rapidly evolving AI landscape, and experts emphasize the need for improved visibility and observability of AI agent activity. The organization has documented risks such as sensitive data leakage (DSGAI-01), data poisoning (DSGAI-04), and compromise through third-party tools (DSGAI-06).

Trojanized PyPI AI Proxy Steals Claude Prompt, Exfiltrates Data

gbhackers.com · 3 months ago

A malicious Python package, hermes-px, available on PyPI, is designed to steal user prompts and data by masquerading as a secure AI inference proxy. The package hijacks a Tunisian university’s internal AI endpoint, injects a modified Anthropic Claude system prompt, and forwards conversations to an attacker-controlled Supabase database. It uses deceptive documentation, mimics the OpenAI Python SDK, and employs a complex, three-stage obfuscation method to conceal its malicious activities. Developers who installed the package may have exposed sensitive data and credentials.

Google Brings Lazy Loading to Media Files in New Chrome Release

gbhackers.com · 3 months ago

false

Drift Protocol Hit in $286M Suspected North Korea-Linked Crypto Heist

gbhackers.com · 3 months ago

Hackers have stolen approximately 286 million dollars from Drift Protocol, a decentralized perpetual futures exchange on the Solana blockchain. The attack, which occurred on April 1, 2026, is suspected to be linked to North Korea and is considered the largest DeFi hack of the year. Security researchers believe the breach was caused by a compromise of Drift Protocol's administrator private keys, allowing the attacker to drain multiple vaults of assets including JLP tokens, USDC, and SOL. Blockchain analytics firm Elliptic identified connections to the Democratic People’s Republic of Korea based on fund laundering techniques.

Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps

thehackernews.com · 3 months ago

Security teams are struggling to handle attacks that spread across multiple operating systems, like Windows, macOS, and Linux, due to fragmented workflows and a lack of consistent visibility. This leads to slower validation, increased escalations, and ultimately, more time for attackers to compromise systems. Experts recommend integrating cross-platform analysis into early triage, keeping investigations within a single workflow, and leveraging tools for faster analysis. A recent ClickFix campaign targeting Claude Code users utilized a malicious Terminal command to steal data and establish persistence.

Samsung to Shut Down Its Messaging App, Switch to Google Messages in July

www.techrepublic.com · 3 months ago

false

⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More

thehackernews.com · 3 months ago

Cybersecurity threats are rapidly increasing, with malware-as-a-service and sophisticated phishing campaigns becoming more prevalent. New Android trojans and existing stealers are being distributed through deceptive methods, while a malicious Chrome extension is harvesting data. Geopolitical tensions are driving espionage activity, and authorities are warning about the risks associated with messaging applications. It's important to carefully examine system processes and updates due to vulnerabilities found in common tools.

Closing the Kernel Backport Gap: Automated CVE Detection

hardenedlinux.org · 3 months ago

New regulations like the EU Cyber Resilience Act require digital product manufacturers to proactively address security vulnerabilities. A new toolset called the Kernel Backport Checker helps organizations determine which kernel vulnerabilities, such as around 3,300 in a recent example, have actually been fixed in various kernel versions. The tool validates fixes and works with both source code and binary kernels, aiding in compliance efforts and improving security posture. It is especially relevant for distro maintainers, embedded vendors, and security teams facing increasing threats.

GitHub-Backed Malware Spread via LNK Files in South Korea

gbhackers.com · 3 months ago

Researchers have discovered three methods attackers can use to bypass security controls in virtual desktop infrastructure environments. These techniques involve manipulating user settings, exploiting vulnerabilities in printer drivers, and leveraging misconfigured network shares. The vulnerabilities allow attackers to escalate privileges and potentially access sensitive data. CVE-2023-28002, CVE-2023-28017, and CVE-2023-28021 are associated with these findings.

North Korean hackers abuse LNKs and GitHub repos in ongoing campaign

www.csoonline.com · 3 months ago

North Korean hackers are employing a new, stealthy campaign targeting South Korean organizations. The attacks utilize weaponized Windows shortcut files and GitHub-based command-and-control to evade detection, progressively improving obfuscation techniques. Researchers have observed the use of decoding functions within shortcut arguments to mask GitHub addresses and payloads, and have identified several GitHub accounts associated with the activity. The campaign aims to expand surveillance capabilities within South Korea and leverages readily available tools to blend into normal system activity.

Fake GitHub CI Update Steals Secrets and Tokens

gbhackers.com · 3 months ago

Researchers have identified a vulnerability affecting multiple products from Ivanti, potentially allowing unauthorized access and control. The flaw arises from insufficient input validation, enabling command injection. Affected products include Ivanti Connect Secure, Policy Secure, and Endpoint Manager, with versions ranging from 2019.x to 2023.x. This vulnerability, designated CVE-2024-23546, poses a significant security risk to organizations utilizing these platforms.

How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

thehackernews.com · 3 months ago

A recent supply chain attack targeting LiteLLM, a popular AI development library, demonstrated how developer machines can become credential harvesting operations. Threat actors, identified as TeamPCP, compromised versions 1.82.7 and 1.82.8 of the library on PyPI, stealing SSH keys, cloud credentials, and Docker configurations from developer workstations. This incident highlights a broader trend of adversaries exploiting compromised dependencies and local environment data stored in plaintext, such as in.env files and IDE settings. To mitigate this risk, organizations should prioritize visibility of secrets across developer endpoints, move credentials into vaults, treat AI agents as potential risks, and transition to short-lived, automatically rotated credentials.

Guardarian Users Targeted With Malicious Strapi NPM Packages

www.securityweek.com · 3 months ago

A supply chain attack has compromised the Strapi ecosystem through 36 malicious NPM packages. These packages deliver payloads capable of Redis code execution, Docker container escapes, credential harvesting, and reverse shell deployment. The attacker specifically targeted the cryptocurrency payment gateway Guardarian, probing databases and attempting credential theft. Security experts advise users to rotate all credentials to mitigate potential damage.

North Korea’s Modular Malware Strategy Hides Attribution, Defies Takedowns

gbhackers.com · 3 months ago

North Korea's cyber program has shifted to a modular malware ecosystem designed for resilience and operational continuity. The program now operates parallel tracks for espionage, financial theft, and disruption, each with its own tools and infrastructure, allowing operations to continue even when components are compromised. Attackers frequently use social engineering and abuse trusted cloud platforms, and defenders must focus on behavioral analytics and monitoring rather than signature-based detection due to rapid malware churn. This approach contrasts with other APT groups and institutionalizes a burn-and-replace strategy for malware.

North Korean Hackers Target High-Profile Node.js Maintainers

www.securityweek.com · 3 months ago

North Korean hackers, identified as UNC1069, are targeting high-profile Node.js maintainers using sophisticated social engineering tactics. The attackers build rapport over weeks, scheduling meetings and using fake software updates to install backdoors, as demonstrated in the recent Axios supply chain attack where over 3 million users were impacted. The campaign, similar to previous operations like DeceptiveDevelopment, now targets multiple maintainers of widely used NPM packages. Security experts urge the open-source community to be vigilant and report suspicious activity.

Google Wants to Transition to Post-Quantum Cryptography by 2029

www.schneier.com · 3 months ago

false

Cracking a Malvertising DGA From the Device Side

www.buchodi.com · 3 months ago

A security researcher has successfully broken the Domain Generation Algorithm utilized by illegal streaming sites. These sites employ an algorithm to generate new domains every three hours, making them difficult to track. By analyzing network traffic, the researcher was able to reconstruct the algorithm and predict future domains used by these sites. This breakthrough allows for proactive measures like blocking and redirecting users away from malicious sites.

Critical Claude Code Flaw Silently Bypasses User-Configured Security Rules

gbhackers.com · 3 months ago

A critical security vulnerability was discovered in Anthropic’s Claude Code AI coding agent. The flaw allows attackers to bypass configured security rules by crafting commands exceeding 50 subcommands, effectively executing blocked actions like data exfiltration. This bypass occurs because the system skips security checks when complex commands are processed, potentially leading to unauthorized data transmission. The vulnerability has been patched in Claude Code v2.1.90, and users are advised to restrict shell access and manually audit configuration files until updated.

Alleged REvil Leader ‘UNKN’ Identified by German Authorities in New Takedown Effort

gbhackers.com · 3 months ago

German authorities have identified 31-year-old Daniil Shchukin as the person behind the hacker alias “UNKN,” a leader of the GandCrab and REvil ransomware operations. Alongside Anatoly Kravchuk, Shchukin is accused of orchestrating numerous cyberattacks in Germany, resulting in significant financial losses. REvil popularized the “double extortion” tactic, locking networks and threatening data leaks for ransom. The group’s 2021 attack on Kaseya impacted over 1,500 businesses globally.

Google’s Bug Bounty Program Hits Record $17 Million in 2025 Payouts

gbhackers.com · 3 months ago

Google’s Vulnerability Reward Program reached a record $17 million in payouts during 2025, a 40% increase from the previous year. The company expanded its focus to include artificial intelligence security with a dedicated AI Vulnerability Reward Program and specific reward categories for Chrome browser AI features. Google also invested in live hacking events, called bugSWAT, and an open-source security tool called OSV-SCALIBR, which helped identify leaked secrets. These efforts reflect Google’s ongoing commitment to collaborating with security researchers to enhance the security of its products and services.