Blahalla

Google Wants to Transition to Post-Quantum Cryptography by 2029

www.schneier.com · 3 months ago

false

Cracking a Malvertising DGA From the Device Side

www.buchodi.com · 3 months ago

A security researcher has successfully broken the Domain Generation Algorithm utilized by illegal streaming sites. These sites employ an algorithm to generate new domains every three hours, making them difficult to track. By analyzing network traffic, the researcher was able to reconstruct the algorithm and predict future domains used by these sites. This breakthrough allows for proactive measures like blocking and redirecting users away from malicious sites.

Critical Claude Code Flaw Silently Bypasses User-Configured Security Rules

gbhackers.com · 3 months ago

A critical security vulnerability was discovered in Anthropic’s Claude Code AI coding agent. The flaw allows attackers to bypass configured security rules by crafting commands exceeding 50 subcommands, effectively executing blocked actions like data exfiltration. This bypass occurs because the system skips security checks when complex commands are processed, potentially leading to unauthorized data transmission. The vulnerability has been patched in Claude Code v2.1.90, and users are advised to restrict shell access and manually audit configuration files until updated.

Alleged REvil Leader ‘UNKN’ Identified by German Authorities in New Takedown Effort

gbhackers.com · 3 months ago

German authorities have identified 31-year-old Daniil Shchukin as the person behind the hacker alias “UNKN,” a leader of the GandCrab and REvil ransomware operations. Alongside Anatoly Kravchuk, Shchukin is accused of orchestrating numerous cyberattacks in Germany, resulting in significant financial losses. REvil popularized the “double extortion” tactic, locking networks and threatening data leaks for ransom. The group’s 2021 attack on Kaseya impacted over 1,500 businesses globally.

Google’s Bug Bounty Program Hits Record $17 Million in 2025 Payouts

gbhackers.com · 3 months ago

Google’s Vulnerability Reward Program reached a record $17 million in payouts during 2025, a 40% increase from the previous year. The company expanded its focus to include artificial intelligence security with a dedicated AI Vulnerability Reward Program and specific reward categories for Chrome browser AI features. Google also invested in live hacking events, called bugSWAT, and an open-source security tool called OSV-SCALIBR, which helped identify leaked secrets. These efforts reflect Google’s ongoing commitment to collaborating with security researchers to enhance the security of its products and services.

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

thehackernews.com · 3 months ago

Cyber threat actors associated with the Qilin and Warlock ransomware operations are employing a bring your own vulnerable driver, or BYOVD, technique to evade security tools. Qilin ransomware uses a malicious DLL, “msimg32.dll,” along with drivers rwdrv.sys and hlpdrv.sys to disable over 300 endpoint detection and response, or EDR, drivers. Warlock ransomware is now using a vulnerable NSec driver, “NSecKrnl.sys,” to terminate security products at the kernel level. Experts recommend organizations allow only signed drivers from trusted publishers and maintain a rigorous patch management schedule.

Authentication is broken: Here’s how security leaders can actually fix it

www.csoonline.com · 3 months ago

Authentication systems are frequently failing, particularly in sectors like healthcare, government, aerospace, and travel, due to a fragmented and brittle ecosystem of hardware and software. Common issues stem from mismatched technology, vendor lock-in, and fragile patches that disrupt login processes. Experts recommend three architectural shifts: utilizing modular secure elements, standardizing middleware, and establishing a unified credential ecosystem to improve reliability and resilience. Security leaders should prioritize eliminating weak fallback options, demanding downgrade transparency, and hardening systems against patch turbulence.

Fortinet Rushes Emergency Fixes for Exploited Zero-Day

www.securityweek.com · 3 months ago

Fortinet has released emergency fixes for a critical vulnerability in FortiClient Enterprise Management Server. The vulnerability, tracked as CVE-2026-35616, allows for remote code execution without authentication. The flaw has been actively exploited in the wild, and approximately 2000 internet-accessible instances are potentially at risk. Fortinet credits the cybersecurity firm Defused for discovering and reporting the issue.

6 ways attackers abuse AI services to hack your business

www.csoonline.com · 3 months ago

Attackers are increasingly exploiting AI services, employing tactics similar to those used with traditional enterprise tools. Cybercriminals are abusing AI platforms as covert command-and-control channels and impersonating model context protocol servers, leading to data theft and supply chain attacks. Security experts have observed dependency poisoning within AI workflows and the creation of weaponized AI platforms like Xanthorox AI. Several vulnerabilities have been identified, including CVE-2025-32711 in Microsoft 365 Copilot and CVE-2026-25253 in OpenClaw, demonstrating the need for tighter controls and monitoring of AI systems.

He survived working for Elon Musk. Here’s how.

www.washingtonpost.com · 3 months ago

false

Escaping the COTS trap

www.csoonline.com · 3 months ago

false

Apache Traffic Server Flaw Allowed Attackers to Trigger Denial-of-Service Attacks

gbhackers.com · 3 months ago

Security updates are available for Apache Traffic Server to address two vulnerabilities. CVE-2025-58136 allows attackers to crash the server with a simple POST request, creating a denial-of-service risk. CVE-2025-65114 is an HTTP request smuggling flaw that could allow attackers to bypass security controls. Users of the 9.x and 10.x branches of Apache Traffic Server should upgrade to the latest versions to mitigate these risks.

Critical Dgraph Database Flaw Allowed Attackers to Bypass Authentication

gbhackers.com · 3 months ago

A critical vulnerability, tracked as CVE-2026-34976, has been identified in the Dgraph database system, allowing attackers to potentially take over servers. The flaw, resulting from a configuration oversight, permits unauthenticated remote access to administrative functions, bypassing authentication and authorization. Attackers can overwrite databases, access sensitive files, conduct Server-Side Request Forgery attacks, and potentially steal credentials. Versions up to v25.3.0 are affected, and administrators are advised to restrict network access until a patch is released.

Hackers Breach ILSpy WordPress Domain to Deliver Malware

gbhackers.com · 3 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown mode. These techniques involve manipulating hyperlinks, exploiting universal links, and leveraging custom URL schemes to execute malicious code. Lockdown mode is designed to restrict certain device features to enhance security, but these workarounds demonstrate potential vulnerabilities. The researchers noted CVE-2023-42052, CVE-2023-42053, CVE-2023-42054, CVE-2023-42055, and CVE-2023-42056 are associated with these findings.

Poisoned Axios Package Spreads Cross-Platform Malware via Phantom Dependency

gbhackers.com · 3 months ago

Hackers compromised the npm account of an Axios maintainer, using it to distribute two malicious versions of the popular HTTP client library: 1.14.1 and 0.30.4. These versions included a phantom dependency, plain-crypto-js@^4.2.1, which installed a cross-platform remote access trojan. The RAT dropper script self-destructed to evade detection, making identifying compromised systems challenging, and affected organizations spanned multiple sectors. Security experts recommend pinning Axios to safe versions and enforcing strict npm controls.

BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks

thehackernews.com · 3 months ago

Germany’s Federal Criminal Police Office has identified two key figures behind the now-defunct REvil ransomware operation. Daniil Maksimovich Shchukin, also known as UNKN, acted as a leader and advertiser for the group, while Anatoly Sergeevitsch Kravchuk is suspected of being the developer. The pair are believed to be responsible for 130 ransomware attacks in Germany, resulting in over 35 million dollars in financial damages and nearly 2 million dollars in ransom payments. REvil, an evolution of GandCrab, targeted companies like JBS and Kaseya before ceasing operations following law enforcement actions.

Threat Actors Weaponize Fake Microsoft Teams Domains to Target Users

gbhackers.com · 3 months ago

Threat actors linked to North Korea, known as UNC1069, are using fake Microsoft Teams domains to trick users into downloading malware. The group creates convincing meeting lures and compromises communication channels to distribute Remote Access Trojans. Attackers revive old conversations, send fake invitations, and pre-schedule meetings through legitimate services to appear trustworthy. Users are advised to verify URLs and treat unexpected meeting requests with caution.

ResokerRAT Hijacks Telegram API to Command Infected Windows PCs

gbhackers.com · 3 months ago

A new Windows malware, ResokerRAT, uses Telegram’s Bot API for command and control, bypassing traditional server infrastructure and blending in with encrypted traffic. The malware employs several anti-analysis techniques, including terminating processes like Task Manager and blocking key defensive key combinations. ResokerRAT also modifies User Account Control settings to suppress security prompts and can download additional payloads via PowerShell. The malware’s activity aligns with numerous MITRE ATT&CK techniques, including PowerShell execution and impairing defenses.

2,000+ FortiClient EMS Instances Exposed Online as Attackers Exploit Active RCE Flaw

gbhackers.com · 3 months ago

Researchers have discovered three distinct methods attackers can use to bypass Apple's Lockdown Mode. These techniques involve exploiting weaknesses in the way apps handle specific types of data. One method uses a malicious GIF image to trigger a crash and potentially gain control, while others leverage vulnerabilities in font parsing and the handling of external display connections. These exploits could allow attackers to execute arbitrary code and compromise device security.

36 Malicious Strapi npm Packages Deliver Redis RCE, Persistent C2 Malware

gbhackers.com · 3 months ago

Researchers have discovered vulnerabilities in the popular file-sharing protocol, BitTorrent. Three potential attack vectors exist including a denial-of-service attack through crafted torrent files, a potential memory corruption issue within the libtorrent library, and a possibility of information disclosure. The memory corruption issue has been assigned CVE-2024-20327. Affected versions of libtorrent prior to 2.2.1 are urged to update promptly.

Google DeepMind Flags New Threat as Malicious Web Content Puts AI Agents at Risk

gbhackers.com · 3 months ago

Researchers at Google DeepMind have identified a new cybersecurity threat called AI Agent Traps, which are malicious web pages designed to manipulate autonomous AI systems. These traps exploit differences in how humans and machines process web content, potentially allowing attackers to access sensitive data or control agent actions. The research team categorized these attacks into six types, including content injection, semantic manipulation, and behavioral control traps. Experts say current security tools are not equipped to defend against these AI-specific threats, highlighting a need for new security measures.

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab

krebsonsecurity.com · 3 months ago

German authorities have identified and named Daniil Maksimovich Shchukin, a 31-year-old from Russia, as the elusive hacker known as “UNKN,” who led the GandCrab and REvil ransomware groups. Shchukin and another Russian, Anatoly Sergeevitsch Kravchuk, are accused of orchestrating over two dozen cyberattacks resulting in over 35 million euros in economic damage and nearly 2 million euros in extorted funds. These ransomware groups pioneered the practice of double extortion, demanding both a decryption key and a promise not to publish stolen data. Authorities believe Shchukin may still be in Russia and is wanted for computer sabotage and extortion.

The Attack With No Attacker Domain: Microsoft Entra B2B Guest Invitation Phishing

phishu.net · 3 months ago

A new phishing technique exploits Microsoft Entra B2B guest invitations, allowing attackers to bypass traditional sender reputation checks because the email appears to originate directly from Microsoft at [email protected]. The PhishU Framework simplifies this attack, requiring only a few clicks to configure and enabling operators to control the post-acceptance landing page and downstream actions, like OAuth Consent Grant requests. This method tests user trust beyond standard phishing defenses, highlighting a potential vulnerability in how organizations handle guest invitations and delegated access. The technique emphasizes realistic social engineering rather than solely bypassing email security controls.

Traffic violation scams switch to QR codes in new phishing texts

www.bleepingcomputer.com · 3 months ago

Scammers are now using QR codes in text messages to impersonate state courts and traffic agencies across the United States. These messages claim there is an outstanding traffic violation and direct recipients to scan the code, leading to phishing sites that request a $6.99 payment. The phishing sites then collect personal and financial information which can be used for identity theft and financial fraud. Authorities confirm that state agencies do not use text messages to request payment or personal information.

New FortiClient EMS flaw exploited in attacks, emergency patch released

www.bleepingcomputer.com · 3 months ago

Fortinet has released an emergency security update to address a critical vulnerability, CVE-2026-35616, in FortiClient Enterprise Management Server. This improper access control flaw allows unauthenticated attackers to execute commands. The vulnerability impacts versions 7.4.5 and 7.4.6, and has been observed exploited in the wild. Security firm Shadowserver has identified over 2,000 exposed instances of FortiClient EMS online.

$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation

thehackernews.com · 3 months ago

A North Korean state-sponsored hacking group, UNC4736 (also known as AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces), is believed responsible for a six-month social engineering operation that led to the theft of $285 million from the decentralized exchange Drift. The attackers posed as a quantitative trading company, built rapport with Drift contributors, and ultimately exploited vulnerabilities through compromised code repositories and wallet applications. The group, linked to previous incidents like the XTRADER/3CX supply chain breach and the Radiant Capital hack, utilizes a fragmented malware ecosystem to evade attribution and generate revenue for the DPRK regime. They are also engaging in a widespread IT worker fraud scheme, recruiting individuals from various countries to infiltrate Western companies.

GDDRHammer and GeForge: GDDR6 GPU Rowhammer to root shell (IEEE S&P 2026, exploit code available)

blog.barrack.ai · 3 months ago

New vulnerabilities, named GDDRHammer, GeForge, and GPUBreach, pose a significant threat to GPU security. Attackers can exploit these issues, which originate from unprivileged CUDA kernels, to escalate memory corruption and gain root shell access, potentially compromising entire systems. The vulnerabilities primarily impact NVIDIA GeForce RTX 3060 and RTX A6000 models, though other GDDR6 GPUs may be affected while newer models utilizing GDDR7 and HBM are less vulnerable. Mitigations include enabling IOMMU and ECC, but are not foolproof, with cloud providers urged to implement additional safeguards like dedicated GPU allocation.

Hackers exploit React2Shell in automated credential theft campaign

www.bleepingcomputer.com · 3 months ago

Hackers are exploiting the React2Shell vulnerability, identified as CVE-2025-55182, to steal credentials from vulnerable Next.js applications. The attackers use a framework called NEXUS Listener to automatically harvest sensitive data like API keys, SSH keys, and cloud credentials from over 766 compromised hosts. This activity is attributed to the UAT-10608 threat cluster, who exfiltrate data via HTTP requests to a command-and-control server. Security experts recommend updating React2Shell, rotating credentials, and enforcing least privilege to mitigate the risk.

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

realnarrativenews.com · 3 months ago

Security experts have identified 36 malicious packages within the npm registry. These packages impersonate plugins for the Strapi CMS and carry payloads designed to exploit Redis and PostgreSQL databases. The malicious code enables reverse shell deployment, credential harvesting, and the installation of persistent implants. Each package includes specific files to carry out these actions.

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

thehackernews.com · 3 months ago

Researchers have identified 36 malicious npm packages disguised as Strapi CMS plugins that exploit Redis and PostgreSQL vulnerabilities. These packages, uploaded by four accounts, use a consistent naming convention starting with "strapi-plugin-" and contain hidden code executed during installation, granting attackers privileges and enabling actions like reverse shell deployment, credential harvesting, and persistent implant installation. The payloads evolved from initial remote code execution to reconnaissance, data collection, and targeted credential theft, potentially indicating a cryptocurrency platform was the target. These incidents highlight a broader trend of supply chain attacks impacting open-source ecosystems, including compromises of GitHub accounts, VS Code extensions, and PyPI packages.

Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

thehackernews.com · 3 months ago

Fortinet has released a patch for a critical security vulnerability, CVE-2026-35616, impacting FortiClient EMS. The vulnerability allows an unauthenticated attacker to bypass access controls and potentially execute malicious code. Exploitation of this flaw has been observed in the wild, and it follows another recent vulnerability, CVE-2026-21643, also being actively exploited. Security experts suggest organizations prioritize patching to mitigate risk, especially given that exploitation often increases during holiday weekends.

I have refactored slurp s3 bucket enumerator to work with any s3 compatible cloud

codeberg.org · 3 months ago

false

Axios npm hack used fake Teams error fix to hijack maintainer account

www.bleepingcomputer.com · 3 months ago

North Korean hackers, identified as UNC1069, compromised the Axios HTTP client project through a sophisticated social engineering campaign. Attackers impersonated a legitimate company and tricked a lead maintainer into installing a fake Microsoft Teams update, which deployed a remote access trojan (RAT) on the maintainer's device. This allowed them to publish malicious versions of Axios (1.14.1 and 0.30.4) containing a plain-crypto-js dependency, impacting macOS, Windows, and Linux systems for approximately three hours. The attackers targeted numerous open-source maintainers, bypassing multi-factor authentication, and focused on high-impact projects with billions of weekly downloads.

BrowserGate: LinkedIn/Microsoft allegedly scans 6,000+ browser extensions & links them to real identities, all without user consent

thecybersecguru.com · 3 months ago

LinkedIn, through Microsoft, is reportedly scanning users' browsers for over 6,200 extensions to gather data about their religion, politics, health, and job searching activities. This practice, dubbed “BrowserGate,” uses a three-layer detection system to identify extensions and link the data to individual user profiles. The data collection appears to violate GDPR regulations and may trigger criminal liability in multiple countries. LinkedIn claims the scanning is for corporate intelligence and competitive analysis.

Apple's Spotlight Search Results Come With Engagement Metrics. No One Knew.

www.buchodi.com · 3 months ago

false

Device code phishing attacks surge 37x as new kits spread online

www.bleepingcomputer.com · 3 months ago

Device code phishing attacks have increased dramatically, surging over 37 times this year. These attacks exploit the OAuth 2.0 Device Authorization Grant flow, tricking victims into entering codes on legitimate login pages to grant attackers access to their accounts. Cybercriminals are using readily available phishing-as-a-service kits like EvilTokens, VENOM, SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOWTOKEN, PAPRIKA, DCSTATUS, and DOLCE to facilitate these attacks. Security experts recommend disabling the device code flow when not needed and monitoring account activity for suspicious authentication events.

Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

realnarrativenews.com · 3 months ago

NULL

European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack

www.securityweek.com · 3 months ago

Hackers breached the European Commission’s cloud infrastructure, resulting in the theft of over 300 gigabytes of data. The breach occurred on March 24 and was linked to a compromised API key obtained through a supply chain attack targeting Aqua Security’s Trivy vulnerability scanner, perpetrated by the TeamPCP hacking group. Attackers gained access to an AWS account supporting the Europa.eu platform, which hosts websites for the European Commission and other EU entities, and exfiltrated data impacting at least 71 clients. The stolen information, including personal data, has been published on a Tor-based leak site by the ShinyHunters extortion group.

Uber and Lyft Offer Gas Price Relief, but Drivers Say It’s Not Enough

www.nytimes.com · 3 months ago

false

Chinese firms market Iran war intelligence ‘exposing’ U.S. forces

www.washingtonpost.com · 3 months ago

Chinese companies are reportedly marketing detailed intelligence about U.S. military movements to clients. This information includes details on equipment at U.S. bases, carrier group movements, and aircraft deployment strategies. Some of these companies have connections to China’s military. The intelligence has been circulating on social media platforms in both Western and Chinese markets.

Hackers Launch Social Engineering Offensive Against Key Node.js Maintainers

gbhackers.com · 3 months ago

Hackers are conducting sophisticated social engineering attacks against Node.js and npm maintainers, following a supply chain compromise of the Axios package. Threat actors are building rapport over weeks through platforms like LinkedIn and Slack before directing targets to fake video conferencing platforms to install a persistent Remote Access Trojan. This malware bypasses security measures and allows attackers to gain write access to the npm registry, potentially impacting millions of enterprise services. Cybersecurity experts suspect the attacks are linked to UNC1069, a group previously known for targeting cryptocurrency wallets.

Proof-of-Personhood Without Biometrics: The IRLid Protocol

irlid.co.uk · 3 months ago

false

Top 10 Best Privileged Access Management (PAM) Solutions 2026

gbhackers.com · 3 months ago

Privileged Access Management is increasingly important for organizations facing growing cyber threats and data breaches. Several solutions cater to various needs, ranging from large enterprises to those using cloud-native and DevOps environments. These solutions offer features like credential vaulting, session management, and Just-in-Time access, with CyberArk recognized as a leader for large organizations. Considerations for selection include ease of use, cost, and integration capabilities.

LinkedIn Hidden Code Secretly Scans Users’ Computers for Installed Software

gbhackers.com · 3 months ago

LinkedIn is reportedly engaging in undisclosed surveillance of its users’ computers, scanning for installed software and browser extensions without consent or disclosure. The platform is linking this data to identified professionals, potentially revealing sensitive personal information and tracking job search activities. LinkedIn is also accused of corporate espionage by monitoring users of competing sales tools and deceiving European regulators regarding its compliance with the Digital Markets Act. The investigation reveals data sharing with third-party firms like HUMAN Security, and the use of encrypted scripts for tracking user behavior.

Anthropic Ends Claude Subscription Access for Third-Party Tools Like OpenClaw

gbhackers.com · 3 months ago

Anthropic is restricting third-party access to its Claude subscription services, effective April 4th. This action targets unauthorized integrations like OpenClaw, which previously exploited an OAuth authentication loophole to utilize subscription models. The company cites server load as the reason for the change, prioritizing resources for native Claude products. Users now have options for pay-as-you-go usage or API key authentication, with Anthropic offering a one-time credit and discounted bundles to ease the transition.

ShieldNet Trust Posture

www.shieldnet.app · 3 months ago

ShieldNet provides a security dashboard to monitor and improve trust posture across various systems. It offers detection layers, threat classifications, and framework alignment including the OWASP LLM Top 10 and the NIST AI Risk Management Framework. Users can scan external assets, review active CVEs, enable drift protection, and review the methodology behind the system. AI-predicted vulnerabilities are automatically distributed as guardrail rules to customers, with a focus on AI-relevant CVEs.

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications

unit42.paloaltonetworks.com · 3 months ago

Researchers have identified ways attackers can manipulate AI agents within multi-agent systems, such as those built on Amazon Bedrock, to extract sensitive information and misuse tools. Exploitation involves bypassing prompt-based guardrails through social engineering and delivering targeted payloads to agents. Defenses include utilizing Bedrock's built-in prompt attack Guardrail, implementing least privilege access, and employing layered security approaches such as Prisma AIRS. Securing these systems requires careful design and continuous monitoring to prevent prompt injection and other attacks.

Friday Squid Blogging: Jurassic Fish Chokes on Squid

www.schneier.com · 3 months ago

false

Inconsistent Privacy Labels Don't Tell Users What They Are Getting

www.darkreading.com · 3 months ago

false

LinkedIn secretly scans for 6,000+ Chrome extensions, collects data

www.bleepingcomputer.com · 3 months ago

LinkedIn is reportedly using JavaScript scripts to scan visitors’ browsers and collect device data. These scripts identify over 6,000 installed browser extensions and gather information such as CPU core count, screen resolution, and battery status. The company claims this scanning is to protect the platform and users by identifying extensions that violate its terms of service, but critics allege it’s used to gather data on competitor software usage. LinkedIn disputes claims of misuse, attributing the report to a banned user attempting to re-litigate a legal dispute.