Blahalla

New BioShocking Attack Tricks AI Browsers Into Leaking Credentials

www.techrepublic.com · 3 months ago

LayerX found that BioShocking could trick AI browsers into leaking credentials by disguising malicious prompts as game rules.

FortiBleed credential-theft campaign linked to Lynx ransomware

www.bleepingcomputer.com · 3 months ago

The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions.

Kubota says hackers had month-long access to network systems

www.bleepingcomputer.com · 3 months ago

Kubota North America Corporation disclosed that hackers had access to some of its network systems for more than a month earlier this year.

Microsoft Warns: Fake Perplexity Extension Abused Chrome Search Features

www.techrepublic.com · 3 months ago

Microsoft found a fake Perplexity AI Chrome extension that rerouted searches through attacker servers. Here’s what users should check now.

Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS

www.darkreading.com · 3 months ago

Attackers fingerprint victims through user-agent data to deliver OS-specific payloads, increasing compromise rates and campaign profitability.

New ChocoPoC malware targets researchers via trojanized PoC exploits

www.bleepingcomputer.com · 3 months ago

Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers.

ChocoPoc malware delivered via trojanized exploits on GitHub

www.bleepingcomputer.com · 3 months ago

Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data.

And the Winner in Dominant Malware Delivery? ClickFix

www.darkreading.com · 3 months ago

Researchers say the highly effective social engineering technique is no longer the exception for malware attacks, it's now the rule.

Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters

thehackernews.com · 3 months ago

Argo CD, a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated attacker run code, provided they can reach the component's internal network port. Synacktiv, which found the bug, says it can lead to a full cluster takeover. There is no fix and no CVE.

19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges

thehackernews.com · 3 months ago

A teenager accused of belonging to the hacking group Scattered Spider has been extradited from Finland to face U.S. charges of conspiracy, computer intrusion, and fraud, the U.S. Department of Justice announced on July 1. Peter Stokes, 19, a dual U.S. and Estonian citizen, appeared in a Chicago federal court on June 30, where a judge ordered him held in custody.

Aflac Data Breach: Over 4M Customers in Japan May Be at Risk

www.techrepublic.com · 3 months ago

Aflac says a data breach in Japan may affect 4.38 million customers and agents, exposing personal, policy, and some banking information.

Microsoft Uncovers Widespread Hotel Phishing Campaign in Japan

www.techrepublic.com · 3 months ago

Microsoft and Trend Micro found hotel phishing attacks using fake guest complaints and photo links to target staff in Japan.

Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings

www.securityweek.com · 3 months ago

Microsoft's new Teams admin policy requires organizer approval for external AI bots, giving organizations greater visibility and control over automated participants in sensitive meetings.

SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

thehackernews.com · 3 months ago

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT. Kaspersky said the activity is part of a "massive, multi-domain, multi-language" campaign that distributes malicious installer archives hosted on spoofed websites. These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam, among others.

DHS confirms hackers breached HSIN info-sharing platform

www.bleepingcomputer.com · 3 months ago

The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector partners.

VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

thehackernews.com · 3 months ago

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEILDROP by Securonix.

Webinar: Why traditional email security is no longer enough

www.bleepingcomputer.com · 3 months ago

Modern phishing, business email compromise, and account takeover attacks increasingly exploit trusted identities and legitimate business workflows, making them harder for traditional email defenses to detect. This webinar explores how behavioral AI can help organizations automate detection and response.

Hackers target Microsoft 365 accounts with 81 million login attempts

www.bleepingcomputer.com · 3 months ago

An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period.

Zero-Click Prompt Injection to RCE in Cursor IDE: DuneSlide

www.catonetworks.com · 3 months ago

Cato AI Labs just disclosed DuneSlide, two critical RCE vulnerabilities found in Cursor IDE: CVE-2026-50548 and CVE-2026-50549. Both are rated Critical. The interesting part is the attack path. This was not just prompt injection changing model output. The agent could ingest untrusted content from sources like MCP servers or web search results, then act through the app around it.

Microsoft named a leader in the Frost Radar for cloud and application runtime security

www.microsoft.com · 3 months ago

Frost & Sullivan names Microsoft a leader as cloud and application security converge into unified, runtime risk reduction.

Cisco Catalyst Center Arbitrary File Read Vulnerability

sec.cloudapps.cisco.com · 3 months ago

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.

ClamAV Vulnerabilities Affecting Cisco Products: July 2026

sec.cloudapps.cisco.com · 3 months ago

Multiple vulnerabilities in ClamAV could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations. For more information about these vulnerabilities, see the Details section of this advisory. For additional information on these vulnerabilities in ClamAV, see the ClamAV blog. Cisco has released software updates that address these vulnerabilities.

6 security settings every GitHub maintainer should enable this week

github.blog · 3 months ago

These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors. Turn these on, and your project will be meaningfully harder to attack than it was before.

Turning Indicators into Intelligence in OpenCTI with Criminal IP

gbhackers.com · 3 months ago

Torrance, California, USA, July 1st, 2026, CyberNewswire Cyber threat intelligence becomes more valuable when indicators are enriched with context that supports investigation, correlation, and decision-making.

When Too Much Security Data Became the Risk

www.darkreading.com · 3 months ago

Rapid growth turned routine firewall logs into a security and budget liability. One CISO used artificial intelligence to filter what data truly belongs in the SIEM.

Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

thehackernews.com · 3 months ago

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its real payload inside an image.

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

thehackernews.com · 3 months ago

Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic. The ColdFusion updates "resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass," Adobe said in an alert released Tuesday.

'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat

www.darkreading.com · 3 months ago

LLMs consistently hallucinate Web domains for legitimate brands that attackers can register for malicious activity in a difficult-to-detect attack vector.

Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands

thehackernews.com · 3 months ago

Two flaws in Cursor, an AI code editor, could let a single, ordinary-looking prompt break out of the editor's safety sandbox and run any command on a developer's computer. There is no click to fall for and no approval box to ignore. Cato AI Labs found the pair and named them DuneSlide. They are tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 out of 10 (or 9.

Turning Indicators into Intelligence in OpenCTI with Criminal IP

www.bleepingcomputer.com · 3 months ago

Threat intelligence is only as useful as the context behind it. Criminal IP explains how its integration enriches threat indicators in OpenCTI with risk scoring, infrastructure intelligence, and phishing analysis.

Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts

thehackernews.com · 3 months ago

A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire's Threat Response Unit (TRU). The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037 (CVSS score: 9.

Mitigating Attacks Before They Impact Infrastructure: Link11 provides next generation network DDoS protection

gbhackers.com · 3 months ago

Frankfurt am Main, Deutschland, July 1st, 2026, CyberNewswire Link11, a leading European provider of cloud-based cybersecurity solutions, today announced the launch of its completely rebuilt Layer 3/4 DDoS mitigation solution, designed to address the growing complexity of modern network attacks. Today’s DDoS attacks are not just simple volume or protocol attacks anymore.

r/netsec monthly discussion & tool thread

www.reddit.com · 3 months ago

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links. Rules & Guidelines Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary. Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.

Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657)

syntetisk.tech · 3 months ago

An unprivileged user inside a Lima QEMU guest could reach the root-owned guest-agent socket and run commands as root in the VM. Fixed in Lima v2.1.3. Lima scored it High, CVSS 8.2 with Scope: Changed, reflecting that crossing from an unprivileged account to root within the VM crosses a security boundary that other components rely on. Full write up is available on the Syntetisk blog.

Safe Events Start With Threat Intel and Digital Security

www.darkreading.com · 3 months ago

Planning ahead to defend against cyber threats is the work that keeps events uneventful.

AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android

thehackernews.com · 3 months ago

Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both Windows and Android devices.

Malicious Google Notes Extension Swaps Crypto Wallet Addresses During Transactions

gbhackers.com · 3 months ago

Technically sophisticated campaign delivering a malicious Chromium extension that silently swaps cryptocurrency wallet addresses during transactions. Delivered via unsigned installers observed in both.NET and Golang variants access, the payload masquerades as a minimalist “Google Notes” browser extension.

Over 900 Oracle E-Business instances exposed to ongoing attacks

www.bleepingcomputer.com · 3 months ago

Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw.

MacSync Stealer Hijacks macOS via Fake Claude Code Google Ads – Full Attack Chain Exposed

gbhackers.com · 3 months ago

MacSync Stealer is a newly discovered macOS infostealer actively distributed through a sophisticated malvertising campaign on Google Ads that impersonates Anthropic’s Claude Code CLI.

ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts

gbhackers.com · 3 months ago

ToddyCat, an advanced persistent threat group long associated with targeted espionage against corporate environments, has evolved its toolkit to exploit OAuth-based authorization flows and compromise Gmail accounts without directly stealing credentials.

2026 Cybersecurity Assessment: The Gap Between Awareness and Resilience

thehackernews.com · 3 months ago

Organizations have never had greater awareness of cyber risk. Yet turning that awareness into operational resilience has never been more challenging. The 2026 Bitdefender Cybersecurity Assessment confirms this is the case, as this year's findings reveal a series of surprising contradictions.

Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities

www.securityweek.com · 3 months ago

Seven of the security defects have a maximum severity rating of 10/10 and could lead to arbitrary code execution.

FCC Bans Chinese-Produced Network Equipment Linked to Cyber and Espionage Risks

gbhackers.com · 3 months ago

The U.S. Federal Communications Commission (FCC) has implemented comprehensive new restrictions banning the import and marketing of Chinese-produced telecommunications and surveillance equipment identified as posing significant cybersecurity and espionage risks.

Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack

www.securityweek.com · 3 months ago

Citrix urges customers to patch NetScaler after fixing six vulnerabilities, including the HTTP/2 Bomb flaw and a high-severity CitrixBleed-style information disclosure bug.

CISA Adds Actively Exploited SimpleHelp Vulnerability to KEV Catalog

gbhackers.com · 3 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in SimpleHelp, tracked as CVE-2026-48558, and added it to its Known Exploited Vulnerabilities (KEV) catalog. This indicates that the vulnerability is actively being exploited in the wild, and CISA is urging immediate remediation.

The Gentlemen Ransomware Targets Large Corporations and Critical Infrastructure Worldwide

gbhackers.com · 3 months ago

The Gentlemen ransomware group has emerged in 2026 as a highly adaptive and technically sophisticated ransomware-as-a-service (RaaS) operation targeting large corporations and critical infrastructure across multiple regions. Public reporting places The Gentlemen among the top 10 ransomware actors by victim announcements on its data leak site during the first half of 2026 (see ransomware.

Papa Johns Surveillance-Based Advertising

www.schneier.com · 3 months ago

Papa Johns is spying on people’s buying activities to predict when they are low on food: The pizza chain recently tapped NBCUniversal, Instacart and the dentsu-owned media agency Carat for help reaching consumers when they’re low on groceries, and thus more likely to be swayed by a mouth-watering ad.

Microsoft fixes GIF functionality in the Windows Emoji Panel

www.bleepingcomputer.com · 3 months ago

Microsoft has fixed the GIF functionality in the Emoji Panel for Windows 11 and Windows Server users after the provider shut down its service.

Microsoft Accelerates Post-Quantum Cryptography Shift to 2029

thehackernews.com · 3 months ago

Microsoft on Tuesday said it's accelerating its quantum safe security roadmap, stating technology advances in quantum computing are making it essential to replace existing encryption standards sooner than previously expected. "Advances in quantum research and development have shifted the risk horizon," Mark Russinovich, chief technology officer of Microsoft Azure, said.

Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors

www.securityweek.com · 3 months ago

From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype.