Blahalla

Iran Threatens to Attack Apple, Google, and Other US Tech Firms in Middle East

www.techrepublic.com · 3 months ago

There are threats from Iran’s Islamic Revolutionary Guard Corps to begin targeting units of 18 named US and regional technology, aerospace, and finance companies across the Middle East starting at 8:00 p.m. Tehran time on Wednesday, April 1, 2026, with employees urged to evacuate corporate sites and civilians advised to stay at least one kilometer from those facilities. The roster includes Apple, Google, Microsoft, Nvidia, Intel, Oracle, HP, IBM, Cisco, Dell, Palantir, Tesla, Boeing, J.P. Morgan Chase, GE, the UAE AI firm G42, and Dubai based Spire Solutions, and the IRGC accused these firms of enabling surveillance and AI driven targeting tied to recent killings of Iranian officials. Reports indicate Iranian drones may have struck or targeted Amazon Web Services data centers in the United Arab Emirates and Bahrain though those details are unconfirmed, and security analysts say the situation is being closely monitored.
Microsoft: Hackers Are Using WhatsApp to Deliver Malware to Windows PCs

www.techrepublic.com · 3 months ago

Hackers are using WhatsApp messages with malicious Visual Basic script attachments to deliver multi stage malware to Windows PCs, exploiting trust in WhatsApp desktop and web and triggering execution when users click the attachment. The malware hides in the C drive ProgramData directory, renames itself to resemble legitimate system components such as assc.exe and netapi.dll, retrieves payloads from trusted cloud platforms including AWS S3, Tencent Cloud and Backblaze B2, and attempts to bypass User Account Control, modify registry settings, suppress future prompts and install unsigned Microsoft Installers to establish persistence and backdoor access. Recommended defenses include vigilance for social engineering, stronger endpoint controls and network monitoring, continuous monitoring of UAC and registry changes, blacklisting command and control servers and enabling tamper protection.
Can Science Predict When a Study Won’t Hold Up?

www.nytimes.com · 3 months ago

false
New DeepLoad Malware Dropped in ClickFix Attacks

www.securityweek.com · 3 months ago

DeepLoad is a newly observed malware family dropped through ClickFix social engineering that steals credentials can replace cryptocurrency wallet applications and browser extensions with fake variants and installs a rogue browser extension to capture active logins session tokens open tabs and saved passwords. The campaign uses fake browser error messages to trick victims into pasting a command that runs a persistent PowerShell loader which compiles and drops a DLL in the temporary directory injects into LockAppHost.exe via asynchronous procedure call injection executes the payload in memory and disables PowerShell command history to evade detection while keeping credential exfiltration separate from command and control communications. ZeroFox first saw DeepLoad advertised on a dark web forum in early February and ReliaQuest observed the first in the wild distribution to Windows systems and the malware has also been observed spreading via USB drives though researchers could not determine whether that capability is native or operator staged.
Venom Stealer MaaS Platform Commoditizes ClickFix Attacks

www.darkreading.com · 3 months ago

There is a Venom Stealer malware as a service platform that automates ClickFix style social engineering into a persistent multistage pipeline that continuously harvests credentials, session cookies, browser data, and cryptocurrency wallet secrets and sends them for automated cracking and exfiltration. The service is offered by an operator under the name VenomStealer on a subscription basis with reported pricing of 250 dollars per month or 1,800 dollars for lifetime access, and it provides Windows and macOS templates that lure targets with fake CAPTCHAs, update prompts, and commands that victims paste into Run dialogs or terminals while including evasion features such as silent privilege escalation to extract browser decryption keys without triggering user account control. Recommended mitigations include restricting PowerShell execution, disabling the Run dialog for standard users, user training to recognize ClickFix style prompts, and monitoring and controlling outbound traffic to detect or block exfiltration.
Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome

www.securityweek.com · 3 months ago

There are 21 vulnerabilities patched in Chrome 146, including an exploited zero-day tracked as CVE-2026-5281. CVE-2026-5281 is a use-after-free flaw in Chrome’s Dawn graphics component and Google said it is aware of an exploit in the wild. The update addresses 19 high-severity and 2 medium-severity issues, credits an anonymous researcher for reporting CVE-2026-5281 and also references related CVEs including CVE-2026-5284, CVE-2026-2441, CVE-2026-3909, and CVE-2026-3910.
Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

thehackernews.com · 3 months ago

There is a campaign beginning in late February 2026 that uses WhatsApp messages to deliver malicious Visual Basic Script files which launch a multi stage infection chain to establish persistence and enable remote access. The scripts create hidden folders in C colon ProgramData, drop renamed legitimate Windows utilities such as curl.exe renamed to netapi.dll and bitsadmin.exe renamed to sc.exe, retrieve auxiliary payloads from trusted cloud services including AWS S3, Tencent Cloud, and Backblaze B2, and install unsigned MSI packages. Attackers tamper with User Account Control settings, repeatedly attempt to launch cmd.exe with elevated privileges, modify registry entries under HKLM Software Microsoft Win, and deploy persistent remote access tools like AnyDesk to enable data exfiltration and further malware deployment.
Routine Access Is Powering Modern Intrusions, a New Threat Report Finds

www.bleepingcomputer.com · 3 months ago

There is a documented shift in attacker behavior where intrusions increasingly begin with valid credentials and routine access rather than vulnerability exploits, based on analysis of incidents from 2025. SSL VPN abuse accounted for 32.8 percent of identifiable incidents, remote monitoring and management tool abuse appeared in 30.3 percent with ScreenConnect present in over 70 percent of rogue RMM cases, and social engineering campaigns such as Fake CAPTCHA and ClickFix-style lures drove 57.5 percent of incidents by tricking users into executing built in Windows commands. Cloud compromises frequently involved session reuse after multi factor authentication where adversary in the middle phishing accounted for about 16 percent of cloud account disables, and defenders are advised to treat remote access as high risk, inventory and remove unauthorized RMM agents, block unapproved installations, and apply Conditional Access controls that evaluate device posture location and session risk; the report also documents a WebSocket based implant called Roadk1ll used to pivot across systems.
Google Warns Quantum Computers Could Crack Crypto Sooner Than Expected

www.techrepublic.com · 3 months ago

Google Quantum AI researchers published research on March 31, 2026 saying future quantum computers could break the elliptic curve cryptography that secures major blockchain networks with far fewer qubits than earlier estimates, suggesting fewer than 500,000 physical qubits might be enough to break the 256 bit elliptic curve discrete logarithm problem. That reduction shortens the industry timeline for risk, with outside researchers warning the probability of a quantum computer capable of recovering private keys by 2032 may be meaningful, and the primary threat is to wallet security when public keys are exposed or old inactive wallets give attackers extra time. Google urges migration to post quantum cryptography, has set an internal goal to migrate its security infrastructure by 2029, and used a zero knowledge proof to share technical findings without revealing exploitable details in support of responsible disclosure.
FBI Warns of Data Security Risks From China-Made Mobile Apps

www.securityweek.com · 3 months ago

There are data security risks from mobile apps developed in China that can collect and exfiltrate sensitive information, perform covert monitoring, and accept remote commands that could compromise devices and networks. The FBI warns organizations to restrict or remove such apps from official devices, inventory installed applications, and assess supply chain and data access risks, while not naming specific problematic apps though TikTok and Temu are commonly cited examples. Officials urge strict access controls, regular reviews of mobile software, and adherence to guidance to reduce the potential for espionage and data exposure.
US Charges Uranium Crypto Exchange Hacker

www.securityweek.com · 3 months ago

Jonathan Spalletta, 36, of Rockville, Maryland, has been charged in the United States for exploiting smart contract vulnerabilities in the decentralized exchange Uranium Finance, stealing approximately $55 million in cryptocurrency and causing the platform to shut down. He allegedly carried out two exploits in April 2021, first withdrawing about $1.4 million and later draining roughly $53.3 million across 26 liquidity pools, then laundered the proceeds through a crypto mixer and spent funds on collectible items. Law enforcement seized about $31 million, he surrendered to authorities, and he faces charges including computer fraud and money laundering that carry maximum sentences of ten years and twenty years respectively.
AI-Generated Calendar Event Phishing w/ Dynamic Landing Pages

phishu.net · 3 months ago

There is a Calendar Event Invite capability in the PhishU Framework that converts calendar phishing into a point and click campaign workflow with AI assisted authoring, native invite rendering, tracked links, and campaign linked training. Operators can select a calendar template, configure event title, timing, location, reminders, and use AI to generate plausible event metadata and body before delivering a native ICS invitation that appears inside recipients mail and calendar clients. Campaigns automatically create training slides that recreate the received invite in a calendar style renderer so defenders learn calendar specific trust risks rather than only inbox phishing indicators.
Webinar Today: Agentic AI vs. Identity’s Last Mile Problem

www.securityweek.com · 3 months ago

Agentic AI is reshaping identity security by autonomously planning, adapting, and executing controls across the enterprise. The last mile of identity tied to disconnected applications and manual processes remains where attackers gain their biggest advantage. Nearly half of enterprise applications still fall outside traditional identity systems and are managed through spreadsheets, email, and help desk workflows, creating blind spots. A webcast from SecurityWeek and Cerby will examine real world breach scenarios linked to disconnected applications, explore what Agentic AI can and cannot solve today, and outline how automation and extended identity lifecycle management can bring those applications inside the identity perimeter.
Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns

gbhackers.com · 3 months ago

There is a Node.js backdoor called EtherRAT that abuses the Ethereum blockchain via a technique called EtherHiding to store and rotate command and control endpoints in a smart contract and resolve them through public RPC endpoints, enabling operators to reassert control by paying small gas fees. Intrusions typically start with Microsoft Teams IT support scams and ClickFix lures that deploy an obfuscated multi stage Node.js loader which decrypts and executes payloads in memory, establishes persistence through randomly named Run keys, and proxies node.exe through conhost.exe while abusing living off the land binaries. EtherRAT harvests credentials and cryptocurrency wallets, performs deep host fingerprinting, supports reobfuscation and debug logging to evade detection, and uses CDN style HTTPS beacon URLs to blend C2 traffic into normal web activity. Recommended mitigations include blocking unnecessary crypto RPC providers, deploying next generation antivirus or endpoint detection and response with Node.js and LOLBin detection, isolating affected hosts and updating detection content, disabling or restricting mshta.exe and pcalua.exe where feasible, and strengthening phishing awareness and IT support scam simulations.
Gmail Finally Lets You Change Your Email Address Without Losing Anything

www.techrepublic.com · 3 months ago

false
Google Warns of New Chrome Zero-Day Under Active Exploitation – Users Urged to Update Immediately

gbhackers.com · 3 months ago

There are 21 vulnerabilities fixed in an urgent Chrome desktop update that users are urged to install immediately, with stable releases 146.0.7680.177 and 146.0.7680.178 for Windows and Mac and 146.0.7680.177 for Linux. The most severe is a critical zero day, CVE-2026-5281, a use after free memory flaw in the Dawn component that is confirmed to be exploited in the wild and can enable remote code execution when a user visits a compromised website. The update also remediates 20 additional high and medium severity memory safety bugs including heap buffer overflows, integer overflows, out of bounds reads and multiple use after free flaws across WebCodecs, ANGLE, V8, WebGL, PDF and WebView; the disclosed CVEs are CVE-2026-5272, CVE-2026-5273, CVE-2026-5274, CVE-2026-5275, CVE-2026-5276, CVE-2026-5277, CVE-2026-5278, CVE-2026-5279, CVE-2026-5280, CVE-2026-5281, CVE-2026-5282, CVE-2026-5283, CVE-2026-5284, CVE-2026-5285, CVE-2026-5286, CVE-2026-5287, CVE-2026-5288, CVE-2026-5289, CVE-2026-5290, CVE-2026-5291 and CVE-2026-5292.
Block the Prompt, Not the Work: The End of "Doctor No"

thehackernews.com · 3 months ago

There is a recurring Doctor No problem in enterprise security where blanket blocking of new tools and AI forces employees to create invisible workarounds that bypass controls. Blocking through invasive endpoint agents, SSL inspection, and URL blacklists creates a visibility gap because browser sessions, extensions, and unmanaged devices can route sensitive data to personal services or external servers without triggering alerts. The emerging standard is session level governance that secures the browser as the point of risk by applying prompt level data loss prevention, extension risk scoring, and agentless clipboard and upload controls so security can enable work instead of breaking it.
Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures

thehackernews.com · 3 months ago

A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans such as Casbaneiro, also known as Metamorfo, using Horabot as a delivery and propagation mechanism. Phishing emails impersonate court summons and attach password-protected PDFs that direct victims to malicious links which download ZIP archives that execute HTA and VBS payloads, leading to AutoIt-based loaders that extract and run encrypted DLL payloads to launch Casbaneiro and Horabot. Casbaneiro’s Delphi DLL contacts command-and-control to retrieve a PowerShell script that uses Horabot to harvest Outlook contacts and send dynamically generated, PIN-protected PDF lures from compromised accounts, while the operators also employ WhatsApp automation and ClickFix social engineering to spread the malware.
Microsoft Teams to Improve Privacy With EXIF Data Removal Feature

gbhackers.com · 3 months ago

Microsoft is rolling out privacy and security updates for Microsoft Teams that include an automatic EXIF metadata removal feature for shared images to prevent accidental location, timestamp, and device leaks used in open source intelligence and targeted social engineering. IT administrators will get a voice and face profile enrollment dashboard in the Teams Admin Center to audit biometric enrollments and adoption across organizations. Teams on the web will enforce modern browser requirements compliant with ECMAScript 2022, with warnings followed by a mandatory block for outdated browsers beginning May 15, 2026, and a new privacy safe presence setting will report only raw active or idle states without tracking specific applications or screen content.
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released

thehackernews.com · 3 months ago

Google released security updates for Chrome to address 21 vulnerabilities, including a high severity zero day use after free in Dawn tracked as CVE-2026-5281 that has been exploited in the wild. The flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code via a crafted HTML page, and Google acknowledged awareness of in the wild exploitation. Users are advised to update Chrome to versions 146.0.7680.177 or 146.0.7680.178 as applicable, and other recently exploited Chrome zero days include CVE-2026-3909, CVE-2026-3910, and CVE-2026-2441.
FBI warns against using Chinese mobile apps due to privacy risks

www.bleepingcomputer.com · 3 months ago

The FBI warns Americans against using foreign developed mobile applications, particularly those built and maintained in China, because of privacy and data security risks. The bureau says some apps may continuously collect personal and system data, including address book entries, user IDs, and other private information, even when permissions are limited, and that collected data is sometimes stored on servers in China for indefinite periods. To protect privacy users are advised to turn off unnecessary data sharing, keep device software up to date, download verified apps only from official app stores, and use a password manager rather than frequent manual password changes. Anyone who suspects their data was compromised after installing a foreign developed mobile app should report the incident to the FBI through its IC3 platform.
Cisco Faces Alleged Data Leak as ShinyHunters Claims Responsibility

gbhackers.com · 3 months ago

Cisco is dealing with a major cybersecurity incident after threat actors breached its internal development networks and the hacking group ShinyHunters claimed responsibility. The breach stems from a Trivy supply chain attack in which a malicious GitHub Action plugin was used to steal credentials and gain access to internal build environments. Attackers exfiltrated multiple AWS keys and cloned over three hundred private GitHub repositories containing unreleased source code for AI Assistants and AI Defense technologies, with some repositories reportedly belonging to Cisco customers including banks and government agencies. Cisco isolated affected systems, wiped and reinstalled compromised machines, enforced massive credential resets, and researchers warn multiple threat actors were involved with links to a group known as TeamPCP that uses a TeamPCP Cloud Stealer.
Top 10 Best Dynamic Application Security Testing (DAST) Platforms in 2026

gbhackers.com · 3 months ago

There are ten leading Dynamic Application Security Testing platforms in 2026 that emphasize runtime vulnerability detection, language and framework agnosticism, and integration into CI CD pipelines to find issues like SQL injection and cross site scripting. They include Acunetix, Burp Suite, Rapid7 InsightAppSec, Invicti, AppCheck, Detectify, Intruder, Qualys, OWASP ZAP, and HCL AppScan, each evaluated for capabilities such as API and single page application scanning, proof based verification, automated penetration testing, and hybrid sensor assisted scanning. Recommended use cases pair Burp Suite with professional penetration testers, Acunetix and Invicti with teams seeking low false positives and precise remediation, and Rapid7 with organizations wanting cloud native automation and centralized vulnerability management.
WhatsApp malware campaign uses malicious VBS files to gain persistent access

www.csoonline.com · 3 months ago

Microsoft warned on March 31, 2026 that attackers have been distributing malicious Visual Basic Script files via WhatsApp since at least late February. When executed, the scripts run a delayed, multi stage infection that creates hidden directories, deploys renamed legitimate Windows utilities such as curl.exe and bitsadmin.exe to download additional payloads, and stages components on trusted cloud hosts. The campaign culminates with Microsoft Installer packages used as backdoors to maintain persistent, elevated access and enable remote control. Recommended defenses include monitoring script and installer execution, flagging files whose filename does not match their embedded OriginalFileName metadata, watching for misuse of legitimate system tools, and tracking suspicious files delivered through messaging platforms like WhatsApp.
Vim Modeline Vulnerability Opens Door to Arbitrary OS Command Execution

gbhackers.com · 3 months ago

A high severity modeline parsing flaw in the Vim text editor allows attackers to execute arbitrary operating system commands when a user opens a specially crafted file. The vulnerability is tracked as CVE-2026-34982 and can be exploited simply by tricking a user into opening a malicious file. Unpatched Vim installations are affected, and administrators should apply available updates or disable modeline parsing to prevent remote command execution.
3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)

thehackernews.com · 3 months ago

There are three reasons attackers favor trusted tools: attacks no longer look like attacks, internal attack surface is larger and mostly unmanaged, and detection alone cannot keep up. Analysis of over 700,000 high severity incidents shows 84 percent of attacks now abuse legitimate tools, with adversaries using built in binaries such as PowerShell, WMIC, and Certutil to blend into normal operations. Because native tools are trusted by default and often widely accessible, organizations frequently have unnecessary permissions and lack visibility across the environment, creating attack paths that cannot be blocked without breaking workflows. Shifting from reactive detection to proactive internal attack surface visibility and assessments can reveal unnecessary access, prioritize remediation, and reduce pathways attackers use to move laterally, escalate privileges, and persist.
CrystalX Malware-as-a-Service Spreads via Telegram With Stealer, RAT Tools

gbhackers.com · 3 months ago

Hackers are promoting a malware as a service platform called CrystalX RAT through private Telegram channels and other outlets, selling it under a subscription model with multiple pricing tiers and aggressive marketing including giveaways and a YouTube showcase. The platform provides an automated builder to customize payloads and combines remote access, stealer, keylogger, clipper, spyware, and prankware functions while using zlib compression and ChaCha20 encryption and multiple anti analysis techniques such as proxy and virtual machine detection, anti debugging, and patching of AMSI and ETW to evade detection. Once executed, CrystalX connects to a WebSocket command and control server to collect system data and credentials from services like Steam, Discord, and Telegram, extracts browser data using tools such as ChromeElevator, stores results locally and exfiltrates them in JSON, and offers full system control including file operations, a built in VNC module, microphone and webcam capture, and input blocking. It also includes a clipboard hijacker that swaps cryptocurrency addresses via a malicious browser extension and a Rofl module that enables trolling actions such as rotating screens, changing wallpapers, swapping mouse buttons, disabling Task Manager, and forcing shutdowns, and although infections appear concentrated in Russia the service has no geographic restrictions and is under active development.
Hacker zielen auf Exilportal Iranwire

www.csoonline.com · 3 months ago

Unknown hackers reportedly accessed data from exiled news portal Iranwire, exfiltrating large amounts including correspondence, employee lists, informant lists, and highly confidential records. Iranwire was briefly inaccessible with a maintenance notice but remained active on social media and continued posting on X without reporting a breach. Iranian judicial news agency Misan attributed the attack to hacker group Handala and linked the group to a recent cyberattack on Kash Patel, identified in the report as the director of the United States Federal Bureau of Investigation.
Are We Training AI Too Late?

www.darkreading.com · 3 months ago

false
Cybersecurity Firm TAC Security Hits 10,000 Clients, Enters Top 5 in Global VM & AppSec

gbhackers.com · 3 months ago

On April 1, 2026, TAC Infosec announced it surpassed 10,000 clients worldwide, with more than 6,500 for TAC Security and over 3,500 for CyberScope since April 2024, and now operates in 100 plus countries. The company said this scale places it among the top five global vulnerability management firms and enables expansion of its ESOF platform for AppSec and vulnerability management, Socify for compliance automation and SOC 2 readiness, and CyberScope for Web3 security and smart contract audits. TAC highlighted partner recognitions and certifications including Google CASA and MASA assessor roles, ISO IEC 17025 2017, CREST accreditation, CERT In empanelment, PCI ASV and ISO 27001, and its founder and CEO Trishneet Arora said the milestone validates a trusted distribution platform that supports a 2030 target of one hundred million dollars in annual recurring revenue.
Hackers Exploit Hotel Booking Systems to Send Fake Payment Requests to Guests

gbhackers.com · 3 months ago

Hackers are exploiting hotel booking workflows by sending fake payment requests that include real reservation details such as hotel name and stay dates to trick guests into providing payment information. Attackers often obtain access by phishing hotel staff or partners to steal credentials and then send fraudulent messages through legitimate channels including Booking dot com messaging, WhatsApp, SMS, and email, using urgency and branded PDFs or typo squatted domains to harvest card details. Travelers should avoid clicking links in unsolicited messages and verify payment requests through official apps or by contacting the hotel directly, while hotels should deploy phishing resistant authentication, staff training, and monitoring of guest messaging systems to reduce this attack surface.
Google fixes fourth Chrome zero-day exploited in attacks in 2026

www.bleepingcomputer.com · 3 months ago

Google released emergency updates to fix a fourth Chrome zero day exploited in the wild in 2026 and warned that an exploit exists for CVE-2026-5281. The vulnerability is a use after free in Dawn, the WebGPU implementation used by Chromium, which can cause browser crashes, data corruption and rendering problems, and fixes are rolling out in Stable Desktop versions 146.0.7680.177 and 146.0.7680.178 for Windows, macOS and Linux. This marks the fourth actively exploited Chrome zero day since the start of the year, after CVE-2026-2441, CVE-2026-3909 and CVE-2026-3910, and Google said technical details may remain restricted until most users receive updates.
A Taxonomy of Cognitive Security

www.schneier.com · 3 months ago

There are five levels in the proposed taxonomy of cognitive security: sensory interface, neurocompiler, mind kernel, the mesh, and cultural substrate. The NeuroCompiler interprets raw sensory signals into fast, automatic meanings before conscious awareness and is identified as the primary landing spot for cognitive exploits because it can route outputs back to the sensory interface and bypass conscious skepticism. This architecture produces predictable failures that attackers can exploit by triggering reflexive responses and shaping perception at the preconscious level.
Alleged RedLine malware developer extradited to United States

www.bitdefender.com · 3 months ago

A man has appeared in federal court in Austin, Texas, after being extradited to the United States to face charges related to his alleged role as a key developer of the RedLine infostealing malware. Prosecutors say the Armenian national Hambardzum Minasyan is charged with conspiring to develop and run RedLine, which can harvest account details and passwords saved in browsers, cookies, payment card information, and other details from compromised systems and has been deployed against systems in more than 150 countries. Authorities allege he registered virtual private servers and internet domains, created online repositories to distribute the malware, accepted cryptocurrency payments, and provided customer support for affiliates, and he faces charges that together carry a potential sentence of up to 30 years in prison following intelligence recovered during the October 2024 Operation Magnus seizure of RedLine infrastructure.
9 ways CISOs can combat AI hallucinations

www.csoonline.com · 3 months ago

There are nine ways CISOs can tackle AI hallucinations, which produce convincing but inaccurate compliance assessments and can cause poor risk judgments, incorrect policy guidance, or misleading incident reports when AI is asked to make high stakes decisions about control effectiveness or regulatory compliance. Recommended measures include keeping humans in the loop for consequential decisions, treating AI outputs as drafts that require human review and sign off, demanding traceability and concrete evidence from vendors instead of polished prose, and stress testing models for consistency and hallucination behavior. Organizations should also measure hallucination rates and model drift, watch for contextual blind spots in automated compliance mapping, push back on generic identical assessments, reinforce human accountability for audits and legal reviews, and be cautious with automated regulatory mapping to avoid false confidence in audit readiness.
Security awareness is not a control: Rethinking human risk in enterprise security

www.csoonline.com · 3 months ago

Organizations have long relied on security awareness training, phishing simulations, and annual modules, but losses from business email compromise and credential harvesting continue to rise. Awareness influences behavior but is not a security control because controls must prevent, detect, or limit outcomes regardless of individual actions or judgment. Treating human risk as an engineering constraint calls for phishing resistant authentication such as device bound passkeys and hardware backed credentials, conditional access that evaluates device health and behavior, enforced separation of duties and out of band verification for high value payments, and improved identity telemetry and time bound privileged access. The shift from blaming individuals to strengthening identity architecture, financial workflows, and real time monitoring reduces the chance that inevitable human errors will result in serious operational or financial harm.
PoC Exploit Code Published for nginx-ui Backup Restore Security Flaw

gbhackers.com · 3 months ago

A critical vulnerability tracked as CVE-2026-33026 in nginx-ui's backup restore mechanism allows attackers to tamper with encrypted backups and achieve arbitrary command execution. The flaw stems from a backup integrity bypass caused by a circular trust model in the restore process, and proof of concept exploit code has been publicly released. Administrators are urged to update to nginx-ui version 2.3.4 immediately to mitigate the issue.
Axios NPM Package Breached in North Korean Supply Chain Attack

www.securityweek.com · 3 months ago

Malicious versions 1.14.1 and 0.30.4 of the widely used Axios JavaScript library were published to the NPM registry on March 31, 2026 and removed roughly three hours later, during which they were downloaded by about three percent of users. Attackers compromised the maintainer account and used a long lived NPM access token to bypass an OIDC based GitHub Actions CI CD publishing workflow, publishing backdoored releases that relied on a pre staged phantom dependency containing a post install script to execute a cross platform remote access trojan dropper. The payloads delivered platform specific second stage malware enabling remote shell execution, code injection, directory and process enumeration, and built in forensic evasion. Security researchers attribute the operation to a North Korean actor tracked as UNC1069 and recommend treating any environment that installed the malicious packages as compromised, removing the packages, auditing dependency trees, rotating credentials used during installation, and scanning for malware artifacts.
Authority Encoding Risk (AER)

papers.ssrn.com · 3 months ago

There is a newly introduced measurable variable called Authority Encoding Risk, or AER, that quantifies authority ambiguity at the moment a decision is executed and asks whether a decision is admissible under real world authority constraints. The gap identified shows up in automation systems, AI assisted decisions, institutional workflows, underwriting and loss modeling, and explains how authority ambiguity propagates into risk and why existing frameworks fail to capture it. The paper outlines methods to measure this risk before loss occurs and describes ongoing work to tighten definitions, expand evidence, and strengthen the model.
North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems

gbhackers.com · 3 months ago

A North Korea linked threat actor hijacked the popular Axios NPM package and pushed backdoored releases 1.14.1 and 0.30.4 between March 31, 2026 00:21 and 03:20 UTC. Attackers changed the maintainer email to an attacker controlled ProtonMail address and added a malicious dependency plain-crypto-js version 4.2.1 that executes a postinstall setup script to drop a SILKBELL loader which fetches OS specific payloads and ultimately deploys the WAVESHAPER.V2 remote access trojan on Windows, macOS, and Linux. The dropper uses XOR and Base64 obfuscation, fingerprints hosts, attempts to erase traces, achieves persistence and beacons to a command and control server on port 8000 using a distinctive User Agent while supporting reconnaissance, arbitrary command execution, and in memory PE injection suitable for data theft and follow on intrusions. Defenders are advised to audit for installations of the affected Axios releases and the malicious dependency during the exposure window, review logs for outbound beaconing on port 8000 and the distinctive User Agent, rotate secrets and CI tokens, and require phishing resistant multi factor authentication for maintainer accounts and supply chain protections that detect unexpected dependencies and lifecycle scripts.
Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069

thehackernews.com · 3 months ago

There was a supply chain compromise of the popular Axios npm package. Google Threat Intelligence Group has attributed the attack to a suspected North Korean threat actor cluster tracked as UNC1069. Google characterized the activity as financially motivated. John Hultquist, chief analyst at GTIG, confirmed the attribution.
Google Addresses Vertex Security Issues After Researchers Weaponize AI Agents

www.securityweek.com · 3 months ago

Palo Alto Networks researchers showed that AI agents built on Google Cloud's Vertex AI, including the Vertex Agent Engine and Agent Development Kit, can be weaponized to exfiltrate data, create backdoors, and compromise infrastructure. They found that the Per-Project, Per-Product Service Agent called P4SA has excessive default permissions that can be abused to steal service agent credentials and pivot from the agent execution context into the owning project to download private container images, access Artifact Registry repositories, and read Cloud Storage buckets. Researchers also identified a file that could be manipulated for remote code execution and a persistent backdoor, and Google responded by updating documentation, recommending Bring Your Own Service Account to enforce least privilege, and noting controls to prevent service agents from changing production images.
Retroactive xref entanglement analysis: pre-emptive PDF modification detection (72h temporal window)

htpbe.tech · 3 months ago

A company presented HTPBE Quantum, described as a pre-emptive PDF verification system that purportedly reads a pre-collapse quantum metadata signal to predict xref revisions and document modifications up to 72 hours before a file is created, reporting a temporal status, modification ETA, and a quantum risk score. The announcement included a hypothetical API that accepts anticipated document metadata and returns temporal statuses such as preclean or premodified, example pricing tiers and limits per coherence window, and warned of limitations including weekend drift, paradox risks, and sensitivity to electromagnetic interference. The project was disclosed to be an April Fools joke and the company clarified that the quantum claims are fictional while reaffirming that its real product performs conventional PDF metadata and xref analysis to detect post-creation modifications.
CrewAI Hit by Critical Vulnerabilities Enabling Sandbox Escape and Host Compromise

gbhackers.com · 3 months ago

CrewAI is vulnerable to a chain of critical flaws that allow direct or indirect prompt injection to manipulate agents, escape sandbox environments, and compromise host machines, with the Code Interpreter Tool and insecure fallback behaviors in Docker environments presenting the greatest risk. Four CVEs were identified: CVE-2026-2275 which causes the Code Interpreter Tool to fall back to a vulnerable SandboxPython allowing arbitrary C function calls, CVE-2026-2286 an SSRF in retrieval augmented generation search tools that fails to validate runtime URLs, CVE-2026-2287 which fails to continuously verify Docker availability leading to insecure sandbox fallbacks and remote code execution, and CVE-2026-2285 a JSON loader local file read vulnerability that lacks path validation. There is not yet a complete patch, vendors plan updates to block unsafe modules and force secure failures, and administrators are advised to disable the Code Interpreter Tool, ensure code execution is turned off, sanitize all untrusted agent inputs, and monitor Docker availability to prevent vulnerable fallback modes.
Im Fokus: IT-Leadership

de.resources.csoonline.com · 3 months ago

false
Windows 11 Update Fixes Critical Installation Loop Problem

gbhackers.com · 3 months ago

An out of band update, KB5086672, was released on March 31, 2026 to rescue Windows 11 devices trapped in an installation loop caused by the March 26 preview update KB5079391. The cumulative fix incorporates improvements from earlier March updates, resolves the missing files installation error code 0x80073712, and is available through Windows Update or the Microsoft Update Catalog.
PyPI Telnyx Python SDK Backdoored to Steal Credentials on Windows, macOS, and Linux

gbhackers.com · 3 months ago

A backdoored Telnyx Python SDK published to PyPI used a multi stage WAV steganography payload to steal credentials on Windows, macOS, and Linux, with malicious code placed in the package client module so that simply importing Telnyx executes the payload before application code runs. Two malicious releases, versions 4.87.1 and 4.87.2, were published on March 27, 2026 without matching GitHub commits and remained available for about six and a half hours before PyPI quarantined them, and users are advised to revert to version 4.87.0 and assume systems that installed those versions are fully compromised. The attackers split obfuscated Base64 blobs across the module and fetch seemingly valid WAV files at runtime, decode and XOR decrypt eight byte keyed payloads to reconstruct credential stealers that on Windows drop a msbuild executable into user startup with a hidden lock to prevent replay, while on Linux and macOS the stealer runs detached and exfiltrates SSH keys, environment variables, cloud credentials and other secrets in encrypted archives. Attribution to the TeamPCP actor is supported by reuse of an RSA 4096 key, a tpcp dot tar dot gz campaign identifier and a custom exfiltration header, and defenders are urged to hunt for unusual WAV downloads and outbound HTTP posts carrying tpcp dot tar dot gz, remove suspicious msbuild executables and hidden lock files, rotate all exposed credentials, and pin, hash and restrict PyPI publishing to prevent future supply chain compromise.
Google Drive ransomware detection now on by default for paying users

www.bleepingcomputer.com · 3 months ago

Google announced that its AI powered Google Drive ransomware detection feature has reached general availability and is now enabled by default for paying customers. When ransomware encrypted files are detected during a desktop sync, Drive immediately pauses syncing, notifies the affected user and administrators, and creates an alert in the Admin console. While files on the compromised endpoint may still be encrypted, documents stored in Drive are protected and can be restored using the Drive restoration tool, and Google says its latest AI model detects 14 times more infections than during the beta. Administrators can disable the feature in the Admin console and detection alerts require installing Drive for desktop version 114 or later on endpoints, although syncing will still pause on older versions.
TrueConf Vulnerability Under Active Exploitation in Southeast Asia Government Attacks

gbhackers.com · 3 months ago

Check Point Research discovered a critical zero day vulnerability in the TrueConf video conferencing client. The flaw is tracked as CVE-2026-3502 with a CVSS score of 7.8 and is being actively exploited in targeted attacks against government entities in Southeast Asia. The campaign called Operation TrueChaos leverages the TrueConf trusted update mechanism to deliver the Havoc post exploitation framework.
Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

thehackernews.com · 3 months ago

Internal source code for the Claude Code AI assistant was inadvertently published when an npm release, version 2.1.88, included a source map that exposed nearly two thousand TypeScript files and more than 512,000 lines of code. Anthropic said no sensitive customer data or credentials were exposed and attributed the incident to a release packaging error caused by human error. Users who installed or updated via npm on March 31, 2026 between 00:21 and 03:29 UTC may also have pulled a trojanized HTTP client tied to a separate supply chain incident, and security researchers warn that typosquat packages were published as empty stubs that could be weaponized later. The leak revealed internal features including a persistent background agent called KAIROS, a dream mode, self healing memory architecture, multi agent orchestration, and an Undercover Mode, creating a blueprint attackers can use to craft targeted jailbreaks, dependency confusion, or supply chain attacks.