Blahalla

Silver Fox Cyberattack Targets Japanese Businesses with Tax-Themed Phishing Scams

gbhackers.com · 4 months ago

A threat actor known as Silver Fox is targeting Japanese organizations with spearphishing emails disguised as legitimate financial and HR communications. These emails, timed with Japan’s tax season, impersonate company personnel and often contain malicious attachments or links that deploy the ValleyRAT trojan. This malware allows attackers to gain remote control, steal data, and move laterally within networks. The group has expanded its operations from China to Southeast Asia, Japan, and North America, and previously conducted similar campaigns last year.

Musk has a plan to make human labor obsolete. Billionaires are joining in.

www.washingtonpost.com · 4 months ago

false

TeamPCP Hackers Focus on AI Developers, Planting Malicious Code to Disrupt Projects

gbhackers.com · 4 months ago

The FBI Cyber Division has issued a warning about a supply chain attack by the threat actor group TeamPCP, which targeted developers of artificial intelligence software. Hackers compromised two widely used developer tools, Trivy and LiteLLM, exploiting weak credential management and using AI-assisted coding to distribute malicious updates to millions of developers. TeamPCP leveraged Anthropic’s Claude to automate malware creation and lateral movement, and they operate as an initial access broker. Cybersecurity experts emphasize the need for enhanced security practices, including strict secrets management and thorough verification of third-party software.

Dutch Police discloses security breach after phishing attack

www.bleepingcomputer.com · 4 months ago

The Dutch National Police recently experienced a phishing attack, but initial assessments indicate the impact was limited and citizen data remains secure. The agency's Security Operations Center quickly detected and blocked the attackers' access, and a criminal investigation has been launched. This latest incident follows a September 2024 data breach attributed to a state actor, involving the theft of police officer contact information. Security measures, including two-factor authentication, have since been strengthened.

LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks

thehackernews.com · 4 months ago

Cybersecurity researchers have identified three vulnerabilities impacting LangChain and LangGraph, widely used frameworks for building applications powered by Large Language Models. These vulnerabilities could allow attackers to expose sensitive data, including filesystem files, environment secrets, and conversation histories. CVE-2026-34070 is a path traversal, CVE-2025-68664 is a deserialization flaw, and CVE-2025-67644 is an SQL injection vulnerability. Patches are available for all three vulnerabilities and users are urged to apply them promptly.

Hackers Target South Asian Financial Firm with BRUSHWORM and BRUSHLOGGER Attacks

gbhackers.com · 4 months ago

A South Asian financial institution was targeted by a custom malware toolkit consisting of BRUSHWORM, a modular backdoor, and BRUSHLOGGER, a DLL side-loaded keylogger. BRUSHWORM handles installation, persistence, and data theft, while BRUSHLOGGER records keystrokes with window context. The malware exhibits basic anti-analysis techniques, uses hardcoded directories with a misspelling, and employs AES-CBC encryption with a hardcoded key. Investigators suspect an inexperienced developer may be using AI-generated code, and the team continues to monitor related infrastructure.

Red Hat Warns of Malware Embedded in Popular Linux Tool, Opening Doors for Unauthorized Access

gbhackers.com · 4 months ago

A serious supply chain attack has targeted the widely used xz compression utility, potentially allowing unauthorized remote access to Linux systems. The vulnerability, tracked as CVE-2024-3094, affects versions 5.6.0 and 5.6.1 of the xz and xz-libs libraries. The malicious code, hidden within M4 macros and build artifacts, compromises SSH authentication by interfering with systemd. Affected systems include Fedora Rawhide, Fedora 40 Beta, Debian unstable, and openSUSE, and users are advised to downgrade to the 5.4.x version.

Hackers Deploy USB Malware, RATs, and Stealers in Southeast Asian Government Attacks

gbhackers.com · 4 months ago

Cybersecurity analysts have identified a multi-cluster cyberespionage campaign targeting a Southeast Asian government organization between June and August 2025. Attackers utilized a range of tools including USBFect malware, PUBLOAD backdoor, CoolClient, EggStremeFuel backdoor, Masol RAT, TrackBak infostealer, Hypnosis Loader, and FluffyGh0st RAT to establish long-term access and collect intelligence. The observed tactics, techniques, and procedures, along with tooling like Masol and EggStremeFuel, strongly suggest a connection to China-aligned threat actors including Crimson Palace, Earth Estries, and Unfading Sea Haze. Security professionals are advised to review USB usage policies and strengthen detection capabilities.

Windows Error Reporting Vulnerability Exposes Systems to Privilege Escalation, Allowing SYSTEM Access

gbhackers.com · 4 months ago

Microsoft recently addressed a severe Elevation of Privilege vulnerability, identified as CVE-2026-20817, within the Windows Error Reporting service. The flaw allows local attackers with standard user rights to gain SYSTEM access by exploiting improper handling of Advanced Local Procedure Call messages. Rather than patching the code, Microsoft removed the vulnerable feature entirely by adding a feature test that immediately returns an error. Security researchers have released a proof-of-concept demonstrating the exploit, and Windows Defender is detecting exploitation attempts by flagging suspicious process behavior.

Phishing ZIP Files Used to Deploy PXA Stealer Targeting Financial Firms

gbhackers.com · 4 months ago

Cybersecurity researchers have observed a significant increase in PXA Stealer campaigns targeting financial institutions beginning in early 2026. These attacks typically start with phishing emails containing ZIP archives disguised as common files like job applications or software installers. Once executed, the malware employs a multi-stage process, utilizing Living-off-the-Land Binaries and Telegram for command-and-control and data exfiltration. The malware injects itself into web browsers to steal sensitive information, including credentials and cryptocurrency data, and establishes persistence through registry modifications.

Hackers Implant Stealthy BPFdoor Backdoors in Telecom Networks for Persistent Access

gbhackers.com · 4 months ago

A China-linked threat actor, known as Red Menshen, is using a stealthy backdoor called BPFdoor to compromise global telecommunications networks. Attackers initially target edge infrastructure like VPNs and firewalls, then deploy BPFdoor, which operates within the Linux kernel and bypasses traditional detection methods by mimicking legitimate network activity. Newer versions of BPFdoor are monitoring Stream Control Transmission Protocol traffic, enabling access to sensitive communications and tracking of individuals. The malware also evades detection by impersonating hardware and containerization components to blend into normal network operations.

Fake Cloudflare CAPTCHA Pages Deliver Infiniti Stealer Malware on macOS

gbhackers.com · 4 months ago

A new macOS infostealer called Infiniti Stealer is being distributed using deceptive Cloudflare-style CAPTCHA pages and a technique called ClickFix, which tricks users into running malicious commands themselves. The malware operates in three stages: a Bash dropper, a Nuitka-compiled loader, and a Python 3.11 infostealer payload that targets browser credentials, Keychain entries, cryptocurrency wallets, and developer secrets. Attackers use this method to bypass traditional security defenses and exfiltrate stolen data via HTTP POST requests to a command-and-control server. Users are advised to change passwords, revoke sessions, and scan their systems for suspicious files.

ISC Issues Critical Warning Over Kea DHCP Vulnerability That Could Remotely Crash Services

gbhackers.com · 4 months ago

The Internet Systems Consortium has issued a critical warning regarding a security vulnerability in the Kea DHCP server software. This flaw, identified as CVE-2026-3608, allows unauthenticated attackers to remotely crash essential network services, leading to a denial-of-service. The vulnerability stems from a stack overflow affecting several Kea daemons, including the control agent, dynamic DNS updater, and IPv4/IPv6 services. Affected versions include Kea 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2, and users are advised to immediately upgrade to patched versions or implement TLS encryption as a temporary fix.

China-linked Red Menshen using BPFdoor kernel backdoor in telecom networks

thecybersecguru.com · 4 months ago

A Chinese-linked threat actor, known as Red Menshen, has compromised telecommunications providers in Asia and the Middle East with a new backdoor called BPFDoor. This advanced malware operates as a "sleeper cell," awaiting a specific activation signal to gain control of network infrastructure. BPFDoor enables espionage activities, including intercepting communications and tracking mobile devices, and uses techniques to evade detection and move laterally within networks. The malware's stealthy design necessitates deep system visibility for detection and highlights a shift towards more persistent threat actor tactics.

An Invisible Bottleneck: A Helium Shortage Threatens the Chip Industry

www.nytimes.com · 4 months ago

false

Google: The quantum apocalypse is coming sooner than we thought

www.csoonline.com · 4 months ago

Google has moved its internal deadline for migrating to post quantum cryptography to 2029 and has adjusted its threat model to prioritize PQC for authentication services, urging engineering teams to follow. Estimates for the resources needed to break RSA with quantum computers have fallen sharply from twenty million qubits in 2019 to one million in May 2025, with recent research suggesting around one hundred thousand physical qubits, while NIST has finalized four PQC algorithms and selected a fifth. Most organizations remain unprepared: PQC standards have not achieved broad adoption, ninety one percent of businesses lack a quantum readiness roadmap, eighty percent say crypto libraries and hardware security modules are not ready, and attackers are likely conducting store now, decrypt later campaigns, so companies must inventory cryptography, invest in cryptographic agility and prioritize migration for long lived sensitive assets.

Shield AI, a Start-Up Making Military Drones, Raises $2 Billion

www.nytimes.com · 4 months ago

false

Judge blocks Pentagon order branding Anthropic a national security risk

www.washingtonpost.com · 4 months ago

A federal judge in San Francisco blocked a Pentagon order on March 26, 2026, that had labeled the artificial intelligence company Anthropic a national security risk, finding officials likely violated the law and retaliated against the firm for publicly opposing certain military uses of its technology. The dispute centered on Anthropic's refusal to allow its Claude system to be used in mass domestic surveillance or to power fully autonomous weapons, after which the Defense Department ended talks, designated the company a supply chain risk, and directed contractors to stop using Claude. Anthropic called the ruling a victory and said it wants to work with the government on safe AI, while the Defense Department did not immediately comment.

Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government

unit42.paloaltonetworks.com · 4 months ago

There are multiple cyberespionage clusters targeting a Southeast Asian government organization. One cluster attributed to Stately Taurus used a USB based worm called USBFect also known as HIUPAN to deliver the PUBLOAD backdoor, with infections observed from June 1, 2025 through August 15, 2025. Two other clusters used distinct toolsets: CL-STA-1048 deployed an espionage toolkit including EggStremeFuel backdoor, the Masol remote access Trojan, an EggStreme Loader that delivered the Gorem RAT and a TrackBak stealer, and CL-STA-1049 used a Hypnosis loader to deploy the FluffyGh0st RAT. Overlapping tactics, techniques and procedures and ties to China aligned actors indicate a coordinated, well resourced operation.

Disabling Security Features in a Locked BIOS

www.mdsec.co.uk · 4 months ago

There is a demonstrated technique to modify a Dell UEFI firmware image at the SPI flash level that disables pre boot DMA protections while leaving the firmware interface showing the original secure settings. This enables attackers with physical access to bypass TPM only BitLocker protections and, after corrupting the DMAR ACPI table and using PCIe DMA tools, obtain NT AUTHORITY SYSTEM privileges, and the modification was observed to survive an official Dell BIOS update to version 1.32.1. The workflow uses flashrom, UEFITool, IFRExtractor, DMAReaper, and PCILeech to locate and alter the Setup NVRAM variable that controls IOMMU pre boot behavior so the option appears enabled in the UI while being disabled in the stored configuration.

Ajax football club hack exposed fan data, enabled ticket hijack

www.bleepingcomputer.com · 4 months ago

A hacker exploited vulnerabilities in Ajax Amsterdam's IT systems, viewing the email addresses of a few hundred people and the names, email addresses, and dates of birth of fewer than 20 individuals with stadium bans. Journalists independently verified the weaknesses and demonstrated that season tickets could be transferred in seconds, that stadium ban records could be modified, and that attackers could potentially manipulate 42,000 season tickets, 538 supporter stadium bans, and view details on over 300,000 accounts. Ajax engaged external experts, patched the identified vulnerabilities, notified the Dutch data protection authority and the police, and advised registered fans and season ticket holders to be vigilant for suspicious communications.

PROTOCOLO DELTA SWORD: Full Disclosure de Persistência Zero-Day e Omissão Corporativa (Google/Samsung)

drive.google.com · 4 months ago

There is a critical security flaw in Kernel 4.19 on the Samsung A04s enabling sandbox escape and rootkit persistence, and forensic analysis shows ransomware EDWARD remains resident in live memory and operates even with RF Kill enabled. Telemetry from a Samsung A04s test environment and an air-gapped Lenovo audit demonstrate CPU telemetry and code injection preceding the March 2026 patch SMR MAR 2026, and the exploit sustains internal communication without external networks. The researcher reports that Google and Samsung used 10 gigabytes of submitted logs to mitigate the issue and subsequently classified the reports as infeasible or duplicates, listing Google Issue Tracker IDs 494092970, 486921160, 494233438 and Samsung Mobile Security ticket 1-119703. Hashes and chronological logs are claimed to be included with the disclosure while executables and exploit code are being withheld and will be shared only under formal institutional request and confidentiality conditions.

Coruna, DarkSword & Democratizing Nation-State Exploit Kits

www.darkreading.com · 4 months ago

Researchers have discovered links between the Coruna mobile exploit kit, used in espionage, and Operation Triangulation, a 2023 spying operation against Russia. A similar toolkit, DarkSword, has also fallen into the hands of cybercriminals and a Russian state actor known as UNC6353, and has been leaked to GitHub. These tools, initially developed by a US military contractor and potentially the DarkMatter Group, incorporate five exploit chains spanning 23 CVEs, and have been modified for financial theft, including cryptocurrency scams. Organizations should prioritize advanced mobile protections and ensure employees update their iOS devices to mitigate the risk.

Is the FCC's Router Ban the Wrong Fix?

www.darkreading.com · 4 months ago

false

Automotive Cybersecurity Threats Grow in Era of Connected, Autonomous Vehicles

www.darkreading.com · 4 months ago

There is growing cybersecurity risk as vehicles become more connected and autonomous, a trend underscored by the 2015 Jeep Cherokee hack that allowed researchers to take remote control and prompted a recall of 1.4 million vehicles. Modern cars contain millions of lines of code from extensive supplier networks, connect wirelessly to apps and services, and are often built by teams without deep cybersecurity expertise, increasing the potential attack surface while researchers continue to publish high quality vehicle vulnerability research. Governments adopted UN Regulation No. 155 in 2021, requiring manufacturers to perform cybersecurity assessments and maintain vehicle security over a 10 to 15 year lifecycle, and experts warn that AI driven threats and the need for post quantum protections will further reshape automotive security as makers invest to harden systems.

CISA: New Langflow flaw actively exploited to hijack AI workflows

www.bleepingcomputer.com · 4 months ago

CISA warns that hackers are actively exploiting a critical code injection vulnerability in the Langflow framework identified as CVE-2026-33017. The flaw received a 9.3 critical score and enables remote code execution by allowing unsandboxed flow execution that can be triggered by a single crafted HTTP request, affecting Langflow versions 1.8.1 and earlier. Researchers observed automated scanning within 20 hours of the advisory, followed by Python based exploitation and harvesting of environment and database files, and administrators are urged to upgrade to Langflow 1.9.0 or later, avoid exposing Langflow directly to the internet, restrict the vulnerable endpoint, and rotate API keys and secrets. CISA previously warned in May 2025 about active exploitation of CVE-2025-3248 and set April 8, 2026 as the deadline for federal agencies to apply updates or mitigations for CVE-2026-33017.

Critical Flaw in Langflow AI Platform Under Attack

www.darkreading.com · 4 months ago

There is a critical code injection vulnerability in Langflow tracked as CVE-2026-33017 that allows unauthenticated attackers to supply attacker controlled flow data to a POST api v1 build public tmp flow endpoint which is executed via exec without sandboxing, producing remote code execution and earning a 9.8 CVSS score and placement on CISA's Known Exploited Vulnerabilities list. Researchers observed exploitation attempts less than 24 hours after disclosure and attackers were able to extract keys and credentials from vulnerable instances that could be used to pivot to connected services. Langflow issued version 1.9.0 to mitigate the flaw, defenders are urged to patch immediately and use runtime detection, network segmentation, and rapid response, and the issue is distinct from CVE-2025-3248 which was exploited last year.

The CISO’s guide to responding to shadow AI

www.csoonline.com · 4 months ago

There is a surge in shadow AI driven by widespread availability of AI tools, vendors turning on embedded capabilities without notice, leadership pressure for productivity, and nascent governance that forces employees to adopt unapproved tools. CISOs are advised to assess risk by evaluating the sensitivity of data exposed, how vendors store and use that data, whether the use trained models, and whether the incident led to a breach or operational or safety impacts. Responses should include understanding why employees use the tools, then either shutting them down or pursuing formal approval through cross functional reviews, paired with mitigation such as education, policy updates, technical controls, and incident response. Organizations should update AI governance, provide clear approval pathways and training, apply proportionate accountability rather than punishment, and accept that shadow AI cannot be fully eliminated but must be managed.

World Leaks data extortion: What you need to know

www.fortra.com · 4 months ago

World Leaks is a cyber extortion operation that steals sensitive data and threatens to leak it publicly if ransoms are not paid. Unlike traditional ransomware, World Leaks does not encrypt data, focusing solely on theft and exposure. The group emerged in early 2025, splintering from a previous ransomware operation and now offers an “Extortion-as-a-Service” platform to affiliates. World Leaks has targeted organizations like Nike, UBS, Dell, and the City of Los Angeles, claiming over 130 victims and stealing data, including police records. Recommendations for protection include enforcing multi-factor authentication, patching systems, utilizing data loss prevention tools, and network segmentation.

The Clues Binance Missed That Led to Billions in Crypto Flowing to Iran

www.nytimes.com · 4 months ago

NULL

Millions of UK iPhone Users Will Need to Verify Their Age — Here’s Why

www.techrepublic.com · 4 months ago

false

Microsoft 365 Under Siege: Phishing Campaign Bypasses MFA Across 5 Countries

www.techrepublic.com · 4 months ago

A global phishing campaign targeting Microsoft 365 abuses the OAuth device authorization flow to trick users into entering device codes on the legitimate Microsoft login page, allowing attackers to capture authentication tokens that can grant access for up to 90 days. More than 340 organizations across the United States, Canada, Australia, New Zealand, and Germany were affected, with most malicious authentication events coming from Railway dot com IP ranges and operations tied to a phishing as a service named EvilTokens. Huntress pushed a conditional access policy to about 60,000 Microsoft tenants to block the Railway IP ranges and recommended immediate actions including searching sign in logs, revoking refresh tokens, blocking the Railway CIDR blocks, disabling device code authentication if not needed, and enabling Continuous Access Evaluation.

Snapchat Investigated in Europe Over Child Safety Policies

www.nytimes.com · 4 months ago

European regulators in Brussels have opened a formal investigation into Snapchat under the European Union’s Digital Services Act for maintaining an insufficient age verification system that may allow users under the platform’s minimum age of thirteen to access the service and prevent users under seventeen from receiving age appropriate experiences. Regulators say the age assurance appears unable to reliably block adults posing as minors and may expose young users to contact by individuals with harmful intent, recruitment for criminal activity, and access to illegal or restricted products such as drugs, vapes, or alcohol. Snap has engaged with the Commission and said it is cooperating while the probe examines compliance with the DSA’s safety obligations and standards. Brussels simultaneously accused several major adult websites of failing to prevent minors from accessing adult content.

China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks

thehackernews.com · 4 months ago

A China-linked threat actor tracked as Red Menshen has embedded long-term stealth access mechanisms inside telecom networks to conduct espionage against government networks and has targeted providers across the Middle East and Asia since at least 2021. The campaign relies on kernel-level implants and a Linux backdoor called BPFDoor that installs BPF filters inside the operating system to inspect network traffic and trigger a remote shell only when a specifically crafted activation packet is received, with newer variants hiding the trigger inside legitimate HTTPS traffic and supporting telecom protocols such as SCTP and ICMP for low-noise communications. Initial access is gained by targeting internet-facing edge services and appliances from vendors including Ivanti, Cisco, Juniper, Fortinet, VMware, Palo Alto Networks, and Apache Struts, after which CrossC2, Sliver, TinyShell, keyloggers, and brute-force tools are used for credential harvesting and lateral movement.

Exploiting AQL Injection Vulnerabilities in ArangoDB

www.anvilsecure.com · 4 months ago

There are AQL injection vulnerabilities in ArangoDB that arise when user input is concatenated into queries, enabling attackers to expose data, manipulate records, and escalate privileges. Exploit techniques include blind, error based, reflected and time based injections, and an open source tool named aqlmap was created to automate extraction by leveraging database functions such as FAIL, COLLECTIONS, VERSION, CURRENTDATABASE and CURRENTUSER to enumerate and leak information. Primary mitigations are using parameterized queries and bind parameters instead of string concatenation, and the research references a prior AQL injection in cruddl tracked as CVE-2022-36084.

Leonid Radvinsky, 43, Dies; Built the Adult-Entertainment Giant OnlyFans

www.nytimes.com · 4 months ago

false

The Age-Gated Internet: Child Safety, Identity Infrastructure, and the Not So Quiet Re-Architecting of the Web

horkan.com · 4 months ago

false

What I Learned from a $2,000 Pen Test

glama.ai · 4 months ago

Attackers created thousands of accounts overnight, added valid payment methods, and ran a single expensive LLM call to exploit an overdraft credit on new accounts so the first costly request was processed before subsequent charges were rejected. The attacks were timed to the target's sleep cycle by checking the victim's Discord online status, allowing attackers to pause when the victim appeared online and resume when the victim appeared offline. Defenses tested included device fingerprinting, IP blocking, CAPTCHA, OTP, JA4 TLS fingerprinting, ALTCHA proof-of-work, and rate limiting, with JA4 and ALTCHA noted as somewhat effective but no single method fully preventing abuse. By toggling online status and observing attacker responses the victim turned the incident into free penetration testing and limited losses to only the small initial deposits allowed for new accounts.

A year of open source vulnerability trends: CVEs, advisories, and malware

github.blog · 4 months ago

Reviewed advisories dropped to 4,101 in 2025, the fewest since 2021, but newly reported vulnerabilities rose 19 percent year over year, indicating the decline reflects fewer older vulnerabilities being reviewed rather than improved security. Malware advisories surged to 7,197 in 2025, including a 69 percent increase in npm malware driven by large campaigns such as SHA1 Hulud, making 2025 the largest year for published malware advisories since support began. GitHub published 2,903 CVEs in 2025, a 35 percent increase that outpaced the CVE Project overall increase of 21 percent, and 679 new organizations began using GitHub CNA services.

UK sanctions Xinbi marketplace linked to Asian scam centers

www.bleepingcomputer.com · 4 months ago

The United Kingdom's Foreign, Commonwealth and Development Office has sanctioned Xinbi, a Chinese language cryptocurrency marketplace that sells stolen data and satellite internet equipment and provides crypto services to scam centers in Southeast Asia. Chainalysis reports Xinbi processed over 19.9 billion dollars between 2021 and 2025 and the marketplace is accused of helping North Korean actors launder proceeds from major crypto heists while facilitating unlicensed over the counter trades, money laundering, and sales of stolen personal databases. The sanctions also target 8 Park and its operator Legend Innovation Company, a large scam compound believed to hold up to 20,000 trafficked workers, and are intended to isolate Xinbi by preventing it from sending or receiving cryptocurrency payments as part of wider actions against scam centers in Myanmar, Cambodia, and Laos that use stolen information to carry out pig butchering and romance baiting scams.

How Organizations Can Use Mistakes to Level Up Their Security Programs

www.darkreading.com · 4 months ago

false

Google warns quantum computers could hack encrypted systems by 2029

www.theguardian.com · 4 months ago

Google warns that large scale quantum computers could break most existing encryption systems by 2029, posing a significant threat to current cryptographic standards before the end of the decade. Banks, governments and technology providers are urged to begin migrating to quantum resistant cryptography and to upgrade authentication and digital signature systems now. The company recommends engineering teams prioritize post quantum migration for authentication services and warns that store now, decrypt later attacks may already be collecting encrypted data for future decryption. Independent experts note timelines vary, with many estimates placing a cryptographically relevant quantum computer in the 2030s or later, but the risk is prompting national agencies and organizations to prepare sooner.

TP-Link Fixes Bug That Lets Hackers Take Over Routers Without a Password

www.techrepublic.com · 4 months ago

TP-Link patched multiple high severity vulnerabilities in its Archer NX router series including NX200, NX210, NX500, and NX600 after flaws were found that could let attackers bypass authentication and upload rogue firmware without a password. The fixed issues include CVE-2025-15517, which allows access to certain CGI endpoints due to a missing authentication check; CVE-2025-15605, which lets logged in attackers misuse cryptographic keys to decrypt and alter configuration files; and CVE-2025-15518 and CVE-2025-15519, which allow execution of malicious commands in admin mode, while CISA also flags CVE-2023-50224 and CVE-2025-9377. Owners of affected routers are urged to install the latest firmware immediately to prevent unauthorized access, as US agencies have highlighted the risks amid regulatory scrutiny and a related lawsuit over product origin claims.

New ClickFix Attack Exploits Windows Run Dialog and macOS Terminal to Deploy Malware

gbhackers.com · 4 months ago

There is a standardized ClickFix attack that abuses the Windows Run dialog and macOS Terminal to trick users into pasting and executing obfuscated commands, shifting exploitation from the browser into native shells. Insikt Group has tracked five distinct ClickFix clusters active since at least May 2024, with lures impersonating brands such as Intuit QuickBooks and Booking.com and many campaigns using pastejacking during fake human verification flows to load encoded commands into the clipboard. Campaigns fetch and execute payloads entirely in memory, commonly using obfuscated PowerShell to deliver tools like NetSupport RAT on Windows and multi stage curl chains to deliver MacSync on macOS, leveraging signed binaries and native tools to evade detection. Defensive measures recommended include disabling the Run dialog via Group Policy, enforcing PowerShell constrained language or AppLocker and WDAC, applying MDM and system integrity protections for shells on macOS, and focused user training to refuse requests to paste commands into Run PowerShell or Terminal.

The Next Billion Users Won’t Be Human: Securing the Agentic Enterprise

www.techrepublic.com · 4 months ago

Autonomous AI agents are rapidly becoming the next billion users of the web, creating a Trust Gap because traditional security cannot reliably stop prompt injection and other invisible threats. Menlo Security is moving the security control point into browser sessions with its Guardian Runtime to perform real time sanitization, enforce instruction data separation, and prevent agents from executing malicious commands or directly accessing applications. Practitioners are advised to separate human and agent identities, treat agents as privileged digital insiders with adaptive data loss prevention, and favor browser based security over legacy VDI to safely scale agent deployments.

Juries Take the Lead in the Push for Child Online Safety

www.nytimes.com · 4 months ago

There are two recent jury verdicts finding major social media platforms liable for harming young users by designing features that hooked them and worsened mental health. A Los Angeles jury ordered Meta and YouTube to pay millions to a plaintiff who said compulsive use beginning in childhood caused depression, body image problems and suicidal behavior, while a New Mexico jury found Meta violated state law by endangering children’s mental health and safety. Legal experts say the rulings add momentum to thousands of related lawsuits and reflect a growing backlash as Congress has so far failed to pass comprehensive social media safety legislation for children.

AI-Powered Dependency Decisions Introduce, Ignore Security Bugs

www.darkreading.com · 4 months ago

AI models often generate faulty or fabricated recommendations for software dependencies, creating wasted AI spend, wasted developer time, unresolved vulnerability exposure, and technical debt. Sonatype analyzed about 258,000 recommendations across Maven Central, npm, PyPI, and NuGet between June and August 2025 and found earlier GPT‑5 outputs had nearly 28 percent hallucinations while newer frontier models from OpenAI, Anthropic, and Google reduced but still produced hallucinations and sometimes left roughly 800 to 900 critical and high severity vulnerabilities unflagged in production code. Grounding models with live registry data, vulnerability and compatibility intelligence, and ranked upgrade candidates cut critical and high risks by about 70 percent in Sonatype’s tests, and relying on human review alone without that live context is unlikely to prevent these errors.

Leak Bazaar Converts Stolen Corporate Data Into Organized Criminal Marketplace

gbhackers.com · 4 months ago

Leak Bazaar is a new cybercriminal service advertised on March 25, 2026 on a Russian speaking TierOne forum that converts stolen corporate data into cleaned, marketable datasets rather than simply publishing raw dumps. It combines automated filtering, machine learning assisted text analysis, database parsing and human analyst validation to transform messy exfiltrated data into categorized outputs such as financial reports, mergers and acquisitions data, research and development materials and personal customer records. The platform monetizes data with a 70 percent to 30 percent revenue split favoring suppliers, offers exclusive sales and multi buyer resale, enforces quality thresholds including 100 gigabytes to 1 terabyte minimums and a preference for English content, and uses a guarantor service to handle transactions and victim negotiations. This model signals a shift toward professionalized, scalable criminal marketplaces that treat stolen data as a reusable product requiring refinement and market segmentation.

TikTok for Business accounts targeted in new phishing campaign

www.bleepingcomputer.com · 4 months ago

Threat actors are targeting TikTok for Business accounts with a phishing campaign that prevents security bots from analyzing malicious pages. Victims are redirected through a legitimate cloud storage URL to Cloudflare hosted pages registered March 24 that use a Turnstile check to block bots and then impersonate TikTok for Business and Google Careers schedule a call pages to harvest basic information. The pages act as a reverse proxy to capture credentials and session cookies, enabling account takeover even when two factor authentication is in place and increasing the risk of ad fraud and distribution of malicious content. Users are advised to treat unexpected invites and job offers with caution, verify domains before entering credentials, and use passkeys to protect high value accounts.

Hightower Holding Data Breach Impacts 130,000

www.securityweek.com · 4 months ago

Hightower Holding is notifying about a data breach that impacted about 131,483 people after a cyberattack in early January 2026 that resulted in files being exfiltrated on January 8 and 9, 2026. The stolen files included names, Social Security numbers, and driver’s license numbers, and the company says the breach stemmed from compromised user credentials rather than a deficiency in its systems. Hightower reports no indication the information has been used for identity theft, is offering 12 months of free identity theft and credit monitoring, and has notified the Maine Attorney General.