Blahalla

Kali Linux 2026.1 released with 8 new tools, new BackTrack mode

www.bleepingcomputer.com · 4 months ago

false

AI-Native Security Is a Must to Counter AI-Based Attacks

www.darkreading.com · 4 months ago

Experts warn that traditional security measures are insufficient against AI-powered attacks, particularly those leveraging tools like OpenClaw, which allows for the creation of autonomous agents. These agents can scan systems, access sensitive data, and even write their own code, potentially remaining dormant for extended periods before activating attacks. Solutions include AI-native security models that use agentic defenses, dynamic access controls, and systems like Nvidia’s NemoClaw, which enforces security guardrails. Companies like ServiceNow are developing AI Control Towers with Access Graphs and Knowledge Graphs to monitor and control agent activity, emphasizing the need for a proactive and machine-speed response.

Mirai Botnets Evolve Into Major DDoS and Proxy Abuse Threats

gbhackers.com · 4 months ago

Mirai botnets have significantly evolved, now functioning as large-scale distributed denial-of-service platforms and proxy abuse networks. Over 21,000 command-and-control servers were observed between 2023 and 2025, with botnets increasingly used as residential proxies. The Aisuru-Kimwolf botnet family has been linked to record-breaking attacks, including a 31.4 Tbps incident. Despite disruption efforts, the resilience of these botnets persists due to vulnerable devices and recycled infrastructure.

GoHarbor Issues Urgent Patch for Harbor Flaw Allowing Full Registry Compromise

gbhackers.com · 4 months ago

A critical security flaw has been identified in GoHarbor, a container registry project, allowing attackers to compromise systems. The vulnerability, tracked as CVE-2026-4404, stems from hardcoded default administrator credentials that are not automatically changed. Successful authentication grants attackers full control over the registry, enabling them to inject malicious images, exfiltrate sensitive data, and establish persistent access. GoHarbor’s development team is working on a patch to address the root cause by randomizing credentials or enforcing a password creation step.

RSAC 2026 Conference Announcements Summary (Day 2)

www.securityweek.com · 4 months ago

false

Trivy supply chain breach compromises over 1,000 SaaS environments, Lapsus$ joins the extortion wave

www.csoonline.com · 4 months ago

A supply chain attack targeting the security scanner Trivy has expanded into a widespread extortion campaign linked to the Lapsus$ group, impacting over 1,000 enterprise SaaS environments. Attackers initially attributed to TeamPCP have leveraged stolen credentials to compromise AI middleware like LiteLLM and distribute a self-replicating worm, CanisterWorm, across the npm ecosystem. Compromised Trivy artifacts and manipulated version tags have been used to distribute malicious code, and Aqua Security’s GitHub organization was defaced. Security experts warn of potential further compromises and highlight the need for stronger controls regarding third-party code usage and pipeline integrity.

The Kill Chain Is Obsolete When Your AI Agent Is the Threat

thehackernews.com · 4 months ago

The traditional cyber kill chain model is becoming obsolete due to the rise of AI agents. In September 2025, a state-sponsored threat actor used an AI coding agent to conduct cyber espionage against 30 global targets, handling 80-90% of operations autonomously. If compromised, an AI agent provides attackers with immediate access, a map of data locations, broad permissions, and a legitimate reason to move data, bypassing all traditional detection points. The OpenClaw incident demonstrated how a compromised agent could access sensitive data within Slack and Google Workspace. Security teams must now focus on visibility and control of AI agents to prevent attackers from exploiting their existing workflows.

Mozilla Releases Firefox 149.0 With Free Built‑In VPN Offering 50 GB Monthly Data

gbhackers.com · 4 months ago

false

Ex-NSA Directors Discuss 'Red Line' for Offensive Cyberattacks

www.darkreading.com · 4 months ago

false

From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPI

www.securityweek.com · 4 months ago

A hacking group called TeamPCP is targeting open-source software supply chains, partnering with Lapsus$ for potential financial gain. The group has compromised accounts across platforms like Docker Hub, VS Code, and PyPI, impacting over 36,000 VS Code users and the LiteLLM Python library which has been downloaded over 95 million times monthly. The attacks have resulted in the theft of around 300 gigabytes of data from approximately 500,000 machines and affected 36 percent of cloud environments. Security experts advise organizations to rotate credentials and rebuild systems to mitigate the escalating threat.

Russian Hacker Sentenced to 2 Years for TA551 Botnet-Driven Ransomware Attacks

thehackernews.com · 4 months ago

A Russian national, Ilya Angelov, has been sentenced to two years in prison and fined $100,000 for managing a botnet used in ransomware attacks. Angelov co-managed the TA551 cybercriminal group, which built a botnet by distributing malware through spam emails and sold access to compromised computers. The group provided access to its botnet to ransomware gangs like BitPaymer, resulting in over $14.17 million in extortion payments, and later collaborated with IcedID operators. TA551 also partnered with the TrickBot and Lockean ransomware groups.

Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse

thehackernews.com · 4 months ago

A widespread device code phishing campaign is targeting Microsoft 365 accounts across several countries, impacting organizations in sectors like construction, finance, and government. Attackers use malicious emails containing device codes that, when entered by victims, grant persistent access tokens, even after password resets. The campaign leverages Cloudflare Workers redirects and infrastructure hosted on Railway, and is linked to a new phishing-as-a-service platform called EvilTokens. Observed malicious activity originates from IP addresses including 162.220.234.41, 162.220.234.66, 162.220.232.57, 162.220.232.99, and 162.220.232.235. Groups tracked as Storm-2372, APT29, UTA0304, UTA0307, and UNKAcademicFlare have been associated with similar attacks.

Epic Games Lays Off Over 1,000 Employees, Citing Fortnite Slump

www.nytimes.com · 4 months ago

false

TP-Link warns users to patch critical router auth bypass flaw

www.bleepingcomputer.com · 4 months ago

TP-Link has released security updates to address critical vulnerabilities in its Archer NX router series. A flaw, CVE-2025-15517, allows attackers to bypass authentication and upload firmware without privileges. The updates also remediate a hardcoded cryptographic key, CVE-2025-15605, and two command injection vulnerabilities, CVE-2025-15518 and CVE-2025-15519. Users are urged to update their firmware to protect against potential attacks.

PyPI warns developers after LiteLLM malware found stealing cloud and CI/CD credentials

www.csoonline.com · 4 months ago

PyPI is warning developers about malicious versions of the LiteLLM Python package that were briefly available, potentially exposing credentials. The compromised packages, versions 1.82.7 and 1.82.8, contained a three-stage payload designed to steal sensitive data including API keys, SSH keys, cloud credentials, and CI/CD secrets. This incident is linked to the ongoing TeamPCP supply chain attack, which initially compromised the Trivy vulnerability scanner. Affected users are advised to rotate any credentials accessible to the LiteLLM environment.

Linux Ransomware Pay2Key Targets Servers, Virtualization Hosts, and Cloud Workloads

gbhackers.com · 4 months ago

The Pay2Key ransomware group, previously known for targeting Israeli and Brazilian organizations, has evolved into a ransomware-as-a-service operation now specifically targeting Linux environments. This ransomware variant is designed for scale and stability, employing a configuration-driven approach to encrypt data on servers, VMware ESXi virtualization hosts, and cloud workloads. Attackers disable security measures like SELinux and AppArmor, and use a cron job for persistence, while prioritizing financial applications and databases to maximize impact. Security teams are urged to implement strict access controls, patching, and purpose-built Linux security measures to prevent and mitigate Pay2Key attacks.

Sen. Wyden Warns of Another Section 702 Abuse

www.schneier.com · 4 months ago

Senator Ron Wyden has expressed concerns regarding potential abuses of Section 702, a surveillance authority. He believes there is a related instance of secret law that impacts the privacy of Americans and has repeatedly requested its declassification. Wyden asserts that Congress needs to openly debate this authority before its reauthorization. He anticipates the public will be shocked when the information is eventually revealed.

F5 NGINX Plus & Open‑Source Flaw Lets Attackers Execute Code via MP4 File

gbhackers.com · 4 months ago

A high-severity vulnerability, CVE-2026-32647, has been identified in F5 NGINX Plus and Open Source deployments utilizing the MP4 streaming module. This flaw, classified as an out-of-bounds read, allows for potential code execution or denial-of-service attacks through crafted MP4 files. Affected NGINX Plus versions include R32 through R36, requiring upgrades to R36 P3, R35 P2, or R32 P5; Open Source versions 1.1.19 through 1.29.6 should be updated to 1.29.7 or 1.28.3. Mitigation strategies include limiting access to trusted users or disabling the MP4 module by commenting out directives in the NGINX configuration.

Hackers Exploiting Magento Flaw to Execute Remote Code and Seize Full Account Access

gbhackers.com · 4 months ago

A critical vulnerability, dubbed "PolyShell," is being exploited in Magento and Adobe Commerce platforms, allowing unauthenticated attackers to upload executable files and potentially take full control of online stores. The flaw exists in the REST API, specifically related to custom file options within anonymous guest carts, and impacts versions up to 2.4.9-alpha2. Attackers are using polyglot files disguised as images to execute malicious code, and mass scanning and active exploitation began March 19, 2026. Until a patch is released, administrators are advised to deploy a Web Application Firewall and restrict access to specific directories.

SmartApeSG ClickFix Campaign Spreads Remcos, NetSupport RAT, StealC, Sectop RAT

gbhackers.com · 4 months ago

A recent cyber campaign, dubbed SmartApeSG, utilizes a technique called ClickFix to redirect victims to fake CAPTCHA pages, tricking them into running malicious scripts. These scripts then download and execute multiple remote access trojans and information stealers in a staged process, designed to evade detection. The malware involved includes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT. Attackers employ DLL side-loading and frequently change file names, hashes, and domains to avoid static detection.

ClawHub Vulnerability Lets Attackers Manipulate Rankings to Become Top Skill

gbhackers.com · 4 months ago

Researchers discovered a critical vulnerability in ClawHub, a registry for OpenClaw agents, allowing attackers to manipulate download counts and artificially boost rankings. The flaw, stemming from an exposed private function within the Convex RPC framework, enabled attackers to inflate download numbers without limits and promote malicious code. This resulted in over three thousand executions of a fake skill across multiple cities, demonstrating the potential for data theft and system compromise. A security plugin, ClawNet, has been released to help prevent future attacks and highlight the need for human oversight in AI-driven development.

How one man used 10,000 bots to steal $8,000,000 from music artists

www.bitdefender.com · 4 months ago

A man has pleaded guilty to defrauding music streaming platforms out of more than eight million US dollars. He created thousands of songs using artificial intelligence and then used ten thousand bots to generate billions of fake streams. This scheme, which involved accomplices, exploited how streaming royalties are distributed, diverting funds from legitimate artists. The man agreed to pay over eight million dollars in forfeiture and faces up to five years in prison.

6 key trends reshaping the IAM market

www.csoonline.com · 4 months ago

false

Stackfield Desktop App: RCE via Path Traversal and Arbitrary File Write (CVE-2026-28373)

www.rcesecurity.com · 4 months ago

A path traversal vulnerability exists in the Stackfield Desktop application for Windows and macOS, potentially allowing an attacker to write arbitrary files to a victim's filesystem and achieve remote code execution. The vulnerability arises during the decryption of organization data exports, specifically through the manipulation of file paths and GUIDs within the export structure. Attackers can craft malicious exports that, when decrypted, write files like a batch script to a user's Startup folder, enabling persistence. Stackfield addressed this issue in version 1.10.2.

US Prisons Russian Access Broker for Aiding Ransomware Attacks

www.securityweek.com · 4 months ago

A Russian national, Aleksei Volkov, has been sentenced to over six years in prison for his involvement in Yanluowang ransomware attacks. Volkov acted as an initial access broker, providing system access to other criminals who deployed malware and stole data, resulting in over $9 million in losses and an attempted $24 million ransom. He pleaded guilty to hacking into company networks and stealing data. Volkov has agreed to pay more than $9 million in restitution to victims.

New Study Reveals How Infostealer Infections Lead to Dark Web Exposure in Just 48 Hours

gbhackers.com · 4 months ago

New research indicates that infostealer malware infections can lead to credential exposure on dark web marketplaces within 48 hours. The process often begins with a user clicking a malicious link or downloading cracked software, resulting in the theft of VPN access, cloud account logins, and session tokens, which are then listed for sale. Threat actors utilize malware-as-a-service models like Lumma, RedLine, and Vidar to quickly harvest data and package it into logs categorized by value. Monitoring dark web marketplaces is now crucial for organizations to detect stolen credentials and proactively mitigate potential exploitation.

In Trump’s war messaging, veterans see something new — and disturbing

www.washingtonpost.com · 4 months ago

false

A movement to ban data centers gains steam across the U.S.

www.washingtonpost.com · 4 months ago

false

AI is breaking traditional security models — Here’s where they fail first

www.csoonline.com · 4 months ago

false

Manager of botnet used in ransomware attacks gets 2 years in prison

www.bleepingcomputer.com · 4 months ago

A Russian national, Ilya Angelov, has been sentenced to two years in prison for managing a botnet used in BitPaymer ransomware attacks against over 70 U.S. companies. Angelov, also known as "milan" and "okart," was part of a cybercriminal operation tracked as Mario Kart, or TA551. The group used a botnet to distribute malware through phishing campaigns and sold access to infected devices, leading to over 14 million dollars in extortion payments. This operation collaborated with groups like TrickBot and was linked to Lockean ransomware.

AI-Driven ‘OpenClaw Trap’ Campaign Targets Developers and Gamers via Trojanized GitHub Repos

gbhackers.com · 4 months ago

A large-scale malware campaign, dubbed "TroyDen’s Lure Factory," is using AI to create convincing but malicious repositories on GitHub, targeting developers, gamers, and everyday users. The operation utilizes a fake OpenClaw deployment repository, AAAbiola/openclaw-docker, alongside numerous other lures like game cheats and VPN crackers, to distribute a custom LuaJIT-based trojan. This trojan employs sophisticated anti-analysis techniques and exfiltrates desktop screenshots and geolocation data to a command-and-control server, and is likely involved in credential theft. Netskope has detected and blocked the activity, reporting the malicious repositories to GitHub.

HackerOne Employee Data Exposed in Massive Navia Breach

www.securityweek.com · 4 months ago

Cybersecurity firm HackerOne is notifying nearly 300 employees that their personal data was exposed in a breach affecting Navia Benefit Solutions. Navia discovered unauthorized access to its systems between December 22, 2025, and January 15, 2026, impacting approximately 2.7 million individuals overall. The compromised information includes names, dates of birth, Social Security numbers, and health plan information. While Navia reports no evidence of data misuse, the potential for future harm remains.

Kali Linux 2026.1 Launches With 8 New Hacking Tools for Penetration Testers

gbhackers.com · 4 months ago

Kali Linux 2026.1 has been released, offering a visual refresh, including updated wallpapers and a nostalgic BackTrack Mode to celebrate the twentieth anniversary of BackTrack Linux. This version includes eight new hacking tools, such as AdaptixC2 and XSStrike, along with improvements to mobile hacking capabilities, particularly for Samsung S10 and Redmi Note 8 users. The Linux 6.18 kernel is included, bringing twenty-five new packages and over one hundred eighty updates, but the GNU Radio ecosystem for software-defined radio is currently experiencing issues. Users can update their current installations through the standard package manager.

Security firm Cybereason open-sourced their Linux EDR agent

cybereason-public.github.io · 4 months ago

false

FCC Bans New Foreign-Made Routers Over Supply Chain and Cyber Risk Concerns

thehackernews.com · 4 months ago

The Federal Communications Commission has banned the import of new, foreign-made consumer routers due to unacceptable cyber and national security risks. This action prevents new models from being marketed or sold in the U.S., unless they receive conditional approval from the Department of War or Homeland Security. Government agencies have determined these routers create supply chain vulnerabilities and pose cybersecurity risks, potentially disrupting infrastructure and harming individuals. Threat actors, including those linked to China like Volt Typhoon and Storm-0940, have exploited vulnerabilities in these devices, including those associated with CovertNetwork-1658, also known as Quad7. Existing routers already in use, and previously approved models, are not affected by this policy.

FCC Blocks New Foreign Consumer Router Models Citing Serious Security Risks

gbhackers.com · 4 months ago

The Federal Communications Commission has banned new consumer routers manufactured in foreign countries from being sold in the United States. This action, prompted by cybersecurity risks and supply chain vulnerabilities, aims to protect U.S. critical infrastructure and aligns with national security strategies. Foreign-made routers were implicated in the Volt, Flax, and Salt Typhoon cyberattacks. Manufacturers can apply for conditional approval from the Department of War or Department of Homeland Security to continue receiving authorization.

Five Malicious npm Packages Target Crypto Developers, Steal Wallet Keys via Telegram

gbhackers.com · 4 months ago

Five malicious npm packages impersonating cryptocurrency libraries have been identified, targeting Solana and Ethereum developers. These packages, named raydium‑bs58, base‑x‑64, bs58‑basic, ethersproject‑wallet, and basexd, steal wallet keys and transmit them to a Telegram bot. The packages use typosquatting techniques and inject malicious code to intercept private keys, with one package briefly appearing and disappearing from the npm registry. Security experts recommend developers remove these packages and treat any keys processed through them as compromised.

Compromised LiteLLM Package With 95M Downloads Tied to TeamPCP, After Trivy & KICS Hacks

gbhackers.com · 4 months ago

A popular Python library, litellm, was compromised on PyPI with over 95 million monthly downloads. The threat actor, known as TeamPCP, injected malicious code into versions 1.82.7 and 1.82.8, following similar attacks on Trivy and KICS. The malware uses a three-stage process, including credential harvesting and establishing a persistent backdoor. Affected users should roll back to version 1.82.6 and block the command and control domains models.litellm.cloud and checkmarx.zone.

HackerOne Confirms Employee Data Stolen Following Linked Navia Hack

gbhackers.com · 4 months ago

HackerOne has confirmed a data breach impacting 287 employees. The breach occurred through a cyberattack targeting Navia, a third-party service provider, between December 22, 2025, and January 15, 2026. Stolen data included employee names and personal identifiers, although HackerOne’s core platform and customer data remain secure. Affected individuals are being offered credit monitoring and identity theft protection services for 12 to 24 months.

Google Authenticator’s Hidden Passkey Design May Expose New Passwordless Attack Vectors

gbhackers.com · 4 months ago

Google’s passkey system relies on a cloud-based authenticator at enclave.ua5v[.]com to manage and sync passkeys across devices. This architecture uses a layered design incorporating Chrome, the OS, TPM hardware, and a cloud authenticator to achieve usability and device recovery. The system generates device and user verification keys, storing hardware-bound public keys and account-level secrets within a security domain, encrypted using a security domain secret. This setup introduces new potential attack vectors targeting the cloud authenticator and recovery flows, requiring comprehensive security monitoring and architectural reviews for passwordless deployments.

Iran Hacktivists Make Noise but Have Little Impact on War

www.darkreading.com · 4 months ago

NULL

Aqua Security’s Trivy Scanner Hit by Supply Chain Attack, Threatening Software Integrity

gbhackers.com · 4 months ago

A sophisticated supply chain attack compromised Aqua Security’s Trivy vulnerability scanner by injecting malicious code into the project’s GitHub Actions. Attackers exploited stolen credentials to force-push malicious commits to existing version tags, targeting deployment pipelines to steal sensitive credentials like API tokens and cloud provider keys. Organizations using Trivy should immediately update to version 0.69.2 or 0.69.3 for the binary and revert GitHub Actions to v0.35.0 or v0.2.6. Security teams should also rotate any exposed secrets and pin GitHub Actions to commit hashes to prevent future attacks.

Last Week in Security (LWiS) - 2026-03-24

blog.badsectorlabs.com · 4 months ago

Recent cybersecurity news includes a ban on new routers produced in foreign countries due to national security concerns, and the exposure of a potential breach at OVHcloud involving a large amount of data. A security scanner, Trivy, was compromised, potentially linked to a compromise of LiteLLM. Several vulnerabilities were addressed, including CVE-2026-20817 in the Windows Error Reporting Service and CVE-2026-32746 in a Telnet server. New tools emerged, such as VMkatz for extracting Windows credentials from virtual machines and ForceHound for mapping Salesforce permissions.

Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

www.microsoft.com · 4 months ago

A recent supply chain attack targeted the vulnerability scanner Trivy, attributed to the group known as TeamPCP. Attackers injected malware into Trivy binaries and compromised CI/CD pipelines to steal sensitive information like cloud credentials and API keys. Microsoft Defender is assisting organizations in investigating and is recommending practices like pinning GitHub actions and securely managing secrets to mitigate future risk. Strategies include secure secret management, preventing credential persistence, and performing attack path analysis.

Jury says Meta must pay $375 million for endangering children online

www.washingtonpost.com · 4 months ago

A jury has ruled against Meta, ordering the company to pay $375 million. The state of New Mexico alleged that Meta’s platforms failed to adequately protect young users, putting them at risk of harm including sexual abuse. The lawsuit centered on the company’s algorithms and the lack of protections for children. A recording of Mark Zuckerberg's deposition was presented to the jury during the trial.

OpenAI Is Shutting Down Sora, Its A.I. Video Generator

www.nytimes.com · 4 months ago

false

PTC warns of imminent threat from critical Windchill, FlexPLM RCE bug

www.bleepingcomputer.com · 4 months ago

PTC has issued a warning about a critical remote code execution vulnerability, CVE-2026-4681, affecting Windchill and FlexPLM product lifecycle management systems. The flaw involves the deserialization of trusted data and poses an imminent threat, prompting German authorities to dispatch agents to alert companies. While no patches are currently available, PTC is developing fixes and recommends a temporary mitigation involving access restrictions to prevent exploitation. Indicators of compromise include specific file types and unusual user agent strings.

CSA Launches CSAI Foundation for AI Security

www.darkreading.com · 4 months ago

false

www.bleepingcomputer.com · 4 months ago

A supply chain attack has compromised the popular LiteLLM Python package on PyPI, with malicious versions 1.82.7 and 1.82.8 containing an infostealer. The hacking group TeamPCP, previously linked to the Aqua Security breach, claimed responsibility for the attack. The malware harvests a wide range of credentials, including SSH keys, cloud tokens, and cryptocurrency wallet data, and attempts lateral movement within Kubernetes clusters, sending stolen data to models.litellm[.]cloud. Organizations using LiteLLM should immediately rotate credentials and check for persistence artifacts.

Meta Ordered to Pay $375 Million Over Child Safety Violations

www.nytimes.com · 4 months ago

NULL