Blahalla

Malicious npm Package Masquerades as PostCSS Utility to Deliver PowerShell Downloader

gbhackers.com · 4 months ago

A malicious npm package, postcss-minify-selector-parser, has been discovered masquerading as a benign PostCSS utility and delivering a multi-stage Windows remote access trojan (RAT).

Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data

www.securityweek.com · 4 months ago

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.

Prinz Eugen Ransomware Hits Recent Files First and Skips Ransom Notes

www.techrepublic.com · 4 months ago

Prinz Eugen ransomware prioritizes recently modified files and leaves no ransom note on disk, creating new pressure on backup windows, endpoint alerts, and incident response playbooks.

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

www.securityweek.com · 4 months ago

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.

Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally

gbhackers.com · 4 months ago

A suspicious file named “GST Debit Note Apr26.com,” which triggered a deeper investigation and revealed a polished, multi-stage steganographic loader delivering Remcos RAT and multiple infostealers across a global phishing campaign. The initial sample arrived as an archive attachment and unpacked to a 32-bit.

Professional Athletes and Wearables

www.schneier.com · 4 months ago

I haven’t thought about the privacy issues surrounding professional athletes and wearables. Wearables present serious privacy issues for “Average Joe” consumers, who are entrusting tech companies to safely store and protect their biometric data. Imagine the stakes for a professional athlete, whose entire livelihood could be affected by a single biometric data point.

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

thehackernews.com · 4 months ago

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new.

282 iOS Apps Found Leaking LLM API Credentials in Network Traffic

gbhackers.com · 4 months ago

Researchers have uncovered a systemic LLM credential exposure problem in the iOS ecosystem, with 282 AI‑powered apps leaking exploitable API credentials and backend access mechanisms directly in network traffic.

LACUNA Chain Ghost Frames Technique Bypasses EDR Call-Stack Detection

gbhackers.com · 4 months ago

The LACUNA Chain’s “Ghost Frames” technique introduces a new method for manipulating call stacks that effectively bypasses modern Endpoint Detection and Response (EDR) systems, which rely on kernel-level stack inspection. This marks a significant advancement in post-exploitation tactics.

What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks

www.securityweek.com · 4 months ago

Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage.

Attackers Can Poison AI Research Agents Using Reddit and Wikipedia Content

gbhackers.com · 4 months ago

Attackers can now manipulate AI “deep-research” agents by discreetly editing Reddit threads and Wikipedia pages. They can insert as little as a 13-word snippet, which these agents may later reference as authoritative advice, product recommendations, or even scams in their responses.

AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity

gbhackers.com · 4 months ago

A newly analyzed botnet family, AryStinger, weaponizes long‑neglected routers and NAS appliances to build a stealthy reconnaissance and relay infrastructure that helps attackers obscure origin and extend lateral reach.

Microsoft Confirms Windows 11 26H2 Upgrade via Enablement Package for Faster Deployment

gbhackers.com · 4 months ago

Microsoft has announced that the upcoming Windows 11 version 26H2 will be delivered using an enablement package model. This approach aligns with their goal of providing streamlined, low-disruption feature updates specifically for enterprise environments.

New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones

www.securityweek.com · 4 months ago

The vulnerability exploited by the Usbliter8 exploit cannot be patched and a PoC exploit has been released by researchers.

Top 10 Best PCI DSS Compliance Solutions For 2026

gbhackers.com · 4 months ago

In the ever-evolving landscape of digital commerce, safeguarding cardholder data is paramount. The Payment Card Industry Data Security Standard (PCI DSS) sets the benchmark for protecting this sensitive information, and compliance is not just a requirement it’s a cornerstone of trust for businesses that handle credit card transactions.

Top 10 Best Cyber Insurance Providers For Businesses in 2026

gbhackers.com · 4 months ago

In the fast-paced digital world of 2026, cyberattacks are no longer a matter of if, but when. The increasing sophistication of threats like ransomware, phishing, and data breaches means that even businesses with robust cybersecurity defenses are at risk.

Fortinet Responds to FortiBleed Campaign

www.securityweek.com · 4 months ago

A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign.

Top 10 Best Cybersecurity Awareness Training Platforms 2026

gbhackers.com · 4 months ago

In the complex digital landscape of 2026, technology alone is no longer enough to protect an organization from cyber threats. The human element, often cited as the weakest link, is now recognized as a critical line of defense the human firewall.

Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices

thehackernews.com · 4 months ago

Canada's spy service got a judge's permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets. The Federal Court released a public version of the ruling on June 15. It is the first time the Canadian Security Intelligence Service has used its threat reduction warrant powers this way.

More Cybersecurity Firms Disclose Impact From Klue Hack

www.securityweek.com · 4 months ago

HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers.

Prinz Eugen Ransomware Uses Go-Based Encryptor to Target Fresh Files and Evade Forensics

gbhackers.com · 4 months ago

A customer compromised by a newly observed ransomware family we attribute to the Prinz Eugen group. The encryptor is a purpose-built Go binary that departs from many first-wave samples by combining deliberate file-targeting, modern cryptography, and anti‑forensic measures traits that raise both technical and operational concerns for defenders.

Beats Studio Buds Vulnerability Lets Attackers Within Bluetooth Range Access Microphone

gbhackers.com · 4 months ago

Apple has revealed a significant security vulnerability affecting Beats Studio Buds, which could allow attackers within Bluetooth range to access a device’s microphone without user consent. This issue, identified as CVE-2025-20701, was addressed in Beats Firmware Update 1B211, released on June 16, 2026.

Chinese Cyber Operations Shift From APT Groups to Composite Responsibility Model

gbhackers.com · 4 months ago

Chinese state-linked cyber activity has moved decisively away from the neat, single-actor narratives that dominated early attribution toward an ecosystem model in which responsibility is distributed across military units, intelligence services, private firms, and criminal-style intermediaries.

Anatomy of a retail ransomware attack: Tabletop simulates modern mayhem methods

www.csoonline.com · 4 months ago

Attacks on AI systems and disinformation starred as key elements of a ransomware tabletop exercise CSO participated in during this month’s Infosecurity Europe conference. The “Enter the War Room” exercise, organised and run by cybersecurity vendor Semperis, featured a scenario focused on a cyberattack against a fictional supermarket chain, BlueCart.

6 security leader tips for mastering business risk

www.csoonline.com · 4 months ago

Longtime security leader Doug Kersten has expanded his list of responsibilities. As CISO of software maker Appfire, he now has accountability for business risks, such as how security tools and processes within customer products and services impact their costs and, thus, profitability.

GitHub Actions Checkout Adds Protection Against Malicious pull_request_target Workflows

gbhackers.com · 4 months ago

GitHub has implemented a major security enhancement in its Actions ecosystem with the release of actions/checkout v7, which aims to address a long-standing class of vulnerabilities known as “pwn requests.” This update was announced on June 18, 2026, and introduces safer defaults for workflows triggered by the pullrequesttarget event.

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

thehackernews.com · 4 months ago

A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin's XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising. The distinction matters. AryStinger exists for the stage of an attack that comes before the break-in.

Sapphire Sleet Hijacks npm Maintainer Account to Publish Poisoned Mastra Packages

gbhackers.com · 4 months ago

A widespread npm supply‑chain compromise to Sapphire Sleet, a North Korean state actor, after the takeover of an npm maintainer account enabled the mass publication of poisoned Mastra packages that silently delivered a multi‑stage implant.

pgAdmin 4 Released with Patches for Seven Vulnerabilities and Feature Enhancements

gbhackers.com · 4 months ago

pgAdmin 4 version 9.16 has been released by the pgAdmin Development Team, introducing significant security improvements along with feature enhancements and bug fixes. This update addresses seven vulnerabilities, tracked as CVE-2026-12044 through CVE-2026-12050, and includes 64 bug fixes and various usability upgrades.

OXLOADER Uses MBA Obfuscation and Control-Flow Flattening to Bypass Static Detection

gbhackers.com · 4 months ago

A previously undocumented Windows loader, tracked as OXLOADER, that combines sophisticated obfuscation and unconventional staging to evade static detection and sandbox analysis while delivering the new CASTLESTEALER infostealer via malvertising. The campaign leveraged malicious Google Ads impersonating Node.

INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific

thehackernews.com · 4 months ago

A new report from INTERPOL has revealed a "dramatic increase" in cybercrime in Asia and the South Pacific, fueled by rapid digitalization, internet penetration, new technologies, organized criminal networks, and a disparity in cybersecurity maturity.

Massive GitHub Attack Injects Malware into 10,000 Compromised Repositories

gbhackers.com · 4 months ago

A large-scale malware distribution campaign utilizing GitHub repositories has been uncovered. This coordinated effort weaponized over 10,000 repositories to deliver Trojanized payloads. The activity was first identified on June 18, 2026, and highlights significant gaps in automated detection and monitoring of repositories on one of the world’s most widely used developer platforms.

Texas Parks & Wildlife Data Breach Affects 3 Million Individuals

www.securityweek.com · 4 months ago

Hackers stole personal information after breaching the systems of a third-party license vendor serving TPWD.

GlassWorm Uses Blockchain-Based C2 and Invisible Unicode to Steal Developer Secrets

gbhackers.com · 4 months ago

A trio of coordinated campaigns a JetBrains fake AI assistant campaign, the GlassWorm self‑propagating worm, and the compromised Nx Console Visual Studio Code extension made clear that IDE plugin ecosystems are now a primary attack surface for AI credential theft.

Fortinet Warns of Active FortiBleed Credential Theft Attacks on FortiGate Devices

gbhackers.com · 4 months ago

Fortinet has issued a security warning about ongoing credential-harvesting attacks targeting FortiGate devices in a campaign known as “FortiBleed.” Threat actors are exploiting weak authentication practices rather than any newly disclosed vulnerabilities.

Why Southeast Asia CISOs Need Zero Trust as Their AI Control Plane – AI Agents, Data Borders and Supply Chains

www.csoonline.com · 4 months ago

At Zenith Live 2026 held on 16-17 June in Vienna, Zscaler sharpened a reality that Southeast Asia CIOs and CISOs are already sensing, which are, AI agents are quickly becoming digital workers inside their organisations, while regulators tighten data residency rules and supply‑chain attacks move closer to core business operations.

Volume Booster (2M Chrome users) silently activated a commerce-tracking SDK with zero permission prompts

malext.io · 4 months ago

Diffed Volume Booster's last three versions (1.0.2 → 1.0.4).

Tesla Driver Using Autopilot Crashes Into Home, Killing a Woman, Officials Say

www.nytimes.com · 4 months ago

The driver told investigators he was using the vehicle’s automated-driver system when the vehicle left the roadway and crashed into a house in Harris County, Texas.

AryStinger botnet infected thousands of D-Link routers worldwide

www.bleepingcomputer.com · 4 months ago

A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for malicious traffic.

New Prinz Eugen ransomware prioritizes recent files for encryption

www.bleepingcomputer.com · 4 months ago

A new ransomware operation named 'Prinz Eugen' prioritizes recently modified files for encryption and leaves no ransom note on the system.

Microsoft links Mastra AI supply chain attack to North Korean hackers

www.bleepingcomputer.com · 4 months ago

Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff.

Texas TPWD Vendor Breach Exposes 3 Million Customer Records

gbhackers.com · 4 months ago

Texas Cyber Command has disclosed a massive third-party data breach affecting the Texas Parks and Wildlife Department (TPWD), exposing the personal records of exactly 3,087,721 individuals. An unauthorized actor breached this vendor’s network infrastructure, resulting in a severe supply chain security incident.

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

thehackernews.com · 4 months ago

Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.

French President Urges US to Share Cutting-Edge AI and Democracies to Cooperate on Regulation

www.securityweek.com · 4 months ago

French President Emmanuel Macron urged the world’s wealthy democracies to work together on regulating advanced AI systems.

A Humble 3-Wheel Electric Vehicle Lands Toyota in Federal Court

www.nytimes.com · 4 months ago

A lawsuit filed in California claims the automaker’s philanthropic arm stole technology intended to help poor farmers, but it is not clear to what end.

Vidar Infostealer Bypasses Google Chrome’s ABE Encryption via APC Injection

gbhackers.com · 4 months ago

A sophisticated evasion technique developed by Vidar infostealer operators successfully bypasses Google Chrome’s Application-Bound Encryption (ABE). Introduced in 2024, ABE was designed to protect browser-stored cookies and sensitive credentials.

Gentlemen RaaS Unifies HexKiller, ThrottleBlood, and HavocKiller in New Evasion Suite

gbhackers.com · 4 months ago

An analysis of the Gentlemen ransomware-as-a-service (RaaS) operation has revealed a sophisticated, centralized approach to neutralizing endpoint detection and response (EDR) solutions.

AutoJack Exploit Chain Hits Microsoft AutoGen Studio With Zero-Click RCE Attack

gbhackers.com · 4 months ago

A critical exploit chain dubbed AutoJack that allows a single malicious web page to hijack Microsoft’s AutoGen Studio browsing agent and silently execute arbitrary code on the host machine, requiring no user interaction beyond submitting a URL. AutoJack targets AutoGen Studio, Microsoft Research’s open-source prototyping UI for multi-agent AI systems.

Threat Brief: Mitigating Large-Scale Credential Attacks

unit42.paloaltonetworks.com · 4 months ago

We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices.

Klue OAuth breach victim list grows as Icarus hackers claim attack

www.bleepingcomputer.com · 4 months ago

Klue suffered OAuth token theft from customer Salesforce via compromised integrations by Icarus group. Attackers used a legacy credential exploit to steal business contact data. This impacted multiple customers.