Blahalla

Ghost Campaign Uses 7 npm Packages to Steal Crypto Wallets and Credentials

thehackernews.com · 4 months ago

Cybersecurity researchers have identified a new malicious campaign, dubbed "Ghost," distributing harmful npm packages designed to steal cryptocurrency wallets and sensitive data. These packages, published by a user named mikilanjillo, trick users into entering their administrator passwords under the guise of system optimizations. The malware then deploys a remote access trojan, harvests data, and communicates with Telegram channels. This activity shares similarities with the GhostClaw campaign, which uses GitHub repositories and AI workflows to distribute credential-stealing payloads on macOS.

New ‘StoatWaffle’ malware auto‑executes attacks on developers

www.csoonline.com · 4 months ago

A new malware strain called StoatWaffle has emerged, building upon the Contagious Interview campaign targeting developers. This malware leverages Visual Studio Code’s “runOn:folderOpen” feature to automatically execute malicious code when a trusted project is opened, bypassing user interaction. StoatWaffle, implemented in Node.js, includes stealer and remote access trojan capabilities, stealing browser data and targeting Keychain databases on macOS. Security researchers attribute the campaign to a North Korea-linked threat actor known as WaterPlum, and have released indicators of compromise to aid detection.

TeamPCP Unleashes Iran-Targeted CanisterWorm Kubernetes Wiper

gbhackers.com · 4 months ago

A threat actor known as TeamPCP has launched a new wiper campaign called CanisterWorm, targeting Kubernetes clusters and systems in Iran. The malware uses a stager from Cloudflare infrastructure and a Python controller script to selectively destroy systems based on timezone and locale checks. On targeted Iranian Kubernetes clusters, the wiper creates a DaemonSet to wipe the entire environment, while on other Kubernetes clusters, a backdoor is installed. The campaign also utilizes network worm behavior to spread laterally, disguising malicious code as PostgreSQL monitoring tools.

Dell Wyse Management Flaws Could Lead to Full System Compromise

gbhackers.com · 4 months ago

Security researchers have discovered a critical vulnerability chain in Dell Wyse Management Suite, allowing unauthenticated attackers to gain full system control. The flaw exploits weaknesses in the device registration and Active Directory user import processes, even when Active Directory features are supposedly disabled. Attackers can escalate privileges, execute code remotely, and upload malicious scripts to achieve remote code execution. Dell has released version 5.5 to address these vulnerabilities, which are tracked as CVE-2026-22765 and CVE-2026-22766.

Critical Citrix NetScaler Vulnerability Poised for Exploitation, Security Firms Warn

www.securityweek.com · 4 months ago

Citrix has released security updates to address a critical vulnerability, CVE-2026-3055, in NetScaler ADC and NetScaler Gateway. This out-of-bounds read issue affects deployments configured as a SAML Identity Provider and carries a CVSS score of 9.3. Security experts warn the flaw could allow attackers to leak sensitive memory, drawing comparisons to previous Citrix security incidents. A second vulnerability, CVE-2026-4368, a race condition leading to user session mixup, is also resolved in the updates.

Alleged OVHcloud data of 1.6M customers and 5.9M websites posted on popular forum for sale. CEO Comments

thecybersecguru.com · 4 months ago

A significant data breach is reportedly impacting OVHcloud, potentially exposing 590 Terabytes of data from 1.6 million customer records and 5.9 million websites. Compromised website source code, databases, and server configurations are among the alleged data exposed, possibly through a parent account vulnerability. While the company disputes the authenticity of a leaked sample, the incident underscores the importance of enhanced cloud security measures, including credential rotation and multi-factor authentication. Experts suggest that attackers may seek to profit from the data, advising users to audit systems and prioritize security hardening.

Team Mirai and Democracy

www.schneier.com · 4 months ago

false

Multiple Vulnerabilities in TP-Link Devices Enable Arbitrary Command Execution

gbhackers.com · 4 months ago

TP-Link has released a security advisory addressing four high-severity vulnerabilities impacting several Archer series routers, including the NX200, NX210, NX500, and NX600 models. These vulnerabilities involve authorization bypass, command injection, and a hardcoded cryptographic key, potentially allowing attackers to execute arbitrary commands and manipulate device configurations. Affected users are urged to update their device firmware immediately, with specific version updates required depending on the hardware version. These routers are not sold in the United States. The vulnerabilities have been assigned CVE identifiers: CVE-2025-15517, CVE-2026-15518, CVE-2026-15519, and CVE-2025-15605.

Forensic Readiness Is Becoming a Strategic Security Discipline

tracehoundlabs.com · 4 months ago

false

Mazda Says Employee, Partner Information Stolen in Cyberattack

www.securityweek.com · 4 months ago

Mazda Motor Corporation recently confirmed a data breach impacting hundreds of employees and business partners. The incident involved unauthorized access to a warehouse operations management system used for parts procured from Thailand, compromising 692 records. Exposed information includes user IDs, names, email addresses, company names, and business partner IDs. Mazda reported the breach to authorities and implemented security patches, revised access policies, and restricted internet access.

TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

thehackernews.com · 4 months ago

Cybercriminals linked to the Trivy supply chain attack, known as TeamPCP, have compromised GitHub Actions workflows belonging to Checkmarx. The threat actors are using a credential-stealing malware, "TeamPCP Cloud stealer," to harvest sensitive information like SSH keys, Git credentials, and cloud provider secrets. Stolen data is exfiltrated to the domain checkmarx[.]zone and sometimes backed up in repositories named "tpcp-docs" or "docs-tpcp." This activity is being tracked under CVE-2026-33634 and is enabling a cascading supply chain compromise as attackers weaponize stolen secrets.

Threat Actors Target MS-SQL Servers to Deploy ICE Cloud Scanner Malware

gbhackers.com · 4 months ago

Threat actors, specifically the Larva-26002 group, are aggressively targeting Microsoft SQL servers. These attacks, which began in 2024, initially involved deploying ransomware like Trigona and Mimic, but now utilize a Go-based malware called ICE Cloud Client to scan for vulnerable systems. Attackers abuse the Bulk Copy Program utility to deploy malicious payloads and are using increasingly sophisticated methods, including possible generative AI, to evade detection. Organizations are urged to strengthen passwords, restrict access, and monitor for suspicious activity to prevent compromise.

Gcore Radar report reveals 150% surge in DDoS attacks year-on-year

gbhackers.com · 4 months ago

DDoS attacks surged dramatically in the last quarter of 2025, with the total number of attacks increasing to 1.3 million, a 150% rise year-on-year. Attack volumes reached a staggering 12 terabits per second, a sixfold increase, driven by factors like broader access to attack tools and geopolitical instability. Network-layer attacks are increasingly common, accounting for 82% of incidents, while application-layer attacks are lasting longer. The technology, financial services, and gaming sectors remain primary targets, with a significant portion of attacks originating from Latin America, particularly Mexico and Brazil, potentially linked to the AISURU botnet.

Stryker Says Malicious File Found During Probe Into Iran-Linked Attack

www.securityweek.com · 4 months ago

Medical technology company Stryker has confirmed a malicious file was used during a cyberattack linked to Iran’s Ministry of Intelligence and Security. The hacker group Handala claimed responsibility, initially suggesting the use of wiper malware, but Stryker found no evidence of that. Instead, the attackers appear to have abused Stryker’s Microsoft Intune system and leveraged stolen credentials to wipe systems and disrupt operations, though the file was contained and did not spread. The US government has linked Handala to Iran and taken action against its infrastructure, and the FBI has released information about related malware, though it is likely unrelated to the Stryker incident.

Autonomous AI adoption is on the rise, but it’s risky

www.csoonline.com · 4 months ago

Autonomous agentic AI is rapidly gaining traction, offering potential efficiencies but also raising security concerns. Tools like Anthropic’s Claude Cowork and OpenClaw enable users to automate tasks, but some users have experienced unintended consequences, such as data loss. Security researchers have identified vulnerabilities in OpenClaw, including prompt injection attacks. Experts caution that while autonomous AI can streamline workflows and free up human workers, robust controls, data management, and employee training are crucial to mitigate risks and prevent errors.

Streamline physical security to enable data center growth in the era of AI

www.csoonline.com · 4 months ago

false

Russian Access Broker Jailed for Facilitating Ransomware Attacks Targeting U.S. Companies

gbhackers.com · 4 months ago

A Russian national, Aleksei Volkov, has been sentenced to 81 months in prison for acting as an initial access broker, facilitating ransomware attacks against U.S. companies. Volkov identified and exploited vulnerabilities in corporate networks, selling access to groups like Yanluowang. His actions led to over $9 million in losses and $24 million in intended damages for victims. He now faces over $9 million in restitution and forfeiture of his cybercrime equipment.

Google Forms Job Scam Spreads PureHVNC Malware

gbhackers.com · 4 months ago

A new malware campaign is using Google Forms and LinkedIn to distribute the PureHVNC Remote Access Trojan. Attackers are impersonating companies with job interview and project proposal lures, directing victims to download ZIP files containing malicious executables and documents. Once executed, the malware establishes persistence and injects PureHVNC into legitimate processes, granting attackers remote control and allowing them to steal sensitive data. Communication with command-and-control servers occurs at IP address 207.148.66.14 over ports 56001, 56003.

Founder of CoinDCX Arrested Amid Serious Fraud and Cheating Charges

gbhackers.com · 4 months ago

CoinDCX co-founders Sumit Gupta and Neeraj Khandelwal were arrested and remanded into police custody facing charges of criminal breach of trust. The arrest stems from a financial fraud where a complainant lost over 71 lakh rupees to fraudsters who promised high-yield cryptocurrency investments and franchise opportunities. CoinDCX maintains their innocence, claiming they are victims of a sophisticated brand impersonation campaign involving over 1200 malicious websites. Authorities are investigating the claims of spoofed websites and cooperating with CoinDCX to resolve the matter.

Microsoft Unveils New GenAI Security Protections in Azure AI Foundry

gbhackers.com · 4 months ago

Microsoft is introducing new security protections for generative AI models hosted on Azure AI Foundry to address growing concerns about trust, data security, and supply chain risks. These protections include a Zero Trust architecture, sandboxing models within Azure’s hardened infrastructure, and rigorous security analysis, including malware analysis, vulnerability assessments targeting CVEs, backdoor detection, and model integrity checks. Microsoft ensures customer data is not used to train shared models and remains confined within the customer’s tenant. The company emphasizes ongoing validation and risk assessment similar to traditional software dependencies.

Why CISOs should embrace AI honeypots

www.csoonline.com · 4 months ago

false

NIST Releases Quick-Start Guide Linking Cybersecurity, Enterprise Risk, and Workforce Management

gbhackers.com · 4 months ago

false

U.S. Sentences Russian Hacker to 6.75 Years for Role in $9M Ransomware Damage

thehackernews.com · 4 months ago

A Russian citizen, Aleksei Olegovich Volkov, has been sentenced to 6.75 years in prison for facilitating ransomware attacks against U.S. companies, resulting in over $9 million in losses. Volkov acted as an initial access broker, selling unauthorized access to criminal groups like Yanluowang. Separately, Angelo Martino, a ransomware negotiator for DigitalMint, has been charged with assisting the BlackCat ransomware gang and faces up to 20 years in prison; authorities seized approximately $9.2 million in cryptocurrency and assets from him.

New Leak Site Tied to Active Initial Access Broker Emerges on Underground Forums

gbhackers.com · 4 months ago

A new Tor-based leak site called ALP-001 has emerged, combining the functions of an access shop and a data leak portal. The group, linked to an Initial Access Broker previously operating under aliases like Alpha Group and DGJT Group, has publicly named French manufacturer Pellenc as their first victim, threatening to release 228 gigabytes of data. ALP-001 specializes in compromising perimeter technology and remote access gateways, often exploiting vulnerabilities in services like Fortinet, Cisco, Citrix, and Palo Alto Networks. Organizations should immediately audit configurations, apply security patches, and enforce multi-factor authentication to mitigate the risk.

Roundcube Releases Urgent Security Update to Fix Critical Bugs

gbhackers.com · 4 months ago

Roundcube Webmail has released an urgent security update, version 1.6.14, to address eight critical vulnerabilities. One severe issue is a pre-authentication arbitrary file write vulnerability stemming from unsafe deserialization, potentially allowing attackers to compromise the entire system. Other vulnerabilities include an authentication bypass, IMAP injection combined with Cross-Site Request Forgery, a Server-Side Request Forgery, Cross-Site Scripting, and methods to bypass email privacy protections, including remote image blocking. Administrators are strongly advised to update immediately and verify the integrity of downloaded packages.

SilentConnect Uses Fake Invites to Deploy ScreenConnect RAT

gbhackers.com · 4 months ago

A new malware campaign called SILENTCONNECT is using fake online invitations and trusted cloud services to deploy the ConnectWise ScreenConnect remote access tool. The attack begins with phishing emails that redirect victims to a Cloudflare CAPTCHA page, then downloads and executes a VBScript file that compiles and runs C code. This loader uses techniques to evade detection, including PEB masquerading and modifying Microsoft Defender exclusion lists before silently installing ScreenConnect. Attackers are also using cloned Microsoft Teams pages to deploy ScreenConnect and Syncro RMM agents, demonstrating both operational discipline and weaknesses in infrastructure choices.

Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks

thehackernews.com · 4 months ago

Citrix is urging users to patch two vulnerabilities affecting NetScaler ADC and NetScaler Gateway. One critical flaw, CVE-2026-3055, allows unauthenticated attackers to potentially leak sensitive data from the appliance’s memory if configured as a SAML Identity Provider. Another vulnerability, CVE-2026-4368, involves a race condition requiring specific configurations like a gateway or AAA server. Security experts warn that exploitation is likely, given previous attacks targeting NetScaler devices, including CVE-2023-4966, CVE-2025-5777, CVE-2025-6543, and CVE-2025-7775.

Fake ChatGPT Invites Target Android Users With Malware

gbhackers.com · 4 months ago

Cybercriminals are targeting Android users with fake ChatGPT and Meta advertising apps through invitation emails appearing to come from Google. These emails direct users to Firebase App Distribution landing pages that mimic legitimate Google infrastructure. Once installed, the apps display a fake Facebook login screen to steal user credentials, potentially enabling account takeover and fraudulent ad campaigns. Users are advised to be cautious of unsolicited invitations, download apps only from official sources, and enforce multi-factor authentication.

Critical NetScaler ADC and Gateway Flaws Expose Systems to Remote Attacks

gbhackers.com · 4 months ago

Cloud Software Group has released a security bulletin addressing critical vulnerabilities in NetScaler ADC and Gateway appliances. A memory overread flaw, CVE-2026-3055, allows attackers to potentially extract sensitive data if the appliance is configured as a SAML Identity Provider. A session mixup vulnerability, CVE-2026-4368, could lead to unauthorized access if the appliance is configured as a virtual server or Gateway with SSL VPN, ICA Proxy, CVPN, or RDP Proxy. Affected versions include NetScaler ADC and Gateway 14.1 prior to 14.1-66.59, version 14.1-66.54, 13.1 prior to 13.1-62.23, and FIPS/NDcPP versions prior to 13.1-37.262; administrators are urged to immediately update to the latest available patches.

Chrome Security Update Fixes 8 Vulnerabilities That Could Enable Remote Code Execution

gbhackers.com · 4 months ago

A critical security update is now available for Google Chrome, addressing eight high-severity vulnerabilities. These flaws primarily involve memory management errors like heap buffer overflows, use-after-free bugs, out-of-bounds reads, and integer overflows, which could allow attackers to execute code on a user’s machine. The update resolves vulnerabilities in WebAudio, WebGL, Dawn, WebGPU, FedCM, CSS, and Fonts, with CVEs including CVE-2026-4673, CVE-2026-4675, CVE-2026-4676, CVE-2026-4678, CVE-2026-4680, CVE-2026-4674, CVE-2026-4677, and CVE-2026-4679. Users are strongly encouraged to update their browsers to protect against potential attacks.

Palo Alto updates security platform to discover AI agents

www.csoonline.com · 4 months ago

Palo Alto Networks is updating its Prisma AIRS security platform to address the growing use of AI agents within organizations, which is predicted to rapidly increase. The platform will now discover, scan, and simulate attacks against these agents to enhance security, and includes capabilities like Agent Artifact Security and AI Red Teaming for Agents. A new version of Prisma Browser will monitor user-generated AI activity, prevent data leaks, and block prompt injection attacks. Additionally, Palo Alto Networks has released Next Generation Trust Security, a digital certificate lifecycle management platform integrating CyberArk's technology to address shortened certificate lifespans.

OpenAI rolls out ChatGPT Library to store your personal files

www.bleepingcomputer.com · 4 months ago

false

e open-sourced 209 security tests for multi-agent AI systems (MCP, A2A, L402/x402 protocols)

www.cteinvest.com · 4 months ago

A new open-source framework is available to verify the security of AI agent systems. The framework runs 209 tests across four communication protocols, covering the OWASP Agentic Security Initiatives Top 10 and aligning with NIST standards. It produces an Agent Autonomy Risk Score to determine if unsupervised operation is safe and includes an adversarial simulation based on Anthropic’s GTG-1002 report. The tool aims to bridge the gap between AI governance policies and real-world security verification, identifying vulnerabilities missed by generic scans.

Mazda discloses security breach exposing employee and partner data

www.bleepingcomputer.com · 4 months ago

Mazda Motor Corporation recently experienced a security breach affecting employee and partner data. Attackers exploited a vulnerability in a warehouse management system related to parts procured from Thailand, potentially exposing user IDs, full names, email addresses, company names, and business partner IDs. The incident impacted 692 records and did not involve customer data. While Mazda has not confirmed the breach, the Clop ransomware group claimed responsibility for compromising Mazda.com and MazdaUSA.com in November 2025.

AI in the SOC: What Could Go Wrong?

www.darkreading.com · 4 months ago

false

Google Authenticator: The Hidden Mechanisms of Passwordless Authentication

unit42.paloaltonetworks.com · 4 months ago

false

Tycoon2FA phishing platform returns after recent police disruption

www.bleepingcomputer.com · 4 months ago

A phishing-as-a-service platform called Tycoon2FA has quickly recovered after a recent disruption by law enforcement. The platform, which targets Microsoft 365 and Gmail accounts and bypasses two-factor authentication, previously sent approximately 30 million phishing emails monthly. CrowdStrike reports activity levels have returned to pre-disruption levels, with the platform continuing to support activities like business email compromise and cloud account takeovers. Cybercriminals have rebuilt the infrastructure using new domains and IP addresses, highlighting the difficulty of permanently dismantling such services without arrests.

Trivy Supply Chain Attack Targets CI/CD Secrets

www.darkreading.com · 4 months ago

A threat actor compromised Trivy, a widely used cloud security scanning tool, exploiting a misconfiguration in its GitHub Action component to steal credentials. Attackers then pushed malicious code to 76 out of 77 versions of trivy-action and all seven versions of setup-trivy, affecting CI/CD pipelines. The malicious payload harvests credentials, including SSH keys, cloud provider credentials, and Kubernetes tokens, using AES-256-CBC encryption and exfiltrates data to attacker-controlled infrastructure or creates public GitHub repositories. Organizations using affected Trivy versions are urged to rotate compromised secrets and audit their workflows.

Ransomware's New Era: Moving at AI Speed

www.darkreading.com · 4 months ago

Ransomware attacks are accelerating, with threat actors now using artificial intelligence to improve data theft and bypass traditional security measures like Endpoint Detection and Response (EDR). Attackers are increasingly utilizing living-off-the-land techniques, exploiting valid credentials instead of relying on malware, and targeting vulnerable medical devices. The rise of AI has lowered the barrier to entry for cybercrime, enabling less technical actors to launch sophisticated campaigns, and organizations are struggling to keep pace with the evolving threat landscape. Law enforcement actions have disrupted major ransomware groups like LockBit, leading to the emergence of Qilin and an increase in impersonation attempts.

Judge Hears State Challenge to Trump’s Tech Deal Settlement

www.nytimes.com · 4 months ago

NULL

CISOs Debate Human Role in AI-Powered Security

www.darkreading.com · 4 months ago

false

TeamPCP deploys Iran-targeted wiper in Kubernetes attacks

www.bleepingcomputer.com · 4 months ago

A hacking group called TeamPCP is targeting Kubernetes clusters and other systems with a wiper malware. The group, known for the recent Trivy supply-chain attack and the CanisterWorm campaign, deploys different payloads based on system configuration. Iranian systems are wiped, while other systems receive a backdoor installation. The malware employs various propagation methods, including Kubernetes DaemonSets and SSH, and researchers have identified key indicators of compromise.

Detect SnappyClient C&C Traffic Using PacketSmith + Yara-X Detection Module

blog.netomize.ca · 4 months ago

NULL

Crunchyroll probes breach after hacker claims to steal 6.8M users' data

www.bleepingcomputer.com · 4 months ago

Crunchyroll is investigating a data breach after a hacker claimed to steal personal information for approximately 6.8 million users. The attacker gained access to Crunchyroll’s systems by compromising the Okta SSO account of a support agent employed by Telus International, a business process outsourcing company. Stolen data includes user names, email addresses, IP addresses, and support ticket contents, with some credit card information exposed when shared within those tickets. The hacker attempted extortion, demanding $5 million, and the attack occurred between March 12th, 2026, and mid-2025.

Navia Data Breach Hits 2.7 Million People, Exposing Sensitive Personal Data

www.techrepublic.com · 4 months ago

Navia Benefit Solutions recently confirmed a data breach impacting approximately 2.7 million people. Hackers had unauthorized access to the company’s systems for over three weeks, from December 22, 2025, to January 15, 2026. Stolen data includes full names, Social Security numbers, dates of birth, phone numbers, email addresses, and health benefits information like HRA, FSA, and COBRA enrollment details. Affected individuals are being offered free credit monitoring services and are advised to place fraud alerts on their credit files and monitor financial statements.

Vulnerability Disclosure - SCHNEIDER ELECTRIC Modicon Controllers M241 / M251 / M262

claroty.com · 4 months ago

Researchers have discovered three new methods attackers can use to bypass security controls in virtual desktop infrastructure environments. These techniques involve manipulating the clipboard, exploiting unattended access tools, and utilizing rogue USB devices. Successful exploitation can lead to privilege escalation and potential data theft. The vulnerabilities include CVE-2024-3093, CVE-2024-3094, and CVE-2024-3095.

Google Reinvents Android Sideloading to Thwart Scammers

www.techrepublic.com · 4 months ago

Google is implementing a new process for Android users to sideload apps from outside the Play Store, following an antitrust settlement. The “advanced flow” requires multiple steps, including enabling developer mode, confirming security protections, a 24-hour waiting period, and reauthentication, designed to deter scammers and protect users from pressure tactics. While intended to preserve sideloading for experienced users, the complex process introduces barriers for casual users and raises concerns about potential impacts on smaller developers and competition. Google is also introducing free “limited distribution” accounts to address those concerns and allow for experimentation.

Why Your Brain is a Security Risk

www.marisec.ca · 4 months ago

Human instincts, developed for physical survival, make people vulnerable to cyberattacks like phishing. Stressful situations trigger cognitive narrowing, leading to hasty decisions like reusing passwords without verification. Attackers exploit these emotions, often motivating attacks for financial gain, potentially resulting in data breaches or ransomware. Organizations should implement measures like multi-factor authentication, key vaults, passkeys, and frequent security awareness training to mitigate these risks and reinforce secure behaviors. Dark-web monitoring is also recommended for early detection of compromised credentials.

North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware

thehackernews.com · 4 months ago

North Korean threat actors, linked to the Contagious Interview campaign, are using malicious Microsoft Visual Studio Code projects to deploy the StoatWaffle malware. This malware uses VS Code's "tasks.json" feature to automatically execute code upon opening a project, initially downloading and installing Node.js if necessary, then fetching and running further payloads. The StoatWaffle malware includes stealer modules for credentials and a remote access trojan (RAT) for command execution, and has expanded tactics to include using GitHub Gist for payload delivery. Microsoft has released an update to VS Code, version 1.109, to mitigate this threat by disabling automatic task execution by default.

Trivy supply-chain attack spreads to Docker, GitHub repos

www.bleepingcomputer.com · 4 months ago

Hackers linked to the TeamPCP group have compromised Aqua Security's GitHub organization, impacting the widely used Trivy vulnerability scanner. Malicious Docker images were pushed to Docker Hub with tags 0.69.5 and 0.69.6, containing infostealing code. The attackers exploited a compromised service account, Argon-DevOps-Mgt, which used a Personal Access Token instead of a more secure GitHub App, allowing for rapid repository tampering. Aqua Security has released safe versions of Trivy and is investigating the incident with Sygnia.