Blahalla

Nordstrom's email system abused to send crypto scams to customers

www.bleepingcomputer.com · 4 months ago

Nordstrom customers recently received fraudulent emails promoting a cryptocurrency scam, disguised as a St. Patrick’s Day promotion. The messages promised to double cryptocurrency deposits within two hours, creating a sense of urgency. The emails originated from a legitimate Nordstrom company email address, indicating a possible security breach through an Okta SSO to Salesforce compromise. Nordstrom has warned customers to disregard the unauthorized messages and verified that they will not request cryptocurrency transactions.

FancyBear Server Leak Exposes Stolen Credentials, 2FA Secrets, NATO Targets

gbhackers.com · 4 months ago

A Russian state-sponsored threat actor, APT28/FancyBear, inadvertently exposed a command and control server containing stolen credentials, 2FA secrets, and operational logs. The server, located at 203.161.50[.]145, was accessible for approximately 500 days due to a basic operational security failure. The compromised data included over 2,800 emails, 240 credential sets, and targeted government and military entities in Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. The exposed toolkit leveraged JavaScript payloads injected into Roundcube and SquirrelMail, enabling credential theft and persistent email forwarding.

UIDAI Introduces Bug Bounty Program to Strengthen Aadhaar Defenses

gbhackers.com · 4 months ago

The Unique Identification Authority of India has launched a bug bounty program to strengthen the security of the Aadhaar system. Twenty experienced security researchers will assess the UIDAI website, the myAadhaar portal, and the Secure QR Code application for vulnerabilities. Researchers will report findings through responsible disclosure channels and receive financial rewards based on the severity of the discovered flaws, which are classified as Critical, High, Medium, or Low. UIDAI has partnered with ComOlho IT Private Limited to manage the program and augment existing security measures.

How to Follow the Game, Even When You Can’t See It Live

www.nytimes.com · 4 months ago

false

Researchers: Meta, TikTok Steal Personal & Financial Info When Users Click Ads

www.darkreading.com · 4 months ago

Social media companies like Meta and TikTok are collecting extensive user data through tracking pixels embedded in advertisers' websites. These pixels gather personally identifying information, credit card details, and shopping behavior, often without users' explicit consent or knowledge, even when users indicate they don’t want their data shared. This practice raises concerns about potential violations of data privacy laws like GDPR and CCPA, and advertisers who use these pixels may face legal repercussions. Both Meta and TikTok have responded to inquiries but have not yet provided formal comments.

SideWinder Espionage Campaign Expands Across Southeast Asia

www.darkreading.com · 4 months ago

The SideWinder threat group, linked to India, has expanded its cyber-espionage operations from South Asia to Southeast Asia, including Indonesia and Thailand. They utilize phishing, stolen credentials, and rapidly changing infrastructure to maintain persistent access to government institutions, telecommunications networks, and strategic sectors. The group employs tactics like DLL hijacking and dynamic configuration data retrieval to evade detection and quickly redeploy infrastructure. Researchers recommend organizations move beyond indicator-based defenses to focus on repeatedly blocking the group’s tactics, techniques, and procedures.

Iranian Hackers Likely Used Malware-Stolen Credentials in Stryker Breach

www.securityweek.com · 4 months ago

Iranian-linked hackers, believed to be operating under the Handala persona and controlled by Iran’s Ministry of Intelligence, recently targeted Stryker, a medical technology company. The attack, which involved the wiping of devices and data theft, initially appeared to utilize wiper malware, but Stryker found no evidence of this. Investigation reveals the attackers likely obtained credentials through infostealer malware, compromising an Intune administrator account and creating a global administrator account. The Cybersecurity and Infrastructure Security Agency and the FBI are assisting with the investigation.

Apple Debuts Background Security Improvements With Fresh WebKit Patches

www.securityweek.com · 4 months ago

Apple has introduced a new system called Background Security Improvements to deliver security updates more quickly across its platforms. This feature supports components like Safari and WebKit, providing lightweight fixes between major software updates. Users can enable the automatic installation of these improvements in the Privacy and Security settings. The initial update addresses a cross-origin bug in WebKit, identified as CVE-2026-20643, impacting the Navigation API.

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE

thehackernews.com · 4 months ago

A critical security flaw has been discovered in the GNU InetUtils telnet daemon, identified as CVE-2026-32746, allowing unauthenticated attackers to execute code with root privileges. The vulnerability stems from a buffer overflow within the LINEMODE Set Local Characters handler and can be triggered by sending a specially crafted message during the initial connection to port 23. Experts recommend disabling the service, restricting access to port 23, or running it without root privileges as a mitigation. This follows a similar vulnerability, CVE-2026-24061, that is currently being exploited.

Apple WebKit Security Flaw Exposes iOS and macOS Users to Content-Based Bypass Attacks

gbhackers.com · 4 months ago

Apple has released security updates to fix a critical vulnerability in the WebKit browser engine affecting iOS, iPadOS, and macOS. The flaw, identified as CVE-2026-20643 and tracked as WebKit Bugzilla 306050, allows attackers to bypass the Same Origin Policy and potentially access sensitive user data. The vulnerability impacts devices running iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. Apple implemented improved input validation to resolve the issue, utilizing its Background Security Improvements system for a seamless patch deployment.

Turing Award Goes to Inventors of Quantum Cryptography

www.nytimes.com · 4 months ago

false

Reco targets AI agent blind spots with new security capability

www.csoonline.com · 4 months ago

Reco has launched a new security capability, Reco AI Agent Security, to address the growing risks associated with AI-driven tools like Copilot, ChatGPT, and automation platforms. The tool provides visibility and control over AI agents operating across an organization’s SaaS ecosystem, moving beyond traditional SaaS security posture management methods. Reco’s approach identifies agents by analyzing their behavior and API call patterns, rather than just connections. Observed incidents have included agents with excessive data access, with one agent exfiltrating customer data to a personal account.

Claude Code Security and Magecart: Getting the Threat Model Right

thehackernews.com · 4 months ago

A recent Magecart attack hid malicious JavaScript within a favicon's EXIF data, bypassing repository scanners and executing directly in the shopper's browser. This highlights a limitation of tools like Claude Code Security, which primarily analyzes code within repositories and lacks visibility into dynamically loaded third-party resources. Experts recommend combining static analysis with client-side runtime monitoring to detect and prevent these web supply chain attacks, as runtime monitoring provides a crucial window into browser activity that static tools cannot observe. Other attack vectors include malicious iframes, pixel tracker abuse, and DOM-based credential harvesting, all sharing the characteristic of operating outside the merchant's codebase.

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

thehackernews.com · 4 months ago

Cybersecurity researchers have identified nine critical vulnerabilities across IP Keyboard, Video, Mouse or KVM devices from multiple vendors. These flaws, including CVE-2026-32290, CVE-2026-32291, CVE-2026-32292, CVE-2026-32293, CVE-2026-32294, CVE-2026-32295, CVE-2026-32296, CVE-2026-32297, and CVE-2026-32298, allow for unauthenticated root access and arbitrary code execution. The vulnerabilities stem from issues like missing authentication, broken access controls, and a lack of firmware verification. Exploitation could grant attackers extensive control over connected systems, bypassing security controls and enabling persistent infections. Mitigations include multi-factor authentication, network isolation, and firmware updates.

LeakNet boosts ransomware with ClickFix lures, stealthy Deno loader

gbhackers.com · 4 months ago

The ransomware group LeakNet is enhancing its operations by utilizing ClickFix lures and a stealthy Deno-based loader to compromise systems. ClickFix tricks users into running malicious commands, while the Deno loader executes code entirely in memory to evade detection. Post-exploitation activities include DLL sideloading, lateral movement using PsExec, and data staging via S3 buckets. Security teams should prioritize behavioral analysis and monitor for unusual activity like msiexec commands from browsers, Deno running unusual code, and anomalous PsExec usage.

Throwing a spark into FuelCMS

pentesttools.com · 4 months ago

NULL

Meta’s AI Glasses and Privacy

www.schneier.com · 4 months ago

Meta’s recently released AI glasses present significant privacy concerns. A new Android application has been developed to identify the presence of smart glasses. This technology is expected to be available regardless of public opinion. There are currently no reported CVEs related to this announcement.

ForceMemo Hijacks GitHub Accounts, Backdoors Python Repos

gbhackers.com · 4 months ago

A software supply-chain campaign called ForceMemo is hijacking GitHub accounts and backdooring Python repositories. The attackers leverage stolen developer credentials obtained by the GlassWorm malware, using the Solana blockchain for command-and-control and re-writing git history to conceal malicious code. Compromised repositories include Django apps, ML research projects, and GitHub-installed packages, with hundreds of accounts and repositories affected since March 2026. The malware utilizes a marker variable, lzcdrtfxyqiplpd, which can be searched for on GitHub to identify impacted projects.

Critical Telnetd Vulnerability Enables Remote Code Execution Attacks

gbhackers.com · 4 months ago

A critical vulnerability has been identified in the GNU InetUtils telnetd daemon, tracked as CVE-2026-32746. This buffer overflow allows unauthenticated attackers to execute arbitrary code with root privileges, earning a CVSS score of 9.8. The flaw is triggered by sending a specially crafted message during the initial connection handshake, requiring no user interaction. Due to the widespread use of Telnet in industrial control systems and other legacy environments, this vulnerability poses a significant threat to critical infrastructure.

Researcher Discovers 4th WhatsApp View Once Bypass; Meta Won’t Patch

www.securityweek.com · 4 months ago

A researcher has found a fourth method to bypass WhatsApp’s View Once feature, which allows media to disappear after viewing. This latest bypass involves a modified WhatsApp client application and could potentially be exploited using browser extensions or WhatsApp Web. Meta has decided not to patch the vulnerability, stating it falls outside their security model and is difficult to completely prevent. The researcher suggests implementing a digital rights management system similar to Netflix to address these bypass methods.

BSI moniert Software-Sicherheit im Gesundheitswesen

www.csoonline.com · 4 months ago

German security experts have identified weaknesses in healthcare software, including those used in doctor’s offices, hospitals, and care facilities. Tests of standard configurations revealed that three of four practice management systems were vulnerable to cyberattacks due to issues like outdated encryption algorithms. The vulnerabilities allowed for potential remote attacks, but manufacturers have been notified and addressed the problems. The Federal Office for Information Security urges improvements to protect sensitive patient data.

OpenAI Introduces GPT-5.4 Mini and Nano for Faster, Lightweight AI Performance

gbhackers.com · 4 months ago

false

Product Walkthrough: How Mesh CSMA Reveals and Breaks Attack Paths to Crown Jewels

thehackernews.com · 4 months ago

Security teams are often overwhelmed by disparate security tools and data, struggling to understand how vulnerabilities chain together to create attack paths. Mesh CSMA addresses this by unifying context across existing tools and infrastructure, creating a visual map of potential attack routes to critical assets, known as "Crown Jewels." The platform prioritizes remediation actions and identifies detection gaps, allowing teams to proactively eliminate attack paths and continuously validate their security posture. Mesh CSMA operates independently of specific tools, avoiding vendor lock-in and enabling a more holistic security approach.

The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains) - watchTowr Labs

labs.watchtowr.com · 4 months ago

Security researchers have identified four vulnerabilities in BMC FootPrints, an IT Service Management solution, impacting versions 20.20.02 through 20.24.01.001. These include an authentication bypass, server-side request forgery, and a critical remote code execution flaw stemming from deserialization of untrusted data, with vulnerabilities CVE-2025-71257 and CVE-2025-71260 chained to achieve remote code execution without authentication. The vulnerabilities were exploited by crafting payloads to write a JSP script and enumerate system information. BMC has released hotfixes to address these issues.

Can you prove the person on the other side is real?

www.csoonline.com · 4 months ago

The increasing use of artificial intelligence is enabling sophisticated impersonation attacks, eroding trust in identity verification systems. Attackers are creating synthetic identities, using deepfakes to mimic real individuals, and exploiting dormant or deceased accounts to gain access and redirect assets. Experts suggest moving beyond simple identity verification to focus on establishing the origin and consistency of digital footprints and strengthening internal access controls. Organizations must prioritize continuous verification, accountability, and adversarial testing to protect against these evolving threats and ensure the legitimacy of users.

Iran Cyber Ops Merge With PsyOps and EW Amid Escalating Conflict

gbhackers.com · 4 months ago

Escalating conflict between Iran and US-Israeli forces has led to a new phase of cyber operations integrated with kinetic attacks, electronic warfare, and psychological operations. Iran, facing constraints on its own cyber capabilities, is increasingly relying on distributed denial-of-service attacks, data theft, destructive malware, and hacktivist groups, sometimes outsourcing to underground services like Cosmic Network (V2), SpaceStresser, TheFlashDDOS, and EliteStresser. A pro-Iran group, the Handala Hack Team, recently claimed responsibility for a destructive attack against Stryker, demonstrating a shift towards strategic sabotage, and maritime navigation is experiencing unprecedented GPS spoofing and jamming. Analysts predict a continued focus on ransomware, data-wiping, and intrusions targeting critical infrastructure.

ClickFix treibt neue Infostealer-Kampagnen an

www.csoonline.com · 4 months ago

Cybercriminals are using a technique called ClickFix to distribute new malware by compromising websites and employing social engineering tactics. The campaigns involve presenting visitors with fake Cloudflare CAPTCHA challenges that instruct them to copy and paste commands into the Windows Run dialog or Windows Terminal, which then executes malicious code. Researchers have identified three distinct malware payloads, including a Vidar Stealer variant and two previously undocumented infostealers named Impure Stealer and VodkaStealer, which employ techniques to avoid detection. The ClickFix attacks have increased significantly and are now utilized by both private and state-sponsored threat actors.

Ubuntu Desktop Vulnerability Lets Attackers Escalate Privileges to Full Root Access

gbhackers.com · 4 months ago

A critical vulnerability, tracked as CVE-2026-3888, has been identified in Ubuntu Desktop versions 24.04 and later, allowing local attackers to escalate privileges to full root access. The flaw stems from an interaction between the snap-confine and systemd-tmpfiles utilities, creating a race condition where malicious files can be introduced into snap application sandboxes. Researchers also discovered a secondary vulnerability in the uutils coreutils package involving the rm utility, which has since been resolved. Affected snapd versions include those prior to 2.73+ubuntu24.04.1, 2.73+ubuntu25.10.1, 2.74.1+ubuntu26.04.1, and upstream versions prior to 2.75.

Turing Award Goes to Inventors of Quantum Cryptography

www.nytimes.com · 4 months ago

false

Cybersecurity and privacy priorities for 2026: The legal risk map

www.csoonline.com · 4 months ago

Corporate legal exposure to cybersecurity and privacy disputes is increasing, with nearly four in ten corporate counsel reporting heightened risk in 2025. Rising geopolitical tensions and the increasing sophistication of state-sponsored threat actors, utilizing technologies like AI, are driving these concerns, particularly impacting critical infrastructure. State regulators are intensifying oversight, exemplified by California’s CCPA requiring cybersecurity audits and the emergence of a consortium for coordinated enforcement. Organizations must prioritize third-party risk management and be prepared for potential legal challenges involving whistleblowers and creative litigation.

Microsoft Teams-Based Vishing Attack Tricks Victims Into Quick Assist Takeover

gbhackers.com · 4 months ago

Attackers are increasingly using social engineering tactics to breach corporate networks. A recent incident involved threat actors using voice phishing, or vishing, through Microsoft Teams to trick an employee into granting remote access via Quick Assist. Once access was gained, the attackers stole credentials and installed malware disguised as a Microsoft Installer, establishing a command-and-control connection. Microsoft’s Detection and Response Team quickly contained the breach and prevented further damage.

Vidar Stealer 2.0 Spreads via Fake Game Cheats Shared on GitHub and Reddit

gbhackers.com · 4 months ago

Criminals are using fake game cheats distributed through GitHub and Reddit to spread the Vidar Stealer 2.0 malware, specifically targeting players of popular online games. The scheme involves deceptive download links and imitates legitimate installers to disable security tools and install the stealer. Vidar 2.0 harvests sensitive data like browser credentials, cryptocurrency wallets, and game-related artifacts before exfiltrating it to attacker-controlled servers. This tactic exploits gaming communities, particularly affecting younger users, and reflects a shift in criminal activity following the disruption of other infostealers.

Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

thehackernews.com · 4 months ago

A security vulnerability, tracked as CVE-2026-3888, allows attackers to gain root privileges on Ubuntu Desktop versions 24.04 and later. The flaw results from an interaction between snap-confine and systemd-tmpfiles, requiring a time-based window of 10 to 30 days. An attacker can manipulate system cleanup cycles to execute arbitrary code with root privileges. A separate race condition vulnerability in the uutils coreutils package was also discovered, potentially enabling file deletion as root, but was mitigated before the public release of Ubuntu 25.10.

Boggy Serpens Hits Diplomats, Critical Infrastructure in Espionage Waves

gbhackers.com · 4 months ago

A cyberespionage group known as Boggy Serpens, also called MuddyWater, is escalating its operations targeting diplomats and critical infrastructure. The group uses tactics like compromising trusted accounts and tailoring social engineering lures to bypass security measures. Recent campaigns have focused on sectors like energy, maritime, aviation, telecom, and finance in regions including the Middle East, Europe, and South America. The attackers employ custom tools such as BlackBeard, UDPGangster, and LampoRAT, alongside AI-assisted techniques, to maintain persistent access and exfiltrate data.

New Kubernetes NFS CSI Vulnerability Enables Unauthorized Directory Deletion and Changes

gbhackers.com · 4 months ago

A security flaw has been identified in the Kubernetes Container Storage Interface driver for Network File System, tracked as CVE-2026-3864. The vulnerability allows attackers with specific cluster privileges to delete or modify directories on NFS storage servers by manipulating volume identifiers. This occurs because the driver does not properly validate user-supplied input, allowing path traversal sequences to be injected. Organizations should upgrade to version 4.13.1 or newer and restrict PersistentVolume creation privileges until the patch is applied.

CISOs rethink their data protection strategies

www.csoonline.com · 4 months ago

false

Researchers Disclose ‘RegPwn,’ a Windows Registry Weakness Allowing SYSTEM Access

gbhackers.com · 4 months ago

Researchers have identified a Windows Elevation of Privilege vulnerability, dubbed "RegPwn," allowing low-privileged users to gain SYSTEM access. The flaw arises from how Windows manages registry configurations for Accessibility features, specifically during transitions to the Secure Desktop. Attackers can exploit this by manipulating data transfers between user and SYSTEM registry keys using registry symbolic links, potentially overwriting critical system components. Microsoft has patched this vulnerability, tracked as CVE-2026-24291, and security teams are urged to apply updates.

Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS

thehackernews.com · 4 months ago

Apple has released security updates to address a WebKit vulnerability affecting iOS, iPadOS, and macOS. This cross-origin issue, identified as CVE-2026-20643, could allow malicious web content to bypass security restrictions. The updates improve input validation and are part of Apple's new Background Security Improvements, which allow for smaller, more frequent security patches. This follows recent fixes for a zero-day vulnerability (CVE-2026-20700) and patches for flaws exploited by the Coruna exploit kit.

Fake Telegram Download Site Delivers Stealthy In-Memory Malware Loader

gbhackers.com · 4 months ago

A new malware campaign is distributing a trojanized installer disguised as the official Telegram download through a deceptive website, telegrgam[.]com. The malicious installer avoids detection by dropping a legitimate Telegram installer and modifying Windows Defender settings to exclude system drives. The malware loads and executes payloads in memory, using rundll32.exe to evade detection and establishing a command-and-control connection at 27[.]50[.]59[.]77:18852 associated with jiijua[.]com. The malicious executables include MD5 hashes of A9A5CC6B6766FEC51B281B94F5F17CCD and 62F8EFFC7690455ABCB300E3574F0A93.

FortiClient Hit by Severe SQL Injection Vulnerability Enabling Database Intrusion

gbhackers.com · 4 months ago

A critical security vulnerability, tracked as CVE-2026-21643, has been identified in Fortinet’s FortiClient Enterprise Management Server version 7.4.4. This pre-authentication SQL injection flaw allows unauthenticated attackers to gain complete control over the database by exploiting how the system handles HTTP headers. Attackers can leverage this vulnerability to steal administrative passwords, harvest security certificates, and potentially take over the entire network. Fortinet has released version 7.4.5 to address the issue, and immediate patching is strongly recommended.

AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

gbhackers.com · 4 months ago

A vulnerability has been discovered in the AWS Bedrock AgentCore Code Interpreter that allows attackers to bypass network isolation. This flaw, assigned a CVSSv3 score of 7.5, permits outbound DNS queries which can be exploited to establish command-and-control channels and exfiltrate data. Attackers can use this to execute remote commands and access sensitive data like personally identifiable information and API keys, which traditional security tools may not detect. AWS has not patched the behavior but recommends migrating to VPC Mode and enforcing the principle of least privilege for IAM roles.

Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads

gbhackers.com · 4 months ago

A sophisticated cyber operation, dubbed "Operation Covert Access," is targeting Argentina’s judicial sector through spear-phishing emails. Attackers use realistic-looking court documents as lures, delivered with ZIP archives containing malicious shortcuts, batch files, and PDFs. These components chain together to silently download and execute a Rust-based COVERT RAT, disguised as a Microsoft Edge proxy, from GitHub infrastructure. The RAT employs extensive anti-analysis techniques, establishes a command-and-control channel, and allows for modular payload deployment.

Complex Systems Science theories in Security Engineering

www.securesql.info · 4 months ago

A new security framework called Governed Agency proposes managing security systems as living organisms composed of autonomous agents. This approach shifts the focus from individual code to defining desired outcomes and uses biological principles like homeostasis and immune responses to guide infrastructure design. Key components include cognitive light cones to limit agent influence, a bioelectric code for data sharing, and continuous feedback loops to ensure alignment with organizational goals. The framework aims to create a proactive, self-evolving security system capable of rapid adaptation.

Hardware entropy is a coupled system

amentilabs.com · 4 months ago

false

U.S. Says Anthropic Is an ‘Unacceptable’ National Security Risk

www.nytimes.com · 4 months ago

NULL

AI infrastructure has a networking problem, zero-trust overlays can help

www.defined.net · 4 months ago

false

Apple pushes first Background Security Improvements update to fix WebKit flaw

www.bleepingcomputer.com · 4 months ago

Apple has released a Background Security Improvements update to address a WebKit security flaw. This flaw, tracked as CVE-2026-20643, allows malicious web content to bypass the browser's security policy. The update is available for iPhones, iPads, and Macs and delivers security patches outside of the regular operating system update cycle. Apple introduced this feature to rapidly address vulnerabilities between full software releases.

Hyoketsu - Solving the Vendor Dependency Problem in Reverse Engineering

slcyber.io · 4 months ago

false

SVD-2026-0314: Third-Party Package Updates in Splunk Universal Forwarder - March 2026

advisory.splunk.com · 4 months ago

Splunk has addressed vulnerabilities in Third Party Packages affecting Universal Forwarder versions 10.2.1, 10.0.4, and later. OpenSSL has been updated to versions 1.0.2zo and 3.0.19 to resolve CVE-2026-22796, CVE-2025-15467, and CVE-2026-22795. Users are advised to upgrade to version 10.2.1, 10.0.4, or a higher version. Splunk has used the vendor’s severity rating or the National Vulnerability Database common vulnerability scoring system to determine severity.

Operationalizing Mandiant's Attack Lifecycle, the Kill Chain, Mitre's ATT&CK, and the Diamond Model with Practical Examples

www.magonia.io · 4 months ago

Cybersecurity professionals are encouraged to combine multiple frameworks for improved incident response and threat intelligence. Combining Mandiant’s Attack Lifecycle, MITRE ATT&CK, and the Diamond Model provides a practical, layered approach, particularly for retrospective analysis. The Diamond Model helps provide context by breaking down intrusions into adversary, infrastructure, capability, and victim facets. This combination allows for turning incidents into actionable intelligence and anticipating future threats.