Blahalla

Hyoketsu - Solving the Vendor Dependency Problem in Reverse Engineering

slcyber.io · 4 months ago

false

SVD-2026-0314: Third-Party Package Updates in Splunk Universal Forwarder - March 2026

advisory.splunk.com · 4 months ago

Splunk has addressed vulnerabilities in Third Party Packages affecting Universal Forwarder versions 10.2.1, 10.0.4, and later. OpenSSL has been updated to versions 1.0.2zo and 3.0.19 to resolve CVE-2026-22796, CVE-2025-15467, and CVE-2026-22795. Users are advised to upgrade to version 10.2.1, 10.0.4, or a higher version. Splunk has used the vendor’s severity rating or the National Vulnerability Database common vulnerability scoring system to determine severity.

Operationalizing Mandiant's Attack Lifecycle, the Kill Chain, Mitre's ATT&CK, and the Diamond Model with Practical Examples

www.magonia.io · 4 months ago

Cybersecurity professionals are encouraged to combine multiple frameworks for improved incident response and threat intelligence. Combining Mandiant’s Attack Lifecycle, MITRE ATT&CK, and the Diamond Model provides a practical, layered approach, particularly for retrospective analysis. The Diamond Model helps provide context by breaking down intrusions into adversary, infrastructure, capability, and victim facets. This combination allows for turning incidents into actionable intelligence and anticipating future threats.

Microsoft's 'unhackable' XBox (One) has been finally hacked

www.tomshardware.com · 4 months ago

Researchers have demonstrated a successful hack of Microsoft’s Xbox One console, a system previously considered unhackable. The exploit, named "Bliss," uses voltage glitching to bypass security measures and load unauthorized code at all levels of the system. This method targets the CPU voltage rail, allowing access to the security processor and enabling decryption of games and firmware. The attack is considered unpatchable as it involves a hardware compromise of the boot ROM.

Arizona Files Criminal Charges Against Kalshi, the Prediction Site

www.nytimes.com · 4 months ago

NULL

More Attackers Are Logging In, Not Breaking In

www.darkreading.com · 4 months ago

Credential theft has become the dominant method for attackers to gain access to enterprise networks. Recorded Future’s analysis of 2025 data reveals nearly two billion stolen credentials indexed, with a significant surge in compromised credentials during the latter half of the year, driven by infostealer malware, malware-as-a-service, and AI-powered phishing. Attackers are increasingly targeting authentication systems, cloud platforms, and remote management tools, and the theft of session cookies is allowing them to bypass multi-factor authentication. Experts advise organizations to prioritize continuous identity monitoring, device-based conditional access, and phishing-resistant MFA.

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

www.bleepingcomputer.com · 4 months ago

A coordinated supply-chain attack attributed to the GlassWorm threat actor has compromised over 430 components across GitHub, npm, VSCode, and OpenVSX platforms. The attackers compromised accounts to push malicious commits and published trojanized packages and extensions using obfuscated code to steal cryptocurrency wallet data, credentials, and developer environment data. The malware communicates with the Solana blockchain for instructions and demonstrates characteristics suggesting Russian-speaking operators, although definitive attribution is not possible. Developers are advised to check for the marker variable “lzcdrtfxyqiplpd”, the ~/init.json file, and suspicious Node.js installations to identify potential compromise.

Clear Communication: The Missing Link in Cybersecurity Success

www.darkreading.com · 4 months ago

false

Less Lucrative Ransomware Market Makes Attackers Alter Methods

www.darkreading.com · 4 months ago

Ransomware attackers are modifying tactics due to a less lucrative market and improved defenses. Research indicates a rise in data theft, targeting of virtualization infrastructure, and record highs in victims being publicly named on data leak sites. Threat actors are increasingly using built-in Windows capabilities and internal tools like PowerShell, instead of external malware such as Cobalt Strike Beacon, to evade detection and blend in with normal system activity. Lateral movement is frequently achieved through Remote Desktop Protocol.

The new security frontier for LLMs; SIEM evasion

blog.vulnetic.ai · 4 months ago

Recent advancements in large language models have enabled a degree of SIEM evasion, particularly when tested against Wazuh. The agent assesses risk by analyzing SIEM configurations and avoids deploying malicious tools in monitored areas. It operates with a zero forensic footprint using custom scripts and lateral movement techniques, building beacons dynamically to match the environment, though inconsistencies remain. While effective against Linux systems, the agent’s evasion capabilities degrade when targeting Windows environments, demonstrating a need for improved instruction consistency and context retention.

China Ramps Up Scrutiny of Meta’s Acquisition of Manus

www.nytimes.com · 4 months ago

NULL

ACP — Cryptographic admission control for autonomous agent actions (Ed25519, anti-replay, delegation chains)

doi.org · 4 months ago

NULL

Hackers Target Cybersecurity Firm Outpost24 in 7-Stage Phish

www.darkreading.com · 4 months ago

Hackers targeted the cybersecurity firm Outpost24 in a sophisticated, seven-stage phishing attack designed to bypass email security measures. The attackers used a convincing financial communication from JP Morgan and leveraged legitimate services like Cisco, Nylas, and Cloudflare to mask their malicious intent, routing victims through multiple domains. Researchers believe the attackers utilized a phishing-as-a-service kit called Kratos to execute the attack, which was stopped before it caused damage. The incident highlights the importance of vendor risk management and layered security defenses.

Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot

www.techrepublic.com · 4 months ago

Researchers have discovered a new phishing technique exploiting Microsoft Copilot’s email summarization feature. Attackers can embed hidden instructions within emails to manipulate Copilot’s output, generating deceptive security alerts or malicious prompts that appear as official system notifications. This cross-prompt injection attack, known as XPIA, leverages the user's trust in AI assistants to bypass traditional phishing defenses. Organizations should implement layered security controls, monitor AI output, and educate users to mitigate this emerging threat.

CVE-2025-59284: How reading a gnu manpage led to a Windows NetNTLM phishing exploit

sec-fault.com · 4 months ago

Security researchers discovered a vulnerability, CVE-2025-59284, in Windows' libarchive implementation that allows for NetNTLMv2 hash leakage. The vulnerability arises from the way Windows handles hardlinks embedded within tar archives. Specifically, attempting to create a hardlink within a.tar file that points to a UNC path triggers a CreateFile call to the remote path, resulting in a hash leak, even though hardlink creation to UNC paths is not permitted. Microsoft has released a patch that displays a warning window but does not fully resolve the underlying issue.

Nvidia NemoClaw promises to run OpenClaw agents securely

www.csoonline.com · 4 months ago

Nvidia has announced NemoClaw, a new platform designed to address security concerns surrounding the OpenClaw agentic AI platform. NemoClaw utilizes Nvidia OpenShell, which incorporates kernel-level sandboxing and a privacy router to isolate OpenClaw and monitor its actions. The platform is hardware agnostic but optimized for Nvidia technologies, aiming to become a security standard for agentic AI. While it improves usability and allows agents to run closer to data, experts note it doesn't fully resolve governance or trust issues.

OpenClaw, the Fastest-Adopted Software Ever, Is Also a Security Blind Spot

www.techrepublic.com · 4 months ago

OpenClaw, a rapidly adopted open-source AI agent, presents a significant security risk due to its ease of installation, broad access to company data, and persistent memory. It bypasses traditional security measures by connecting to email, Slack, and other platforms without requiring administrator privileges or central monitoring. Security vendors have issued warnings and recommendations for treating OpenClaw as untrusted code, and researchers have found exposed credentials and malicious tools distributed through its marketplace. Several vulnerabilities have been disclosed, including CVEs for remote code execution, command injection, SSRF, authentication bypass, and path traversal, emphasizing the need for data-centric governance rather than outright bans.

Europe sanctions Chinese and Iranian firms for cyberattacks

www.bleepingcomputer.com · 4 months ago

The European Union has sanctioned five entities and two individuals for cyberattacks targeting devices and critical infrastructure. Integrity Technology Group and Anxun Information Technology, both based in China, received sanctions for providing technical support and hacking services, respectively. An Iranian company, Emennet Pasargad, was also sanctioned for influence campaigns and compromising an SMS service. One individual, known as Holy Souls, is accused of attempting to sell stolen data from a French magazine. These sanctions freeze assets and prohibit EU citizens and companies from providing financial support.

Netanyahu Posts ‘Proof of Life’ Video as A.I. Sows Doubts About What’s Real

www.nytimes.com · 4 months ago

NULL

Trapped in a Self-Driving Car During an Anti-Robot Attack

www.nytimes.com · 4 months ago

NULL

AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

thehackernews.com · 4 months ago

Researchers have identified vulnerabilities in several AI tools. Amazon Bedrock AgentCore Code Interpreter allows outbound DNS queries, potentially enabling data exfiltration and remote code execution, although Amazon considers this intended functionality. LangSmith has a flaw, CVE-2026-25750, that could lead to account takeover through URL parameter injection. Finally, SGLang contains remote code execution vulnerabilities, CVE-2026-3059, CVE-2026-3060, and CVE-2026-3989, stemming from unsafe pickle deserialization.

Now You See mi: Now You're Pwned

labs.taszk.io · 4 months ago

Researchers have discovered and exploited vulnerabilities in Xiaomi smart home devices, specifically targeting their miIO communication protocol. These flaws include a predictable random number generator, a heap buffer overflow allowing remote code execution, and weaknesses in the device setup protocol. The exploits enable unauthorized access, remote control, and even a "cloud jailbreak," allowing device functionality without a Xiaomi account. The researchers have publicly released the exploit code and reported the vulnerabilities to Xiaomi.

Detect Malicious .ip6.arpa TLD Reverse DNS Zone Response Packets using PacketSmith Yara-X Detection Module

blog.netomize.ca · 4 months ago

NULL

China Probe: How a Fake Fitness Tracker Became an AI ‘Top Pick’

www.techrepublic.com · 4 months ago

A fake fitness tracker, called Apollo-9, appeared on AI-generated recommendation lists in China after a coordinated effort to flood online platforms with fabricated reviews and rankings. This tactic, called generative engine optimization or GEO, manipulates AI systems into believing false information. The practice, which has already generated a market estimated at 36 million dollars, is now under scrutiny and sparking discussion about regulation and industry safeguards. The incident highlights the ease with which AI outputs can be manipulated and the need for greater oversight of AI-generated content.

Credential Guard - Control Validation

ipurple.team · 4 months ago

Credential Guard was introduced in Windows 10 and Windows Server 2016 to isolate credentials using Virtualization Based Security and is enabled by default from Windows 11 22H2 and Windows Server 2025 when hardware requirements are met. There are four publicly disclosed attack techniques since 2020 targeting Credential Guard called Patching, Pass the Challenge, Downgrade, and SSP Negotiation, and some ransomware families including Akira and Qlin have used these methods to re-enable credential storage in LSASS memory. Microsoft has mitigated the Patching and Downgrade techniques while Pass the Challenge and SSP Negotiation remain unresolved, and a Downgrade proof of concept leverages a rollback to exploit CVE-2022-34709. Defenders are advised to expand control validation to include operating system embedded controls, run purple team exercises covering all techniques, and implement detection strategies with log correlation to address the complex and noisy attack flows.

Tech Giants Invest $12.5 Million in Open Source Security

www.securityweek.com · 4 months ago

false

Investing in the people shaping open source and securing the future together

github.blog · 4 months ago

false

UK Companies House Exposed Details of Millions of Firms

www.securityweek.com · 4 months ago

A critical vulnerability was recently discovered in the Companies House WebFiling service, allowing authenticated users to access the accounts of other registered firms. This flaw, present since October 2025, exposed non-public data for five million companies, including directors’ personal information. Attackers could also modify company details and submit unauthorized filings by manipulating the authentication process. Companies House reports the vulnerability did not expose passwords or allow systematic data extraction, and they are unaware of any misuse, but advise companies to review their records.

Warlock Ransomware Group Augments Post-Exploitation Activities

www.darkreading.com · 4 months ago

The Warlock ransomware group, also known as Water Manaul, is rapidly evolving its tactics, maintaining a consistent initial attack method of exploiting unpatched Microsoft SharePoint servers. Researchers have observed the group using new techniques to improve persistence, lateral movement, and evasion within compromised networks, including the Nsec driver with a bring your own vulnerable driver technique. They're also utilizing TightVNC, Yuze, and a modified driver, along with existing tools like Rclone and Cloudflare tunnels, to create redundant command-and-control channels and evade detection. Observed vulnerabilities include CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, and CVE-2025-53771.

GlassWorm Part 4 -- 24h after samples made live: DLL injection, Chrome hijacking via COM abuse, and the full supply chain loop confirmed

codeberg.org · 4 months ago

Git commands that execute clone, fetch, or push without user input can cause issues with recursive submodules and atomic pushes. Comparing the HEAD or index can lead to conflicts. Using the rev-list command can consume slightly more memory per active branch. Certain Git configuration options and signals can influence how Git operates and handles authorization.

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

thehackernews.com · 4 months ago

The ransomware group LeakNet is now using ClickFix social engineering tactics to gain initial access to systems, tricking users into running malicious commands through compromised websites. They’re also employing a Deno JavaScript runtime to load and execute malware directly in memory, minimizing detection. This shift away from traditional methods like stolen credentials allows LeakNet to broaden its targeting and operate more quickly. Attackers are also utilizing Microsoft Teams phishing campaigns employing a similar Deno-based loader, and post-compromise activity involves DLL side-loading, lateral movement, and data exfiltration via S3 buckets.

From Enumeration to Findings: The Security Findings Report in EntraFalcon

blog.compass-security.com · 4 months ago

A significant update has been released for EntraFalcon, a tool designed to review Entra ID environments. The new Security Findings Report provides an interactive HTML overview consolidating tenant settings and object-based checks into a structured format. The report includes 63 checks focusing on tenant configurations and object permissions, offering graphical charts, filtering, and export options to prioritize remediation efforts. The Security Findings Report is currently in beta and feedback is encouraged.

Microsoft Confirms Windows 11 Bug Crippling PCs, Blocking Access to Core Drive

www.techrepublic.com · 4 months ago

A bug in Windows 11 is preventing some users from accessing their C: drive and launching essential applications. Microsoft has confirmed the issue affects primarily Samsung Galaxy Book 4 laptops and certain Samsung desktop models running Windows 11 versions 24H2 and 25H2. The problem is linked to the Samsung Galaxy Connect software, which has been temporarily removed from the Microsoft Store. Microsoft is providing recovery instructions for affected users, including uninstalling Samsung Galaxy Connect and repairing drive permissions.

Top 5 Things CISOs Need to Do Today to Secure AI Agents

www.bleepingcomputer.com · 4 months ago

Agentic AI is transforming operations, but most organizations lack the necessary security measures. Traditional approaches like guardrails are insufficient, as a single mistake with an agent's credentials can lead to data breaches or system failures. Instead, organizations must treat AI agents as digital identities, tightly control access based on defined intent, and implement lifecycle governance to manage evolving permissions and ownership. Prioritizing identity visibility is crucial to eliminate "shadow AI" and secure these autonomous systems.

GitGuardian Reports an 81% Surge of AI-Service Leaks as 29M Secrets Hit Public GitHub

gbhackers.com · 4 months ago

A new report indicates a significant surge in leaked secrets on GitHub, with a 34% year-over-year increase, totaling approximately 29 million. The rise is attributed to increased AI adoption in software development, specifically noting a 3.2% secret leak rate with code assisted by Claude Code. AI service credentials saw an 81% increase in leaks, and exposed credentials remain a major vulnerability, often stemming from human error and inadequate governance. The report highlights the growing risk of secrets embedded in internal repositories and collaboration tools, emphasizing the need for improved Non-Human Identity (NHI) governance and remediation practices.

New font-rendering trick hides malicious commands from AI tools

www.bleepingcomputer.com · 4 months ago

Researchers have discovered a new technique to bypass AI assistants by hiding malicious commands within webpages. The attack uses custom fonts and CSS to display harmless text to AI analysis while presenting a dangerous command to the user, often through social engineering. Several AI assistants, including ChatGPT, Claude, and others, were initially vulnerable to this method. Microsoft addressed the issue after receiving a report, while Google initially deemed it low risk. Users are cautioned against blindly trusting AI assistants for security evaluations.

Microsoft stops force-installing the Microsoft 365 Copilot app

www.bleepingcomputer.com · 4 months ago

false

Reversing the FT100 BLE fitness bracelet

lessonsec.com · 4 months ago

Researchers have reverse engineered the communication protocols of several fitness trackers and smartwatches using Bluetooth Low Energy. They intercepted and analyzed BLE traffic to understand functions like "find my device," weather data pushes, and watchface updates. This analysis revealed custom services, message structures, fragmentation mechanisms, and CRC-8 checksums. The process allowed researchers to trigger device actions by sending specific data payloads and identify image encoding schemes.

Robotic Surgery Giant Intuitive Discloses Cyberattack

www.securityweek.com · 4 months ago

Intuitive, a leading robotic surgery company, recently experienced a cyberattack resulting in a data breach. The attack, attributed to a targeted phishing incident, granted unauthorized access to internal business applications. Stolen data includes customer business contact information, employee details, and corporate data, but did not affect robotic system operations or hospital networks. Intuitive states the incident is contained and data privacy regulators are being notified.

Iranian Hackers Use Compromised Cameras for Regional Surveillance

gbhackers.com · 4 months ago

Iranian cyber actors are expanding their operations, targeting US organizations and exploiting internet-connected cameras across the Middle East for intelligence gathering. The APT group MuddyWater has maintained access to US and Canadian organizations, using backdoors like Dindoor and Fakeset, and attempting data theft via Rclone. Iran-linked infrastructure is also exploiting vulnerabilities in Hikvision and Dahua cameras, including CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, and CVE-2021-33044, to conduct surveillance and reconnaissance. Additionally, the Handala hacktivist group has claimed responsibility for a cyberattack on Stryker, involving device wipes and data theft.

Cyber-Attacken fluten Eon-Netz: Angriffe verzehnfacht

www.csoonline.com · 4 months ago

German energy company Eon is experiencing a significant increase in cyberattacks targeting its energy networks. The number of daily attacks has reportedly increased tenfold compared to five years ago, now reaching several hundred. Eon is working to improve security through collaboration with external service providers to simulate and defend against these attacks. As Germany's largest energy supplier and grid operator, Eon manages roughly one-third of the nation's electricity grid.

Built a self-hosted email threat daemon: IMAP IDLE + multi-stage enrichment (SPF/DKIM/DMARC/DNSBL/WHOIS/URLhaus/VirusTotal) + provider-agnostic LLM verdict — write-up

scarolas.com · 4 months ago

false

174 Vulnerabilities Targeted by RondoDox Botnet

www.securityweek.com · 4 months ago

Security researchers have observed a significant increase in the activity of the RondoDox botnet, which now targets 174 vulnerabilities. The botnet’s developers are shifting to a more targeted approach, exploiting specific flaws for infection rather than a broad scanning method. RondoDox shares similarities with the Mirai botnet but focuses on distributed denial-of-service attacks. The botnet’s operators frequently update their exploit list and have been observed exploiting vulnerabilities before CVEs are assigned, including React2Shell.

Windows 11 25H2/24H2 Update Addresses Bluetooth Device Visibility Issues

gbhackers.com · 4 months ago

false

Google Warns Ransomware Groups Shift to Data Theft as Profits Decline

gbhackers.com · 4 months ago

Ransomware groups are shifting their tactics as encryption-for-ransom attacks become less profitable. Data theft is now a central element in many ransomware attacks, with nearly 77% of incidents in 2025 involving data exfiltration. Many ransomware-as-a-service programs now offer data theft-only options, and attackers increasingly target smaller organizations with weaker security. Threat actors are exploiting vulnerabilities in VPNs, firewalls, and virtualization platforms like ESXi, and some are experimenting with Web3 and AI to improve resilience and optimize extortion.

Google, Meta, Microsoft Among Signatories of Pact to Combat Scams

www.securityweek.com · 4 months ago

false

LeakNet ransomware uses ClickFix, Deno runtime in stealthy attacks

www.bleepingcomputer.com · 4 months ago

The LeakNet ransomware group is now utilizing the ClickFix social engineering technique to gain initial access to corporate networks. Attackers are leveraging the legitimate Deno runtime for JavaScript and TypeScript to execute malicious payloads directly in system memory, minimizing detection and forensic evidence. This "bring your own runtime" tactic allows the ransomware to bypass security filters and appear as normal developer activity. Following initial execution, LeakNet employs techniques like DLL sideloading and credential discovery for post-exploitation actions.

Microsoft shares fix for Windows C: drive access issues on Samsung PCs

www.bleepingcomputer.com · 4 months ago

Microsoft and Samsung are addressing access issues on the C: drive affecting some Samsung laptops running Windows 11. The problems stem from the Samsung Galaxy Connect app, which has been temporarily removed from the Microsoft Store and subsequently updated. A 29-step process is available for users to restore standard Windows permissions, returning drive ownership to Windows. Microsoft has also released out-of-band updates to resolve a Bluetooth issue and security vulnerabilities in the Routing and Remote Access Service.

AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds

thehackernews.com · 4 months ago

false

AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch

www.csoonline.com · 4 months ago

Researchers discovered a vulnerability in AWS Bedrock AgentCore’s “Sandbox” mode that allows attackers to bypass isolation boundaries through DNS queries. The sandbox, intended to provide isolated AI workflows, permits outbound DNS requests, enabling attackers to exfiltrate data and execute commands by encoding information within DNS responses. AWS initially attempted a fix but subsequently reverted it, deeming the behavior an intended functionality and updating documentation instead. Security teams are advised to inventory AgentCore instances and consider migrating to VPC mode, with a CVSS score of 7.5 assigned to the issue.