Blahalla

Mobile spyware campaign impersonates Israel's Red Alert rocket warning system

www.acronis.com · 4 months ago

A cyber campaign is exploiting geopolitical tensions by distributing a fake version of Israel's Red Alert rocket warning app. Attackers use SMS messages to trick users into installing the malicious application, which steals sensitive data including contacts, SMS messages, location, and device account information. The malware bypasses Android security measures and uses techniques to hide its presence. Users are advised to verify SMS senders, check app permissions, and only install applications from trusted sources.

'InstallFix' Attacks Spread Fake Claude Code Sites

www.darkreading.com · 4 months ago

Cybercriminals are using a technique called InstallFix to distribute the Amatera Stealer malware by creating fake installation pages for Anthropic's Claude Code and other AI coding tools. Malicious actors use Google-sponsored links to lure users into copying and pasting fraudulent install commands, which then deploy the malware, potentially compromising developer credentials and enterprise environments. This tactic exploits the common practice of directly executing commands from websites, and attackers are leveraging the rapid adoption of AI tools to target a broader, less security-conscious audience. Researchers caution users to verify the authenticity of command sources before execution to avoid potential compromise.

Anthropic sues Pentagon over national security risk label

www.washingtonpost.com · 4 months ago

Anthropic has filed a lawsuit against the Trump administration. The lawsuit challenges a government order that prevents military contractors from working with the AI company. The order was issued after President Trump directed agencies to cease using Anthropic’s chatbot, Claude, due to concerns about its potential use in warfare. Anthropic claims the order is unlawful and seeks a federal judge's intervention.

Are We Ready for Auto Remediation With Agentic AI?

www.darkreading.com · 4 months ago

false

Ericsson US discloses data breach after service provider hack

www.bleepingcomputer.com · 4 months ago

Ericsson US recently disclosed a data breach impacting an undisclosed number of employees and customers. Attackers accessed a service provider who stored personal data for Ericsson, with unauthorized access occurring between April 17 and April 22, 2025. The exposed information includes names, addresses, Social Security Numbers, and financial and medical information. Affected individuals in Texas number 4,377 and are being offered free identity protection services.

Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credentials

thehackernews.com · 4 months ago

A malicious npm package disguised as an OpenClaw installer, named "@openclaw-ai/openclawai," has been discovered on the npm registry. The package uses social engineering tactics, including a fake command-line interface and iCloud Keychain prompt, to steal sensitive data such as macOS Keychain databases, browser data, cryptocurrency wallet information, and developer credentials. It then establishes a persistent remote access trojan, enabling attackers to control the compromised system and exfiltrate data through various channels including Telegram and GoFile.io. The package also monitors clipboard content for sensitive information and clones browser sessions to maintain authenticated access.

CVE program funding secured, easing fears of repeat crisis

www.csoonline.com · 4 months ago

A funding crisis that threatened the Common Vulnerabilities and Exposures Program, a cornerstone of cybersecurity, has been resolved. The Cybersecurity and Infrastructure Security Agency and MITRE Corporation have renegotiated the contract, moving it to a protected funding line within CISA’s budget. This shift elevates the program from a discretionary item to a core operational program, addressing concerns about transparency and long-term stability. While the contract details remain largely undisclosed, CISA is committing to modernization and international partnerships, prompting discussions about alternative systems and governance models.

Microsoft Teams will tag third-party bots trying to join meetings

www.bleepingcomputer.com · 4 months ago

false

ShinyHunters claims ongoing Salesforce Aura data theft attacks

www.bleepingcomputer.com · 4 months ago

Salesforce customers are facing data theft attacks targeting misconfigured Experience Cloud platforms. Hackers are exploiting vulnerabilities in guest user access controls to query sensitive data without authentication. The extortion gang ShinyHunters claims responsibility for compromising hundreds of organizations, including many in the cybersecurity sector, beginning in September of 2025, and has modified an open-source auditing tool, AuraInspector, for reconnaissance. Salesforce recommends customers audit guest user permissions, disable guest access to public APIs, and monitor logs for unusual activity.

Cybersecurity M&A Roundup: 42 Deals Announced in February 2026

www.securityweek.com · 4 months ago

false

Built an Automated SOC Pipeline That Thinks for Itself, AI-Powered Multi-Pass Threat Hunting using Analyzers

aradhyacp.in · 4 months ago

false

Security Risk Advisors Releases “The Purple Perspective 2026” Report

gbhackers.com · 4 months ago

false

FBI warns of phishing attacks impersonating US city, county officials

www.bleepingcomputer.com · 4 months ago

The Federal Bureau of Investigation is alerting businesses and individuals to phishing attacks where criminals impersonate city and county planning officials. These scams target those with pending land-use permits, requesting payment of fraudulent fees through wire transfer, peer-to-peer payments, or cryptocurrency. The FBI advises verifying the legitimacy of messages by checking email domains and contacting government offices directly. Previously, the FBI has warned of impersonations of government officials, IC3 employees, and the use of AI-generated audio in voice phishing attacks.

Anthropic Sues Pentagon Over ‘Supply Chain Risk’ Label

www.nytimes.com · 4 months ago

false

UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File to Work Device

thehackernews.com · 4 months ago

A North Korean threat actor, tracked as UNC4899, targeted a cryptocurrency organization in 2025, resulting in millions of dollars in cryptocurrency theft. The attack began with social engineering, tricking a developer into transferring a malicious file to their work device via AirDrop. Attackers then exploited DevOps workflows, compromised a bastion host, and employed living-off-the-cloud techniques to escalate privileges, steal credentials, and manipulate customer accounts to facilitate the theft. Google recommends organizations strengthen identity validation, restrict data transfers, and enhance cloud environment isolation to mitigate similar risks.

The Former Coal Miner in the Middle of the A.I. Data Center Boom

www.nytimes.com · 4 months ago

false

Why Password Audits Miss the Accounts Attackers Actually Want

www.bleepingcomputer.com · 4 months ago

Password audits often miss critical security risks by focusing solely on password complexity and expiry policies. Attackers frequently target over-privileged users, forgotten accounts, service accounts, and credentials already exposed in breaches, which traditional audits fail to identify. To improve security, audits should incorporate breached password screening, prioritize high-value accounts, include dormant and service accounts, and employ continuous monitoring. Solutions like Specops Password Policy and Specops Password Auditor can assist with these enhanced auditing processes.

Microsoft still working to fix Windows Explorer white flashes

www.bleepingcomputer.com · 4 months ago

false

Using cookies to hack into a tech college's admission system

eaton-works.com · 4 months ago

A vulnerability at the Sri Krishna College of Engineering and Technology in India allowed unauthorized access to student admission data. The college’s admission system, SparK, lacked authentication on its APIs, enabling an attacker to manually insert a cookie and gain access to 4,110 student records. Exposed information included names, addresses, Aadhaar numbers, medical details, grades, income levels, and sensitive documents, impacting both students and their parents. The vulnerability was resolved by the college within a week, with confirmation received by India’s Computer Emergency Response Team.

⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware

thehackernews.com · 4 months ago

There were multiple high-profile incidents this week including the law enforcement and industry takedown of the Tycoon2FA service and LeakBase, the discovery of a Qualcomm graphics buffer over-read tracked as CVE-2026-21385 being exploited in the wild, and Google's disclosure of the Coruna iOS exploit kit that uses five full exploit chains and 23 exploits against iOS 13.0 through 17.2.1. The report flags trending vulnerabilities that organizations should prioritize patching, naming CVE-2026-2796 for Firefox alongside other notable entries such as CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 for AWS-LC and CVE-2026-28289 for Mail2Shell. Researchers also detailed the AirSnitch technique that can bypass Wi-Fi client isolation and warned of AI-assisted vibeware used by Transparent Tribe to generate polyglot binaries for targeted attacks. While defenders achieved meaningful takedowns, the coverage warns the cybercrime ecosystem adapts quickly and urges immediate patching and heightened vigilance.

Unpinched - Instant point-in-time detection of PinchTab and agentic browser bridge artifacts.

helixar.ai · 4 months ago

Helixar Labs has released several open-source AI security tools to help teams secure Model Context Protocol deployments. The MCP Security Checklist provides structured security controls across seven domains, while Sentinel is a CLI scanner for identifying misconfigurations in MCP server infrastructure. Additionally, Unpinched is a tool for detecting PinchTab artifacts. Future projects include Kubernetes manifest scanning and agent behavioral baselining toolkits, and these tools are provided as-is with no guarantee of complete coverage.

Fake CleanMyMac Site Spreads SHub Stealer, Targets Crypto Wallets

gbhackers.com · 4 months ago

Hackers are using a fake CleanMyMac website to distribute the SHub Stealer, an infostealer that targets cryptocurrency wallets and sensitive data on macOS devices. The attack involves tricking users into pasting a command into Terminal that downloads and executes a malicious script, bypassing standard security protections. SHub steals data from numerous browsers and crypto wallets, including Exodus, Atomic Wallet, Ledger Live, and Trezor Suite, and also installs persistent backdoors within those wallet applications. The malware communicates with a command-and-control server at res2erch-sl0ut[.]com and uses a builder field called BUILDNAME to track victims.

InferShield v1.0 – Zero-Custody OAuth Proxy: Client-Side Token Encryption for AI Workflows

blog.infershield.io · 4 months ago

false

ClickFix Attack Uses Windows Terminal to Evade Detection

www.securityweek.com · 4 months ago

A new ClickFix attack is evading detection by instructing users to utilize Windows Terminal instead of the traditional Run dialog. Attackers are guiding victims to open Windows Terminal directly, bypassing protections and creating a more trustworthy appearance. This technique leads to the execution of malicious PowerShell commands, often resulting in Lumma Stealer infections or, in some cases, batch scripts that harvest sensitive data from web browsers. A related attack, InstallFix, uses cloned websites to deliver malicious commands and also leads to information-stealer infections.

BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data

gbhackers.com · 4 months ago

A new malware campaign, BoryptGrab, is using fake GitHub repositories disguised as free tools and utilities to infect Windows systems. The malware steals browser data, cryptocurrency wallet information, system details, Telegram data, and Discord tokens. Attackers use layered downloaders and multiple techniques, including DLL side-loading, VBS/PowerShell scripts, and Golang-based downloaders, to deliver the payload, which can also include Vidar stealer variants and a backdoor called TunnesshClient. The campaign is ongoing and actively evolving, with evidence suggesting a Russian-speaking threat actor is behind the operation.

Internet Infrastructure TLD .arpa Abused in Phishing Attacks

www.securityweek.com · 4 months ago

Cybercriminals are exploiting the internet’s infrastructure TLD.arpa to conduct phishing attacks. Attackers are gaining control of.arpa domains and creating A records to serve malicious content, impersonating major brands and hiding the true domain names from victims. The attacks have involved hijacking Canonical Name records from legitimate organizations and using them in phishing emails. Cloudflare and Hurricane Electric were among the DNS providers where this vulnerability was exploited, with the activity observed since September 2025.

Chinese Cyber Threat Lurks In Critical Asian Sectors for Years

www.darkreading.com · 4 months ago

A Chinese-speaking threat actor, identified as CL-UNK-1068, has been conducting cyberespionage attacks against critical infrastructure sectors across Asia since 2020. The group uses a combination of custom malware, open-source tools, and living-off-the-land techniques on both Windows and Linux systems to steal credentials and exfiltrate sensitive data. Their tactics include deploying Web shells like GodZilla and AntSword, along with tools like Mimikatz and ScanPortPlus. Security experts recommend monitoring for behavioral anomalies, misuse of legitimate Python binaries, and unauthorized tunneling tools to detect and defend against this threat.

Iran-Linked Hackers Target U.S. Critical Infrastructure Amid Rising Cyber Threats

gbhackers.com · 4 months ago

Iran-linked hackers, specifically the group Seedworm, are intensifying cyber operations against U.S. and Israeli networks amid regional conflict. They've compromised a U.S. bank, an airport, non-profits, and a software supplier, deploying new backdoors like Dindoor, which uses the Deno runtime, and Fakeset. The attackers attempted data exfiltration using Rclone to Wasabi cloud storage and have used certificates associated with "Amy Cherne" and "Donald Gay" to sign malicious code. Security experts advise heightened vigilance for DDoS attacks, web exploitation attempts, and unusual activity involving tools like Rclone and Deno.

Cyber Espionage Group CL-UNK-1068 Linked to China Targets Asian Infrastructure

gbhackers.com · 4 months ago

A sophisticated cyber espionage group, CL-UNK-1068, originating from China, has been targeting critical infrastructure in Asia since 2020. The group utilizes a mix of web shells like GodZilla and AntSword, custom tools like ScanPortPlus, and living-off-the-land techniques, including DLL side-loading with Python executables, to compromise Windows and Linux systems. They employ a modified Fast Reverse Proxy with Chinese identifiers and the Xnote backdoor for DDoS attacks, focusing on credential theft and data exfiltration. Mitigation strategies include behavioral monitoring, network defense, endpoint security, firewall protection, and vulnerability management.

OpenAI says Codex Security found 11,000 high-impact bugs in a month

www.csoonline.com · 4 months ago

OpenAI has developed a new AI-powered AppSec tool called Codex Security. During initial testing, it identified over 11,000 high-severity and critical flaws across more than a million code commits. The tool operates like a security researcher, mapping attack paths and suggesting fixes to reduce alert fatigue for security teams. Vulnerabilities were found in both proprietary and open-source projects like OpenSSH, GnuTLS, and Chromium, resulting in 14 assigned CVEs. OpenAI plans to expand access to Codex Security and support open-source maintainers through a new initiative.

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign

www.securityweek.com · 4 months ago

A new malware campaign called InstallFix is using cloned webpages of popular development tools to distribute information-stealing malware. Threat actors are using malvertising and Google Ads to direct victims to these fake installation pages, which contain malicious code disguised as legitimate installers. The cloned pages are designed to be nearly identical to the real ones, making them difficult to distinguish. Once executed, the malicious code installs an Amatera Stealer, and threat actors are leveraging legitimate services like Cloudflare Pages to host their content.

Vaultwarden Vulnerabilities Enable Privilege Escalation and Data Exposure

gbhackers.com · 4 months ago

Two high-severity vulnerabilities have been identified in Vaultwarden, affecting version 1.35.3 and requiring immediate patching to version 1.35.4. The first vulnerability, CVE-2026-27803, allows Manager accounts to bypass authorization controls and manipulate password collections. The second vulnerability, CVE-2026-27802, enables privilege escalation through the bulk-access API, granting unauthorized access to restricted collections. Both flaws are network-based, require no user interaction, and pose significant risks to data confidentiality, integrity, and availability.

Apache ZooKeeper Flaw Exposes Sensitive Data to Attackers

gbhackers.com · 4 months ago

Apache ZooKeeper users should immediately update their software to address two critical security vulnerabilities. CVE-2026-24308 involves the unintentional logging of sensitive configuration data in plain text, while CVE-2026-24281 allows attackers to bypass hostname verification through reverse DNS spoofing. Both vulnerabilities affect versions 3.8.0 through 3.8.5 and 3.9.0 through 3.9.4, and updates to versions 3.8.6 or 3.9.5 are now available to resolve the issues. Security teams should also review existing logs for any potential data exposure.

MaaS VIP Keylogger Campaign Uses Steganography to Steal Credentials at Scale

gbhackers.com · 4 months ago

A large-scale spear-phishing campaign is distributing the VIP Keylogger malware as a Malware-as-a-Service. The attackers use steganography, in-memory execution, and modular payloads to evade detection while stealing credentials from over 40 Chromium-based browsers, email clients, and collaboration tools. The keylogger harvests data such as browser cookies, stored payment information, and Discord tokens, exfiltrating the stolen data via FTP, Telegram, Discord, web POST requests, and SMTP. This campaign highlights the effectiveness of social engineering combined with stealthy malware techniques.

New Attack Against Wi-Fi

www.schneier.com · 4 months ago

A new Wi-Fi attack called AirSnitch exploits flaws in network layers to allow an attacker to intercept and modify data. This enables a full, bidirectional man-in-the-middle attack, potentially compromising sensitive information like passwords and payment details, even on networks using HTTPS. The attacker can operate on the same or different networks, targeting both home and enterprise environments. AirSnitch can also be used to corrupt DNS tables and expose external IP addresses.

NIS-2: Tausende reißen BSI-Frist und riskieren Strafen

www.csoonline.com · 4 months ago

A new law in Germany, implementing the NIS-2 directive, requires over 29,000 businesses to protect against cyberattacks and significant IT incidents. Recent cyberattacks, such as one impacting European airports and disrupting operations at Berlin Brandenburg Airport, highlight the importance of these measures. Thousands of companies registered just before a deadline, indicating a positive trend toward compliance with the regulations. Businesses must now report security incidents within 24 hours and face potential fines for non-compliance.

ClipXDaemon Malware Targets Crypto Users in Linux X11 Sessions

gbhackers.com · 4 months ago

A new Linux malware family called ClipXDaemon is targeting cryptocurrency users. This malware operates entirely offline, without any command-and-control infrastructure, and hijacks cryptocurrency clipboard data during X11 sessions. It uses a publicly available obfuscation framework, similar to ShadowHS, to deliver its payload and establishes persistence through the user's profile. The malware monitors the clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, with observed attacker wallets for Ethereum, Monero, Bitcoin, Dogecoin, Litecoin, Tron, and Ripple. Indicators of compromise include SHA-256 hashes for the bincrypter loader script, dropper script, and ClipXDaemon ELF binary.

Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft

thehackernews.com · 4 months ago

Multiple Google Chrome extensions have been compromised, enabling attackers to inject code, steal data, and control user browsers. QuickLens and ShotBird, originally developed by [email protected], were taken over by new developers and subsequently updated with malicious code, including capabilities to bypass security protections and deliver fake browser update prompts. The malware captures sensitive data like credentials and browsing history and harvests cryptocurrency seed phrases. Researchers suspect a single threat actor is behind the attacks, highlighting the risks of extension supply chain vulnerabilities. Users are advised to remove suspicious extensions and exercise caution when installing browser add-ons.

Cybercrime Group in Vietnam Enables Massive Fraudulent Signups

gbhackers.com · 4 months ago

A cybercrime group based in Vietnam is enabling large-scale fraudulent account registrations to facilitate financial fraud, phishing, and interpersonal scams. Attackers use botnets and disposable email addresses to create "puppet" accounts and trigger SMS messages to premium-rate numbers, monetizing the telecom charges. Several online marketplaces, like Via17.com, resell compromised or automatically created accounts, along with session tokens, lowering the barrier to entry for fraudsters. These fraudulent accounts are then used for spam, phishing, and review manipulation, degrading the user experience on targeted platforms.

Rogues gallery: 15 worst ransomware groups active today

www.csoonline.com · 4 months ago

Ransomware-as-a-service models, double extortion tactics, and growing use of artificial intelligence are reshaping the ransomware threat landscape, which has become more fragmented after law enforcement takedowns and the rise of many emergent players. Attackers range from nation state actors to lone operators and affiliate-run RaaS operations that increasingly use stealth and living off the land techniques, and researchers recorded well over seven thousand victims publicly posted last year with some operations such as Akira allegedly collecting about forty five million dollars in illicit payments in two thousand twenty five. A not exhaustive roster of high impact active groups includes Akira, Black Basta, BlackCat also known as ALPHV, BlackLock, Clop, DragonForce, FunkSec, The Gentlemen, LockBit, Lynx, Medusa, Play, Qilin, RansomHub, and Scattered Lapsus Hunters. These groups commonly exploit unsecured remote access, phishing, initial access brokers, zero day and known vulnerabilities, and custom malware to exfiltrate data, encrypt systems, demand ransoms, and in some cases add distributed denial of service or triple extortion tactics as further leverage.

1-Click ZITADEL Vulnerability Could Allow Full System Takeover

gbhackers.com · 4 months ago

A critical Cross-Site Scripting vulnerability, tracked as CVE-2026-29191, has been identified in the ZITADEL identity and access management platform. This flaw in the /saml-post endpoint allows unauthenticated attackers to execute malicious JavaScript with a single click, potentially enabling account takeover through password resets. Versions 4.0.0 through 4.11.1 are affected and the vulnerability exists in the default configuration. ZITADEL has released version 4.12.0 to address the issue, which removes the vulnerable endpoint and enhances password change security.

Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure

thehackernews.com · 4 months ago

A Chinese threat actor, identified as CL-UNK-1068, has targeted critical infrastructure organizations across Asia for years. The group uses a mix of custom malware like Godzilla, ANTSWORD, Xnote, and Fast Reverse Proxy, alongside living-off-the-land binaries, to maintain a persistent presence and steal data. Attackers employ techniques like Base64 encoding to exfiltrate files and utilize tools such as Mimikatz, LsaRecorder, DumpItForLinux, Volatility Framework, and a SQL Server Management Studio Password Export Tool to steal credentials. The campaign’s primary objective appears to be cyber espionage, with the adversary demonstrating versatility across both Windows and Linux environments.

Nginx UI Vulnerabilities Let Attackers Download Full System Backups

gbhackers.com · 4 months ago

A critical security vulnerability, tracked as CVE-2026-27944, has been identified in Nginx UI versions before 2.3.2. The flaw allows unauthenticated attackers to download and decrypt full system backups, exposing sensitive data like user credentials, SSL private keys, and Nginx configurations. This is due to a lack of authentication on the backup endpoint and a failure to properly protect decryption keys, transmitting them in plain text via an HTTP header. Organizations are urged to immediately update to version 2.3.3, reset credentials, rotate certificates, and restrict network access.

ExifTool Vulnerability Lets Malicious Images Trigger macOS Code Execution

gbhackers.com · 4 months ago

A critical vulnerability, CVE-2026-3102, has been identified in ExifTool, a widely used open-source utility for managing image metadata. This flaw allows malicious image files to execute code on macOS systems if the -n or --printConv flag is used. Attackers can exploit this to install malware by embedding shell commands within the DateTimeOriginal metadata field. Users are advised to update to ExifTool version 13.50 or later and to isolate workflows involving untrusted images.

Hikvision Multiple Product Vulnerability Could Let Attackers Escalate Privileges

gbhackers.com · 4 months ago

Federal authorities have added a critical vulnerability affecting multiple Hikvision products to the Known Exploited Vulnerabilities catalog due to active exploitation in real-world attacks. The vulnerability, tracked as CVE-2017-7921, allows attackers to bypass security checks, escalate privileges, and gain unauthorized access to surveillance information. CISA has issued a mandatory directive for Federal agencies to resolve the issue by March 26, 2026, and strongly urges private organizations to prioritize remediation. Network isolation and device decommissioning are recommended as additional defensive measures.

PQC roadmap remains hazy as vendors race for early advantage

www.csoonline.com · 4 months ago

false

Critical ExifTool Vulnerability Allows Malicious Images to Execute Code on macOS

gbhackers.com · 4 months ago

Researchers have identified a critical vulnerability, CVE-2026-3102, in the ExifTool software impacting macOS systems. Attackers can embed malicious code within image metadata, specifically the DateTimeOriginal field, to execute commands when ExifTool is used with the -n flag. This allows for the silent download of secondary payloads, such as Trojans, without the user’s knowledge. The vulnerability poses a significant risk to organizations utilizing ExifTool for digital forensics, media processing, and automated workflows.

Transparent Tribe’s ‘Vibeware’ Move Points to AI-Made Malware at Scale

gbhackers.com · 4 months ago

A group known as Transparent Tribe, or APT36, is using artificial intelligence to generate a large volume of malware, dubbed "vibeware." This vibeware consists of syntactically correct but often flawed code quickly ported across various programming languages like Nim, Zig, Crystal, Rust, Go.NET, and C. The group is also leveraging legitimate cloud services such as Google Sheets, Supabase, Firebase, Discord, and Slack for covert command-and-control channels. This strategy, called Distributed Denial of Detection, aims to overwhelm defenders through sheer volume rather than sophisticated evasion techniques.

**MCP Security Checklist - 40 controls for securing AI agent tool infrastructure**

checklist.helixar.ai · 4 months ago

false

WiFi Signals Can Track Human Activity Through Walls by Mapping Body Keypoints

gbhackers.com · 4 months ago

New technology called RuView, formerly WiFi DensePose, can track human movement, estimate body poses, and monitor vital signs through walls using everyday WiFi signals. The system utilizes inexpensive ESP32-S3 microchips and analyzes Channel State Information to map body keypoints, operating locally without internet access. This capability poses significant physical surveillance threats, bypassing traditional security measures like encryption and physical barriers. Potential mitigation strategies include CSI randomization, physical RF shielding, and RF noise injection.