Blahalla

62 people indicted by Taiwanese prosecutors over ties to cyber scam company Prince Group

therecord.media · 4 months ago

Taiwanese prosecutors have indicted 62 individuals and 13 companies linked to the Prince Group for involvement in cyber scam operations. The group, led by Chen Zhi, allegedly laundered at least 339 million dollars into Taiwan, using stolen funds to purchase assets. The operation, which spanned multiple countries and involved human trafficking and extortion, targeted victims in the U.S., Europe, and China. Authorities have seized approximately 174 million dollars in assets, and Chen Zhi has been extradited to China.

LeakBase Cybercrime Forum Shut Down, Suspects Arrested

www.securityweek.com · 4 months ago

Law enforcement has dismantled the LeakBase cybercrime forum, a platform active since 2021. The forum, which had roughly 142,000 registered users, facilitated the trade of stolen data like account credentials, payment card information, and bank details. During Operation Leak, authorities seized the forum's database and arrested suspects following house searches and user identification. Europol highlighted a unique trust-based system within the forum and noted a rule prohibiting data related to Russia.

Critical pac4j-jwt Authentication Bypass Vulnerability Allows Attackers to Impersonate Any User

gbhackers.com · 4 months ago

A critical vulnerability, tracked as CVE-2026-29000, has been identified in the pac4j-jwt Java authentication library. This flaw allows attackers to bypass authentication and impersonate users, including administrators, by crafting unsigned tokens and exploiting a misplaced null check. The vulnerability impacts deployments using RSA-encrypted tokens and the JwtAuthenticator configuration, allowing attackers to forge tokens with arbitrary claims. Users are urged to update to version 4.5.9 or newer for the 4.x line, 5.7.9 or newer for the 5.x branch, or 6.3.3 or newer for the 6.x line.

Cisco flags more SD-WAN flaws as actively exploited in attacks

www.bleepingcomputer.com · 4 months ago

Cisco has identified several actively exploited security vulnerabilities in its Catalyst SD-WAN Manager software. Two flaws, CVE-2026-20122, an arbitrary file overwrite, and CVE-2026-20128, an information disclosure, are currently being exploited. A critical authentication bypass vulnerability, CVE-2026-20127, has been exploited since 2023, enabling attackers to introduce malicious devices into networks, and CISA has issued directives for federal agencies to address this issue. Additionally, Cisco recently patched vulnerabilities in its Secure Firewall Management Center software, including CVE-2026-20079 and CVE-2026-20131.

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

thehackernews.com · 4 months ago

Researchers have identified a new cyber campaign targeting Ukrainian entities, attributed with moderate confidence to the APT28 threat actor. The attack begins with a phishing email leading to a ZIP archive containing a lure document disguised as a border crossing appeal. This triggers the deployment of a.NET-based loader called BadPaw, which then downloads and runs a sophisticated backdoor named MeowMeow, allowing remote PowerShell command execution and file system manipulation. The malware incorporates decoy mechanisms, including a cat-themed GUI that displays a message when triggered independently, to evade detection and mislead analysis.

You’ve Never Seen Ants Like This Before

www.nytimes.com · 4 months ago

false

A Word to the Wise: Don’t Trust A.I. to File Your Taxes

www.nytimes.com · 4 months ago

false

ClickFix Campaign Exploits Fake LinkedIn VCs to Spread Malware Among Crypto and Web3 Experts

gbhackers.com · 4 months ago

A sophisticated malware campaign is targeting cryptocurrency and Web3 professionals using fake venture capital identities on LinkedIn. Attackers create convincing profiles for fictitious investment firms and lure victims into scheduling meetings via Calendly, which redirects to malicious Zoom or Google Meet links. The campaign employs a “ClickFix” technique, presenting a fake CAPTCHA that, when bypassed, prompts users to execute malicious commands directly in their terminal, bypassing standard security defenses. Researchers suspect links to the financially motivated UNC1069 group.

Google Rolls Out Emergency Chrome Update to Patch 10 Critical Security Vulnerabilities

gbhackers.com · 4 months ago

Google has released an emergency security update for Chrome, addressing ten vulnerabilities including three critical flaws and seven high-severity issues. The update, version 145.0.7632.159/160 for Windows and Mac, and 145.0.7632.159 for Linux, resolves memory management and lifecycle errors within the browser's core components. Critical vulnerabilities CVE-2026-3536, CVE-2026-3537, and CVE-2026-3538, involving integer overflows and object lifecycle issues, received substantial bug bounties. Users are advised to manually update their browsers immediately to prevent potential exploits.

Cisco Patches Critical Vulnerabilities in Enterprise Networking Products

www.securityweek.com · 4 months ago

Cisco has released updates to address 50 vulnerabilities impacting its enterprise networking products. Two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20131, exist in the Secure FMC software, allowing attackers to bypass authentication and execute code with root privileges. Nine additional high-severity vulnerabilities were also patched, potentially enabling SQL injection and denial-of-service attacks. Cisco reports that no vulnerabilities are currently being exploited.

Phobos ransomware admin pleads guilty to wire fraud conspiracy

www.bleepingcomputer.com · 4 months ago

A Russian national has pleaded guilty to wire fraud conspiracy for his role in administering the Phobos ransomware operation. The ransomware-as-a-service has impacted over 1,000 entities worldwide, generating more than $39 million in ransom payments. The administrator oversaw the sale and distribution of the ransomware through a darknet website, collecting fees for decryption keys. International law enforcement, through Operation Aether, has targeted Phobos-linked individuals and disrupted the operation, warning over 400 companies of potential attacks. The defendant faces up to 20 years in prison.

Cisco Secure Firewall Management Flaw Allows Remote Code Execution

gbhackers.com · 4 months ago

Cisco recently disclosed a critical security vulnerability in its Secure Firewall Management Centre software and Cisco Security Cloud Control Firewall Management systems. The flaw, identified as CVE-2026-2013 with a severity score of 10.0, allows unauthenticated attackers to execute arbitrary code and gain root privileges through insecure deserialization. There are no temporary workarounds available, and organizations must immediately apply vendor patches to mitigate the risk. Cisco Security Cloud Control users do not need to take action as the platform automatically receives security upgrades.

Reclaim Security Raises $26M to Eliminate the 27-Day Remediation Gap

gbhackers.com · 4 months ago

Cybersecurity firms face a widening gap between vulnerability detection and remediation, with attackers now able to exploit weaknesses in as little as 27 seconds, while remediation often takes 27 days. Reclaim Security has secured $26 million in funding to address this challenge with its preemptive exposure-remediation platform. The platform utilizes a Productivity Impact Prediction Engine, or PIPE, to simulate the effects of security changes before deployment, automating remediation and reducing timelines from weeks to minutes. Reclaim aims to shift security strategies from reactive approaches to proactive exposure removal.

RedAlert Mobile Espionage Campaign Exploits Trojanized Rocket Alert App to Spy on Civilians

gbhackers.com · 4 months ago

A new mobile espionage campaign called "RedAlert" is exploiting the Israel-Iran conflict by distributing a trojanized version of the official Israeli Rocket Alert app. Attackers use SMS phishing to trick users into sideloading the fake app, which then steals sensitive data like SMS messages, contacts, and GPS location while displaying legitimate emergency alerts. The malware uses a three-tier infection chain to bypass security checks, including spoofing digital signatures and concealing malicious code. Data is exfiltrated to attacker-controlled servers via HTTP POST requests, and the campaign utilizes infrastructure associated with domains like api.ra-backup.com and IP addresses including 44.208.242.141.

we at codeant found a bug in pac4j-jwt (auth bypass)

www.codeant.ai · 4 months ago

A critical authentication bypass in pac4j-jwt allows an attacker possessing only the server RSA public key to craft an encrypted unsigned JWT that authenticates as any user, including administrators; this vulnerability is tracked as CVE-2026-29000 with a CVSS score of 10.0. The bypass occurs because pac4j decrypts the JWE and calls toSignedJWT on the inner payload, and when that returns null for a PlainJWT the code skips signature verification and accepts the unverified claims. Maintainers shipped patches on March 2, 2026 and users are urged to upgrade to 4.5.9 or newer, 5.7.9 or newer, or 6.3.3 or newer; the CVE was assigned on March 4, 2026.

Cisco Secure Firewall Vulnerability Exposes Networks to Authentication Bypass Attacks

gbhackers.com · 4 months ago

Cisco has disclosed a critical vulnerability, CVE-2026-20079, in its Secure Firewall Management Centre software, allowing unauthenticated attackers to gain root access. The flaw, discovered during internal testing, results from a faulty system process and can be exploited through specially crafted HTTP requests. This bypasses authentication and enables attackers to control the underlying operating system, potentially compromising the entire network. Only on-premises deployments are affected, and Cisco provides a Software Checker tool to help administrators identify and apply the necessary updates.

State-affiliated hackers set up for critical OT attacks that operators may not detect

www.csoonline.com · 4 months ago

Threat groups linked to state-sponsored actors are actively mapping and preparing to disrupt industrial control systems, posing a significant risk to critical infrastructure. Fewer than 1 in 10 OT networks have adequate monitoring to detect this activity. Groups like Voltzite, Kamacite, and Electrum are demonstrating increasingly sophisticated tactics, including exploiting vulnerabilities like those in Ivanti EPMM and SAP NetWeaver, and deploying wiper malware. This shift highlights a concerning lack of visibility and preparedness within OT environments, and could be triggered by geopolitical conflict.

Threat Actors Intensify Targeting of IP Cameras Across the Middle East Amid Ongoing Conflict

gbhackers.com · 4 months ago

Iran-nexus threat actors are targeting IP cameras across the Middle East, beginning February 28, 2026, to gather intelligence and support military operations. The attacks, utilizing commercial VPNs and cloud servers, have primarily targeted cameras from Hikvision and Dahua, exploiting vulnerabilities like CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, and CVE-2021-33044. Researchers suggest increases in camera targeting may foreshadow kinetic escalation, and advise organizations to strengthen security measures, including patching firmware and segmenting networks. The activity demonstrates the increasing intersection of cyber operations and physical warfare.

Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks

thehackernews.com · 4 months ago

Law enforcement agencies have dismantled Tycoon 2FA, a phishing-as-a-service toolkit linked to over 64,000 attacks and impacting nearly 100,000 organizations globally. The subscription-based kit allowed cybercriminals to stage adversary-in-the-middle attacks, generate tens of millions of phishing emails monthly, and steal credentials, MFA codes, and session cookies. Microsoft has tracked the operators of this service as Storm-1747, noting it became the most prolific platform in 2025. The takedown involved seizing 330 domains that comprised the criminal service.

FBI and Europol Seize LeakBase Forum Used to Trade Stolen Credentials

thehackernews.com · 4 months ago

Law enforcement agencies, including the FBI and Europol, have dismantled LeakBase, a significant online forum used by cybercriminals to trade stolen credentials and cybercrime tools. The forum, active since 2021, had over 142,000 members and facilitated the sale of hacked databases containing hundreds of millions of account credentials and financial information. During Operation Leak, authorities executed search warrants, made arrests, and seized forum content for evidentiary purposes. LeakBase was linked to the threat actor known as Chucky, who is also associated with the monikers Chuckies and Sqlrip.

14 old software bugs that took way too long to squash

www.csoonline.com · 4 months ago

There are 14 noteworthy software bugs that lingered for years or decades in widely used operating systems, libraries, and applications before being discovered and fixed. Notable examples include libpng CVE-2026-25646, Python tarfile CVE-2007-4559, Redis CVE-2025-49844, HashiCorp Vault CVE-2025-6000, LionWiki CVE-2020-27191, sudo CVE-2025-32462, and Telnet CVE-2026-24061. The flaws range from buffer overflows and use after free to local file inclusion, authentication bypass, and logic errors that enabled remote code execution, privilege escalation, data loss, and supply chain exposure, driving coordinated patching and mitigation across vendors and distributions.

Cisco Catalyst SD-WAN Flaws Expose Devices to Root Access, Threatening Network Security

gbhackers.com · 4 months ago

Cisco has released critical software updates to address vulnerabilities in the Catalyst SD-WAN Manager that could allow attackers to bypass authentication and gain elevated privileges. Exploitation of CVE-2026-20129 allows unauthenticated attackers to obtain netadmin privileges, while CVE-2026-20126 enables local attackers to achieve root access. Active exploitation of CVE-2026-20122 and CVE-2026-20128 is also underway, allowing threat actors to overwrite files and disclose credentials. Immediate software upgrades are mandatory, and Cisco recommends restricting internet access and disabling HTTP for the administrator portal.

Operation Leak: Authorities Dismantle LeakBase Forum, Secure User Data and IP Logs

gbhackers.com · 4 months ago

Law enforcement agencies, including the FBI, have dismantled the LeakBase online forum, a marketplace for stolen data and credentials. The action, called Operation Leak, resulted in the seizure of the forum's domains and infrastructure using court orders from Germany and the United States. Authorities secured a significant amount of data including user accounts, forum posts, private messages, financial credit details, and IP logs. Anyone who used the platform or communicated with LeakBase administrators is urged to contact the FBI directly.

Cyberattack Alert: Hackers Impersonate LastPass Support to Steal Vault Passwords

gbhackers.com · 4 months ago

A phishing campaign is targeting LastPass users by impersonating support emails. Attackers are crafting fake email chains that mimic internal communications regarding suspicious account activity, such as unauthorized data exports or device registrations. The emails direct users to fake LastPass login pages designed to steal master passwords and vault data, utilizing display name spoofing to appear legitimate. LastPass advises users to verify email addresses, avoid clicking links, and enable multi-factor authentication.

Tycoon 2FA Phishing Operation Dismantled in Joint Raid by Microsoft and Europol

gbhackers.com · 4 months ago

Microsoft and Europol have dismantled the Tycoon 2FA Phishing-as-a-Service platform, which bypassed multi-factor authentication to infiltrate over 96,000 victims globally. The platform, operated by Saad Fridi from Pakistan, allowed low-skilled attackers to hijack authenticated sessions on Microsoft 365 and Google platforms, peaking at 62% of Microsoft's blocked phishing attempts. The coordinated disruption involved seizing hundreds of domains and servers across multiple countries, requiring extensive international collaboration. Organizations are advised to enforce phishing-resistant MFA, implement session controls, and update threat intelligence to defend against similar attacks.

Die besten Cyber-Recovery-Lösungen

www.csoonline.com · 4 months ago

false

Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks

www.securityweek.com · 4 months ago

Security researchers have identified a sophisticated iOS exploit kit called Coruna, initially used by Russian state actors against Ukrainians, now in the hands of Chinese criminal groups. The kit targets iOS versions 13 through 17.2.1, employing 23 exploits across five exploit chains, and utilizes non-public exploitation techniques. It has been observed in watering hole attacks and is now used to steal financial information and bitcoin wallets through fake websites. Users are advised to update to iOS 17.3 or higher, or enable Lockdown Mode for increased security.

Elon Musk Defends Social Media Posts in Twitter Shareholder Lawsuit

www.nytimes.com · 4 months ago

false

Microsoft leads takedown of Tycoon2FA phishing service infrastructure

www.csoonline.com · 4 months ago

Law enforcement and IT companies, led by Microsoft, have dismantled Tycoon2FA, a phishing-as-a-service infrastructure used to target millions with malicious emails. The service allowed criminals with limited technical skills to create sophisticated phishing campaigns mimicking legitimate login pages for services like Microsoft 365, Outlook, and Gmail. Tycoon2FA intercepted multi-factor authentication codes and session cookies, enabling access to sensitive information even after password resets. Experts caution that similar tools will likely emerge, emphasizing the need for stronger identity security and phishing-resistant authentication methods like FIDO2/WebAuthn.

Normalized Certificate Transparency logs as a daily JSON dataset

hefftools.dev · 4 months ago

false

Your Duolingo Is Talking to ByteDance: Cracking the Pangle SDK's Encryption

www.buchodi.com · 4 months ago

Researchers discovered that several popular mobile applications, including Duolingo, BeReal, and Character.AI, are transmitting sensitive device data to ByteDance’s Pangle ad SDK. This data includes device models, IP addresses, battery levels, and more. The “encryption” used, labeled "cypher:3," is easily broken because the decryption key is embedded within each message, essentially acting as obfuscation rather than true encryption. A second, stronger encryption method, "cypher:4," is used for ad-related data.

Smashing Security podcast #457: How a cybersecurity boss framed his own employee

grahamcluley.com · 4 months ago

A cybersecurity firm investigated a leak, unaware that the person leading the investigation was the source of the breach, resulting in an employee being wrongly implicated. A defense contractor was recently sentenced to 87 months for selling stolen trade secrets, including zero-day exploits, to a broker with ties to Russia. Authorities have sanctioned a network involved in the theft and sale of cyber tools. Concerns are rising about nation states potentially manipulating artificial intelligence models to influence information and erode trust.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Authenticated Command Injection Vulnerabilities

sec.cloudapps.cisco.com · 4 months ago

Cisco has identified several vulnerabilities within its Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software. These vulnerabilities, including CVE-2026-20064, CVE-2026-20016, CVE-2026-20017, and CVE-2026-20063, allow authenticated, local attackers to potentially cause denial-of-service conditions or execute arbitrary commands with root-level privileges. The vulnerabilities stem from insufficient input validation within the command-line interface. Software updates are available to address these issues, and there are no available workarounds.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Server Denial of Service Vulnerability

sec.cloudapps.cisco.com · 4 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software, potentially leading to a denial of service. Cisco recommends upgrading to a fixed software release to fully resolve the issue and prevent future exposure. A tool called the Cisco Software Checker is available to help customers determine their vulnerability status and the earliest software versions that provide fixes. Upgrading Cisco Secure FTD devices should be done through the appropriate Cisco Secure FMC upgrade guide.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities

sec.cloudapps.cisco.com · 4 months ago

Cisco has identified several denial-of-service vulnerabilities within the Remote Access SSL VPN functionality of its Secure Firewall ASA and Secure FTD Software. These vulnerabilities, identified as CVE-2026-20100, CVE-2026-20101, CVE-2026-20103, CVE-2026-20105, and CVE-2026-20106, can be exploited by unauthenticated or authenticated attackers to cause unexpected reloads or memory exhaustion, resulting in a denial of service. The issues stem from insufficient error checking and input validation within the VPN authentication process, Lua interpreter, and HTTP management interfaces. Software updates are available to address these vulnerabilities, and no workarounds are provided.

Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 4 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software that could allow unauthorized access. Cisco recommends upgrading to a fixed software release to fully resolve the issue and prevent future exposure. A tool, the Cisco Software Checker, is available to help customers identify affected software versions and the earliest available fixes. Cisco provides resources to help determine the appropriate software release.

Iranian TV and Social Media Project Defiant and Distorted View of the War

www.nytimes.com · 4 months ago

false

Built a header echo + TLS interception detector to score ISP-level surveillance — looking for feedback on the methodology

ismyispspying.com · 4 months ago

NULL

Bitwarden adds support for passkey login on Windows 11

www.bleepingcomputer.com · 4 months ago

false

Trump Announces A.I. Industry Pledge to Pay for Power

www.nytimes.com · 4 months ago

false

Mail2Shell zero-click attack lets hackers hijack FreeScout mail servers

www.bleepingcomputer.com · 4 months ago

A critical vulnerability in the FreeScout helpdesk platform allows attackers to remotely execute code without user interaction. The flaw, tracked as CVE-2026-28289, bypasses a previous fix for CVE-2026-27636. Hackers can exploit the vulnerability by sending a crafted email attachment, which triggers code execution by bypassing security checks using a zero-width space character. FreeScout versions up to 1.8.206 are affected, and users are strongly advised to update to version 1.8.207 and disable ‘AllowOverrideAll’ in the Apache configuration.

VMware Aria Operations Bug Exploited, Cloud Resources at Risk

www.darkreading.com · 4 months ago

A vulnerability in VMware Aria Operations, identified as CVE-2026-22719, is currently being exploited. This high severity command injection flaw, with a CVSS score of 8.1, allows unauthorized access and potential remote code execution during product migration. Broadcom, the owner of VMware, confirmed reports of exploitation but cannot independently verify them, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. Experts warn that compromising Aria Operations can provide attackers with extensive access to cloud infrastructure, including credentials and network topology.

Windows 10 KB5075039 update fixes broken Recovery Environment

www.bleepingcomputer.com · 4 months ago

false

Fake LastPass support email threads try to steal vault passwords

www.bleepingcomputer.com · 4 months ago

LastPass users are being targeted by a sophisticated phishing campaign impersonating company support staff. Attackers are sending fake email threads designed to appear as legitimate internal communications regarding account changes. These emails trick users into clicking malicious links that lead to fraudulent LastPass login pages, designed to steal vault passwords. LastPass emphasizes that its systems are secure and that support agents will never request a master password.

Cisco warns of max severity Secure FMC flaws giving root access

www.bleepingcomputer.com · 4 months ago

Cisco has released security updates to address two maximum-severity vulnerabilities in its Secure Firewall Management Center software. One vulnerability, CVE-2026-20079, is an authentication bypass flaw allowing attackers to gain root access, while the other, CVE-2026-20131, is a remote code execution vulnerability enabling attackers to execute arbitrary code as root. The remote code execution vulnerability also affects Cisco Security Cloud Control Firewall Management. Cisco reports no evidence of active exploitation or publicly available proof-of-concept code for these flaws.

Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks

www.bleepingcomputer.com · 4 months ago

A sophisticated set of 23 iOS exploits named "Coruna" has been observed in targeted attacks and financially motivated campaigns. The exploit kit, initially used for espionage, now targets cryptocurrency users by stealing wallet recovery phrases, sensitive text strings, and data from Apple Memos. The framework uses five full exploit chains that bypass security mitigations and targets iOS versions 13.0 through 17.2.1, utilizing CVE-2024-23222, a WebKit vulnerability. Google attributes activity to UNC6353 and UNC6691, and suggests a market for "second-hand" zero-day exploits.

Hacker mass-mails HungerRush extortion emails to restaurant patrons

www.bleepingcomputer.com · 4 months ago

Customers of restaurants utilizing the HungerRush point-of-sale system are receiving extortion emails from an attacker threatening to release customer data. The emails, sent via Twilio SendGrid, claim access to millions of customer records including names, emails, and potentially financial information. A possible compromise occurred in October 2025 when an infostealer infected a HungerRush employee's device, allegedly stealing credentials for various corporate systems. HungerRush is investigating the incident and advising customers to be cautious of potential phishing attempts.

Tycoon 2FA Phishing Platform Dismantled in Global Takedown

www.securityweek.com · 4 months ago

Law enforcement and cybersecurity companies have collaborated to dismantle Tycoon 2FA, a phishing-as-a-service platform. The platform allowed attackers to impersonate users and bypass multi-factor authentication, enabling them to access email and cloud accounts. Tycoon 2FA was responsible for a significant portion of phishing attempts, impacting hundreds of thousands of organizations and tens of thousands of Microsoft customers. The takedown involved seizing infrastructure and legal action against individuals, including the platform’s suspected developer.

Lawmakers Question Intel’s Use of Tools From Blacklisted Chinese Firm

www.nytimes.com · 4 months ago

Lawmakers are expressing national security concerns regarding Intel's potential use of technology from ACM Research, a Chinese company that is on a trade blacklist. Intel’s use of these tools could allow China access to Intel's chip-making processes, particularly concerning given Intel is now partly owned by taxpayers. A bipartisan group of senators sent a letter to Intel's CEO requesting answers about the testing of ACM tools, safeguards in place, and measures to prevent taxpayer money from supporting China. The scrutiny highlights challenges facing the company as it attempts to regain industry leadership.

Perplexity AI Browser Flaw Could Let Calendar Invites Access Local Files

www.techrepublic.com · 4 months ago

A security vulnerability in the Perplexity AI-powered Comet browser allowed attackers to potentially access local files through malicious calendar invitations. Researchers discovered that the AI agent could be manipulated to execute harmful instructions hidden within routine content, such as a prompt to search for password documents. The browser’s ability to access the file system through the file:// protocol enabled this access. Perplexity has since released patches to restrict the AI agent's file system access and prevent attackers from hijacking the agent's capabilities.