Blahalla

Hackers Spread VIP Keylogger via Fake Business Emails

gbhackers.com · 4 months ago

Hackers are actively deploying VIP Keylogger through phishing emails disguised as routine business documents, using multi‑layered loaders, steganography, and in‑memory execution to quietly steal credentials and other sensitive data from compromised systems. Recent VIP Keylogger campaigns rely heavily on social engineering, with phishing emails crafted to look like legitimate bank payment notifications, procurement orders, logistics
Motorola App Allegedly Hijacks Amazon App Activity to Insert Affiliate Referral Codes

gbhackers.com · 4 months ago

Motorola is facing scrutiny after researchers and users discovered that its preinstalled Smart Feed app was silently hijacking launches of the Amazon Shopping app to inject affiliate referral codes into user traffic. The behavior, now disabled after public backlash, raises fresh concerns about trust, bloatware, and on‑device ad tech on premium Android phones. Motorola Smart
Microsoft Warns Against Public Release of Zero-Day Details Before Vendor Coordination

gbhackers.com · 4 months ago

Microsoft has issued a strong warning to the cybersecurity community following a recent surge in publicly disclosed zero-day vulnerabilities without prior coordination. According to the Microsoft Security Response Center (MSRC), several vulnerabilities were disclosed without prior notification to Microsoft, leaving customers exposed to potential exploitation before patches could be developed and deployed. The company stressed
What scanners are actually trying against AI infrastructure

honeylabs.net · 4 months ago

Scanners are intensely targeting AI infrastructure, specifically probing Anthropic proxy paths to find misconfigured services without sending proper authentication tokens. Port 11434 running Ollama is a notable high-volume target, receiving a steady stream of sources weekly that utilize unauthenticated endpoints. Vulnerabilities include the /api/tags endpoint, which publicly lists available models, and the /api/pull path, which can potentially allow calling servers to download arbitrary models. These findings are compounded by focused sweeps that test credential storage conventions for major AI platforms, including Gemini and Claude.
Nordic CISOs Handle Rising Cyber Threats Remarkably Well

www.darkreading.com · 4 months ago

Artificial intelligence notwithstanding, the vast majority of CISOs in northern Europe say they're facing no more serious cyberattacks than they did two years ago.
Hackers Host JS Malware on GHOSTYNETWORKS and OMEGATECH

gbhackers.com · 4 months ago

Hackers are abusing two bulletproof hosting providers, GHOSTYNETWORKS and OMEGATECH, to run a global JavaScript (JS) malware infrastructure that powers large‑scale malspam and business email compromise activity. In March 2026, multiple malspam waves delivered a JavaScript backdoor via ZIP or RAR attachments to organizations across regions and sectors, including energy companies and finance ministries. The
Threat Actors Launch FIFA Website Spoofing Campaign to Steal User Details

gbhackers.com · 4 months ago

Threat actors are actively launching spoofing campaigns targeting FIFA-themed websites ahead of the 2026 FIFA World Cup, according to a Public Service Announcement (Alert I-052726-PSA) issued by the Federal Bureau of Investigation (FBI) on May 27, 2026. The campaign is designed to exploit global interest in the tournament by deceiving users into interacting with fraudulent
New PureLogs Variant Abuses MSBuild to Evade Detection

gbhackers.com · 4 months ago

A new phishing-driven malware campaign distributing a stealthy PureLogs variant that leverages advanced evasion techniques, including process hollowing via MsBuild.exe. The campaign is designed to steal sensitive data from infected systems while avoiding traditional detection mechanisms through layered obfuscation and fileless execution. The attack begins with phishing emails disguised as purchase orders, a familiar social
FortiClient Code Execution Flaw Exploited to Deploy EKZ Malware

gbhackers.com · 4 months ago

Fortinet customers are facing a new wave of attacks after a critical flaw in FortiClient Endpoint Management Server (EMS) was exploited to push a fake Fortinet patch that secretly installs credential‑stealing malware. The vulnerability, tracked as CVE‑2026‑35616, allows unauthenticated attackers to bypass FortiClient EMS API authentication and issue privileged requests, effectively turning the management server
Silent Ransom Impersonates IT Support to Target Law Firms

gbhackers.com · 4 months ago

The Silent Ransom Group (SRG) is running a new wave of hands‑on social engineering attacks against law firms, posing as internal IT support to steal sensitive data and extort victims without deploying traditional ransomware. In its latest campaigns, SRG contacts employees directly by phone or lures them through phishing emails that appear to come from
SBI Warns Fake YONO Deactivation Message Scam

gbhackers.com · 4 months ago

State Bank of India has issued a cybersecurity alert about an ongoing phishing campaign targeting users of its YONO digital banking platform. Fraudulent messages claim a customer's YONO app will be deactivated due to incomplete Aadhaar updates and urge recipients to click links or install APKs that can harvest login credentials, intercept OTPs, and grant remote access for financial theft. The bank warns it never asks customers to update sensitive information via unsolicited links, advises downloading YONO only from official app stores, and recommends verifying communications through official channels, reporting suspicious messages, and keeping devices patched and protected.
Defense by accumulation

puck.security · 4 months ago

There is a 64 year arc showing that credentials persist as files and other artifacts and remain a primary target whenever they are accessible. Credentials have migrated from on disk password files to in memory artifacts, to tokens and session cookies, and now to machine to machine agent credentials, with incidents such as the Morris Worm, Mimikatz driven attacks, the Target breach, the RSA SecurID incident, the Office of Personnel Management compromise, the Snowflake campaign, CI compromises like Codecov and CircleCI, and support channel incidents at identity providers illustrating each stage. Operational practices drive the risk: long lived and over privileged tokens, secrets committed to repositories, exposed CI environment variables, unlocked password stores, and lack of rotation or scope limitations mean attackers choose the softest layer rather than breaking the strongest cryptography. The practical defense imperative is visibility across all credential classes so that in the first hour of an incident responders can answer what credentials are on a host, what those credentials reach, and where similar patterns exist.
Employees are unknowingly inviting tech support impersonators into firms, says FBI

www.csoonline.com · 4 months ago

The FBI warns that a criminal group known as the Silent Ransom Group, also tracked as Luna Moth Chatty Spider and UNC3753, has targeted US law firms since at least 2022 using data theft and extortion rather than encryption. The group now impersonates IT support by phone to obtain remote access or visits in person to insert USB storage devices into employee computers to install remote access tools or steal data. Observed tools and behaviors include use of WinSCP or renamed Rclone to transfer files, uploading stolen data to Google Drive or Microsoft OneDrive, and unauthorized installation of remote support software such as Zoho Assist, AnyDesk, RustDesk, Quick Assist, Syncro, Splashtop, or Atera. The FBI urges organizations to verify IT requests through approved channels, train employees to refuse unverified visitors and unsolicited support calls, disable or limit USB use, collect visitor identification, monitor for unexpected remote access tool installations and data transfers, and preserve extortion notes, logs, and surveillance for investigators.
CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal (Severity: CRITICAL)

security.paloaltonetworks.com · 4 months ago

A buffer overflow vulnerability, identified as CVE-2026-0300, has been discovered in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software. This vulnerability allows an unauthenticated attacker to potentially execute code with root privileges on affected PA-Series and VM-Series firewalls. To mitigate the risk, it is recommended to restrict User-ID Authentication Portal access to trusted internal IP addresses or disable the service entirely. Several PAN-OS versions are impacted, with updates expected between May 13th and May 28th of 2026.
Another IT governance headache: AI-enabled sanction evasion

www.csoonline.com · 4 months ago

A new research report warns that over the next three to five years governments and the private sector must rapidly adapt identification and mitigation protocols as adversaries shift from AI assisted to AI enabled sanctions evasion and proliferation financing. AI can mass produce high quality fraudulent documents, automate the administrative minutia of managing extensive shell company networks, create sophisticated fake identities, and analyze blockchain patterns in real time to dynamically adjust cryptocurrency mixing strategies to evade detection. Actors including North Korea and Iran are already developing and deploying AI models to support phishing and other schemes that raise revenue for weapons programs. Enterprises are advised to adopt defensive AI, behavior based analytics, circuit breakers for heavy API or marketplace use, stronger identity verification and updated personnel training, and to treat the problem as a trust architecture challenge rather than a narrow sanctions screening issue to prepare for an anticipated AI arms race.
Smashing Security podcast #469: What your Oura ring won’t tell you

grahamcluley.com · 4 months ago

A contractor for the US Cybersecurity and Infrastructure Security Agency published dozens of plain text credentials to a public GitHub profile. The Oura ring was found to transmit some user data unencrypted, and the company’s reply to a journalist asking how often it shares user data with law enforcement was telling. Episode 469 of the Smashing Security podcast features an interview with OPSWAT’s Benny Czarny about his book Cybersecurity Upside Down, hosted by Graham Cluley with guest Lesley Carhart.
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 4 months ago

In May 2026 a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager could allow an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on affected systems. Exploitation can let an attacker log in as an internal high privileged non-root user, access NETCONF, and manipulate SD-WAN network configuration; there are no workarounds and the issue is rated Critical. Software updates have been released to address the issue, customers are advised to collect admin-tech output from each control component before upgrading to preserve indicators of compromise, and the vulnerability is tracked as CVE-2026-20182.
Out of the Crypt: The Evolving Cyber Extortion Economy

unit42.paloaltonetworks.com · 4 months ago

There is a growing shift in the cyber extortion economy from encryption-based ransomware to data-theft extortion, with encryption used in seventy eight percent of extortion cases in 2025 compared with near or above ninety percent in earlier years. Threat actors are weaponizing regulatory disclosure windows and high breach costs to force payments, driving average data-theft extortion losses to about five point zero eight million dollars and exceeding ten million dollars for broader U.S. breaches. Actors such as TGR-CRI-1135 are exploiting software supply chain compromises, Bling Libra is using vishing to infiltrate SaaS tenants, and CL-CRI-1116 has combined swatting with data leaks under a rebranded program called Redact. Frontier AI models are accelerating attack timelines and are expected to be weaponized within an estimated three to five months, prompting recommendations to deploy data loss prevention, strengthen SaaS security posture, adopt phishing resistant authentication like FIDO2 hardware keys, and secure CI slash CD pipelines and secrets.
AI models more vulnerable than claimed when faced with iterative attacks

www.csoonline.com · 4 months ago

A Cisco study tested 15 frontier AI models with 30,090 single-prompt attacks and 6,986 multi-turn attacks and found multi-turn attack success rates were substantially higher than single-turn rates across most models. Examples include Anthropic Claude Opus 4.6 rising from 3.64 percent single-turn ASR to 16.20 percent multi-turn, OpenAI GPT 5.4 from 2.74 percent to 24.68 percent, and Google Gemini 3 Pro from 18.10 percent to 73.35 percent. Model configuration flags such as reasoning modes materially changed safety outcomes, for example xAI Grok 4.1 Fast non-reasoning at 88.30 percent versus reasoning at 43.47 percent, and the study calls for paired single-turn and multi-turn ASRs, transparent configuration effects, and adversarial benchmarks informed by OWASP and emerging regulation. The researchers recommend any model with an absolute gap greater than 15 percentage points between single-turn and multi-turn ASR receive a manual review before deployment, which flagged eight models in the tested cohort.
GPU mining malware spreads via SEO poisoning, AI chatbots

www.bleepingcomputer.com · 4 months ago

Threat actors are targeting high performance systems in a coordinated cryptojacking campaign that spreads via SEO poisoning and by manipulating AI chatbot recommendations. The infection starts with malicious download pages for common utility software such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear where ZIP archives bundle a legitimate executable with a malicious DLL that installs the ScreenConnect remote access tool via a vcredistx64.dll installer to gain persistence. Attackers use a loader named SimpleRunPE to establish multiple autostart persistence mechanisms, perform process hollowing into Microsoft signed utilities, add exclusions in Microsoft Defender, evade virtual machines and analysis tools, and then deploy GPU miners gminer, lolMiner, or SRBMiner-MULTI to maximize GPU mining yield on each compromised device.
Go Ask Alice Why Tech Start-Ups Are Spending Big on Hype Videos

www.nytimes.com · 4 months ago

Bay Area A.I. startups are increasingly staging theatrical, highly produced marketing videos featuring costumed characters like a Mad Hatter and a giant rabbit to capture attention. Founders and marketing teams are using these stunts to generate viral content, signal brand identity, and compete for limited investor and user attention in a crowded market. The trend reflects a shift toward spectacle-driven launch strategies where visibility often trumps product maturity.
Report ‘phone hack’ to police or I will do it for you, Labour chair tells Farage

www.theguardian.com · 4 months ago

The Labour chair gave Nigel Farage 24 hours to confirm to the police or national security services whether his phone, email and bank accounts were hacked by Russia linked actors or the Labour party said it would report the claim itself in the public and national interest. Farage has said foreign state actors likely serving Moscow accessed his phone and leaked information about an undeclared five million pounds gift from Christopher Harborne, and Reform said the incident had been reported to the relevant authorities without specifying which ones. He reportedly handed his phone for forensic analysis that allegedly found a malware attack likely originating from Russia, while cybersecurity experts have called the claim unsubstantiated and the parliamentary commissioner for standards has opened an investigation into whether the gift should have been declared.
Ransomware Actors Show Up In Person to Steal Law Firm Data

www.darkreading.com · 4 months ago

The FBI warns that the extortion group Silent Ransom Group is targeting law firms by impersonating IT staff and social engineering employees, and in some cases actors have appeared in person at firm locations. Attackers establish access via phishing calls and links to remote access tools or by inserting storage devices, then exfiltrate data using tools such as WinSCP or renamed versions of Rclone to cloud storage or physical drives and use data theft extortion rather than encrypting systems. Indicators include unauthorized installations of remote access or management tools, unexpected USB or external drive connections, and WinSCP or Rclone sessions to external IPs, and the FBI recommends verifying identities of on site visitors, enforcing phishing resistant multifactor authentication, training staff to report phishing, and disabling remote access and external drive installation on systems holding sensitive data.
The Next AI Security Failure May Start With a Trusted Assistant

www.techrepublic.com · 4 months ago

There is a class of vulnerability in AI coding assistants where a network sandbox bypass combined with prompt injection can be used to exfiltrate data, and a widely used tool was quietly patched for a SOCKS5 hostname null byte weakness. There are systemic gaps because organizations often rely on model layer controls such as system prompts, output filters, and sandboxes that can be defeated, leaving no independent data layer enforcement to stop unauthorized access. There are recommended data layer controls including authenticating agents and tying requests to the human who authorized them, enforcing attribute based access policies, encrypting returned data, and writing interactions to a tamper evident audit log. There are industry findings that most custom assistants lack adequate protection, many organizations cannot enforce purpose limits or terminate misbehaving agents, and AI enabled adversary activity is rising sharply, underscoring the need to treat assistants as data processing systems with least privilege, encryption, and audit rigor.
UK Cyberspying Chief Calls AI ‘an Unstoppable Force’ and Warns About Russia

www.securityweek.com · 4 months ago

Artificial intelligence is an unstoppable force being weaponized in ways that fall just short of traditional warfare, and Britain faces a narrowing window to stay ahead as tech companies release AI innovations at rapid pace. The director of GCHQ warned that Russia is scaling up daily hybrid activity targeting critical infrastructure, democratic processes, supply chains and public trust, and cited new intelligence suggesting almost half a million Russian soldiers have been killed since February 2022. GCHQ is planning to harden machine speed cyber defenses by integrating agentic AI, and officials urged governments, companies and citizens to treat cybersecurity with far greater urgency while reinforcing international partnerships, particularly the U.K.-U.S. intelligence relationship.
Latin American Cybercriminals Hoover Up Government Data

www.darkreading.com · 4 months ago

There are reports of a purported leak exposing 5.8 million records of Uruguayan citizens after a group calling itself La Pampa Leaks claimed to have compromised the government-sponsored identity service managed by telecommunications provider Antel, which responded that passwords, signature PINs, private keys tied to digital certificates, and credentials were not compromised. There are broader trends of Latin American cybercriminal groups monetizing government and citizen data, including a claim by the Chronus Group that it stole data from 25 Mexican government agencies and reporting that Colombia's health ministry faced more than 23 million attempted attacks in March. There are analyses from security firms noting that public administration was the most-breached sector in the region, accounting for about 21 percent of breaches, and that regional actors are shifting to pure extortion and high-volume data exfiltration instead of deploying encryption. There are recommendations to harden identity controls, reduce exposed services and open ports, and prioritize patching of vulnerabilities to build resilience against these targeted attacks.
AI-Assisted Exploit Development Outpaces Scanner Detection

www.darkreading.com · 4 months ago

Analysis of 69,159 CVEs shows attackers using AI reduced the time to develop a working exploit for a disclosed vulnerability from about 125 days in January 2025 to roughly half a day by April 2026. That acceleration created visibility gaps for defenders, with 83.2 percent of critical vulnerabilities producing a visibility gap, 55.7 percent of critical CVEs never receiving detection coverage from major scanners, and 62 percent of vulnerabilities having exploits circulating before detection signatures were available. Median detection lags among leading scanners were measured at 0.1 days for Tenable, 2.9 days for Qualys, and 5.1 days for Rapid7, prompting recommendations to adopt continuous software inventory checks, software bill of materials matching, and threat intelligence feeds so teams can identify affected assets within minutes of disclosure.
Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

thehackernews.com · 4 months ago

Two banking trojan campaigns are targeting Windows and Android users across Latin America and Europe, with Grandoreiro focusing on companies in Spain, Portugal, and Mexico and BTMOB aimed at mobile users in Brazil. Grandoreiro operations use DLL side-loading to launch Delphi-built DLLs that incorporate sgcWebSockets and rely on WebRTC, STUN, or ICE to hide in web-conferencing traffic, and attackers deliver payloads via phishing lures such as Mediafire-hosted ZIPs containing obfuscated Visual Basic scripts that prompt fake Adobe Reader updates to steal banking credentials. BTMOB is an Android remote access trojan sold as malware-as-a-service with an APK builder that spreads through phishing sites and fake app listings, abuses Android accessibility services to automate credential theft and remote control, and as of May 2026 is at version 4.5.5 with commercial pricing and leaked source code increasing its availability.
New Phishing Technique - Vaultjacking: One Captured PIN, the Entire Google Password Manager Vault

phishu.net · 4 months ago

A new phishing technique called Vaultjacking uses a single AiTM landing page that spoofs a Google passkey or password manager PIN to capture that PIN and then access and exfiltrate all of a victim's third party credentials saved in Chrome, including passkeys. A single successful phish on one site can therefore lead to total compromise of a user’s Chrome saved credentials, and the technique is demonstrated in the Phishu framework.
Malicious npm Package Stole Files From Claude AI User Directory via GitHub

thehackernews.com · 4 months ago

A malicious npm package named mouse5212-super-formatter was found to exfiltrate files from the /mnt/user-data directory used by Anthropic's Claude AI in an operation codenamed Malware-Slop. The package masquerades as an archive deployment sync utility but authenticates to GitHub during postinstall using an environment access token or a hard coded fallback, creates a repository if needed and recursively uploads local files to a threat actor controlled GitHub account while writing fake network logs. Stolen files were stored in randomly named folders, the package leaked the operator's private token and account details, and it remained available on npm with an estimated 676 downloads before the linked GitHub account, created on May 26, 2026, became unavailable. Security researchers warned that AI assistance is lowering the bar for creating malware and may increase the volume of sloppy supply chain threats.
7-Eleven Breach: Hackers Claim 600,000 Records Stolen

www.techrepublic.com · 4 months ago

A system intrusion at 7-Eleven on April 8 exposed internal systems used to store franchise application documents, and breach notification letters dated May 1 said attackers accessed personal information submitted during the application process including names, addresses, phone numbers and dates of birth. Analysis of leaked files linked to the incident estimated roughly 185,300 affected individuals and reported Social Security numbers in a subset of records, while the extortion group ShinyHunters claims to have stolen more than 600,000 records from a connected Salesforce environment and later published a 9.4 gigabyte archive, although 7-Eleven has not officially attributed the breach to that group. 7-Eleven hired a forensic investigation firm, is offering up to 24 months of identity theft protection and CyberScan monitoring through IDX, and cybersecurity experts say ShinyHunters increasingly targets Salesforce related environments through phishing, third party integrations and cloud misconfigurations while the FBI warns organizations not to pay extortion demands.
FastAPI-based AI tools exposed to authentication bypass by flaw in Starlette framework

www.csoonline.com · 4 months ago

A single malformed character in an HTTP Host header can allow an unauthenticated attacker to bypass access controls in applications built on the Starlette Python framework that powers FastAPI, an issue tracked as CVE-2026-48710. The flaw stems from Starlette rebuilding the request address by joining the Host header to the path while validating the combined URL and its parts with different rules, so a Host value containing a slash, question mark, or hash can shift where the path begins and cause middleware or endpoints to see a different path than the server routes. Researchers demonstrated that the bug can turn a forbidden response into a successful one without credentials, enabling authentication bypass and potentially chaining into server side request forgery and in some cases remote code execution against downstream projects, and it affects model serving tools, proxies, gateways and other FastAPI ecosystem components. Maintainers released a patch and advised upgrading to Starlette version 1.0.1 or later, with severity rated between CVSS 6.5 by the maintainer and 7.0 by the researchers, and a public test was published to help detect vulnerable deployments.
MalShark: MCP-Powered Malware Traffic Analysis — Benchmarked Against Real Malware

mohitdabas.in · 4 months ago

MalShark is an MCP server that wraps tshark to provide AI-accessible malware traffic analysis, allowing a user to drop a pcap, request analysis in plain English, and receive a structured forensic report. Its toolset runs multiple tshark passes in parallel and includes pcapsummary, extractiocs, c2beaconing, finddownloads, extractcredentials, httpsessions, detectdnstunneling, and live capture to detect DNS and TLS SNI indicators, non‑TLS traffic on port 443, and SYN‑only offline C2s. Every detection rule is validated against real malware samples in a blind benchmark process; example results include a May 8, 2026 macOS Shub stealer sample with six of six network IOCs detected and a May 22, 2026 SmartApeSG to NetSupport RAT sample with 87 percent detection coverage, and the project documents fixes such as SYN‑only detection and SNI‑based false positive suppression driven by those samples.
Vulnerability in Popular Conference Software Granted Attackers a 100% Talk Acceptance Rate

www.securityweek.com · 4 months ago

Researchers at Novee discovered a high severity account takeover vulnerability in the open source call for papers and scheduling platform Pretalx. The flaw tracked as CVE-2026-41241 is a stored cross site scripting issue that allowed registered speakers to embed code that executed in an organizer's browser when submissions were searched, enabling silent account compromise. Many conferences share the same Pretalx codebase so an attacker could submit booby trapped proposals across events and, in practice, achieve a one hundred percent talk acceptance rate, and the issue was patched in Pretalx version 2026.1.0.
FBI’s 2025 Internet Crime Report

www.schneier.com · 4 months ago

There were 1,008,597 complaints to the Internet Crime Complaint Center in 2025 reporting $20.9 billion in losses, a roughly 26 percent increase from 2024. Cryptocurrency-related scams produced the largest share of losses, with about 181,565 complaints and roughly $11.36 billion reported, while investment scams overall accounted for about $8.6 billion. For the first time the report separated AI-related complaints, documenting about 22,364 AI-nexus complaints and $893 million in losses, and it also identified business email compromise and account takeover as high-cost threats. The report highlighted emerging tactics such as deepfakes, QR code lures, and rising bitcoin ATM fraud that criminals use to move funds quickly and irreversibly.
Can you enforce strong Active Directory password rules without frustrating users?

www.bleepingcomputer.com · 4 months ago

There are practical ways to enforce strong Active Directory password policies without frustrating users, including prioritizing passphrases by raising minimum length for example to 15 characters, blocking weak and breached passwords, and avoiding frequent mandatory expirations unless a compromise is suspected. Organizations should pair these controls with approved password managers, secure self-service password resets verified with multi factor authentication, clear expiry and lockout notifications, and real time, specific feedback at password creation to reduce helpdesk tickets and risky workarounds. Continuous breached password checking and custom banned word lists stop reused or compromised credentials at creation, while length based aging can reward longer passwords with extended expiry, improving resilience without increasing support burdens.
A week after Dutch FIOD seized 800+ servers, the hosting network's ASN (AS209847) is still scanning at its normal daily rate

ellio.tech · 4 months ago

Dutch law enforcement FIOD seized more than 800 servers and arrested two operators on May 18, yet scanning from the bulletproof hosting network's ASN ranges has largely continued. About a third of recently active ranges including legacy Stark blocks 94.131.105.0/24 and 92.118.232.0/24 were withdrawn from global routing while surviving ranges under AS209847 WorkTitans THE.Hosting remain announced and continue scanning at the network's normal daily rate. Sibling ASNs AS213999 and Moscow based AS33993 are still routed but currently idle. Recent activity skews toward database and industrial control system discovery including MongoDB Redis PostgreSQL Oracle LDAP and protocols DNP3 and EtherNet IP alongside known exploit probes targeting CVE-2017-17215 and WinRM.
Spencer Pratt Wants to Be Mayor. His Fans Want Him to Be Batman.

www.nytimes.com · 4 months ago

There is an AI-generated video that casts Spencer Pratt as a Batman-like vigilante in a viral campaign ad portraying Los Angeles as a dystopian landscape and depicting Mayor Karen Bass and other leaders as corrupt figures. The video, created by outside supporters and reposted by Pratt, has racked up millions of views and prompted widespread debate over the use of artificial intelligence in political messaging, with some officials and commentators criticizing the violent imagery while others praise its persuasive creativity. Observers and campaign experts warn that AI-generated ads could rapidly reshape political advertising even as it remains uncertain whether viral AI spectacles will translate into actual votes.
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees

thehackernews.com · 4 months ago

There are five practical steps to manage shadow AI without slowing employees: build a full inventory of AI tools including OAuth apps, browser extensions, and embedded vendor AI; write a usable AI governance policy specifying approved tools, data classification, and data training opt-out requirements; create a fast approval lane using structured intake and evaluation criteria; and provide browser-native monitoring and just-in-time coaching to make secure choices easy. Across most organizations, employees run three to five AI tools daily that often bypass network controls by accessing data through browser sessions or OAuth, and Gartner reports 69 percent of organizations suspect or have confirmed prohibited AI tool use while only 37 percent have an AI governance policy. When security teams publish an open approved tool list, shorten review turnaround, and give real-time visibility, shadow AI usage typically declines as employees prefer approved alternatives.
Glassworm botnet disrupted after resilient C2 infrastructure takedown

www.bleepingcomputer.com · 4 months ago

The Glassworm botnet that targeted developers with malicious extensions and software supply chain attacks has been disrupted after researchers deprived it of a resilient command and control infrastructure that used Solana blockchain memo fields, the BitTorrent distributed hash table, a public calendar service, and traditional servers. On May 26, 2026, CrowdStrike, Google, and The Shadowserver Foundation coordinated a takedown that cut off the botnet’s four C2 channels simultaneously, preventing infected machines from receiving new instructions. Following the disruption, compromised hosts are now beaconing to an address operated by CrowdStrike, and organizations are advised to look for that network indicator and use published YARA rules to confirm and remediate infections.
Link11 is fully committed to Europe and is opening a Customer Excellence Hub in Lisbon

gbhackers.com · 4 months ago

On May 27, 2026, Link11 announced it is opening a Technical Customer Excellence Hub in Lisbon and relocating its technical customer service operations to the European Union. The European cloud based IT security provider, which specializes in network and web application security, said the move is intended to strengthen its commitment to digital sovereignty and centralize technical customer support within Europe. The new hub will serve as a regional center for customer excellence and support Link11's continued expansion across European markets.
SecurityWeek to Host AI Risk Summit August 11-12 at the Ritz-Carlton, Half Moon Bay

www.securityweek.com · 4 months ago

SecurityWeek will host the 2026 AI Risk Summit on August 11 and 12, 2026, at the Ritz Carlton in Half Moon Bay, California. Now in its third year, the summit will bring together CISOs, security leaders, AI researchers, developers, policymakers, and enterprise risk professionals for keynote presentations, expert panel discussions, fireside chats, technical briefings, and networking focused on securing enterprise AI, adversarial AI threats, deepfakes and misinformation, AI governance and compliance, risk management frameworks, and protecting sensitive data in AI workflows. The call for presentations is open through May 31, 2026, and registration includes a discounted rate of one thousand seven hundred ninety five dollars available until May 31, 2026.
Teachers Union Urges Schools to Curb A.I. Chatbots and Screen Time

www.nytimes.com · 4 months ago

The American Federation of Teachers recommended that students in second grade or younger have no screens at all in school. The union also urged that A.I. chatbots be barred from use by students in elementary school.
HN Security - AI Reporter - Let's automate reporting in Burp Suite!

hnsecurity.it · 4 months ago

AI Reporter is a Burp Suite extension that automatically generates structured vulnerability findings from HTTP request and response pairs using Burp AI, a local Ollama instance, or any OpenAI compatible service. The tester right clicks a request, selects Report with AI, provides a vulnerability title severity and confidence, and the extension creates a Burp issue and can export findings as Markdown ready for reports. Features include editable prompts and templates, dynamic tags to inject request data, a lightweight chat tab, support for Community Edition via local models, and the option to avoid sending data to third parties by using a local model, while cloud based AI usage consumes credits and Burp Suite Pro currently includes 10,000 free AI credits.
BadHost Vulnerability Exposes Sensitive AI Agent Server Endpoints to Attackers

gbhackers.com · 4 months ago

There is a critical vulnerability called BadHost, tracked as CVE-2026-48710, in the Starlette web framework that lets attackers craft malicious Host headers to control request.url and bypass path-based authentication middleware. Thousands of FastAPI and Starlette applications used across AI infrastructure, including vLLM, LiteLLM, Model Context Protocol servers, OpenAI-compatible APIs and various AI agent frameworks, are affected and exploitation does not require authentication. Successful exploitation can expose protected model endpoints, prompt data and API keys, and enable unauthorized use of compute resources or lateral movement within AI environments. Mitigations include upgrading to Starlette version 1.0.1 or later, validating and normalizing Host headers at reverse proxies and application layers, avoiding path-based auth in middleware in favor of route-tied mechanisms or using the ASGI scope path, and deploying RFC-compliant reverse proxies.
Cybersecurity Evolution: How We Went From Perimeter Defense to AI-Native Security

www.darkreading.com · 4 months ago

The cybersecurity industry has shifted from a narrow focus on antivirus and firewalls in 2006 to a strategic, board-level priority driven by cloud, mobile, the Internet of Things, and now artificial intelligence. Infrastructure changes such as widespread cloud migration and the proliferation of connected devices expanded the attack surface and forced defenses to move from perimeter appliances to software and service-based platforms. Industry spending has moved heavily toward security software and consolidated platforms like SASE, zero trust, and XDR, with analysts projecting software to account for roughly half of security spending by 2026. As AI drives the next wave of innovation, defenders are adopting diverse telemetry, stronger identity and data protection, and platform consolidation while still relying on fundamentals such as patching and proper access management.
RevEng.AI Raises $15 Million to Hunt for Flaws and Backdoors in Software Binaries

www.securityweek.com · 4 months ago

RevEng.AI raised $15 million in a Series A investment led by the NATO Innovation Fund with participation from Sands Capital, In-Q-Tel, IQ Capital, and Episode One, bringing the startup's total funding to $19.5 million. The London-based company uses an AI model called BinNet to analyze compiled software at the binary level without access to source code, enabling automated detection of vulnerabilities, hidden backdoors, dangerous behaviors, and abnormal release changes. BinNet, reportedly trained with allied government cyber units and commercial security teams, can analyze software in seconds and integrates with existing security and software delivery workflows to verify the integrity of closed-source, internally developed, and third-party software.
FBI warns of in-person data theft attacks from extortion gang

www.bleepingcomputer.com · 4 months ago

The FBI warns that the Silent Ransom Group, also known as Luna Moth, Chatty Spider, and UNC3753, is targeting U.S. law firms with in-person data theft attacks. Actors pose as IT support via phone calls or phishing to obtain remote desktop access and, if that fails, will travel to a victim site to plug in USB drives or external hard drives to steal data. Stolen data is used to extort victims through ransom emails that threaten to sell or post it on leak sites and by calling employees or clients to pressure victims into paying; indicators include unauthorized external drives and unidentified individuals claiming to be IT support. The group has been active since at least 2022 and has targeted legal and financial organizations in the United States since early 2023.
CISA Warns LiteSpeed cPanel Plugin Vulnerability Is Being Exploited in Attacks

gbhackers.com · 4 months ago

On May 26, 2026, CISA added a critical LiteSpeed cPanel Plugin vulnerability to its Known Exploited Vulnerabilities catalog and confirmed active exploitation in the wild. The flaw, tracked as CVE-2026-48172, stems from improper privilege management and allows any authenticated cPanel user to execute arbitrary scripts with root level permissions, enabling full server takeover and lateral movement in multi tenant hosting. CISA mandated remediation by May 29, 2026 under Binding Operational Directive 22 01 and organizations are urged to apply vendor patches immediately or disable or restrict the plugin, audit accounts, monitor logs, and enforce strict access controls to reduce exposure.
GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure

thehackernews.com · 4 months ago

CrowdStrike, working with Google and the Shadowserver Foundation, simultaneously disrupted all command and control channels used by GlassWorm, a persistent software supply chain campaign that has targeted software developers since at least early 2025. The campaign delivered trojanized Visual Studio Code extensions and compromised npm and Python packages to install a data theft framework that harvests developer credentials and crypto wallets, deploys a WebSocket based JavaScript RAT, installs malicious Chrome extensions, and converts infected hosts into SOCKS proxies, hidden VNC servers, and remote execution nodes. GlassWorm relied on four resilient C2 layers including Solana blockchain memo fields, the BitTorrent DHT, Google Calendar event titles, and commercial VPS hosts, and the coordinated takedown neutralized those channels so infected machines can no longer receive new instructions, with CrowdStrike attributing the operation to likely Russia based actors.