Blahalla

Indian APT 'Sloppy Lemming' Targets Defense, Critical Infrastructure

www.darkreading.com · 4 months ago

An India-linked advanced persistent threat group, known as Sloppy Lemming, has intensified cyber operations targeting organizations in Pakistan, Bangladesh, and other South and Southeast Asian nations. The group has transitioned from using common tools to developing custom tooling written in the Rust programming language and expanding its command-and-control infrastructure to over 100 domains utilizing Cloudflare’s serverless Workers. Their tactics include phishing, credential theft, and using malicious documents containing keyloggers. Cybersecurity researchers note operational security lapses despite increased sophistication, and several other India-linked groups, such as Fishing Elephant and Mysterious Elephant, operate with distinct focuses and potentially separate goals.

Free Exploit Development CTFs + Walkthroughs Based On Real CVEs

zeropath.com · 4 months ago

ZeroPath has created Capture The Flag exercises to educate users about exploit development. These exercises are built around synthetic vulnerabilities that mirror real-world flaws, including one similar to CVE-2017-1000367. The synthetic vulnerability involves unsafe input parsing and race conditions that allow for output redirection as root. Educational resources such as hints, solutions, and video walkthroughs are provided to assist learners.

Signed malware impersonating workplace apps deploys RMM backdoors

www.microsoft.com · 4 months ago

Cybercriminals are using a complex phishing campaign to distribute malware disguised as familiar applications such as Microsoft Teams and Adobe Reader. Attackers are leveraging compromised digital certificates from TrustConnect Software to deploy remote monitoring and management tools like ScreenConnect, Tactical RMM, and Mesh Agent, granting them persistent remote access. Microsoft recommends using Windows Defender Application Control or AppLocker to block unauthorized software, enforcing multi-factor authentication, and utilizing Microsoft Defender threat hunting capabilities. Microsoft Sentinel users can use TI Mapping analytics to detect and respond to the threat.

Microsoft: Hackers abuse OAuth error flows to spread malware

www.bleepingcomputer.com · 4 months ago

Hackers are exploiting a legitimate process called OAuth to bypass security measures and deliver malware. These attacks primarily target government and public sector organizations through phishing emails disguised as legitimate requests such as e-signatures or meeting invitations. Attackers create malicious applications to redirect users to phishing pages, sometimes bypassing multi-factor authentication and automatically filling in credentials. The malware then utilizes malicious shortcut files to launch PowerShell, perform reconnaissance, and load additional payloads.

Vehicle Tire Pressure Sensors Enable Silent Tracking

www.darkreading.com · 4 months ago

Researchers have demonstrated the ability to track vehicles using data transmitted from tire pressure monitoring systems, or TPMS. A network of inexpensive receivers captured over six million transmissions from approximately 20,000 vehicles over ten weeks. The TPMS sensors transmit unique identifiers in clear text, allowing researchers to link signals to specific vehicles and infer movement. This wireless communication is susceptible to eavesdropping and tracking from distances up to 50 meters, potentially revealing details about a driver's habits and vehicle type.

Qualcomm Zero-Day Exploited in Targeted Android Attacks

www.darkreading.com · 4 months ago

Android devices are facing a new security threat due to vulnerabilities in Qualcomm chipsets. CVE-2026-21385, a high severity integer overflow issue, is under limited and targeted exploitation, potentially by a nation-state or commercial surveillance vendor. Another vulnerability, CVE-2026-0047, is a critical local privilege escalation flaw that could lead to remote code execution. Patches are available from Qualcomm and the Android Open Source Project, but consumers rely on device manufacturers to implement them.

Iranian Strikes on Amazon Data Centers Highlight Industry’s Vulnerability to Physical Disasters

www.securityweek.com · 4 months ago

Recent drone strikes in the Middle East have damaged three Amazon Web Services data centers, causing structural damage and disrupting power. The incidents, which affected facilities in the United Arab Emirates and Bahrain, resulted in localized disruptions but Amazon advised customers in the region to migrate their data. Experts note that while data centers are designed with redundancies, multiple facility failures within an availability zone can cause significant problems. The attacks underscore the vulnerability of cloud computing infrastructure to physical disasters.

California fines national high school ticketing platform $1.1 million for privacy violations

therecord.media · 4 months ago

California regulators have fined PlayOn Sports one point one million dollars for privacy violations. The company’s GoFan platform, used nationwide for high school ticketing and streaming, allegedly tracked users without providing a clear way to opt out. California law requires companies to offer their own opt-out tools, which PlayOn Sports bypassed. The company is now required to improve its privacy disclosures and opt-out methods, ensuring compliance with state regulations protecting consumer data.

Phishing Lures Utilizing a Single Google Cloud Storage Bucket

malwr-analysis.com · 4 months ago

A sophisticated phishing campaign is using Google Cloud infrastructure to bypass security filters and target users. Attackers host malicious HTML files on Google Cloud Storage, using seemingly legitimate URLs to redirect users to third-party sites designed for credit card harvesting. The emails employ diverse social engineering tactics, ranging from account urgency and security fears to retail incentives and health promotions. To mitigate this threat, users should inspect redirect paths, verify sender metadata, and report abuse to Google.

LexisNexis says hackers accessed legacy data in contained breach

therecord.media · 4 months ago

LexisNexis has confirmed a data breach where threat actors accessed and leaked legitimate data from a cybercriminal forum. Hackers claimed to have stolen 2 gigabytes of information, including contact details, account records, passwords, and IT incident tickets. The company reports the compromised data primarily consists of legacy information from before 2020 and has been contained, with no impact to current products and services. LexisNexis engaged a cybersecurity firm and notified impacted customers, but did not disclose details about a ransom demand or when the intrusion occurred.

Motorola Plans GrapheneOS-Compatible Devices as Early as 2027

www.techrepublic.com · 4 months ago

false

Google urges Supreme Court to strike down geofence warrants as unconstitutional

therecord.media · 4 months ago

false

Speakeasies to Shadow AI: Banning AI Browsers Will Fail

www.darkreading.com · 4 months ago

Gartner recently suggested enterprises ban AI browsers due to potential data leakage, prompt injection vulnerabilities, and connections to unknown services. However, a ban is likely to be ineffective, as employees will circumvent restrictions to utilize these tools for increased productivity, similar to the failure of alcohol Prohibition. Instead of bans, organizations should focus on controlled enablement through context-aware data loss prevention, identity-based access controls, and browser-layer security to monitor and manage associated risks within the user's browsing environment. Ultimately, adapting to user behavior and implementing practical controls is a more effective approach than outright prohibition.

IPVanish VPN macOS Privilege Escalation

blog.securelayer7.net · 4 months ago

A critical privilege escalation vulnerability in the IPVanish VPN macOS privileged helper allows any local unprivileged process to execute arbitrary code as root without user interaction. The flaw stems from an unauthenticated XPC Mach service that accepts parameters such as OpenVPNPath directly from clients without path or signature validation, combined with a logic error in code signature verification that permits unsigned scripts to be copied into root owned directories and executed via OpenVPN hooks. The issue is rated CVSS 8.8 and listed as CVE pending, and recommended mitigations include implementing XPC caller authentication, validating calling process signatures and entitlements, and enforcing strict path and signature checks before launching privileged processes.

Generate 45+ honeytokens with no sign-up required and no paywall

lab.neroswarm.com · 4 months ago

false

Chrome Extension Hijacked to Deliver Malware, Steal Crypto Wallets

www.techrepublic.com · 4 months ago

A Chrome extension called QuickLens, previously with 7,000 users and a featured badge, was compromised and updated to distribute malware. The malicious update removed browser security headers, enabling clickjacking and script injection attacks while also stealing cryptocurrency wallet seed phrases and other sensitive data like Gmail content and login credentials. The extension communicated with a command-and-control server to deliver payloads, including a fake Google Update prompt initiating a ClickFix attack and targeting cryptocurrency wallets like MetaMask and Coinbase Wallet. Google has removed the extension from the Chrome Web Store and disabled it in affected browsers.

Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations

thehackernews.com · 4 months ago

Cybercriminals are employing a deceptive tactic impersonating IT support to compromise organizations. The attacks begin with spam emails, followed by phone calls where attackers convince victims to grant remote access, often using tools like AnyDesk or Quick Assist. Once access is gained, a fake Microsoft page is used to harvest credentials and deploy a malicious DLL that installs the Havoc command-and-control framework, enabling data exfiltration or ransomware deployment. Attackers are also utilizing legitimate remote management tools to maintain persistence.

Google Chrome shifts to two-week release cycle for increased stability

www.bleepingcomputer.com · 4 months ago

false

Hacktivists Claim DHS Breach, Leak 6,600+ ICE Contractor Records

www.techrepublic.com · 4 months ago

A self-described hacktivist group, calling itself “Department of Peace,” claims to have breached Department of Homeland Security systems and released over six thousand six hundred records related to Immigration and Customs Enforcement contractor applicants. The leaked data includes company names, employee information, and government identification numbers. The group cited concerns over ICE operations and referenced deaths that prompted protests as justification for the release. The Department of Homeland Security has not yet confirmed the breach.

They seized $4.8m in crypto… then gave the master key to the internet

www.bitdefender.com · 4 months ago

South Korea's National Tax Service accidentally revealed a cryptocurrency wallet's recovery phrase in a public press release, leading to the theft of approximately $4.8 million in Pre-Retogeum (PRTG) tokens. The compromised wallet contained roughly 4 million PRTG tokens, representing 40% of the token’s total supply. The thief may face difficulties liquidating the stolen cryptocurrency due to its obscurity and limited trading volume. Authorities have since removed the press release and issued an apology for the security lapse.

The British Watch Brand Apiar Goes Beyond Traditional Constraints

www.nytimes.com · 4 months ago

false

Fig Security Launches With $38 Million to Bolster SecOps Resilience

www.securityweek.com · 4 months ago

false

Red Teaming LLM Web Apps with Promptfoo: Writing a Custom Provider for Real-World Pentesting

fortbridge.co.uk · 4 months ago

A penetration test of an enterprise LLM assistant with a RAG pipeline required building a custom promptfoo provider to handle a non-standard four-step API flow consisting of create chat, send query, poll for completion, and fetch answer. The provider parsed structured response blocks to extract the assistant’s main output while ignoring internal reasoning and tool-attributed blocks to avoid leaking chain of thought, and forced all traffic through Burp Suite using raw socket requests so the ATOR extension could transparently refresh fifteen minute Bearer tokens. Automated promptfoo runs using a local Llama 3.3 70B grader and RAG-specific plugins with multi-turn strategies such as Crescendo and Mischievous User uncovered diverse failures including multi-turn jailbreaks, RAG document exfiltration, and prompt injection variants, with each automated finding validated manually. The recommended practice is to budget time to reverse-engineer non-standard APIs, pair promptfoo with Burp and a local grading model, disable remote generation and telemetry for confidentiality, and implement a custom provider to enable repeatable, multi-turn LLM red teaming.

LexisNexis confirms data breach as hackers leak stolen files

www.bleepingcomputer.com · 4 months ago

LexisNexis Legal & Professional has confirmed a data breach after hackers leaked stolen files online. The breach occurred when a threat actor exploited a vulnerability in an unpatched React frontend application, gaining access to the company’s AWS infrastructure. Compromised data included customer names, user IDs, and business contact information, though sensitive personal or financial information was not affected. The attackers, known as FulcrumSec, accessed over 3.9 million database records and criticized the company’s security practices related to AWS Secrets Manager. The vulnerability exploited was CVE-2023-41717, known as React2Shell.

Honeywell, Researcher Clash Over Impact of Building Controller Vulnerability

www.securityweek.com · 4 months ago

A cybersecurity researcher has identified a vulnerability in Honeywell’s IQ4 building management controller, allowing unauthorized access and potential control of building systems. The device’s web interface is reportedly accessible without authentication in its default settings, and attackers might create administrator accounts before authorized users configure the system. Honeywell disputes the severity, stating the issue occurs only during installation and can be resolved with a reset, though the researcher claims to have observed active control of equipment even before full setup. A pending CVE is associated with this vulnerability.

Western allies form 6G security coalition amid tech rivalry with China

therecord.media · 4 months ago

false

Compromised Site Management Panels are a Hot Item in Cybercrime Markets

www.bleepingcomputer.com · 4 months ago

Compromised cPanel credentials are being openly sold in underground cybercrime markets, often at commodity pricing. Threat actors leverage these credentials for phishing, spam campaigns, and data theft, gaining abilities like deploying malware and creating admin users. These credentials are typically obtained through stolen logins, exploiting website vulnerabilities, or misconfigurations like exposed files and weak passwords. Researchers analyzed over 200,000 posts referencing cPanel access, revealing a structured ecosystem where pricing tiers and quality differentiation exist, with premium cPanels commanding higher prices due to factors such as active SMTP servers and hosting locations. Organizations should implement multi-factor authentication and robust monitoring to mitigate the risk of compromise.

Florida woman gets 2 year sentence for trafficking Microsoft software labels

therecord.media · 4 months ago

false

Building a High-Impact Tier 1: The 3 Steps CISOs Must Follow

thehackernews.com · 4 months ago

false

Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries

thehackernews.com · 4 months ago

A threat actor, suspected to be Russian-speaking, has been using an open-source artificial intelligence security tool called CyberStrikeAI to target Fortinet FortiGate appliances in a campaign spanning 55 countries. The tool was developed by a China-based developer, Ed1s0nZ, who has ties to the Chinese government and has published other tools related to exploitation and AI jailbreaking. The developer's activities and interactions with organizations like Knownsec 404, a company linked to Chinese state-sponsored cyber operations, raise concerns about the tool's origins and potential use. CyberStrikeAI integrates over 100 security tools for vulnerability discovery and attack-chain analysis.

Sometimes, You Can Just Feel The Security In The Design (Junos OS Evolved CVE-2026-21902 RCE) - watchTowr Labs

labs.watchtowr.com · 4 months ago

A critical remote code execution vulnerability, CVE-2026-21902, has been identified in Juniper’s PTX Series routers and systems using a DAG scheduler. Attackers can execute commands as root by manipulating the REST API or through attacker-controlled input within a command’s syntax field. This allows arbitrary code to be run on the affected devices. WatchTowr Labs’ platform is highlighted for proactive threat intelligence and exposure management related to this vulnerability.

Quantum Decryption of RSA Is Much Closer Than Expected

www.securityweek.com · 4 months ago

A new quantum decryption algorithm, the Jesse-Victor-Gharabaghi or JVG algorithm, poses a significant threat to current encryption methods. The JVG algorithm requires substantially fewer quantum resources, potentially less than 5,000 qubits, to break RSA and Elliptic Curve Cryptography, significantly reducing the estimated timeline for quantum decryption. Unlike Shor's algorithm, JVG utilizes classical computing for more tasks and employs a quantum number theoretic transform which is more noise tolerant. Experts recommend accelerating the transition to post-quantum cryptography through crypto-agility and vendor roadmaps to mitigate the risk.

Iranian drone strikes hit Amazon data centers in Gulf, disrupting cloud services

therecord.media · 4 months ago

Iranian drone strikes recently targeted three Amazon data center facilities in the UAE and Bahrain, disrupting cloud services across the Middle East. Amazon confirmed that two data centers in the UAE were directly hit, while a facility in Bahrain sustained damage, affecting approximately 60 Amazon Web Services. The attacks caused structural damage, power disruptions, and water damage, prompting local authorities to shut off power. Amazon is working to restore infrastructure and advises customers to back up data and migrate applications.

New ‘AirSnitch’ Attack Shows Wi-Fi Client Isolation Could Be a False Sense of Security

www.securityweek.com · 4 months ago

Researchers have discovered vulnerabilities allowing attacks to bypass client isolation in Wi-Fi networks, potentially exposing users to data interception and malware. The attacks exploit weaknesses in how Wi-Fi keys are managed, inconsistencies in layer enforcement, and synchronization issues within the network stack. These methods, termed GTK abuse, gateway bouncing, and a Machine-in-the-Middle attack, affect networks in homes, workplaces, airports, and coffee shops, with every tested network exhibiting at least one vulnerability. The researchers attribute the problem to a lack of standardization in client isolation implementations and warn that comprehensive solutions will require ecosystem-wide coordination.

SloppyLemming Espionage Campaign Targets Pakistan, Bangladesh with BurrowShell Backdoor and Rust RAT

gbhackers.com · 4 months ago

A cyber espionage group, SloppyLemming, linked to India, has been conducting a year-long campaign targeting government agencies and critical infrastructure in Pakistan and Bangladesh. Attackers use spear-phishing tactics involving malicious PDF lures and macro-enabled Excel files to deploy custom malware, including a BurrowShell backdoor and a Rust-based remote access tool (RAT) for keylogging and reconnaissance. The group has significantly expanded its use of Cloudflare Workers for command and control, but operational security lapses have exposed their tooling. Security professionals should monitor for suspicious ClickOnce deployments, inspect outbound HTTPS traffic, and block known malicious hostnames.

1.2 Million Affected by University of Hawaii Cancer Center Data Breach

www.securityweek.com · 4 months ago

A ransomware attack compromised the personal information of approximately 1.2 million people at the University of Hawaiʻi Cancer Center. The incident, which occurred August 31, 2025, impacted research servers but not clinical operations or patient care. Records of over 87,000 study participants and data from approximately 1.15 million unrelated individuals were affected, including names, Social Security numbers, and driver’s license details. The university is offering impacted individuals free credit monitoring and identity theft services.

New Starkiller Phishing Framework Uses Real Login Pages to Bypass MFA Security

gbhackers.com · 4 months ago

A new phishing framework called Starkiller is emerging as a sophisticated “phishing-as-a-service” tool, designed to bypass multi-factor authentication. Starkiller uses a live reverse proxy to display genuine login pages and steal session cookies/tokens after authentication, enabling account takeover. Operators can easily deploy phishing flows through a control panel, with features including keystroke logging, geo-tracking, and URL masking to obscure malicious destinations. Security experts recommend prioritizing phishing-resistant authentication methods like FIDO/WebAuthn and tightening email and URL controls to mitigate this threat.

OAuth phishers make ‘check where the link points’ advice ineffective

www.csoonline.com · 4 months ago

Attackers are exploiting a feature of the OAuth authentication protocol to redirect users to malicious websites, even when the initial link appears legitimate. The phishing emails impersonate common requests, such as password resets or meeting invites, and manipulate parameters within the OAuth link to trigger a redirect to attacker-controlled pages. These redirects have delivered malware and credential-harvesting tools, exhibiting pre-ransomware behaviors. Experts recommend validating the context of authentication requests and improving OAuth application governance within organizations.

AI Agent Overload: How to Solve the Workload Identity Crisis

www.darkreading.com · 4 months ago

false

Malvertising Actor ‘D-Shortiez’ Exploits WebKit Back-Button Hijack in Forced-Redirect Campaign

gbhackers.com · 4 months ago

A threat group known as D-Shortiez is exploiting a flaw in WebKit, affecting Safari and other iOS browsers, to hijack the back button and redirect users to malicious websites. This technique, reminiscent of older browlock scams, involves manipulating browser history to trap users on fraudulent landing pages promoting scams. The campaign has generated over 300 million malicious ad impressions primarily targeting users in the United States and Canada. Security researchers have reported the issue to Apple and recommend users close tabs instead of using the back button when encountering suspicious redirects.

Jetzt Staats-CISO werden – für unter 160.000 Euro

www.csoonline.com · 4 months ago

false

Android Update Patches Exploited Qualcomm Zero-Day

www.securityweek.com · 4 months ago

Google has released new Android security updates addressing nearly 130 vulnerabilities. A significant issue, CVE-2026-21385, impacts Qualcomm graphics components and could allow attackers to gain unauthorized control, with indications of limited, targeted exploitation. The March 2026 security bulletin includes fixes for vulnerabilities in several components, including a critical System component flaw allowing remote code execution. Updates are available as security patch levels 2026-03-01 and 2026-03-05, with Wear OS also receiving related fixes.

Shannon: Autonomous AI Tool with Nmap Integration Can Uncover and Exploit Security Flaws

gbhackers.com · 4 months ago

Keygraph has released Shannon, an AI-powered penetration testing tool that autonomously identifies and exploits vulnerabilities in web applications. It uses a four-phase process including reconnaissance, vulnerability analysis, exploitation, and reporting, combining code analysis with real-world attack validation. Shannon achieved a 96.15% success rate on a benchmark and discovered over 20 critical vulnerabilities in one test, with editions available as open source or a commercial enterprise product. The tool is designed for use in sandboxed environments and utilizes tools like Nmap for reconnaissance.

Built a free live CVE intelligence dashboard — looking for feedback

www.leakycreds.com · 4 months ago

A large number of vulnerabilities have been recently identified, with several rated as critical. These vulnerabilities include authentication bypasses in OpenMQ, User Registration systems, and All-in-One Microsoft 365 login, alongside SQL injection flaws in the code-projects Simple Food Order System. Several vulnerabilities also exist in Tenda devices, including command injection and buffer overflows, as well as remote code execution vulnerabilities in products like Twenty CRM and Chamilo. These issues range in severity, affecting various systems and software.

Iran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay Low

www.securityweek.com · 4 months ago

Following recent US and Israeli strikes against Iran, hacktivist activity has increased, but state-sponsored cyberattacks from Iran remain subdued. Cybersecurity firms have observed website defacements, DDoS attacks, and claims of compromised systems by pro-Iran groups, though many of these claims lack verification. Several groups, including FAD Team and Fatimion Cyber Team, have targeted Israeli and allied entities, while others like Handala Hack team are active on Telegram and X. While overall state-sponsored cyber activity has not significantly escalated, security officials advise organizations to review their defenses and remain vigilant.

On Moltbook

www.schneier.com · 4 months ago

false

Zerobot Malware Exploits Tenda Command Injection Vulnerabilities to Deploy Malicious Payloads

gbhackers.com · 4 months ago

A new malware campaign, dubbed Zerobot, is exploiting vulnerabilities to build a botnet and compromise systems. The campaign utilizes CVE-2025-7544, a buffer overflow in Tenda AC1206 routers, and CVE-2025-68613, a remote code execution flaw in the n8n automation platform. Exploitation involves deploying a Mirai-based payload, Zerobotv9, which downloads and executes a malicious script from an external server. This activity was first observed in January 2026, targeting both traditional IoT devices and enterprise automation infrastructure.

Amazon: Drone strikes damaged AWS data centers in Middle East

www.bleepingcomputer.com · 4 months ago

Drone strikes have damaged Amazon Web Services data centers in the United Arab Emirates and Bahrain, causing widespread outages and impacting numerous cloud computing services. The attacks, which physically damaged infrastructure and disrupted power, affected the AWS Middle East (UAE) Region and the AWS Middle East (Bahrain) Region. Amazon is working to restore infrastructure and implement software-based recovery solutions, advising customers to back up data and migrate workloads to unaffected regions. The United Kingdom’s National Cyber Security Centre has warned organizations of increased Iranian cyberattack risks due to the ongoing conflict.

HPE AutoPass Vulnerability Allows Remote Attackers to Bypass Authentication

gbhackers.com · 4 months ago

A vulnerability has been identified in Hewlett Packard Enterprise’s AutoPass License Server, allowing attackers to bypass authentication controls remotely. The issue, tracked as CVE-2026-23600, is rated 7.3 in severity and requires no privileges or user interaction to exploit. Affected versions are those prior to 9.19, and HPE recommends upgrading to version 9.19 or later to resolve the problem. Additional security measures include restricting network access and monitoring for unusual activity.

As War Continues, Pro-Iranian Actors Launch Barrage of Cyberattacks

www.darkreading.com · 4 months ago

Following a US-Israeli military action against Iran, a surge of cyberattacks has been launched by pro-Iranian actors. These attacks include distributed denial of service hits, critical infrastructure attacks, and network compromises, targeting organizations in the US, Israel, and allied nations. Groups like Cotton Sandstorm, FAD Team, and Handala Hack have claimed responsibility for various incidents, including data leaks, SQL injection campaigns, and disruptions to energy and healthcare sectors. Additionally, pro-Russian hacktivist groups are coordinating attacks in support of Iran, intensifying the cyber threat landscape.