Blahalla

GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos

www.csoonline.com · 4 months ago

A large automated campaign called Megalodon pushed 5,718 malicious commits into 5,561 public GitHub repositories within roughly six hours on May 18, 2026, modifying GitHub Actions workflows to include base64 encoded bash payloads that exfiltrate CI secrets. Attackers used compromised personal access tokens and deploy keys and forged author identities such as build-bot, auto-ci and ci-bot to push a malicious commit identified as acac5a9 without a pull request, affecting projects including Wiznet ioLibrary Driver, multiple Tiledesk repositories and persian tools, and researchers found that Tiledesk versions 2.18.6 through 2.18.12 carry the backdoor. Two payload variants, SysDiag and Optimize Build, either ran obfuscated bash on every push or used workflow dispatch to execute on demand, targeting AWS and GCP credentials, SSH keys, Kubernetes configurations, GitHub OpenID Connect tokens, source code secrets and other environment variables, and researchers advised monitoring for unexpected workflow dispatch runs and reviewing cloud audit logs for unknown token requests.
How Varonis Atlas integrates Claude Compliance API for AI governance

www.bleepingcomputer.com · 4 months ago

Varonis Atlas integrates the Claude Compliance API to ingest Claude Enterprise and Claude Platform activity into its AI security platform. This integration enables continuous monitoring of conversation content including chats uploaded files and projects, session level investigations to assess intent and misuse, and detection of sensitive data exposure jailbreak attempts and suspicious prompt patterns in real time. Atlas also surfaces audit and admin events from Claude Platform, provides real time alerts and proactive AI penetration testing to find prompt injection and jailbreak vulnerabilities, and connects AI activity to underlying data context such as permissions sensitivity classification and access so security teams can remediate exposures and enforce governance at scale.
AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security

www.securityweek.com · 4 months ago

AppOmni has launched Marlin AI to automatically analyze SaaS misconfigurations, investigate related activity across enterprise environments, and recommend remediation steps while working alongside its AskOmni assistant. Marlin uses AppOmni’s accumulated SaaS context to prioritize risks by correlating risky configuration settings with observed behaviors and supplies investigative graphs for deeper analysis. It can automate corrective actions inside the AppOmni platform through user-confirmed operations but will not perform autonomous changes to third party SaaS systems because doing so would require elevated administrative access that customers are unwilling to grant.
How journalists rely on VPNs to protect press freedom

freedom.press · 4 months ago

There are three critical ways VPNs protect journalists: they mask a journalist's IP so sensitive online research cannot be traced to a newsroom or personal location. They prevent internet service providers and investigators from easily linking reporters to confidential sources by hiding visited websites and peer to peer connections, and they encrypt traffic on untrusted WiFi to reduce exposure to some cyberattacks. VPNs do not stop phishing or device compromise, so journalists should also keep devices updated and use two factor authentication and strong passwords, and lawmakers considering or enacting VPN bans risk weakening press freedom.
Iranian APT Targets Aviation, Software Companies With Updated Tools

www.securityweek.com · 4 months ago

Nimbus Manticore, an Iranian advanced persistent threat linked to Charming Kitten with suspected ties to the IRGC and active since at least 2022, has continued operations and expanded targeting to aviation and software companies including US organizations. The group adopted AppDomain hijacking by planting trojanized XML config files to load malicious DLLs and used phishing lures and trojanized installers to deploy updated backdoors such as MiniJunk and a new 64 bit MiniFast that impersonates Chrome and provides long term persistence, remote command execution, file exfiltration, process and directory manipulation, scheduled task creation, and payload deployment. Campaigns also abused search engine optimization and fake download sites and used fraudulent hiring portals impersonating airlines, and Check Point assesses Nimbus Manticore rapidly adapts and likely used LLM based and AI assisted techniques to develop tooling and maintain infrastructure.
CERT-In Mandates 12-Hour Patch Deadline for Internet-Facing Vulnerabilities

gbhackers.com · 4 months ago

India's national cybersecurity agency CERT-In requires organizations to contain and patch known exploited vulnerabilities affecting internet facing and crown jewel systems within 12 hours where feasible, citing AI driven attackers that are shortening exploitation timelines. The 38 page blueprint sets risk based deadlines including one day for critical externally exposed vulnerabilities and known exploited internal bugs unless strong compensating controls exist, three days for critical internal high value systems, and five days for other high severity issues, and it directs isolation, access tightening, WAF or API protections, and increased monitoring where vendor patches are not available. The guidance also calls for continuous exposure management across cloud, APIs, AI systems and third party dependencies, adoption of zero trust and assume breach principles, modernization of security operations with behavior based analytics and AI assisted defensive tooling, and reporting incidents to CERT-In within six hours.
Analyzing the Taiwan High-Speed Rail (THSR) TETRA incident (part 1)

www.midnightblue.nl · 4 months ago

On April 5, 2026 at 23:23 local time an unauthorized General Alarm transmitted over the Taiwan High Speed Rail TETRA network caused several trains to halt temporarily before services began restarting at 23:43 and disruptions ended by 00:11. Analysis indicates the operation was technically simple: passive SDR captures exposed network parameters, an Individual Short Subscriber Identity was cloned into a Motorola MTP3000 series handheld radio, an accomplice likely supplied critical parameters, and police later seized multiple radios and related equipment. The network was likely unauthenticated or using TEA1 encryption, the TEA1 backdoor enables trivial 32 bit brute forcing of keys, and related vulnerabilities cited include CVE-2022-24403, CVE-2022-24402, and CVE-2025-52944 which together weaken TETRA protections and permit traffic injection despite authentication.
Microsoft Defender can now automatically isolate hacked endpoints

www.bleepingcomputer.com · 4 months ago

There is a new Microsoft Defender for Endpoint capability available in preview that automatically isolates compromised endpoints to reduce attacker lateral movement and limit impacts such as data exfiltration and ransomware propagation. Automatically isolated devices are disconnected from the network but retain connectivity to the Defender for Endpoint service for continued monitoring, and the capability applies only to onboarded end user workstations managed by Defender for Endpoint. Security operators can release devices from isolation after investigation and mitigation by selecting the device in the device inventory or on the device page and choosing release from isolation.
Webinar: Too many tools are slowing network incident response

www.bleepingcomputer.com · 4 months ago

There will be a live webinar on June 2, 2026 featuring Edgar Ortiz of Tines that examines how shifting between monitoring dashboards, infrastructure tools, ticketing systems, and communication platforms slows network incident response. The presentation will explain how fragmented workflows force responders to manually collect context, determine ownership, prioritize incidents, and coordinate actions, which can increase response times and the risk of outages. Attendees will learn how automation, AI assisted and intelligent workflows that connect systems and automate repetitive operational tasks can enrich alerts with network identity and threat context, prioritize and route incidents automatically, and streamline investigations to improve operational coordination across complex environments.
Quasar RAT Hits Developers With Fileless Linux Attacks

gbhackers.com · 4 months ago

Quasar Linux, or QLNX, is a stealthy Linux remote access trojan that targets developer and DevOps workstations to create high value beachheads for software supply chain attacks. It launches as a single ELF binary but pivots to fileless, in memory execution using memfdcreate and execveat while unlinking the on disk binary and rewriting its comm and argv to mimic kernel threads to evade detection. QLNX dynamically compiles and deploys a two tier rootkit combining user space LDPRELOAD libraries, kernel eBPF programs, and malicious PAM modules, builds a peer to peer command and control mesh over TLS, and harvests SSH keys, personal access tokens, cloud credentials, and project level secrets from common developer paths. Detection requires correlating syscall telemetry, file integrity, authentication logs and network flows, watching for anonymous memfd executions, suspicious gcc compilations producing shared objects in temporary paths, modifications to the file /etc/ld.so.preload and hidden high entropy files, and confirmed compromises should prompt full operating system wipe and reinstall.
EU Regulators Prepare Landmark Fine Against Google Under Digital Markets Act

gbhackers.com · 4 months ago

European Union regulators are preparing a landmark penalty under the Digital Markets Act against Alphabet’s Google after accusing its search engine of systematically favoring Google services such as Google Shopping, Google Maps, and Google Flights in an investigation opened in March 2025. The enforcement could result in a fine reaching several hundred million euros and potentially up to ten percent of global annual turnover, with a final decision expected before the EU summer recess pending approval by the European Commission president. The case follows prior multibillion euro antitrust penalties and raises concerns about platform neutrality, data access, algorithmic transparency, and the effect of dominant platforms on the visibility of security and trusted sources.
Remembering Tim Wilson, Whose Legacy Lives on at Dark Reading

www.darkreading.com · 4 months ago

Tim Wilson, co-founder and former editor in chief of Dark Reading, died in late November 2021 after a brief battle with cancer. He co-founded Dark Reading in May 2006, led the site for about 15 years, and pioneered formats such as webinars, virtual events, research reports, and the INsecurity conference launched in 2017 to convene CISOs and security leaders. His mentorship and entrepreneurial vision are credited with shaping Dark Reading’s editorial direction and continue to influence the outlet as it marks its 20th anniversary and expands into video, podcasts, international coverage, AI tools, and Spanish language translation.
185,000 Likely Impacted by 7-Eleven Data Breach

www.securityweek.com · 4 months ago

There are roughly 185,300 likely victims of a 7-Eleven data breach that occurred on April 8 and involved systems containing franchise documents. The leaked dataset, which ShinyHunters initially claimed contained 600,000 Salesforce records and later published, contains names, addresses, email addresses, and dates of birth, with a small subset including additional fields. 7-Eleven said names and addresses were likely exposed and the incident fits a pattern of ShinyHunters targeting Salesforce instances via phishing, third party integrations, and misconfigurations.
[THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back

thehackernews.com · 4 months ago

There are AI assisted DDoS attacks that automatically find weak spots in systems and can launch massive attacks that take businesses offline in seconds. Traditional defenses like simple firewalls and routine patching are no longer sufficient because AI attacks adapt, probe APIs and cloud misconfigurations, and do in minutes what used to take humans weeks. A 45 minute webinar and companion checklist recommend shrinking the patch window to about 12 hours, avoiding common cloud configuration mistakes, deploying automated threat detection, and following a live blueprint to secure networks quickly.
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions

thehackernews.com · 4 months ago

Microsoft has rolled out updates to fix a remote code execution vulnerability in Microsoft Office SharePoint. The flaw stems from deserialization of untrusted data and can be exploited by attackers without requiring any special conditions. The issue is tracked as CVE-2026-45659, scored 8.8 on the CVSS and rated important, and organizations are advised to apply the updates promptly.
Angular Language Service Extension Flaws Allow Remote Code Execution

gbhackers.com · 4 months ago

Multiple high severity vulnerabilities in the Angular Language Service VS Code extension Angular.ng-template enable remote code execution via malicious project files and dependencies. Attack paths include a JSDoc hover Markdown command injection that can execute command URIs from rendered tooltips and unsafe TypeScript SDK workspace handling that allows loading a malicious tsserverlibrary.js from workspace settings, both of which bypass VS Code Workspace Trust. The issues are tracked under GitHub advisory GHSA-ccq4-xmxr-8hcq, affect all versions before 21.2.4 and have been patched in the latest release. Developers are urged to upgrade to version 21.2.4 or later, review workspace settings, avoid opening untrusted repositories and packages, and enforce strict workspace trust policies.
Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations

www.securityweek.com · 4 months ago

Claude now integrates with 28 security and compliance platforms, including CrowdStrike, Palo Alto Networks, Microsoft, Okta, Zscaler, Netskope, Cloudflare, Fortinet, Wiz, Datadog, SailPoint, Snyk, Tenable, and IBM. The integrations span data loss prevention, SASE, SIEM, identity management, e discovery, and AI observability and are powered by the Claude Compliance API which gives programmatic access to conversation content such as chats uploaded files and projects and to activity event logs including user logins admin actions and configuration changes. Organizations using the supported platforms can connect and configure a Claude instance so data flows into existing dashboards and alerting workflows and Anthropic has published documentation and a process for additional vendors to join.
TrapDoor malware campaign puts developer workstations in CISO spotlight

www.csoonline.com · 4 months ago

A cross registry malware campaign tracked as TrapDoor targets developer workflows and AI coding assistant files, spanning more than 34 malicious packages and over 384 related versions across npm, PyPI, and Crates.io. The packages are designed to steal developer secrets including AWS credentials, GitHub tokens, SSH keys, browser data, environment variables, crypto wallets, and local development configuration files, and to persist on workstations to enable lateral movement into CI and CD pipelines and build infrastructure. Attackers abused normal development execution points such as npm postinstall scripts, PyPI import time execution, and Rust build scripts, and attempted to alter AI assistant files like.cursorrules and CLAUDE.md using hidden Unicode instructions to trick AI tools into exposing secrets. Recommended mitigations include treating developer environments as production adjacent infrastructure, enforcing install time scanning for malicious packages and risky behaviors, using least privilege with short lived scoped credentials, package allowlisting, hardened developer endpoints, AI tooling governance, and zero trust controls.
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

www.securityweek.com · 4 months ago

Threat actors exploited a KnowledgeDeliver zero-day to deploy Godzilla web shells and backdoors against the KnowledgeDeliver learning management system used mainly in Japan. The flaw, tracked as CVE-2026-5426 with a CVSS score of 7.5, stemmed from hardcoded machineKey values in a standardized web.config file that enabled ViewState deserialization attacks and remote code execution. Attackers used the web shell to change web application permissions, inject malicious scripts, and ultimately install a Cobalt Strike backdoor with payloads tailored to specific victims, and Mandiant provided indicators of compromise and response guidance. All KnowledgeDeliver deployments before February 24, 2026, are potentially at risk, and organizations are advised to rotate machine keys, restrict LMS access, and monitor for signs of intrusion.
China-Linked Hackers Hit SEA Edge Routers With Custom Linux Implant

gbhackers.com · 4 months ago

China-linked hackers are conducting an infrastructure-centric espionage campaign across Southeast Asia by implanting Linux edge routers with a custom 64-bit ELF remote access trojan named router.elf, deploying a redundant backdoor called clientrcstart, and installing persistent iptables rules to control downstream traffic. The router implant uses DNS over HTTPS through a public DoH provider, protects C2 configuration with a custom Xorshift-based stream cipher and XOR obfuscation, and redirects internal DNS queries to attacker-controlled services on a nonstandard port using ipset and DNAT rules to enable man-in-the-middle name resolution. The same operator pairs this with a cracked Cobalt Strike 4.4 Beacon delivered to Windows hosts via DLL sideloading of version.dll under a crash reporting executable, using identical HTTPS polling and exfiltration endpoints and overlapping infrastructure to achieve unified command and control. Indicators include the filenames router.elf, clientrcstart and version.dll, plus multiple associated domains and file hashes, and the campaign is consistent with long-term espionage targeting telecom and government networks rather than short-term financial motives.
Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images

www.securityweek.com · 4 months ago

DockSec correlates findings from multiple container security scanners, deduplicates and ranks vulnerabilities with a large language model, and generates plain English remediation guidance and exact Dockerfile fixes. Scans commonly surface large numbers of CVEs, with typical results exceeding two hundred CVEs and one example finding 183 high severity and 15 critical vulnerabilities across 15 images, and some images containing dozens of issues. The tool runs scanners locally and sends only scan metadata to the LLM, supports models from OpenAI Anthropic and Google Gemini or local models via Ollama, and has been adopted as an OWASP incubator project with growing community contributions.
Memcached SASL Flaw Exposes Usernames to Enumeration Attacks

gbhackers.com · 4 months ago

A timing side channel in Memcached SASL authentication allows remote attackers to enumerate valid usernames by measuring response time differences. The flaw is tracked as CVE-2026-47783 and affects Memcached versions before 1.6.42, caused by improper username validation that exits an internal loop early when a match is found. Developers fixed the issue in Memcached 1.6.42 by normalizing processing time during username validation and also addressed multiple memory corruption, crash, and protocol handling bugs. Organizations are urged to upgrade to version 1.6.42 immediately to mitigate username enumeration and related risks.
MFA Prompt Bombing: Why Your Second Factor Isn't Saving You

thehackernews.com · 4 months ago

Push based multi factor authentication is vulnerable to prompt bombing, where attackers with valid credentials repeatedly trigger approval prompts and often pair those prompts with vishing to wear down or trick users into approving access. A 2022 breach involving Cisco shows the method can succeed against mature defenses, as attackers harvested VPN credentials from a synced Google account, pushed prompts until an employee approved, enrolled attacker devices, escalated privileges, and exfiltrated about 2.8 gigabytes of data. Organizations can reduce risk by adopting phishing resistant factors such as FIDO2 security keys or number matching, blocking compromised passwords at the source, and enforcing conditional access that uses geography, device posture, and login time to stop suspicious logins before a prompt is sent.
Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries

www.securityweek.com · 4 months ago

Lithuanian authorities are on high alert after a data leak of more than 600,000 entries from national registers that is believed to have been executed by a foreign country. The leak was primarily from real estate and legal entity registers and was carried out using login credentials of institutions authorized to access the data, prompting the resignation of the head of the State Enterprise Centre of Registers Adrijus Jusas. Authorities blocked suspected user accounts, required credential updates, and restricted access while the prosecutor’s office investigates suspected foreign involvement; no nation was specified, though officials noted Lithuania is a primary target of hybrid operations and an opposition politician suggested Russian intelligence may be responsible without providing evidence. Officials warned that addresses of intelligence officers, military personnel, diplomats and politicians may have been exposed, raising concerns about potential spying or pressure against those individuals.
NightSpire Ransomware Abuses RDP for Stealthy Persistence

gbhackers.com · 4 months ago

There are reports that NightSpire emerged in early 2025 and within a three month window from March to June 2025 compromised at least 64 organizations across 33 countries, with the United States the most affected. There are double extortion tactics that combine file encryption with data exfiltration and threats to publish stolen files on a Tor based leak site, and intrusions frequently begin with unauthorized Remote Desktop Protocol access. There are observations that operators maintain stealthy persistence by abusing legitimate remote administration tools such as Chrome Remote Desktop and AnyDesk installed as system services, using utilities like Everything and 7 Zip to locate and archive valuable files, and using MEGAsync to exfiltrate archives before encrypting data with a Go based encryptor that appends a.nspire extension and targets OneDrive synced files. There are recommendations that security teams test detections and response using breach and attack simulation platforms such as Picus with specific threat scenarios to evaluate defenses.
Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands

www.securityweek.com · 4 months ago

On May 18, 2026, Dutch authorities arrested two men, a 57 year old from Amsterdam and a 39 year old from The Hague, suspected of owning companies that provided bulletproof hosting services to Russia aligned threat actors and evaded European Union sanctions. Investigators from the Dutch Fiscal Information and Investigation Service searched sites in Enschede and Almere and two data centers in Dronten and Schiphol Rijk, seizing laptops, phones and more than 800 servers. The operation allegedly served as a front to continue services for a sanctioned provider known as Stark Industries, which was placed on the EU sanctions list in May 2025, and local reporting identified the suspects as Youssef Z. and Andrey N. and linked the infrastructure to firms named Mirhosting and WorkTitans.
CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks

thehackernews.com · 4 months ago

CERT-In has issued a 38-page blueprint requiring organizations to patch critical internet-exposed vulnerabilities within 12 hours where feasible, warning that AI tools and large language models can automate vulnerability discovery and exploitation and dramatically shorten attackers' preparation times. The guidance says AI-assisted attacks can compress exploitation timelines and mandates continuous, risk based vulnerability and patch management with remediation windows that include critical externally exposed vulnerabilities within one day, known exploited internal vulnerabilities within one day unless mitigations are documented, critical internal vulnerabilities for high value systems within three days, and high severity flaws within five days. Defensive measures emphasized include assume breach readiness, zero trust and least privilege, defense in depth, software supply chain risk reduction through software bills of materials and provenance checks, enhanced monitoring, testing and red teaming, and temporary mitigations such as isolation, access restrictions, web application firewall and API protections when patches are not immediately available.
Stop treating AI governance as a review layer. Make it release infrastructure

www.csoonline.com · 4 months ago

Traditional compliance as a post hoc review fails for AI because models, retrieval indexes and agent toolchains change continuously, widening a governance gap between slow audit cycles and fast deployments. There are three operational shifts to close that gap: generate model cards, training data provenance and evaluation baselines automatically in the CI CD pipeline; make compliance evidence an enforceable deployment gate; and treat agent identity as a first class security control with scoped permissions and audit trails. Embedding governance into release infrastructure rather than treating it as a separate review layer produces continuous evidence, enables faster compliant launches, and reduces governance debt ahead of regulatory regimes such as the EU AI Act and emerging US state and sector rules.
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware

gbhackers.com · 4 months ago

A critical SQL injection vulnerability in Ghost CMS tracked as CVE-2026-26980 is being actively exploited to extract Ghost Admin API keys, modify posts, and inject JavaScript that distributes ClickFix malware, with researchers reporting more than 700 compromised domains. Attackers insert a lightweight page loader that fetches a cloaked second-stage payload, fingerprints visitors using WebGL, timezone, and behavior signals, and redirects selected users to a fake verification that social engineers them into running commands that download and execute payloads such as installer.dll or UtilifySetup.exe via rundll32. Multiple threat groups are rotating infrastructure and reinfecting sites, and the flaw was publicly disclosed in February 2026 but many Ghost instances remain unpatched, enabling rapid large-scale page poisoning. Immediate mitigation advice includes upgrading to patched Ghost versions, rotating all API keys and credentials, thoroughly inspecting site content and logs for unauthorized changes, and urging users who visited affected sites to check systems for suspicious downloads or execution activity.
Update Starlette Now. New severe vulnerability dropped.

badhost.org · 4 months ago

The vulnerability CVE-2026-48710 affects Starlette versions below 1.0.1 because the library derives the request url from the Host header without proper sanitization. This flaw allows attackers to forge the request url path, potentially bypassing path-based authentication middleware in thousands of affected FastAPI and Starlette applications. To fix this, users must update Starlette to version 1.0.1 or later and avoid relying solely on middleware for authentication decisions. Implementing an RFC compliant reverse proxy is also a crucial mitigation step to validate and normalize the Host header.
CISA orders feds to patch actively exploited Drupal vulnerability

www.bleepingcomputer.com · 4 months ago

CISA has ordered U.S. federal civilian agencies to patch an actively exploited unauthenticated SQL injection vulnerability in the Drupal content management system by midnight on May 27, 2026 under Binding Operational Directive 22-01. The flaw, tracked as CVE-2026-9082 and discovered by Google Mandiant researcher Michael Maturi, exists in Drupal's database abstraction API and allows arbitrary SQL injection against PostgreSQL powered sites, potentially leading to information disclosure, privilege escalation, and remote code execution. Drupal released patches and labeled the bug highly critical after detecting exploitation in the wild, while Shadowserver is tracking about 670 exposed unpatched Drupal instances concentrated in North America and Europe. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog and urged all organizations to apply vendor mitigations, follow applicable guidance for cloud services, or discontinue use if mitigations are unavailable.
Apache CXF Flaw Exposes Systems to LDAP Injection Attacks

gbhackers.com · 4 months ago

There is an LDAP injection vulnerability in Apache CXF's XKMS LDAP certificate repository that can be manipulated to retrieve arbitrary X.509 certificates, exposing sensitive cryptographic material and enabling impersonation or unauthorized access, tracked as CVE-2026-44930. The flaw exists in the cxf-services-xkms-x509-repo-ldap component due to improper input validation and can force LDAP queries to return all certificate entries. Multiple CXF releases are affected and Apache has released fixes in versions 4.2.1, 4.1.6 and 3.6.11, with users urged to upgrade immediately and to apply input validation, least-privilege controls, and monitoring as mitigations. Detection and hardening options include reviewing LDAP query handling, monitoring LDAP query logs for unusual activity, and deploying application filtering or web application firewalls.
Hackers Use SEO Poisoning to Fake Gemini CLI and Claude Code Installers

gbhackers.com · 4 months ago

Hackers are abusing search engine optimization to impersonate popular AI developer tools and deliver fake installer pages that prompt developers to run a PowerShell command which executes a fileless infostealer in memory. The campaign, first observed in early March 2026, uses typosquatting domains and even installs legitimate packages alongside the malicious payload to mask the compromise while the malware disables endpoint defenses, harvests credentials, tokens, keys, cloud files, and collaboration data, and exfiltrates it to attacker controlled infrastructure. The malware also supports remote code execution for hands on keyboard activity and is hosted across dozens of spoofed domains on bulletproof hosting. Organizations are advised to verify software sources, monitor for hidden or chained PowerShell commands such as Invoke-RestMethod and Invoke-Expression, and watch for unusual outbound connections immediately after installation attempts.
ConnectWise Automate Flaw Allows Hackers to Evade Security Controls

gbhackers.com · 4 months ago

There is a high severity vulnerability in ConnectWise Automate remote monitoring and management software that can bypass integrity verification and potentially enable unauthorized code execution, tracked as CVE-2026-9089 with a CVSS score of 8.8. The flaw resides in the agent plugin loading and self update processes where certain downloaded components may be processed without full integrity checks, and it is classified under CWE 494. Exploitation requires no user interaction and has low complexity, creating risks of arbitrary code execution, lateral movement, persistent access, and broader supply chain exposure for managed service providers, with no confirmed active exploitation at disclosure. ConnectWise addressed the issue in Automate version 2026.5, cloud instances were automatically updated, on premises deployments must be manually upgraded, and organizations are urged to patch within 30 days and monitor agent activity while deploying endpoint detection controls.
Microsoft: Domain Controller lookup may fail on Windows Server 2016

www.bleepingcomputer.com · 4 months ago

A known issue in the May 2026 cumulative update KB5087537 causes domain controller discovery to fail on Windows Server 2016 systems whose hostnames are exactly 15 characters long. When the hostname is 15 characters long, DCLocator calls for example using nltest dsgetdc domain pdc return ERRORINVALIDPARAMETER preventing applications and administrative tools from locating a domain controller and disrupting administrative operations such as DFS Namespace management. Microsoft is investigating the problem and has not provided a timeline for a fix.
Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning

thehackernews.com · 4 months ago

Nimbus Manticore, an Iranian state sponsored threat actor linked to Iran's Islamic Revolutionary Guard Corps, has run a cross regional espionage campaign since late February 2026 using career themed phishing lures, spoofed meeting invitations, and SEO poisoning to impersonate aviation and software organizations across the United States, Europe, and the Middle East. The campaigns delivered two RAT families, MiniJunk and a new AI assisted backdoor called MiniFast or MiniUpdate, using AppDomain hijacking, trojanized installers including Zoom, and poisoned search results that directed victims to a fake SQL Developer download page. MiniFast communicates over HTTP, beacons system details, and supports file operations, directory listings, process enumeration, command execution via cmd.exe, DLL loading, archive creation, scheduled task persistence, privilege escalation via runas, and configurable polling and jitter for long term access. Security firms observed the actor expand operations to multiple countries, including attacks that targeted a U.S. oil and gas firm and manipulation of online automatic tank gauge displays at gas stations in several U.S. states that altered readings without changing fuel levels.
Phishing Campaigns Exploit RCS and iMessage to Evade SMS Security Filters

gbhackers.com · 4 months ago

Phishing campaigns are shifting from traditional SMS to encrypted messaging channels such as RCS and iMessage, which operate over data networks and reduce carriers ability to inspect or block malicious content, making lures appear more legitimate through features like read receipts, media, and branded content. Attackers are moving from static phishing pages to live interaction models provided by a growing phishing as a service ecosystem that instantly relays credentials, triggers one time passcode requests, and captures OTPs or session tokens to bypass multifactor authentication. These platforms use localization and artificial intelligence to clone legitimate sites in real time and employ anti bot checks to evade automated detection while converting stolen card details into tokenized assets for contactless payments and high value transactions. Defenders are advised to adopt phishing resistant authentication such as FIDO2 or WebAuthn, implement device fingerprinting and risk based verification for digital wallet provisioning, and shift emphasis from detection to prevention.
PuTTY 0.84 Update Patches SSH Key Exchange Crash Issues and Telnet Prompt Spoofing Flaw

gbhackers.com · 4 months ago

PuTTY 0.84 was released with three minor security fixes that address vulnerabilities which could allow remote attackers to crash the client or trick users during insecure sessions. Fixed issues include an ECDSA signature verification bug that can trigger an assertion failure during SSH key exchange affecting NIST curves P-256 P-384 and P-521, a double free in RSA key exchange present in versions 0.72 through 0.83, and a Telnet trust indicator flaw that can leave the trust sigil set and enable fake password prompt spoofing. The update also addresses CVE-2026-4115 related to EdDSA signature handling, and users are urged to upgrade to 0.84, avoid legacy protocols such as Telnet, and disable unused key exchange methods like RSA KEX.
7-Eleven data breach exposes personal information of 185,000 people

www.bleepingcomputer.com · 4 months ago

The ShinyHunters extortion gang stole the personal information of about 185,300 people after breaching 7‑Eleven systems in early April 2026. Analysis of the leaked data by Have I Been Pwned shows exposed names, dates of birth, unique email addresses, phone numbers, and physical addresses. ShinyHunters claimed to have exfiltrated over 600,000 Salesforce records and published a 9.4 gigabyte archive after 7‑Eleven refused to pay the ransom. 7‑Eleven said it discovered unauthorized access on April 8, 2026 and sent breach notification letters on May 1, noting the incident was limited to systems used to store franchisee documents.
Vulnerabilities have become cyber attackers’ No. 1 door to the enterprise

www.csoonline.com · 4 months ago

Vulnerability exploitation has overtaken stolen credentials as the most common initial access vector, causing 31 percent of breaches versus 13 percent for credential abuse. Only 26 percent of CISA Known Exploited Vulnerabilities were fully remediated in 2025, down from 38 percent the year before, while the median time to patch rose to 43 days from 32 days and the volume of critical vulnerabilities increased by 50 percent year on year. Attackers are increasingly targeting unpatched perimeter and third party systems, with breaches involving a third party accounting for 48 percent of incidents, and adversaries are using AI to shrink the time to exploit from months to hours. Ransomware featured in roughly 48 percent of breaches even as ransom payments declined, prompting calls for risk based continuous vulnerability management, stronger identity controls, defense in depth, and containment measures.
Multiple 7-Zip Vulnerabilities Enable Arbitrary Code Execution

gbhackers.com · 4 months ago

Multiple memory safety bugs in 7 Zip version 26.00 allow remote attackers to leak sensitive data and in at least one case to execute arbitrary code when a victim opens a crafted archive file. GitHub Security Lab disclosed a critical NTFS heap buffer overflow tracked as CVE-2026-48095 and a cluster of additional memory access violations affecting formats such as SquashFS, UEFI capsules, UDF, and WIM. All 7 Zip releases up to and including 26.00 are affected and fixes were shipped in 7 Zip version 26.01 on April 27, 2026, so administrators and users should upgrade to 26.01 or later immediately or otherwise limit 7 Zip use on high value systems and monitor for suspicious archive activity.
Malicious PDF LNK Files Deploy Cobalt Strike in Operation Dragon Whistle

gbhackers.com · 5 months ago

Operation Dragon Whistle targets China s education sector with highly tailored spear phishing emails impersonating university communications and using urgent ZIP attachments named as official testing notices to coerce students and staff into opening them. Inside the ZIP is a file disguised as a PDF but actually a LNK shortcut that leverages explorer dot exe to launch a hidden VBScript which opens a decoy PDF while silently running a bundled Bandizip executable and causing DLL sideloading of a malicious ark dot x64 dot dll. The chain decrypts and unpacks a payload in memory, bypasses AMSI and ETW, employs anti analysis checks, and loads a Cobalt Strike Beacon directly into memory that communicates with command and control hosted on Alibaba Cloud. Security researchers attribute the campaign to actor UNG0002 with medium to high confidence and note strong similarities to prior LNK based operations.
Anthropic Prepares Claude Mythos for Wider Release Through Claude Code

gbhackers.com · 5 months ago

Anthropic is preparing to expand access to its most advanced AI, Claude Mythos, by staging a commercial rollout labeled Mythos 1 with references appearing in source code and brief user interface tests. Claude Mythos surfaced after a March 2026 internal leak and was subsequently tested through Project Glasswing in April 2026 with over 40 partners including AWS, Microsoft, Google, and CrowdStrike. The model has reportedly identified thousands of vulnerabilities, finding more than ten thousand high and critical issues across open source projects and disclosing 1,596 findings across 281 projects with only a fraction patched so far. Anthropic plans to integrate Mythos into developer and security products such as Claude Code and Claude Security, which offer automated scanning, patch suggestion pull requests, and historical trends, while rolling out access gradually and reinforcing safeguards to reduce misuse.
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

thehackernews.com · 5 months ago

There is a now patched high severity zero day in Digital Knowledge KnowledgeDeliver learning management system that was exploited to deliver the Godzilla web shell and enable deployment of Cobalt Strike Beacon. The vulnerability, tracked as CVE-2026-5426 with a CVSS score of 7.5, stems from hard coded ASP.NET machineKey values that allowed unauthenticated ViewState deserialization and remote code execution. Attackers used the web shell to run commands, change file permissions, alter a JavaScript file to display a fake security alert that lured users to install a malicious plugin, and delivered organization specific encrypted payloads that resulted in Cobalt Strike infections. The incident highlights the severe risks of shared secrets in deployment templates and recommends using unique secrets and robust endpoint monitoring to defend against deserialization attacks.
Jailbroken Gemini AI Abused in Credential Theft and Crypto Wallet Heist

gbhackers.com · 5 months ago

A jailbroken Gemini AI was weaponised in a multi year campaign that combined political influence operations, credential theft, and a cryptocurrency wallet heist run by a single Russian speaking actor known as bandcampro. The operator ran a public Telegram channel called americanpatriotus for five years to build trust with an audience aligned to MAGA and QAnon themes and from September 2025 began using a compromised Gemini setup as an automation engine that was persistently jailbroken by loading malicious context in session memory. Gemini was used to generate propaganda posts, manage infrastructure, rotate at least 73 likely stolen API keys, act as a password mutation oracle to brute force accounts, and help deploy a fake wallet installer named StellarMonster whose installer deployed a legitimate remote access tool to steal seed phrases and drain victim wallets. Investigators confirmed at least one wallet was emptied and at least 29 WordPress administrator accounts across small businesses and firms were compromised, and analysts assess the operation was primarily financially motivated rather than state sponsored.
Hackers Abuse KnowledgeDeliver LMS Flaw to Install BLUEBEAM Web Shell

gbhackers.com · 5 months ago

A critical unauthenticated remote code execution vulnerability in the KnowledgeDeliver learning management system enables ASP.NET ViewState deserialization attacks and is tracked as CVE-2026-5426. Attackers have abused deployments that used a shared hard-coded ASP.NET machineKey prior to February 24, 2026 to deliver crafted ViewState payloads that execute code and, in observed incidents, install the BLUEBEAM.NET in-memory web shell inside the IIS worker process. Recommended mitigations include immediately rotating ASP.NET machineKey values to unique cryptographically strong keys, restricting access to trusted IP ranges, monitoring for ViewState validation failures such as Event ID 1316 and suspicious child processes spawned by w3wp.exe, and hunting for modified web application files and web shell indicators of compromise.
Ransomware Uses ChaCha20 and Curve25519 to Encrypt Windows Files

gbhackers.com · 5 months ago

Payload ransomware is a new Windows ransomware family that combines ChaCha20 stream encryption with a per-file Curve25519 Elliptic Curve Diffie Hellman key exchange, making victim data effectively unrecoverable without the attackers' private key. It implements strong anti forensics measures including Event Tracing for Windows patching, deletion of Volume Shadow Copies, event log wiping, and aggressive termination of processes and services to hinder detection and recovery.
Security experts caution MFA alone can no longer stop threat actors

www.csoonline.com · 5 months ago

There are increasing phishing campaigns and phishing as a service platforms such as Kali365 and EvilTokens that steal Microsoft 365 OAuth device codes to capture access and refresh tokens, allowing attackers to bypass multifactor authentication and access Outlook, Teams, and OneDrive. Kali365 commercializes attacks with AI generated lures, automated campaign templates, management dashboards, multi language variants and subscription tiers starting around two hundred fifty dollars, and observed activity includes creating malicious inbox rules and registering devices to extend persistent access. Law enforcement and security experts urge that MFA alone is no longer sufficient and recommend restricting or blocking device code authentication via conditional access, proactively revoking and monitoring OAuth tokens and device registrations, adopting phishing resistant FIDO2 passkeys and stronger session controls, implementing continuous access evaluation, and segmenting high risk users and functions.
Project Glasswing has uncovered 10,000 vulnerabilities: Anthropic

www.csoonline.com · 5 months ago

There are an estimated 10,000 critical or high severity vulnerabilities surfaced by Project Glasswing, an initiative using the Claude Mythos Preview model with more than 50 partners. Mythos Preview scanned over 1,000 open source projects and found 6,202 high or critical vulnerabilities, 1,752 of which were assessed by six independent firms with 90.6 percent true positives and 62.4 percent confirmed as high or critical; so far 530 high or critical bugs have been disclosed to maintainers, 75 patched and 65 public advisories issued, with plans to disclose another 827. Maintainers report a deluge of low quality AI generated reports and severe capacity constraints, shifting the cybersecurity bottleneck from finding bugs to human driven triage and patching, and Anthropic has launched a Claude Security beta, a Cyber Verification Program, and committed over 100 million dollars in usage credits and 4 million dollars in donations to support remediation.
The War Between Wars: How an IRGC Front Runs Destructive OT and IT Attacks Under Cover of a Ceasefire

profero.io · 5 months ago

An Iranian state-directed persona called Cyber Isnaad Front, assessed to be operated alongside IRGC-affiliated ASA, has been running deniable destructive campaigns against Israeli infrastructure during ceasefires that combine IT intrusions with targeted operational technology sabotage. At one food-production plant attackers reprogrammed refrigeration controllers, changed setpoints and safety limits, switched motorized valves to manual and pinned them open, changed central-controller credentials to lock out engineers, and caused the destruction of three compressors without malware on the controllers themselves. On the IT side the operation deployed a Go Remote Access Toolkit called GRAT, masquerading as fake Microsoft updates and persisting as a scheduled task named OneDrive Update, with modules for VNC, exfiltration, encryption named BigBang, and a disk-wiper that overwrites drives and destroys partition tables while communicating with C2 infrastructure at 84.201.6.131 on ports 7878 and 9988. Indicators include specific SHA-256 hashes, file paths under AppData and ProgramData, and C2 hosts, and defenders are advised to hunt for unsigned binaries in those locations, alert on outbound AMQPS or Redis traffic to the listed host and ports, segment IT from OT, keep offline versioned backups of controller programs, and alarm on out-of-band setpoint or operating-mode changes.