Blahalla

Hackers Launch Massive SonicWall Firewall Attack Using 4,000+ IP Addresses

gbhackers.com · 4 months ago

Hackers are actively scanning SonicWall firewalls worldwide to identify vulnerable devices with exposed SSL VPN services. The activity, which occurred between February 22 and 25, 2026, involved over 84,000 scanning sessions from more than 4,000 unique IP addresses. The scans primarily targeted a single SonicOS REST API endpoint, indicating reconnaissance for future credential stuffing and vulnerability exploitation. Security researchers note that this activity mirrors a previous campaign and highlights SonicWall VPNs as a prime target for ransomware groups like Akira and Fog, and CVE-2024-53704 is of particular concern. Organizations are urged to immediately restrict access, enforce multi-factor authentication, and patch vulnerabilities.

Angular SSR Flaw Enables Unauthorized Server-Side Requests in Web Apps

gbhackers.com · 4 months ago

A critical vulnerability, tracked as CVE-2026-27739, has been identified in Angular Server-Side Rendering (SSR) that allows for Server-Side Request Forgery (SSRF) and Header Injection attacks. The flaw arises from Angular's insufficient validation of HTTP headers like Host and X-Forwarded- when reconstructing URLs, potentially leading to credential theft, internal network probing, and data exposure. Successful exploitation requires the application to use Angular SSR and HttpClient, and relies on the attacker's ability to influence headers without proper validation. Developers are advised to update affected packages or implement workarounds like using absolute URLs and strict header validation.

North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT

thehackernews.com · 4 months ago

North Korean hackers are using a new technique called StegaBin to distribute malware through malicious npm packages. Twenty-six packages disguised as developer tools have been published to the npm registry, employing Pastebin steganography to hide command-and-control URLs. Once installed, the packages deploy a credential-stealing remote access trojan, targeting developers and leveraging Vercel infrastructure for payload delivery. The malware includes modules for keylogging, browser credential theft, and Git repository exfiltration, connecting to 103.106.67[.]63:1244 and 103.106.67[.]63:1247.

Hacker erpressen weniger Lösegeld

www.csoonline.com · 4 months ago

Ransomware attacks generated 820 million dollars in 2025, a 28 percent decrease from the previous year. Despite the drop in overall earnings, the number of attacks increased by 50 percent. The decline in total revenue is attributed to more organizations refusing to pay ransoms, due to the risk of repeat attacks and potential legal consequences. Although overall earnings decreased, the average ransom payment rose significantly to almost 60000 dollars.

OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure

gbhackers.com · 4 months ago

A new botnet Trojan campaign called OCRFix is using deceptive tactics to infect systems. The operation begins with a fake Tesseract OCR download site and ClickFix-style PowerShell prompts to trick users into executing malicious scripts. The botnet employs EtherHiding on the BNB Smart Chain TestNet to conceal its command and control infrastructure, making detection difficult. The malware drops multiple executables and DLLs, ultimately turning infected machines into bot listeners that beacon data to control panels hosted on domains such as ldlture.com. No CVEs were mentioned.

Middle East AWS Outage Sends Shockwaves Through Cloud Infrastructure Service

gbhackers.com · 4 months ago

A significant infrastructure incident in the Middle East caused a widespread Amazon Web Services outage impacting the ME-CENTRAL-1 and ME-SOUTH-1 regions. Physical damage to a data center in the UAE, specifically mec1-az2, initiated the event when external objects struck the facility, leading to a fire and a complete power shutdown. The disruption affected numerous AWS services including EC2, RDS, DynamoDB, Lambda, and EKS, with over 84 services experiencing issues across both regions. AWS implemented mitigation strategies by rerouting traffic and advising administrators to utilize alternative Availability Zones to minimize further impact.

CISA Alerts on RESURGE Malware Exploiting Ivanti Connect Secure Zero-Days

gbhackers.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency has identified a new malware family called RESURGE, which exploits a zero-day vulnerability in Ivanti Connect Secure devices. RESURGE builds upon earlier malware and can create web shells, manipulate integrity checks, and steal credentials, even persisting through system reboots. The intrusions are linked to CVE-2025-0282, a stack-based buffer overflow vulnerability. CISA recommends a full factory reset of affected appliances and resetting passwords for all accounts, including the krbtgt account, to ensure complete removal.

How CISOs can build a resilient workforce

www.csoonline.com · 4 months ago

false

Prayer App Used by Millions Hacked to Broadcast Defection Messages Amid U.S.-Israel Strikes on Iran

gbhackers.com · 4 months ago

A popular Iranian prayer application, BadeSaba Calendar, was hacked to send anti-government messages to over 5 million users during coordinated U.S. and Israeli military strikes on Iran. The messages, appearing as push notifications, urged military personnel to surrender and promised amnesty. Following the incident, Iran experienced a significant digital blackout, with network traffic dropping to just 4 percent of normal levels and international connectivity lost at major data centers. Cybersecurity experts believe this was a sophisticated, pre-planned operation likely conducted by a nation-state.

Pixel Perfect Browser Extension Exploited for Stealth Script Injection and Security Header Stripping

gbhackers.com · 4 months ago

A popular Chrome extension, QuickLens, Search Screen with Google Lens, has been compromised and transformed into a remote code-execution platform. Malicious actors acquired the extension and introduced version 5.8, adding capabilities to strip security headers like Content-Security-Policy and X-XSS-Protection, allowing arbitrary script injection. The extension now communicates with api.extensionanalyticspro.top, utilizing a pixel-based technique to execute JavaScript payloads and potentially steal user data. The extension has been removed from the Chrome Web Store due to a policy violation.

Im Fokus: RZ-Modernisierung

de.resources.csoonline.com · 4 months ago

false

Im Fokus: RZ-Modernisierung

whitepaper.computerwoche.de · 4 months ago

false

OpenClaw 0-Click Flaw Lets Malicious Websites Hijack Developer AI Agents

gbhackers.com · 4 months ago

A critical security flaw was discovered in OpenClaw, a popular AI assistant for developers, allowing malicious websites to hijack user agents. The vulnerability, a 0-click exploit, arises from the gateway’s trust of localhost connections, enabling attackers to bypass authentication and gain full control of the agent. This compromise allows access to sensitive data, including API keys and Slack messages, effectively granting a full workstation compromise. The OpenClaw team has released version 2026.2.25 to address the High severity vulnerability.

Kubernetes Security: Wie Sie Ihre Cluster (besser) absichern

www.csoonline.com · 4 months ago

Cyberattacks targeting Kubernetes clusters are becoming increasingly common due to the platform’s complexity and open nature. Attackers are quickly exploiting vulnerabilities, sometimes within minutes of a new cluster’s creation. Common security failings, such as poor network segmentation and weak passwords, often facilitate these attacks. Experts advise implementing strong access controls, key management, regular audits, and employee training to improve security.

An Ohio newspaper has a new star writer. It isn’t human.

www.washingtonpost.com · 4 months ago

Cleveland’s largest newspaper, The Plain Dealer, is now using artificial intelligence to write articles. These AI-generated pieces appear with the byline “Advance Local Express Desk.” Recent stories include reports on an ice carving festival, medical research, and a pack of dogs. The newspaper is experimenting with AI as a content creation tool.

ClawJacked attack let malicious websites hijack OpenClaw to steal data

www.bleepingcomputer.com · 4 months ago

Security researchers have identified a high-severity vulnerability, dubbed "ClawJacked," in the OpenClaw AI platform, allowing malicious websites to potentially take control of locally running instances. The vulnerability stems from the platform's gateway service binding to localhost and exposing a WebSocket interface, enabling attackers to brute-force login credentials without warnings. Once authenticated, an attacker can gain full access to the AI platform, steal credentials, and execute commands, potentially compromising the entire workstation. A fix, released in version 2026.2.26, has been implemented to strengthen WebSocket security and prevent such attacks.

Samsung TVs to stop collecting Texans’ data without express consent

www.bleepingcomputer.com · 4 months ago

Samsung has reached a settlement with the State of Texas regarding the alleged unlawful collection of viewer data through its smart TVs. The company will revise its privacy disclosures to explain data collection and processing practices more clearly. Samsung must now obtain express consent from Texas consumers before collecting or processing Automated Content Recognition viewing data. Other smart TV manufacturers like Sony, LG, Hisense, and TCL have not yet made changes in response to similar lawsuits.

r/netsec monthly discussion & tool thread

www.reddit.com · 4 months ago

false

Hackers Weaponize Claude Code in Mexican Government Cyberattack

www.securityweek.com · 4 months ago

Hackers targeted Mexican government systems in a recent cyberattack, compromising ten government bodies and a financial institution. The attackers utilized Anthropic’s Claude Code assistant, sending over 1,000 prompts to it and leveraging OpenAI’s GPT-4.1 for analysis, to write exploits and automate data exfiltration. This resulted in the theft of over 150 gigabytes of data, impacting roughly 195 million identities, including civil registry files, tax records, and voter data. This incident follows previous data breaches targeting Mexican government entities, including claims of stolen data from healthcare systems and journalist information.

Bring On Defunct: The iPod Enthralls Young Music Listeners

www.nytimes.com · 4 months ago

false

At the Pentagon, OpenAI is In and Anthropic Is Out

www.nytimes.com · 4 months ago

false

Network Security News Feed

insidestack.it · 4 months ago

false

QuickLens Chrome extension steals crypto, shows ClickFix attack

www.bleepingcomputer.com · 4 months ago

A Chrome extension called QuickLens was compromised and used to distribute malware and steal user data. The malicious version 5.8 introduced ClickFix attacks and info-stealing functionality, stripping browser security headers and communicating with a command-and-control server. The extension targeted cryptocurrency wallets and credentials, as well as sensitive data from services like Gmail and Facebook. Google has removed the extension from the Chrome Web Store and is disabling it for users, recommending they remove the extension and scan for malware.

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket

thehackernews.com · 4 months ago

A security flaw, dubbed ClawJacked, has been identified in OpenClaw, potentially allowing malicious websites to hijack locally running AI agents. The vulnerability involves a missing rate-limiting mechanism, enabling attackers to brute-force passwords and gain control over agents, potentially accessing sensitive data. OpenClaw has released version 2026.2.25 to address this, alongside a log poisoning vulnerability fixed in version 2026.2.13. Several other vulnerabilities have been addressed, including CVE-2026-25593, CVE-2026-24763, CVE-2026-25157, CVE-2026-25475, CVE-2026-26319, CVE-2026-26322, and CVE-2026-26329. Microsoft has also warned of the risks of running OpenClaw, recommending deployment in isolated environments.

Fake Zoom and Google Meet Phishing Campaigns Deploy Teramind Surveillance Software

gbhackers.com · 4 months ago

Cybercriminals are using sophisticated phishing campaigns disguised as Zoom and Google Meet to install Teramind surveillance software on Windows devices. Victims are directed to fake landing pages that install a malicious MSI package, which then establishes a connection to a command and control server. The software installs in a hidden mode, evading visual detection, and utilizes SOCKS5 proxy support to potentially obscure network traffic. Security teams should monitor for suspicious services and directory GUIDs to identify compromised systems.

OpenAI Reaches A.I. Agreement With Defense Dept. After Anthropic Clash

www.nytimes.com · 4 months ago

Researchers have discovered three methods attackers can use to bypass Android's Memory Tagging Binder (MTB) protection. These techniques involve exploiting vulnerabilities in system services and leveraging misconfigurations to gain elevated privileges. Attackers could potentially manipulate Binder transactions and forge valid signatures to compromise device integrity. The vulnerabilities affect numerous Android devices and have been assigned CVE identifiers CVE-2023-39747, CVE-2023-39748, and CVE-2023-39749.

$4.8M in crypto stolen after Korean tax agency exposes wallet seed

www.bleepingcomputer.com · 4 months ago

South Korea’s National Tax Service mistakenly revealed a cryptocurrency wallet’s recovery phrase in a press release, leading to the theft of approximately $4.8 million in Pre-Retogeum tokens. The agency released images of a seized Ledger device, inadvertently displaying the handwritten seed phrase. An attacker then transferred the tokens to a new address after paying transaction fees with Ethereum. Experts have criticized the agency’s lack of understanding regarding virtual assets and the security risks associated with exposing recovery phrases.

I used MCP Ghidra and Claude Code to find 9 kernel driver vulnerabilities on my gaming laptop

www.credrelay.com · 4 months ago

false

Who is the Kimwolf Botmaster “Dort”?

krebsonsecurity.com · 5 months ago

A security researcher's work exposing the Kimwolf botnet has triggered a series of attacks orchestrated by an individual known as "Dort." Publicly available information suggests Dort is a Canadian teenager born in August 2003, using aliases like “CPacket” and “M1ce.” Dort’s activities include developing malicious software like “Dortware” and providing services for bypassing CAPTCHA systems and registering temporary email addresses, often in collaboration with another hacker known as "Qoft." Dort's actions have escalated to threats of swatting and the publication of personal information against the researcher and others.

Canadian Tire Data Breach Impacts 38 Million Accounts

www.securityweek.com · 5 months ago

A data breach at Canadian Tire has impacted over 38 million customer accounts, with roughly 42 million records now posted online. The compromised data includes names, email addresses, dates of birth, encrypted passwords, addresses, phone numbers, gender information, and partial credit card details. Canadian Tire states passwords were stored as PBKDF2 hashes. The company has notified affected individuals via email.

Musk asked Epstein for ‘the wildest party.’ Now he claims to stand up for victims.

www.washingtonpost.com · 5 months ago

Elon Musk recently called for accountability regarding individuals named in the Epstein files. This came after Musk himself appeared in those files. During a public dispute with former President Donald Trump, Musk alluded to the existence of Trump's name within the files. Musk made the statement on the social media platform X.

Pentagon assault on Anthropic sends shock waves across Silicon Valley

www.washingtonpost.com · 5 months ago

false

Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement

thehackernews.com · 5 months ago

Researchers have discovered thousands of Google Cloud API keys exposed online, potentially allowing attackers to access sensitive data and incur significant charges. These keys, initially intended for billing purposes, now unexpectedly authenticate to Gemini endpoints when the Generative Language API is enabled. Google has acknowledged the issue and implemented measures to block leaked keys, but users are urged to rotate their API keys, starting with older ones, to mitigate the risk of unauthorized access and quota theft. One user reported significant, unexpected charges due to a compromised key.

Hackers Exploit Windows File Explorer and WebDAV to Distribute Malware

gbhackers.com · 5 months ago

Cybersecurity researchers have identified an ongoing campaign where attackers are exploiting the legacy WebDAV protocol through Windows File Explorer to distribute malware. Threat actors use direct linking, URL shortcut files, and LNK files to trick users into downloading Remote Access Trojans like XWorm, Async, and DcRAT, bypassing security measures. Attackers often utilize free Cloudflare Tunnel instances to host malicious WebDAV servers, obscuring their activity and making detection difficult; these attacks have increased since February 2024, targeting European corporate networks with phishing emails containing fake invoices. Several Cloudflare Tunnel domains are hosting malicious WebDAV servers and are listed as indicators of compromise.

Trump Bans Anthropic AI in Federal Agencies Amid Growing Security Concerns

gbhackers.com · 5 months ago

The U.S. government has banned federal agencies from using Anthropic, an American AI company, classifying it as a supply chain risk to national security. This action, announced by President Trump, stems from Anthropic’s refusal to grant the Pentagon unrestricted access to its AI model, Claude, due to concerns about autonomous weapons and domestic surveillance. Departments like the Department of War have six months to phase out Anthropic’s technology, while individual users and non-government contractors can still utilize the service. Legal experts warn this precedent could negatively impact the broader tech industry and Anthropic plans to challenge the designation in court.

Pentagon Designates Anthropic Supply Chain Risk Over AI Military Dispute

thehackernews.com · 5 months ago

The Pentagon has designated Anthropic, an artificial intelligence company, as a supply chain risk due to disagreements over the use of its AI model, Claude. Anthropic opposes the Pentagon’s requests for exceptions allowing mass domestic surveillance and fully autonomous weapons. President Trump has ordered federal agencies to phase out Anthropic technology within six months, and the Department of War is mandating that contractors cease commercial activity with the company. Anthropic maintains the designation is legally unsound and sets a dangerous precedent.

Silicon Valley Rallies Behind Anthropic in A.I. Clash With Trump

www.nytimes.com · 5 months ago

false

OpenAI Reaches A.I. Agreement With Defense Dept. After Anthropic Clash

www.nytimes.com · 5 months ago

false

Pentagon declares Anthropic a threat to national security

www.washingtonpost.com · 5 months ago

false

Instagram to Alert Parents to Teens’ Self-Harm Searches

www.nytimes.com · 5 months ago

false

In a Memoir Draft, Changpeng Zhao of Binance Details the Talks Leading to His Prison Time

www.nytimes.com · 5 months ago

Changpeng Zhao, the founder of Binance, detailed secret negotiations in a draft memoir leading to his guilty plea for violating an anti-money-laundering statute. Federal prosecutors accused Binance of money laundering and terrorist financing, initially demanding a record $6.8 billion penalty. Zhao, consulting numerous lawyers, initially prepared to become a fugitive but ultimately pleaded guilty and served four months in prison before receiving a pardon from President Trump. The memoir also recounts a brief period as the wealthiest inmate and an unexpected encounter with Immigration and Customs Enforcement.

Friday Squid Blogging: Squid Fishing in Peru

www.schneier.com · 5 months ago

false

Security hole could let hackers take over Juniper Networks PTX core routers

www.csoonline.com · 5 months ago

A critical vulnerability labeled CVE-2026-21902 in Junos OS Evolved on PTX series core routers allows an unauthenticated network attacker to execute code as root, enabling device takeover and potential interception or redirection of traffic. The issue is caused by incorrect permission assignment in the On-Box Anomaly detection framework, which is enabled by default but should only be reachable by internal processes. Devices running Junos OS Evolved versions earlier than 25.4R1-S1-EVO and 25.4R2-EVO are affected and administrators are urged to install version 25.4R1-S1-EVO or await upcoming 25.4R2-EVO and 26.2R1-EVO updates. If immediate patching is not possible, operators should restrict access with access control lists or firewall filters to trusted hosts and consider disabling the anomaly service using the command request pfe anomalies disable.

Trump Orders All Federal Agencies to Phase Out Use of Anthropic Technology

www.securityweek.com · 5 months ago

false

Pentagon-Anthropic Standoff Is a Decisive Moment for How A.I. Will Be Used in War

www.nytimes.com · 5 months ago

false

Life Mirrors Art: Ransomware Hits Hospitals on TV & IRL

www.darkreading.com · 5 months ago

Recent events mirrored a fictional television show depicting a ransomware attack on a hospital. The University of Mississippi Medical Center experienced a real ransomware attack impacting its IT systems, including electronic medical records, forcing the closure of 35 clinics. Cybersecurity experts note the realism of the depiction, highlighting the operational chaos and reliance on paper-based systems when digital tools are unavailable. Experts advise healthcare facilities to secure credentials, develop downtime plans for patient care, and regularly test resilience through drills to mitigate disruptions and ensure patient safety.

‘Silent’ Google API key change exposed Gemini AI data

www.csoonline.com · 5 months ago

Researchers discovered a Google Cloud Platform security issue where API keys, initially used for billing, were inadvertently repurposed as authentication credentials for the Gemini AI API. A Common Crawl scan revealed 2,863 live API keys potentially exposing sensitive data and risking unauthorized usage. Google was alerted to the problem in November and has since restricted the vulnerable keys from accessing the Gemini API, but a comprehensive fix is still in progress. Developers are advised to review and rotate their API keys to mitigate the risk.

Cities Hosting Major Events Need More Focus on Wireless, Drone Defense

www.darkreading.com · 5 months ago

Cybersecurity experts warn that the 2026 FIFA World Cup presents escalating risks from drones and wireless attacks. The increasing use of drones in conflict zones, such as Ukraine where they account for 80% of casualties, highlights the potential danger to civilian populations. Experts recommend layered defenses combining radio frequency, radar, acoustic, and optical detection to protect event infrastructure and public safety communications. Furthermore, the complexity of wireless environments during large events provides attackers with numerous targets and opportunities to hide malicious activity within legitimate traffic.

Flaw-Finding AI Assistants Face Criticism for Speed, Accuracy

www.darkreading.com · 5 months ago

New AI tools from Anthropic and OpenAI aim to find vulnerabilities in code, with Anthropic claiming their system identified over 500 zero-day vulnerabilities in open-source projects. However, security experts report these tools are currently slow, generating numerous false positives, and disrupting development workflows. The tools are not expected to replace existing security checks but may assist developers in understanding and fixing code, especially as AI-assisted coding increases security debt and high-severity vulnerabilities. Ultimately, the real challenge remains remediating discovered vulnerabilities efficiently within existing development pipelines.

Microsoft testing Windows 11 batch file security improvements

www.bleepingcomputer.com · 5 months ago

Microsoft is enhancing Windows 11 security and performance for batch file and CMD script execution. IT administrators can now enable a secure processing mode to prevent file modifications during script runs through a registry value or application manifest control. This improvement boosts performance and reduces signature validation requirements when code integrity is enabled. Additionally, the Shared audio feature now supports individual volume sliders and expanded device compatibility.