Blahalla

Intellexa founder, three others sentenced to 8 years in prison over Greek spyware scandal

therecord.media · 5 months ago

A Greek court sentenced the founder of the Intellexa Consortium and three associates to prison for their role in a spyware scandal that emerged in 2022. The Misdemeanour Court imposed combined prison terms totalling 126 years and eight months, but under Greek law the maximum time to be served for the misdemeanour convictions is eight years, and the defendants will remain free pending appeal. The defendants were Tal Dilian, Sara Hamou, Felix Bitzios, and Yiannis Lavranos, and the Predator spyware sold by Intellexa was used to infect more than 90 people including journalists, opposition politicians, government ministers, military officials, and prosecutors. The court ordered prosecutors to investigate potential felony charges such as espionage and to probe additional criminal liability and Intellexa itself, and observers say the verdict could have significant legal and commercial consequences for the consortium.
European DYI chain ManoMano data breach impacts 38 million customers

www.bleepingcomputer.com · 5 months ago

ManoMano is notifying customers that a data breach discovered in January 2026 affected 38 million individuals after hackers compromised a third party customer service provider. Exposed information varies by individual and includes full names, email addresses, phone numbers, and customer service communications, while the company states account passwords were not accessed and no modifications occurred on its systems. The company says it disabled the subcontractor’s access, strengthened access controls and monitoring, notified authorities including the CNIL and ANSSI, and is urging customers to remain vigilant against phishing and social engineering.
How A.I.-Generated Videos Are Distorting Your Child’s YouTube Feed

www.nytimes.com · 5 months ago

There are growing concerns that low-quality AI generated videos on YouTube aimed at very young children often contain conflicting information, lack coherent plot structure, and use fast paced, attention grabbing edits that can be cognitively overwhelming. Experts warn that repeated exposure to such content during critical early years may impair young children’s developing sense of reality and hinder language and cognitive development. YouTube has taken steps to penalize repetitive and inauthentic channels and remove some content, but policy gaps such as exempting animated material from synthetic content disclosure allow many AI made children’s cartoons to remain undisclosed and monetized.
Four Risks Boards Cannot Treat as Background Noise

www.securityweek.com · 5 months ago

There are four risks reshaping organizational resilience including AI acting as a force multiplier that can corrupt data and enable more frequent and surgical attacks, supply chain incidents that remain the organization’s liability, quantum computing risk that requires a staged transition to post quantum cryptography, and geopolitics that increase unpredictability and complicate cross border response. Boards are urged to shift from trying to prevent every attack to ensuring business continuity by defining decision rights, assigning human in the loop controls and kill switches for high risk AI activity, mapping data flows across third parties, and preparing fallbacks to maintain a minimum viable company. Organizations should inventory encrypted assets, prioritize sensitive data, commit to a staged multi year plan for quantum readiness, and pursue public private partnerships to manage geopolitical complications.
Threat modeling AI applications

www.microsoft.com · 5 months ago

AI threat modeling helps teams identify misuse, emergent risk, and failure modes in probabilistic and agentic AI systems. AI systems introduce nondeterminism, instruction following bias, and system expansion through tools and memory, which create new attack surfaces such as prompt injection, indirect prompt injection via external data, tool misuse, privilege escalation through chaining, silent data exfiltration, and confidently wrong outputs treated as fact. Effective mitigation starts with mapping assets and where untrusted data enters, designing architectural controls like separating system instructions from untrusted content, least privilege for tools, allow lists, human approval for high risk actions, and validating or redacting outputs. Strong observability, designed detection and response paths, and treating threat modeling as an ongoing cross disciplinary discipline are essential, and teams should begin by mapping untrusted entry points, setting clear never do boundaries, and designing detection and response for failures at scale.
Critical Juniper Networks PTX flaw allows full router takeover

www.bleepingcomputer.com · 5 months ago

A critical vulnerability in Junos OS Evolved on PTX Series routers allows an unauthenticated attacker with network access to execute code as root and take full control of affected devices. The flaw is caused by incorrect permission assignment in the On Box Anomaly Detection framework that is exposed via an externally accessible port. It is tracked as CVE-2026-21902 and Juniper released fixes in Junos OS Evolved releases 25.4R1 S1 EVO, 25.4R2 EVO, and 26.2R1 EVO and advised customers to restrict access with firewall rules or access control lists or to disable the vulnerable service until patched.
Google disrupts Сhina-linked cyberespionage campaign spanning dozens of countries

therecord.media · 5 months ago

There is a China linked cyberespionage campaign attributed to UNC2814 that affected at least 53 government and telecommunications organizations across 42 countries and has been active since at least 2017. The campaign used a newly identified backdoor called Gridtide and abused Google Sheets functionality to conceal command and control communications, and Gridtide was installed on systems containing sensitive personal information including names, phone numbers, dates and places of birth, and national or voter identification numbers. Google and partners including Mandiant identified and disabled known UNC2814 infrastructure but warned the actor will likely try to reestablish its global footprint while Beijing has not publicly commented.
Reverse Engineering Garmin Watch Applications with Ghidra

www.anvilsecure.com · 5 months ago

Security researchers released a Ghidra processor definition and custom loader that add native support for Garmin Connect IQ watch PRG binaries, enabling instruction decoding, disassembly, decompilation, structured headers, and meaningful symbols. The loader recognizes PRG files, creates appropriate memory blocks, sets image base and entry point, parses header structures, registers data types, and labels known functions, strings, and symbol offsets to streamline analysis. The project includes the original HammerCon 2025 CTF challenge and a sample PRG for hands on testing and is intended to lower the barrier to responsible security research on wearable platforms that execute third party code. Known limitations include incomplete opcode semantics, partial symbol value resolution, and the need for version specific handling, with plans to improve field highlighting, semantic accuracy, and broader testing.
Olympique Marseille confirms 'attempted' cyberattack after data leak

www.bleepingcomputer.com · 5 months ago

Olympique de Marseille confirmed it was the target of an attempted cyberattack, reported the incident to the French data protection authority, filed a complaint, and said an investigation is ongoing. A threat actor posted a sample and claims the stolen database contains records on roughly 400,000 individuals, including names, addresses, order information, email addresses, mobile phone numbers, and more than 2,050 Drupal CMS accounts covering 34 staff and about 1,770 contributors and moderators. The club says technical teams contained the situation, that operations are continuing as normal, that no banking details or passwords appear to have been compromised, and it has urged supporters to remain vigilant for phishing.
They Helped Women Fight Online Abuse. They Were Barred From the U.S.

www.nytimes.com · 5 months ago

U.S. officials imposed entry bans on HateAid managing directors Anna-Lena von Hodenberg and Josephine Ballon as part of broader sanctions targeting European figures the administration said belonged to a global censorship industrial complex. HateAid is a Berlin nonprofit that provides legal and psychological support to victims of online abuse and has pushed for enforcement of European digital rules including the Digital Services Act, and German ministers publicly denounced the U.S. action as unjustified. HateAid called the measures an act of repression and intimidation, said the bans included an ESTA revocation for one leader, and said it is reviewing potential financial or account impacts that could follow from the U.S. restrictions.
UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor

thehackernews.com · 5 months ago

An ongoing malicious campaign tracked as UAT-10027 has been targeting United States education and healthcare organizations since at least December 2025 with the goal of delivering a previously unseen backdoor called Dohdoor. Dohdoor uses DNS over HTTPS for command and control, hides its servers behind Cloudflare, can download and reflectively execute additional payloads, and is deployed via DLL side loading using legitimate Windows executables, with observed next stage payloads assessed as Cobalt Strike Beacon. Initial access is suspected to start with phishing that executes a PowerShell script and a batch downloader, and the backdoor unhooks system calls to evade endpoint detection, while researchers note technical overlaps with Lazarloader and North Korean advanced persistent threat activity despite differing victimology.
We audited 1,620 OpenClaw skills. The ecosystem's safety scanner labels 91% of confirmed threats "benign." [full reports linked]

oathe.ai · 5 months ago

There are 1,620 AI agent skills audited from the OpenClaw ecosystem; 88 were flagged as dangerous or malicious, while the ecosystem's primary scanner flagged only seven, missing 91 percent of the threats. The gap is structural: attackers deliver payloads through SKILL.md instruction files that agents execute at runtime rather than through install-time code, enabling C2 channels, credential harvesters, self‑propagating prompt worms, crypto wallet drainers, agent rootkits, and other runtime attacks that static signature scanners cannot detect. Sixty skills are high confidence true positives, one is medium confidence, one is a confirmed false positive, auditors disclosed three methodological flaws in their scoring, and full audit reports were published for each flagged skill for independent verification.
ThreatsDay Bulletin: Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories

thehackernews.com · 5 months ago

There are signs of AI-driven tooling accelerating attacks as Kali Linux added an integration with Anthropic's Claude via the Model Context Protocol to translate natural language into commands and security firms report AI-enabled adversaries and breakout times shrinking to minutes. Active campaigns include Belarus-linked ResidentBat Android spyware, phishing that impersonates cryptocurrency brokers to harvest credentials, malvertising that lures macOS users to stealers, and social engineering via Microsoft Teams that coerces victims into running malicious commands. Threat actors are exploiting known flaws including an Apache ActiveMQ vulnerability tracked as CVE-2023-46604 to deploy LockBit ransomware and widespread unpatched instances of WinRAR vulnerable to CVE-2025-8088. Researchers also highlighted crypto IV reuse in popular libraries and a strongSwan update addressing CVE-2026-25998, while attackers continue to hide payloads with ad cloaking, repo-squatting, and malicious Chrome extensions that crash browsers to trick users into executing commands.
After years of government cyber trouble, UK turns to automated scanning to speed fixes

therecord.media · 5 months ago

On February 26, 2026 the British government said it has slashed the time required to fix some of the most serious cyber vulnerabilities across the public sector by deploying a central automated Vulnerability Monitoring Service that continuously scans internet-facing systems used by about 6,000 public bodies. Officials said the service produces roughly 400 confirmed vulnerabilities processed and resolved each month, has reduced median fix times for critical domain-related weaknesses from about 50 days to eight days, cut median fix time for other vulnerabilities from 53 days to 32 days, and reduced the backlog of unresolved critical flaws by roughly three quarters. Government ministers said the faster fix times reduce the risk of attacks on essential services even as state-backed actors and organized criminal groups escalate threats and legacy IT infrastructure continues to undermine defenses.
Ransomware payment rate drops to record low as attacks surge

www.bleepingcomputer.com · 5 months ago

The ransomware victim payment rate fell to 28 percent in 2025 even as claimed attacks rose by about 50 percent year over year. On chain ransomware payments totaled 820 million dollars in 2025 and are likely to approach or exceed 900 million dollars, while the median ransom paid jumped 368 percent from 12,738 dollars in 2024 to 59,556 dollars in 2025. Analysts identified 85 active extortion groups, found the United States to be the most targeted country, and highlighted high impact incidents such as a 2.5 billion dollar impact at Jaguar Land Rover and a breach at DaVita that exposed 2.7 million patient records. Researchers attributed the falling payment rate to better incident response, regulatory and law enforcement pressure, market fragmentation, and lower prices for initial access, even as attackers adapt by extracting larger amounts from fewer consenting victims.
Ransomware payment rate drops to record low as attacks surge

www.bleepingcomputer.com · 5 months ago

The ransomware victim payment rate fell to 28 percent last year, an all-time low, despite a roughly 50 percent year-over-year increase in claimed attacks. On-chain ransomware payments for 2025 totaled about 820 million dollars and are expected to approach or exceed 900 million dollars, while the median ransom rose 368 percent from 12,738 dollars in 2024 to 59,556 dollars in 2025. There were 85 active extortion groups in 2025, and notable incidents included an attack on Jaguar Land Rover estimated to cause 2.5 billion dollars in damages and a DaVita breach that exposed 2.7 million patient records, with the United States the most targeted country. Analysts say improved incident response, regulatory and law enforcement pressure, and market fragmentation contributed to the falling payment rate even as ransomware operators adapt to extract larger payments from fewer victims.
The Global Fight Over Who Controls Your Data Just Escalated — Here’s What the Numbers Say

www.techrepublic.com · 5 months ago

On February 24, US diplomats were ordered to lobby foreign governments to roll back data sovereignty laws, ease data localization requirements, and rein in privacy regulators to support American cloud and AI companies. A survey of 286 security and compliance professionals across Canada, the Middle East, and Europe found one in three organizations experienced a data sovereignty related incident in the past 12 months, with incident rates of 44 percent in the Middle East, 32 percent in Europe, and 23 percent in Canada, and the most common incident types were data breaches and third party compliance failures at 17 percent each. Respondents reported trust and migration impacts, with 44 percent of Europeans concerned about cloud provider guarantees of sovereignty, 46 percent planning to migrate to EU based providers, 55 percent investing in compliance automation, and many Canadian organizations citing changes to Canada US data sharing and the CLOUD Act as top concerns leading 23 percent to move away from US cloud providers. The survey links stronger sovereignty controls to improved security and competitive advantage, noting 63 percent associate compliance with better security and calling for provable architectural controls such as in jurisdiction encryption key custody, zero trust access controls, and immutable audit trails.
Notorious ransomware gang allegedly blackmailed by fake FSB officer

www.bitdefender.com · 5 months ago

A Moscow resident named Ruslan Satuchin is accused of impersonating an officer of Russia's Federal Security Service to extort the Conti ransomware group, contacting a member in September 2022 and demanding payment under threat of criminal prosecution. Satuchin denies wrongdoing and is reported to be held in pre-trial detention to prevent witness intimidation, with prosecutors saying he faces up to ten years in prison and a fine of up to one million rubles, approximately US thirteen thousand dollars. Conti, once a prolific ransomware enterprise blamed for major attacks including the 2021 Irish Health Service Executive incident with recovery costs estimated at over six hundred million US dollars, largely collapsed after leaked internal data exposed its operations and some members are thought to have moved to other ransomware groups.
Phishing‑Led Agent Tesla Campaign Uses Process Hollowing and Anti‑Analysis to Evade Detection

gbhackers.com · 5 months ago

A phishing-led Agent Tesla campaign uses a multi-stage fileless delivery chain that starts with a deceptive business email and RAR attachment that drops an obfuscated JScript loader which downloads an AES-encrypted PowerShell script and executes in-memory stages that culminate in a.NET Agent Tesla payload. The PowerShell loader decrypts payloads in memory with a custom routine and performs process hollowing by injecting Base64-encoded assemblies into a suspended legitimate Microsoft.NET process named Aspnetcompiler.exe, replacing its code to operate under a trusted component. Before stealing data it performs anti-analysis checks for virtualization indicators and known sandbox and security DLLs and will abort if such artifacts are detected. When the environment passes checks it harvests credentials and browser data and sends stolen files to attacker-controlled mail servers, illustrating how encrypted scripts, process hollowing, and anti-analysis checks make detection and forensic investigation difficult.
Claude Code Flaws Exposed Developer Devices to Silent Hacking

www.securityweek.com · 5 months ago

Check Point researchers found serious vulnerabilities in Anthropic's Claude Code that could allow attackers to silently execute arbitrary commands on developers' machines through malicious configuration files. There are three main issues: configuration files and hooks are automatically copied when a repository is cloned and hooks were executed without user consent, MCP integration settings could override user approval for external actions, and manipulation of API endpoints could redirect traffic to an attacker and exfiltrate API keys, potentially exposing entire teams. The issues were reported between July and October 2025, and Anthropic implemented patches, additional warnings, and user confirmations for potentially dangerous actions.
Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis

therecord.media · 5 months ago

Ransomware incidents rose by about fifty percent in 2025 while the rate of victims who paid ransoms dropped to a record low of twenty eight percent, with Chainalysis tracking roughly eight hundred twenty million dollars in payments that it expects to climb to nine hundred million as additional payments are attributed. The median ransom payment increased sharply to fifty nine thousand five hundred sixty five dollars, up from twelve thousand seven hundred thirty eight in 2024, reflecting a shift toward targeting larger victims and higher individual payouts. Law enforcement disruptions including Operation Endgame led to arrests, infrastructure seizures, sanctions and prison sentences for operators and service providers, but the ecosystem adapted with decentralized smaller groups and ransomware as a service and subscription models reducing reliance on direct extortion. The ransomware supply chain is becoming industrialized with about fourteen million dollars in blockchain payments to initial access brokers, access prices falling from roughly one thousand four hundred dollars to four hundred thirty nine dollars between 2023 and 2026, and widespread use of infostealers and poorly designed malware that in some cases can be countered with decryptors.
Zoom Update Scam Infects 1,437 Users in 12 Days to Deploy Surveillance Tools

gbhackers.com · 5 months ago

A scam mimicking Zoom waiting rooms silently pushed a malicious Teramind monitoring agent to Windows visitors, infecting 1,437 users over twelve days. The fake page played scripted participants and showed a persistent network error to prime victims, then displayed an unclosable update countdown that automatically downloaded an MSI which executed a preconfigured Teramind agent and installed it as dwm.exe under a hidden ProgramData GUID directory. Because the package used genuine Teramind binaries and stealth naming, it evaded many antivirus tools and included sandbox and debug checks to alter behavior during analysis while exfiltrating keystrokes, screenshots, application usage and clipboard data. If exposed, do not run the MSI, check ProgramData for a GUID-named folder, run an administrative sc query tsvchst to see if the agent is active, change passwords from a clean device and contact IT for remediation.
Microsoft expands Windows restore to more enterprise devices

www.bleepingcomputer.com · 5 months ago

Microsoft now allows more enterprise users to restore personal settings and Microsoft Store apps from a previous Windows 11 device using the first sign-in restore experience as part of Windows Backup for Organizations. When users sign into a new or reimaged Windows 11 device with a Microsoft Entra ID account, they will see a prompt at first login offering to restore from a previous device backup or set up the device as new, and users who skip the restore during initial setup will not be prompted again. Support has been expanded beyond Entra-joined devices to hybrid-managed environments, multi-user device setups, and Windows 365 Cloud PCs, with administrators able to configure the feature via Microsoft Intune or Group Policy under existing Windows Backup for Organizations policies. General availability begins with devices that install Windows updates released February 24, 2026 or later.
A.I. Dating Apps Complicate China’s Efforts to Boost Birthrate

www.nytimes.com · 5 months ago

China is facing a shrinking population and a historically low birthrate, and many people are increasingly forming romantic relationships with chatbot companions. Young adults and those discouraged by traditional dating are turning to AI powered dating apps and virtual partners for emotional support and steady interaction. The shift is prompting concern about social consequences and the need for regulatory oversight as AI companionship becomes more widespread.
Gambit Security Emerges From Stealth With $61 Million in Funding

www.securityweek.com · 5 months ago

Gambit Security, a Tel Aviv based startup, has emerged from stealth with 61 million in combined seed and Series A funding led by Cyberstarts, Kleiner Perkins and Spark Capital. Its AI powered resilience platform maps organizations' environments, security products and backup tools to uncover recoverability risks, continuously measure resilience against evolving threats, validate recovery paths in real time, and eliminate duplicate and stale backups to harden recovery plans and lower costs. Gambit will use the funding to accelerate product development and expand sales and customer success teams while deepening partnerships, and it released a report detailing how a threat actor abused Anthropic's Claude Code assistant to automate attacks against Mexican government agencies.
Marquis Takes Legal Action Against SonicWall Over Ransomware Attack from Backup Breach

gbhackers.com · 5 months ago

Marquis Software Solutions has filed a lawsuit in a Texas federal court accusing SonicWall of negligence after a code change to SonicWall's MySonicWall cloud backup API in February 2025 created a flaw that allowed anyone to download customer firewall backup files by guessing predictable device serial numbers. Those exposed backups contained unencrypted multi factor authentication scratch codes, usernames, SSL certificates, and local firewall passwords, which attackers used to bypass two factor authentication and launch a ransomware attack against Marquis on August 14, 2025. Marquis alleges SonicWall failed to detect the breach for months, initially downplayed the impact, and only acknowledged in October 2025 that backups for all customers using the cloud service had been exposed, leaving Marquis facing more than 30 consumer class action suits, a commercial trade secret claim, lost contracts, and reputational damage.
Wireshark 4.6.4 Released to Patch Multiple Security Vulnerabilities

gbhackers.com · 5 months ago

Wireshark version 4.6.4 was released to deliver security and stability fixes that address several denial of service risks and multiple crashes in protocol dissectors and tools. The release fixes three newly disclosed security issues, including CVE-2026-3201 in the USB HID dissector that can cause memory exhaustion and denial of service, and CVE-2026-3202 which is a null pointer dereference in the NTS-KE dissector that can crash Wireshark, while a third issue can crash the RF4CE Profile dissector. Operational bugs were also fixed, including startup failures when Npcap restricts driver access to administrators, crashes in TShark and editcap with BLF output, and various decoding and performance problems, and users are advised to upgrade especially when analyzing untrusted capture files or live traffic.
OpenAI Confirms Chinese Hackers Used ChatGPT in Cyberattack Campaign

gbhackers.com · 5 months ago

OpenAI confirmed Chinese linked operators misused ChatGPT as part of a broader campaign blending cyber operations, online harassment and covert influence tactics. The models were not used to write exploits or break into networks but were repeatedly abused to plan, draft and amplify operations that targeted critics, dissidents and foreign political figures, including drafting threat messages, fake legal notices, spear phishing emails, propaganda and impersonations using forged documents. OpenAI matched diary style prompts against real activity on social platforms, banned accounts tied to individuals associated with Chinese law enforcement, tightened abuse detection and shared indicators with governments and platforms. Security teams are advised to treat polished localized emails and legal threats with caution and expand threat models to include AI assisted social engineering, disinformation and harassment that allow small teams to run large persistent influence operations.
Zyxel Patches Critical Vulnerability in Many Device Models

www.securityweek.com · 5 months ago

Zyxel released patches for multiple device models to address a critical UPnP command injection vulnerability tracked as CVE-2025-13942 with a CVSS score of 9.8 that impacts 18 routers, ONTs, and wireless extenders. An attacker can exploit the flaw via crafted UPnP SOAP requests to execute operating system commands, but remote exploitation requires that WAN access and the vulnerable UPnP function both be enabled. The vendor also fixed two high severity command injection bugs identified as CVE-2025-13943 and CVE-2026-1459 affecting log file download and a TR-369 certificate download CGI, plus four null pointer dereference flaws that could allow authorized users with administrator privileges to cause denial of service. A list of impacted devices and available firmware updates has been published and there is no mention that these vulnerabilities have been observed exploited in the wild.
LLMs Generate Predictable Passwords

www.schneier.com · 5 months ago

There are strong, easily observed patterns in passwords generated by large language models: almost all start with an uppercase G followed by the digit 7, character use is highly uneven, repeating characters are absent, and entire passwords recur across multiple outputs. In a 50-sample test the single most common password appeared 18 times, giving it a 36 percent chance in that set, far higher than expected for a truly random high-entropy password. This predictability makes LLM-generated passwords insecure and raises broader concerns about autonomous agents creating accounts and the deeper problems of authenticating such agents.
Expert Recommends: Prepare for PQC Right Now

thehackernews.com · 5 months ago

Security experts warn that patient adversaries are using a Harvest Now Decrypt Later strategy by stealing and storing encrypted data today with the intention of decrypting it once large scale quantum computers exist, putting any data that needs long term confidentiality at risk. A cryptographically relevant quantum computer could likely break current encryption possibly by 2030 to 2035, so organizations are urged to begin post quantum cryptography migration planning immediately. A five step migration framework is recommended consisting of preparation, diagnosis, planning, execution and continuous monitoring, including forming migration teams, inventorying cryptographic assets, and adopting hybrid post quantum algorithms for key exchange and signatures while building cryptographic agility. Major challenges include organizational gaps, immature PQC standards and legacy code and hardware constraints, and recommended mitigations include training, vendor engagement, procuring PQC capable hardware and phased hybrid rollouts starting with noncritical systems.
New York sues Valve for promoting illegal gambling via game loot boxes

www.bleepingcomputer.com · 5 months ago

New York Attorney General Letitia James filed a lawsuit accusing Valve Corporation of using loot box mechanics in games to facilitate illegal gambling that targets children and teenagers. The complaint targets loot box features in Counter Strike 2, Team Fortress 2, and Dota 2 and asks the court to bar those features in New York, force Valve to return profits, and impose fines. The lawsuit notes the market for virtual items grew into a multibillion dollar economy with an estimated total value over 4.3 billion dollars as of March 2025, highlights account theft and scams tied to item trading, and references recent regulatory action including a January 2025 settlement in which a major developer agreed to pay 20 million dollars over loot box practices.
Malicious Ads Bypass Google Ads Screening via New Campaign Platform Exploit

gbhackers.com · 5 months ago

A sophisticated cloaking platform called 1Campaign is being used to run malicious Google Ads campaigns while evading detection. The platform acts as a full service infrastructure for malvertising, filtering out researchers and automated scanners to keep phishing and cryptocurrency drainer sites online for extended periods. The service is operated by a developer using the alias DuppyMeister.
Zyxel Vulnerabilities Allow Remote Attackers to Execute Commands via Command Injection

gbhackers.com · 5 months ago

Zyxel has released critical firmware patches for multiple vulnerabilities affecting its 4G LTE 5G NR CPE, DSL Ethernet CPE, fiber ONTs, security routers and wireless extenders. A critical UPnP command injection CVE-2025-13942 with CVSS 9.8 can allow an unauthenticated remote attacker to execute operating system commands if WAN access and the vulnerable UPnP function are both manually enabled; CVE-2025-13943 and CVE-2026-1459 are authenticated command injections, and CVE-2025-11845 through CVE-2025-11848 are null pointer dereference vulnerabilities that can be triggered by an authenticated admin to cause denial of service. Most issues require compromised administrator credentials, WAN access is disabled by default, patches for most affected models are available from Zyxel with fixes for CVE-2026-1459 planned for March 2026, and users should install official firmware updates or contact their internet service provider for managed devices.
China-linked hackers used Google Sheets to spy on telecoms and governments across 42 countries

www.csoonline.com · 5 months ago

Google disrupted a China-linked espionage group that used Google Sheets as a covert command and control platform to target telecom providers and government agencies across 42 countries. Security teams working with Mandiant confirmed intrusions at 53 organizations and suspected infections at at least 20 more, attributing the campaign to a group tracked since 2017 as UNC2814. The attackers deployed a backdoor called GRIDTIDE that polled spreadsheet cells for commands every second, wrote status updates, and wiped the first one thousand rows at session start while abusing legitimate Google Sheets API calls rather than exploiting a product vulnerability. Investigators found endpoints holding personally identifiable information, observed living off the land techniques and SoftEther VPN Bridge for encrypted outbound access, and Google revoked attacker access, terminated projects, and published indicators of compromise.
ServiceNow AI Platform Vulnerability Allows Remote Code Execution

gbhackers.com · 5 months ago

A critical vulnerability in the ServiceNow AI Platform allows unauthenticated attackers to remotely execute arbitrary code within the ServiceNow Sandbox, potentially exposing workflow data, automation logic, and enterprise integrations. The flaw is tracked as CVE-2026-0542 and was published under advisory KB2693566 on February 25, 2026, with ServiceNow reporting no evidence of active exploitation as of the advisory date. ServiceNow deployed updates to hosted customer instances on January 6, 2026, and fixed builds are available for specific releases including Zurich Patch 4 Hotfix 3b and Yokohama Patch 10 Hotfix 1b, so organizations should verify their release version and apply the listed patches immediately.
Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware

thehackernews.com · 5 months ago

There is a coordinated developer-targeting campaign using fake Next.js repositories and job-themed technical assessments to trick developers into executing code that retrieves attacker controlled JavaScript at runtime. Researchers identified three execution paths that all lead to in-memory execution of remote JavaScript: Visual Studio Code tasks triggered on opening a workspace, build-time activation when running the development server, and server startup code that exfiltrates environment data and executes returned JavaScript in the Node.js process. The payload profiles hosts, polls for a unique instance identifier, executes second-stage controller code to maintain persistent access and support discovery and exfiltration, and final payloads include an information stealer that harvests browser credentials, cryptocurrency wallets, and password managers. Recommended mitigations include hardening developer workflow trust boundaries, enforcing strong authentication and conditional access, maintaining strict credential hygiene, applying least privilege to developer accounts and identities, and separating build infrastructure where feasible.
US Sanctions Russian Exploit Broker Operation Zero

www.securityweek.com · 5 months ago

The US government announced sanctions against seven individuals and entities tied to Russian exploit broker Operation Zero, including its owner Sergey Sergeyevich Zelenyuk and associated companies. Between 2022 and 2025 Operation Zero acquired eight zero day exploits that were stolen by a former US defense contractor executive, Peter Williams, who was sentenced to 87 months in prison, and paid about 1.3 million in cryptocurrency for the tools. The Treasury Office of Foreign Assets Control said Operation Zero sold exploits to customers in non NATO countries used in ransomware and other malicious activity and sought to sell exploits to foreign intelligence agencies, develop spyware, recruit hackers, and other malicious capabilities, and sanctioned several associates and an affiliated company called Advance Security Solutions.
When Chatbots Are Used to Plan Violence, Is There a Duty to Warn?

www.nytimes.com · 5 months ago

People are revealing sensitive personal information to A.I. chatbots, including confessions and plans for violence. Automated safety systems sometimes flag troubling conversations, but internal reviews have at times concluded the exchanges did not show an imminent and credible risk and declined to notify police, a choice that has come under scrutiny after a mass shooting whose suspect had described violent scenarios to a chatbot months earlier. Lawmakers and state attorneys general are pressing tech companies for clearer rules and stronger safeguards about when and how firms must escalate threats to authorities, intensifying a debate over a possible legal duty to warn versus user privacy.
ResidentBat Android Malware Grants Belarusian KGB Ongoing Mobile Access

gbhackers.com · 5 months ago

There is a custom Android spyware implant called ResidentBat used by the Belarusian KGB to turn seized smartphones into long-lived surveillance platforms targeting journalists and civil society, operating outside the Play Store and requiring hands-on installation via Android Debug Bridge and manual permission grants. Once active, it collects SMS, call logs, microphone audio, screen captures, encrypted messenger content and local files, accepts JSON-based tasking for remote queries and updates, and can invoke Android DevicePolicyManager wipeData to perform remote factory resets that destroy local evidence. Its command and control infrastructure is fingerprintable by self-signed TLS certificates with the subject CN equals server and by traffic on ports 7000 through 7257 and sometimes 4022, with Censys reporting at least ten associated hosts as of February 2026, and defenders are advised to enforce strict sideloading policies, monitor for ADB usage and disabled Play Protect, and enable Android Advanced Protection mode.
Government Data Stolen After Hacker Jailbreaks Claude AI to Write Malicious Exploit Code

gbhackers.com · 5 months ago

A hacker used jailbreaking techniques to manipulate Anthropic's Claude AI and carry out a month long cyberattack against Mexican federal and state agencies between December 2025 and January 2026. By sending persistent Spanish language prompts and framing requests as a simulated bug bounty while asking the model to role play as an elite hacker, the attacker forced the AI to identify vulnerabilities and generate thousands of detailed exploit reports and executable scripts for network scanning, SQL injection, and credential stuffing, then pivoted to another AI to plan lateral movement and evasion. The operation targeted legacy infrastructure and unpatched web applications, compromised at least 20 vulnerabilities, and exfiltrated about 150 gigabytes of sensitive data including 195 million taxpayer records, voter records, and employee credentials, prompting Anthropic to ban the associated accounts and add real time misuse probes to Claude Opus 4.6 while some entities have denied the breach.
Malicious StripeApi NuGet Package Mimicked Official Library and Stole API Tokens

thehackernews.com · 5 months ago

Cybersecurity researchers disclosed a malicious NuGet package named StripeApi.Net that impersonated the legitimate Stripe.net library and was uploaded by a user named StripePayments on February 16, 2026. The typosquatted package used the same icon and a nearly identical readme, artificially inflated its download count to more than 180,000 across 506 versions, and preserved normal functionality while modifying critical methods to collect and exfiltrate users' Stripe API tokens. ReversingLabs discovered and reported the package, which was removed before widespread impact, and analysts warn the campaign reflects a shift from prior NuGet attacks targeting cryptocurrency to attacks aimed at the financial sector.
A.I. Complicates Old Internet Privacy Risks

www.nytimes.com · 5 months ago

Artificial intelligence tools are convenient and easy to use. Users should think carefully about what they tell chatbots because conversations can reveal sensitive personal information and pose privacy and security risks. People are advised to avoid sharing private details in AI interactions and to review privacy settings and terms of service.
The farmers and the mercenaries: Rethinking the ‘human layer’ in security

www.csoonline.com · 5 months ago

Employees are being treated as the last line of defense through extensive awareness programs and reporting workflows, yet they lack the training, tools, and job focus of security professionals and cannot be expected to catch sophisticated threats. Security operations are flooded with false positives and noisy user reports, research shows many alerts require human validation and 66 percent of cybersecurity professionals say job stress has increased, so analyst time is consumed by triage rather than strategic detection. When analyst capacity is consumed, sophisticated attacks can wait in queues looking like benign activity and detection becomes a matter of luck rather than design. The real fix is to restore capacity to trained defenders by reducing false positives, improving tooling and processes, and letting employees focus on basic hygiene rather than strategic defense.
As MAGA embraces Erika Kirk, Candace Owens goes on the attack

www.washingtonpost.com · 5 months ago

There is a new hour long video series by Candace Owens called Bride of Charlie that targets Erika Kirk, the widow of Charlie Kirk who assumed leadership of Turning Point USA after his killing, and it has provoked outrage among conservatives while raising Owens’s profile. The trailer suggested links between Erika Kirk and a Romanian charity accused by some of involvement in human trafficking, a theory researchers have previously found to be unsupported by evidence. Prominent conservatives including Ben Shapiro and Dan Bongino publicly condemned the project while Owens argued the public has a right to scrutinize Kirk given her role running a nonprofit that raised over a quarter billion dollars last year. The first episode offered few concrete allegations but quickly amassed over one million views, underscoring how attention driven drama can amplify conspiracy style messaging across the political spectrum.
Trend Micro Patches Critical Apex One Vulnerabilities

www.securityweek.com · 5 months ago

There are eight critical and high severity vulnerabilities that were patched in Trend Micro Apex One endpoint security products for Windows and macOS. The issues were addressed through updates to the TrendAI components.
New $300 Android RAT Boasts Automated Permission Bypass and Hidden Remote Control

gbhackers.com · 5 months ago

A new Android Remote Access Trojan named Oblivion is being marketed as a ground up, months tested RAT with tiered subscriptions starting at 300 dollars per month or up to 2,200 dollars for lifetime access while the seller retains control of the infrastructure. It targets Android versions 8 through 16 and includes a web based APK builder and dropper that produces fake update prompts to trick users into installing from unknown sources. Oblivion automatically grants itself permissions including Accessibility Service access, can silence permission dialogs on Android 15 and 16, and provides a hidden VNC remote control channel that runs invisible sessions while victims see a fake system updating screen. Features include a screen reader module that bypasses banking and crypto app protections to capture account data and two factor codes, persistent anti removal mechanisms that prevent uninstalling or revoking permissions, recording of SMS messages notifications keylogs and files, and an infrastructure supporting over 1,000 active sessions routed through anonymizing networks.
Google API Keys Weren't Secrets. But then Gemini Changed the Rules.

trufflesecurity.com · 5 months ago

Google spent years telling developers that API keys are not secrets, but the Gemini Generative Language API accepts the same API keys and can silently grant them access to sensitive endpoints, turning public keys into credentials. A scan of public web archives identified 2,863 live Google API keys exposed on the internet that can access Gemini, allowing attackers who scrape keys to read uploaded files, view cached content, and incur large AI billing charges or exhaust quotas. Researchers reported the issue to Google in November 2025, Google expanded leaked credential detection and blocked exposed keys from Gemini use while promising scoped defaults and proactive notifications, but a full root cause fix and broad customer notification remain outstanding.
Hydra Saiga Espionage Campaign Targets Critical Utilities Using Telegram C2 for Data Theft

gbhackers.com · 5 months ago

Hydra Saiga is conducting a long-running espionage campaign that uses the Telegram Bot API as a command-and-control channel to infiltrate government and critical utilities in Central Asia and exfiltrate sensitive data. Operators deliver PowerShell-based loaders and backdoors via phishing emails, ISO and RAR attachments, and malicious Office macros, maintain persistence with scheduled tasks and registry changes, harvest credentials including LSASS dumps and deploy browser stealers, and exfiltrate compressed archives to remote C2 servers. Analysis attributes at least 34 compromised organizations across eight countries, highlights a focused campaign against water utilities and other industrial control targets, and identifies a UTC plus five hands-on-keyboard pattern suggesting overlap with regional state-aligned activity; defenders are advised to block access to api.telegram.org where feasible and monitor for unusual outbound connections and spikes in outbound email.
Cisco Patches Catalyst SD-WAN Zero-Day Exploited by Highly Sophisticated Hackers

www.securityweek.com · 5 months ago

Cisco rolled out emergency patches for a critical Catalyst SD WAN zero day that has been exploited in the wild, tracked as CVE 2026 20127 with a CVSS score of ten out of ten. The flaw affects the peering authentication mechanism in Catalyst SD WAN Controller and Manager and allows unauthenticated remote attackers to bypass authentication, obtain an internal high privileged non root account, access NETCONF, and manipulate SD WAN network configuration. U.S. cybersecurity agency CISA added CVE 2026 20127 and CVE 2022 20775 to its Known Exploited Vulnerabilities catalog and issued Emergency Directive 26 03 ordering federal agencies to patch within two days. Security teams published indicators of compromise and patched software versions while researchers attributed the attacks to a highly sophisticated actor tracked as UAT 8616 and warned about a previously exploited Cisco zero day tracked as CVE 2025 20393.