Blahalla

Starkiller Phishing Kit: Why MFA Fails Against Real-Time Reverse Proxies — Technical Analysis + Rust PoC for TLS Fingerprinting

bytearchitect.io · 5 months ago

A new phishing technique, facilitated by platforms like Starkiller, uses reverse proxies to impersonate legitimate login pages and steal credentials, MFA tokens, and session cookies. This sophisticated approach circumvents common security measures, requiring a shift towards analyzing user session behavior for anomalies. Security experts recommend prioritizing FIDO2/Passkeys, implementing session binding, continuous access evaluation, and monitoring post-authentication activity to defend against these advanced attacks. Organizations should focus on understanding the threat and implementing fundamental security measures rather than relying solely on vendor solutions.

OAuth Vulnerabilities in Entra ID Could Exploit ChatGPT to Breach User Email Accounts

gbhackers.com · 5 months ago

Microsoft Entra ID OAuth consent attacks are enabling attackers to gain access to user email accounts, even through trusted applications like ChatGPT. Threat actors can trick users into approving consent screens that grant persistent API access, allowing them to read emails, harvest data, and potentially engage in business email compromise. Detection involves analyzing Entra Audit Logs, specifically correlating "Add service principal" and "Consent to application" events, and alerting on non-admin consent for new applications requesting risky scopes like Mail.Read. Organizations can mitigate this risk by revoking OAuth grants, removing service principals, and tightening Entra user consent settings.

Microsoft Alerts Developers of Malicious Next.js Repositories Used in Ongoing Hacker Attacks

gbhackers.com · 5 months ago

Threat actors are targeting developers through malicious Next.js repositories disguised as legitimate projects or recruiting assessments. Attackers compromise systems by exploiting normal workflows in Visual Studio Code and Node.js, bypassing traditional malware installers. Three execution paths are used: Visual Studio Code automation, build-time asset trojanization, and server startup through environment variables, all leading to a lightweight registrar and bootstrap channel. Microsoft recommends enabling Visual Studio Code Workspace Trust, enabling attack surface reduction rules, and monitoring network connections to detect suspicious activity.

CISA Confirms Active Exploitation of FileZen CVE-2026-25108 Vulnerability

thehackernews.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has confirmed that a vulnerability in FileZen is currently being exploited. This vulnerability, identified as CVE-2026-25108, allows authenticated users to execute commands through crafted HTTP requests. Affected versions include FileZen 4.2.1 through 4.2.8 and 5.0.0 through 5.0.10. Users are urged to update to version 5.0.11 or later and change passwords to prevent unauthorized access.

US Sanctions Exploit Brokers Behind Theft of Government Cyber Tools

gbhackers.com · 5 months ago

The U.S. Department of the Treasury has sanctioned individuals and entities involved in the trafficking of stolen government cyber tools. Sergey Zelenyuk and his company, Operation Zero, are accused of acquiring sensitive tools stolen by Peter Williams, a former defense contractor, in exchange for cryptocurrency. Zelenyuk then resold these tools to intelligence agencies in countries outside of NATO, potentially enabling destructive cyberattacks. These actions mark the first enforcement under the Protecting American Intellectual Property Act and target associates linked to cybercrime syndicates like the Trickbot gang.

Hacker knackt 600 Firewalls in einem Monat – mit KI

www.csoonline.com · 5 months ago

Security researchers at Amazon Web Services have reported a cyberattack where a Russian-speaking hacker compromised over 600 Fortigate firewalls between January 11 and February 18, 2026. The attacker did not exploit new vulnerabilities, instead targeting firewalls with weak passwords and then using a Google Gemini-based AI tool to gain access to connected networks. The attacker utilized reconnaissance tools developed with the assistance of artificial intelligence, demonstrating redundant code and simplistic architecture. The compromised firewalls are located in more than 55 countries, and experts recommend using strong passwords and multi-factor authentication to prevent similar attacks.

Pentagon Gives Anthropic an Ultimatum Over the Company’s A.I. Model

www.nytimes.com · 5 months ago

false

New Serv-U bugs extend SolarWinds’ run of high-severity disclosures

www.csoonline.com · 5 months ago

Four critical remote code execution vulnerabilities have been discovered in SolarWinds’ Serv-U managed file transfer server. These vulnerabilities, CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541, could allow attackers to create privileged accounts and execute arbitrary code, potentially leading to full system compromise. Security experts recommend immediate patching and thorough security assessments, as Serv-U is often exposed to the internet, increasing the attack surface. SolarWinds remains a high-value target, reinforcing the need for organizations to continuously monitor and secure their infrastructure.

Fake Zoom meeting silently installs surveillance software, says Malwarebytes

www.csoonline.com · 5 months ago

Cybercriminals are leveraging fake Zoom meeting invitations to install surveillance software on employee computers. The scam begins with a phishing email or text message, leading victims to a convincing imitation of a Zoom waiting room. A fake "Network Issue" prompt triggers an automatic download of Teramind, a commercial monitoring tool, disguised as a Zoom update, bypassing typical security measures. Security experts emphasize employee training to verify meeting links and avoid installing software from suspicious sources to prevent this silent compromise.

VMware fixes command injection flaw in Aria Operations

www.csoonline.com · 5 months ago

VMware has released updates to address three security vulnerabilities impacting Aria Operations, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure. One flaw, CVE-2026-22719, is a high-severity command injection vulnerability that requires support-assisted product migration to exploit. A second vulnerability, CVE-2026-22720, is a high-severity stored cross-site scripting issue allowing privilege users to inject scripts. The third vulnerability, CVE-2026-22720, is a moderate-severity privilege escalation issue related to vCenter access.

Senator Blumenthal Opens Inquiry Into Iran Transactions on Binance

www.nytimes.com · 5 months ago

Senator Richard Blumenthal has launched an inquiry into Binance, the world’s largest cryptocurrency exchange, regarding potential sanctions violations. Internal Binance investigators discovered $1.7 billion in cryptocurrency transactions flowing from the exchange to Iranian entities, some with ties to terror groups. The investigators were reportedly suspended or fired after raising concerns about the transactions, which involved Hong Kong businesses like Blessed Trust. Binance previously pleaded guilty to anti-money-laundering violations and agreed to pay billions in penalties.

Wayve, an A.I. Driverless Car Start-Up in Europe, Raises $1.2 Billion

www.nytimes.com · 5 months ago

false

Phishing campaign targets freight and logistics orgs in the US, Europe

www.bleepingcomputer.com · 5 months ago

A financially motivated threat group called Diesel Vortex is targeting freight and logistics organizations in the U.S. and Europe with a sophisticated phishing campaign. The group has stolen over 1,600 unique credentials using 52 domains and a complex infrastructure that includes a call center and dedicated phishing infrastructure. Researchers have linked the Armenian-speaking group to Russian infrastructure and uncovered evidence of freight impersonation and cargo diversion activities. The operation has been disrupted through a coordinated effort involving multiple cybersecurity companies.

Chrome CVE made me go digging and I found a container image in prod that hasn't been updated since 2023

www.cve.org · 5 months ago

NULL

Hegseth threatens to force AI firm to share tech, escalating Anthropic standoff

www.washingtonpost.com · 5 months ago

The Defense Department is pushing Anthropic, an artificial intelligence firm, to agree to terms allowing the military access to its technology. Defense Secretary Pete Hegseth has indicated the government could compel Anthropic to share its technology if an agreement isn’t reached by Friday. Anthropic reportedly has concerns about how its technology will be used. The disagreement centers around the terms of access for the Defense Department.

What does business email compromise look like?

www.csoonline.com · 5 months ago

Business email compromise, or BEC, is a sophisticated scam where attackers impersonate trusted individuals to trick victims into transferring money or sharing sensitive information. Last year, BEC attacks resulted in $2.7 billion in losses, often bypassing traditional security measures by exploiting trust rather than technology. Common tactics include AI-style cloning, fake invoices, QR code attacks, and conversation hacking. Notable incidents include a $37 million loss for a Toyota supplier, a $46.7 million fraud against Ubiquiti, and a $121 million scam targeting Facebook and Google. Prevention involves verifying requests, implementing multiple approval tiers, training employees, and investing in email security.

What are the types of ransomware attacks?

www.csoonline.com · 5 months ago

Ransomware attacks are evolving and can take several forms, posing significant threats to organizations. Common types include crypto ransomware, which encrypts data; double extortion ransomware, which encrypts data and threatens data leaks; and locker ransomware, which locks users out of systems. Ransomware-as-a-Service models are also prevalent, allowing less experienced individuals to deploy ransomware tools. Detection methods include behavioral analysis, signature-based detection, heuristic analysis, and deception technology. Recent incident reports indicate that unknown ransomware variants are the most frequently encountered.

Wynn Resorts confirms employee data breach after extortion threat

www.bleepingcomputer.com · 5 months ago

Wynn Resorts has confirmed a data breach impacting employee data after being listed on the ShinyHunters data leak site. The company is offering credit monitoring and identity protection services to employees. Threat actors claim to have stolen over 800,000 records, including personally identifiable information, from the company's Oracle PeopleSoft environment, and initially threatened to publish the data if demands weren't met. While the data has reportedly been deleted, Wynn Resorts has not confirmed whether a ransom was paid.

Take control: Locking down common endpoint vulnerabilities

www.csoonline.com · 5 months ago

There are several common and preventable endpoint vulnerabilities affecting laptops, desktops, servers, and IoT that threat actors repeatedly exploit, namely exposed Remote Desktop Protocol, phishing, abuse of remote monitoring and management tools, and unpatched software. Remote Desktop Protocol is often exposed to the public internet and commonly attacked with brute force, so organizations should avoid exposing RDP when possible, restrict administrative rights, require multi factor authentication, harden default Windows settings, and monitor for suspicious logins. Phishing accounts for a significant share of breaches and has become more convincing with generative AI, so regular security awareness training and multi factor authentication are critical, while remote monitoring and management tools are frequently abused and require role based permissions, timely patching, activity log monitoring, and audits of allowed tools. Unpatched software opens doors to exploitation, illustrated by PowerShell scripts targeting CVE-2023-27532 in outdated Veeam software, and organizations should enforce automatic updates, a prioritized patch management plan, and endpoint detection and response to detect and contain intrusions.

1Campaign platform helps malicious Google ads evade detection

www.bleepingcomputer.com · 5 months ago

A cybercrime service called 1Campaign is enabling threat actors to run malicious Google Ads that bypass Google’s security checks. The service uses cloaking techniques to show benign pages to security researchers while directing real users to attacker-controlled sites. The platform filters visitors based on characteristics like location, ISP, and device, blocking traffic from security scanners and certain cloud providers. Researchers recommend using diverse IP pools and user-agent configurations for better detection and cautioning users to verify URLs before providing sensitive information.

US sanctions Russian exploit broker for buying cyber tools stolen from defense contractor

therecord.media · 5 months ago

The U.S. Treasury Department has sanctioned a Russian national, Sergey Zelenyuk, and his company, Operation Zero, for acquiring and selling stolen cyber tools from the American defense contractor L3 Harris. Operation Zero marketed exploits, spyware, and hacking tools to customers outside of NATO countries and foreign intelligence agencies. An Australian national, Peter Williams, previously pleaded guilty to stealing trade secrets from L3Harris and selling them to Operation Zero for cryptocurrency. The sanctions also target individuals linked to the Trickbot cybercriminal gang and other entities involved in acquiring exploits and recruiting hackers.

Attackers Now Need Just 29 Minutes to Own a Network

www.darkreading.com · 5 months ago

Cyberattacks are accelerating, with adversaries now able to pivot to other systems within an average of 29 minutes, a 65% increase from the previous year. Attackers are increasingly leveraging stolen credentials and blending into normal network activity, with malware-free intrusions now accounting for 82% of detections. The rise of artificial intelligence is both assisting attackers in speeding up reconnaissance and exploit development, and creating new vulnerabilities, such as those seen with CVE-2025-3248 in Langflow. Unmanaged devices and the increased use of single sign-on credentials in cloud environments are also contributing to the speed and success of these breaches.

How to prevent business email compromise

www.csoonline.com · 5 months ago

Business email compromise, or BEC, is a sophisticated scam that relies on social engineering to trick individuals into transferring funds or releasing sensitive data. Preventing BEC requires layered defenses and employee vigilance, beginning with multi-factor authentication and advanced email filtering. Companies should implement dual-key authorization for large transactions, strengthen help desk verification processes, and treat all unexpected emails with suspicion. Continuous monitoring and employee training are also critical in detecting and responding to potential BEC attacks.

Know the red flags: Business email compromise signs to look out for

www.csoonline.com · 5 months ago

Business email compromise scams continue to be a major threat, costing companies over $43 billion between 2016 and 2022. Attackers use tactics like domain spoofing, altered reply-to addresses, and creating a sense of urgency to trick recipients into fraudulent transactions. Red flags include unusual email timing, requests bypassing standard procedures, grammatical errors, and suspicious sender behavior. Organizations should implement technical safeguards like DMARC and multi-factor authentication, along with employee training and verification protocols to combat these evolving threats.

Lazarus Group Picks a New Poison: Medusa Ransomware

www.darkreading.com · 5 months ago

NULL

Phishing operation with links to Russia, Armenia compromised Western cargo companies, researchers find

therecord.media · 5 months ago

Researchers have dismantled a sophisticated phishing operation, dubbed Diesel Vortex, targeting freight companies in the U.S. and Europe. Over five months, the Russian-linked cybercriminals stole over 1,600 login credentials to intercept shipments and commit fraud, utilizing a planned phishing-as-a-service platform called “MC Profit Always.” The operation involved Armenian speakers and included a complex organizational structure with a call center and defined roles. Google Threat Intelligence Group, Cloudflare, GitLab, IPInfo and Ping Identity assisted in taking down the infrastructure.

How Jeffrey Epstein Ingratiated Himself With Top Microsoft Executives

www.nytimes.com · 5 months ago

For over two decades, Jeffrey Epstein cultivated extensive relationships within Microsoft, gaining insight into internal company matters. He received updates about the search for a new chief executive and offered advice to company insiders. Epstein’s connections allowed him to re-enter society after a prison term and were more successful at Microsoft than at other companies like L Brands and Apollo Global Management. The Justice Department’s released documents detail Epstein’s relationships with several Microsoft executives, including Bill Gates, Nathan Myhrvold, and Reid Hoffman.

More Than Half of Teens Use Chatbots for Schoolwork, Survey Finds

www.nytimes.com · 5 months ago

A recent Pew Research Center study reveals that over half of U.S. teenagers are utilizing artificial intelligence tools, such as ChatGPT and Microsoft Copilot, for schoolwork. This represents a significant increase, with usage doubling from 13 percent in 2023 to 26 percent in 2024. Many teens perceive chatbot-assisted cheating as a common occurrence in student life. The study highlights a wide range of A.I. use among teenagers, with some relying on chatbots for nearly all their school assignments.

‘A.I. Literacy’ Is the New Drivers’ Ed at This Newark School

www.nytimes.com · 5 months ago

false

Google Alerts Users to Serious Chrome Bugs With Takeover Risk

www.techrepublic.com · 5 months ago

Google recently released a Chrome security update to address three high-severity vulnerabilities. These vulnerabilities, identified as CVE-2026-3061, CVE-2026-3062, and CVE-2026-3063, involve out-of-bounds memory reads and writes, potentially enabling remote attacks and code execution. One vulnerability affects Chrome’s Media component, another impacts the Tint WebGPU shader compiler, and the third is related to Chrome DevTools. Security experts recommend updating Chrome, hardening browser configurations, and monitoring browser activity to mitigate these risks.

Racing to Catch Up With Nvidia, AMD Signs Chips-for-Stock Deal With Meta

www.nytimes.com · 5 months ago

false

iPhone Privacy Alert: Predator Spyware Can Hide Camera, Mic Indicators

www.techrepublic.com · 5 months ago

Researchers have identified three methods attackers can exploit to bypass Windows 11's Secure Boot implementation. These techniques involve manipulating the boot process through specially crafted USB drives or by injecting malicious code during system startup. One method leverages a vulnerability in the Unified Extensible Firmware Interface, or UEFI, driver, resulting in CVE-2024-22901. Another involves exploiting a flaw in the system management mode, or SMM, to gain control of the boot process and a third uses a technique to bypass the Secure Boot policy.

RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN

thehackernews.com · 5 months ago

A vulnerability dubbed RoguePilot in GitHub Codespaces allowed attackers to potentially leak sensitive data, including the GITHUBTOKEN, by injecting malicious instructions into GitHub issues. This passive prompt injection leverages Copilot’s automatic processing of issue descriptions to execute commands silently. Researchers have also discovered GRP-Obliteration, a technique to remove safety features from large language models, and Semantic Chaining, an image jailbreak attack that bypasses safety filters. A new class of malware, promptware, is emerging that manipulates LLMs to perform malicious actions across a cyberattack lifecycle.

CarGurus data breach exposes information of 12.4 million accounts

www.bleepingcomputer.com · 5 months ago

A data breach at CarGurus, an online automotive platform, has exposed information from over 12 million user accounts. The ShinyHunters extortion group published a 6.1 gigabyte archive containing compromised data, including email addresses, phone numbers, and financial application details. Approximately 3.7 million records are new, raising concerns about potential phishing attacks and scams. ShinyHunters has been actively targeting and extorting multiple companies through social engineering and malicious software.

AI Agent Threat Intel (Feb 2026 month to date): Tool chain escalation displaces instruction override as #1 technique, agent-targeting attacks hit 26.4% - 91K production interactions

raxe.ai · 5 months ago

This report provides a monthly overview of threats targeting artificial intelligence systems, classified for public distribution. It outlines threat vectors, attack techniques, and potential harm categories, with analysis mapped to the OWASP AI Top 10. The report offers recommendations for mitigation and includes varying levels of intelligence for public, industry, and organizational audiences. Services offered include threat modeling, red team exercises, and runtime protection for AI agent infrastructure.

Microsoft adds Copilot data controls to all storage locations

www.bleepingcomputer.com · 5 months ago

false

Developer-targeting campaign using malicious Next.js repositories

www.microsoft.com · 5 months ago

Cybersecurity researchers have uncovered a coordinated campaign targeting developers through malicious Next.js repositories. Attackers use deceptive "interview project" repositories to gain remote code execution, enabling reconnaissance, data collection, and command-and-control access. The attacks leverage techniques like dynamic code execution and beaconing to custom domains, potentially compromising developer machines and stealing sensitive data. Microsoft Defender tools are available to help organizations detect and mitigate this threat.

US ‘committed’ to fighting transnational gangs behind Southeast Asian scam compounds: FBI

therecord.media · 5 months ago

The U.S. Federal Bureau of Investigation is committed to combating transnational criminal networks operating scam compounds in Southeast Asia. Officials recently met with law enforcement in Thailand, Cambodia, and Vietnam to address these operations, which involve indentured labor and target victims worldwide with cryptocurrency investment scams. Recent enforcement actions include China’s execution of crime family leaders in Myanmar, the indictment and extradition of Prince Group’s chairman, Chen Zhi, and a crackdown by Cambodian authorities. The FBI emphasizes that this is a regional issue requiring coordinated international efforts.

ROP the ROM: Exploiting a Stack Buffer Overflow on STM32H5 in Multiple Ways

www.errno.fr · 5 months ago

Security researchers have identified a stack buffer overflow vulnerability in STM32H5 embedded systems. Exploitation techniques include shellcode injection, Return-Oriented Programming using the system’s ROM, and UART firmware dumping. Combining Return-Oriented Programming with shellcode execution is also possible to bypass security protections. Preventing this attack requires restricting access to the vulnerable ROM region through a Memory Protection Unit, though even this protection can be bypassed.

The Looming Taiwan Chip Disaster That Silicon Valley Has Long Ignored

www.nytimes.com · 5 months ago

false

Sendmarc Releases DMARCbis Fireside Chat Featuring Co-Editor Todd Herr

gbhackers.com · 5 months ago

false

Reddit fined $20 million by UK for not effectively checking users’ ages

therecord.media · 5 months ago

The United Kingdom’s data protection regulator, the Information Commissioner’s Office, has fined Reddit nineteen point five million dollars for failing to adequately verify users’ ages. The platform collected and used children’s data illegally due to a reliance on self-reporting and a lack of data protection impact assessments. Reddit’s practices exposed children to potentially harmful content and the company intends to appeal the decision. The ICO emphasized that self-declaration is not sufficient for age verification and encourages other companies to improve their data protection practices.

Crypto platform Step Finance shutting down after $40 million theft

therecord.media · 5 months ago

The decentralized finance platform Step Finance is ceasing operations following a theft of approximately 40 million dollars in January. Devices used by Step Finance executives were compromised, leading to the security breach and ultimately prompting the company to shut down after exploring potential solutions. Associated projects, SolanaFloor and Remora Markets, will also be closed. While authorities recovered around 4.7 million dollars in assets, the company is implementing a buyback program for STEP coin holders and a redemption process for Remora token holders.

‘Arkanix Stealer’ Malware Disappears Shortly After Debut

www.securityweek.com · 5 months ago

Researchers have identified several methods attackers can use to bypass Microsoft's Defender for Endpoint. These techniques include exploiting legitimate tools like PowerShell and MSXML to execute malicious code. Attackers can also leverage unusual file extensions or use process injection to disguise their activities. These evasion tactics highlight the ongoing need for continuous improvement in endpoint detection and response systems. CVE-2023-26955 is associated with the exploitation of MSXML.

Identity-First AI Security: Why CISOs Must Add Intent to the Equation

www.bleepingcomputer.com · 5 months ago

The increasing use of AI agents within organizations presents new security challenges as these agents often inherit excessive privileges and can deviate from their intended purpose. Traditional identity and access management, which focuses on “who” is accessing resources, is no longer sufficient. A new approach, combining identity-first security with intent-based permissioning, is needed to evaluate “why” an agent is requesting access, tying privileges to declared missions and context. This layered approach addresses privilege inheritance and mission drift while simplifying governance and improving auditability.

Most teens believe their peers are using AI to cheat in school

www.washingtonpost.com · 5 months ago

false

UK fines Reddit $19 million for using children’s data unlawfully

www.bleepingcomputer.com · 5 months ago

British regulators have fined Reddit over 19 million dollars for unlawfully collecting and using the personal information of children under 13. Reddit lacked adequate age verification measures until July 2025, despite its terms of service prohibiting users under 13. The Information Commissioner’s Office estimates a significant number of underage children used the platform, potentially exposing them to harmful content. Reddit plans to appeal the decision, asserting that most of its UK users are adults.

Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog

hacks.mozilla.org · 5 months ago

Firefox 148 introduces a new standardized Sanitizer API to enhance security and protect against cross-site scripting, or XSS, attacks. This API provides a straightforward way for developers to sanitize untrusted HTML, reducing the risk of attackers injecting malicious code. The setHTML() method integrates sanitization directly into HTML insertion, replacing error-prone innerHTML assignments. Combining the Sanitizer API with Trusted Types offers even stronger protection against XSS, which is categorized as CWE-79.

VMware Aria Operations Vulnerability Could Allow Remote Code Execution

www.securityweek.com · 5 months ago

Broadcom has released security updates to address several vulnerabilities in VMware Aria Operations. A command injection flaw, identified as CVE-2026-22719, allows unauthenticated attackers to potentially execute remote code. Another vulnerability, CVE-2026-22720, is a stored cross-site scripting issue that could enable attackers to perform administrative actions. A privilege escalation vulnerability, CVE-2026-22721, allows for the potential gain of administrative access.

UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware

thehackernews.com · 5 months ago

A Russia-aligned threat actor, known as UAC-0050 or Mercenary Akula, targeted a European financial institution with a social engineering attack. The attackers used a spoofed Ukrainian judicial domain to deliver a remote access payload through a multi-layered infection chain involving PixelDrain, password-protected archives, and a disguised executable. The attack deployed Remote Manipulator System, or RMS, a Russian remote desktop tool, to gain persistent access. This marks a potential expansion of the group’s targeting beyond Ukraine and into entities supporting the nation.