Blahalla

CISA Warns of Actively Exploited Google Chromium 0‑Day Vulnerability

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability to its list of known exploited vulnerabilities. This flaw, tracked as CVE-2026-2441, is a Use-After-Free vulnerability in the Chromium browser engine’s CSS component and is currently being exploited. Attackers can potentially execute code or cause crashes by tricking users into visiting malicious web pages, and the vulnerability affects browsers like Microsoft Edge, Opera, Vivaldi, and Brave. Federal agencies must patch the vulnerability by March 10, 2026, and all organizations are strongly advised to apply vendor mitigations immediately.

Dell RecoverPoint Zero-Day Exploited by Chinese Cyberespionage Group

www.securityweek.com · 5 months ago

A China-linked cyberespionage group, tracked as UNC6201, has exploited a zero-day vulnerability in Dell’s RecoverPoint for Virtual Machines since at least mid-2024. The vulnerability, CVE-2026-22769, involves hardcoded credentials and allows for unauthorized access and persistence. The group has been observed using malware like BrickStorm and a new backdoor called GrimBolt, which provides remote shell capabilities. Attackers also deployed a web shell named SlayStyle and created hidden network interfaces to conceal their activities.

The new paradigm for raising up secure software engineers

www.csoonline.com · 5 months ago

false

Foxveil Malware Loader Uses Cloudflare, Netlify, and Discord to Bypass Detection

gbhackers.com · 5 months ago

A new malware loader called Foxveil is using trusted platforms like Cloudflare Pages, Netlify, and Discord to bypass detection and deliver malicious payloads. The loader, active since August 2025, employs two variants, Foxveil v1 and v2, with differing injection and persistence techniques. Foxveil retrieves shellcode from these platforms, reduces on-disk artifacts, and uses string mutation to evade analysis, potentially serving as a staging loader for frameworks like Cobalt Strike. Researchers have observed behavior indicative of attempts to manipulate Microsoft Defender configurations, targeting the ExclusionPath for the SysWOW64 directory.

CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update

thehackernews.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its list of actively exploited weaknesses. These include a use-after-free vulnerability in Google Chrome, an arbitrary file upload flaw in TeamT5 ThreatSonar Anti-Ransomware, a server-side request forgery vulnerability in Synacor Zimbra Collaboration Suite, and a buffer overflow vulnerability in Microsoft Windows Video ActiveX Control. Exploitation of the Chrome vulnerability is already occurring, and attackers have been observed using the Zimbra vulnerability to target systems in multiple countries. The Microsoft ActiveX Control vulnerability can be used to download malware such as Dogkild, a worm that can overwrite system files and disable security processes.

Critical Flaw in Windows Admin Center Exposes Systems to Privilege Escalation Attacks

gbhackers.com · 5 months ago

A critical vulnerability, tracked as CVE-2026-26119, has been identified in the Windows Admin Center, allowing for privilege escalation. The flaw stems from improper authentication and has a CVSS base score of 8.8, classifying it as critical. Attackers with low-level privileges can exploit this network-based vulnerability without user interaction to gain control of systems, compromising confidentiality, integrity, and availability. Microsoft has released a security update and recommends immediate patching to prevent exploitation.

New Phishing Campaign Exploits Booking.com Partners, Targets Customers in Multi-Stage Fraud Scheme

gbhackers.com · 5 months ago

A coordinated phishing campaign is targeting hotels and their customers through the Booking.com platform. The attack unfolds in three stages: first, phishing emails target hotel staff to steal login credentials using a fake Booking.com partner portal; then, compromised accounts are used to access booking records; finally, customers receive WhatsApp messages with realistic booking details and links to a phishing kit designed to steal payment data. Investigators link this activity to intrusion set BR-UNC-030 and note the use of custom phishing kits and infrastructure, with code suggesting Russian-speaking development ties.

OpenClaw AI ‘Log Poisoning’ Flaw Enables Malicious Content Injection

gbhackers.com · 5 months ago

A log poisoning vulnerability has been identified in the OpenClaw AI assistant, enabling attackers to manipulate the agent’s behavior through indirect prompt injection. The flaw arises from unsanitized data within User-Agent and Origin headers being written to log files, allowing for payloads up to 14.8 kilobytes. Attackers can exploit this by crafting malicious requests and later triggering the agent to read the poisoned logs, potentially influencing decisions or exposing sensitive data. The vulnerability, classified as GHSA-g27f-9qjv-22pm, has been patched in version 2026.2.13.

CRESCENTHARVEST Malware Campaign Uses Iran Protest Lures to Deploy Info‑Stealing RAT

gbhackers.com · 5 months ago

A new malware campaign, CRESCENTHARVEST, is targeting Farsi-speaking users, particularly those supporting Iran's ongoing protests. The attackers use politically themed lures, including archives containing protest footage and documents, to deliver a remote access trojan that steals information. The malware uses techniques like DLL sideloading and a keyboard hook to harvest credentials, browser data, and keystrokes, and it communicates with command-and-control servers using JSON messages over HTTPS. The campaign suggests an Iranian-aligned threat actor is attempting to monitor protest supporters and activists.

Dell 0-Day Vulnerability Targeted by Chinese Hackers Since Mid-2024 for Ongoing Malware Campaign

gbhackers.com · 5 months ago

Chinese state-sponsored hackers, identified as UNC6201, have exploited a critical zero-day vulnerability in Dell RecoverPoint for Virtual Machines since mid-2024. The vulnerability, CVE-2026-22769, allows attackers to gain root access through hardcoded credentials in the Apache Tomcat Manager. The attackers initially used malware called BRICKSTORM, which has been replaced by a more advanced tool named GRIMBOLT, written in C to evade detection. Dell has released update version 6.0.3.1 HF1 to address this vulnerability.

Singapore & Its 4 Major Telcos Fend Off Chinese Hackers

www.darkreading.com · 5 months ago

Singapore's cybersecurity agencies and four major telecommunications companies successfully defended against an 11-month cyberattack by a China-linked group, identified as UNC3886. The attackers used advanced tools, including a zero-day exploit and rootkits, to gain unauthorized access to telecommunications networks and systems, but were prevented from disrupting services or stealing data. This operation, dubbed Cyber Guardian, underscored the importance of public-private partnerships and intelligence sharing in protecting critical infrastructure. Authorities are warning that future attempts to compromise telecommunications infrastructure are likely.

SVD-2026-0204: Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise