Blahalla

New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released

thehackernews.com · 5 months ago

Google has released a security update to address a zero-day vulnerability in Chrome, identified as CVE-2026-2441. The vulnerability is a use-after-free bug in the CSS component and allows a remote attacker to execute arbitrary code. An exploit for this flaw is currently being used, although Google has not released details about the attacks. Users are advised to update to the latest version of Chrome or other Chromium-based browsers.

CISA Issues Alert on ZLAN ICS Flaws Enabling Full Device Takeover

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about critical vulnerabilities in ZLAN Information Technology’s ZLAN5143D device server. These flaws, affecting firmware version 1.600, allow attackers to bypass authentication and gain full administrative control. Security researchers at KPMG discovered the issues, which have been assigned CVSS v3 scores of 9.8, specifically CVE-2026-25084 and CVE-2026-24789. Organizations are urged to isolate control system networks and use secure remote access methods like VPNs to mitigate the risk.

ZeroDayRAT Exploit Targets Android & iOS, Enabling Real-Time Surveillance and Massive Data Theft

gbhackers.com · 5 months ago

A new mobile spyware platform called ZeroDayRAT is gaining traction, offering attackers complete remote control over both Android and iOS devices. The tool facilitates real-time surveillance and data theft through a user-friendly interface, with infection occurring via smishing texts, phishing emails, and malicious apps. ZeroDayRAT harvests extensive device data, including location, account details, SMS messages, and even live camera and microphone feeds, and includes modules for cryptocurrency and bank credential theft. Security experts recommend avoiding sideloaded apps and implementing mobile threat defenses to protect against this increasingly accessible threat.

Attackers Exploit Critical BeyondTrust Flaw to Seize Full Active Directory Control

gbhackers.com · 5 months ago

A critical vulnerability, CVE-2026-1731, has been identified in BeyondTrust Remote Support and Privileged Remote Access deployments, allowing unauthenticated attackers to execute operating system commands. Threat actors are exploiting this flaw to gain control of Active Directory environments, escalating privileges by creating new domain accounts and joining them to high-privilege groups. Federal agencies are required to patch the vulnerability by February 16, 2026, and self-hosted environments require immediate patching with updates BT26-02-RS or BT26-02-PRA. Cloud-based customers were automatically patched on February 2, 2026.

Lotus Blossom Hackers Breach Official Notepad++ Hosting Infrastructure

gbhackers.com · 5 months ago

A state-sponsored threat group, Lotus Blossom, compromised the hosting infrastructure used to distribute Notepad++ updates between June and December 2025. Attackers redirected users to malicious servers, delivering trojanized installers that deployed advanced payloads using DLL sideloading and Lua script execution. The attackers utilized a custom backdoor called Chrysalis, incorporating code protection and stealthy persistence techniques to evade detection, and targeted organizations across multiple sectors and regions. Notepad++ has since migrated to a more secure hosting provider and implemented enhanced update verification measures in versions 8.8.9 and 8.9.2.

Chrome 0-Day Enables Remote Code Execution in Ongoing Campaign

gbhackers.com · 5 months ago

A critical security update has been released for Google Chrome to address a zero-day vulnerability currently being exploited. The vulnerability, CVE-2026-2441, is a "Use After Free" flaw in the browser’s CSS component that could allow attackers to execute code. Google confirmed that an exploit exists in the wild and has restricted details of the vulnerability while a majority of users update. Users are advised to manually check for and install the update immediately.

Canada Goose investigating as hackers leak 600K customer records

www.bleepingcomputer.com · 5 months ago

Canada Goose is investigating a data leak impacting over 600,000 customer records. The data, released by the data extortion group ShinyHunters, includes customer names, addresses, order histories, and partial payment card information like card brand and the last four digits. Canada Goose reports no evidence of a breach of its own systems, suggesting the data originated from a third-party payment processor breach dating back to August 2025. ShinyHunters has denied any connection to recent single sign-on attacks.

New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS

www.bleepingcomputer.com · 5 months ago

Threat actors are now using a new technique in ClickFix social engineering attacks to deliver malware through DNS queries. Victims are instructed to run a specific nslookup command that retrieves a malicious PowerShell script from an attacker-controlled DNS server. This script then executes a remote access trojan called ModeloRAT, which allows attackers remote control of the compromised system. This marks the first known use of DNS as a channel in ClickFix campaigns, allowing for on-the-fly payload modifications and blending with normal network traffic.

I built a free, open-source platform to learn GenAI security, learning content + hands-on labs against real LLMs (beta, looking for feedback)

prompttrace.airedlab.com · 5 months ago

NULL

Windows 11 KB5077181 fixes boot failures linked to failed updates

www.bleepingcomputer.com · 5 months ago

A bug affecting some commercial Windows 11 systems has been resolved in the February 2026 Patch Tuesday update, KB5077181. The issue caused boot failures with an "UNMOUNTABLEBOOTVOLUME" error after installing security updates from January 13, 2026, or later. The problem stemmed from a failed December 2025 security update installation and primarily impacted physical devices running Windows 11 versions 24H2 and 25H2. While an initial fix was released in January 2026, Microsoft now states the issue is fully resolved.

CTM360: Lumma Stealer and Ninja Browser malware campaign abusing Google Groups

www.bleepingcomputer.com · 5 months ago

A sophisticated malware campaign is leveraging Google Groups and hosted URLs to distribute malicious software globally. Attackers create seemingly legitimate discussions within industry-related forums to trick users into downloading credential-stealing malware or a trojanized browser disguised as “Ninja Browser.” Windows users receive the Lumma Stealer, while Linux users are infected with a browser containing hidden malicious extensions that track user data and facilitate future compromise. The campaign abuses trusted Google services to evade detection and gain user confidence.

Pastebin comments push ClickFix JavaScript attack to hijack crypto swaps

www.bleepingcomputer.com · 5 months ago

Cybercriminals are using Pastebin comments to lure cryptocurrency users into a new ClickFix-style attack. The scheme promises large profits through a fake Swapzone.io arbitrage exploit, but instead directs victims to execute malicious JavaScript code in their browser. This code hijacks Bitcoin swap transactions, redirecting funds to attacker-controlled wallets by manipulating the swap process and replacing legitimate Bitcoin addresses with those controlled by the attackers. This marks a novel use of ClickFix techniques, traditionally targeting operating systems, now exploiting JavaScript within a browser environment.

Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging

thehackernews.com · 5 months ago

Cybercriminals are increasingly using a social engineering tactic called ClickFix to distribute malware. This technique tricks users into running commands that execute malicious code, often disguised as troubleshooting steps. Attackers use DNS lookups to retrieve payloads, bypass security controls, and establish a staging channel before deploying malware like ModeloRAT and Lumma Stealer. Recent campaigns involve fake CAPTCHA pages and compromised websites, targeting both Windows and macOS systems to steal credentials and cryptocurrency.

Could an Electronic Coach Help Ski Jumpers Leap Farther?

www.nytimes.com · 5 months ago

false

More Than Ever, Videos Expose the Truth. And Cloud It, Too.

www.nytimes.com · 5 months ago

false

More Than Ever, Videos Expose the Truth. And Cloud It, Too.

www.nytimes.com · 5 months ago

false

He spent decades perfecting his voice. Now he says Google stole it.

www.washingtonpost.com · 5 months ago

NPR’s David Greene is suing Google, claiming the company unlawfully replicated his voice. Greene alleges Google’s NotebookLM artificial intelligence tool mimics his voice without consent or compensation. A former colleague alerted Greene to the similarity after noticing the AI’s vocal qualities. He is claiming the creation of this product violates his rights.

Introducing IDA-Free-MCP: mcp server for IDA Free version (native)

0xshlomil.github.io · 5 months ago

false

First Ever OffSec USA Chapter Meetup - DMV Area!

oxidized-root-d90.notion.site · 5 months ago

false

Cloudflare Pages “Continue Read” Redirect Kit Abused for Phishing, Adware, and Malware Delivery

malwr-analysis.com · 5 months ago

Attackers are abusing Cloudflare Pages to host seemingly legitimate SEO articles, like celebrity net worth blogs, which then trigger deceptive “Continue reading” pop-ups. Clicking these buttons redirects users to phishing pages, adware installers, or malware droppers, sometimes disguised as browser downloads or fake CAPTCHA challenges. Over 250 URLs have been observed using this technique, with activity persisting for five months, suggesting a coordinated effort to evade detection and attract organic traffic through search engine indexing. The operation utilizes a central redirect endpoint at preservationwristwilling[.]com/utx3iw6i?key= to manage traffic distribution and includes anti-analysis measures like proxy/VPN detection. A sample executable with SHA256 be590100ecdcae5ce4b7b42f87082e201fcb2f38c114c8fbc6640ad9b9a0708a has been classified as adware/PUP.

Meta Plans to Add Facial Recognition Technology to Its Smart Glasses

www.nytimes.com · 5 months ago

false

Upcoming Speaking Engagements

www.schneier.com · 5 months ago

false

One threat actor responsible for 83% of recent Ivanti RCE attacks

www.bleepingcomputer.com · 5 months ago

Security researchers have observed a single threat actor responsible for the majority of recent attacks exploiting vulnerabilities in Ivanti Endpoint Manager Mobile. This actor leveraged CVE-2026-21962 and CVE-2026-24061, which allow for remote code execution without authentication. The attacks primarily originate from a single IP address hosted on bulletproof infrastructure, accounting for over 83% of exploitation activity. This threat actor is also targeting vulnerabilities in Oracle WebLogic, GNU Inetutils Telnetd, and GLPI.

Snail mail letters target Trezor and Ledger users in crypto-theft attacks

www.bleepingcomputer.com · 5 months ago

Cybercriminals are targeting cryptocurrency hardware wallet users with sophisticated physical phishing campaigns. Threat actors are sending letters impersonating Trezor and Ledger, claiming mandatory authentication or transaction checks to pressure recipients into scanning QR codes. These codes direct victims to fake websites designed to steal recovery phrases, granting attackers control of their cryptocurrency wallets. Never share recovery phrases, as legitimate hardware wallet companies will never request them.

Hacking a pharmacy to get free prescription drugs and more

eaton-works.com · 5 months ago

Security vulnerabilities on the Dava India Pharmacy website allowed an unauthorized party to create a super administrator account. This account granted complete control over the pharmacy's online operations, including access to nearly 17,000 orders and the ability to modify product details and create coupons. The vulnerability, discovered in August 2025, enabled the creation of a 100 percent off coupon, though no orders were placed using it. Dava India addressed the issue in September 2025, and customers are not believed to have had their data compromised.

David J. Farber, ‘Grandfather of the Internet,’ Dies at 91

www.nytimes.com · 5 months ago

false

Over 300 Malicious Chrome Extensions Caught Leaking or Stealing User Data

www.securityweek.com · 5 months ago

Security researchers have identified over 300 malicious Chrome extensions that are leaking or stealing user data. These extensions are transmitting browsing history and search results to unsecured networks or collection servers, impacting over 37 million users. The data appears to be collected for monetization by data brokers, and some extensions are linked to known spyware distributors. LayerX also reported on 30 extensions posing as AI tools that inject iframes to manipulate content and steal data, with 15 specifically targeting Gmail.

Trump officials condemned Don Lemon. He’s bigger than ever after arrest.

www.washingtonpost.com · 5 months ago

false

REMnux v8 Linux Toolkit Released With AI-Powered Malware Analysis Capabilities

gbhackers.com · 5 months ago

REMnux v8, a Linux toolkit for malware analysis, has been released with significant updates. The toolkit now incorporates artificial intelligence to assist researchers in reverse engineering processes. The operating system has been upgraded to Ubuntu 24.04, and a new installer has been implemented for greater reliability. Over 200 tools are included, with a focus on analyzing modern programming languages and mobile threats.

Best Free Security Tools Everyone Should Use in 2026

techputs.com · 5 months ago

false

Viral AI Caricatures Highlight Shadow AI Dangers

www.techrepublic.com · 5 months ago

A viral social media trend where users generate caricatures of themselves and their jobs using AI tools like ChatGPT is raising security concerns. The trend inadvertently reveals how employees are using AI for work, potentially inputting sensitive data into public platforms and increasing the risk of social engineering attacks and data leakage. This highlights a broader problem of shadow AI, where organizations lack control over employee AI usage, and exposes a significant attack surface. Security teams should focus on AI governance, secure alternatives, and monitoring for compromised accounts and data exfiltration. The trend is associated with the OWASP LLM Top Ten risk of Sensitive Information Disclosure (LLM2025:02).

Homeland Security Demands Social Media Sites Reveal Names Behind Anti-ICE Posts

www.nytimes.com · 5 months ago

The Department of Homeland Security is seeking to identify individuals critical of Immigration and Customs Enforcement. They have issued hundreds of subpoenas to companies like Google, Meta, Reddit, and Discord, requesting personal information associated with social media accounts. These accounts have been identified for criticizing ICE or revealing the locations of ICE agents. Tech companies are reviewing these requests before complying, and some have notified users of the data requests, allowing them to challenge the subpoenas in court.

Critical BeyondTrust RS vulnerability exploited in active attacks

www.csoonline.com · 5 months ago

Cybersecurity researchers have observed attackers exploiting a critical vulnerability, CVE-2026-1731, in BeyondTrust Remote Support to compromise systems. The attacks have targeted self-hosted BeyondTrust appliances, including those from Bomgar, many of which are past their end-of-life. Attackers are deploying SimpleHelp, creating domain accounts, and utilizing tools like Impacket to move laterally within networks. The US Department of the Treasury experienced a compromise related to this vulnerability.

Phishing on the Edge of the Web and Mobile Using QR Codes

unit42.paloaltonetworks.com · 5 months ago

Threat actors are increasingly using QR codes to launch phishing and malware attacks on mobile devices, bypassing security measures. Attackers are masking destinations, exploiting in-app deep links, and distributing malicious apps directly. Targeted platforms include Telegram, WhatsApp, Signal, and Line, and campaigns have specifically targeted Signal users in Ukraine. Users should be cautious when scanning QR codes due to the potential for financial fraud, account takeovers, and malicious app installations.

I built a vulnerable AI banking CTF—5 flags covering prompt injection techniques (write-up in comments)

www.sbytec.com · 5 months ago

Prompt injection is a serious vulnerability that allows attackers to manipulate the input given to large language models. Attackers can use prompt injection to bypass security guardrails, forcing the AI model to perform unintended actions. These malicious inputs can potentially reveal sensitive data or cause the model to generate harmful and inappropriate content. Developers must implement robust input validation and established defensive techniques to mitigate this risk.

Fake job recruiters hide malware in developer coding challenges

www.bleepingcomputer.com · 5 months ago

North Korean threat actors are targeting JavaScript and Python developers through fake job postings, employing a campaign called "Graphalgo." Attackers create fraudulent companies in the blockchain and cryptocurrency sectors and require candidates to run malicious code during the interview process. These activities involve 192 malicious packages hosted on npm and PyPi, which install a remote access trojan (RAT) capable of stealing cryptocurrency and exfiltrating data. Researchers attribute the campaign to the Lazarus group and advise developers who may have been compromised to rotate credentials and reinstall their operating systems.

Friday Squid Blogging: Do Squid Dream?

www.schneier.com · 5 months ago

false

Zscaler-SquareX Deal Boosts Zero Trust, Secure Browsing Capabilities

www.darkreading.com · 5 months ago

false

Claude LLM artifacts abused to push Mac infostealers in ClickFix attack

www.bleepingcomputer.com · 5 months ago

Threat actors are using Claude artifacts and Google Ads to distribute MacSync infostealer malware to macOS users. Malicious search results lead users to either Claude artifacts or fake Apple Support pages, instructing them to execute shell commands in Terminal. These commands download and run the infostealer, which steals sensitive data like keychain information, browser data, and crypto wallet details before exfiltrating it to a command-and-control server. Researchers have observed over 27,000 views of the malicious Claude guide, highlighting the potential reach of this campaign.

Fingerprinting The Gentleman ransomware gang on Tor

www.sprocketsecurity.com · 5 months ago

A significant data leak has exposed details about the ransomware group "The Gentlemen" and their operational practices. Researchers found that the group uses a shared SFTP server at 194.87.31.69:2222 for data exfiltration, with multiple rclone configurations using different credentials for each victim. The SFTP server is linked to Vidar stealer infrastructure, and the leak also suggests potential affiliate relationships with other ransomware groups like Mallox. This incident highlights how open-source intelligence techniques can uncover valuable information about cybercriminals.

F.T.C. Chair Warns Apple Against Bias in Apple News

www.nytimes.com · 5 months ago

The Federal Trade Commission chair has cautioned Apple regarding potential violations of consumer protection laws. A recent study alleges Apple News is suppressing conservative viewpoints and favoring left-leaning media. The FTC chair stated consumers expect neutral coverage and the company may not be upholding its commitments. This action aligns with a broader effort by Trump-appointed officials to address perceived media bias.

Louis Vuitton, Dior, and Tiffany fined $25 million over data breaches

www.bleepingcomputer.com · 5 months ago

South Korea has fined Louis Vuitton, Dior, and Tiffany a combined $25 million for data security failures impacting over 5.5 million customers. Hackers accessed a shared cloud-based customer management service, resulting in data breaches including names, phone numbers, and purchase histories. Louis Vuitton’s breach stemmed from malware on an employee’s device, while Dior and Tiffany were compromised through phishing and voice phishing attacks on customer service employees. The South Korean Personal Information Protection Commission stressed that companies remain responsible for securing customer data, even when using third-party services.

South Korea fines Louis Vuitton, Christian Dior, Tiffany $25M for SaaS security failures

www.csoonline.com · 5 months ago

South Korean authorities have fined Louis Vuitton, Christian Dior, and Tiffany a combined 25 million US dollars for security failures related to customer data. The breaches involved vishing attacks and malware compromising employee devices, impacting over 5 million customers. All three companies failed to implement basic security measures like IP-based access controls and stronger authentication, and missed breach notification deadlines. The Personal Information Protection Commission emphasized that using Software-as-a-Service does not relieve companies of their responsibility to protect personal information.

Space emerges as new front in great power competition, officials warn

therecord.media · 5 months ago

false

Researchers unearth 30-year-old vulnerability in libpng library

www.csoonline.com · 5 months ago

A decades-old vulnerability has been found and patched in the widely used libpng open-source library. The flaw, identified as CVE-2026-25646, is a heap buffer overflow that could potentially lead to information extraction or remote code execution, though exploitation requires specific conditions. The vulnerability exists in the pngsetquantize function and is fixed in version 1.6.55 of the library. Security experts caution against panic, noting the vulnerability’s complexity and relatively low usage, while also acknowledging that AI tools may uncover more dormant vulnerabilities in open-source software.

Battling bots face off in cybersecurity arena

www.csoonline.com · 5 months ago

false

Ring ends partnership plans with Flock days after privacy blowback from Super Bowl ad

therecord.media · 5 months ago

false

Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs

thehackernews.com · 5 months ago

Google’s Threat Intelligence Group has linked a suspected Russian-affiliated actor to cyberattacks on Ukrainian organizations using CANFAIL malware. This group has expanded its targeting to include aerospace, manufacturing, and humanitarian organizations, in addition to defense and government entities. Attackers are utilizing large language models to improve reconnaissance, social engineering, and technical tasks. The malware, disguised as a PDF, executes a PowerShell script and displays a fake error message.

Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks

www.darkreading.com · 5 months ago

Threat actors are increasingly using a technique called bring-your-own-vulnerable-driver, or BYOVD, to disable security products like EDR on targeted systems. This involves exploiting vulnerable drivers to gain kernel-level access and kill security processes. Microsoft faces a challenge because its operating system supports a wide range of drivers, inadvertently creating an arms race between attackers and defenders. A loophole exists allowing drivers with revoked certificates to load, as seen in a recent attack using a driver for EnCase, which had its certificate revoked in 2010. Microsoft maintains a Vulnerable Driver Blocklist, but it is updated infrequently and often blocks drivers used for legitimate purposes.

Nation-State Hackers Put Defense Industrial Base Under Siege

www.darkreading.com · 5 months ago

Nation-state hackers are increasingly targeting defense industrial base organizations through cyber espionage and attacks. Attackers, including those linked to China and Russia, are exploiting zero-day vulnerabilities in edge devices to gain initial access and establish persistent footholds within networks. Threat actors are also targeting defense workers through malicious job portals and credential theft. The Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog lists 26 vulnerabilities exploited in edge devices in 2025 and 35 in 2024.