Blahalla

BADIIS Malware Targets Over 1,800 Windows Servers in Massive SEO Poisoning Attack

gbhackers.com · 5 months ago

A widespread SEO poisoning campaign, dubbed REF4033, has compromised over 1,800 Windows IIS servers globally, impacting governments, educational institutions, and corporations. The BADIIS malware, deployed by a Chinese-speaking cybercrime group, redirects users to illicit gambling, pornography, and cryptocurrency scam sites. Attackers rapidly deploy the malware, creating local accounts, escalating privileges, and installing a malicious Windows service, WalletServiceInfo, which loads unsigned DLLs to manipulate IIS configurations and inject SEO content. The modules operate as native IIS modules, evading detection while controlling traffic based on User-Agent and Referer headers.

Zimbra Issues Security Update to Address XSS, XXE, and LDAP Injection Flaws

gbhackers.com · 5 months ago

Zimbra has released a critical security update, version 10.1.16, to address several high-severity vulnerabilities. Patches include fixes for Cross-Site Scripting, LDAP injection, and XML External Entity vulnerabilities, which could lead to unauthorized access and data theft. The update also enhances Cross-Site Request Forgery protection and introduces improvements to the Backup and Restore module. Administrators are urged to back up their systems before applying the update due to a “High” deployment risk.

BeyondTrust RCE Vulnerability Under Active Exploitation – Urgent Patch Released

gbhackers.com · 5 months ago

BeyondTrust has released urgent security updates to address a critical remote code execution vulnerability affecting its Remote Support and Privileged Remote Access products. The flaw, designated CVE-2026-1731, allows unauthenticated attackers to execute commands without credentials. Approximately 11,000 instances are exposed online, and organizations using on-premise deployments must manually apply the patch. BeyondTrust automatically applied fixes to cloud-hosted customers, but self-managed systems require immediate action.

Hackers turn bossware against the bosses

www.csoonline.com · 5 months ago

Cybercriminals are exploiting legitimate employee monitoring software, Net Monitor for Employees, and a remote management platform, SimpleHelp, to deploy ransomware and steal cryptocurrency. Attackers have used these tools to evade detection, tamper with security software, and establish persistent remote access, often gaining initial access through compromised vendor VPN accounts. Security experts advise organizations to inventory all applications, strengthen identity and access management, and prioritize security awareness training to prevent unauthorized installations and potential abuse. In June 2025, CISA warned of ransomware operators exploiting unpatched SimpleHelp RMM vulnerabilities.

Trump’s campaign against ‘left-wing’ media finds a new target: Apple News

www.washingtonpost.com · 5 months ago

A regulator appointed by President Donald Trump has warned Apple over potential legal violations related to its news curation practices. The Federal Trade Commission chairman expressed concern that Apple News may be promoting left-leaning news outlets while suppressing conservative publications. He stated that while he is not the speech police, Apple’s article choices raise concerns. The warning highlights an ongoing campaign against media perceived as "left-wing."

Why Tech Giants Are Accused of Causing Social Media Addiction

www.nytimes.com · 5 months ago

Several tech companies including Meta, TikTok, Snap, and YouTube are facing legal action. Plaintiffs claim these companies’ platforms are addictive and have caused personal injury. These landmark trials aim to examine the impact of social media on users. The legal proceedings could have significant consequences for both the technology industry and social media users.

Russia tries to block WhatsApp, Telegram in communication blockade

www.bleepingcomputer.com · 5 months ago

The Russian government is attempting to block WhatsApp, following similar restrictions on Telegram. Authorities cite countering crime and fraud as the reasoning, while Meta, WhatsApp’s parent company, is labeled an extremist entity. The move comes as Russia promotes its own messaging app, MAX, raising concerns about its security and data collection practices. Russian officials have indicated a willingness to allow WhatsApp to resume operations if Meta complies with local laws.

Anthropic Is Valued at $380 Billion in New Funding Round

www.nytimes.com · 5 months ago

false

Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — Again

www.darkreading.com · 5 months ago

Hackers exploited vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) software, impacting several European government agencies. Two critical remote code execution vulnerabilities, CVE-2026-1281 and CVE-2026-1340, were disclosed on January 29th. Following the disclosure, attacks targeted the European Commission and agencies in the Netherlands and Finland, compromising staff information. Experts suggest organizations improve perimeter security by minimizing exposure and implementing aggressive monitoring to prevent exploitation and limit network access.

These Mathematicians Are Putting A.I. to the Test

www.nytimes.com · 5 months ago

false

Bitwarden introduces ‘Cupid Vault’ for secure password sharing

www.bleepingcomputer.com · 5 months ago

false

Critical Apple Flaw Exploited in ‘Sophisticated’ Attacks, Company Urges Rapid Patching

www.techrepublic.com · 5 months ago

Apple has released urgent security updates to address a zero-day vulnerability, CVE-2026-20700, that was actively exploited in sophisticated, targeted attacks. The flaw impacts multiple Apple operating systems and allows attackers to execute arbitrary code. This vulnerability was exploited alongside CVE-2025-14174 and CVE-2025-43529, suggesting a possible exploit chain. Users are urged to immediately update their devices to the latest versions of iOS, iPadOS, and macOS.

Critical BeyondTrust RCE flaw now exploited in attacks, patch now

www.bleepingcomputer.com · 5 months ago

A critical remote code execution vulnerability, tracked as CVE-2026-1731, is now being exploited in attacks targeting BeyondTrust Remote Support and Privileged Remote Access appliances. The flaw allows unauthenticated attackers to execute commands and potentially compromise systems, with a CVSS score of 9.9. Hacktron discovered the vulnerability and reported it to BeyondTrust, revealing that approximately 11,000 instances were exposed online. Attackers are exploiting the vulnerability by targeting exposed portals to retrieve identifiers and execute commands.

Critical RCE Vulnerability in Unstructured.io (CVE-2025–64712) - CVSS 9.8

www.cyera.com · 5 months ago

A critical vulnerability, CVE-2025, 64712, has been discovered in Unstructured.io, a data processing library widely used by businesses, including 87% of Fortune 1000 companies. The vulnerability allows attackers to write arbitrary files and potentially achieve remote code execution on affected systems. It stems from a path traversal bug in how the library handles attachments within Microsoft Outlook email files, specifically when processing.msg files. Unstructured.io has released version 0.18.18 to address the issue.

SpecterOps Launches BloodHound Scentry to Accelerate the Practice of Identity Attack Path Management

www.darkreading.com · 5 months ago

false

Gone With the Shame: One in Two Americans Are Reluctant to Talk About Romance Scam Incidents

www.darkreading.com · 5 months ago

A recent survey indicates that over half of Americans who have lost money to romance scams feel it’s more shameful than other types of fraud, leading many to remain silent. Men are disproportionately affected, with nearly twice as many reporting losses compared to women, particularly those aged 35 to 44. Significantly, almost a fifth of victims do not report these incidents, often prioritizing emotional recovery over financial concerns. Experts recommend reporting to the FBI Internet Crime Complaint Center and the Federal Trade Commission.

Microsoft: New Windows LNK spoofing issues aren't vulnerabilities

www.bleepingcomputer.com · 5 months ago

Security researcher Wietze Beukema has identified techniques for manipulating Windows shortcut files to trick users into executing unintended programs. Attackers can craft deceptive shortcuts that display one target path but run another, effectively hiding command-line arguments and malicious payloads. Microsoft declined to classify these techniques as vulnerabilities, stating they require user interaction. The discovered methods involve manipulating data structures within LNK files and are being used by groups exploiting CVE-2025-9491, which was silently mitigated by Microsoft.

Those 'Summarize With AI' Buttons May Be Lying to You

www.darkreading.com · 5 months ago

Researchers have discovered a new tactic called AI recommendation poisoning, where hidden instructions are embedded within "Summarize With AI" buttons on websites. These instructions can manipulate AI assistants like ChatGPT and Microsoft 365 Copilot to prioritize specific information or recommendations, potentially benefiting businesses and creating unfair competitive advantages. Microsoft observed 50 unique instances of these attempts over 60 days, involving 31 companies, and notes that readily available tools simplify the process. The effectiveness of the tactic depends on factors like the AI assistant being used and whether the user is logged in.

Copilot Studio agent security: Top 10 risks you can detect and prevent

www.microsoft.com · 5 months ago

Microsoft has identified ten critical security risks associated with Microsoft Copilot Studio agents. These risks include overly permissive access, hard-coded credentials, unmanaged integrations, and a lack of guidance. Organizations are advised to implement strong authentication, least privilege access, and regular reviews to prevent exploitation and treat these agents as critical production assets. Microsoft Defender and Advanced Hunting can be utilized for proactive detection and mitigation of these vulnerabilities.

Gail Slater Leaves Role as Justice Dept.’s Antitrust Chief

www.nytimes.com · 5 months ago

false

Romania's oil pipeline operator Conpet confirms data stolen in attack

www.bleepingcomputer.com · 5 months ago

Romanian oil pipeline operator Conpet S.A. confirms a data breach by the Qilin ransomware gang. The attackers stole nearly 1 terabyte of data, including confidential documents with personal information like names, addresses, and bank account details. Conpet is working with the Romanian National Cyber Security Directorate to investigate the incident. The company warns potentially affected individuals to be cautious of fraudulent requests.

‘Dead’ Outlook add-in hijacked to phish 4,000 Microsoft Office Store users

www.csoonline.com · 5 months ago

A hacker hijacked an abandoned Outlook add-in called AgreeTo to conduct a phishing campaign targeting Microsoft Office Store users. The attacker exploited a weakness in Microsoft’s add-in delivery architecture, which allows for live content fetching from developer servers, bypassing the initial review process. This allowed them to redirect users to a fake Microsoft sign-in page, successfully stealing credentials from approximately 4,000 users. The attacker also operated multiple phishing kits impersonating various financial institutions, and Microsoft has since removed AgreeTo from its marketplace.

Microsoft’s February Patch Tuesday Fixes 6 Zero-Days Under Attack

www.techrepublic.com · 5 months ago

Microsoft has released security updates for 58 vulnerabilities across Windows, Office, and related products. Six of these vulnerabilities are zero-day flaws, meaning they are actively exploited. Several vulnerabilities allow attackers to bypass security features, execute code, or gain elevated privileges. Affected CVEs include CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21533, and CVE-2026-21525. The Cybersecurity and Infrastructure Security Agency has added these vulnerabilities to its Known Exploited Vulnerabilities catalog, setting a March 3 deadline for federal agencies to patch.

Laid-Off Battery Plant Workers Pin Blame on Ford, not Trump, for Lost Jobs

www.nytimes.com · 5 months ago

false

Urgent warnings from UK and US cyber agencies after Polish energy grid attack

www.fortra.com · 5 months ago

NULL

Neue Warn-App für Cybervorfälle gestartet

www.csoonline.com · 5 months ago

A new smartphone application called CYROS is now available to warn users about cyber threats. Developed by the Cyberintelligence Institute, the app compiles security alerts from agencies like the German Federal Office for Information Security and consumer protection organizations. CYROS organizes these alerts by topic, region, and state, providing tailored information and assistance. The application aims to empower users to take action and improve overall cybersecurity in Germany.

Dutch mobile phone giant Odido announces data breach

therecord.media · 5 months ago

Dutch mobile phone provider Odido recently confirmed a cyberattack resulting in the theft of customer data. Approximately 6.2 million people had their personal information stolen, including names, bank account numbers, and identification documents. The attack occurred on February 7th and involved a compromised customer contact system. Odido is contacting affected customers and warning them about potential phishing attempts.

Odido data breach exposes personal info of 6.2 million customers

www.bleepingcomputer.com · 5 months ago

Dutch telecommunications provider Odido has confirmed a cyberattack resulting in a data breach impacting 6.2 million customers. Attackers gained access to a customer contact system, potentially exposing personal information like names, addresses, mobile numbers, customer numbers, email addresses, IBANs, dates of birth, and identification data. Passwords, call logs, billing information, and scans of identification documents were not compromised. Odido has secured the system, notified authorities, and is informing affected customers.

Google Reports State-Backed Hackers Using Gemini AI for Recon and Attack Support

thehackernews.com · 5 months ago

Google has observed the North Korean hacking group UNC2970, linked to Lazarus Group, using the Gemini AI model for reconnaissance, including profiling targets within the cybersecurity and defense sectors. Several other threat actors are also leveraging generative AI tools: UNC6418 for credential gathering, Temp.HEX and APT31 for dossier creation and vulnerability analysis, APT41 for exploit code troubleshooting, UNC795 for web shell development, and APT42 for social engineering and reconnaissance. New malware like HONESTCUE utilizes Gemini’s API to generate malicious code, and campaigns like ClickFix leverage AI sharing features for malware delivery; researchers have also identified attacks aimed at extracting information from AI models. A proof-of-concept demonstrated an 80.1% accuracy rate in replicating a model's behavior using just 1,000 queries, highlighting the risk of model behavior exposure. CVE-2025-8088 is referenced.

Cisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of input received by an affected device. An attacker could exploit this vulnerability by getting the affected device to render crafted text, for example, a crafted meeting invitation. As indicated in the CVSS score, no user interaction is required, such as accepting the meeting invitation. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tce-roomos-dos-9V9jrC2q <br/Security Impact Rating: High <br/CVE: CVE-2026-20119

WordPress plugin with 900k installs vulnerable to critical RCE flaw

www.bleepingcomputer.com · 5 months ago

A critical vulnerability, tracked as CVE-2026-1357, has been identified in the WPvivid Backup & Migration WordPress plugin, affecting over 900,000 websites. This flaw allows for remote code execution by unauthorized individuals through arbitrary file uploads, potentially leading to complete website takeover. The issue stems from improper error handling during RSA decryption and a lack of file sanitization, enabling directory traversal and the uploading of malicious files. A security update, version 0.9.124, has been released to address the vulnerability, and users are strongly advised to update immediately.

A hard truth in Munich: Cyber defense runs through Silicon Valley

therecord.media · 5 months ago

false

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

thehackernews.com · 5 months ago

Cybersecurity researchers have identified a coordinated malicious package campaign, codenamed graphalgo, targeting developers via fake job postings on platforms like LinkedIn, Reddit, and Facebook. The Lazarus Group, linked to North Korea, is believed to be behind the campaign, which involves establishing fake companies and repositories to distribute malicious packages through npm and PyPI. These packages act as a conduit to deploy a remote access trojan capable of stealing data and performing various system actions, protected by a token-based communication mechanism. Additionally, researchers discovered a malicious npm package called "duer-js" that steals sensitive data and a new extortion campaign utilizing the "npm install" command to demand cryptocurrency payments.

FTC push for age verification a ‘major landmark’ for spread of the tool

therecord.media · 5 months ago

false

How to Eliminate the Technical Debt of Insecure AI-Assisted Software Development

www.securityweek.com · 5 months ago

false

California fines Disney $2.75 million for data privacy violations

therecord.media · 5 months ago

California regulators have reached a $2.75 million settlement with Disney regarding alleged violations of the California Consumer Privacy Act. The state attorney general claims Disney’s opt-out processes were inadequate, making it difficult for consumers to prevent data sharing and sales across devices and services. Disney has agreed to implement a comprehensive privacy program and provide regular compliance updates to the state. This is the largest fine ever levied under the CCPA and follows a previous $10 million penalty from the Federal Trade Commission for child privacy violations.

US wants cyber partnerships to send ‘coordinated, strategic message’ to adversaries

therecord.media · 5 months ago

false

Anthropic Donates $20 Million to Super PAC Operation to Counter OpenAI

www.nytimes.com · 5 months ago

false

AMOS infostealer targets macOS through a popular AI app

www.bleepingcomputer.com · 5 months ago

Researchers have identified the AMOS infostealer as a significant threat within the cybercrime landscape, operating as a data collection engine for stolen credentials and sensitive information. Attackers are increasingly exploiting popular AI applications, like OpenClaw, and even leveraging ChatGPT to distribute the malware through compromised skills and malicious installation guides. Distribution methods include fake software installers, SEO poisoning, and social engineering tactics that trick users into executing malware themselves. The AMOS ecosystem functions as a Malware-as-a-Service model, with developers selling the stealer platform to downstream threat actors who then monetize the stolen data.

Im Fokus: Emerging Technologies

de.resources.csoonline.com · 5 months ago

Emerging technologies such as artificial intelligence, quantum computing, extended reality, edge computing and digital twins are driving profound changes in manufacturing by improving efficiency, security and innovation. They are reshaping how companies operate, remain competitive and deliver value in a rapidly evolving digital landscape.

Nation-state hackers ramping up use of Gemini for target reconnaissance, malware coding, Google says

therecord.media · 5 months ago

Nation-state hackers from China, North Korea, and Iran are increasingly using Google’s Gemini AI tool to enhance their cyberattacks. Threat actors are leveraging Gemini for target reconnaissance, malware coding, and automating tasks like creating convincing phishing emails and generating targeted testing plans. A new malware framework called HONESTCUE has been identified, which utilizes Gemini’s API to generate malicious code, blurring the lines between legitimate AI use and malicious activity. Google has disabled assets used by some groups but notes the tool is being used for a wide range of malicious purposes.

ORB Networks Leverages Compromised IoT Devices and SOHO Routers to Mask Cyberattacks

gbhackers.com · 5 months ago

Advanced threat actors are using covert, mesh-based infrastructures called Operational Relay Boxes, or ORBs, to conceal the origins of cyberattacks. These networks are built from compromised IoT devices, SOHO routers, and Virtual Private Servers, enabling attackers to blend malicious traffic with legitimate user activity. Researchers have observed the increasing use of ORBs by China-nexus espionage groups like UNC3886, who exploited a zero-day vulnerability in Singaporean telecommunications networks, resulting in data exfiltration. Singapore is implementing strict router security measures, but a significant number of older devices remain vulnerable and can be incorporated into these anonymizing networks.

Fake AI Chrome extensions with 300K users steal credentials, emails

www.bleepingcomputer.com · 5 months ago

A campaign of 30 malicious Chrome extensions, dubbed AiFrame, has impacted over 300,000 users by impersonating AI assistants. These extensions steal credentials, email content, and browsing data by rendering content from a remote domain and using the Mozilla Readability library to extract data from visited websites. Some extensions specifically target Gmail data, capturing email content and drafts, and may also use voice recognition to transmit information to external servers. Google has not yet responded to the findings.

287 Malicious Chrome Extensions Steal Browsing Data from 37.4 Million Users

gbhackers.com · 5 months ago

Researchers have identified 287 malicious Chrome extensions that have secretly collected and sent browsing data to remote servers, affecting approximately 37.4 million users. The investigation used automated testing to analyze network traffic, revealing extensions sending full URLs or parts of them to third parties. Data collection involved entities like Similarweb, Curly Doggo, and others, and the leaked URLs may contain sensitive information useful for targeted attacks. Users are advised to remove unrecognized extensions, review permissions, and monitor browser activity.

WhatsApp says Russia tried to fully block platform, push users to state app

therecord.media · 5 months ago

Russia has attempted to block the WhatsApp messaging application, impacting over 100 million users, in an effort to encourage adoption of a state-backed messaging platform called Max. This action follows Meta, WhatsApp’s parent company, being designated as an extremist organization and banned in Russia. Authorities removed WhatsApp’s domain records from Russia’s National Domain Name System, hindering connection without a virtual private network. This escalation follows previous restrictions on Telegram and other platforms, and is part of a broader effort by Russia to control online communication.

DragonForce Ransomware Group Targets 363 Companies, Expands Cartel-Like Operations Since 2023

gbhackers.com · 5 months ago

The DragonForce ransomware group has rapidly evolved into a cartel-like operation since late 2023, operating under a Ransomware-as-a-Service model and recruiting affiliates. They have targeted 363 organizations through December 2025, with a peak of 35 victims disclosed in December 2025. DragonForce’s infrastructure includes RansomBay, a service for generating customized payloads, and actively engages in the cybercrime underground through platforms like BreachForums. Technical modifications include changes to file metadata encryption and the addition of extension-based encryption modes for various file types.

SSH Worm Exploit Detected by DShield Sensor Using Credential Stuffing and Multi-Stage Malware

gbhackers.com · 5 months ago

A DShield honeypot sensor recently detected a self-replicating SSH worm exploiting weak passwords to compromise Linux systems. The attack began with a brute-force login using the credentials "pi / raspberryraspberry993311" and quickly escalated to the deployment of a malicious bash script, establishing persistence and command-and-control communication over IRC. The worm then scanned for vulnerable systems using tools like zmap and sshpass, rapidly propagating across the internet and attempting to infect them with the same credential pairs. This incident highlights the continuing threat of default passwords and the vulnerability of devices like Raspberry Pis to botnet recruitment.

Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection

www.csoonline.com · 5 months ago

Researchers have identified a new phishing campaign delivering the XWorm remote access trojan, combining familiar techniques with fileless execution to evade detection. The campaign uses phishing emails with malicious Excel add-ins that exploit CVE-2018-0802, a known vulnerability in Microsoft Office. Attackers leverage HTA and PowerShell to load additional components, ultimately deploying a modular XWorm core with encrypted command-and-control capabilities, including plugin support for actions such as credential theft and data exfiltration. Experts emphasize that robust post-compromise controls are crucial to mitigating the risk, as the entry vector and tools used are readily available.

Feiniu NAS Devices Hit in Massive Netdragon Botnet Attack Exploiting Unpatched Vulnerabilities

gbhackers.com · 5 months ago

Attackers have compromised thousands of Feiniu NAS devices, incorporating them into the Netdragon botnet for distributed denial-of-service attacks. The malware establishes an HTTP backdoor on port 57132, allowing remote command execution. To maintain persistence, the malware removes logs, disables updates, and deploys systemd services and kernel modules. The botnet actively evolves to evade detection and remediation efforts, including deleting critical files like rsaprivatekey.pem.

ApolloMD Data Breach Impacts 626,000 Individuals

www.securityweek.com · 5 months ago

A cyberattack occurred at ApolloMD in May 2025, impacting over 626,000 individuals. Hackers gained access to files containing personal and health information, including names, addresses, dates of birth, and health insurance details, and potentially Social Security numbers. The Qilin ransomware group claimed responsibility for the attack, posting data on a leak site. ApolloMD has notified affected individuals and is offering free credit monitoring services.