Blahalla

HN Security - Extending Burp Suite for fun and profit – The Montoya way – Part 10

hnsecurity.it · 5 months ago

false

Cisco Acquisition of Astrix Security Signals to Strengthen on Non-Human Identity Security

gbhackers.com · 5 months ago

false

Cerberus Stalkerware Hits Google Play, Abuses Accessibility and Firebase for Remote Control

gbhackers.com · 5 months ago

The Android application Cerberus Anti-theft, available on Google Play, is operating as stalkerware, providing abusers with extensive remote control capabilities. The app utilizes accessibility services and Google Firebase to silently trigger actions like camera activation, location logging, and screen recording. Cerberus offers 44 distinct remote commands, including device locking, SMS initiation, and data access, and employs a Wi-Fi "radar" for indoor tracking. The app bypasses Android restrictions using the HiddenApiBypass library to evade detection by Google Play’s review process.

Critical Remote Code Execution Vulnerability Patched in Android

www.securityweek.com · 5 months ago

Google has released an Android update to address a critical vulnerability allowing for remote code execution. The flaw, CVE-2026-0073, impacts the Android System component and adbd daemon, potentially enabling attackers to execute code without user interaction or additional privileges. Patches are not yet available for Wear OS, Pixel Watch, Android XR, and Android Automotive. Google recently increased bug bounty payouts, offering up to $1.5 million for certain zero-click exploits.

The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed

thehackernews.com · 5 months ago

Security leaders are increasingly concerned about unmanaged OAuth grants, which present a significant risk as they bypass traditional security controls like multi-factor authentication. The Drift incident, affecting numerous organizations including Cloudflare and PagerDuty, demonstrated how attackers exploited legitimate OAuth integrations by stealing refresh tokens and accessing sensitive data, like AWS access keys and passwords. Current security tools often focus on initial app assessments, but effective protection requires continuous behavioral monitoring of app activity and assessing the potential impact of compromised grants. Organizations need visibility into existing grants, continuous monitoring of behavior, and the capability to respond quickly to mitigate potential threats.

How the Story of a USB Penetration Test Went Viral

www.darkreading.com · 5 months ago

There was a 2006 penetration test in which consultants seeded rigged USB drives around a credit union parking lot and observed a reported 15 out of 20 employees plug the drives into work machines, enabling remote callbacks. The exercise sparked widespread awareness and dozens of copycat social engineering engagements, and modern equivalents now rely on full field systems and on-site devices rather than simple thumb drives while using pretexts such as utility or copier repair to gain entry. Testers report using artificial intelligence to accelerate reconnaissance, leveraging human trust and small gifts to obtain access, doing ransomware incident response and ransom negotiations when needed, and warning that AI simultaneously lowers the effort required for attackers and raises new safety and ethical concerns for defenders.

How the Story of a USB Penetration Test Went Viral

www.darkreading.com · 5 months ago

false

MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks

thehackernews.com · 5 months ago

Threat actors are actively exploiting a critical vulnerability in the MetInfo content management system. This vulnerability, identified as CVE-2026-29014, is a code injection flaw allowing for remote code execution. The flaw exists in versions 7.9, 8.0, and 8.1 of the CMS and requires the "/cache/weixin/" directory to exist on non-Windows servers. Exploitation began on April 25th, with a significant increase in attacks targeting China and Hong Kong on May 1st.

AI finds 20-year-old bugs in PostgreSQL and MariaDB

www.csoonline.com · 5 months ago

Security researchers have identified critical vulnerabilities in PostgreSQL and MariaDB databases, some dating back over 20 years. The vulnerabilities, found using an AI-powered security analysis tool, allow for remote code execution. Specific flaws include a heap-based buffer overflow in PostgreSQL’s “pgcrypto” extension (CVE-2026-2005), a missing validation bug in PostgreSQL (CVE-2026-2006), and a buffer overflow in MariaDB’s JSON schema validation logic (CVE-2026-32710). Patches have been released for all identified vulnerabilities, and users are urged to update their systems immediately.

Google now offers up to $1.5 million for some Android exploits

www.bleepingcomputer.com · 5 months ago

Google is increasing rewards for complex Android and Chrome exploits, with a top bounty of $1.5 million for zero-click Pixel Titan M2 security chip exploits that include persistence. Rewards for Chrome exploits involving memory allocation protection, known as MiraclePtr, now include a $250,000 reward plus an additional $250,128 bonus. Google is also shifting its focus to concise bug reports, due to advances in artificial intelligence. In 2025, Google paid researchers $17.1 million for reported vulnerabilities, a 40 percent increase from the previous year.

Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server

www.securityweek.com · 5 months ago

Apache has released security updates for its HTTP Server and MINA software. The HTTP Server update addresses eleven vulnerabilities, including a double-free bug (CVE-2026-23918) and a heap buffer overflow (CVE-2026-28780), both potentially leading to remote code execution. MINA updates resolve two critical vulnerabilities, CVE-2026-42778 and CVE-2026-42779, which relate to insecure deserialization and allowlist bypass issues. Users are advised to explicitly allow accepted classes after upgrading to a patched release.

Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs

www.csoonline.com · 5 months ago

A new malware campaign is exploiting Microsoft's Phone Link feature to steal SMS one-time passwords and other sensitive data from Windows systems. The threat, first observed in January 2026, involves a remote access trojan called CloudZ and a custom plugin named Pheno, which monitors data mirrored through Phone Link without compromising the mobile device itself. Attackers use CloudZ to deliver Pheno, which then scans for Phone Link activity and potentially intercepts SMS messages and authenticator notifications. The malware chain begins with an unknown initial access vector, employing techniques to evade detection and establish persistence on the system.

Ghosts of Encryption Past – How we Read All Your Emails in Salesforce Marketing Cloud

slcyber.io · 5 months ago

Researchers have identified multiple vulnerabilities within Salesforce Marketing Cloud, posing a risk of data exposure. Exploits involve flaws in the MicrositeURL function and weak encryption methods, allowing access to sensitive email data across multiple tenants. Salesforce has responded by implementing AES-GCM encryption, link expiration, and disabling specific scripting functions. The vulnerabilities have resulted in the assignment of several CVEs.

WhatsApp Security Flaw Enables Malicious URL Execution Through Instagram Reels

gbhackers.com · 5 months ago

WhatsApp has addressed two security vulnerabilities that could have allowed attackers to execute malicious actions. One vulnerability, tracked as CVE-2026-23866, involved Instagram Reels, allowing attackers to trigger URLs on a victim’s device through unvalidated message elements. A second vulnerability, CVE-2026-23863, targeted WhatsApp for Windows, enabling attackers to spoof file attachments and trick users into running malicious files. Both vulnerabilities have been patched and were not actively exploited, but users are advised to update their applications.

Karakurt Ransomware Negotiator Sentenced to Prison

www.securityweek.com · 5 months ago

A Latvian national involved with the Karakurt ransomware gang has been sentenced to 8.5 years in prison in the United States. The group, previously associated with Conti and known by other names, targeted organizations across various industries to steal data and demand ransom. The individual’s role involved negotiating with victims and escalating pressure, including threatening to release patient data when payment wasn't received. He received a portion of the ransom payments in cryptocurrency and was arrested in Georgia before extradition.

Education Sector Hit by Espionage, Phishing, and Supply Chain Attacks

gbhackers.com · 5 months ago

Educational institutions are experiencing a rise in state-sponsored espionage, spear-phishing, and supply chain attacks, shifting from traditional ransomware threats. Activity from China-aligned groups like MISSION2074, Stone Panda, and others is targeting organizations in countries including the United States, United Kingdom, and Japan. Cyberattacks are increasingly focused on email, FTP, and SSHD servers to gain access to research data and communications. Hacktivism and distributed denial-of-service attacks are also increasing, aiming to disrupt online learning platforms.

DarkSword Malware

www.schneier.com · 5 months ago

A sophisticated malware known as DarkSword has been discovered targeting Apple iOS devices. The Google Threat Intelligence Group believes the malware is likely government designed and utilizes multiple zero-day vulnerabilities to fully compromise devices across versions 18.4 through 18.7. Threat actors in Saudi Arabia, Turkey, Malaysia, and Ukraine have been observed using DarkSword in surveillance campaigns, deploying malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. A version of the exploit chain recently leaked, increasing its potential for broader use.

The Danger of Multi-SSO AWS Cognito User Pools

blog.doyensec.com · 5 months ago

Security vulnerabilities have been identified in AWS Cognito multi-SSO user pool setups, potentially allowing attackers to compromise user authentication. These issues stem from trusting data received from external identity providers, creating risks like ghost identity injection and IdP identifier hijacking. Developers should carefully validate identity provider data and implement secure coding practices, including robust domain policy enforcement and protecting identity provider identifiers. A weaponized identity provider tool and a Terraform lab are available to test and identify vulnerabilities.

We Scanned 1 Million Exposed AI Services. Here's How Bad the Security Actually Is

thehackernews.com · 5 months ago

A recent scan of over 2 million hosts revealed widespread security vulnerabilities in self-hosted AI infrastructure, exceeding the risk levels seen in other software. Many AI services were found deployed without authentication, exposing user data, chatbot conversations, and company tools. Exposed platforms included agent management systems like n8n and Flowise, along with unsecured Ollama APIs, with 31% of queried servers responding without authentication. Researchers observed insecure deployment practices, default configurations, and even hardcoded credentials, highlighting a concerning trend of prioritizing speed over security.

Karakurt extortion gang ‘cold case’ negotiator gets 8.5 years in prison

www.bleepingcomputer.com · 5 months ago

A Latvian national has been sentenced to 8.5 years in prison for his role as a negotiator for the Russian Karakurt ransomware group. The individual, Deniss Zolotarjovs, was involved in extorting dozens of companies, including a government entity whose 911 system was affected. He used stolen personal and health information to pressure victims into paying ransom, and is linked to attacks by groups like Conti, Royal, and Akira. Authorities estimate total losses from the attacks to be in the hundreds of millions of dollars.

CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs

www.bleepingcomputer.com · 5 months ago

A new malicious plugin called Pheno is being used with the CloudZ remote access tool to hijack Microsoft Phone Link connections and steal sensitive information. The threat actor can intercept SMS and one-time passwords from mobile devices without compromising the device itself. Researchers discovered the intrusion began at least in January and involved a fake ScreenConnect update delivering a Rust-based loader, followed by a.NET loader that installs CloudZ. The malware uses techniques to evade detection and rotates user-agent strings to disguise its communication.

Code of Conduct Phish Hits 35,000 Users in Multi-Stage AiTM Attack

gbhackers.com · 5 months ago

A sophisticated phishing campaign, observed between April 14 and April 16, 2026, has targeted over 35,000 users across 13,000 organizations. The attackers used code-of-conduct themed lures and convincing internal communication techniques to bypass security defenses. The multi-stage attack involved CAPTCHA challenges and an adversary-in-the-middle (AiTM) technique to steal session tokens and bypass multifactor authentication. Affected industries include healthcare, financial services, and technology, with the United States experiencing the highest impact.

securelist.com · 5 months ago

A supply chain attack compromised DAEMON Tools software in early 2026, affecting users across more than 100 countries. Malicious code was inserted into installers between versions 12.5.0.2421 and 12.5.0.2434, deploying a backdoor and the QUIC RAT malware. While most systems received basic data collection, a select number of organizations in government, science, manufacturing, and retail were targeted with a more advanced backdoor. Kaspersky is actively detecting and mitigating the threat, which highlights the increasing prevalence of supply chain attacks.

MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs

www.securityweek.com · 5 months ago

Threat actors are actively exploiting critical vulnerabilities in MetInfo and Weaver E-cology, allowing for remote code execution without authentication. The MetInfo vulnerability, CVE-2026-29014, is a PHP code injection issue stemming from insufficient input sanitization, with approximately 2,000 instances currently exposed online. Weaver E-cology's vulnerability, CVE-2026-22679, involves exposed debug functionality enabling command execution. Attackers have been observed using ping callbacks and payloads to compromise vulnerable systems, primarily in China and Singapore.

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

thehackernews.com · 5 months ago

A North Korea-aligned hacking group known as ScarCruft has compromised a video game platform targeting ethnic Koreans in China. The attackers used a supply chain attack to distribute the BirdCall backdoor, a variant of RokRAT, on both Windows and Android devices. BirdCall’s capabilities include screenshot capture, keystroke logging, and data theft, utilizing cloud services for command and control. Compromised Android application packages are available at sqgame.com[.]cn/ybht.apk and sqgame.com[.]cn/sqybhs.apk.

ScarCruft hackers push BirdCall Android malware via game platform

www.bleepingcomputer.com · 5 months ago

A North Korean hacker group, known as APT37 or ScarCruft, has been using a modified Android version of the BirdCall backdoor to spy on users. The malware was distributed through a compromised game platform targeting Korean users in China. This Android variant collects extensive device information, records audio, and exfiltrates files, though it lacks some of the features found in the Windows version. Cybersecurity researchers advise users to only download software from trusted sources to avoid malware infections.

WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities

www.securityweek.com · 5 months ago

WhatsApp has addressed two security vulnerabilities impacting its Windows, iOS, and Android applications. CVE-2026-23863 involves a file spoofing issue where malicious documents could execute upon opening. CVE-2026-23866 relates to incomplete validation of rich response messages, potentially allowing attackers to trigger media content from arbitrary URLs. Researchers responsibly disclosed both vulnerabilities through Meta’s bug bounty program, and there is no indication of exploitation.

CISOs step up to the security workforce challenge

www.csoonline.com · 5 months ago

false

Why most zero-trust architectures fail at the traffic layer

www.csoonline.com · 5 months ago

false

Cuba’s mom influencers share rare view of struggles under U.S. fuel embargo

www.washingtonpost.com · 5 months ago

false

Qualcomm Chipset Vulnerabilities Raise Alarm Over Remote Code Execution Risk

gbhackers.com · 5 months ago

Qualcomm has released a security bulletin addressing numerous vulnerabilities across its chipsets, impacting smartphones, automotive systems, and industrial devices. Several critical flaws, including CVE-2026-25254 and CVE-2026-25293, enable remote code execution. Other vulnerabilities, such as CVE-2026-25262, involve memory corruption and require local access, while CVE-2026-25255 poses a privilege escalation risk. Device manufacturers must promptly deploy patches to mitigate these risks and protect users.

Attackers Exploit Amazon SES to Send Authenticated Phishing Emails

gbhackers.com · 5 months ago

Attackers are increasingly exploiting Amazon’s Simple Email Service, or SES, to send sophisticated phishing emails that bypass standard security measures. These emails often mimic legitimate communications, like notifications from electronic signature services such as DocuSign, and appear technically authentic due to SES’s established reputation and authentication protocols. Threat actors typically gain access to SES accounts through leaked AWS Identity and Access Management, or IAM, credentials. To mitigate this risk, organizations should strengthen AWS security practices, including limiting access privileges and rotating access keys.

New Attribution Framework Links APT Campaigns Across Key Layers

gbhackers.com · 5 months ago

Cybersecurity analysts are adopting a new attribution framework to better understand advanced persistent threat activity. Traditional methods rely on matching tactics, techniques, and procedures, but this is often unreliable due to shared tools and evolving adversary behavior. The new approach focuses on campaign-based analysis, examining discrete operations to identify connections through shared infrastructure, malware, targeting patterns, and timing. This layered model utilizes a Campaign Linkage Graph and assigns confidence levels to attribution based on evidence convergence.

Proton Pass: Second-Password Bypass Through Emergency Access

www.zolder.io · 5 months ago

A vulnerability has been identified in Proton Pass's Emergency Access feature, allowing attackers to bypass the second password protection for password vaults. By compromising a user’s primary Proton account and creating a new, minimally verified account, an attacker can add themselves as an emergency contact with a zero-minute wait time. This grants immediate, unimpeded access to the Proton Pass vault without requiring the second password, effectively nullifying its intended security benefit. Proton acknowledges the issue as a design choice, but immediate action is recommended to mitigate the risk of account compromise.

Critical Android Zero-Click Vulnerability Enables Remote Shell Access

gbhackers.com · 5 months ago

A critical vulnerability has been identified in the Android System component, allowing attackers to gain remote shell access without user interaction. The flaw, tracked as CVE-2026-0073, impacts Android versions 14, 15, 16, and 16-qpr2, and is linked to the Android Debug Bridge Daemon. Attackers must be on the same local network or in close proximity to the device to exploit the vulnerability. Google is addressing the issue through Google Play system updates and advises users to update to the 2026-05-01 security patch level.

Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

thehackernews.com · 5 months ago

A critical vulnerability, CVE-2026-22679, is actively being exploited in Weaver E-cology, an office automation platform. This unauthenticated remote code execution flaw allows attackers to execute arbitrary commands through the debug API endpoint. Exploitation began around March 17, 2026, just days after the release of patches. Threat actors have been observed using deceptive file names and running discovery commands during the intrusion.

Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries

thehackernews.com · 5 months ago

Microsoft has identified a large-scale phishing campaign targeting over 35,000 users across 26 countries, primarily in the U.S., with a focus on healthcare, finance, and technology sectors. The attackers used legitimate email services and sophisticated HTML templates mimicking internal communications to steal credentials and authentication tokens via an adversary-in-the-middle technique. The campaign included code of conduct-themed lures, PDF attachments, and CAPTCHA challenges to evade defenses. The findings highlight a rise in QR code phishing and the abuse of Amazon Simple Email Service to bypass email security protocols.

Fake “Notepad++ for Mac” Site May Pose Malware Risk for Mac Users

gbhackers.com · 5 months ago

A deceptive website is impersonating the Notepad++ text editor and falsely claiming to offer an official version for macOS. The site, notepad-plus-plus-mac[.]org, uses the Notepad++ name, logo, and color scheme to trick users into believing it's a legitimate release. The website's creator has publicly stated the site has no connection to the original Notepad++ project and is using his image and biography without authorization. Downloading software from unofficial sources poses a security risk, as future updates could contain malware. Users are advised to only download Notepad++ from the official website, notepad-plus-plus[.]org, and to remove any previously installed fake versions.

Microsoft Edge Found Storing Saved Passwords in Cleartext Memory at Startup

gbhackers.com · 5 months ago

Microsoft Edge stores all saved passwords in cleartext memory immediately upon launch, a design choice confirmed by Microsoft. This behavior differentiates Edge from browsers like Google Chrome, which decrypt passwords on demand using App-Bound Encryption. The practice poses a significant security risk, especially in shared computing environments where attackers with administrative privileges can easily harvest credentials from memory. Security experts advise against storing sensitive information in Edge and recommend using third-party password managers instead.

Apache HTTP Server Vulnerability Exposes Millions to Remote Code Execution Threats

gbhackers.com · 5 months ago

A critical security vulnerability has been identified in the Apache HTTP Server, tracked as CVE-2026-23918. This “double free” flaw affects servers running version 2.4.66 with HTTP/2 enabled, allowing for potential remote code execution. Researchers privately reported the vulnerability, prompting a swift patch released in version 2.4.67; immediate updates are advised to prevent attacks and potential data theft or system control. Administrators should also monitor server logs and consider temporarily disabling HTTP/2 until patching is complete.

pnpm 11 Enables Default Release-Age Guard to Curb npm Supply Chain Attacks

gbhackers.com · 5 months ago

pnpm 11 has been released with a focus on improving software supply chain security. A new default minimum release age of 24 hours is now in place, delaying the installation of newly published packages to mitigate attacks that rely on quickly spreading malicious versions. The update also restricts dependencies to standard sources and simplifies controls over lifecycle scripts to prevent malicious code execution. These changes respond to recent attacks, like the Mini Shai-Hulud campaign, which targeted developer environments through install hooks.

We probed 6,000 web apps for Stripe webhook signature checks. 1,542 don't bother

securityscanner.dev · 5 months ago

Researchers scanned 6,000 web applications and discovered 1,542, or roughly one in four, were accepting payment webhook events without signature verification. This allows attackers to forge events, potentially upgrading accounts or creating fraudulent bookings. The vulnerability stems from developers skipping signature verification, often due to incomplete code implementations or reliance on code assistants. To mitigate the risk, developers should always verify webhook signatures using the appropriate SDK for their framework.

DigiCert Hacked in Screensaver-Based Attack to Fraudulently Obtain EV Code Signing Certificates

gbhackers.com · 5 months ago

DigiCert, a Certificate Authority, experienced a security breach in April 2026 where attackers fraudulently obtained 60 Extended Validation Code Signing certificates. The attackers used a malicious screensaver file delivered through a customer support chat channel to compromise a support analyst’s computer and access sensitive initialization codes. These stolen certificates were then used to digitally sign the “Zhong Stealer” malware, bypassing security warnings. DigiCert has since revoked all affected certificates and implemented stricter security measures, including hiding initialization codes and enforcing stronger multi-factor authentication.

10 Anzeichen für einen schlechten CSO

www.csoonline.com · 5 months ago

There are ten signs of a poor CSO: lack of a long term strategy, moving from crisis to crisis, words instead of actions, no documentation, poor communication, leaving questions unanswered, avoiding hard decisions, self focused leadership, suppression of talent, and claiming others successes. Weak security leadership increases staff turnover, undermines the organization security posture, and should be changed promptly to reduce risk and restore team effectiveness.

Anthropic and Wall Street Giants Join Forces to Create New A.I. Firm

www.nytimes.com · 5 months ago

false

S.E.C. Settles Lawsuit Against Elon Musk Over His Twitter Disclosures

www.nytimes.com · 5 months ago

false

Anthropic Mythos spurs White House to weigh pre-release reviews for high-risk AI models

www.csoonline.com · 5 months ago

Concerns over the potential for AI-enabled cyberattacks, particularly stemming from Anthropic’s new Mythos model, are prompting the White House to re-evaluate pre-release oversight of high-risk AI systems. The Mythos model has demonstrated the capability to identify software vulnerabilities at a level comparable to skilled human experts. Anthropic is limiting access to Mythos through Project Glasswing and has briefed government agencies on its capabilities. Discussions are underway to potentially reinstate review processes similar to those previously revoked, although no formal proposals or timelines have been established.

White House Considers Vetting A.I. Models Before They Are Released

www.nytimes.com · 5 months ago

false

Elon Musk’s Lawyers Ask OpenAI’s President Why He Is Worth $30 Billion

www.nytimes.com · 5 months ago

false

Elon Musk will pay $1.5 million to settle with SEC over late paperwork

www.washingtonpost.com · 5 months ago

false