Blahalla

Sophisticated Deep#Door Backdoor Enables Espionage, Disruption

www.securityweek.com · 5 months ago

There is a stealthy Python based backdoor framework that installs a persistent Windows implant likely intended for espionage. The infection chain begins with a batch script that disables security controls such as SmartScreen firewall logging Defender tamper protection and Antimalware Scan Interface then reconstructs an embedded Python payload in memory and on disk. The implant achieves multi layer persistence by modifying Run registry keys creating scheduled tasks and placing scripts in the Startup folder while mimicking legitimate Windows services and avoiding analysis by checking for debuggers virtualization artifacts and sandbox environments. Once active the backdoor enables shell command execution file manipulation reconnaissance keylogging clipboard monitoring screenshots microphone and webcam capture credentials and SSH key harvesting and can shift to destructive actions including overwriting the Master Boot Record forcing system crashes and exhausting system resources while using AMSI and ETW patching ntdll unhooking dynamic port selection and public tunneling for covert resilient communications.
OpenAI’s Big Reset + A.I. in the Doctor’s Office + Talkie, a pre-1930s LLM

www.nytimes.com · 5 months ago

OpenAI announced a loosened partnership with Microsoft and an aggressive new strategy to secure computing power, prompting questions about whether it can scale while facing a legal trial and investor concerns over missed revenue and user targets. There are worries the company may struggle to balance rapid expansion with those legal and financial pressures. Dr. Adam Rodman, an internal medicine physician and assistant professor at Harvard Medical School, outlines the most significant ways A.I. is changing how doctors treat patients. Researchers including David Duvenaud discuss Talkie, a chatbot built as an LLM trained on very old texts to test whether models trained on historical corpora can predict future behavior.
Top Five Sales Challenges Costing MSPs Cybersecurity Revenue

thehackernews.com · 5 months ago

The managed security services market is projected to grow from 38.31 billion dollars in 2025 to 69.16 billion dollars by 2030, but many managed service providers leave revenue on the table because their go to market strategies fail to connect technical expertise with business priorities. There are five core go to market challenges: lack of client urgency, expanded buying committees, cost objections, underutilizing compliance as a catalyst, and failing to expand revenue in existing accounts. To address these gaps providers should translate technical findings into business outcomes, map and tailor messaging to multiple stakeholders, quantify outcomes and ROI, automate consistent sales processes, and use data driven dashboards to identify upsell opportunities. A vendor developed GTM Academy and a complete sales kit supply practical enablement tools such as discovery frameworks, scripts, scoring worksheets, and dashboards to help MSP sales teams convert demand into predictable, profitable revenue.
Cisco Releases Open Source Tool for AI Model Provenance

www.securityweek.com · 5 months ago

There is a new open source tool named Model Provenance Kit released by Cisco to help organizations assess and trace the provenance of third party AI models and mitigate risks including poisoned models, regulatory noncompliance, supply chain integrity problems and more difficult incident response. The Python based toolkit and command line interface generates a fingerprint for each model using metadata signals, tokenizer similarity and weight level identity signals such as embedding geometry, normalization layers, energy profiles and direct weight comparisons, and provides a compare mode to detect shared lineage and a scan mode to find the closest lineage against a database of fingerprints. The kit and a dataset of base model fingerprints are available as open source on public code and model hosting platforms for organizations to use in provenance analysis.
New Android Spyware Platform Enables Rebranding and Resale

gbhackers.com · 5 months ago

A newly discovered Android spyware platform called KidsProtect offers a subscription and white label model that lets buyers rebrand and resell surveillance malware, with pricing starting around sixty dollars. Once installed it runs silently and provides near total control via a web dashboard, including live microphone streaming and call recording, GPS tracking, reading SMS and app notifications such as WhatsApp and Viber, keystroke logging, remote camera access, contacts and photo exfiltration, and live screen monitoring. The spyware abuses Android permissions including the Accessibility Service, requests numerous sensitive permissions, disguises itself as WiFi Service, registers as a device administrator, includes anti uninstall and boot persistence mechanisms, instructs users to disable Google Play Protect, allows cleartext traffic, and is distributed under the package name com.example.parentguard supporting Android seven and above.
Windows 11 KB5083631 update released with 34 changes and fixes

www.bleepingcomputer.com · 5 months ago

Microsoft released the optional Windows 11 preview update KB5083631 containing 34 quality improvements and fixes, including a new Xbox mode, haptic feedback enhancements, faster launching of startup apps, and improved handling and security for batch files and CMD scripts. The update enables a more secure processing mode that prevents batch files from changing during execution, improves Kerberos authentication for Remote Desktop sessions using Remote Credential Guard to address error 0xc000009a, and updates event logging to include the application name for CVE-2024-30098. Administrators are advised that this preview does not include security fixes, that updated Secure Boot certificates are rolling out to replace expiring 2011 certificates in late June 2026, and that some Windows Server 2025 devices with certain BitLocker Group Policy settings may boot into recovery and require the BitLocker recovery key after installing the update.
Human-centric failures: Why BEC continues to work despite MFA

www.csoonline.com · 5 months ago

Business email compromise continues to thrive despite widespread multi-factor authentication because attackers exploit human behavior, process gaps and operational blind spots so that often no account is technically compromised. High-profile examples include a 2019 incident at Toyota Boshoku where an employee transferred over 30 million dollars after receiving a cloned vendor email, and a 2024 Arup case in which deepfake voice and video were used to convince finance staff to make payments totaling 25 million dollars, both relying on social engineering and procedural shortcuts rather than stolen credentials. Recommended mitigations include redesigning approval workflows to require multi-step out of band verification for high risk requests, realistic simulations that mirror urgent business scenarios, mandatory pauses and automated anomaly alerts tied to finance ownership, and formal policies that empower staff to pause or escalate suspicious requests without fear of reprisal.
Two Cybersecurity Professionals Get 4-Year Sentences in BlackCat Ransomware Attacks

thehackernews.com · 5 months ago

The U.S. Department of Justice announced that two cybersecurity professionals were sentenced to four years in prison for facilitating BlackCat ransomware attacks in 2023. The defendants, Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, were accused of deploying the ransomware against multiple victims across the United States between April and December 2023.
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

thehackernews.com · 5 months ago

A new software supply chain campaign attributed to the GitHub account BufferZoneCorp uses sleeper Ruby gems and Go modules to deliver malicious payloads that harvest credentials, tamper with GitHub Actions workflows, and establish SSH persistence. Affected packages include Ruby gems named knot-activesupport-logger, knot-devise-jwt-helper, knot-rack-session-store, knot-rails-assets-pipeline, knot-rspec-formatter-json, knot-date-utils-rb and knot-simple-formatter, and Go modules including go-metrics-sdk, go-weather-sdk, go-retryablehttp, go-stdlib-ext, grpc-client, net-helper, config-loader, log-core and go-envconfig. The Ruby gems are designed to harvest environment variables, SSH keys, AWS secrets, npm and netrc credentials and RubyGems credentials and exfiltrate them to an attacker controlled endpoint, while the Go modules can install fake go wrappers that intercept go executions, manipulate workflow paths and append a hard coded SSH public key to authorized keys for remote access. As of May 1, 2026 the malicious Ruby gems have been yanked from RubyGems and the Go modules have been blocked, and affected users are advised to remove the packages, inspect for unauthorized changes to authorized keys, rotate exposed credentials and review network logs for outbound HTTPS to the exfiltration endpoint.
CAPTCHA and ClickFix Abuse Fuels Credential Theft Surge

gbhackers.com · 5 months ago

Attackers are increasingly combining QR codes, fake CAPTCHA gates, and ClickFix style prompts to steal credentials at scale, shifting risk from traditional malware attachments to highly convincing hosted phishing flows that evade users and email filters. Most threats in the first quarter of 2026 were link based, with CAPTCHA gated phishing surging in March and QR code phishing climbing sharply as attackers used PDFs and other attachments to redirect users to unmanaged mobile devices. Phishing as a service platforms were disrupted but quickly retooled, while rival offerings expanded and began abusing OAuth device flows to harvest long lived tokens for business email compromise and account takeover. Defenders are advised to prioritize layered email and identity controls, phishing resistant multi factor authentication, conditional access, endpoint network protections, and targeted user training that warns users never to paste opaque commands or device codes from untrusted prompts.
Billions of meals at risk due to Iran war, says fertiliser boss

wesearch.press · 5 months ago

There are up to ten billion meals a week at risk globally after the war in Iran and the blocking of the Strait of Hormuz disrupted fertiliser supplies and shipping. About half a million tons of nitrogen fertiliser are not being produced and fertiliser prices have risen by about eighty percent, which could reduce crop yields by as much as fifty percent in the first season for some crops. The shortfall could spark a bidding war for food that would hit poorer countries hardest while the United Kingdom is unlikely to face shortages but can expect higher food prices with food inflation possibly reaching ten percent by the end of the year.
Multiple Exim Mail Server Vulnerabilities Could Trigger Crashes via Malicious DNS Data

gbhackers.com · 5 months ago

Exim developers released version 4.99.2 to address four vulnerabilities that can crash servers, corrupt memory heaps, or leak sensitive data when processing malicious DNS responses and crafted email headers. The fixed issues are CVE-2026-40684, which can trigger crashes via malicious PTR DNS data affecting systems using musl libc; CVE-2026-40685, an out-of-bounds read and write from corrupt JSON in headers that can cause heap corruption; CVE-2026-40686, an out-of-bounds read from oversized UTF-8 trailing characters that may leak data; and CVE-2026-40687, an out-of-bounds read and write in the SPA authentication driver that can crash an instance or expose heap data. The patches were shared with Linux distribution maintainers on April 24, 2026 and formally released on April 29, 2026, and administrators are strongly advised to upgrade immediately because older Exim versions are no longer maintained.
Just 34% of cyber pros plan to stick with their current employer

www.csoonline.com · 5 months ago

A survey of 500 cybersecurity professionals found that only 34 percent plan to stay with their current employer, increasing pressure on CISOs to improve talent retention. Flexible hybrid work models, particularly roles requiring one to two days onsite per week, and wage growth rather than absolute salary levels correlate strongly with higher satisfaction and lower turnover, while employees who believe their employer treats security as a priority are far more likely to stay than those who do not. Employers can improve retention by investing in mentorship, clear career progression, visibility into strategy, modern security tooling, ongoing training and certifications, and by tackling burnout and unrealistic workloads. The global cybersecurity workforce gap peaked at 4.8 million in 2024, and cybersecurity tied with artificial intelligence as one of the hardest skills to fill, with demand reported at about 42 percent for AI and 38 percent for cybersecurity.
Enterprise Spotlight: Transforming software development with AI

us.resources.csoonline.com · 5 months ago

Artificial intelligence has had an immediate and profound impact on software development. Coding practices, developer tools, developer roles, and the software development process are being reimagined as AI agents are applied across every stage of the software development life cycle, from planning and design to testing, deployment, and maintenance. A May 2026 industry spotlight offers guidance for organizations seeking to harness AI enabled development.
What Silicon Valley layoffs hide about the future of the job market

www.washingtonpost.com · 5 months ago

Tech giants are investing heavily in artificial intelligence while not significantly shrinking their workforces, with Amazon, Google and Meta together having roughly the same number of employees now as during a 2022 hiring binge. Executives repeatedly cited efficiency amid layoffs and cost cutting, with Meta announcing job cuts starting this month, Amazon having announced tens of thousands of white collar layoffs since last fall, and Microsoft offering buyouts to about seven percent of its staff in the United States. The companies plan to spend more than 700 billion dollars this year on AI related projects, and rising research and development expenses per dollar of sales at Meta, Google and Amazon suggest AI is increasing costs and providing cover for workforce reductions rather than directly replacing large numbers of workers.
Managing OT risk at scale: Why OT cyber decisions are leadership decisions

www.csoonline.com · 5 months ago

Operational technology cyber risk is distinct from IT because systems remain in service for years, patching is limited, change windows are negotiated, asset visibility is often incomplete, third-party vendor access is embedded, and ownership is fragmented, making the primary challenge leadership and governance rather than only technical controls. At scale, local weaknesses become enterprise coordination issues and common exposure paths such as remote access abuse, shared accounts, weak segmentation, infected maintenance media, compromised workstations, and poorly governed vendor connectivity can produce direct operational impacts including loss of visibility, degraded transport operations, plant downtime, and emergency shutdowns. Research finds that only sixteen percent of organizations with industrial environments report OT security to their boards, twenty percent maintain dedicated OT security teams, and thirty six percent make the CISO responsible for OT, indicating a widespread accountability gap. Boards should insist on decision grade oversight by clarifying operating models and decision rights, identifying the two or three OT scenarios that most threaten continuity, requiring independent assurance such as site assessments and adversarial simulations, and treating AI and cloud adoption as governance and resilience issues rather than merely technology questions.
Hugging Face, ClawHub Abused for Malware Distribution

www.securityweek.com · 5 months ago

There are campaigns abusing AI distribution platforms Hugging Face and ClawHub to host trojanized files and malicious skills that rely on social engineering to trick users into downloading files that execute commands, fetch payloads, and install hidden dependencies. There are close to six hundred malicious skills across thirteen ClawHub developer accounts, with two accounts containing the majority, and the campaigns deliver trojans, cryptominers, malware loaders, and information stealers including the Atomic macOS Stealer, targeting Windows, macOS, Linux, and Android. There are indirect prompt injection techniques that abuse trust between users, AI agents, and external resources so agents will download and run external code, and the true scale is likely higher given the platforms rapid growth and dynamic hosted content.
Handled, Not Hosted: Administrative Activity Inside a Bulletproof Hoster

disclosing.observer · 5 months ago

Administrative activity in a leaked bulletproof hosting dataset is highly concentrated in a few administrator accounts, with one account called Boss responsible for a large share of admin-mediated authentication events and multiple administrators repeatedly accessing a small set of high-capacity customer accounts, especially an account known as Mr Reseller. The same credentials, provisioning records, billing links, and SSH key material connect provisioned instances for Mr Reseller to actor communications attributed to the Black Basta group, and administrator linked SSH public keys were found on live hosts in the provider address space as of April 30, 2026, some of which overlap infrastructure used as BRUTED SOCKS proxy nodes. The evidence does not prove intent or direct operator involvement, but it establishes operational proximity between provider administrative access and abuse linked infrastructure and narrows the plausible explanations for regulators and investigators.
DDoS Malware Targets Jenkins to Hit Valve Game Servers

gbhackers.com · 5 months ago

A new DDoS botnet abuses exposed Jenkins servers to launch powerful attacks against Valve Source Engine game infrastructure, including servers hosting Counter Strike and Team Fortress 2. On March 18, 2026, Darktrace observed a threat actor authenticate to a Jenkins honeypot and use the scriptText endpoint to execute a Groovy payload that fetched Windows and Linux binaries and established command and control. The malware sets a dontKillMe environment variable, renames itself to mimic kernel worker processes, daemonizes, and supports commands for keep alive, stop, update, and multiple attack modes including UDP floods, a Source Engine query amplification, TCP push floods, high rate HTTP GETs, and special modes targeting DNS, NTP, and game ports. Operators are advised to harden hosting, implement DDoS protections on common game ports such as 27015, and ensure CI tools like Jenkins are not exposed with weak credentials.
FBI Warns of Surge in Hacker-Enabled Cargo Theft

www.securityweek.com · 5 months ago

The FBI warns of a surge in cyber enabled cargo theft in which criminal enterprises hack shipping brokers and carriers to steal high value shipments for resale. These attacks, observed since at least 2024, use phishing emails, fake listings on trucking load boards, malware, and remote access tools to compromise systems, then employ stolen carrier identities to win contracts and perform illegal double brokering, cross docking, transloading, or ransom operations. The activity helped drive over 700 million dollars in cargo theft losses in 2025, a 60 percent increase from 2024, and the FBI shared indicators of compromise such as unauthorized shipment contact, suspicious emailed links, requests to download documents from shortened or spoofed links, and unauthorized forwarding or autodeletion rules in email accounts.
US ransomware negotiators get 4 years in prison over BlackCat attacks

www.bleepingcomputer.com · 5 months ago

Two former employees of cybersecurity firms Sygnia and DigitalMint were sentenced to four years in prison each for participating as affiliates in BlackCat ALPHV ransomware attacks against multiple U.S. companies. Prosecutors say that between May 2023 and November 2023 they breached networks, paid a 20 percent share of ransom proceeds for access to the ransomware platform, and extorted victims including a Maryland pharmaceutical firm, a Tampa medical device company, a California engineering firm, a Virginia drone manufacturer, and a California doctor's office. The Tampa company paid 1.27 million dollars after a 10 million dollar demand in May 2023 and other demands ranged from 300,000 dollars to 10 million dollars, with payments laundered and split among the defendants. The FBI has linked BlackCat ALPHV to more than 60 breaches between November 2021 and March 2022 and said the operation collected at least 300 million dollars from more than 1,000 victims through September 2023.
1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom

www.securityweek.com · 5 months ago

Over 1,800 developers were affected by a Mini Shai Hulud supply chain attack first observed on April 29, 2026, which compromised packages across the PyPi, NPM, and Packagist ecosystems. Malicious versions of the Lightning Python package 2.6.2 and 2.6.3, the intercom client NPM package 7.0.4 and 7.0.5, and intercom PHP 5.0.2 were injected with an information stealer that harvests credentials, keys, tokens, and other secrets and attempts to propagate to other packages. The malware exfiltrates stolen data to attacker infrastructure, searches GitHub for embedded command and control markers, and actively scans for Kubernetes and HashiCorp Vault secrets to collect AWS keys, GitHub and npm tokens, database connection strings, private keys, API secrets such as Stripe, Slack and Twilio, VPN credentials, cryptocurrency wallet data, and session tokens. Security researchers attribute the campaign to the TeamPCP group and report that more than 1,800 repositories containing stolen developer credentials were created, with the compromised Lightning and intercom packages having a combined monthly download count of nearly 10 million.
Multiple Wireshark Vulnerabilities Allow Arbitrary Code Execution via Malformed Packets

gbhackers.com · 5 months ago

Wireshark 4.6.5 fixes over 40 vulnerabilities following a surge in AI-assisted reports, with the most severe bugs enabling arbitrary code execution via malformed packets. Four critical flaws are CVE-2026-5402 in the TLS dissector, CVE-2026-5403 in the SBC codec dissector, CVE-2026-5405 in the RDP dissector, and CVE-2026-5656 in profile import, all of which can trigger memory corruption, crashes, or potential remote code execution when processing crafted network traffic or packet capture files. The update also patches dozens of denial-of-service issues in dissectors for protocols such as SMB2, HTTP, ICMPv6 and MySQL and in compression routines, and users are urged to upgrade immediately.
AI-Powered Ransomware Surge Hits 7,831 Victims Worldwide

gbhackers.com · 5 months ago

Ransomware attacks surged dramatically in 2025, reaching 7,831 victims worldwide and representing a nearly 389 percent year over year increase from roughly 1,600 cases in 2024, with the United States accounting for 3,381 victims. The rise is driven by the widespread availability of AI powered cybercrime tools such as WormGPT, FraudGPT and BruteForceAI and by underground offerings like HexStrike AI, which lower the barrier to entry and let even low skilled actors scale operations through automation. Attackers reduced time to exploit to 24 to 48 hours on average from 4.76 days previously, with some exploitations beginning within hours as with React2Shell, enabled by AI assisted reconnaissance, automated vulnerability scanning and pre built exploit frameworks, while international operations and increased intelligence sharing aim to disrupt criminal infrastructure.
4 ways to prepare your SOC for agentic AI

www.csoonline.com · 5 months ago

false
Deep#Door Stealer Targets Passwords, Tokens, SSH Keys, and Wi-Fi Credentials

gbhackers.com · 5 months ago

DeepDoor is a stealthy Python based remote access trojan that uses a heavily obfuscated batch loader embedding a full Python implant to deploy persistent surveillance and credential stealing on Windows systems. When executed it weakens host defenses by disabling Microsoft Defender components, suppressing SmartScreen and PowerShell logging, adding exclusions, and establishing multiple persistence mechanisms including startup scripts, registry run keys, scheduled tasks, and WMI subscriptions. The implant hides command and control traffic behind a public TCP tunneling service, decodes its host and key at runtime, performs environment checks to avoid sandboxes and debuggers, patches AMSI and ETW, and exfiltrates browser passwords, cloud tokens, SSH keys, and Wi Fi credentials. Defenders are advised to prioritize behavioral detection such as monitoring for self referential batch or PowerShell payload extraction, unauthorized security control changes, unusual persistence artifacts, and outbound connections to tunneling services.
FBI Warns Logistics Sector of Fake Business Identity Cargo Scams

gbhackers.com · 5 months ago

The FBI issued a public service announcement warning transportation and logistics companies of a sharp rise in cyber enabled strategic cargo theft, noting estimated losses in 2025 in the United States and Canada rose 60 percent to nearly 725 million dollars. Incidents confirmed by the Internet Crime Complaint Center increased 18 percent and the average value per theft rose to 273,990 dollars. Attackers use a multi step campaign that begins with spoofed broker emails and malicious links to deliver malware or remote management tools, then abuse compromised load board accounts to post fraudulent freight, double broker real shipments, manipulate bills of lading and FMCSA records, and use cross docking or transloading to hand goods to complicit drivers; organizations are advised to watch for unexplained broker contact, emails from free providers, shortened link download requests, unauthorized mailbox forwarding rules, and slight sender domain alterations, and to implement two factor authentication, multi channel verification, secondary confirmation for pickups, thorough driver and vehicle documentation, and immediate reporting to law enforcement and the Internet Crime Complaint Center.
China-Aligned Hackers Deploy ShadowPad in Multi-Stage Espionage Campaign

gbhackers.com · 5 months ago

There is a multi-stage espionage campaign by China-aligned threat actors tracked as SHADOW-EARTH-053 deploying the ShadowPad backdoor against government entities and critical infrastructure across South, East, and Southeast Asia and at least one NATO member state. The group is exploiting unpatched Microsoft Exchange and IIS flaws, notably the ProxyLogon chain CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, and the newer server-side issue CVE-2025-55182, using ASP.NET web shells such as GODZILLA and tools like AnyDesk for initial footholds. Post compromise activity includes Active Directory and Exchange reconnaissance, DLL sideloading to load ShadowPad, credential theft with Evil-CreateDump and Mimikatz, WMIC-driven lateral movement, DCSync-style attacks, and covert proxy tunneling with tools such as IOX, GOST, and Wstunnel to maintain command and control.
Ruby Gems and Go Modules Used in Campaign Targeting GitHub Actions

gbhackers.com · 5 months ago

A sophisticated software supply chain attack tied to the GitHub account BufferZoneCorp used malicious Ruby gems and Go modules to target developers and continuous integration environments including GitHub Actions. The Ruby packages, published under prefixes such as knot-activesupport-logger and linked to a knot-theory profile, executed at install time to harvest environment variables, scan local paths for SSH private keys AWS credentials and GitHub CLI configurations, encode the data as JSON and exfiltrate it while suppressing errors. The Go modules initialized on import to manipulate workflow environments by altering environment variables and proxy settings disabling checksum verification planting fake execution wrappers and in some cases appending a hardcoded SSH public key to authorized keys to enable persistent backdoor access; defenders are advised to audit dependencies rotate exposed credentials and limit secrets in automated jobs.
Claude Security Enters Public Beta for Enterprise Customers

gbhackers.com · 5 months ago

Anthropic has launched a public beta of Claude Security for Claude Enterprise customers, an advanced vulnerability detection and remediation platform. Powered by the Claude Opus 4.7 model, the tool shifts application security testing from basic pattern matching to deep contextual analysis and offers automated remediation guidance. The platform is designed to shorten the window between vulnerability discovery and exploitation by accelerating detection and remediation workflows for enterprise applications.
Microsoft Windows 11 April 2026 Security Update Disrupts Third-Party Backup Tools

gbhackers.com · 5 months ago

There is an April 2026 Windows 11 security update, KB5083769, deployed to versions 24H2 and 25H2 that breaks the Microsoft Volume Shadow Copy Service and is causing widespread failures of third-party backup snapshots. Affected backup products include Acronis Cyber Protect Cloud, Macrium Reflect, and Urbackup, with users reporting VSS timeouts and failed jobs while Microsoft’s native cloud backup is not affected. Vendors are recommending uninstalling KB5083769 and pausing updates as a temporary workaround until Microsoft issues an out of band fix or a May 2026 Patch Tuesday correction, but removing the patch reintroduces the security flaws it fixed and the upcoming point in time restore feature under KB5070307 may also be impacted.
Fake CAPTCHA Scam Uses SMS Pumping to Inflate Phone Bills

gbhackers.com · 5 months ago

A newly uncovered cyber fraud campaign abuses fake CAPTCHA pages to trick mobile users into sending large volumes of international SMS messages, resulting in unexpected phone bills and illicit profits for attackers. Victims are redirected via malvertising and typosquatted domains to CAPTCHA pages that open the device SMS app with prefilled messages and recipient numbers across at least seventeen countries, including high cost regions, with charges that can total about thirty dollars per victim. Attackers use browser back button hijacking to keep users in the scam flow and leverage click to SMS affiliate networks that share termination fees with operators, monetizing the inflated SMS traffic without needing to install malware. Recommended mitigations include avoiding CAPTCHAs that request actions outside the browser, monitoring mobile bills for unusual international SMS charges, contacting telecom providers promptly, disabling international or premium SMS if unnecessary, and using mobile security to block malicious domains.
Billions of Chrome Users Urged to Update After Google Patches 30 Security Flaws

www.techrepublic.com · 5 months ago

There are 30 Chrome vulnerabilities patched, including four Critical flaws, in an update that brings Chrome to version 147.0.7727.137 and 147.0.7727.138. Most fixes address Use‑After‑Free memory bugs that can let malicious websites bypass Chrome’s sandbox and run code, affecting components such as Canvas and the GPU. One critical Canvas vulnerability is tracked as CVE‑2026‑7363, which earned a researcher seven thousand dollars while another high severity GPU bug drew a sixteen thousand dollar payout. Users are urged to update now and restart Chrome, and Firefox users should install version 150.0.1 to address related memory safety and information disclosure fixes.
‘Trivial’ exploit can give attackers root access to Linux kernel

www.csoonline.com · 5 months ago

There is a serious Linux kernel logic bug called Copy Fail that allows an unprivileged local user to trigger a deterministic four byte write into the page cache of any readable file and thereby obtain root access, tracked as CVE-2026-31431. The flaw, discovered by researchers at Theori, affects most Linux distributions shipped since 2017 and is exploitable by a trivial proof of concept Python script that also enables escapes from container environments. Researchers compared Copy Fail to prior local privilege escalation flaws, noting it is a straight line logic error unlike Dirty Cow CVE-2016-5195 or Dirty Pipe CVE-2022-0847 which required races or precise conditions. Administrators are advised to apply kernel patches immediately when released, prioritize multi tenant hosts, containers and continuous integration systems, consider disabling the vulnerable module or applying available kernel boot parameters where feasible, and monitor for unusual privilege escalation activity since a reboot may be required to fully mitigate.
Bank regulator sounds warning over cybersecurity threat posed by AI models

www.csoonline.com · 5 months ago

Australia's financial regulator, the Australian Prudential Regulation Authority, warned that frontier AI models inspired by Anthropic's Claude Mythos could give attackers advanced capabilities that the banking sector is ill equipped to cope with. The regulator said governance has not kept pace with AI risks and called for faster vulnerability identification and remediation, robust security testing of AI generated code and components, and deeper assessment of major AI platforms. Regulators and industry figures urged banks to gain access to Claude Mythos to better defend themselves, warning that AI can shorten the attack cycle and that defenders must automate defenses or face a sharp rise in targeting of financial services.
Elon Musk’s A.I. Claims of Danger Face Limits in OpenAI Trial

www.nytimes.com · 5 months ago

There is a high-profile civil trial in Oakland in which Elon Musk is suing OpenAI, Sam Altman, Greg Brockman, and Microsoft over OpenAI's conversion from a nonprofit to a for-profit structure and is seeking remedies including the removal of executives and tens of billions in disgorgement. Musk has testified and framed his case partly around fears that advanced AI could pose an existential threat, but the legal arguments before the jury focus on corporate governance, fiduciary duties, and the timing of his objections. Courtroom rules and the judge's management of evidence mean jurors are expected to be asked to decide narrower contract and governance questions while the judge will determine any remedies, limiting the role of broader existential debates in the jury's deliberations.
Apple Reports 17% Sales Jump, Powered by iPhones

www.nytimes.com · 5 months ago

Apple reported a record quarter driven by unprecedented iPhone demand, posting $143.8 billion in revenue and $42.1 billion in profit for the quarter ended December 27, 2025, with diluted earnings per share rising 19 percent. iPhone revenue surged to about $85.3 billion, up roughly 23 percent year over year, and set all-time records across geographic segments. The company is undergoing a planned leadership transition with Tim Cook moving to executive chairman and John Ternus named chief executive officer effective September 1, 2026.
That AI Extension Helping You Write Emails? It’s Reading Them First

unit42.paloaltonetworks.com · 5 months ago

There are 18 AI browser extensions marketed as productivity tools that instead deliver remote access Trojans, man in the middle attacks, and infostealers, with examples that surveil emails as they are composed, intercept AI prompts, and exfiltrate passwords. These extensions abuse powerful browser privileges to intercept API calls, observe the rendered page DOM, proxy traffic, decrypt HTTPS responses, establish persistent WebSocket command and control channels, execute arbitrary JavaScript in authenticated tabs, attach the browser debugger, and exfiltrate sensitive data including one time passwords and AI API keys, and multiple samples contained AI generated code used by the attackers. Google either removed the reported extensions or warned their owners, and recommended mitigations include sourcing extensions only from trusted providers, applying the principle of least privilege, and carefully scrutinizing requested permissions because broad browser access can authorize interception of credentials and proprietary session information.
TeamPCP Hits SAP Packages With 'Mini Shai-Hulud' Attack

www.darkreading.com · 5 months ago

There is a supply chain campaign by TeamPCP that compromised several npm packages for SAP's Cloud Application Programming Model and Cloud MTA Build Tool, with four poisoned packages going live on April 29, 2026 and including at cap js sqlite version 2.2.2, at cap js postgres version 2.2.2, at cap js db service version 2.10.1 and mbt version 1.2.48. The packages contained malicious preinstall scripts that run on installation and deploy a multistage payload to harvest GitHub, npm, Kubernetes, CI CD and cloud credentials, exfiltrate data to attacker controlled GitHub repositories and propagate via compromised tokens, and security vendors Wiz, Socket and Aikido attributed the activity to TeamPCP based on technical overlaps. The campaign references previous Shai hulud worm operations from fall 2025 but researchers say the link is unproven, and organizations are urged to search lockfiles, package caches, CI logs, internal registries, artifact stores and developer systems for signs of the poisoned packages and to rotate all affected secrets.
Samsung’s Free Android Upgrade Brings Better Security to Galaxy Phones

www.techrepublic.com · 5 months ago

One UI 8.5 is expected to add protections for theft, failed authentication attempts, app blocking, and inactivity restarts, with a rollout likely beginning in Korea before expanding globally around May 4 as a free upgrade for supported Galaxy devices. Some Galaxy S25 and S24 users report rapid battery drain and device overheating after a recent security update, with the exact cause still unknown and no official fix announced. Suggested culprits include certain Meta apps and recent enhancements to Samsung Knox Matrix that may be affecting device performance. The stable One UI 8.5 program began in December 2025 and has gone through ten beta releases, drawing notable criticism during testing.
Another AI-Assisted Software Scan Yields 9-Year-Old Linux Bug

www.darkreading.com · 5 months ago

There is a nine-year-old local root escalation vulnerability in the Linux kernel cryptography code tracked as CVE-2026-31431 that allows any unprivileged user to write four specific bytes into an in-memory copy of a readable file to gain root privileges. A public proof of concept exploit is only ten lines long, works reliably across all Linux distributions without race conditions, leaves no disk traces and clears on reboot. Exploitation enables container escape from Kubernetes pods and compromise of continuous integration runners, posing risks to system configurations, secrets and deployment keys. A patch is available and researchers say AI assisted scanning combined with human insight produced the finding.
New Global Scam Uses Fake Meeting Links to Run PowerShell Malware

www.techrepublic.com · 5 months ago

BlueNoroff, a financially motivated subgroup of North Korea’s Lazarus Group, used spearphishing with AI generated deepfakes and typosquatted meeting links to lure Web3 and cryptocurrency founders and executives into fake Zoom or Teams calls. During the calls victims were shown a broken audio prompt and urged to run a ClickFix style command that executed a fileless PowerShell script which fetched a second payload and established in memory persistence to evade file based detection. The malware injected into Chromium based browser processes to steal cryptocurrency wallet keys, login credentials, and browser history, escalated privileges, captured high resolution screenshots, and attackers often reused compromised identities to target others. Recommended defenses include security awareness training, tuned endpoint detection and response for fileless activity, reputation based network monitoring, segmentation of critical systems, and regular audits of installed extensions and processes.
Cisco Introduces Model Provenance Kit to Strengthen AI Supply Chain Security

www.techrepublic.com · 5 months ago

Cisco released an open source Model Provenance Kit to help organizations verify AI model origins, trace lineage, and reduce AI supply chain security risks. The kit fingerprints models at the weight level to determine direct or indirect derivation and is accompanied by a Model Provenance Constitution that defines legitimate derivation relationships and lists common false signals such as shared architecture or overlapping datasets. Recommended risk mitigations include verifying lineage, enforcing strong governance aligned with frameworks such as NIST AI RMF, securing training and inference pipelines and access controls, continuous monitoring and adversarial testing, and regularly exercising AI incident response plans.
Palantir Is Making a French Chore Coat. Yes, That Palantir.

www.nytimes.com · 5 months ago

There is a French style chore coat being sold by Palantir that the company frames as a signal of its commitment to re industrializing America. The launch fits a broader trend of technology firms expanding into menswear and branding apparel to burnish industrial credentials, and it has drawn criticism for appearing tone deaf given Palantir's ties to defense and surveillance work. The coat prompted widespread online mockery and debate among employees, commentators and critics who described the move as provocative and techno fascist.
Anthropic's Mythos Has Landed: Here's What Comes Next for Cyber

www.darkreading.com · 5 months ago

On April 7, Anthropic announced that its Claude Mythos model can find and exploit zero day bugs across major operating systems and web browsers and said the model quickly identified a 27 year old flaw in OpenBSD. A consortium called Project Glasswing, made up of major cloud providers, software vendors, security firms, and financial institutions, will use the model defensively to test software and prioritize fixes before adversaries can adopt the capability. Security leaders and policymakers warn the capability is double edged, that regulation may be difficult without blocking defensive uses, and that rapid formalized information sharing between vendors and government agencies will be essential to limit weaponization.
New Bluekit phishing service includes an AI assistant, 40 templates

www.bleepingcomputer.com · 5 months ago

A new phishing kit called Bluekit provides more than 40 templates that mimic popular email, cloud, developer, and cryptocurrency services including Outlook, Hotmail, Gmail, Yahoo, ProtonMail, iCloud, GitHub, and Ledger. Bluekit includes an AI Assistant panel that supports multiple models such as Llama, GPT-4.1, Claude, Gemini, and DeepSeek to generate campaign drafts, but analysis shows the outputs are largely placeholder content and function more as campaign skeletons than finished phishing flows. The platform combines domain registration, phishing page setup, and campaign management with real time victim session monitoring, cookie and local storage capture, Telegram exfiltration channels, and options to block VPNs, headless agents, and apply fingerprint based filters, and it is under active development with frequent updates.
Anthropic Unveils Claude Security to Counter AI-Powered Exploit Surge

www.securityweek.com · 5 months ago

With models like Mythos compressing time to exploit to minutes, defenders face a surge of near instant attacks unless they deploy specialized AI defenses. Anthropic has released Claude Security in public beta to Claude Enterprise customers; it runs on Claude Opus 4.7, is accessible from the Claude sidebar without API integration, and can scan selected repositories, directories, or branches to find vulnerabilities, explain findings, rate confidence, reproduce issues, and generate targeted patching instructions that can be executed with Claude Code on the Web. The product supports scheduled scans for ongoing coverage and is being integrated into major security platforms and professional services so teams can speed remediation and keep pace with AI enabled threats, with rollout to team and Max customers planned soon.
AI Fuels ‘Industrial’ Cybercrime as Time-to-Exploit Shrinks to Hours

www.securityweek.com · 5 months ago

Industrialized cybercrime now delivers attacks with far greater scale, speed and success by using AI, automation and efficient data sharing to turn vulnerabilities into repeatable, business-like exploits. Malicious tools including WormGPT, FraudGPT, HexStrike AI, APEX AI and BruteForceAI automate reconnaissance, attack-path generation, social engineering, code creation and credential attacks, lowering skill and time requirements for attackers. Time-to-exploit for many critical vulnerabilities has collapsed from nearly a week to about 24 to 48 hours and in some cases begins within hours of public disclosure, aided by infostealers and underground markets that sell databases, credentials and validated access. Defenders are urged to match this machine-speed threat with defensive AI and automation, prioritizing identity-centric detection, exposure reduction and faster detection and response.
Here’s the latest.

www.nytimes.com · 5 months ago

NULL
Romanian leader of online swatting ring gets 4 years in prison

www.bleepingcomputer.com · 5 months ago

A Romanian national, 27 year old Thomasz Szabo, extradited from Romania on November 18, 2024, was sentenced to four years in federal prison and three years of supervised release after pleading guilty in June 2025 to one count of conspiracy and one count of threats involving explosives. He founded and led an online community that beginning in late 2020 organized swatting and bomb threats that targeted more than 75 public officials, multiple journalists, four religious institutions, at least 25 members of Congress or their family members, several cabinet and senior executive branch officials, senior federal law enforcement officials, members of the federal judiciary, and dozens of state officials. He personally made false reports including a December 2020 threat to carry out a mass shooting at New York City synagogues and a January 2021 threat to detonate explosives at the U.S. Capitol and kill President elect Joe Biden, and he encouraged followers to carry out similar attacks. An accomplice, 23 year old Nemanja Radovanovic, was also charged in August 2024 and faces separate proceedings while authorities say the scheme wasted taxpayer funds, drained law enforcement resources, and put innocent civilians in harm's way.