Blahalla

vr2jb: Pwning the PlayStation VR2 using Sony's hidden recovery mode

bnuuy.solutions · 5 months ago

Researchers discovered a stack overflow in the PS VR2 USB authentication code that copies an unvalidated USB request buffer into a fixed 64 byte stack structure, enabling overwriting of stack memory. Repeatedly triggering the overflow while connecting the headset crashes it into a recovery mode that boots firmware version v01.10 and allows the device to be downgraded to any firmware by replacing the PC update package, bypassing expected downgrade protections. An exploit tool named vr2jb was released to perform the downgrade and the authors recommend moving to firmware v06.00 for further exploitation while warning of the risk of hardware damage.
Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

thehackernews.com · 5 months ago

There are state sponsored attackers who hijacked Notepad plus plus official update mechanism by compromising the hosting provider, allowing interception and redirection of update traffic to attacker controlled servers. The WinGUp updater's verification of downloaded files was bypassed so targeted users received poisoned executables, with the campaign assessed to have started in June 2025, the shared hosting server compromised until September 2, 2025, and attackers retaining internal credentials until December 2, 2025. Notepad plus plus released version 8.8.9 to address the issue, migrated its website to a new host, and independent researchers attributed the exploitation to threat actors in China.
Hackers Target MongoDB Instances to Delete Databases and Plant Ransom Notes

gbhackers.com · 5 months ago

A widespread ransomware campaign is compromising thousands of misconfigured MongoDB databases worldwide. Attackers are exploiting internet exposed instances that lack basic authentication, using automated scripts to wipe databases, plant ransom notes, and demand Bitcoin payments. Researchers warn that simple configuration negligence has become a scalable extortion vector and urge organizations to secure MongoDB instances by enabling authentication and limiting network exposure.
PeckBirdy Hackers Abuse LOLBins Across Environments to Deploy Advanced Malware

gbhackers.com · 5 months ago

PeckBirdy is a sophisticated JScript command and control framework active since 2023 that abuses living off the land binaries to execute across browsers, MSHTA, WScript, Classic ASP, Node.js, and.NET ScriptControl, adapting communications with WebSocket and HTTP fallbacks and encrypting traffic with AES tied to a 32 character ATTACKID. The framework has been used in two coordinated campaigns called SHADOW-VOID-044 and SHADOW-EARTH-045 targeting Chinese gambling websites, Asian government entities, and private organizations while delivering modular backdoors such as HOLODONUT, a.NET modular backdoor deployed via a NEXLOAD downloader that uses Donut to run assemblies in memory, and MKDOOR, which employs a downloader that adds Microsoft Defender exclusions and mimics Microsoft support traffic. The SHADOW-EARTH-045 campaign exploited CVE-2020-16040 in Google Chrome to trick users into executing malware, and operators also used stolen code signing certificates and signed Cobalt Strike payloads to further evade detection.
Deutschland und Israel trainieren Abwehr von Cyberangriff

www.csoonline.com · 5 months ago

Germany and Israel have for the first time conducted a joint exercise to defend against a major cyber attack called Blue Horizon. The exercise is the first concrete step under the Cyber and Security Pact agreed by German Interior Minister Alexander Dobrindt and Israeli Prime Minister Benjamin Netanjahu and seeks closer networking of security agencies and cooperation on cybercrime, artificial intelligence and drone defense. A core element is development of a German Cyberdome modeled on the Israeli system that aggregates diverse data and uses artificial intelligence to detect vulnerabilities and warn organizations of threats early. Israel says it has deep experience defending against frequent Iranian cyber attacks that aim to sabotage infrastructure, collect data and spread disinformation and it continues to work with allies to counter such threats.
Move Fast, but Obey the Rules: China’s Vision for Dominating A.I.

www.nytimes.com · 5 months ago

Beijing aims to lead the world in cutting-edge artificial intelligence while imposing an increasingly complex regulatory framework that requires platform providers to register services, undergo security reviews, and use and disclose legitimate training data to regulators. Regulatory oversight is spread across multiple agencies, mandates conspicuous labeling of synthetic content and complaint-handling mechanisms, and couples support for commercial development with strict controls over political and social risks, backed by a national algorithm registry that catalogs thousands of AI tools and specified risk categories.
CSO Barry Hensley on staying a step ahead of the cyber threat landscape

www.csoonline.com · 5 months ago

Barry Hensley is a retired US Army colonel with 24 years as an Army Signal Officer who now serves as chief security officer at Brown & Brown after leading elite cyber forces and committing his career to protecting national and customer networks. He says organizational awareness of cyber risk has increased after incidents and regulatory action, but investment and risk tolerance vary, and threat actors focus on valuable data and low maturity programs with ransomware often targeting likely payers. His security strategy centers on focused investments tied to risk tolerance, adopting AI to automate commodity tasks while freeing humans for context and continuous penetration testing, and improving validation and collaboration with third and fourth party vendors. To retain talent he emphasizes leadership that aligns teammates to mission and purpose, and he warns the biggest ongoing challenge is the unknown since defenders must be right all the time while attackers need only succeed once.
Notepad++ Users Targeted After State-Backed Attackers Hijack Update Servers

gbhackers.com · 5 months ago

There was a six month supply chain attack that began in June 2025 in which state backed actors compromised Notepad plus plus update infrastructure and selectively redirected update requests to attacker controlled servers. Attackers gained access to the shared hosting server, maintained persistent access until September 2, 2025, and then continued intercepting and manipulating update traffic until December 2, 2025 by abusing stolen credentials and the getDownloadUrl.php endpoint while exploiting insufficient cryptographic verification. Notepad plus plus migrated to a new hosting provider, WinGup was strengthened in version 8.8.9 to verify certificate and installer signatures, XML update responses will be signed using XMLDSig with mandatory verification in version 8.9.2, and the hosting provider rotated credentials and hardened systems.
ShadowHS: New Stealthy Fileless Linux Malware Spreads Automatically

gbhackers.com · 5 months ago

ShadowHS is a sophisticated fileless Linux malware framework that runs entirely in memory via anonymous file descriptors and proc execution, using a multi stage AES 256 CBC encrypted shell loader and spoofed process arguments to evade file integrity and signature based defenses. It is operator driven, performs extensive reconnaissance and fingerprinting of enterprise security tools including CrowdStrike, Sophos, Cortex XDR and Microsoft Defender, implements anti competition logic to terminate rival malware, and carries out covert data exfiltration using GSocket user space tunnels with hardcoded rendezvous endpoints. Capabilities include on demand cryptocurrency mining, lateral movement using Rustscan and brute force tooling, dormant credential theft and privilege escalation modules, and an exploit binary tied to CVE 2025 21756 with a detailed set of indicators of compromise provided for detection and response.
When responsible disclosure becomes unpaid labor

www.csoonline.com · 5 months ago

Responsible disclosure is fraying as researchers increasingly wait months or more for acknowledgments, sometimes prompting public disclosure, legal escalation, or ethically questionable actions. The React2Shell vulnerability CVE-2025-55182 showed that coordinated disclosure involving maintainers and major cloud providers can enable timely patches, yet even well-handled disclosures can be exploited in the wild and cause widespread operational risk. Common failure modes include silent responses, disputes over CVE scope and severity, report flooding from automated scanners, and coercive escalation, which together turn unpaid research into de facto consulting and erode trust. CISOs are urged to treat disclosure as an operational function by setting acknowledgment and triage service levels, publishing severity triage criteria, providing noncash recognition or legal safe harbor, funding critical open source dependencies, and using third party coordinators to reduce friction.
Your Phone Silently Sends GPS to Your Carrier via RRLP/LPP – Here's How the Control Plane Positioning Works

fumics.in · 5 months ago

RRLP and LPP protocols let carriers silently extract precise GPS coordinates from a phone by querying the baseband without app permissions, notifications, or OS involvement. Control plane positioning works because the baseband processor handles signaling requests, activates the GPS chipset, computes coordinates, and returns them with no authentication and no visibility to the application processor. Law enforcement, intelligence agencies, and carriers selling location data have used this capability, and legal standards for real time control plane positioning are inconsistent across jurisdictions. Apple iPhone 16e devices with a C1 modem running iOS 26 can notify the OS, prompt the user, and provide a coarser response for non emergency requests but that protection is limited to that modem and the only reliable user defenses today remain physical measures such as airplane mode, removing the SIM, or a Faraday bag.
Windows 11 Introduces New Feature to Block Unauthorized Access to System Files

gbhackers.com · 5 months ago

Microsoft released KB5074105, a critical preview update for Windows 11 versions 25H2 and 24H2, OS builds 26200.7705 and 26100.7705, that implements stricter layered access control to block unauthorized reading or modification of protected system files. The release also includes KB5074104 as a servicing stack update to improve secure and reliable update deployment, and updates multiple on device AI components including Image Search, Content Extraction, Semantic Analysis, and Settings Model to version 1.2601.1268.0. The update is being rolled out in phases and organizations are advised to test it in controlled environments, monitor the Windows release health dashboard, and prioritize deployment in security sensitive environments via Windows Update, the Microsoft Update Catalog, Windows Server Update Services, or the Business Catalog.
Arsink RAT Targets Android Devices to Steal Sensitive Data and Enable Remote Access

gbhackers.com · 5 months ago

Arsink is a cloud native Android Remote Access Trojan that steals device identifiers, public IP and location data, Google account emails, SMS messages, call logs, contacts, microphone audio, and files while giving attackers deep remote control including toggling the flashlight, initiating calls, and wiping external storage. Malicious APKs are distributed via Telegram channels, Discord posts, and direct downloads, often masquerading as mod or premium versions of well known apps and requesting sensitive permissions to run quietly in the background. Researchers observed 1,216 distinct APK hashes, roughly 317 unique Firebase Realtime Database endpoints used as command and control or data sinks, and about 45,000 unique victim IP addresses with major concentrations in Egypt, Indonesia, Iraq, Yemen, and Türkiye. Variants exfiltrate data through Google Apps Script into Google Drive, Firebase Realtime Database and Storage, and sometimes Telegram bots, and defenders are advised to avoid sideloading mod APKs, use Play Protect, and report abusive cloud infrastructure.
eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware

thehackernews.com · 5 months ago

The update infrastructure for eScan antivirus developed by MicroWorld Technologies was compromised by unknown attackers who distributed malicious updates that installed a persistent multi stage downloader on enterprise and consumer endpoints. Unauthorized access to a regional update server allowed a corrupt update to be pushed during a roughly two hour window on January 20, 2026, prompting MicroWorld to isolate impacted update servers for over eight hours and release a remediation patch. The attackers replaced the legitimate reload.exe with a rogue signed variant that uses an UnmanagedPowerShell based loader with an AMSI bypass to run Base64 encoded PowerShell scripts that block updates, establish persistence, modify the HOSTS file, and fetch additional payloads including a CONSCTLX.exe component and a scheduled task launched PowerShell payload. Kaspersky and Morphisec telemetry shows hundreds of attempted infections mainly in India, Bangladesh, Sri Lanka and the Philippines, and organizations are urged to contact MicroWorld for the available fix and remediation guidance.
1-Click Flaw in ClawDBot Allows Remote Code Execution

gbhackers.com · 5 months ago

There is a high severity authentication bypass in the ClawDBot npm package that allows remote code execution when a user clicks a single malicious link. The Control UI accepts an unvalidated gatewayUrl parameter from the query string and automatically opens a WebSocket connection that transmits the stored gateway authentication token to the specified endpoint. An attacker who tricks a victim into visiting a crafted URL or phishing site can exfiltrate that token, gain operator level access to the gateway API, modify gateway configuration and policies, and achieve full gateway compromise and remote code execution even on instances bound to localhost. The issue is tracked as GHSA-g8p2-7wf7-98mq, affects versions up to v2026.1.28, and was fixed in v2026.1.29 which enforces user confirmation for new gateway URLs; users are advised to upgrade and audit gateway access logs.
AutoPentestX Introduced as Automated Penetration Testing Toolkit for Linux Systems

gbhackers.com · 5 months ago

AutoPentestX is an open source automated penetration testing framework for Linux that consolidates reconnaissance, scanning, exploitation, and reporting into a single modular platform. Developed by security researcher Gowtham-Darkseid, the toolkit runs on Python 3.x and Bash, integrates with common penetration testing tools, and is configured via an install script and a JSON configuration file. It generates structured vulnerability reports and timestamped logs for audits, operates under the MIT License with legal disclaimers, and has accrued 581 GitHub stars and 121 forks since its release about three months ago.
Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm

thehackernews.com · 5 months ago

On January 30, 2026 four Open VSX extensions published by the oorzc author were replaced with malicious versions that embedded the GlassWorm malware loader. The attackers abused the developer publishing credentials, likely via a leaked token or other unauthorized access, to distribute encrypted runtime loaders that use EtherHiding and Solana memos to retrieve command and control infrastructure. The malware profiles hosts to exclude Russian locales and exfiltrates macOS credentials, browser logins and cookies, wallet files for multiple cryptocurrency wallets, iCloud Keychain data, developer credentials such as npm auth tokens and GitHub artifacts, and VPN and SSH configuration files. The poisoned releases have been removed from Open VSX and defenders are advised to prioritize behavioral detection and rapid response because static indicators are less effective.
Researchers Uncover Moltbook AI Flaw Exposing API Keys and Login Credentials

gbhackers.com · 5 months ago

A critical vulnerability in Moltbook, the AI agent social network launched in late January 2026, exposes email addresses, JWT login tokens, and API keys for registered agents and may affect the platform's claimed 1.5 million accounts though researchers say much of that count is driven by unchecked bot registrations. An exposed database misconfiguration combined with an insecure direct object reference allows unauthenticated attackers to enumerate sequential agent IDs via simple GET requests to harvest credentials and OpenClaw API keys, while untrusted inputs, unsandboxed OpenClaw execution, and external service integrations amplify the risk. No patch has been confirmed and Moltbook has been unresponsive to disclosure, so users are advised to revoke exposed API keys, sandbox agent execution, and audit data exposures while enterprises should enforce governance to limit unauthorized AI agent deployments.
Google Uncovers Major Expansion in ShinyHunters Threat Activity Using New Tactics

gbhackers.com · 5 months ago

There is a substantial expansion in ShinyHunters branded extortion operations that now combine advanced voice phishing and victim branded credential harvesting websites to capture single sign on credentials and multi factor authentication codes. Google threat intelligence tracked clusters UNC6661 UNC6671 and UNC6240 during early to mid January 2026 and found attackers using lookalike domains registered through registrars such as NICENIC and Tucows to harvest Okta credentials, register attacker devices, and move laterally to exfiltrate data from cloud services including SharePoint Salesforce DocuSign and Slack. Operators deleted evidence by removing an Okta security method enrolled email and enabling a Google Workspace add on to search and permanently delete messages, and Mandiant observed PowerShell activity downloading data from SharePoint and OneDrive. Extortion demands in mid January 2026 specified Bitcoin payments with 72 hour deadlines and tactics escalated to harassment, extortion text messages and distributed denial of service attacks while defenders are urged to migrate to phishing resistant multi factor authentication such as FIDO2 security keys or passkeys.
Why should renters like me have to trade away our privacy just to get a roof over our heads? | Samantha Floreani

www.theguardian.com · 5 months ago

Renters increasingly must hand over large amounts of revealing personal information to digital third parties in order to secure housing. Seven popular rent-tech platforms have serious security vulnerabilities that left millions of lease documents containing renters' personal information exposed on the open web for years. When these risks were disclosed, only two of the seven companies responded saying they would implement additional security measures, leaving many renters' data still at risk.
Das nächste große Security-Schlachtfeld

www.csoonline.com · 6 months ago

Künstliche Intelligenz hat weite Teile der Technologielandschaft durchdrungen und Quantencomputing steht als das nächste große Technologieereignis bereit, sodass das Zusammentreffen beider Bereiche Rechenleistung, Cybersicherheit und geopolitische Machtverhältnisse neu gestalten könnte. Quantencomputer arbeiten mit Qubits und Prinzipien wie Superposition und Verschränkung, die Probleme in Mikrosekunden lösen, Quantum Machine Learning ermöglichen und neue Anwendungen wie Echtzeitklimamodellierung oder Real Time Finanzsimulationen denkbar machen. Die Kehrseite ist, dass Quantenrechner bestehende Verschlüsselungsverfahren wie ECC, RSA und AES aushebeln könnten, wodurch Vertraulichkeit gefährdet wäre und Angriffe wie Passwortknacken, Zertifikatfälschung und quantengestützte Deepfakes erleichtert würden, ein Szenario, das als Q Day bezeichnet wird. Deshalb bereiten sich Regierungen und Unternehmen vor, setzen Zeitpläne zur Härtung von Systemen fest, fördern quantenresistente Kryptografie und investieren in KI Governance, Audits, Observability und ethische sowie regulatorische Rahmenbedingungen.
Notepad++ Hijacked by State-Sponsored Hackers

notepad-plus-plus.org · 6 months ago

There are reports that traffic from the Notepad++ updater WinGUp was occasionally redirected to malicious servers, resulting in the download and execution of compromised installer files. The issue stemmed from a weakness in how the updater validated the integrity and authenticity of downloaded update files, allowing an attacker who could intercept update traffic to prompt the updater to run an unwanted binary. Mitigations include hardening Notepad++ and WinGUp to verify digital signatures and certificates of downloaded installers so updates are aborted if verification fails, and users are advised to remove any previously installed root certificate and install the fixed release published on December 9, 2025.
Enterprise Spotlight: Manufacturing Reimagined

us.resources.cio.com · 6 months ago

Emerging technologies such as artificial intelligence, extended reality, edge computing, and digital twins are driving significant changes across the manufacturing sector. A February 2026 Enterprise Spotlight issue produced by the editors of CIO, Computerworld, CSO, InfoWorld, and Network World examines these technologies and how they are poised to reshape how companies operate, compete, and deliver value. The report focuses on the new tech at the forefront of innovation and the practical implications for manufacturing organizations navigating a rapidly evolving digital landscape.
Microsoft Pledged to Save Water. In the A.I. Era, It Expects Water Use to Soar.

www.nytimes.com · 6 months ago

Microsoft projects that water use at its data centers will more than double by 2030 compared with 2020 as artificial intelligence workloads expand. The increase is expected to occur even in regions that face water shortages, raising concerns about strain on local water supplies and utilities. The company is pursuing water-saving measures including closed-loop cooling, chip-level cooling, and next-generation datacenter designs that aim to reduce water-use intensity and deploy zero-water cooling in some facilities. No CVE identifiers are mentioned.
The Social Media Addiction Trials: What to Know

www.nytimes.com · 6 months ago

Landmark bellwether trials begin January 27, 2026 in Los Angeles testing claims that Meta, TikTok, Snap and YouTube designed features such as infinite scroll, autoplay, algorithmic recommendations and push notifications to foster compulsive use and cause mental health harms in young people. Plaintiffs seek damages and say internal company documents show executives prioritized teen engagement, while the companies deny wrongdoing, point to content and Section 230 issues, and note safety tools they have added. Snap settled a related case days before trial, and legal experts say the remaining trials could set precedent comparable to tobacco and opioid litigation and potentially lead to large damages, product redesigns, or new regulation.
1-Click RCE in OpenClaw/Moltbot/ClawdBot

depthfirst.com · 6 months ago

OpenClaw, formerly Moltbot and ClawdBot, had a critical logic flaw where a gatewayUrl query parameter persisted to storage could trigger an immediate connection that included the authentication token, enabling a single malicious click to leak that token to an attacker. Because the WebSocket server did not validate the origin header, an attacker could pivot through the victim browser to reach localhost instances, then use the stolen admin token to disable exec approvals and force tools to run on the host rather than inside a sandbox, achieving one click remote code execution. The issue was patched, versions up to v2026.1.24-1 were vulnerable, and users are advised to upgrade OpenClaw and rotate any potentially leaked tokens.
Comparing different IP Geolocation Provider's Accuracy

ipapi.is · 6 months ago

There are ten major IP geolocation providers compared using ground truth GPS coordinates collected with user consent via the browser Geolocation API. After excluding non residential addresses such as datacenters, VPNs, proxies, Tor and other non residential traffic, the data shows roughly 92 percent country level accuracy and about 70 percent city level accuracy within 50 kilometers, while neighborhood level accuracy within 10 kilometers drops to roughly 15 to 35 percent. The 75th percentile deviations range from about 128 to 288 kilometers and extreme outliers of over 15,000 kilometers occur with mobile carrier IPs, CGNAT, IPv6 gaps and recently reallocated ranges. The conclusion is that IP geolocation is a useful first indicator for localization, fraud detection and compliance, but applications that need higher precision should use browser based geolocation such as GPS or WiFi triangulation.
Exposed MongoDB instances still targeted in data extortion attacks

www.bleepingcomputer.com · 6 months ago

A threat actor is targeting exposed MongoDB instances in automated data extortion attacks, compromising around 1,400 servers and leaving ransom notes that demand about 0.005 Bitcoin, roughly five hundred dollars. Researchers found more than 208,500 publicly exposed MongoDB servers, about 3,100 accessible without authentication, and nearly half of those unrestricted instances had been wiped and bore ransom notes often demanding payment within 48 hours to one of five wallet addresses with one address used in about ninety eight percent of cases. Many exposed servers run older MongoDB versions vulnerable to n day flaws, and administrators are advised to avoid public exposure, enable strong authentication, enforce firewall and network policies, update MongoDB, rotate credentials if exposed, and monitor logs for unauthorized activity.
New Apple privacy feature limits location tracking on iPhones, iPads

www.bleepingcomputer.com · 6 months ago

There is a new privacy feature that lets users limit the precision of location data shared with cellular networks on some iPhone and iPad models by restricting carriers to approximate locations rather than precise street addresses, and emergency calls are not affected. There is a Limit Precise Location setting available after upgrading to iOS 26.3 or later that users can enable from Settings under Cellular and Cellular Data Options, and the system may prompt a device restart to complete activation. There is support for the feature on iPhone Air, iPhone 16e, and iPad Pro M5 Wi Fi and Cellular models and availability depends on carrier support, with confirmed networks including Telekom in Germany, EE and BT in the United Kingdom, Boost Mobile in the United States, and AIS and True in Thailand.
r/netsec monthly discussion & tool thread

www.reddit.com · 6 months ago

A monthly netsec discussion and tool thread invites questions about network security and the sharing of tool links. Rules require civil discourse, marking NSFW or classified content, avoiding memes, keeping all discussions directly related to netsec, and prohibiting tech support, and feedback is requested to be sent to the moderators inbox.
Real estate agents in Australia using apps that leave millions of lease documents at risk, digital researcher says

www.theguardian.com · 6 months ago

Australian rent platforms used by real estate agents are exposing millions of lease agreements and supporting documents via publicly accessible hyperlinks that do not require authentication. An analysis of seven platforms found links could be discovered by web crawlers or guessed by incrementing URL numbers or via URL shorteners, and in one case accessing a document issued an authentication cookie that granted access to a landlord's entire rental history. Some companies have since introduced measures such as expiring links and postcode checks, while the Office of the Australian Information Commissioner says it has received no breach notifications and is scrutinising rent tech platforms.
We ran a live red-team vs blue-team test on autonomous OpenClaw agents

gobrane.com · 6 months ago

A controlled red team versus blue team security audit of autonomous agents built on the OpenClaw framework ran a live session with no humans in the loop and direct webhook to webhook communication with real tooling access. The test focused on three failure dimensions called access, exposure, and agency and deployed a red agent authorized to attack and a blue observability agent with shared secrets and no extra guardrails. The defending agent blocked a direct social engineering Trojan that attempted credential exfiltration and remote code execution, but an indirect attack succeeded when a malicious payload was hidden inside JSON metadata that relied on implicit execution and variable expansion and remains under analysis. The key takeaway is that direct attacks are easier to detect and stop while indirect execution paths through documents, templates, and memory present the harder frontier for agent security.
Google helped Israeli military contractor with AI, whistleblower alleges

www.washingtonpost.com · 6 months ago

A whistleblower complaint filed with the Securities and Exchange Commission alleges Google breached its own AI policies in 2024 by helping an Israeli military contractor use Gemini AI to analyze drone surveillance video. Internal documents say a July 2024 customer support request from an Israel Defense Forces email, linked to the firm CloudEx, asked for help improving Gemini's ability to identify drones, armored vehicles and soldiers, and Google cloud staff responded with suggestions and tests. The complaint asserts this use contradicted Google's 2018 AI principles banning applications for weapons or surveillance and that the company misled investors, while Google says the assistance was limited and the account's spend was too small to be meaningful. The information also notes Google updated its policies in February 2025 to remove pledges against weapons and surveillance and that the Pentagon announced in December 2025 that Gemini was being provided on its GenAI.mil platform.
DOJ releases details alleged talented hacker working for Jeffrey Epstein

securityaffairs.com · 6 months ago

An FBI informant reported in 2017 that Jeffrey Epstein had a personal hacker, according to a Department of Justice document released as part of the Epstein Files on January 31, 2026. The informant described the individual as an Italian from Calabria who developed zero-day exploits for iOS, BlackBerry, and Firefox, created offensive cyber tools, and sold them to several countries while allegedly accepting a trunk of cash from Hezbollah for a zero-day. The document further alleges the person sold his company to CrowdStrike in fall 2017 and later became a vice president there, maintained ties with European hackers, helped establish a Saudi government cyber surveillance program, and laundered proceeds through a California theater company.
OpenAI says you can trust ChatGPT answers, as it kicks off ads rollout preparation

www.bleepingcomputer.com · 6 months ago

OpenAI is beginning an ads rollout for ChatGPT, with early signs appearing on Android and tests covering free and eight dollar ChatGPT Go accounts. Ads are shown as clearly labeled Sponsored blocks beneath answers, and OpenAI says ads will not change ChatGPT answers, conversations will not be shared with advertisers, and users can hide or report ads or ask ChatGPT why an ad was shown. An Ads controls settings page allows deleting ad related data without affecting chats and toggling ad personalization on or off, while Plus, Pro, Business, and Enterprise subscribers will not see ads, though the current conversation may still influence which sponsored ad appears.
OpenAI is retiring famous GPT-4o model, says GPT 5.2 is good enough

www.bleepingcomputer.com · 6 months ago

OpenAI will retire GPT-4o and several other models including GPT-5 Instant, GPT-5 Thinking, GPT-4.1, GPT-4.1 mini, and o4-mini on February 13, 2026. The move follows the rollout of GPT-5.2, which the company says has met expectations and become the dominant model while only 0.1 percent of users still choose GPT-4o each day. OpenAI said there are no changes to the API at this time and highlighted new personalization and Personality features intended to reproduce GPT-4o's conversational style.
The Tech Arsenal That ICE Has Deployed in Minneapolis

www.nytimes.com · 6 months ago

There is use of facial recognition, social media monitoring and other technological tools by agents to identify undocumented immigrants and to track protesters, according to current and former officials. The systems rely on commercial databases and software from private firms including Palantir to process tips, match biometrics and aggregate social media and location data. Civil liberties groups and some officials warn the expanded deployment reaches beyond traditional immigration enforcement and risks misidentification, warrantless surveillance of U.S. citizens and chilling of protest activity.
U.S. convicts ex-Google engineer for sending AI tech data to China

www.bleepingcomputer.com · 6 months ago

A U.S. federal jury convicted Linwei Ding, a former Google software engineer, on seven counts of economic espionage and seven counts of trade secret theft after finding that between May 2022 and April 2023 he stole more than two thousand pages of confidential AI supercomputing materials and uploaded them to his personal cloud account. The stolen materials included details about Google s AI super computing infrastructure, proprietary TPU and GPU system technologies, orchestration software for large scale AI workloads, and SmartNIC networking technology, and evidence showed he secretly affiliated with China based companies, negotiated a chief technology officer role, and later founded an AI company in Shanghai. Prosecutors say he sought to aid entities linked to the People s Republic of China and applied to a Shanghai government talent program; he was indicted in March 2024, convicted after an eleven day trial in San Francisco, and faces maximum prison terms of ten to fifteen years per count with sentencing pending.
Top 10 Best DNS Filtering Solutions 2026

gbhackers.com · 6 months ago

With the traditional network perimeter gone, DNS filtering combined with Secure Access Service Edge is presented as the most effective control plane to stop ransomware command-and-control callbacks and AI driven phishing before connections are established. A ranked list of ten leading DNS filtering and SASE solutions for 2026 emphasizes millisecond latency, rapid AI driven domain categorization, and support for modern protocols such as DNS over HTTPS and DNS over QUIC, with top vendors including Check Point Harmony SASE, Cloudflare Gateway, WebTitan, Cisco Umbrella, NextDNS, Zscaler ZIA, DNSFilter, Quad9, SafeDNS, and Control D. The selection methodology prioritizes active defense, API integration, real world speed, false positive accuracy, and deep enterprise integrations like SD WAN and endpoint clients.
Best E-Signature Solutions For Secure Digital Signing In 2026

gbhackers.com · 6 months ago

Secure electronic signatures are essential in 2026 as organizations face rising risks of document fraud, identity theft, and regulatory violations. E signature platforms should provide strong encryption, multi factor authentication, tamper resistant audit trails, regulatory support, secure integrations, and mobile safe remote signing. Leading solutions evaluated for cybersecurity and suitability include Adobe Sign, Signeasy, OneSpan Sign, PandaDoc, Dropbox Sign, Sertifi, DocuSign, HelloSign, and SignNow, each with trade offs around usability, compliance capabilities, and cost. Organizations are advised to define compliance requirements, evaluate encryption and authentication, check integrations, balance usability with security, and plan for scalability when selecting an e signature platform.
Cloud storage payment scam floods inboxes with fake renewals

www.bleepingcomputer.com · 6 months ago

A large scale cloud storage subscription scam campaign is targeting users worldwide with repeated emails falsely warning that photos, files, and accounts will be blocked or deleted due to an alleged payment failure. The messages come from many randomized domains and use personalized, urgent subject lines, with links that rely on Google Cloud Storage as a redirector to phishing pages impersonating cloud service portals. Phishing sites perform fake storage scans, claim users are eligible for heavy discounts, and then redirect victims to affiliate checkout pages that harvest credit card details while promoting unrelated products. Recipients are advised to delete these emails without clicking links and to verify any billing concerns only by logging into official cloud service websites, since legitimate providers typically restrict extra storage rather than instantly deleting files.
StopLamers Investigation: From IRC Wars to Android Backdoors

datapeice.me · 6 months ago

There is an investigation that traces a group evolving from IRC conflicts into creators of destructive Android backdoors and malware. Analysts found custom ROM images containing scripts that use the dd utility to wipe modem and bootloader partitions, effectively bricking targeted devices. The actors also employ a technique called L Obfuscation that leverages dynamic getattr and eval calls in Python to hinder analysis.
Mandiant details how ShinyHunters abuse SSO to steal cloud data

www.bleepingcomputer.com · 6 months ago

There is a wave of ShinyHunters-branded SaaS data theft that uses targeted voice phishing and company-branded credential harvesting sites to capture single sign-on credentials and multi-factor authentication codes, allowing attackers to access centralized SSO dashboards for Okta, Microsoft Entra, and Google. Attackers impersonate corporate IT or helpdesk staff, call employees to trigger MFA prompts while guiding them through phishing sites, then enroll their own MFA devices and use the SSO dashboard to access cloud apps such as Salesforce, Microsoft 365, SharePoint, DocuSign, Slack, Dropbox, and Google Drive to steal data. Google Threat Intelligence Group and Mandiant are tracking the activity across clusters UNC6661, UNC6671, and UNC6240, noting differences in domain registration patterns and extortion behavior, and that the group has posted alleged stolen data to a data leak site. Mandiant and GTIG recommend hardening identity workflows, moving to phishing resistant MFA such as FIDO2 or passkeys, improving logging and detections for rapid SSO exfiltration, PowerShell user agent activity, unexpected OAuth authorizations, and deleted MFA notification emails, and have published hardening guides and detection rules.
eScan Antivirus Delivers Malware in Supply Chain Attack

www.securityweek.com · 6 months ago

Hackers compromised a MicroWorld Technologies update server and distributed malicious updates to eScan customers, delivering a Reload dot exe file that initiated a multi stage infection. Reload dot exe modified the HOSTS file to block automatic updates, established persistence through scheduled tasks, and downloaded additional payloads, making automatic remediation impossible. Morphisec reported the activity on January 29 and said it notified MicroWorld on January 21 after detecting the behavior, while eScan says it detected unauthorized access on January 20, isolated affected update servers for over eight hours, and released a cleanup utility available via technical support. eScan disputes Morphisec's characterization of the incident and is working with legal counsel but acknowledges the unauthorized access impacted a regional update server and had medium high impact on enterprise customers.
Researcher reveals evidence of private Instagram profiles leaking photos

www.bleepingcomputer.com · 6 months ago

A security researcher disclosed that some Instagram private profiles returned links to private photos embedded in the HTML response body, allowing unauthenticated visitors on certain mobile devices to see references to media that should have been restricted. In tests limited to private accounts the researcher reported that at least twenty eight percent of profiles returned links and published a proof of concept showing the polaristimelineconnection JSON containing encoded CDN links. The researcher said he reported the issue to Meta on October twelfth, two thousand twenty five, the behavior stopped around October sixteenth, and Meta closed the report as not applicable while declining to provide a root cause analysis.
Iran-Linked RedKitten Cyber Campaign Targets Human Rights NGOs and Activists

thehackernews.com · 6 months ago

Security researchers observed in January 2026 an operation codenamed RedKitten attributed to a Farsi speaking actor aligned with Iranian state interests that targets non governmental organizations and individuals documenting recent human rights abuses. The campaign begins with a Farsi named seven zip archive containing macro laden Excel spreadsheets that lure targets with purported lists of protesters and use malicious VBA macros to drop a C sharp implant named AppVStreamingUXMultiUser.dll via AppDomainManager injection, with the VBA showing signs of being generated by a large language model. The backdoor called SloppyMIO uses GitHub and Google Drive as dead drop resolvers, extracts configuration steganographically from images, retrieves modular payloads and uses the Telegram Bot API for command and control to run commands, collect and exfiltrate files, and persist via scheduled tasks. Separate phishing activity serving fake WhatsApp Web and Gmail login pages harvests credentials and two factor authentication codes and requests camera microphone and location permissions to enable surveillance, with about fifty victims identified across Kurdish communities, academics, government officials and business leaders.
Some of the most coveted jobs in America aren’t safe anymore

www.washingtonpost.com · 6 months ago

Tech workers continue to lose their jobs in droves even as the U.S. economy shows signs of growth. There were major cuts this week including Amazon cutting 16,000 roles, Pinterest announcing plans to cut 15 percent of staff, and large reductions at Meta and Microsoft, with Microsoft cutting about 15,000 jobs last year. Companies point to AI forward strategies, restructuring and efficiency drives while investing heavily in AI infrastructure, which is reducing hiring even as employers tout productivity gains. The result is longer job searches and heightened anxiety among workers, with average weeks unemployed rising to 24.4 in December and the unemployment rate near historic lows at 4.4 percent, leaving junior and younger entrants especially vulnerable.
FBI takes notorious RAMP ransomware forum offline

www.bitdefender.com · 6 months ago

The FBI has seized control of RAMP, a Russian language cybercrime forum that promoted ransomware, and the site now displays an FBI seizure notice while its nameservers have been redirected to FBI controlled servers. The seizure was carried out in collaboration with the US Attorney’s Office for the Southern District of Florida and the Justice Department’s Computer Crime and Intellectual Property Section. RAMP, active since mid 2021 and boasting over 14,000 users, served as a marketplace for ransomware operators, initial access brokers, stolen data and tools, and was used by groups such as ALPHV also known as BlackCat, Qilin, DragonForce and RansomHub. Authorities are likely to now have access to user data including email addresses, IP addresses and private messages which could lead to arrests, and the action represents a meaningful disruption of criminal infrastructure though it will not eliminate ransomware activity.
Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms

thehackernews.com · 6 months ago

Mandiant found an expansion in threat activity that uses advanced voice phishing and fake credential harvesting sites to collect single sign on credentials and multi factor authentication codes to breach cloud based software as a service platforms for data theft and extortion. Activity tracked as UNC6661, UNC6671, and UNC6240 in January 2026 shows operators impersonating IT staff to trick employees into updating MFA, registering attacker devices, and in some cases gaining access to Okta accounts and downloading data from SharePoint and OneDrive using PowerShell, followed by follow on phishing and harassment. Recommended mitigations include strengthening help desk identity verification with live video calls, removing SMS and phone calls as authentication methods in favor of phishing resistant options like FIDO2 security keys or passkeys, restricting management plane access and trusted egress points, and logging and monitoring MFA enrollment and unusual identity events.
SCADA Flaw Enables DoS Condition, Impacting Availability of Affected Systems

gbhackers.com · 6 months ago

A vulnerability in the Mitsubishi Electric Iconics Suite used across automotive, energy, and manufacturing sectors enables attackers to trigger denial of service conditions by exploiting privileged file system operations in the AlarmWorX64 MMX Pager Agent. The flaw, tracked as CVE-2025-0921 with a CVSS score of 6.5, allows a local nonadministrative user to change the SMSLogFile configuration and create symbolic links that redirect logging to critical Windows drivers such as cng.sys, corrupting them and causing boot failures and persistent DoS. The issue is amplified when combined with CVE-2024-7587, which grants excessive permissions to the ProgramData ICONICS directory and lets nonadministrative users modify configuration files. Mitsubishi Electric has published a security advisory and organizations running Iconics Suite version 10.97.2 and earlier are urged to apply vendor workarounds and patches immediately.