Blahalla

Not a Kids Game: From Roblox Mod to Compromising Your Company

www.bleepingcomputer.com · 6 months ago

There is a growing trend of infostealer malware concealed in seemingly harmless game mods and cheat downloads for platforms like Roblox, and an analysis found that over forty percent of infostealer infections originate from gaming related files. After a user runs a malicious installer, stealers such as Lumma, RedLine, Vidar, Raccoon and Exodus can harvest saved browser passwords, session cookies, OAuth and Discord tokens, VPN and single sign on credentials, SSH keys and other secrets in seconds and package them into stealer logs that are sold on Telegram channels, marketplaces and criminal SaaS panels. Because those logs can include session tokens that bypass multi factor authentication and corporate credentials, a family computer compromise from a downloaded mod can turn into an enterprise breach without exploiting a software vulnerability, and threat actors regularly offer stealer access and logs for sale in underground markets.
LLMs Hijacked, Monetized in ‘Operation Bizarre Bazaar’

www.securityweek.com · 6 months ago

There is an LLMjacking operation called Operation Bizarre Bazaar that scans for and hijacks exposed LLM and MCP endpoints to monetize access, resell API access, exfiltrate data, and move laterally into internal systems. The campaign focuses on self hosted LLM infrastructure such as Ollama on port 11434, OpenAI compatible APIs on port 8000, exposed MCP servers, and public development and staging environments, and uses three components: a scanner, a validator tied to silver.inc, and a marketplace called The Unified LLM API Gateway that offers access to more than 30 models and accepts cryptocurrency and PayPal. Researchers observed over 35,000 attack sessions averaging about 972 attacks per day and attribute the operation to an actor using the monikers Hecker, Sakuya, and LiveGamer101, while a separate reconnaissance campaign focused on MCP servers accounted for about 60 percent of late January attack traffic. Recommended defenses include rate limiting, usage caps, behavioral monitoring, verifying that internal services are not publicly accessible, and regular external attack surface scanning.
Aisuru botnet sets new record with 31.4 Tbps DDoS attack

www.bleepingcomputer.com · 6 months ago

The Aisuru Kimwolf botnet launched a massive distributed denial of service attack that peaked at 31.4 terabits per second and around 200 million requests per second. Cloudflare detected and mitigated the campaign on December 19, 2025, naming it The Night Before Christmas and saying it targeted multiple companies, primarily telecommunications providers and IT organizations. Most attacks lasted one to two minutes, many of the attack sources were compromised Android televisions, and the mitigations were performed automatically without triggering internal alerts. The operation sets a new publicly disclosed record, exceeding Aisuru's prior observed peak of 29.7 terabits per second and occurring amid a sharp increase in large scale DDoS activity during 2025.
N8n Vulnerabilities Could Lead to Remote Code Execution

www.securityweek.com · 6 months ago

There are two vulnerabilities in the n8n AI workflow automation platform's sandbox mechanism that can be exploited via weaknesses in Abstract Syntax Tree sanitization to achieve remote code execution. The issues are tracked as CVE-2026-1470 with a CVSS score of 9.9 affecting the JavaScript expression evaluation engine and enabling arbitrary JavaScript execution, and CVE-2026-0863 with a CVSS score of 8.5 affecting the Python code execution flow in the Code node and allowing subprocess execution on the main node when running in Internal configuration. Both vulnerabilities allow attackers to bypass AST based sandbox protections and fully compromise n8n instances, and they were patched in n8n versions 1.123.17, 2.4.5 and 2.5.1 for CVE-2026-1470 and in versions 1.123.14, 2.3.5 and 2.4.2 for CVE-2026-0863.
New Microsoft Teams feature will let you report suspicious calls

www.bleepingcomputer.com · 6 months ago

false
Latvia says Russia remains its top cyber threat as attacks hit record high

therecord.media · 6 months ago

Latvia's national security service reported that 2025 saw an all time high in registered cyber threats against the country, with activity rising well above levels seen before Russia's 2022 invasion of Ukraine. Most incidents were linked to cybercrime and digital fraud and rarely caused direct disruption to critical infrastructure or national security, though serious cases included intrusion attempts, malware distribution, equipment compromise, and distributed denial of service attacks. Russia was identified as the primary source of cyber risk, driven by Moscow's strategic objectives and Latvia's political, military, and material support for Ukraine, and Russian linked hacktivist groups have targeted industrial control systems and public institutions. The report warned that operational technology systems for energy, water, and transport are increasingly at risk and cautioned that hostile Russian activity is likely to continue into 2026 and beyond.
Identitäten im Fokus von Cyberkriminellen

www.csoonline.com · 6 months ago

Eye Securitys State of Incident Response Report 2026 finds attackers increasingly target digital identities, with many intrusions going unnoticed and causing damage within minutes; 97 percent of identity-based incidents involve passwords and misuse of legitimate accounts fuels cloud breaches and the market for initial access brokers. Business email compromise accounts for more than 70 percent of incidents, with phishing as the initial vector in 40 percent and many BEC intrusions remaining undetected for weeks, while ransomware remains a major threat enabled by Ransomware as a Service, builder leaks, and access broker marketplaces. The report also highlights the commercialization of insider knowledge with groups recruiting employees to buy credentials and identifies industry, construction, and transport and logistics as particularly affected based on analysis of 630 European incidents from 2023 to 2025.
Notorious Russia-based RAMP cybercrime forum apparently seized by FBI

therecord.media · 6 months ago

On January 29, 2026, websites for the RAMP cybercrime forum were replaced with a splash page declaring they had been seized by the FBI. The Department of Justice has not issued a public statement and questions were raised about the authenticity after DNS records reportedly showed RAMP redirecting to an FBI domain and the seizure notice cited coordination with the United States Attorney for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice. RAMP was widely used by Russian, Chinese and English speaking cybercriminals, especially ransomware groups and initial access brokers, and administrators included Mikhail Matveev and a user known as Stallman who said law enforcement had taken control and that they would continue criminal activity by purchasing access to victim networks.
France fines unemployment agency €5 million over data breach

www.bleepingcomputer.com · 6 months ago

France's data protection authority fined the national employment agency France Travail five million euros for failing to secure job seekers data after a breach that allowed attackers to steal personal information for up to 43 million people. The incident, disclosed in March 2024 and spanning about 20 years of records, exposed names, dates of birth, national insurance numbers, email and home addresses, and phone numbers, but did not include bank details or account passwords. Investigators say attackers used social engineering to hijack accounts of CAP EMPLOI advisers, and the authority ordered France Travail to document corrective measures and face daily penalties of five thousand euros for noncompliance. France Travail had previously suffered a separate breach in August 2023 affecting about ten million people and exposing full names and social security numbers.
Open Directory Exposure Leaks BYOB Framework Across Windows, Linux, and macOS

gbhackers.com · 6 months ago

Researchers have identified vulnerabilities in Ivanti Connect Secure and Policy Secure gateways, allowing for remote code execution. The flaws stem from improper sanitization of user inputs, potentially enabling unauthorized access and control of affected systems. Successful exploitation requires an authenticated administrator account. These vulnerabilities are tracked as CVE-2023-42404, CVE-2023-42405, CVE-2023-42406, CVE-2023-42407, and CVE-2023-42408.
SolarWinds Patches Critical Web Help Desk Vulnerabilities

www.securityweek.com · 6 months ago

SolarWinds released patches for six vulnerabilities in Web Help Desk, including four critical flaws that can be exploited without authentication for remote code execution or authentication bypass. The critical CVEs are CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554, each rated 9.8, with CVE-2025-40551 and CVE-2025-40553 described as untrusted data deserialization issues leading to unauthenticated RCE and CVE-2025-40552 and CVE-2025-40554 enabling authentication bypass that may lead to RCE. Two additional high severity flaws were fixed, CVE-2025-40536 which allows CSRF token and parameter validation bypass that can be used to create an AjaxProxy instance and enable CVE-2025-40551, and CVE-2025-40537 which involves a hardcoded default client account that can lead to privilege escalation, and organizations are advised to update to Web Help Desk version 2026.1 immediately.
Notorious Russia-based RAMP cybercrime forum apparently seized by FBI

therecord.media · 6 months ago

U.S. law enforcement seized the RAMP cybercrime forum on January 28, 2026, replacing both its clearnet and Tor sites with Federal Bureau of Investigation and Department of Justice seizure notices and updating the domains nameservers to indicate federal control. The action was executed in coordination with the United States Attorney's Office for the Southern District of Florida and the DOJ Computer Crime and Intellectual Property Section, and an alleged operator known as Stallman acknowledged that law enforcement had gained control, raising the likelihood that backend user and transaction data is now in investigators hands.
ThreatsDay Bulletin: New RCEs, Darknet Busts, Kernel Bugs & 25+ More Stories

thehackernews.com · 6 months ago

This week's bulletin warns of steady pressure across multiple fronts as familiar tools are repurposed to exploit trusted platforms and small changes create accumulative security risks. The FBI seized the RAMP cybercrime forum, driving actors to alternative underground spaces, and threat actors have been abusing trusted cloud domains to deliver the legitimate GoTo Resolve remote access tool as part of phishing campaigns. More than 20 vulnerabilities in Dormakaba access control systems, tracked as CVE-2025-59090 through CVE-2025-59109, could allow attackers to open doors and reconfigure controllers, and an integer overflow in the Linux kernel tracked as CVE-2018-14634 was added to CISA's Known Exploited Vulnerabilities list with federal patching required.
Microsoft Previews Windows 11 Update With Smarter AI and Phone Continuity

www.techrepublic.com · 6 months ago

false
Critical RCE bugs expose the n8n automation platform to host‑level compromise

www.csoonline.com · 6 months ago

There are two critical sandbox escape flaws in the n8n workflow automation platform that allow authenticated users to escape containment and execute arbitrary code on affected hosts. One flaw in the JavaScript expression engine is tracked as CVE-2026-1470 with a CVSS score of 9.9 and enables attackers to bypass AST based sandboxing via a with statement edge case to run arbitrary JavaScript, and the other affects the Python Code node in Internal execution mode as CVE-2026-0863 with a CVSS score of 8.5 enabling Python sandbox escape. Both issues have been patched in specific releases CVE-2026-1470 in versions 1.123.17, 2.4.5, and 2.5.1 and CVE-2026-0863 in versions 1.123.14, 2.3.5, and 2.4.2, and operators are urged to upgrade immediately and restrict who can create or edit workflows where n8n has access to internal networks, secrets, or privileged APIs.
BlackIce Introduced as Container-Based Red Teaming Toolkit for AI Security Testing

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can exploit to bypass Android's hardware-backed key storage. These techniques involve manipulating the on-screen display and utilizing accessibility services to extract encryption keys. Successful exploitation could allow unauthorized access to user data protected by these keys. The vulnerabilities affect numerous devices and have been assigned CVE identifiers CVE-2023-34599, CVE-2023-34600, and CVE-2023-34601.
Swarmer Tool Abuses Windows Registry to Evade Detection and Persist on Systems

gbhackers.com · 6 months ago

Swarmer is a tool that constructs and injects malicious HKCU registry hives by converting modified registry exports into binary NTUSER.MAN mandatory profile files and by using the legacy Offline Registry Library Offreg.dll to avoid triggering endpoint detection systems that monitor common registry APIs such as RegCreateKey and RegSetValue. Its operational workflow exports a target user HKCU registry, injects persistence entries, then converts the modified export into a binary hive using RegLoadAppKeyW and Offreg functions so that Process Monitor and ETW logging remain blank, and it can be run entirely offline or integrated into command and control via BOF output parsing. Defenders are advised to monitor for unexpected NTUSER.MAN creation in user profile directories, flag Offreg.dll loading by processes without legitimate offline registry needs, inventory mandatory profile usage, and enforce strict controls over profile directory permissions.
Cyber Insights 2026: Zero Trust and Following the Path

www.securityweek.com · 6 months ago

false
Google rolls out Android theft protection feature updates

www.bleepingcomputer.com · 6 months ago

false
Survey of 100+ Energy Systems Reveals Critical OT Cybersecurity Gaps

thehackernews.com · 6 months ago

There are widespread cybersecurity gaps in operational technology networks at substations, power plants, and control centers worldwide, identified through passive IDS deployments across more than 100 installations. Common technical findings include unpatched PAC devices with known vulnerabilities such as CVE-2015-5374, undocumented external TCP IP connections, unnecessary insecure services, weak network segmentation, and unexpected devices that create asset blind spots. Organizational weaknesses compounding these risks include unclear responsibilities for OT security, limited resources, and siloed IT and OT teams. Assessments also uncovered operational problems that affect availability and can amplify cyber incidents, including VLAN misconfigurations, RTU and SCD mismatches, time synchronization errors, and network redundancy issues.
CISA chief uploaded sensitive government files to public ChatGPT

www.csoonline.com · 6 months ago

Madhu Gottumukkala, who has led the US Cybersecurity and Infrastructure Security Agency since May 2025, uploaded at least four documents marked for official use only to the public version of ChatGPT between mid July 2025 and early August 2025, exposing contracting information not intended for public release. Cybersecurity sensors generated multiple alerts in early August 2025, and the uploads occurred despite a temporary authorized exception that Gottumukkala had requested after joining CISA while the public tool remained blocked for most Department of Homeland Security employees. Because data entered into the public ChatGPT can be retained on provider servers and potentially used in model training, the incident highlights failures in AI governance, exception handling for senior officials, and the risk of losing control over sensitive but unclassified information. An internal DHS assessment involving senior department and CISA officials was launched and the outcome has not been disclosed, and the episode has raised reputational and accountability questions for CISA leadership amid other controversies during Gottumukkala's tenure.
Google Disrupts IPIDEA Proxy Network

www.securityweek.com · 6 months ago

Google disrupted IPIDEA, one of the largest residential proxy networks, after finding operators had embedded SDKs and proxy software in mobile and desktop applications to secretly enroll user devices as exit nodes. The investigation linked Castar SDK, Earn SDK, Hex SDK, and Packet SDK to a two tier infrastructure that relied on roughly 7,400 tier two servers, identified more than 600 Android apps and 3,075 unique Windows PE files, and controlled over a dozen proxy and VPN brands including Galleon VPN, Radish VPN, and Aman VPN. The disruption combined legal seizures of command and marketing domains, Google Play Protect policy changes, and partner coordination with firms such as Spur, Lumen Black Lotus Labs, and Cloudflare to degrade the network and reduce the available pool of devices for operators by millions, with potential downstream impact across reseller networks.
Fake “Mac Cleaner” Campaign Uses Google Ads to Redirect Users to Malware

gbhackers.com · 6 months ago

Cybercriminals are exploiting Google Search Ads to distribute malware by serving deceptive landing pages that impersonate Apple's official website and redirecting users to Google Apps Script pages styled with Apple branding. The Apps Script pages host obfuscated payloads that decode Base64 strings and execute shell commands using bash and curl to silently download and run remote scripts, enabling remote code execution that can install malware, steal SSH keys, add persistent backdoors, deploy cryptocurrency miners, or exfiltrate files. Investigators say the ads stem from apparently compromised Google Ads accounts that bypass verification, and they advise avoiding sponsored results for system maintenance and verifying tools through official Apple support channels.
One-click RCE on Clawd/Moltbot in 2 hours with an AI Hacking Agent

ethiack.com · 6 months ago

An autonomous pentesting agent named Hackian demonstrated a one click account takeover that led to remote code execution against Clawdbot, now called Moltbot, in about one hour and forty minutes. The exploit abuses a gatewayUrl query parameter to force the application to connect to an attacker controlled WebSocket, exfiltrate the Gateway Control UI token from the victim browser, and use that token to authenticate and issue arbitrary commands, and the gateway fails to validate WebSocket origin which enables pivoting to local instances. The vulnerability was reported on January 26, 2026 and patched in the main branch on January 28, 2026.
3 Decisions CISOs Need to Make to Prevent Downtime Risk in 2026

thehackernews.com · 6 months ago

There are three strategic decisions CISOs should take in 2026 to reduce operational downtime risk: prioritize threat intelligence focused on current business risks, shield analysts from false positives, and shorten the gap between detection and response. Actionable, continuously refreshed STIX slash TAXII threat feeds sourced from active investigations are reported to expand threat coverage and detect up to fifty eight percent more threats while reducing Tier one to Tier two escalations by thirty percent. Enriching alerts with behavioral context from sandbox analyses is reported to shorten mean time to respond by twenty one minutes and help maintain operational continuity by accelerating investigations.
The powerful tools in ICE’s arsenal to track suspects — and protesters

www.washingtonpost.com · 6 months ago

There are newly expanded surveillance powers for Immigration and Customs Enforcement tied to a recent funding increase that have enabled purchases of biometric trackers, cellphone location databases, spyware and drones and relaxed some usage restrictions. There are specific tools in use including facial recognition systems such as NEC Mobile Fortify, Clearview AI and BI2 iris scanning; license plate readers and Thomson Reuters plate databases and Flock Safety access via police partners; cell site simulators from L3Harris; commercial phone location services like Penlink; digital forensics and phone hacking tools from Paragon Solutions, Cellebrite and Finaldata; and drones from Skydio and General Atomics. There are reports that ICE has used these capabilities to track undocumented immigrants and to monitor anti-ICE protesters including U.S. citizens, that the Department of Homeland Security has broadened the agency’s operational scope for facial recognition and AI, and that lawmakers and civil rights groups warn the practices raise privacy and free speech concerns and have at times flouted warrant requirements.
Lawsuit claims WhatsApp has a gaping security hole. Experts doubt it.

www.washingtonpost.com · 6 months ago

A lawsuit filed in California by Quinn Emanuel on behalf of seven WhatsApp users alleges company staff can request and view a specific user’s private WhatsApp messages as well as their Instagram and Facebook posts. WhatsApp denies the claims, called the suit frivolous, threatened sanctions against the law firm, and said the case appears tied to Quinn Emanuel attorneys joining NSO Group’s appeal after a jury in May 2025 entered a 167 million dollar judgment against NSO over Pegasus spyware. Security experts said the complaint lacks technical detail, noted WhatsApp uses end to end encryption that normally prevents access to message contents, and described the allegations as implausible. The suit seeks class action status for users worldwide but excludes U.S. and Canadian users who would be required to enter arbitration, and experts warned the case could harm WhatsApp’s credibility and create financial risk for Meta if the allegations were proven.
ShinyHunters Claims 14M Panera Bread Records Exposed in Data Breach

www.techrepublic.com · 6 months ago

There are claims that the ShinyHunters group exfiltrated roughly 14 million Panera Bread customer records totaling about 760 megabytes of compressed data and containing names, email addresses, postal addresses, phone numbers, and account related details, with no indication that payment card data or passwords were included. The group says it gained access through Microsoft Entra single sign on, reflecting a broader wave of attacks that use social engineering and voice phishing to target identity and access management platforms. Security experts warn that exposed contact data can enable phishing, identity fraud, and account takeover and recommend consumers be wary of unsolicited messages while organizations strengthen authentication, employee training against social engineering, and monitoring of SSO activity.
Gakido - CRLF Injection

rosecurify.com · 6 months ago

A CRLF injection vulnerability tracked as CVE-2026-24489 affects Gakido versions earlier than 0.1.1-1bc6019 and allows attackers to inject arbitrary HTTP headers by including carriage return line feed sequences line feed characters or null bytes in header names or values. The flaw stems from improper sanitization in the header processing logic and the canonicalizeheaders function and can be triggered via Client.get Client.post or other request methods. Impact includes arbitrary header injection HTTP response splitting cache poisoning session fixation and bypassing server side security controls and a proof of concept shows an injected header sent by placing CRLF in a User Agent header. Vendor HappyHackingSpace released a fix in release v0.1.1-1bc6019 and the issue was reported on January 25 2026 and published on January 27 2026.
Reports of GDPR violations have risen sharply

www.csoonline.com · 6 months ago

The average number of daily reports of GDPR violations rose above 400 to 443 in 2025, a 22 percent increase over the prior year. Total fines for the year were around €1.2 billion, bringing cumulative GDPR fines since 2018 to about €7.1 billion, with Ireland accounting for €4.04 billion of that total. Major individual penalties include a €1.2 billion fine against Meta Platforms Ireland and a €530 million fine against TikTok in April 2025. The causes of the rise are not definitive, but geopolitical tensions, new technologies available to cyber threat actors, and new laws mandating incident reporting are cited as likely contributing factors.
EU’s answer to CVE solves dependency issue, adds fragmentation risks

www.csoonline.com · 6 months ago

An EU hosted vulnerability database called GCVE dot EU aggregates advisories from more than 25 public sources into a normalized, cross referenced resource hosted by CIRCL and co funded by the EU FETTA project. The platform aims to reduce dependence on the US led CVE and NVD system after a recent funding scare, but experts warn that without enforceable interoperability, automated cross mapping standards, and strong governance it could fragment security intelligence and create duplicate tracking and triage overhead for security teams. GCVE already implements automated and human curated cross referencing and is operational, but its long term value depends on federated identifier allocation, clear coordinated disclosure processes, and integration with enterprise security tools to deliver a single actionable truth for defenders.
Kritik am Kritis-Dachgesetz: “Flickenteppich” befürchtet

www.csoonline.com · 6 months ago

There is widespread criticism that the federal draft law to protect critical infrastructure sets an excessively high threshold of 500,000 people, leaving many medium sized energy, transport and municipal facilities without mandatory crisis plans, incident reporting and security obligations. The German Städtetag and other industry and political figures are urging the threshold be lowered to about 150,000 people and warn that leaving further designations to the states will create a patchwork of rules instead of a uniform national standard. After a suspected politically motivated arson attack that left tens of thousands in southwest Berlin without power and heating, the draft includes access restrictions, mandatory notification of security incidents and fines, and an amendment calls for removing publicly available infrastructure data to reduce attacker intelligence, but critics say the measures still fall short of current security needs.
SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass

thehackernews.com · 6 months ago

SolarWinds released security updates for Web Help Desk to address multiple vulnerabilities, including four critical flaws that can lead to authentication bypass and remote code execution. The affected CVEs are CVE-2025-40536 a security control bypass, CVE-2025-40537 hard coded credentials allowing administrative access via the client account, CVE-2025-40551 and CVE-2025-40553 untrusted data deserialization issues enabling unauthenticated remote code execution, and CVE-2025-40552 and CVE-2025-40554 authentication bypasses that could also be leveraged to achieve remote code execution. Researchers at Horizon3.ai and watchTowr reported the issues, SolarWinds addressed them in WHD 2026.1, and prior Web Help Desk flaws include CVE-2024-28986, CVE-2024-28987, CVE-2024-28988 and CVE-2025-26399 with two of the earlier flaws added to the U.S. known exploited vulnerabilities catalog.
eScan Antivirus Update Server Breached to Deliver Malicious Software Updates

gbhackers.com · 6 months ago

There was a supply chain attack on January 20, 2026 that compromised MicroWorld Technologies eScan update infrastructure and distributed multi stage malware to enterprise and consumer endpoints worldwide. The compromise replaced Reload.exe with a trojanized component that drops a 64 bit persistent downloader named CONSCTLX.exe, establishes persistence via scheduled tasks under C colon backslash Windows backslash Defrag with names like CorelDefrag, and tampers with hosts files and eScan registry settings to disable updates and block security communications, with Reload.exe SHA256 36ef2ec9ada035c56644f677dab65946798575e1d8b14f1365f22d7c68269860 and CONSCTLX.exe SHA256 bec369597633eac7cc27a698288e4ae8d12bdd9b01946e73a28e1423b17252b1. eScan isolated the affected infrastructure within one hour and took its global update system offline for over eight hours, released patches but noted systems require manual intervention, and defenders are advised to search for the Reload.exe hash and related VirusTotal samples, inspect HKLM software for GUID named keys, review Windows Defrag scheduled tasks and hosts files, and block the identified command and control domains and IP 185.241.208.115.
Researchers Uncover Semantic Chaining Attack That Defeats Grok 4, Gemini AI Safeguards

gbhackers.com · 6 months ago

Security researchers have identified a jailbreak technique called Semantic Chaining that bypasses safety filters in leading multimodal AI models including Grok 4 and Gemini Nano Banana Pro. The technique uses a four stage progression that establishes a safe base, introduces minor substitutions, performs a critical pivot replacing elements with sensitive content, and then extracts the output as an image to evade text based detectors. The exploit takes advantage of fragmented safety architectures that lack cross prompt contextual awareness so harmful intent can be distributed across innocuous steps and rendered pixel by pixel into images that keyword scanners miss. Researchers demonstrate real world bypass patterns described as historical substitution, educational blueprints, and artistic narratives and recommend adding governance layers and real time latent intent monitoring beyond surface prompt scanning.
Weaponized VS Code Extension “ClawdBot Agent” Spreads ScreenConnect RAT

gbhackers.com · 6 months ago

A malicious Visual Studio Code extension named ClawdBot Agent, first seen on January 27, 2026, posed as an AI coding assistant while secretly installing a fully functional remote access tool that leverages a trojanized ConnectWise ScreenConnect client for stealthy remote control. The extension activates at VS Code startup, fetches a remote configuration from a command and control server, and silently downloads additional binaries including a DLL sideloading loader and a cloud hosted installer to provide multiple fallback delivery paths. Recommended actions are to immediately remove the extension, uninstall any ScreenConnect client and stop related services, investigate unexpected Code processes and persistence mechanisms, block attacker infrastructure at the network perimeter, rotate any API keys entered into the extension, run full antivirus scans, and treat affected systems as fully compromised.
Zoom and Microsoft Teams Lose French Government Trust After Security Review

gbhackers.com · 6 months ago

France will eliminate foreign videoconferencing platforms, rejecting Zoom and Microsoft Teams in favor of a domestically controlled solution called Visio, announced January 26, 2026, with full government deployment planned by 2027. Visio is hosted on SecNumCloud labeled infrastructure at Outscale, aligns with ANSSI security standards, integrates French AI tools such as Pyannote and Kyutai for transcription and subtitling, and has a pilot supporting 40,000 regular users while about 200,000 employees transition to the platform. Leading adopters include the CNRS, the French National Health Insurance Fund, the Directorate General of Public Finances, and the Ministry of Armed Forces, and the move is justified by data sovereignty and national security concerns as well as an estimated savings of one million euros per 100,000 migrated users.
PwC and Google Cloud Ink $400 Million Deal to Scale AI-Powered Defense

www.securityweek.com · 6 months ago

false
Python-Based PyRAT Emerges as Cross-Platform Threat With Advanced Remote Access Capabilities

gbhackers.com · 6 months ago

There is a Python based Remote Access Trojan called PyRAT that has been compiled into ELF and PE formats and demonstrates cross platform infection of Windows and Linux with samples observed on VirusTotal and high detection rates across antivirus engines. It fingerprints hosts to create a semi persistent identifier from username and MAC address, communicates with command and control servers using unencrypted HTTP POST requests to an api uid hello endpoint sending plaintext JSON, and implements user space persistence via XDG autostart on Linux and HKCU Run registry entries on Windows. Capabilities include remote command execution with full stdout and stderr capture, bidirectional file transfer via multipart form data, ZIP based bulk exfiltration, screenshot capture, adaptive beaconing with active polling as fast as 0.5 seconds, and a cleanup routine that removes persistence and uses Windows RunOnce for post reboot cleanup. Organizations are advised to deploy network based threat detection, perform regular endpoint security audits, and keep security solutions updated to detect Python compiled malware variants.
Google Disrupts IPIDEA — One of the World’s Largest Residential Proxy Networks

thehackernews.com · 6 months ago

Google said it disrupted IPIDEA, a global residential proxy network, by taking legal action to seize dozens of control domains and disable its website, a network that advertised more than 6.1 million daily updated IP addresses and 69,000 daily new IPs. The company said the infrastructure had been leveraged by over 550 distinct threat groups to route malicious traffic, access corporate and SaaS environments, and support botnets and DDoS campaigns, with about 7,400 Tier Two servers in its command and control architecture. Operators enrolled consumer devices as exit nodes through preloaded or trojanized software, including apps bundled on off brand Android TV boxes, and Google identified roughly 3,075 Windows binaries and about 600 Android applications connecting to the network via monetization SDKs. Google updated Google Play Protect to warn users, remove flagged apps on certified devices, and block future installs, while noting enforcement is complicated by opaque ownership and reseller arrangements.
NIST’s AI guidance pushes cybersecurity boundaries

www.csoonline.com · 6 months ago

NIST is shifting from a principle based AI risk management approach toward more operational expectations for agentic AI and on January 8, 2026 issued a Request for Information seeking input on novel risks, security practices, assessment methods, and deployment constraints for systems that take autonomous actions. NIST’s portfolio now spans the AI Risk Management Framework released January 26, 2023, the Center for AI Standards and Innovation for testing and evaluations, a March 2025 adversarial machine learning taxonomy, the Dioptra test platform, the SP 800 218A community profile for secure development of generative models, the PETs Testbed for privacy enhancing technologies, and updated digital identity guidance to address agent identity. Security experts warn that AI behaves probabilistically and can be manipulated indirectly through prompt injection and data poisoning, so CISOs should avoid treating AI as just another application and should prefer concise, implementable checklists to reduce framework fatigue.
Matanbuchus Malware Evolves to Bypass AV Defenses by Swapping Core Components

gbhackers.com · 6 months ago

Matanbuchus is a malicious C plus plus downloader sold as Malware as a Service since 2020 that has evolved from a simple loader into a flexible backdoor platform increasingly tied to ransomware operations. Operators have modularized the malware, swapping core components to bypass antivirus defenses and deliver second stage payloads. Researchers observed version 3.0 in the wild in July 2025 with redesigned components and stronger evasion techniques.
Requesting security review: zero-knowledge one-time secret sharing tool

sharemylogin.com · 6 months ago

A new tool offers secure credential sharing by encrypting data entirely in the browser using AES 256 GCM and deriving keys with PBKDF2 using 250000 iterations so the server never sees plaintext or keys. One time secrets are enforced server side and deleted atomically on first view, and a delete token carried in the fragment identifier enables early destruction. Client side cryptographic code is publicly available on GitHub for review. The developer does not claim protection against compromised endpoints or device level compromise or anonymity from state level actors and is requesting threat model and protocol feedback.
SolarWinds, again: Critical RCE bugs reopen old wounds for enterprise security teams

www.csoonline.com · 6 months ago

SolarWinds disclosed six vulnerabilities in its Web Help Desk product that include four critical flaws enabling authentication bypass and remote command execution and two high severity issues that expose restricted functionality and hardcoded credentials. The vulnerabilities are CVE-2025-40551, CVE-2025-40553, CVE-2025-40552, CVE-2025-40554, CVE-2025-40536, and CVE-2025-40537, with the four critical bugs rated 9.8 and the others rated 7.5 and 8.1. Two critical deserialization flaws, CVE-2025-40551 and CVE-2025-40553, can enable unauthenticated remote command execution while the other critical flaws, CVE-2025-40552 and CVE-2025-40554, allow authentication bypass to invoke protected actions. Administrators are urged to upgrade to Web Help Desk 2026.1, investigate any anomalous activity on affected servers, and apply vendor patches immediately to reduce the risk of weaponized exploits and lateral movement.
Smashing Security podcast #452: The dark web’s worst assassins, and Pegasus in the dock

grahamcluley.com · 6 months ago

A London based YouTuber was awarded damages after his phone was hacked with Pegasus spyware, illustrating how a single seemingly harmless text message can convert a smartphone into round the clock surveillance. Reporting also uncovers dark web services that advertised professional hitmen but appear to have been scams, prompting uncomfortable questions about why such crimes attract customers while producing few complaints. Coverage notes a reported UK court award of 4.1 million dollars in the Pegasus case and references related reporting on stalkerware and state linked surveillance.
Crooks are hijacking and reselling AI infrastructure: Report

www.csoonline.com · 6 months ago

Researchers at Pillar Security warn that criminal campaigns are systematically probing exposed large language model and Model Context Protocol endpoints to steal compute, exfiltrate LLM context data, and resell API access. Honeypots captured about thirty five thousand attack sessions in recent weeks, and investigators have identified two campaigns, including one called Operation Bizarre Bazaar targeting unprotected LLMs and another targeting MCP servers. Attackers use search engines to find misconfigured services such as Ollama and high performance LLM servers, validate targets, and sell discounted access through a criminal marketplace hosted in the Netherlands. Recommended mitigations include enabling authentication and rate limiting on all LLM endpoints, auditing and firewalling MCP servers and development environments, blocking known malicious network ranges, and auditing production chatbots to prevent unauthorized use and lateral pivots.
SVD-2026-0101: Third-Party Package Update in Splunk Enterprise - MongoDB CVE-2025-14847

advisory.splunk.com · 6 months ago

There is a Medium severity vulnerability identified as CVE-2025-14847 in MongoDB used by Splunk Enterprise with a CVSS v3.1 score of 5.3. Splunk remediated the issue by upgrading bundled MongoDB builds and delivering fixes in Splunk Enterprise versions 10.2.0, 10.0.3, 9.4.8, 9.3.9, 9.2.12 and later. Users are advised to upgrade to those fixed Splunk Enterprise releases or higher and, as a mitigation for systems that do not use the KV Store, disable the App Key Value Store on indexers or heavy forwarders.
Initial access hackers switch to Tsundere Bot for ransomware attacks

www.bleepingcomputer.com · 6 months ago

A prolific initial access broker tracked as TA584 is using Tsundere Bot alongside the XWorm remote access trojan to gain network access that researchers say could lead to ransomware, and Proofpoint has tracked TA584 activity since 2020 with a significant recent increase. The attack chain begins with emails sent from hundreds of compromised aged accounts via SendGrid and Amazon Simple Email Service that include unique target URLs, geofencing, IP filtering, and redirect chains using traffic direction systems such as Keitaro, which lead victims to CAPTCHA and ClickFix pages instructing them to run a PowerShell command. The PowerShell command fetches and executes an obfuscated script that loads XWorm or Tsundere Bot into memory and redirects the browser to a benign site, while Tsundere Bot requires Node.js, retrieves its command and control address from the Ethereum blockchain using an EtherHiding technique with a hardcoded fallback, and communicates over WebSockets. Tsundere Bot profiles infected machines, can execute arbitrary JavaScript, supports using infected hosts as SOCKS proxies, features a built in market for buying and selling bots, and checks system locale to abort execution on Commonwealth of Independent States language settings.
Tycoon 2FA phishing campaign abusing *.contractors domains for Gmail & Microsoft 365 credential harvesting

malwr-analysis.com · 6 months ago

There is a coordinated credential harvesting campaign that abuses newly registered dot contractors domains to host Gmail and Microsoft 365 phishing pages and uses social engineering lures such as ICANN email verification, document sharing, and account security prompts. The operation is attributed with high confidence to the Tycoon 2FA phishing kit based on MFA aware multi step flows, client side obfuscation, encrypted runtime loaders, and advanced anti analysis logic including debugger detection and CAPTCHA gating to evade automated scanners. Campaign infrastructure reuses randomized subdomains and long URL paths that embed victim email addresses, with domains observed registered on January 7, 2026 and January 14, 2026, and employs benign decoy landing pages and additional domains beyond the contractors cluster to prolong domain lifespan and reduce detection.
How Can CISOs Respond to Ransomware Getting More Violent?

www.darkreading.com · 6 months ago

There are reports that ransomware actors are becoming more violent, resorting to threats of physical harm and other coercive tactics as they adapt to fewer victims willing to pay. Research finds that in about two fifths of attacks adversaries threatened to harm executives, sixty three percent of victims were threatened with data destruction, forty seven percent faced threats of regulatory complaints, and identity systems were compromised in eighty three percent of analyzed attacks enabling persistence and lateral movement. Victimization and payments remain high with an estimated fifty six percent of organizations in surveyed countries breached in 2024 and sixty nine percent of those paying ransoms, and Chainalysis estimates roughly eight hundred fourteen million U.S. dollars in ransom payments in 2024, down from one point three billion in 2023. Recommended defenses emphasize business resilience through prompt patching, improved user education, multi factor authentication, robust backups, automated defense and recovery, and well tested incident response processes that also cover suppliers to reduce impact and avoid repeat targeting.