Blahalla

Overcoming AI fatigue

www.csoonline.com · 6 months ago

There is a clear spectrum of AI risk: generative AI responds to prompts and mainly risks data leakage and intellectual property exposure, while agentic AI can take autonomous actions and poses much greater operational and safety risks. Data integrity is foundational because compromised or incomplete data can lead AI systems to make harmful decisions that affect finances, supply chains, customer interactions, or physical safety. CISOs have a narrow window to set guardrails before autonomous systems become entrenched, giving security leaders more influence than in past technology waves. A practical governance approach is tiered risk categorization by autonomy and impact, consistent baseline controls such as enforceable acceptable use policies, training, monitoring and technical safeguards, a cross functional review forum, and non negotiable rules like human oversight, least privilege, zero trust and reliable kill switches for high risk agentic systems.
CTEM in Practice: Prioritization, Validation, and Outcomes That Matter

thehackernews.com · 6 months ago

Organizations are adopting Continuous Threat Exposure Management to move beyond isolated threat and vulnerability assessments and focus on exposures that are exploitable in their actual environments. CTEM, as defined by Gartner, is a continuous cycle of scoping, discovery, prioritization, validation, and mobilization designed to identify and remediate exposures attackers can realistically exploit. Threat intelligence and Priority Intelligence Requirements are central because more than 40,000 vulnerabilities were reported in 2024 and fewer than ten percent are ever exploited, so teams must prioritize flaws tied to observed adversary tactics. Validation through controlled attack simulations and improvements to people and processes is necessary to ensure defenses work, and CTEM requires top level leadership to break silos and define a scoped, measurable program focused on reducing cyber risk.
CISA Urges Public to Stay Alert Against Rising Natural Disaster Scams

gbhackers.com · 6 months ago

CISA warns of heightened malicious cyber activity targeting natural disaster victims, reporting that threat actors use social engineering such as phishing emails with malicious links or attachments, fraudulent charity appeals on social media and text messages, and door to door solicitations to exploit affected populations' emotional vulnerability. The agency advises verifying disaster guidance through trusted authorities including local officials, FEMA, and DHS Ready, and recommends consulting resources from the Federal Trade Commission and the Consumer Financial Protection Bureau to avoid scams. Individuals should exercise caution before clicking links or sharing personal or financial information and should report suspected fraud to appropriate authorities.
ShinyHunters Group Targets Over 100 Enterprises, Including Canva, Atlassian, and Epic Games

gbhackers.com · 6 months ago

There is a surge in infrastructure deployment mirroring the tactics of a predatory supergroup combining Scattered Spider, LAPSUS, and ShinyHunters. A human-led identity theft campaign is targeting Single Sign-On platforms, particularly Okta, across more than 100 high-value enterprises and relies on voice phishing to bypass multifactor authentication. Attackers use a live phishing panel to intercept credentials and MFA tokens in real time, pivot to internal collaboration tools to escalate privileges, and combine data theft with encryption and ransom demands. Recommended countermeasures include alerting support staff, conducting forensic audits of Okta logs for new device enrollments followed by unfamiliar IP activity, and deploying DNS-level defenses to block lookalike domains before infrastructure becomes operational.
Critical vm2 Flaw Lets Attackers Bypass Sandbox and Execute Arbitrary Code in Node.js

gbhackers.com · 6 months ago

There is a critical vulnerability in the vm2 JavaScript sandbox affecting versions up to 3.10.0 that enables attackers to bypass sandbox protections and execute arbitrary code with full system privileges. The flaw exploits improper sanitization of Promise callback functions by abusing inconsistencies between local Promise.prototype.then and the global Promise returned by async functions, allowing attackers to use Symbol properties on error objects to trigger async execution, expose the unsanitized then method, and gain access to the Error constructor Function prototype to run system commands such as via the child process module. The issue is tracked as CVE-2026-22709 with a CVSS score of 9.8 and advisory GHSA-99p7-6v5w-7xg8, it affects around 273,000 npm projects, and it is patched in vm2 version 3.10.2 with no viable workarounds so immediate updating is required.
Organizations Warned of Exploited Linux Vulnerabilities

www.securityweek.com · 6 months ago

There are five flaws added to the CISA Known Exploited Vulnerabilities catalog, including two Linux bugs that can let threat actors obtain root privileges or bypass authentication via Telnet to gain a root shell. One Linux issue, CVE-2026-24061, is a critical authentication bypass in GNU Inetutils telnetd caused by an unsanitized USER environment variable that allows an attacker to supply an -f flag via Telnet and obtain a root shell, and it has a CVSS score of 9.8 and affects GNU Inetutils versions from 1.9.3 through 2.7. The other Linux issue, CVE-2018-14634, is an integer overflow in the kernel that can enable local privilege escalation to root on systems meeting exploit requirements such as at least 32 gigabytes of RAM, and there were no known in the wild exploitation reports prior to CISA's warning. CISA also added two SmarterMail vulnerabilities and a Microsoft Office zero day to the KEV catalog and urged federal agencies to remediate all five flaws by February 16.
Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

thehackernews.com · 6 months ago

Microsoft issued an out of band security update to address a high severity Microsoft Office zero day tracked as CVE-2026-21509 with a CVSS score of 7.8, described as a security feature bypass that can be exploited by sending a specially crafted Office file which a recipient must open. Microsoft said the Preview Pane is not an attack vector, that Office 2021 and later will receive a service side protection after restarting Office, and that Office 2016 and 2019 users must install specified updates or apply a registry mitigation that creates a COM Compatibility subkey and sets a Compatibility Flags value of 400. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog and required Federal Civilian Executive Branch agencies to apply patches by February 16, 2026.
Critical Grist-Core Vulnerability Allows RCE Attacks via Spreadsheet Formulas

thehackernews.com · 6 months ago

There is a critical flaw in Grist-Core that allows remote code execution via malicious spreadsheet formulas, tracked as CVE-2026-24002 with a CVSS score of 9.1 and codenamed Cellbreak by Cyera Research Labs. The vulnerability is a Pyodide sandbox escape in Grist's Python formula execution that can reach the host runtime to run OS commands or JavaScript, enabling filesystem access and secret exposure, and it is similar to the earlier n8n flaw CVE-2025-68668. Grist addressed the issue in version 1.7.9 released January 9, 2026, moved Pyodide formula execution under the Deno runtime by default, and recommends updating immediately, setting GRISTSANDBOXFLAVOR to gvisor as a temporary mitigation, and avoiding setting GRISTPYODIDESKIPDENO to 1.
Over 6,000 SmarterMail Servers Exposed to Actively Exploited RCE Vulnerability

gbhackers.com · 6 months ago

There are approximately 6,000 vulnerable SmarterTools SmarterMail installations worldwide exposed to an actively exploited unauthenticated remote code execution vulnerability tracked as CVE-2026-23760. Shadowserver integrated CVE-2026-23760 detection into daily vulnerable HTTP scans, reporting around 6,000 likely vulnerable IPs and observing exploitation attempts with a geographically widespread distribution. The flaw enables full server compromise with risks of data exfiltration, lateral movement, and persistent backdoors, and organizations are urged to verify versions against vendor advisories and apply available patches while implementing mitigations such as network segmentation, WAF rules, IP whitelisting, or temporary service shutdowns where patches are not yet available.
Attackers Exploit React2Shell Vulnerability to Target IT Sector Systems

gbhackers.com · 6 months ago

There is active exploitation of a critical React Server Components vulnerability tracked as CVE-2025-55182, dubbed React2Shell, which targets the Flight protocol by exploiting insecure deserialization to enable remote code execution under specific conditions. The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0 through 19.2.0, and patched releases are available in versions 19.0.1, 19.1.2, and 19.2.1. Attackers have weaponized the vulnerability to deliver diverse malware including XMRig miners, Kaiji and RustoBot botnets, Sliver and VShell implants, and novel JavaScript RATs, establishing persistence via systemd services, cron jobs, modified startup scripts, and added SSH keys. Organizations are advised to immediately update and rebuild projects to remove vulnerable dependencies, verify lock files, audit for indicators such as unauthorized services, cron tasks, and connections to known malicious infrastructure, and continuously monitor for post exploitation activity.
Outrage over ICE has spilled into typically apolitical online spaces

www.washingtonpost.com · 6 months ago

There is growing outrage after Border Patrol agents killed intensive care nurse Alex Pretti in Minneapolis, and widely shared video of the incident has driven typically apolitical online communities from cat and hobby forums to fitness and lifestyle influencers to speak out. Moderators and creators across Reddit, Instagram, TikTok and YouTube have posted anti ICE messages that went viral, prompting some conservatives to reverse earlier defenses and fueling nationwide protests and criticism of the administration's immigration crackdown. Polling shows about 48 percent of Americans condemned the killing compared with 20 percent who defended it, and the president announced a partial recall of agents amid pressure from lawmakers and local officials who said the situation cannot continue.
Inside an AI start-up’s plan to scan and dispose of millions of books

www.washingtonpost.com · 6 months ago

Court filings show that Anthropic ran a secret Project Panama in which it bought, sliced the spines off, scanned, and recycled millions of books over about a year, spending tens of millions of dollars to feed its Claude chatbot. The filings say the company also downloaded large collections from shadow libraries such as LibGen and that a co founder personally downloaded thousands of titles, though Anthropic contends it did not use some pirated datasets to train commercial models. Judges in June 2025 found that training AI on books can be transformative under fair use, but Anthropic agreed to a roughly 1.5 billion dollar settlement over how some materials were acquired without admitting wrongdoing.
Hackers Exploit SEO Poisoning to Target Users Seeking Legitimate Tools

gbhackers.com · 6 months ago

Attackers are poisoning search engine results to promote fake repositories and ZIP archives that contain BAT batch scripts masquerading as legitimate applications. When executed these BAT files contact attacker controlled command and control servers to retrieve secondary payloads such as remote administration tools that establish persistence and grant attackers full system access. Threat actors abuse compromised and fraudulent repositories and use obfuscation and legitimate system commands in the scripts to evade detection and make the archives appear authentic. Recommended defenses include verifying official download sources, scanning archives before execution, applying application whitelisting, and deploying endpoint detection and response to monitor suspicious BAT execution and outbound connections.
AI overload to accelerate zero-trust data governance adoption

www.csoonline.com · 6 months ago

Gartner warns that the growing volume of unverified AI generated data threatens the future reliability of large language models and predicts that 50 percent of organizations will adopt a zero trust stance for data governance by 2028. A 2026 survey of CIOs and technology executives found 84 percent expect increased funding for generative AI, which will expand AI generated data and raise the risk of a model crash as future models are trained on outputs of prior models. Organizations are urged to stop implicitly trusting data by establishing authentication and verification measures, identifying and tagging AI generated data, and investing in metadata management, data cataloging, and workforce skills to meet increasingly varied regional regulatory requirements.
New Deepfake Phishing Attack Targets Bitcoin Users via Zoom and Teams

gbhackers.com · 6 months ago

A sophisticated deepfake-enabled phishing campaign is actively targeting Bitcoin users by initiating messages on Telegram and then placing fake Zoom or Microsoft Teams calls that use AI-generated video to impersonate trusted contacts. During calls attackers feign audio or technical problems and prompt victims to install a supposed plugin or update that is actually malware which grants full remote access to steal bitcoin from hot wallets, hijack Telegram accounts, and capture credentials and authentication tokens. Victims report the attacks are highly convincing and high-pressure, and security experts advise not accepting calls via Telegram links, never installing plugins suggested during live calls, preferring more controlled platforms for sensitive discussions, and using reputable endpoint protection and regular malware scans.
Meta Faces Legal Action Over Claims of Accessing All WhatsApp User Messages

gbhackers.com · 6 months ago

A class action filed in San Francisco federal court alleges Meta systematically misled over two billion WhatsApp users by claiming messages were protected by end to end encryption while storing, analyzing, and granting employees access to chat contents through internal tools. Plaintiffs from Australia, Brazil, India, Mexico, and South Africa seek unspecified damages and say the practices could expose sensitive personal information, though no technical evidence such as code samples or server logs has been provided and Meta calls the suit frivolous. The complaint highlights acknowledged gaps in optional cloud backups and metadata collection, warns that certification as a global class action could affect users under multiple jurisdictions, and may pressure Meta to increase transparency about its data handling.
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023

thehackernews.com · 6 months ago

There is a JScript based command and control framework called PeckBirdy that China aligned APT actors have used since 2023 to target Chinese gambling sites, Asian government entities, and private organizations. The framework is flexible and can run across web browsers, MSHTA, WScript, Classic ASP, Node JS, and.NET ScriptControl, fetching landing scripts via an API with a 32 character attack ID and communicating primarily over WebSocket with Flash ActiveX or Comet fallbacks. Two intrusion clusters labeled SHADOW VOID 044 and SHADOW EARTH 045 were observed using PeckBirdy to deliver credential harvesting scripts, social engineering fake updates, Electron based backdoors, TCP reverse shells, and modular backdoors including HOLODONUT and MKDOOR launched by the NEXLOAD downloader. One PeckBirdy server was found hosting an exploitation script for a Google Chrome V8 vulnerability tracked as CVE-2020-16040, which was patched in December 2020.
Microsoft Patches Office Zero-Day Likely Exploited in Targeted Attacks

www.securityweek.com · 6 months ago

Microsoft released patches for CVE-2026-21509, an Office zero day that bypasses OLE mitigations and is being actively exploited. Exploitation requires convincing a user to open a malicious Office file, the flaw was discovered by Microsoft security researchers, and the complexity and social engineering requirements indicate it is being used for targeted espionage or other high value operations rather than broad campaigns. Patches cover Office 2016, 2019, LTSC 2024 and 2021, and Microsoft 365 Apps for Enterprise, mitigations are available for those who cannot immediately update, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of February 16 2026.
4 issues holding back CISOs’ security agendas

www.csoonline.com · 6 months ago

There are four issues holding back enterprise security agendas: failure to train and empower team members to act on priorities, inability to keep pace with AI innovation and adoption, limited adoption of AI for security operations, and a shortage of needed talent and skills. Security leaders widely expect a breach, with 76 percent saying they feel at risk of a material cyberattack in the next 12 months and 58 percent saying their organizations are unprepared to respond, and CISOs report high levels of stress and burnout that impede delegation and decision making. Adoption and governance gaps around AI are acute, with most organizations using AI but only a small fraction having strong visibility or dedicated AI governance, only 28 percent having integrated AI tools into security operations, and a persistent talent and skills gap that executives cite as a major obstacle to improving security posture.
Users say TikTok stifled posts about Minneapolis shooting as platform faltered

www.washingtonpost.com · 6 months ago

TikTok users reported their videos concerning the shooting of a man by immigration agents were suppressed or delayed. This occurred shortly after a deal to transfer the U.S. business of the platform to new investors. Many users claim their posts received few views or were stalled due to technical problems. The shooting involved federal immigration agents and occurred in Minneapolis.
Unplugged holes in the npm and yarn package managers could let attackers bypass defenses against Shai-Hulud

www.csoonline.com · 6 months ago

An Israeli researcher at Koi Security disclosed six zero day vulnerabilities collectively called PackageGate that can allow attackers to bypass recommended defenses in JavaScript package managers and enable worm-like attacks similar to Shai-Hulud. The flaws can defeat two widely promoted protections: disabling lifecycle scripts and relying on lockfile integrity checks to block tampered packages. Pnpm, vlt, and Bun have issued patches while npm and yarn have not, and developers are advised to use patched managers or keep their tools up to date. Microsoft and GitHub say they are working to address the issues and urge adoption of prior supply chain hardening guidance, but the researcher warns that the standard advice is insufficient until PackageGate is fully resolved.
New malware service guarantees phishing extensions on Chrome web store

www.bleepingcomputer.com · 6 months ago

There is a new malware as a service named Stanley that promises malicious Chrome extensions that can clear Google's review process and be published to the Chrome Web Store. The extensions overlay a full screen iframe to display phishing content while leaving the address bar unchanged, support silent auto installation on Chrome, Edge, and Brave, let operators enable hijacking rules and push browser notifications, and include IP based victim identification with geographic targeting. The malware polls its command and control every ten seconds, supports backup domain rotation for resilience, is sold in tiered subscriptions including a Luxe plan that offers assistance publishing malicious extensions, and researchers say the code is rough and lacks advanced features.
Beauty in Destruction: Exploring Malware's Impact Through Art

www.darkreading.com · 6 months ago

A Museum of Malware Art opened in Finland in late 2024, transforming historical and live malware into immersive exhibits and featuring a centerpiece heart made from 728 computer mice that references the ILOVEYOU virus. Interactive installations let visitors engage with near real time threat data, capture malware with gestures, view detailed descriptions of captured rootkits, and download samples to their phones, while a Virus Archive traces malware evolution back to 1987 and the museum sells themed merchandise such as scarves patterned after the DUCKTAIL malware. The museum situates these works alongside digital art projects such as Persistence of Chaos, which aggregated notorious malware including ILOVEYOU, MyDoom, SoBig, WannaCry, DarkTequila, and BlackEnergy and sold for one point two million dollars, framing destruction, reverse engineering, and AI driven visualization as creative and educational lenses on cybersecurity.
Google agrees to pay $68 million to settle voice recording lawsuit

therecord.media · 6 months ago

Google has agreed to pay 68 million dollars to settle a class action alleging its voice activated assistant illegally recorded and shared plaintiffs private conversations with third parties without their consent. A preliminary settlement was filed in a Northern California federal court and still requires approval by a judge. Plaintiffs say the assistant sometimes misheard the Hey Google trigger, began recording, and the recordings were used to deliver targeted advertising, and settlement funds will be distributed to people who bought Google devices since May 2016.
New ClickFix attacks abuse Windows App-V scripts to push malware

www.bleepingcomputer.com · 6 months ago

A new malicious campaign mixes the ClickFix social engineering trick with a fake CAPTCHA and a signed Microsoft Application Virtualization script that proxies PowerShell execution through the trusted wscript.exe to deliver the Amatera infostealer. The attack tricks victims into pasting a command that runs SyncAppvPublishingServer.vbs, verifies manual execution and clipboard integrity to evade sandboxes, retrieves base64 configuration from a public Google Calendar, spawns a hidden 32 bit PowerShell process via WMI, and loads payloads hidden using LSB steganography in PNG images hosted on public CDNs. Final stages decrypt and execute native shellcode in memory, connect to a hardcoded IP for endpoint mappings and further payloads, and recommended defenses include restricting access to the Run dialog, removing App V components when not needed, enabling PowerShell logging, and monitoring outbound connections for mismatches between HTTP Host headers or TLS SNI and destination IP.
Sandworm Blamed for Wiper Attack on Poland Power Grid

www.darkreading.com · 6 months ago

Security researchers attributed an attempted destructive wiper attack on Poland's power grid on December 29 and 30, 2025 to the Russian APT group Sandworm with medium confidence. Attackers targeted two combined heat and power plants and a system that manages electricity from renewable sources, but the operation failed and caused no blackout or other negative consequences. ESET analysts said the malware used was a new strain they named DynoWiper and that it is detected as Win32 KillFiles NMO, while providing no technical details. Sandworm has a documented history of destructive campaigns including the BlackEnergy attack against Ukraine in 2015, the NotPetya campaign in 2017, and use of Industroyer against industrial control systems.
Kubernetes Remote Code Execution Via Nodes/Proxy GET Permission

grahamhelton.com · 6 months ago

There is an authorization bypass in Kubernetes RBAC where a service account granted nodes proxy GET permission and network access to a Node's Kubelet on port 10250 can execute commands in any Pod using WebSocket style connections to the Kubelet exec endpoint. This behavior was demonstrated on Kubernetes versions 1.34 and 1.35, affects at least 69 Helm charts that request nodes proxy GET permission, can run commands in privileged system Pods and lead to full cluster compromise, and Kubernetes audit policy does not record the full commands when the connection goes directly to the Kubelet. The issue was reported through the Kubernetes security disclosure process but closed as intended behavior, so administrators should audit service accounts for nodes proxy GET, restrict Kubelet access on port 10250 and consult vendors for alternatives.
Russian hackers accused of attack on Poland electricity grid

www.csoonline.com · 6 months ago

On December 29 and 30, 2025, the Polish electricity grid was subjected to a cyberattack that nearly knocked out power to hundreds of thousands of households. Security firm ESET attributed the attack to Sandworm, a hacking group with strong ties to the Russian military intelligence service GRU. The attack deployed Dynowiper, a destructive malware that erases data on compromised systems. Sandworm has a history of similar operations against Ukrainian power infrastructure since 2014, including use of Industroyer variants and campaigns that led to indictments by the US Department of Justice.
Supreme Court to hear Facebook pixel tracking case

therecord.media · 6 months ago

The Supreme Court agreed to hear Salazar v. Paramount Global, a case over a Facebook tracking pixel that allegedly monitored the streaming habits of a user of a Paramount owned sports site. Michael Salazar asserts that the site embedded the pixel, shared his video viewing with Facebook, and used that data to target advertising in violation of the Video Privacy Protection Act of 1988. The U.S. Court of Appeals for the Sixth Circuit sided with Paramount in July 2023, finding Salazar was not a consumer under the VPPA because he was not a subscriber receiving audiovisual content, and the Supreme Court will decide how broadly the law applies in the digital age.
Microsoft patches actively exploited Office zero-day vulnerability

www.bleepingcomputer.com · 6 months ago

Microsoft releases out of band security updates to patch a high severity Microsoft Office zero day vulnerability tracked as CVE-2026-21509, which affects Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Security updates for Office 2016 and 2019 are not yet available and Microsoft provides a registry based mitigation that creates a COM Compatibility key and sets a Compatibility Flags value to 400 to reduce the severity of exploitation. The flaw is a security feature bypass that can be exploited by unauthenticated local attackers through low complexity attacks that require sending a malicious Office file and convincing a user to open it, and it bypasses OLE mitigations that protect against vulnerable COM OLE controls. Microsoft has not disclosed who discovered the vulnerability or shared technical exploitation details.
Bypassing Windows Administrator Protection

projectzero.google · 6 months ago

Administrator Protection in Windows 11 25H2 replaces User Account Control with a shadow administrator model that aims to make elevation a securable boundary by using a separate shadow administrator account and removing auto elevation. Security research identified nine distinct bypasses that can silently grant full administrator privileges, including a practical exploit involving per session DOS device object directories where kernel creation without forced access checks can let a limited user override drive letter symbolic links and redirect system DLL loading. All reported issues were fixed by Microsoft either before release in an optional update KB5067036 or in subsequent security bulletins, and the feature was disabled on December 1 2025 while an application compatibility issue is addressed, a change that does not alter the analysis.
Cloudflare misconfiguration behind recent BGP route leak

www.bleepingcomputer.com · 6 months ago

Cloudflare shared that on January 22, 2026 a twenty five minute Border Gateway Protocol route leak affecting IPv6 traffic caused measurable congestion, packet loss, and about twelve gigabits per second of dropped traffic. The incident occurred after an accidental policy change removed prefix lists, which made the export policy overly permissive and caused a mixture of Type three and Type four route leaks that redistributed internal IPv6 routes to BGP neighbors in Miami. Cloudflare detected the problem quickly, engineers manually reverted the configuration and paused automation to stop the impact within twenty five minutes, and later reverted the triggering code before safely re enabling automation. Planned mitigations include stricter community based export safeguards, CI CD policy checks, improved early detection, validation of RFC 9234, and promotion of RPKI ASPA adoption.
EU launches investigation into X over Grok-generated sexual images

www.bleepingcomputer.com · 6 months ago

The European Commission launched formal proceedings under the Digital Services Act to investigate whether X properly assessed risks before deploying its Grok artificial intelligence tool after it was used to generate manipulated sexually explicit images, including content that may amount to child sexual abuse material. UK authorities including the Information Commissioner’s Office and the communications regulator Ofcom and the California Attorney General have opened inquiries, and X subsequently limited Grok’s image generation and editing features to paid subscribers, a move criticized by a UK Prime Minister spokesperson. X is designated a very large online platform in the European Union and must mitigate systemic risks under the Digital Services Act, and the company was fined 120 million euros in December for transparency violations.
Indian Users Targeted in Tax Phishing Campaign Delivering Blackmoon Malware

thehackernews.com · 6 months ago

Cybersecurity researchers have identified a targeted cyber espionage campaign against Indian users. The attackers use phishing emails impersonating the Indian Income Tax Department to trick victims into downloading a malicious archive. This archive deploys a variant of the Blackmoon banking trojan and repurposes SyncFuture TSM, a legitimate enterprise tool, to establish persistent access, monitor activity, and exfiltrate data. The malware employs techniques like DLL sideloading, User Account Control bypass, and security software evasion, including automated mouse simulation to manipulate antivirus exclusion lists.
Security strategies for safeguarding governmental data

www.microsoft.com · 6 months ago

false
Microsoft Shared BitLocker Keys With FBI, Raising Privacy Fears

www.techrepublic.com · 6 months ago

Microsoft recently provided BitLocker recovery keys to the FBI as part of a federal investigation into alleged fraud in Guam. The keys unlocked data on three encrypted laptops, a move that has sparked privacy concerns. Microsoft encourages users to store recovery keys in the cloud for convenience, which allows them to comply with legal requests. Security experts criticize this practice, noting that other companies utilize zero-knowledge architectures to protect encryption keys.
Digitale Integrität: Warum Firewall und IDS nicht reichen

www.csoonline.com · 6 months ago

srcset="https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock2727061735.jpg?quality=50&strip=all 800w, https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock2727061735.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock2727061735.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock2727061735.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock2727061735.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock2727061735.jpg?resize=444%2C250&quality=50&strip=all 444w" width="800" height="450" sizes="auto, (max-width: 800px) 100vw, 800px" Die systematische Erfassung von Daten über Mitarbeiter, Kunden und Geschäftspartner hat eine neue Angriffsfläche geschaffen, die von Cyberkriminellen ausgenutzt wird. Digineer Station, shutterstock.com In einer vernetzten Geschäftswelt stehen Unternehmen vor beispiellosen Cybersicherheits-Herausforderungen. Laut dem IBM Cost of a Data Breach Report 2024 betragen die durchschnittlichen Kosten eines durch Phishing verursachten Datenlecks etwa 4,88 Millionen Dollar. Nach Branchenschätzungen werden täglich etwa 3,4 Milliarden Phishing-E-Mails verschickt. Gleichzeitig wächst die globale Datenhändlerbranche auf geschätzte 280 Milliarden Dollar im Jahr 2024. Diese Branche sammelt systematisch Informationen über Mitarbeiter, Kunden und Geschäftspartner, oft ohne deren Wissen. Traditionelle Sicherheitskonzepte wie Firewalls und Intrusion Detection reichen nicht mehr aus. Die Grenzen von Firewall und Intrusion Detection Eine Firewall ist unverzichtbar, hat jedoch fundamentale Einschränkungen: Sie ist hauptsächlich reaktiv und auf bekannte Bedrohungen konfiguriert. Bei täglich 300.000 neuen Malware- Varianten entstehen erhebliche Sicherheitslücken. Zudem konzentriert sie sich primär darauf, dass niemand ins Firmennetzwerk eindringt, die unkontrollierte Übertragung sensibler Daten nach außen bleibt oft unbemerkt. Intrusion-Detection-Systeme (IDS) wiederum erkennen Eindringlinge erst, wenn diese bereits im System sind, vergleichbar mit einem Rauchmelder, der vor einem Brand warnt, ihn aber nicht verhindert. Advanced Persistent Threats (APTs) können so monatelang unentdeckt in Netzwerken verweilen. Was die Datenindustrie über Ihr Unternehmen weiß Data Broker sammeln systematisch Informationen, die weit über das hinausgehen, was Unternehmen bewusst ist. Nach Branchenberichten haben führende Data Broker personenbezogene Daten von schätzungsweise 70 Prozent der weltweiten Online-Bevölkerung erfasst. Der Marktwert dieser Branche beträgt 2024 rund 280 Milliarden Dollar, größer als der globale Cybersicherheitsmarkt. Die gesammelten Daten betreffen nicht nur das Unternehmen selbst, sondern auch Mitarbeiter, Kunden und Geschäftspartner. Das Gefährliche: Diese Daten fließen kontinuierlich und unbemerkt ab, durch alltägliche Internetnutzung am Arbeitsplatz. Jeder Webseitenbesuch, jede App-Nutzung, jedes vernetzte Gerät wird zum Datenlieferanten. Für herkömmliche Firewalls ist dieser Datenabfluss unsichtbar, da er als legitimer ausgehender Datenverkehr erscheint. Über Mitarbeiter erfasst die Datenindustrie umfangreiche Informationen. Standort und Bewegungsmuster werden über die IP-Adresse beim Surfen ermittelt. Daraus entstehen detaillierte Profile darüber, welche Technologien ein Mitarbeiter recherchiert, an welchen Projekten er arbeitet und welche Wettbewerber er analysiert. Auch die berufliche Rolle und Position werden erfasst: Tracker auf Karriereportalen wie LinkedIn und Xing registrieren Profilbesuche und Interaktionen, während Browser-Fingerprinting wiederkehrende Besucher auch ohne Cookies identifiziert. Die Kombination aus Firmendomain, Surfverhalten und Social-Media-Aktivitäten ermöglicht die Zuordnung zu konkreten Personen und ihren Entscheidungsbefugnissen. Hinsichtlich Kommunikationsmuster und Metadaten gilt: Selbst bei verschlüsselten E-Mails können alle Metadaten mitgelesen werden. Über Kunden und Geschäftspartner werden ebenfalls sensible Informationen gesammelt. Geschäftsbeziehungen lassen sich ermitteln, wenn Mitarbeiter Kunden-Websites besuchen oder Partner- Portale nutzen, da eingebettete Tracker diese Verbindungen erfassen können und die Häufigkeit der Besuche die Intensität der Geschäftsbeziehung verrät. Projektinformationen werden sichtbar, weil Recherchen zu bestimmten Technologien, Branchen oder Märkten über Browser-Tracking protokolliert werden. Daraus lässt sich ableiten, an welchen Projekten gearbeitet wird und welche Investitionen geplant sind. Bei der Nutzung von Cloud-basierten CRM- Systemen, Projektmanagement-Tools oder Collaboration-Plattformen können eingebettete Analyse-Skripte zudem Informationen über verarbeitete Kundendaten erfassen. Data Broker bieten ihre Datenbanken als legale Dienstleistung an, etwa für Hintergrundüberprüfungen, Marketing oder Kreditwürdigkeitsprüfungen. Das bedeutet: Auch Cyberkriminelle und staatliche Akteure können diese Daten problemlos erwerben. Wie Cyberkriminelle diese Daten nutzen Beim CEO Fraud (Chef-Betrug) geben sich Angreifer als Geschäftsführer oder Führungskräfte aus, um Mitarbeiter zur Überweisung von Geldern zu verleiten. Laut FBI führten zwischen 2013 und 2023 über 305.000 solcher Vorfälle zu weltweiten Verlusten von über 55 Milliarden Dollar. Die von Data Brokern gesammelten Informationen über Position, Reisepläne und aktuelle Projekte machen diese Angriffe erschreckend glaubwürdig. 2024 berichteten 64 Prozent der Unternehmen von solchen Angriffen. Spear Phishing zielt im Gegensatz zu breit gestreutem Phishing auf spezifische Mitarbeiter. Mit Wissen über deren Rolle, Projekte und Kontakte erstellen Angreifer hochgradig personalisierte Nachrichten. Obwohl Spear-Phishing weniger als 0,1 Prozent des E-Mail-Volumens ausmacht, ist es für 66 Prozent aller Datenpannen verantwortlich. Staatliche Akteure als zusätzliche Bedrohung Neben Cyberkriminellen stellen staatlich finanzierte Hackergruppen eine wachsende Bedrohung für Unternehmen dar. Diese sogenannten Nation-State Actors verfügen über erhebliche Ressourcen und nutzen die von Data Brokern gesammelten Informationen für gezielte Wirtschaftsspionage und Sabotage. Die Zahlen sind alarmierend: Laut CrowdStrike nahmen chinesische Cyber-Spionage-Aktivitäten 2024 um 150 Prozent zu, in bestimmten Branchen sogar um bis zu 300 Prozent. Das BSI registrierte 2024 durchschnittlich 309.000 neue Malware-Varianten pro Tag. Nach Angaben von Microsoft sind russische, chinesische, iranische und nordkoreanische Gruppen für den Großteil der staatlich unterstützten Cyberangriffe verantwortlich. Allein die bekannten APT-Gruppen (Advanced Persistent Threats) wie APT27, APT28, APT29, APT31, APT41, Lazarus Group und Kimsuky führen hunderte aktive Kampagnen gegen westliche Unternehmen durch. Diese Gruppen nutzen die von Data Brokern verfügbaren Informationen zur präzisen Zielidentifikation, für Social-Engineering- Angriffe und zur langfristigen, unentdeckten Infiltration von Unternehmensnetzwerken. Die durchschnittliche Verweildauer eines APT in einem kompromittierten Netzwerk beträgt mehrere Monate, Zeit genug, um sensible Geschäftsgeheimnisse zu exfiltrieren. Was digitale Integrität bedeutet Digitale Integrität beschreibt die Unversehrtheit, Korrektheit und Vollständigkeit von Daten sowie das Recht, die digitale Identität und Kommunikation vor unbefugtem Zugriff zu schützen. Für Unternehmen bedeutet dies: Digitale Informationen dürfen nicht unbefugt verfälscht oder abgefangen werden. Mitarbeiter, Kunden und Geschäftspartner müssen darauf vertrauen können, dass ihre Daten geschützt sind. Schutzmaßnahmen für Unternehmen Security & Privacy Boxen sind eine Weiterentwicklung von Firewalls, die dazu beitragen können, den ungewollten Abfluss von Informationen aus dem Unternehmen deutlich zu reduzieren. Entscheidend ist, dass die Lösung vertrauenswürdig ist: Kein Missbrauch als Überwachungsinstrument, Tracker können sich nicht freikaufen, und der Hersteller muss unabhängig von Werbeeinnahmen und Datenhandel sein. Neben dem Einsatz einer Security & Privacy Box sollten CISOs aber weitere Maßnahmen implementieren. Dazu gehören regelmäßige Mitarbeiterschulungen zu Phishing und Social Engineering sowie das Eigen-Hosting sensibler Daten statt der Nutzung externer Cloud- Anbieter. Eine Zero-Trust-Architektur nach dem Prinzip ‚Vertraue niemandem, verifiziere alles’ bildet eine wichtige Grundlage. Ergänzend sollte regelmäßig überprüft werden, welche Unternehmensdaten öffentlich zugänglich sind. (jm)
Judge awards British critic of Saudis $4.1 million, finds the regime hacked his devices

therecord.media · 6 months ago

A London judge said there was a "compelling basis" to conclude that Saudi Arabia was behind spyware infections aimed at YouTuber and regime critic Ghanem Al-Masarir.
Access System Flaws Enabled Hackers to Unlock Doors at Major European Firms

www.securityweek.com · 6 months ago

More than 20 vulnerabilities were found and patched in Dormakaba physical access control systems.
DPRK's Konni Targets Blockchain Developers With AI-Generated Backdoor

www.darkreading.com · 6 months ago

North Korean APT group Konni is using a newly observed AI generated PowerShell backdoor to target blockchain developers and development environments across Japan, Australia, and India. The campaign uses phishing lures that mimic legitimate project documentation with architecture and timeline details to obtain infrastructure access, API credentials, wallet access, and cryptocurrency holdings. The PowerShell implant is unusually polished, appears AI authored, enforces a single UUID based instance, and exfiltrates system information via HTTP GET roughly every 13 minutes. Researchers published indicators of compromise including hashes, scripts, executables, domains, and IP addresses and advise treating unsolicited project documents with suspicion and monitoring developer environments closely.
Malicious VS Code AI Extensions with 1.5 Million Installs Steal Developer Source Code

thehackernews.com · 6 months ago

Cybersecurity researchers have discovered two malicious Microsoft Visual Studio Code (VS Code) extensions that are advertised as artificial intelligence (AI)-powered coding assistants, but also harbor covert functionality to siphon developer data to China-based servers. The extensions, which have 1.5 million combined installs and are still available for download from the official Visual Studio
New Videos of the Beckham Feud Are Fake. Nobody Seems to Care.

www.nytimes.com · 6 months ago

A.I.-generated content of Victoria Beckham has spread as wedding drama has engulfed the celebrity clan and the public has clamored for receipts (even fabricated ones).
Russian state hackers likely behind wiper malware attack on Poland’s power grid

therecord.media · 6 months ago

A major cyberattack that nearly cut electricity to half-a-million people in Poland last year was reportedly carried out by the Russia-linked hacking group Sandworm, which likely attempted to knock out systems using wiper malware.
Nearly 800,000 Telnet servers exposed to remote attacks

www.bleepingcomputer.com · 6 months ago

Internet security watchdog Shadowserver tracks nearly 800,000 IP addresses with Telnet fingerprints amid ongoing attacks exploiting a critical authentication bypass vulnerability in the GNU InetUtils telnetd server.
Microsoft handed over BitLocker keys to law enforcement, raising enterprise data control concerns

www.csoonline.com · 6 months ago

Microsoft gave Windows users’ BitLocker encryption keys for to US law enforcement officers, providing access to encrypted data, according to a news report. The US Federal Bureau of Investigation approached Microsoft with a search warrant in early 2025, seeking keys to unlock encrypted data stored on three laptops in a case of alleged fraud involving the COVID unemployment assistance program in Guam. As the keys were stored on a Microsoft server, Microsoft adhered to the legal order and handed over the encryption keys, Forbes reported on Friday. Microsoft did not immediately respond to a request for comment. There have been instances in the past where the big tech companies were approached by law enforcement for access to devices but have resisted handing encryption keys to authorities. BitLocker is a widely used tool for securing data at rest, whether by individuals or enterprises managing hundreds or thousands of Windows devices. By default, many Windows installations back up BitLocker recovery keys to Microsoft’s cloud services, where Microsoft can retrieve them if legally compelled with a valid order. Custody issue, not BitLocker BitLocker is designed to provide encryption for entire volumes, addressing the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned devices. As BitLocker is bunded with Windows 10 and Windows 11, it has effectively become the default full-disk encryption layer across Windows endpoints, say experts. “BitLocker itself does not fail here. The software does what it is built to do, encrypts the disk, integrates into Windows, allows for easy recovery,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. While the encryption of BitLocker is robust, enterprises need to be mindful of who has custody of the keys, as this case illustrates. “The encryption engine in BitLocker, using AES-128 or AES-256 in XTS mode, is built to resist modern cryptanalysis. Even the US Department of Homeland Security has admitted they lack the forensic tooling to break it directly. However, most enterprise fleets running Windows use tools like Intune and Autopilot to roll out and manage devices. In that flow, unless explicitly disabled, recovery keys are automatically backed up to Microsoft Entra ID. These keys are then viewable via the admin centre or retrievable through scripts,” Gogia said. Where most enterprises go wrong Enterprises using BitLocker should treat the recovery keys as highly sensitive, and avoid default cloud backup unless there is a clear business requirement and the associated risks are well understood and mitigated. The safest configuration is to redirect those keys to on-premises Active Directory or a controlled enterprise key vault. Even if stored in corporate-controlled directory or service such as Microsoft Entra ID or Intune, there should be strong governance on who can read the keys, with effective logging and just-in-time access, said Amit Jaju, a global partner at Ankura Consulting. This can cut Microsoft out of the recovery loop, he said. If keys have to reside in Microsoft’s cloud, use strong multi-factor authentication for admin roles, with conditional access and privileged-access workstations so a compromise of admin credentials does not automatically become a compromise of all keys, he said. Enterprises should ensure strict access control and separation of duties. “Only a small, vetted group such as security operations, endpoint engineering, should have rights to view or export recovery keys. Approvals should be workflow-based, not ad hoc. Every key retrieval should leave an auditable, immutable trail, and ideally be tied to an incident or ticket ID,” said Jaju. CISOs should also ensure that when devices are repurposed, decommissioned, or moved across jurisdictions, keys should be regenerated as part of the workflow to ensure old keys cannot be used. Gogia warned of the long tail of insecure setups. Personal accounts linked during provisioning, or BYOD devices that silently sync keys to consumer dashboards, are invisible pathways for leakage. “If those keys sit outside your boundary, you no longer have a clean chain of custody. That’s not a theoretical risk. It’s something auditors are now actively checking,” he said. As many breaches are not cryptographic but procedural, enterprises should have a formal playbook for when a recovery key can be used (lost PIN, internal investigation with legal approval, lawful order) and when it cannot (informal manager request to access an employee’s data), noted Jaju. Geopolitics reshaping enterprise data and key control Geopolitical tensions are also reshaping global trade and technology policies, something enterprises increasingly need to factor into their security strategies. As governments assert greater control over data, trade secrets and proprietary information risk becoming entangled in broader state interests. Gogia warned, “The US CLOUD Act allows law enforcement to compel US-based providers to hand over data and keys, even if that data is hosted in Europe or Asia. Similarly, Chinese data localisation rules require keys and data to be accessible to state regulators. In India, recent legislation has introduced broad access rights for security agencies. And the EU is debating whether sovereignty must include key custody by design, not just data residency.” If recovery keys are stored with a cloud provider, that provider may be compelled, at least in its home jurisdiction, to hand them over under lawful order, even if the data subject or company is elsewhere without notifying the company. This becomes even more critical from the point of view of a pharma company, semiconductor firm, defence contractor, or critical-infrastructure operator, as it exposes them to risks such as exposure of trade secrets in cross‑border investigations. Jaju added, “Enterprises should assume that where keys are held, they can potentially be compelled. So where practical, ensure that the entities controlling keys are legally anchored in the jurisdiction whose laws and due-process standards you trust most. Establish board-level oversight on cross-border data access, including a register of government data-access requests, where legally permitted. For multinational companies, legal and security teams must work together to understand mutual legal-assistance treaties, CLOUD Act implications, and local interception laws.” This article first appeared on Computerworld.
Microsoft releases second out-of-band fix for Windows in a week

www.csoonline.com · 6 months ago

Outlook users have reported difficulties with Microsoft’s January Patch Tuesday updates, forcing Microsoft, once again, to patch some of its patches. Users reported that, after applying the January 13 Windows updates, some applications became unresponsive or encountered unexpected errors when opening files from or saving files to cloud-based storage such as OneDrive or Dropbox. In particular, certain Microsoft Outlook configurations with the PST file containing a users’ messages stored on OneDrive could cause Outlook to hang or lead to sent messages going missing or previously downloaded emails being re‑downloaded. In response, Microsoft has issued a bunch of out-of-band emergency updates for Windows 11 and 10 and Windows Server 2019, 2022, and 2025 to solve the problem. This is not the first time that Microsoft has had to issue a patch for a patch. Just last week, it had to react when it inadvertently introduced two new bugs: an inability to connect to Windows Cloud PCs and an inability to shut down some machines with Secure Launch enabled. Prior to that, in October 2025, a patch caused a multitude of different issues, while in May 2025 Microsoft had to issue an out-of-band patch to fix a Windows 11 start-up failure. Microsoft said the latest out-of-band updates are cumulative and include security fixes and improvements from the January 13, 2026, security update (KB5074109) and the out-of-band update (KB5077744) from January 17, 2026. This article first appeared on Computerworld.
6 Okta security settings you might have overlooked

www.bleepingcomputer.com · 6 months ago

Okta misconfigurations can quietly weaken identity security as SaaS environments evolve. Nudge Security shows six Okta security settings teams often overlook and how to fix them.
Romania probes two suspects over alleged hitman-for-hire website

therecord.media · 6 months ago

Police seized devices and cryptocurrency in multiple raids aimed at an alleged assassins-for-hire platform, Romanian authorities said.
Upwind Raises $250 Million at $1.5 Billion Valuation

www.securityweek.com · 6 months ago

The CNAPP company will use the fresh investment to scale its runtime-first cloud security offering across data, AI and code.
Elon Musk’s X Faces EU Inquiry Over Sexualized AI Images Generated by Grok

www.nytimes.com · 6 months ago

European Union regulators have launched an investigation into X, formerly known as Twitter, regarding the spread of sexualized images generated by the artificial intelligence chatbot Grok. Authorities allege X has failed to adequately control the platform, leading to the widespread distribution of deepfakes, some depicting children. This investigation could intensify a dispute between Europe and the United States over online content regulation. Last month, X was already fined over 120 million euros for violating Digital Services Act rules.