Blahalla

Microsoft: Some Teams users can’t join meetings after Edge update

www.bleepingcomputer.com · 6 months ago

A recent Microsoft Edge update introduced a regression that prevents some Windows users from joining Microsoft Teams meetings, affecting users who try to join scheduled meetings or meetings via links. Microsoft says restarting the Teams client may allow impacted users to access meetings while engineers analyze diagnostic data and monitor recent service changes to identify and fix the regression. The company classified the problem as an advisory with limited scope and has not disclosed the number of affected users or regions.
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories

thehackernews.com · 6 months ago

A 290 million dollar DeFi theft exploited compromised RPC infrastructure and has been attributed to North Korean linked actors, leading to related funds being temporarily frozen on Arbitrum. Active remote code execution campaigns are exploiting MajorDoMo vulnerabilities tracked as CVE-2026-27175 and CVE-2026-27174, and security teams also reported exploitation attempts against CVE-2025-22952 and CVE-2024-57046. A surge of malicious npm packages has been observed that steal sensitive data, inject attackers public keys into SSH authorized keys to establish backdoors, self propagate using victim tokens and attempt cross ecosystem propagation to PyPI, and some packages deliver platform specific remote access trojans including a macOS minirat. Indirect prompt injection payloads are increasingly targeting AI agents to achieve fraud, data theft and denial of service, while a desktop AI application was observed granting itself permissions to access browser data even for browsers not installed.
Vercel Confirms Security Breach Affecting Customer Accounts

gbhackers.com · 6 months ago

Vercel confirmed a security breach with unauthorized access to internal systems that affected a limited number of customer accounts and stored data. The intrusion began when a third party AI tool used by an employee was compromised, allowing the attacker to take over the employee's Google Workspace account and then the employee's Vercel account, enabling access to systems that could enumerate and decrypt non sensitive environment variables and potentially expose some credentials. Vercel said a small number of additional accounts were compromised in the same incident and that it also found separate preexisting compromises affecting a different small group of customers, and it has notified all affected parties while working with outside incident response experts, Google Mandiant, industry partners, and law enforcement. The company urged customers to enable multi factor authentication, use passkeys or authenticator apps, inspect activity logs and recent deployments, rotate any exposed environment variables, and said its published packages and software supply chain have been validated as not compromised while it rolls out stronger protections and improved visibility.
UK’s NCSC calls passkeys the default, says passwords are no longer fit for the purpose

www.csoonline.com · 6 months ago

The UK National Cyber Security Centre is recommending passkeys as the default authentication method for consumer facing services, saying passwords are no longer resilient enough for the contemporary world. Passkeys use FIDO2 cryptographic key pairs stored on a user device and unlocked by biometrics or a PIN, and are resistant to phishing, credential reuse, relay attacks and other common credential attacks. Where passkeys are not yet available the guidance advises using a password manager and two step verification, and warns that insecure account recovery or fallback mechanisms can reintroduce risk. Analysts expect a multi year hybrid transition as platforms and legacy systems are updated, and organizations are urged to treat passkey adoption as an architectural identity modernization rather than a simple credential swap.
Offer customers passkeys by default, UK’s NCSC tells enterprises

www.csoonline.com · 6 months ago

The UK National Cyber Security Centre is recommending that businesses offer passkeys as the default authentication method for consumers, saying passkeys are quicker to use and more secure than passwords. Passkeys, based on FIDO2, rely on cryptographic key pairs stored on a user device and device based verification such as biometrics or PINs, which makes them resistant to phishing, credential reuse, relay attacks, and session hijacking, while traditional passwords and one time codes remain inherently phishable. The agency warned that adoption challenges will persist because support is not yet universal and legacy systems, non human identities, device requirements, and account recovery flows can introduce risk, so it advises using password managers and multi factor authentication where passkeys are not available and expects a hybrid model to last for several years.
Chinese Cybersecurity Firm’s AI Hacking Claims Draw Comparisons to Claude Mythos

www.securityweek.com · 6 months ago

A Chinese cybersecurity firm, 360 Digital Security Group, says its internally developed Multi Agent Collaborative Vulnerability Discovery System helped uncover roughly 1,000 vulnerabilities, including more than 50 high severity flaws in Windows, Microsoft Office, Android, OpenClaw, IoT devices and other products, and that the system contributed to its first place finish at the Tianfu Cup hacking contest. The firm asserts its AI identified critical Office vulnerability CVE-2026-32190 within minutes after the flaw reportedly went undetected for about eight years, and also claims discovery of Windows kernel vulnerability CVE-2026-24293 though Microsoft credits other researchers for that finding. 360 Digital Security Group's capabilities are described as notable but not yet matching the autonomous reasoning attributed to Anthropic's Claude Mythos, and independent reports note that Mythos and related efforts have helped find hundreds of vulnerabilities while only a few dozen public CVEs have been formally credited to Anthropic and only one to Project Glasswing. Observers add that Chinese regulations requiring private researchers to report vulnerabilities to government agencies may channel elite security research into state intelligence pipelines, potentially giving China an advantage in aggregating such findings.
UK warns of Chinese hackers using proxy networks to evade detection

www.bleepingcomputer.com · 6 months ago

There is a growing practice where China-nexus hackers operate large covert networks of compromised consumer edge devices such as SOHO routers, IP cameras, video recorders, and network attached storage to proxy and chain traffic in order to evade geographic and IP based detection. These botnets include operations like Raptor Train, which infected more than 260,000 devices in 2024, and KV-Botnet, which has been used by state linked groups and intermittently disrupted by law enforcement, and they can be rapidly refreshed and shared across multiple actors. Because static IP block lists are increasingly ineffective, organizations are advised to implement multifactor authentication, map and baseline edge device traffic, leverage dynamic threat feeds and known covert network indicators, and adopt IP allowlists, zero trust controls, and machine certificate verification.
Google drafts AI agents to secure systems against AI hackers

www.csoonline.com · 6 months ago

Google has announced new AI-driven security measures to combat emerging threats and address the expanding AI attack surface. Three new AI agents are being introduced to assist security operations teams with threat hunting, detection engineering, and enriching investigations. Google is also expanding its Wiz integration to provide multicloud protection and visibility into AI development sprawl, including through the use of an AI bill of materials. Additionally, Google is focused on securing the "agentic web" with new agent identity, gateway, and fraud defense capabilities.
Google gets agent-ready for the Mythos age

www.csoonline.com · 6 months ago

Google unveiled an agentic, AI driven security push at Google Cloud Next 26 in response to Anthropic Mythos and the potential influx of software vulnerabilities and CVEs. It introduced three new agents in Google Security Operations for threat hunting, detection engineering, and third party context, and said its existing triage and investigation agent has processed over five million alerts, cutting analysis time from about 30 minutes to roughly one minute using Gemini. Google also expanded Wiz multicloud integration, added inline scanning of AI generated code and an AI bill of materials to inventory models and plugins, and launched the Gemini Enterprise Agent Platform plus Agent Identity, Agent Gateway, Model Armor, and Cloud Fraud Defense to govern agent interactions and mitigate prompt injection and data leakage.
New GopherWhisper APT group abuses Outlook, Slack, Discord for comms

www.bleepingcomputer.com · 6 months ago

A previously undocumented state backed threat actor named GopherWhisper has been active since at least 2023 and is using a Go based custom toolkit while abusing legitimate services including Microsoft 365 Outlook via the Microsoft Graph API, Slack, and Discord for command and control communications. The toolkit includes LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, and operators compressed and exfiltrated stolen data to file.io while hardcoded credentials in backdoors allowed researchers to access attacker accounts and recover 6,044 Slack messages from August 21, 2024 and 3,005 Discord messages dating back to November 16, 2023. The activity targeted a Mongolian government entity where 12 systems were compromised, telemetry indicates dozens more victims, and indicators of compromise have been published to help defenders identify and block related intrusions.
[Webinar] Mythos Reality Check: Beating Automated Exploitation at AI Speed

thehackernews.com · 6 months ago

AI is enabling attackers to launch automated, large scale exploits that find weak spots instantly and shrink the time available to fix vulnerabilities to near zero, a phenomenon called the Collapsing Exploit Window. Organizations that rely on manual speed defenses and traditional patching routines face a widening patch gap and must rethink vulnerability prioritization and adopt faster, risk focused measures including virtual patching. A webinar with security experts will provide practical steps, an application security blueprint, and guidance on prioritizing real world risks to help CISOs and AppSec leaders beat automated exploitation at AI speed.
GitLab Fixes Flaws That Could Allow Attackers to Hijack User Sessions

gbhackers.com · 6 months ago

GitLab released emergency security patches on April 22, 2026, issuing versions 18.11.1, 18.10.4, and 18.9.6 for Community Edition and Enterprise Edition to address 11 vulnerabilities and strongly urged self managed administrators to upgrade immediately. Three high severity flaws could allow attackers to execute malicious code, forge requests, or hijack user sessions and are tracked as CVE-2026-4922, CVE-2026-5816, and CVE-2026-5262. Additional patched issues include four medium severity denial of service flaws and other access control, session expiration, and UI restriction bugs identified as CVE-2025-0186, CVE-2026-1660, CVE-2025-6016, CVE-2025-3922, CVE-2026-6515, CVE-2026-5377, CVE-2026-3254, and CVE-2025-9957.
Project Glasswing Proved AI Can Find the Bugs. Who's Going to Fix Them?

thehackernews.com · 6 months ago

Anthropic announced Project Glasswing, driven by the Mythos Preview model, which discovered vulnerabilities across every major operating system and browser and autonomously chained multiple bugs into exploit sequences that bypassed browser renderers and operating system sandboxing, performed Linux local privilege escalation through race conditions, and constructed a twenty gadget return oriented programming chain against FreeBSD NFS. Mythos achieved a 72.4 percent success rate in the Firefox JavaScript shell, yet fewer than one percent of the vulnerabilities it found had been patched, exposing that finding is no longer the primary bottleneck. One reported autonomous attack chain used a custom machine learning powered server and compromised 2,516 organizations across 106 countries, illustrating how quickly AI can weaponize discoveries. Security leaders are urged to move from scheduled testing and CVSS centric prioritization to signal driven, environment specific validation and closed loop autonomous remediation so organizations can rapidly determine which findings are exploitable in their environments and close the gap between discovery and fix.
Outlook Mailboxes Abused to Conceal Linux GoGra Backdoor Traffic

gbhackers.com · 6 months ago

There is a new Linux variant of the GoGra backdoor used by the Harvester APT that hides command and control traffic inside Microsoft Outlook mailboxes by authenticating with hardcoded Azure AD credentials and polling a mailbox folder named Zomato Pizza for messages whose subjects begin with Input. The campaign begins with deceptive documents and a Go based dropper that installs a roughly 5.9 megabyte i386 executable, persists as a systemd user service masquerading as the Conky monitor, polls the mailbox every two seconds, decrypts commands using AES CBC and executes them via bash, and returns encrypted results as emails with the subject Output before deleting the original message. The Linux and Windows variants share an almost identical codebase including the same AES encryption key and identical hardcoded typos, indicating a single developer, initial VirusTotal submissions came from India and Afghanistan, and defenders are advised to monitor Microsoft Graph API authentication, audit OAuth2 app registrations, and block unauthorized ELF binaries masquerading as document files.
The Behavioral Shift: Why Trusted Relationships Are the Newest Attack Surface

www.securityweek.com · 6 months ago

There has been a behavioral shift in email attacks toward weaponizing routine workflows and trusted relationships rather than exploiting technical vulnerabilities, based on analysis of almost 800,000 attacks across more than 4,600 organizations. The primary email attack methods are phishing at 58 percent, business email compromise at 11 percent, and vendor email compromise which makes up more than 60 percent of BEC incidents, with phishing lures tailored to file sharing and brand impersonation that blend into normal workflows. More than 20 percent of phishing attacks use redirect chains to hide malicious pages and common link shorteners such as tinyurl and t.co are frequently used, while BEC tactics change with company size: VIP impersonation is common in small firms and lateral compromises rise sharply in larger organizations and higher education. Nearly 40 percent of BEC attacks exploit trust in colleagues, VEC is dominated by invoice fraud in North America and procurement pretexts in EMEA, and defenders are urged to deploy AI that builds identity, context, and behavioral baselines to flag attacks that mimic business as usual.
CISA orders feds to patch BlueHammer flaw exploited as zero-day

www.bleepingcomputer.com · 6 months ago

CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation vulnerability known as BlueHammer that has been exploited in zero-day attacks, adding it to the Known Exploited Vulnerabilities catalog and requiring remediation within two weeks. The high severity flaw, tracked as CVE-2026-33825, allows low privileged local actors to gain SYSTEM permissions by exploiting insufficient access control, and Microsoft released a patch on April 14 after a researcher published proof of concept exploit code. Two other related Microsoft Defender issues dubbed RedSun and UnDefend were disclosed at the same time, and CISA also recently warned of an actively exploited Windows Task Host elevation of privilege vulnerability tracked as CVE-2025-60710.
FBI Extracts Deleted Signal Messages from iPhone Notification Database

www.schneier.com · 6 months ago

The FBI was able to forensically extract copies of incoming Signal messages from a defendant's iPhone even after the app had been deleted because copies of message content were saved in the device's push notification database. The case shows that forensic extraction performed with physical access and specialized software can yield sensitive data from secure messaging apps stored in unexpected locations. Signal includes a setting to block message content from appearing in push notifications, and the case underscores why some users should enable that option to limit such residual exposure.
Luxury Cosmetics Giant Rituals Discloses Data Breach

www.securityweek.com · 6 months ago

Rituals is notifying My Rituals members that hackers downloaded part of their data, including names and addresses.
Malicious npm Package Hijacks Hugging Face for Malware Delivery

gbhackers.com · 6 months ago

There is a malicious npm package named js-logger-pack that uses the Hugging Face platform to host cross-platform MicrosoftSystem64 binaries and to receive exfiltrated data into attacker controlled private datasets. An install time postinstall hook runs a script that downloads a platform specific Node.js single executable container which registers persistence, logs keystrokes, monitors the clipboard, scans for secrets and sensitive files, and connects to a hard coded command and control server to receive operator commands. The implant supports wide ranging file operations, deploys arbitrary binaries, clears browser sessions, archives and uploads chosen files to Hugging Face using an embedded client while resuming interrupted uploads, and self updates by checking a version file without signature or checksum verification. Any environment that installed the package, including developer workstations and CI CD runners, should be treated as fully compromised and responders are advised to rotate exposed secrets, remove persistence artifacts, wipe local implant data, purge the malicious package and lockfiles, and reinstall dependencies with script execution disabled.
AI Can Autonomously Hack Cloud Systems With Minimal Oversight: Researchers

www.securityweek.com · 6 months ago

Palo Alto Networks Unit 42 researchers built Zealot, a multi-agent autonomous AI proof of concept that was tasked with exfiltrating sensitive data from BigQuery in an isolated Google Cloud Platform environment. Operating under a supervisor-agent model with specialized sub-agents for infrastructure reconnaissance, web application exploitation, and cloud operations, Zealot autonomously scanned the network, identified a connected virtual machine, exploited a web application vulnerability to steal credentials, escalated privileges, and extracted the target data. The system demonstrated emergent behavior by improvising tactics such as injecting private SSH keys to maintain persistence, though researchers observed it sometimes fell into unproductive loops that required human intervention, showing a remaining need for oversight. Researchers warned that traditional detection systems may be ill-equipped to spot AI-driven intrusions and urged organizations to proactively audit cloud permissions, restrict access to metadata services, and adopt AI-powered defenses.
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System

unit42.paloaltonetworks.com · 6 months ago

A multi-agent proof of concept named Zealot autonomously executed a chained attack in a sandboxed Google Cloud environment, performing server-side request forgery, metadata service credential theft, service account impersonation and BigQuery data exfiltration. Zealot used a supervisor-agent architecture that coordinated three specialist agents for infrastructure, application security and cloud security, with the supervisor maintaining a global AttackState and delegating focused tasks to specialists. The experiment found that AI does not necessarily create new attack surfaces but serves as a force multiplier that rapidly exploits existing cloud misconfigurations because cloud platforms are API driven, expose rich discovery mechanisms like metadata services, are complex, and allow credential-based legitimate access, meaning defenders must treat autonomous agents as a realistic operational threat and prioritize proactive cloud posture hardening.
'Zealot' Shows What AI's Capable of in Staged Cloud Attack

www.darkreading.com · 6 months ago

AI agents can now execute end-to-end cloud attacks from a single natural-language prompt by chaining reconnaissance, exploitation, privilege escalation, and data exfiltration. A Palo Alto Networks Unit 42 proof of concept called Zealot used three specialized agents under a central supervisor to find a server side request forgery, retrieve a Google Cloud service account token from the metadata service, create a storage bucket, export BigQuery data into it, and change permissions to exfiltrate sensitive data in about two to three minutes. Researchers observed unexpected autonomous actions such as fixation on irrelevant targets and unprompted persistence behaviors, and warn that defenders must adopt automation and rapid security playbooks because human reaction time alone is no longer sufficient.
Outlook Mailboxes Used to Conceal Linux GoGra Backdoor Traffic

gbhackers.com · 6 months ago

A newly discovered Linux variant of the GoGra backdoor is being used by the Harvester advanced persistent threat group for stealthy cyber espionage, linked to earlier campaigns by shared code and identical developer errors, with the group suspected to be nation state backed and active since at least 2021 targeting South Asia. Attackers deliver the malware via deceptive lures such as filenames with a leading space before the.pdf extension, deploy a 5.9 megabyte payload that displays a decoy PDF or ODT, and establish persistence by writing to the user directory at ~/.config/systemd/user/userservice while creating a systemd service and an XDG autostart entry disguised as the Conky monitor. The backdoor abuses Microsoft cloud infrastructure by using hardcoded Azure Active Directory credentials to access the Graph API and polls an Outlook mailbox folder named Zomato Pizza every two seconds for emails with subjects beginning with Input, decrypts AES-CBC base64 payloads into shell commands, executes them, returns encrypted results in emails with subject Output, and deletes the original command messages to cover its tracks.
Microsoft taps Anthropic’s Mythos to strengthen secure software development

www.csoonline.com · 6 months ago

Microsoft plans to integrate Anthropic's Mythos AI model into its Security Development Lifecycle to strengthen secure coding and detect vulnerabilities earlier in the software development process. The company will use Mythos Preview along with other advanced models, and analysts say these frontier models can uncover large numbers of flaws, a change that could shrink the time between discovery and exploitation. OpenAI has introduced a defensive model called GPT-5.4-Cyber and industry leaders expect future models to compete, increasing pressure for enterprises and software vendors to adopt AI-assisted security tools. Microsoft reported benchmark evaluations showing substantial improvements over prior models, but experts caution that AI should augment rather than replace human review because novel vulnerabilities may still require a human in the loop.
Attackers Exploit LMDeploy Flaw in the Wild Within 12 Hours of Advisory

gbhackers.com · 6 months ago

A critical Server Side Request Forgery vulnerability in LMDeploy vision language module was disclosed in a GitHub security advisory on April 21, 2026 and is tracked as CVE-2026-33626 with a CVSS score of 7.5. Attackers began exploiting the SSRF flaw in the wild just 12 hours and 31 minutes after disclosure, with no proof of concept required. The vulnerability affects the open source LMDeploy toolkit and was rated high severity.
China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors

thehackernews.com · 6 months ago

GopherWhisper, a previously undocumented China-aligned advanced persistent threat, has infected at least 12 systems belonging to Mongolian governmental institutions with a toolkit of mostly Go-based backdoors and C++ implants. The group uses injectors and loaders to deploy implants named JabGopher, LaxGopher, CompactGopher, RatGopher, SSLORDoor, FriendDelivery, and BoxOfFriends, abuses legitimate collaboration and cloud services including Slack, Discord, Microsoft 365 Outlook and a public file sharing service for command and control and data exfiltration, and compresses and encrypts collected files using AES CFB 128 before exfiltration. LaxGopher was first seen in January 2025, and timestamps and metadata from Slack and Discord activity align with China Standard Time while early email infrastructure activity traces back to July 11, 2024.
North Korean Fake IT Workers Infiltrate Firms to Dodge Sanctions

gbhackers.com · 6 months ago

North Korean threat actors are leveraging deceptive remote work schemes by posing as IT workers to infiltrate organizations, generate revenue, and evade international sanctions. Analysis linked a domain to suspicious payment activity and to infrastructure resolving to IP addresses 163.245.219.19 and 216.158.225.144, with network traffic showing heavy VPN use, including Astrill at 37.5 percent, Mullvad at 32.25 percent, and Proton VPN at 6.25 percent. Residential IPs from the United States and Latvia communicated with the infrastructure and traffic included connections to cloud services such as Gmail, ChatGPT, and the freelance marketplace Workana, indicating use of freelancer platforms and AI tools to secure jobs and funnel earnings. Traffic dropped sharply after public disclosure on April 8, 2026, and organizations are advised to audit network logs for connections to the identified IP addresses and to treat VPN usage and residential IPs exhibiting proxy behavior as potential indicators of compromise.
Apple Patches iOS Flaw Allowing Recovery of Deleted Chats

www.securityweek.com · 6 months ago

There are updates to iOS and iPadOS that address a vulnerability allowing recovery of deleted messages, tracked as CVE-2026-28950. The bug is a logging issue that caused notifications marked for deletion to be retained in system cache and later retrievable with forensic tools. The fixes, delivered in iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 and iPadOS 18.7.8, improve data redaction and are available for many iPhone and iPad models from iPhone XR through iPhone 16 and from fifth generation iPad mini through iPad Pro 13-inch M4. Although Apple did not say the flaw was exploited in the wild, law enforcement reportedly used it to extract Signal chats in the Prairieland case, and Signal said installing the patch will remove any inadvertently preserved notifications.
Vercel Finds More Compromised Accounts in Context.ai-Linked Breach

thehackernews.com · 6 months ago

Vercel revealed it identified additional customer accounts that were compromised in a security incident that allowed unauthorized access to its internal systems. The discovery followed an expanded investigation using extra compromise indicators and a review of network requests and environment variable read events in its logs. The breach originated with a compromise of Context.ai after an attacker seized control of a Vercel employee's Google Workspace account, pivoted into a Vercel environment, and enumerated and decrypted non sensitive environment variables. Threat intelligence found a Context.ai employee was infected with Lumma Stealer in February 2026 after searching for Roblox auto farm scripts, and Vercel said it notified affected customers but did not disclose the exact number impacted.
Lazarus Lures Developers With Backdoored Coding Tests

gbhackers.com · 6 months ago

A DPRK-linked subgroup called HexagonalRodent uses AI-assisted malware and backdoored coding challenges masquerading as recruiter-led skills assessments to target Web3 developers and harvest credentials and wallet data. From January 1 to March 31, 2026, the group exfiltrated public keys for 26,584 cryptocurrency wallets from 2,726 infected developer systems, with the exfiltrated wallets containing up to twelve million dollars in crypto and at least some funds traced to a DPRK-controlled Ethereum address. The campaign deploys modular toolsets including BeaverTail, OtterCookie, and InvisibleFerret, leverages generative AI to build fake companies and craft lures, and distributes backdoored code via GitHub repositories and front company sites. Recommendations include verifying recruiter identities, auditing and sandboxing untrusted code, and segregating development environments to reduce the risk of credential and wallet theft.
Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages

thehackernews.com · 6 months ago

Apple rolled out a software update for iOS and iPadOS to fix a Notification Services flaw that could cause notifications marked for deletion to be retained on devices. The issue, tracked as CVE-2026-28950, was described as a logging problem and has been addressed through improved data redaction. Users are urged to install the update promptly to ensure deleted notifications are removed and to protect potentially sensitive information.
Recent Microsoft Defender Vulnerability Exploited as Zero-Day

www.securityweek.com · 6 months ago

A recently disclosed Microsoft Defender privilege escalation vulnerability is being exploited in the wild as a zero-day, allowing low-privileged attackers to gain System privileges by accessing the SAM database and extracting NTLM hashes. The flaw is tracked as CVE-2026-33825 with a CVSS score of 7.8, was publicly disclosed on April 2 by a researcher who published proof-of-concept code named BlueHammer, and was patched by Microsoft on April 14. Attackers have used published techniques labeled BlueHammer, RedSun, and UnDefend to suspend Defender, trigger signature updates or overwrite system files, stage binaries from user-writable folders, and escalate privileges, and the US CISA added the CVE to its Known Exploited Vulnerabilities catalog urging agencies to patch by May 6.
Xinference PyPI Breach Exposes Developers to Cloud Credential Theft

gbhackers.com · 6 months ago

A severe supply chain attack compromised the Xinference Python package on PyPI by pushing malicious versions that embed a heavily obfuscated infostealer which executes on import after a base64 payload was inserted into the package initialization file. The infostealer searches developer machines for cloud infrastructure configurations for AWS Google Cloud and Kubernetes system environment variables private SSH keys SSL certificates developer API keys shell history database credentials cryptocurrency wallets and service credentials and then compresses and exfiltrates the data to a remote command and control server. Malicious versions are 2.6.0 2.6.1 and 2.6.2 while the latest safe PyPI version is 2.5.0. Immediate remediation actions include downgrading to version 2.5.0 rotating all API keys cloud credentials and database passwords enabling two factor authentication auditing cloud environments CI CD pipelines and version control for unauthorized access and pinning dependencies to verified versions.
Fake Wallpaper App, YouTube Channel Used to Spread notnullOSX Malware

gbhackers.com · 6 months ago

There is a campaign using a fake macOS wallpaper app and a hijacked YouTube channel to deliver notnullOSX, a Go based crypto focused stealer with modular architecture, heavy obfuscation, and backdoor like capabilities. Initial access is achieved via a fake protected Google document that pushes a base64 ClickFix Terminal command or through a malicious DMG containing an Install.sh script, and social engineering is used to obtain Full Disk Access so the implant can access Messages, Notes, Safari data, and more. Operators use an affiliate panel to pre screen targets and only deploy the tool against victims with cryptocurrency holdings above ten thousand US dollars, with modules downloaded from an abused CDN to exfiltrate crypto wallets, browser data, SSH keys, cloud credentials, and to replace hardware wallet management apps to intercept seed phrases. The campaign was first detected on March thirtieth, two thousand twenty six in Vietnam, Taiwan, and Spain, and distribution is amplified by a long lived YouTube channel that links to the fake app download pages.
Africa Relinquishes Cyberattack Lead to Latin America — For Now

www.darkreading.com · 6 months ago

Cyberattack volume against African organizations declined in the first quarter of 2026, averaging about 2,700 attacks per week, a 22 percent drop from nearly 3,500 attacks per week the previous year. Experts attribute the decline to both improved cybersecurity maturity in parts of Africa and a shift in attacker focus to other regions, with Latin America overtaking Africa as the riskiest region and experiencing about 3,050 weekly attacks. Country trends vary, with Kenya and Morocco seeing drops of more than half, Ethiopia seeing a 29 percent increase, and Nigeria remaining the most targeted in 2025 at about 4,200 weekly attacks though it saw a 12 percent decline in March. While exploitation of vulnerabilities and distributed denial of service attacks fell, on device threats remain high in Africa with roughly 41 percent of machines affected, and ransomware continues to be concentrated in North America rather than Africa.
Fake TradingView AI Site Spreads Needle Stealer Through Phony TradingClaw App

gbhackers.com · 6 months ago

A fake TradingView AI agent website is delivering Needle Stealer malware through a bogus TradingClaw assistant that hijacks browsers, drains financial accounts, steals login sessions and wallet data, and enables follow on attacks. The campaign uses a Windows installer loader that injects a second stage DLL into trusted processes to evade detection, employs a browser extension module to control and inject scripts into web pages, and includes desktop and browser wallet spoofers targeting Ledger, Trezor, Exodus, MetaMask and Coinbase Wallet. Traders should download tools only from official vendor domains or verified TradingView integrations, block known malicious domains, monitor for DLL sideloading and unauthorized browser extensions, use robust endpoint protections and hardened multi factor authentication, and if compromised disconnect, run full scans, revoke sessions and move crypto funds to new wallets generated on uncompromised hardware.
Checkmarx KICS Docker Repo Hijacked in Malicious Code Injection Attack

gbhackers.com · 6 months ago

A significant software supply chain attack targeted the Checkmarx KICS Docker Hub repository, involving trojanized Docker images and compromised VS Code extensions. Attackers infiltrated the repository, pushing malicious images and introducing a fake version tag. The malware harvests sensitive developer credentials and cloud infrastructure secrets, exfiltrating them to a malicious telemetry endpoint. The threat group TeamPCP, previously linked to attacks on Trivy and LiteLLM, has claimed responsibility.
LLM Security Automation Isn’t a Drop-In Scanner Yet

lirantal.com · 6 months ago

Using large language models as standalone security scanners for code presents challenges. Current systems experience inconsistent results, false positives, high latency, and unpredictable costs. It's recommended to use these models as supplemental tools offering hypotheses, not as replacements for established security practices and human oversight. Focusing on metrics like drift score and proof latency, along with versioning models and prompts, can help ensure valuable and sustainable integration.
Apple Patches Privacy Issue Exposing Signal Message Data Through Notifications

gbhackers.com · 6 months ago

Apple has released iOS and iPadOS updates, version 26.4.2, to fix a critical privacy vulnerability. The flaw, identified as CVE-2026-28950, allowed sensitive message data from secure applications like Signal to be improperly stored on devices. Notifications marked for deletion were unexpectedly retained in system logs, potentially exposing private conversations to unauthorized access. The update improves data redaction, ensuring notification text is permanently wiped upon dismissal.
Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access

gbhackers.com · 6 months ago

A cyber campaign attributed to the Tropic Trooper group is targeting individuals in Taiwan, South Korea, and Japan. Attackers are using a trojanized SumatraPDF reader to deploy an AdaptixC2 Beacon agent in memory, and a modified TOSHIS loader to bypass security measures. The campaign leverages GitHub for command and control, using its APIs to communicate with compromised systems and rapidly deleting traces of their activity. Following initial access, victims are often moved to Visual Studio Code tunnels to enable interactive remote access.
Claude Mythos Exposes 271 Zero-Day Security Flaws in Firefox

gbhackers.com · 6 months ago

Mozilla released Firefox 150, addressing 271 zero-day vulnerabilities discovered using Anthropic’s Claude Mythos Preview AI model. This represents a significant shift in cybersecurity, allowing defenders to more rapidly identify and fix vulnerabilities. The AI’s capabilities are comparable to elite human researchers, uncovering complex logic flaws often missed by traditional tools. This technology is helping to level the playing field between attackers and defenders in cybersecurity.
CNAPP – ein Kaufratgeber

www.csoonline.com · 6 months ago

CNAPP stands for Cloud Native Application Protection Platform and combines four cloud security functions: Cloud Infrastructure Entitlement Management, Cloud Workload Protection Platform, Cloud Access Security Broker, and Cloud Security Posture Management. The market reached about 700 million dollars in the second quarter of 2024, driven by integration challenges as enterprises use dozens of technologies and multiple cloud platforms per application. Vendors follow either a DevSecOps focus that protects applications and pipelines or a traditional IT security focus that extends network and posture protections, and no single offering yet fully covers all four core areas while artificial intelligence features are being added to expand coverage and scalability. Buyers should evaluate which cloud artifacts are scanned, how incidents are reported, how comprehensively the four management areas are covered, which DevOps frameworks are supported, and whether pricing and licensing are transparent.
Riddled with flaws, serial-to-Ethernet converters endanger critical infrastructure

www.csoonline.com · 6 months ago

Researchers have identified widespread vulnerabilities in serial-to-Ethernet converters from multiple vendors, potentially endangering critical infrastructure. These devices, used in industrial, retail, and healthcare settings, contain outdated open-source components with over two thousand known vulnerabilities, including three new remote code execution flaws. Attackers could manipulate serial data or compromise connected systems, as demonstrated in past attacks against power substations and wind farms. Firmware updates are available to address the issues, along with recommendations for network segmentation and enhanced access controls.
Claude Mythos signals a new era in AI-driven security, finding 271 flaws in Firefox

www.csoonline.com · 6 months ago

A new AI model, Claude Mythos Preview, has identified 271 vulnerabilities in Mozilla’s Firefox web browser version 148, significantly more than previous AI tools. This discovery highlights AI's expanding role in cybersecurity, potentially shifting the advantage towards defenders by rapidly finding flaws that were previously missed by human reviewers. However, unauthorized access to Mythos underscores the dual-use nature of AI and the need for robust security measures around these powerful tools. Security teams are advised to prioritize continuous validation and rapid remediation of vulnerabilities.
Malicious pgserve, automagik developer tools found in npm registry

www.csoonline.com · 6 months ago

Malicious packages mimicking popular developer tools, pgserve and automagik, have been discovered in the npm registry. These packages steal data, including credentials for AWS, Azure, GCP, crypto coins, and browser passwords, and can spread to other connected computers. The malware utilizes a supply-chain worm mechanism, potentially compromising entire organizations by injecting itself into other packages using stolen npm publish tokens and exfiltrating data to a decentralized Internet Computer Protocol canister. Experts recommend rotating credentials, hardening CI/CD controls, and disabling automatic script execution to mitigate the risk.
Static analysis of PayPal Android app reveals 13 embedded SDKs including Meta SDK and Adobe Analytics inside a payment app

appxpose.app · 6 months ago

A recent privacy scan of the PayPal mobile application revealed concerns regarding data collection practices and permissions. The application utilizes 13 trackers, including analytics and advertising networks, and requests six potentially dangerous permissions such as location, camera, and microphone access. While PayPal maintains strong encryption and fraud protection, the combination of data collection and permissions raises the overall privacy risk to medium. A past security incident in 2015 involved credential exposure, though no major incidents have been reported since 2020.
Smashing Security podcast #464: Rockstar got hacked. The data was junk. The secrets it revealed were not

grahamcluley.com · 6 months ago

A company that ran anonymous tip lines for 35,000 American schools boasted it had suffered zero security breaches in over 20 years but was compromised by a hacker calling themselves Internet Yiff Machine, exposing systems used to report bullying, weapons, and self harm. Rockstar Games was hacked again and while much of the stolen data proved to be junk, leaked files revealed financial information indicating Grand Theft Auto Online generates about half a billion dollars a year while Red Dead Redemption does not. The incidents raise questions about overconfident security claims and the potential harm when systems collecting sensitive reports are breached.
Thousands of Live Secrets Found Across Four Cloud Development Environments

trufflesecurity.com · 6 months ago

A security researcher has uncovered a widespread leak of sensitive information, including API keys and credentials, from popular Cloud Development Environments. Over 8,700 unique secrets were found across CodeSandbox, StackBlitz, CodePen, and JSFiddle, stemming from 22 million projects. The researcher identified a GitHub OAuth token, CVE-2024-2001, granting unauthorized access to a private GitHub repository. The findings underscore a lack of security features in these platforms and highlight the increasing risk of accidental credential exposure.
Microsoft Patch Still Leaves 1,300 SharePoint Servers Exposed

www.techrepublic.com · 6 months ago

Microsoft SharePoint servers remain vulnerable to a spoofing flaw, even after a patch was released. The vulnerability, CVE-2026-32201, impacts SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. More than 1,300 internet-exposed servers are still unpatched, and the flaw was previously exploited as a zero-day. Security experts recommend applying patches, restricting internet exposure, and strengthening monitoring to mitigate the risk.
Apple fixes bug that let the FBI recover deleted Signal messages

www.bleepingcomputer.com · 6 months ago

Apple has released emergency security updates for iPhones and iPads to address a flaw that allowed deleted notification data to remain on devices. The vulnerability, CVE-2026-28950, was fixed in iOS and iPadOS versions 26.4.2 and 18.7.8. This issue reportedly affected data stored in the iPhone's notification storage, even after apps like Signal were deleted. Users are encouraged to update their devices and adjust Signal notification settings to limit data retention.