Blahalla

Operation PowerOFF identifies 75k DDoS users, takes down 53 domains

www.bleepingcomputer.com · 6 months ago

There are more than 75,000 individuals using DDoS-for-hire platforms who were warned during the latest phase of Operation PowerOFF. The coordinated action, supported by Europol across 21 countries, resulted in four arrests, the takedown of 53 domains, and 25 search warrants. Authorities say the operation is moving into a prevention phase that includes awareness campaigns, search engine ads aimed at young people, removal of more than 100 URLs that promote illegal services, and adding on-chain warning messages tied to illicit payments, building on earlier phases that seized databases with over three million criminal accounts.
RCE by design: MCP architectural choice haunts AI agent ecosystem

www.csoonline.com · 6 months ago

AI agent building tools that support the Model Context Protocol may expose systems to remote code execution because the STDIO transport in Anthropic’s reference implementation allows client-supplied commands to be executed without safe defaults. With STDIO, clients can launch MCP servers as subprocesses and pass parameters that, if not filtered, run with the parent process permissions and are only reported as errors after execution. Researchers testing many IDEs, frameworks, and services found more than 30 RCE issues across live deployments and open source projects, with attack vectors including changing transport types in MCP configurations and prompt injection, while many maintainers treat the behavior as intentional or rely on other mitigations. Ten of the reported issues have received CVE identifiers, and researchers recommend SDKs adopt safer defaults such as command allowlisting and require developers to sanitize STDIO parameters.
ZionSiphon malware designed to sabotage water treatment systems

www.bleepingcomputer.com · 6 months ago

A new malware named ZionSiphon has been designed to target operational technology in water treatment and desalination environments with the intent to sabotage operations. It contains routines to adjust hydraulic pressures and maximize chlorine dosing by appending configuration entries such as Chlorine Dose 10, Chlorine Pump ON, Chlorine Flow MAX, Chlorine Valve OPEN and RO Pressure 80 and it scans for industrial protocols including Modbus, DNP3 and S7comm. It also spreads via USB by copying itself as a hidden svchost.exe and creating malicious shortcut files to execute when clicked, and its Modbus code is only partially functional while other protocol support remains placeholder. Researchers found a flawed encryption validation and an XOR mismatch in the country targeting logic that causes the current build to self destruct and prevents it from activating but they warn a future fixed release could make it operational and dangerous with apparent focus on Israeli targets.
A Deep Dive Into Attempted Exploitation of CVE-2023-33538

unit42.paloaltonetworks.com · 6 months ago

There are active automated scans attempting to exploit CVE-2023-33538, a command injection flaw affecting end of life TP Link Wi Fi routers including TL WR940N v2 and v4, TL WR740N v1 and v2, and TL WR841N v8 and v10. Observed exploit attempts seek to download and run a Mirai like arm7 binary by injecting commands into the router web interface to download a binary, change permissions, and execute it, and many requests used Basic Authentication with username admin and password admin which makes default credentials a practical infection vector. Firmware emulation and reverse engineering confirm that the ssid1 parameter in the userRpm WlanNetworkRpm endpoint is unsanitized and can permit command injection leading to arbitrary system command execution, though many in the wild exploit payloads were flawed and would fail. Affected devices are end of life with no vendor patches available, so replacement and avoidance of default credentials are recommended.
NIST cuts down CVE analysis amid vulnerability overload

www.csoonline.com · 6 months ago

There are significant operational changes at the National Institute of Standards and Technology to address an escalating volume of security flaws, with the agency now prioritizing enrichment only for the most critical vulnerabilities. NIST will focus enrichment on items appearing in CISA's Known Exploited Vulnerabilities catalog and other high priority software used by the federal government and critical software, aiming for enrichment within one business day while marking other entries as not scheduled and stopping recalculation of severity scores when a reporting organization provides one. The backlog began accumulating in early 2024 after submissions grew 263 percent between 2020 and 2025, NIST enriched nearly 42,000 vulnerabilities in 2025 and now reports a backlog of more than 30,000, while industry forecasts expect about 59,427 vulnerabilities for 2026 and warn that AI driven flaw discovery is accelerating the problem.
NIST Revamps CVE Framework to Focus on High-Impact Vulnerabilities

www.darkreading.com · 6 months ago

NIST is changing its criteria for which software flaws receive detailed analysis in the Common Vulnerabilities and Exposures framework, adopting a risk based model after falling behind under a rapidly growing backlog. Beginning April 15, 2026, NIST will continue to add all submitted vulnerabilities to the National Vulnerability Database but will only prioritize and provide detailed scoring for a subset, focusing on vulnerabilities on the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities list and flaws in critical software defined under Executive Order 14028. NIST cited a 263 percent increase in submissions between 2020 and 2025 and higher volumes in early 2026, and experts say the change shifts remediation toward threat intelligence and real world exploitability while potentially disrupting legacy auditing workflows.
Pentagon Seeks Help From Ford and G.M.

www.nytimes.com · 6 months ago

false
RedSun: How Windows Defender's Remediation Became a SYSTEM File Write

nefariousplan.com · 6 months ago

RedSun is a local privilege escalation chain that abuses Windows Cloud Files sync roots and a mount point reparse to cause Windows Defender, running as SYSTEM, to follow a tracked origin path into System32 and overwrite a service binary. The chain registers a sync provider and placeholder, stamps a mount point reparse pointing to C:\Windows\System32, then triggers Defender to remediate the placeholder and copy the attacker binary over TieringEngineService.exe, which is then launched as SYSTEM. A previous independent exploit called BlueHammer was patched as CVE-2026-33825, but RedSun was unpatched as of April 16, 2026, and the researcher warns similar variants are likely because the root cause is Defender remediating paths without validating canonicalized write targets. Short term mitigations include applying attack surface reduction rules, auditing and alerting on unexpected CfRegisterSyncRoot registrations and FSCTLSETREPARSEPOINT operations against Cloud Files roots, and monitoring unexpected modifications to TieringEngineService.exe.
World Leaks: RDP Access Leads to Custom Exfiltration and Personalized Extortion

breachcache.com · 6 months ago

A two day intrusion began with an RDP brute force using a company specific wordlist, allowing operators to run an open source privacy hardening script to disable endpoint defenses, deploy a Cobalt Strike stager and a Go based loader named lactenin.exe, and move laterally to the domain controller and backup server. Operators then ran a Rust based exfiltration platform called RustyRocket agent.exe in normal mode to index and copy files over SMB and stream data over HTTPS to more than 6,900 unique Cloudflare backed IP addresses, and recovered operator documentation describing three operating modes and a companion pivoting proxy for segmented networks. Following exfiltration they placed personalized extortion notes addressed by name to each employee with separate leadership and staff templates, directed the victim to a negotiation portal, initially demanded 200,000 in Bitcoin and negotiated down to 85,000 with full negotiation chats and indicators of compromise provided.
New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges

www.bleepingcomputer.com · 6 months ago

A researcher known as Chaotic Eclipse published a proof-of-concept exploit for a Microsoft Defender zero-day called RedSun and said the release was a protest over how Microsoft handles vulnerability disclosures. The exploit is a local privilege escalation that grants SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server when Microsoft Defender is enabled. The proof of concept abuses the Cloud Files API by writing an EICAR test string, using an opportunistic lock to win a volume shadow copy race, and leveraging a directory junction to redirect a Defender file rewrite to the system TieringEngineService executable so the attacker-planted binary is executed as SYSTEM, and some vendors initially detected the exploit because of the embedded EICAR but detections were reduced by encrypting it. A prior related exploit called BlueHammer was tracked as CVE-2026-33825 and was fixed by Microsoft in April Patch Tuesday.
I Feel So Sorry for My A.I. Sunglasses

www.nytimes.com · 6 months ago

false
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555)

r3verii.github.io · 6 months ago

There is a vulnerability CVE-2026-33555 in HAProxy HTTP 3 standalone QUIC handling where a single QUIC STREAM frame with zero payload and the FIN bit set can cause HAProxy to forward a request with a Content-Length header indicating a body that contains zero bytes. The backend then waits for the declared body bytes that never arrive and the next user request on the same pooled TCP connection has its first bytes consumed as the missing body, enabling cross-user cross-protocol HTTP request smuggling. Affected versions include HAProxy 2.6 through 3.3.5 when compiled with QUIC support, and fixes are available in versions 3.3.6, 3.2.15, 3.0.19, 2.8.20 and 2.6.25.
North Korea Uses ClickFix to Target macOS Users' Data

www.darkreading.com · 6 months ago

Sapphire Sleet is using ClickFix techniques to target macOS users by posing as recruiters and directing targets to run a compiled AppleScript named Zoom SDK Update.scpt during bogus technical interviews. The staged payloads use curl to execute multiple AppleScript modules that install credential harvesters, a data stealer that targets cryptocurrency wallets, browsers, keychains, Apple Notes, and Telegram, and multiple backdoors, while bypassing Apple’s Transparency, Consent, and Control protections by renaming and modifying TCC files and database entries to suppress prompts. Microsoft reported the campaign to Apple, which implemented mitigations, and recommends educating users about ClickFix social engineering, blocking or restricting.scpt files and unsigned Mach-O binaries downloaded from the Internet, exercising caution when copying and pasting sensitive data, and protecting wallets and browser credential stores.
McGraw-Hill Confirms Data Exposure, Hackers Claim 45M Salesforce Records Leaked

www.techrepublic.com · 6 months ago

McGraw Hill confirmed unauthorized access to a limited set of internal data after a reported Salesforce misconfiguration, while the extortion group ShinyHunters claimed it had obtained up to 45 million Salesforce records including personally identifiable information. The company says its investigation found only limited non sensitive data exposure and that the incident did not involve unauthorized access to its Salesforce accounts, customer databases, courseware, or internal systems. Security experts warned that extortion actors frequently inflate scope to increase leverage and that SaaS misconfigurations create downstream risks such as impersonation, credential harvesting, identity fraud, and harassment, and they recommended continuous configuration audits, stronger identity and access controls, least privilege, multifactor authentication, data loss prevention, and centralized logging and monitoring.
'Harmless' Global Adware Transforms Into an AV Killer

www.darkreading.com · 6 months ago

An update pushed by Dragon Boss on March 22, 2025 converted its adware into malware that disabled multiple antivirus products including ESET, McAfee, Kaspersky, and Malwarebytes, established persistence via scheduled tasks, and arranged for future payloads to be excluded from Windows Defender. Researchers at Huntress sinkholed the campaign after identifying its update infrastructure and found the adware on more than 23,500 systems in 124 countries, with roughly half of the infections in the United States, priming those machines for follow on attacks such as ransomware or botnets. Among the infected were 35 government entities, 41 operational technology networks, 221 higher education institutions, and several Fortune 500 companies, and researchers noted the malicious update used Advanced Installer update functionality and included inline comments suggesting possible AI assistance.
NTT Research Launches Scale Academy to Bring Lab Technology to Market

www.techrepublic.com · 6 months ago

NTT Research launched Scale Academy to turn lab and R and D innovations into market ready products, with Bennett Indart leading the incubator and SaltGrain as its inaugural offering. Scale Academy operates with product style governance, funding gates, timelines, and a fail fast discipline to identify commercially viable technologies and pursue spinouts or external partners. SaltGrain combines attribute based encryption that embeds access policies in ciphertext with an AI driven data classification engine and recent optimizations aimed at post quantum resistance to enable fine grained, zero trust data sharing. NTT will be measured by whether SaltGrain wins paying reference customers in regulated industries and whether the incubator transparently meets milestones and attracts external partners over the next 18 to 24 months.
Cisco Webex Services Certificate Validation Vulnerability

sec.cloudapps.cisco.com · 6 months ago

There is a vulnerability in the integration of single sign on with Control Hub in Cisco Webex Services that could have allowed an unauthenticated remote attacker to impersonate any user. The issue was caused by improper certificate validation and could be exploited by connecting to a service endpoint and supplying a crafted token, and while the service has been patched affected customers using SSO must upload a new identity provider SAML certificate to Control Hub because there are no workarounds. Security Impact Rating Critical, CVE CVE-2026-20184.
Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

thehackernews.com · 6 months ago

There is an active malicious campaign targeting workers in the Czech Republic with a previously undocumented botnet dubbed PowMix that has been observed since at least December 2025. The infection chain begins with a malicious ZIP file likely delivered by phishing and uses a Windows shortcut to launch a PowerShell loader that extracts, decrypts, and runs the malware in memory, then establishes persistence via a scheduled task while checking the process tree to avoid duplicate instances. PowMix facilitates remote access, reconnaissance, and remote code execution, embeds encrypted heartbeat data and unique victim identifiers in C2 URL paths, uses randomized beaconing intervals to evade network detection, supports commands that enable self deletion and C2 migration, and shows tactical overlap with prior ZIP based campaigns while its ultimate payload and motives remain unclear.
What Is ‘Jagged Intelligence’ and How Can It Reframe the AI Debate?

www.nytimes.com · 6 months ago

false
Government Can’t Win the Cyber War Without the Private Sector

www.securityweek.com · 6 months ago

There is a growing consensus that governments cannot secure national digital infrastructure alone and that securing national resilience now depends on faster and deeper partnerships with the private sector. Cyber threats have risen in scale and sophistication, commonly targeting multiple attack surfaces such as endpoints, networks, cloud infrastructure, applications, and identity, while AI is accelerating attack timelines and widening risk. Because critical technology and infrastructure are largely built and operated by private companies, public private coordination is required for faster threat intelligence sharing, secure by design AI, aligned governance, and joint disruption of criminal infrastructure across borders. Cybercrime has become industrial and persistent with strong financial incentives, so coordinated offensive measures against the broader criminal ecosystem are necessary rather than isolated defensive actions.
Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face

www.bleepingcomputer.com · 6 months ago

Hackers are exploiting critical remote code execution vulnerability CVE-2026-39987 in the Marimo reactive Python notebook to deliver a new NKAbuse malware variant hosted on Hugging Face Spaces. Attackers create typosquat Spaces such as vsccode-modetx to host a dropper script named install-linux.sh and a kagent binary, which is fetched and executed to install the payload and establish persistence via systemd, cron, or macOS LaunchAgent. The NKAbuse variant functions as a remote access trojan that executes shell commands, exfiltrates output, leverages NKN and WebRTC technologies for command and control, and operators have used stolen environment credentials to pivot to PostgreSQL and Redis instances. Mitigations include upgrading Marimo to version 0.23.0 or later immediately or blocking external access to the terminal websocket endpoint.
Malicious WordPress Plugins with Backdoors Compromise Thousands of Websites

www.techrepublic.com · 6 months ago

31 WordPress plugins in the Essential Plugin portfolio contained hidden backdoors that compromised thousands of websites and were permanently closed by WordPress. A security researcher found the plugins had been sold to a new owner and that, beginning August 8, 2025, modified releases such as version 2.6.7 of Countdown Timer Ultimate added 191 lines of malicious code that lay dormant for eight months and affected installations including one plugin with over 20,000 active installs. The backdoor resolved its Command and Control servers via an Ethereum smart contract to persistently update the infrastructure, and site owners are advised to delete the affected plugins, apply researcher patches if available, and audit installed plugins regularly.
Building your cryptographic inventory: A customer strategy for cryptographic posture management

www.microsoft.com · 6 months ago

Post quantum cryptography readiness starts with building a comprehensive cryptographic inventory that catalogs certificates, keys, protocols and cipher suites, cryptographic libraries, algorithms in code, encrypted session metadata, secrets, and hardware security modules. A cryptographic posture management lifecycle is a continuous cycle of Discover, Normalize, Assess risk, Prioritize, Remediate, and Continuous Monitoring applied across code, network, runtime, and storage domains. Maintaining an inventory enables governance, compliance, and risk prioritization, and around 15 countries and the European Union already recommend or require cryptographic inventorying through regulations such as DORA, OMB M-23-02, and PCI DSS 4.0. Organizations should implement customer-led operating models that combine tooling, automation, continuous monitoring, and partner solutions to accelerate cryptographic modernization and quantum-safe readiness.
Sometimes changing the password on your email mailbox isn’t enough

www.fortra.com · 6 months ago

New research shows roughly one in ten Microsoft 365 accounts compromised in Q4 2025 had malicious mailbox rules added shortly after access, in some cases within five seconds of the initial breach. Attackers create rules that silently forward, hide, or delete messages to exfiltrate data, suppress security alerts, and intercept communications, and those rules can persist through a password reset. Attacker created rules are often given short nonsensical names such as a single dot, sequences of dots, or semicolons, and one case involved a hidden rule that concealed payment related messages and enabled a phishing campaign that led to additional compromises. Recommended defenses include disabling automatic external forwarding, enforcing multi factor authentication and conditional access, monitoring OAuth app grants, revoking active sessions and refresh tokens, removing unexpected mailbox rules, and reviewing sign in logs.
Two-Factor Authentication Breaks Free from the Desktop

www.darkreading.com · 6 months ago

Two-factor authentication is expanding beyond desktop IT systems into the physical world to protect connected cars, medical devices, HVAC systems, and other Internet of Things targets. Automakers and vendors are testing solutions such as in-vehicle hardware paired with mobile one-time passwords, ultra-wideband proximity keys, biometrics, and pin-to-drive models to counter relay attacks and key cloning, but usability and the absence of clear standards slow adoption. Healthcare organizations are adding multifactor controls for clinicians interacting with devices and patient records because SMS-based codes remain vulnerable to interception and SIM swapping. Regulators are unlikely to mandate specific authentication methods immediately, yet industry groups and broader cybersecurity requirements are driving increased uptake.
Google expands Gemini AI use to fight malicious ads on its platform

www.bleepingcomputer.com · 6 months ago

Google is increasingly using its Gemini AI models to detect and block harmful ads across its advertising platforms as scammers use generative AI and evasive techniques such as cloaking and redirects. In 2025, 8.3 billion ads were blocked or removed and 24.9 million advertiser accounts were suspended globally, including 602 million scam-related ads, and in the United States 1.7 billion ads were removed and 3.3 million accounts suspended. Gemini analyzes billions of signals beyond keywords, including advertiser behavior, account history, campaign patterns, and intent, enabling real-time blocking at submission for many Responsive Search Ads, reducing incorrect advertiser suspensions by 80 percent, and Google plans to expand Gemini to additional ad formats and enforcement systems.
Microsoft's Original Windows Secure Boot Certificate Is Expiring

www.darkreading.com · 6 months ago

The original 2011 UEFI Secure Boot certificates for Windows will start expiring on June 24, 2026, and Microsoft is urging IT and security teams to update the certificates on all Windows PCs made before 2024 so they continue to receive security updates. Secure Boot serves as the hardware based root of trust that verifies cryptographic signatures at startup to block unauthorized firmware and bootloaders, and Microsoft warned that expired certificates will prevent updates to the UEFI databases DB and DBX, increasing exposure to UEFI bootkits such as BlackLotus, FinSpy, and MoonBounce. Microsoft has added a Secure Boot certificate status indicator in the Windows Security app and plans to add notifications next month to help users and administrators identify devices that need the refresh, while advising organizations to consult its playbook, inventory endpoints, and confirm OEM firmware prerequisites. Windows 10 devices enrolled in Microsoft s Extended Security Update program will receive the new certificates, but Windows 10 systems not in ESU may not automatically get them and older devices could gradually lose Secure Boot functionality if not updated.
Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

www.microsoft.com · 6 months ago

A North Korean threat actor known as Sapphire Sleet ran a macOS intrusion campaign that relied on social engineering to trick users into manually executing a compiled AppleScript disguised as a legitimate software update. Attackers hid malicious logic in large decoy comment blocks so users would not see it, used Script Editor to run shell commands and launched signed system binaries, then fetched additional AppleScript with curl and executed it with osascript to deliver multi stage payloads. The campaign used fake system dialogs to harvest credentials, manipulated the macOS Transparency Consent and Control database, established persistence via launch daemons, and exfiltrated credentials, sensitive data, and cryptocurrency assets while operating outside Gatekeeper and quarantine protections. Apple was informed and implemented mitigations, and defenders are advised to keep macOS up to date, use layered security controls, and apply the provided detections and hunting guidance to identify similar intrusion activity.
They Were YouTube’s First Stars. Here’s What They Wish They’d Known.

www.nytimes.com · 6 months ago

There are early YouTube creators MatPat, Miranda Sings, Grace Helbig and WheezyWaiter who built major followings before the platform became a behemoth. They offer insights about what it takes to succeed on YouTube today, stressing authenticity, adaptability and consistent creative output. They say long term success depends on evolving with the platform while maintaining a direct connection with fans.
OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

www.securityweek.com · 6 months ago

OpenAI is expanding its Trusted Access for Cyber program to thousands of verified defenders and hundreds of security teams, granting vetted users access to GPT 5.4 Cyber, a fine tuned variant of GPT 5.4 that relaxes standard guardrails to support legitimate cybersecurity work. The model adds capabilities such as binary reverse engineering and will be rolled out iteratively to vetted security vendors, organizations, and researchers, with individuals able to apply through an identity verification process and enterprise teams enrolling via their OpenAI account representatives. OpenAI cites principles of democratized access, iterative deployment, and ecosystem resilience, and says its Codex Security platform has already helped identify over three thousand critical and high severity vulnerabilities, while the move follows Anthropic restricting access to its Claude Mythos model amid concerns it could autonomously discover thousands of zero day vulnerabilities.
New ATHR vishing platform uses AI voice agents for automated attacks

www.bleepingcomputer.com · 6 months ago

A new cybercrime platform named ATHR automates voice phishing attacks to harvest credentials by combining human operators with AI voice agents. It is marketed on underground forums for four thousand dollars plus a ten percent commission and targets services including Google, Microsoft, Coinbase, Binance, Gemini, Crypto.com, Yahoo, and AOL. The platform automates the full telephone oriented attack delivery from customized lure emails through Asterisk and WebRTC calls to scripted AI agents that imitate account recovery processes to extract six digit verification codes while operators monitor and control campaigns from a centralized dashboard. Defenses include modeling normal communication behavior to flag anomalous messages that contain phone numbers or similar lures sent repeatedly within an organization.
Most "AI SOCs" Are Just Faster Triage. That's Not Enough.

www.bleepingcomputer.com · 6 months ago

Most AI SOC tools largely speed triage by summarizing alerts, enriching events, and suggesting next steps without solving the coordination and execution work that actually reduces analyst workload. Real workload reduction comes from embedding AI into deterministic end to end workflows that gather context across tools, trigger actions across systems, and involve humans only where judgment is required, with vendors reporting outcomes such as Jamf handling 90 percent of alerts end to end and saving 150 hours in the first month. Organizations evaluating AI for the SOC are advised to test whether systems can execute multi step processes across their actual tools, behave reliably at scale, provide audit logs and human override, and consider that 99 percent of SOCs use AI while many report increased workloads and large shares of time spent on automatable tasks.
Cisco Secure Web Appliance Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 6 months ago

There is a vulnerability in the authentication service feature of Cisco AsyncOS for Cisco Secure Web Appliance that could allow an unauthenticated remote attacker to bypass authentication policy requirements. The flaw is improper validation of user supplied authentication input in HTTP requests and can be exploited by sending specially crafted HTTP requests to bypass policy enforcement, allowing an attacker to send HTTP requests that should be restricted through the device. Software updates have been released to address the issue, there are no workarounds, the Security Impact Rating is Medium, and the vulnerability is tracked as CVE-2026-20152.
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories

thehackernews.com · 6 months ago

A targeted breach at cryptocurrency wallet provider Zerion led to about 100,000 dollars being stolen from internal hot wallets after an AI enabled social engineering attack attributed to a North Korean actor known as UNC1069. A new Microsoft Defender privilege escalation exploit codenamed RedSun was disclosed following a prior BlueHammer issue that was fixed as CVE-2026-33825, and researchers report RedSun can reliably escalate to SYSTEM on Windows 10 and Windows 11 when Defender is enabled. The U S Cybersecurity and Infrastructure Security Agency added a 17 year old Microsoft Excel remote code execution vulnerability CVE-2009-0238 to its Known Exploited Vulnerabilities catalog with federal remediation required by April 28, 2026, and Microsoft rolled out April 2026 protections to harden against phishing that abuses RDP files addressing CVE-2026-26151. Security researchers also reported a sharp rise in brute force attacks targeting SonicWall and FortiGate edge devices, a fake Ledger app on the Apple store that drained about 9.5 million dollars from users, and a WordPress plugin supply chain compromise used to push backdoors.
UAC-0247 Hits Hospitals, Governments With Browser and WhatsApp Data Theft

gbhackers.com · 6 months ago

There is a surge of targeted cyberattacks against local governments and municipal healthcare institutions attributed to threat cluster UAC-0247 that begin with phishing emails posing as humanitarian aid proposals which deliver archive files containing shortcut files that trigger mshta.exe and HTA scripts to silently deploy executables via scheduled tasks. Attackers use a sophisticated two stage loader that delivers a TCP reverse shell called RAVENSHELL encrypted with a nine byte XOR key, deploy a C Sharp remote administration tool named AGINGFLY that downloads and compiles command handlers at runtime, and operate a PowerShell component called SILENTLOOP that maintains C2 via Telegram. For data theft they use CHROMELEVATOR to harvest browser credentials and cookies and ZAPIXDESK to exfiltrate WhatsApp desktop data, while conducting reconnaissance and lateral movement with tools such as RUSTSCAN, LIGOLO NG and CHISEL and in some cases loading an XMRIG miner through a patched WireGuard client, and CERT UA recommends restricting execution of LNK HTA and JS files and limiting mshta powershell and wscript to reduce exposure.
Open dataset: 100k+ multimodal prompt injection samples with per-category academic sourcing

huggingface.co · 6 months ago

Researchers have compiled a vast collection of adversarial payloads designed to jailbreak large language models like GPT-4 and Claude. These techniques range from iterative prompt refinement to exploiting gradient-based optimization and visual obfuscation methods, categorized by approach such as universal attacks and code injection. The collection tracks attack success rates across different models and highlights the evolving landscape of prompt injection vulnerabilities, showcasing a continuous arms race between developers and attackers. Datasets are also available to train and evaluate AI prompt injection detectors, including multimodal attacks and evasion strategies.
Data Breach at Tennessee Hospital Affects 337,000

www.securityweek.com · 6 months ago

There was a ransomware attack on Cookeville Regional Medical Center that resulted in a data breach affecting more than 337,000 individuals. The network intrusion was discovered on July 14, 2025, and investigators found that attackers stole more than 370,000 files totaling about 500 gigabytes that could include names, dates of birth, addresses, Social Security numbers, driver’s license numbers, financial account numbers, medical treatment information, and health insurance details. The Rhysida ransomware group listed the hospital on its leak site in August 2025, attempted to sell the data for ten bitcoin, and then made the files freely available when no buyer was found while the hospital says it has no evidence information has been misused. Identity theft protection services are being offered only to individuals whose Social Security numbers or driver’s license numbers were compromised.
Artemis Emerges From Stealth With $70 Million in Funding

www.securityweek.com · 6 months ago

On April 16, 2026, US cybersecurity startup Artemis emerged from stealth with 70 million dollars in combined seed and Series A funding. Founded in 2025 and based in New York, the company has built an AI platform designed to detect and contain AI powered attacks across applications, users, machines, and cloud workloads by combining behavioral log data with business context into a dynamic data model. The platform retrieves data on demand from cloud sources and logs to reduce costs, autonomously investigates alerts, identifies attack paths, and can automatically apply remediations while operating alongside existing tools such as legacy SIEMs. Backers include Brightmind, Felicis, First Round Capital, Lockstep, Theory VC, Two Sigma Ventures, and various angel investors, and the company says its customers include technology, banking, and financial services organizations.
Microsoft’s Windows Recall still allows silent data extraction

www.csoonline.com · 6 months ago

Microsoft's Windows Recall feature remains vulnerable to silent data extraction by malware running in a user's context, allowing attackers to siphon everything Recall has captured without administrator privileges, kernel exploits, or breaking encryption. Researcher Alexander Hagenah published a proof of concept called TotalRecall Reloaded and disclosed the issue to Microsoft, which reviewed the report and said the behavior is by design rather than a security boundary bypass. The weakness lies not in the cryptography but in how decrypted content is handled after it leaves the enclave, because plaintext screenshots and extracted text are rendered in an unprotected process that same user code can access. Short term mitigation is to add stronger code integrity and process protections to the rendering process AIXHost.exe, while a durable fix would render inside a protected process or ensure raw data never leaves the trust boundary, and independent tests confirmed exploitability with no antivirus or endpoint detection alerts.
Cisco says critical Webex Services flaw requires customer action

www.bleepingcomputer.com · 6 months ago

Cisco released security updates that address four critical vulnerabilities in its cloud Webex Services platform, including an improper certificate validation flaw in the single sign on integration that could let remote attackers impersonate any user and is tracked as CVE-2026-20184. Customers using SSO integration must upload a new SAML certificate for their identity provider to Control Hub to avoid service interruption. Cisco also patched three critical flaws in Identity Services Engine tracked as CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186 which can allow arbitrary command execution when administrative credentials are present, and the company said its PSIRT has no evidence they have been exploited. The bulletin additionally noted that CISA ordered federal agencies last month to patch a previously exploited maximum severity Cisco flaw tracked as CVE-2026-20131.
Behind the Mythos hype, Glasswing has just one confirmed CVE

www.csoonline.com · 6 months ago

Efforts to cut through the hype around Anthropic Mythos show Project Glasswing has produced only one publicly attributable CVE despite seventy five CVE records mentioning Anthropic and forty credited to Anthropic researchers. The single Glasswing attributed vulnerability is CVE-2026-4747, a FreeBSD NFS remote code execution flaw described as autonomously identified and exploited. Industry observers say Mythos still represents a structural cybersecurity shift because the model reportedly achieved about seventy two percent exploit success on the tested class of targets and that rapid diffusion of similar capabilities could outpace organizational patching and safety guardrails, while Anthropic plans a full public accounting of Glasswing findings and fixes in July 2026.
Splunk Enterprise Update Patches Code Execution Vulnerability

www.securityweek.com · 6 months ago

Splunk has released updates for Splunk Enterprise, Cloud Platform, and MCP Server to address multiple vulnerabilities and fixes in third-party packages. A high-severity vulnerability tracked as CVE-2026-20204 allows low-privileged users to upload a malicious file to a temporary directory and achieve remote code execution due to improper handling and insufficient isolation of temporary files. Another high-severity issue, CVE-2026-20205, in the MCP Server app could allow authenticated attackers to view user sessions and authorization tokens in clear text and was fixed in MCP Server app version 1.0.3. Users are advised to update to Splunk Enterprise versions 10.2.2, 10.0.5, 9.4.10, 9.3.11 or later, and Splunk is patching Cloud Platform instances.
Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution

thehackernews.com · 6 months ago

Cisco patched four critical vulnerabilities in Identity Services and Webex Services that could enable arbitrary code execution, denial of service, or allow an attacker to impersonate any user within the service. The flaws include CVE-2026-20184 (CVSS 9.8) an improper certificate validation in SSO integration enabling unauthenticated impersonation; CVE-2026-20147 (CVSS 9.9) insufficient input validation in Identity Services Engine and ISE Passive Identity Connector allowing remote code execution with administrative credentials; and CVE-2026-20180 and CVE-2026-20186 (CVSS 9.9) multiple input validation issues that could let attackers with read only admin credentials execute arbitrary operating system commands and potentially elevate to root. CVE-2026-20184 is addressed in the cloud and requires no customer action although SSO customers are advised to upload a new identity provider SAML certificate to Control Hub, while the other vulnerabilities are fixed in specific Cisco ISE and ISE PIC release patches and users are urged to update to the listed fixed releases.
Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest

www.securityweek.com · 6 months ago

There was a Zero Day Quest 2026 live hacking contest with a five million dollar prize pool, and Microsoft awarded two point three million dollars to participants across seven hundred submissions from researchers in more than twenty countries. Researchers discovered more than eighty high impact cloud and AI vulnerabilities, identifying critical paths such as credential exposure, server side request forgery chains, and cross tenant access, and noting weaknesses in identity controls and tenant isolation that could allow issues found in authorized test environments to affect other tenants when combined with execution or network level vulnerabilities. The findings underscore the need for layered defenses, strong isolation boundaries across cloud and AI services, and addressing upstream control gaps earlier in the development lifecycle.
Fake ProtonVPN, game mod sites spread NWHStealer in new Windows malware campaign

gbhackers.com · 6 months ago

There are multiple ongoing malware campaigns distributing NWHStealer, an information‑stealing trojan, by masquerading as popular software installers and mods for tools like Proton VPN, OhmGraphite, Sidebar Diagnostics, Pachtop, and HardwareVisualizer. The malicious files are hosted across fake lookalike sites, developer platforms and file sharing services including GitHub, GitLab, MediaFire, and SourceForge, and attackers have abused a legitimate free web hosting service that runs virtual machines in the browser and compromised YouTube channels that point victims to download links. NWHStealer uses loaders with anti‑analysis and AES‑CBC decryption, deploys via self‑injection, DLL hijacking, MSI loaders, and process hollowing into trusted binaries such as RegAsm, then injects DLLs into browser processes to harvest saved credentials and cryptocurrency wallet files, encrypts stolen data before exfiltration to command and control servers with a Telegram fallback, and uses PowerShell and a CMSTP UAC bypass to disable defenses and maintain persistence. To reduce risk, only download software from official vendor sites, verify digital signatures and publisher details, avoid files from untrusted file sharing and mod sites and YouTube links promising modded software, and use browser and endpoint protections.
AI Is Not Replacing Security Researchers

simonkoeck.com · 6 months ago

false
NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software

www.securityweek.com · 6 months ago

The National Institute of Standards and Technology has updated National Vulnerability Database operations to adopt a risk based enrichment model that prioritizes adding details to CVE entries placed on the Known Exploited Vulnerabilities catalog within one day and to vulnerabilities in software used by federal agencies or designated as critical under Executive Order 14028. Other newly added CVEs will still appear in the NVD but will be labeled Not Scheduled for enrichment unless they meet the prioritized criteria, and the backlog of unenriched entries published before March 1, 2026 will be moved to that category while users can request enrichment by email. NIST will not provide its own severity score when a CVE Numbering Authority has submitted a score and will not reanalyze entries modified after enrichment unless the changes materially affect enrichment data, a shift driven by a surge in CVE submissions that rose 263 percent between 2020 and 2025 and were nearly one third higher in the first three months of 2026 compared with the same period in 2025. The agency enriched 42,000 CVEs last year and framed the policy change as necessary to focus resources on systemic risk and to support development of automated systems and workflow enhancements for long term sustainability.
Data breach at edtech giant McGraw Hill affects 13.5 million accounts

www.bleepingcomputer.com · 6 months ago

The ShinyHunters extortion group leaked data linked to 13.5 million McGraw Hill user accounts after breaching a misconfigured webpage hosted in the company’s Salesforce environment earlier in April 2026. McGraw Hill confirmed unauthorized access to a limited set of data and said the incident did not affect its Salesforce accounts, courseware, customer databases, or internal systems. More than 100 gigabytes of files were later distributed and the exposed information includes email addresses, names, physical addresses, and phone numbers that could enable targeted spear-phishing, while ShinyHunters claimed up to 45 million Salesforce records were taken.
Hidden Passenger? How Taboola Routes Logged-In Banking Sessions to Temu

thehackernews.com · 6 months ago

A bank-approved Taboola tracking pixel performed a 302 redirect from sync.taboola.com to a Temu tracking endpoint that included the header Access-Control-Allow-Credentials set to true, causing browsers to send cookies to the Temu domain. This behavior ran on logged-in banking pages without the bank's knowledge or user consent and allowed Temu to associate tracking identifiers with authenticated sessions. Conventional security controls including WAFs, static analyzers, and Content Security Policy allow-lists failed to detect the issue because they validate the declared script origin rather than the runtime redirect destination. The finding, uncovered during a February 2026 audit, creates GDPR transparency and cross-border transfer risks and a PCI DSS review gap, prompting the recommendation that teams inspect runtime third-party script behavior and treat browser-level tracking on authenticated pages as high-risk.
Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks

thehackernews.com · 6 months ago

A novel social engineering campaign abused the Obsidian note taking application by convincing targets to open a shared cloud vault and enable community plugin sync, which caused malicious plugin configuration files to execute code. Attackers posed as a venture capital firm on LinkedIn and Telegram to lure individuals in the financial and cryptocurrency sectors into a staged group and instruct them to connect to the malicious vault. On Windows the vault triggered a PowerShell script that drops an intermediate loader called PHANTOMPULL which decrypts and launches an in memory remote access trojan named PHANTOMPULSE that resolves its command and control via the Ethereum blockchain and supports commands including inject, drop, screenshot, keylog, uninstall, elevate and downgrade. On macOS the campaign used an obfuscated AppleScript dropper with domain and Telegram based fallback C2 resolution, and researchers reported the intrusion was detected and blocked before the adversary completed their objectives.