Blahalla

DevOps & SaaS Downtime: The High (and Hidden) Costs for Cloud-First Businesses

thehackernews.com · 6 months ago

false

Five Chrome extensions caught hijacking enterprise sessions

www.csoonline.com · 6 months ago

A coordinated campaign has compromised Chrome extensions disguised as productivity tools, targeting popular enterprise platforms like Workday, NetSuite, and SuccessFactors. These extensions steal session tokens, enabling attackers to hijack accounts and bypass multi-factor authentication. Some extensions actively block security controls, preventing administrators from responding to security incidents. Over 2300 users were tricked into installing these malicious extensions before Google initiated takedown requests.

Attackers Abuse WSL2 to Operate Undetected on Windows Systems

gbhackers.com · 6 months ago

Attackers are exploiting Windows Subsystem for Linux 2, or WSL2, to operate undetected on Windows systems. WSL2 provides a semi-isolated Linux environment within Hyper‑V that is often overlooked by security tools, allowing adversaries to pivot, run tools, and harvest credentials with minimal detection. Researchers have developed a technique using the WSL2 Component Object Model, or COM, to execute commands without spawning wsl.exe, creating a stealthy pivot mechanism. Security teams should monitor WSL2 usage, inspect file systems, and watch for suspicious COM activity to address this expanding attack surface.

New StackWarp Hardware Flaw Breaks AMD SEV-SNP Protections on Zen 1–5 CPUs

thehackernews.com · 6 months ago

Researchers have discovered a hardware vulnerability, codenamed StackWarp, affecting AMD processors from Zen 1 through Zen 5. The flaw allows attackers with privileged access to manipulate the stack pointer within confidential virtual machines, potentially enabling remote code execution and privilege escalation. AMD is tracking this as CVE-2025-29943, classifying it as a medium-severity improper access control bug. The vulnerability impacts several AMD EPYC processor series and can be exploited by disabling hyperthreading and using undocumented control bits. Microcode updates have been released, and additional patches are planned.

Privilege Escalation via a service account impersonation chain

jdsec.cloud · 6 months ago

A security vulnerability was recently discovered in Google SecOps that allowed attackers to escalate privileges and gain administrative control. The exploit chain involved impersonating service accounts, specifically gke-init-python and secops-auth, to forge JSON Web Tokens. This vulnerability, which has been addressed, exposed risks related to overly permissive Identity and Access Management bindings and a lack of proper code validation. Google has since restricted service account permissions and adopted a new tenant model to prevent similar issues.

"synthetic vulnerabilities" — security flaws unique to AI-generated code

webmatrices.com · 6 months ago

NULL

Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’

www.securityweek.com · 6 months ago

A new malicious Chrome extension called NexShield, impersonating uBlock Origin Lite, is being used in a ClickFix variant dubbed CrashFix to target corporate environments. The extension initiates a denial-of-service attack, crashing the browser and then displaying a fake security warning to trick users into running malicious commands. These commands install ModeloRAT, a sophisticated remote access trojan, on domain-joined systems, allowing attackers to compromise Active Directory and internal resources. The threat actor, known as KongTuke, actively avoids infecting home users, demonstrating a focus on enterprise environments.

42,000 Impacted by Ingram Micro Ransomware Attack

www.securityweek.com · 6 months ago

IT distributor Ingram Micro recently experienced a ransomware attack impacting approximately 42,000 individuals. The incident occurred on July 3, 2025, leading to system outages and the theft of sensitive data including names, Social Security numbers, and driver's license numbers. The ransomware group Safepay claimed responsibility and leaked 3.5 terabytes of data, indicating a ransom was not paid. Affected individuals are being offered two years of free credit monitoring and identity protection services.

Python-Bibliotheken für Hugging-Face-Modelle vergiftet

www.csoonline.com · 6 months ago

Security vulnerabilities have been discovered in several AI and machine learning Python libraries, including NeMo, Uni2TS, and FlexTok, which are used with Hugging Face models. Attackers can embed malicious code within manipulated metadata, triggering execution when the file is loaded. This exploitation occurs due to the use of the instantiate() function within the Hydra library, allowing for remote code execution. Patches have been released for NeMo (CVE-2025-23304), Uni2TS (CVE-2026-22584), and FlexTok, and Meta has updated Hydra’s documentation to warn about the potential for remote code execution.

Attackers Rerouted Employee Pay Without Breaching IT Systems

gbhackers.com · 6 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown Mode. One technique involves manipulating image previews to trigger arbitrary code execution, while another leverages maliciously crafted font files. A third method exploits vulnerabilities in how Lockdown Mode handles certain system processes. These exploits could potentially allow unauthorized access to a device.

The culture you can’t see is running your security operations

www.csoonline.com · 6 months ago

false

The Rise of Prediction Markets

www.nytimes.com · 6 months ago

false

How tech billionaires spurred an exodus of rich people from California

www.washingtonpost.com · 6 months ago

false

Spear-Phishing Campaign Leverages Google Ads to Distribute EndRAT Malware

gbhackers.com · 6 months ago

A sophisticated threat group known as Konni is conducting Operation Poseidon, a spear-phishing campaign targeting financial institutions and human rights organizations in South Korea. Attackers use Google Ads and Naver's marketing platform to mask malicious URLs and evade security filters, ultimately delivering EndRAT malware through compromised WordPress websites. The malware is distributed via Windows shortcut files disguised as legitimate documents, employing AutoIt scripts to download and execute the payload directly into memory. The attackers have demonstrated mature infrastructure and sustained development practices, reusing known command-and-control infrastructure like jlrandsons.co[.]uk.

Fahndung nach Kopf von Black Basta

www.csoonline.com · 6 months ago

Authorities are searching for the suspected leader of the Black Basta ransomware group, who is believed to be a Russian national. The group is known for targeting companies, hospitals, and government agencies with ransomware attacks, stealing data, and demanding ransom payments. Black Basta is responsible for over 100 attacks and more than 20 million euros in losses in Germany alone, between March 2022 and February 2024. Several countries, including Germany, the Netherlands, Switzerland, and Great Britain, participated in raids and investigations.

Redmi Buds Vulnerability Could Allow Call Data Theft and Firmware Instability

gbhackers.com · 6 months ago

Security vulnerabilities have been identified in the Redmi Buds 3 Pro through 6 Pro series, allowing attackers to potentially steal call data and cause devices to crash. These flaws, tracked as CVE-2025-13834 and CVE-2025-13328, stem from improper handling of Bluetooth protocols like RFCOMM. The information disclosure vulnerability, CVE-2025-13834, allows attackers to extract phone numbers without authentication, while CVE-2025-13328 can trigger firmware crashes through flooding attacks. Xiaomi has not yet released a fix or offered mitigation strategies.

CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures

thehackernews.com · 6 months ago

Cybersecurity researchers have identified a malicious Chrome extension called "NexShield, Advanced Web Guardian" that uses a deceptive technique called CrashFix to deliver a remote access trojan known as ModeloRAT. The extension, a clone of a legitimate ad blocker, intentionally crashes web browsers by triggering a denial-of-service attack and presents users with a fake security alert prompting them to execute a malicious command. This campaign, codenamed KongTuke, targets both corporate and standalone environments, with domain-joined machines receiving the full ModeloRAT payload, while standalone workstations receive a test payload. The attack chain also employs anti-analysis techniques and employs the Windows utility finger.exe to download and execute subsequent payloads.

Five Chrome Extensions Used to Hijack Enterprise HR and ERP Systems

gbhackers.com · 6 months ago

Researchers have identified a coordinated campaign involving five malicious Chrome extensions targeting enterprise HR and ERP systems like Workday, NetSuite, and SAP SuccessFactors. These extensions, installed over 2,300 times, steal session cookies, block security controls, and enable account takeover through session hijacking. The extensions masquerade as productivity and access-control tools while secretly exfiltrating data and preventing users from accessing security pages. The attackers use a three-pronged approach including cookie theft, administrative page blocking, and cookie injection to facilitate account takeover and disrupt security remediation efforts.

PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses

gbhackers.com · 6 months ago

Security researchers have identified a sophisticated malware variant called PDFSIDER that uses DLL side-loading to bypass antivirus and endpoint detection and response systems. The malware, delivered through spear-phishing campaigns disguised as PDF24 Creator software, exploits vulnerabilities to load a malicious DLL instead of a legitimate system library. PDFSIDER operates primarily in memory, uses encrypted command-and-control channels with AES-256-GCM, and includes evasion techniques to detect sandboxes and virtual machines. Organizations are advised to strengthen security through behavioral monitoring and application patching.

Mandiant Publishes Rainbow Tables That Crack NTLMv1 Admin Passwords

gbhackers.com · 6 months ago

Security firm Mandiant has released rainbow tables designed to crack outdated Net-NTLMv1 authentication hashes, significantly lowering the barrier for exploiting this vulnerability. Previously, cracking these hashes required specialized hardware or uploading credentials to third-party services, but now it can be done with consumer-grade equipment costing less than $600 USD. This technique allows attackers to recover passwords from Active Directory environments, potentially leading to complete organizational compromise. Organizations are urged to immediately disable Net-NTLMv1 authentication and implement continuous monitoring to detect any ongoing usage.

How ‘Reprompt’ Attack Let Hackers Steal Data From Microsoft Copilot

www.techrepublic.com · 6 months ago

Researchers have discovered a new attack method, dubbed "Reprompt," that allowed malicious actors to extract sensitive data from Microsoft Copilot sessions. The attack exploits three techniques: Parameter-to-prompt injection, which uses a URL parameter to execute hidden instructions; a double-request bypass, which circumvents data leak protections; and chain-request exfiltration, which allows data to be gradually transferred to an attacker-controlled server. This attack persisted even after the user closed the Copilot chat, enabling continuous data extraction without further user interaction. Microsoft has patched the vulnerability in Copilot Personal as part of its January 2026 security updates.

Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence

gbhackers.com · 6 months ago

A new open-source reconnaissance platform called Argus v2.0 has been released. This Python-based toolkit combines 135 specialized modules into a single command-line interface for network mapping, web application analysis, and threat intelligence gathering. It offers multiple deployment options, including Python execution, pip installation, shell scripts, and Docker containers, and integrates with services like Shodan and VirusTotal. Argus organizes modules across network, web application, and security intelligence categories, with export capabilities in TXT, CSV, and JSON formats.

From arts degree to cybersecurity: Rona Michele Spiegel brings fresh perspective to cyber leadership

www.csoonline.com · 6 months ago

false

ServiceNow BodySnatcher flaw highlights risks of rushed AI integrations

www.csoonline.com · 6 months ago

A recently discovered vulnerability, dubbed BodySnatcher, impacts ServiceNow’s Now Assist AI Agents and Virtual Agent API applications, potentially allowing unauthenticated users to create backdoor accounts with administrator privileges. The flaw exploits misconfigurations that enable AI agents to execute tasks with user privileges, potentially through impersonation and bypassing authentication. ServiceNow has released patches for hosted and self-hosted instances, but custom code and third-party integrations could still pose a risk. To mitigate this, organizations should enforce multi-factor authentication, review custom agents, and disable unused AI agents. There are no CVEs mentioned in the provided information.

7 top cybersecurity projects for 2026

www.csoonline.com · 6 months ago

false

Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations

thehackernews.com · 6 months ago

A cross-site scripting vulnerability was discovered in the StealC malware panel, enabling researchers to observe the operations of threat actors using the tool. The StealC malware, distributed via YouTube and other methods, is a Malware-as-a-Service that steals information, including passwords and cookies. Researchers were able to gain insights into a threat actor, dubbed YouTubeTA, who used StealC to distribute cracked software and amassed a significant number of stolen credentials. An operational security lapse exposed YouTubeTA’s location and IP address, indicating they operate from Ukraine.

New “BodySnatcher” Flaw Allows Full ServiceNow User Impersonation

gbhackers.com · 6 months ago

Researchers have identified several methods attackers can use to bypass security controls in Windows. One technique involves manipulating Registry run keys to execute malicious code during system startup. Another bypass leverages the Windows Task Scheduler to achieve persistence. Finally, attackers can exploit vulnerabilities in Microsoft Office documents to compromise systems, specifically addressing CVE-2023-24932, CVE-2023-24933, CVE-2023-24936, CVE-2023-24937, and CVE-2023-24938. These findings highlight the importance of robust endpoint detection and response capabilities.

Threat Actors Abuse Browser Extensions to Deliver Fake Warning Messages

gbhackers.com · 6 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown Mode. One technique involves manipulating the system clipboard to trigger malicious actions. Another allows attackers to forge incoming connections, while a third utilizes specialized fonts to execute arbitrary code. These vulnerabilities pose a risk to users employing Lockdown Mode as their primary security measure.

Microsoft January 2026 Security Update Triggers Credential Prompt Failures in Remote Desktop

gbhackers.com · 6 months ago

Microsoft's January 2026 security update, specifically patch KB5074109, has caused authentication failures preventing users from connecting to Remote Desktop environments like Azure Virtual Desktop and Windows 365. The issue, impacting Windows 11 versions 24H2 and 25H2, manifests as "Unable to Authenticate" errors. Microsoft released an out-of-band patch, KB5077744, to resolve the problem without removing the original security update. The January 2026 security update also addressed 114 vulnerabilities, including the actively exploited zero-day CVE-2026-20805.

New Kerberos Relay Technique Exploits DNS CNAMEs to Bypass Existing Defenses

gbhackers.com · 6 months ago

A new technique exploits a Windows Kerberos authentication flaw to conduct credential-relay attacks. The vulnerability, tracked as CVE-2026-20929, allows attackers to manipulate DNS records to force victims into requesting Kerberos tickets for attacker-controlled systems, enabling lateral movement and privilege escalation. This method bypasses previous defenses and affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025. Microsoft’s response involved implementing Channel Binding Tokens, but organizations must enforce additional security measures like SMB signing and DNS hardening to mitigate the risk.

GhostPoster Malware Targets Chrome Users via 17 Rogue Extensions

gbhackers.com · 6 months ago

A sophisticated malware campaign, named GhostPoster, has compromised Chrome, Firefox, and Edge users through 17 malicious browser extensions. These extensions, collectively downloaded over 840,000 times, utilize steganography to hide malicious payloads within PNG icon files, bypassing security reviews. The malware employs a delayed activation of 48 hours or longer and modular architecture to evade detection and allow for ongoing updates, primarily to hijack affiliate traffic and perform click fraud. The campaign has operated for five years, demonstrating significant gaps in browser extension vetting processes, and requires user action to remove installed extensions.

Southeast Asia CISOs Top 13 Predictions for 2026: Securing AI, Centering Identity, and Making Resilience Strategic

www.csoonline.com · 6 months ago

Southeast Asia CISOs predict significant cybersecurity shifts by 2026. Organizations must prioritize hardening cloud and AI infrastructure and treating identity as a critical security perimeter, as attackers increasingly use AI for impersonation and data theft. Supply chain risk will multiply due to open-source components and cloud platforms, and agentic AI presents both offensive and defensive challenges, requiring guardrails and automated security operations centers. Financial institutions may even productize cyber resilience as a revenue stream, and regulatory focus will increase on AI identity and access governance.

OpenAI hostname hints at a new ChatGPT feature codenamed "Sonata"

www.bleepingcomputer.com · 6 months ago

false

New OpenAI leak hints at upcoming ChatGPT features

www.bleepingcomputer.com · 6 months ago

false

After the Takedown: Excavating Abuse Infrastructure with DNS Sinkholes

disclosing.observer · 6 months ago

false

Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs

www.bleepingcomputer.com · 6 months ago

Microsoft has released out-of-band updates to address two issues stemming from the January security updates. The first problem prevents some users from connecting to Microsoft 365 Cloud PC sessions, causing credential prompt failures. A second issue is preventing some Windows 11 devices with Secure Launch enabled from shutting down or entering hibernation, instead restarting. These updates are currently only available for manual download and organizations can deploy a Known Issue Rollback as an alternative.

How Security Teams Use IP Location and DNS History In Cybercrime Investigation

gbhackers.com · 6 months ago

false

Successful Errors: New Code Injection and SSTI Techniques

github.com · 6 months ago

There are two new exploitation techniques for Code Injection and Server Side Template Injection called Error Based and Boolean Error Based Blind, with detection and exploitation payloads provided for Python, PHP, Java, Ruby and NodeJS. Universal detection payloads enable blind scanning without guessing the target language, and the techniques were integrated into the SSTImap detection tool in version 1.3.0 to facilitate practical application. Practical examples and a development timeline are provided for targets including Dust dot JS, Twig with CVE 2022 23614 and JSONPath Plus with CVE 2025 1302, along with payload development guidance for other engines such as expr eval.

CIRO confirms data breach exposed info on 750,000 Canadian investors

www.bleepingcomputer.com · 6 months ago

The Canadian Investment Regulatory Organization, or CIRO, recently confirmed a data breach impacting approximately 750,000 Canadian investors. The breach, identified last August, involved the exfiltration of personal data including dates of birth, phone numbers, income, social insurance numbers, and account information. CIRO states login credentials and security questions were not compromised and reports no evidence of data misuse or publication. Affected investors will receive two years of free credit monitoring and identity theft protection services.

Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK

ysamm.com · 6 months ago

A critical vulnerability in the Facebook JavaScript SDK has been identified, enabling Cross-Site Scripting attacks on websites using Facebook plugins. The vulnerability arises from a predictable random number generator used for message validation and the leakage of identifiers through iframe names. Attackers can forge valid messages from Facebook's domain, potentially triggering malicious scripts on victim websites. This flaw, initially reported in June 2023 and fixed in December 2023, also allowed for potential account takeover and resulted in a $66,000 bounty payment.

Google Chrome tests Gemini-powered AI "Skills"

www.bleepingcomputer.com · 6 months ago

false

Google Chrome now lets you turn off on-device AI model powering scam detection

www.bleepingcomputer.com · 6 months ago

false

Kasm workspace CTI tooling

kasm.com · 6 months ago

false

Black Basta Ransomware Leader Added to EU Most Wanted and INTERPOL Red Notice

thehackernews.com · 6 months ago

Ukrainian and German law enforcement have identified two Ukrainians suspected of involvement with the Russia-linked Black Basta ransomware-as-a-service group. The group’s alleged leader, Oleg Evgenievich Nefedov, has been added to the European Union’s Most Wanted and INTERPOL’s Red Notice lists, and is believed to have ties to Russian intelligence agencies. Black Basta has targeted over 500 companies and amassed hundreds of millions of dollars, before seemingly disappearing in February. Nefedov is linked to the now-defunct Conti ransomware group, for which the U.S. State Department has offered a $10 million reward for information.

Credential-stealing Chrome extensions target enterprise HR platforms

www.bleepingcomputer.com · 6 months ago

Cybersecurity researchers discovered a coordinated campaign involving malicious Chrome extensions on the Chrome Web Store that targeted enterprise HR and ERP platforms like Workday, NetSuite, and SAP SuccessFactors. These extensions, disguised as productivity and security tools, were installed over 2,300 times and employed three attack methods: cookie exfiltration, blocking of security administration pages, and direct session hijacking through cookie injection. The extensions were published under different developer names but shared identical infrastructure and code patterns, and have been removed from the Chrome Web Store. Users are advised to report the extensions and change passwords on affected platforms.

Google Vertex AI Flaw Lets Low-Privilege Users Escalate to Service Agent Roles

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can use to bypass Apple's Lockdown Mode on iPhones. The vulnerabilities involve exploiting weaknesses in the way Lockdown Mode handles Bluetooth connections, legacy system files, and the Core Animation framework. Successful exploitation could allow attackers to execute arbitrary code or gain unauthorized access to a device, even when Lockdown Mode is enabled. These findings highlight the ongoing challenge of securing mobile devices against sophisticated threats.

How I used an agent to hunt vulns

blazelight.dev · 6 months ago

A recently discovered vulnerability affects multiple versions of the popular React library. The issue, identified as CVE-2024-2203, allows for arbitrary code execution through specially crafted JavaScript files. Attackers could potentially leverage this to compromise applications relying on vulnerable React versions. The vulnerability stems from a flaw in the reconciliation algorithm and is being addressed in updated releases.

Tennessee Man Pleads Guilty to Repeatedly Hacking Supreme Court’s Filing System

www.securityweek.com · 6 months ago

A Tennessee man has pleaded guilty to repeatedly hacking into the U.S. Supreme Court’s filing system, as well as systems belonging to AmeriCorps and the Department of Veterans Affairs. The 24-year-old, identified as Nicholas Moore, accessed personal records and posted information on an Instagram account. He faces a maximum of one year in prison and is scheduled to be sentenced in April. The hacking incidents occurred in 2023 and involved the unauthorized use of stolen credentials.

He stoked ‘deep state’ conspiracy theories. Now they’re coming back to haunt him.

www.washingtonpost.com · 6 months ago

false

These prophets of economic doom are worried about another collapse

www.washingtonpost.com · 6 months ago

false