Blahalla

JADEPUFFER Agentic Ransomware Uses LLM to Automate Database Extortion

gbhackers.com · 20 days ago

The first instance of agentic ransomware: JADEPUFFER, an LLM-driven extortion operation that automated an end-to-end database-crippling campaign.

/r/netsec's Q3 2026 Information Security Hiring Thread

www.reddit.com · 20 days ago

Overview If you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company. We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.

New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

thehackernews.com · 20 days ago

Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs. Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker a shell on your machine.

ChocoPoC Campaign Abuses GitHub PoC Repositories to Steal Browser Credentials

gbhackers.com · 20 days ago

A coordinated supply-chain campaign has been weaponizing GitHub proof-of-concept (PoC) repositories to compromise vulnerability researchers and penetration testers, delivering a stealthy Python Remote Access Trojan (RAT) dubbed “ChocoPoC.” The lure is simple and effective: newly disclosed high-severity CVEs create urgency for fast PoC and scanner module development.

Attackers Downgrade WDigest Protection to Dump Plaintext Credentials With Mimikatz

gbhackers.com · 20 days ago

An incident that began with innocuous enumeration commands but quickly escalated into a focused, multi-stage effort to impair detection and extract credentials. The intruder uploaded a steganographic webshell to an IIS server, used the process w3wp.exe to run OS reconnaissance such as whoami, and then deployed an extensive defence-impairment script (i.

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

thehackernews.com · 20 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deserialization of untrusted data.

LSHIY Password Spray Attack Hits Microsoft 365 Accounts With 81 Million Login Attempts

gbhackers.com · 20 days ago

A large-scale password spray campaign linked to the infrastructure provider LSHIY LLC has targeted Microsoft 365 environments, resulting in over 81 million login attempts. This campaign has led to at least 78 confirmed account compromises across 64 organizations between June 12 and June 26, 2026.

Browser-Only Ransomware Uses File System Access API to Encrypt Files Without Malware Installation

gbhackers.com · 20 days ago

A novel, practical ransomware technique that runs entirely inside the browser by abusing the File System Access API, demonstrating how AI can turn high-level malicious ideas into operational attack chains without any native payload. The proof-of-concept leverages a social engineering lure a fake AI image-enhancement/upscaler web app to convince users to grant folder-level access.

Critical Cursor IDE Flaws Let Attackers Execute Code via Zero-Click Prompt Injection

gbhackers.com · 20 days ago

Two significant remote code execution (RCE) vulnerabilities in the widely used Cursor ID expose developers to zero-click attacks driven by prompt injection. These vulnerabilities, tracked as CVE-2026-50548 and CVE-2026-50549, collectively known as “DuneSlide,” carry a CVSS score of 9.8.

FortiBleed Campaign Linked to INC and Lynx Ransomware Operations

gbhackers.com · 20 days ago

A direct operational link between the large-scale FortiBleed credential-harvesting campaign and two active ransomware-as-a-service (RaaS) groups: INC Ransom and Lynx. This finding provides the first confirmed evidence that mass theft of FortiGate credentials is being integrated into ransomware deployment processes, significantly increasing the threat posed by exposed firewall infrastructure.

Scattered Spider Hacker Arrested in Finland and Extradited to U.S. Over Cyber Intrusion Charges

gbhackers.com · 20 days ago

U.S. authorities have announced federal charges against an alleged member of the notorious cybercriminal group Scattered Spider, following his arrest in Finland and extradition to the United States. The defendant, identified as 19-year-old Peter Stokes, a dual national of the U.S.

Medtronic notifies customers impacted by ShinyHunters data breach

www.bleepingcomputer.com · 20 days ago

Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party.

Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector

www.csoonline.com · 20 days ago

Researchers have discovered two vulnerabilities in the widely used Cursor AI-enabled integrated development environment (IDE) that can be exploited through prompt injection to achieve remote code execution (RCE).

Smashing Security podcast #474: Polymarket can predict the future. So how did it miss this hack?

grahamcluley.com · 20 days ago

Polymarket has built an entire business on predicting the future. So how did it manage to spectacularly fail to predict its own hack? Plus, the Google engineer with a million-dollar secret, and the curious case of the airport hairdryer. Meanwhile, "FortiBleed" sees 75,000 Fortinet firewalls thrown wide open - and the real damage is going to roll on for years.

New BioShocking Attack Tricks AI Browsers Into Leaking Credentials

www.techrepublic.com · 20 days ago

LayerX found that BioShocking could trick AI browsers into leaking credentials by disguising malicious prompts as game rules.

FortiBleed credential-theft campaign linked to Lynx ransomware

www.bleepingcomputer.com · 20 days ago

The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions.

Kubota says hackers had month-long access to network systems

www.bleepingcomputer.com · 20 days ago

Kubota North America Corporation disclosed that hackers had access to some of its network systems for more than a month earlier this year.

Microsoft Warns: Fake Perplexity Extension Abused Chrome Search Features

www.techrepublic.com · 20 days ago

Microsoft found a fake Perplexity AI Chrome extension that rerouted searches through attacker servers. Here’s what users should check now.

Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS

www.darkreading.com · 20 days ago

Attackers fingerprint victims through user-agent data to deliver OS-specific payloads, increasing compromise rates and campaign profitability.

New ChocoPoC malware targets researchers via trojanized PoC exploits

www.bleepingcomputer.com · 20 days ago

Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers.

ChocoPoc malware delivered via trojanized exploits on GitHub

www.bleepingcomputer.com · 20 days ago

Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data.

And the Winner in Dominant Malware Delivery? ClickFix

www.darkreading.com · 20 days ago

Researchers say the highly effective social engineering technique is no longer the exception for malware attacks, it's now the rule.

Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters

thehackernews.com · 20 days ago

Argo CD, a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated attacker run code, provided they can reach the component's internal network port. Synacktiv, which found the bug, says it can lead to a full cluster takeover. There is no fix and no CVE.

19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges

thehackernews.com · 20 days ago

A teenager accused of belonging to the hacking group Scattered Spider has been extradited from Finland to face U.S. charges of conspiracy, computer intrusion, and fraud, the U.S. Department of Justice announced on July 1. Peter Stokes, 19, a dual U.S. and Estonian citizen, appeared in a Chicago federal court on June 30, where a judge ordered him held in custody.

Aflac Data Breach: Over 4M Customers in Japan May Be at Risk

www.techrepublic.com · 21 days ago

Aflac says a data breach in Japan may affect 4.38 million customers and agents, exposing personal, policy, and some banking information.

Microsoft Uncovers Widespread Hotel Phishing Campaign in Japan

www.techrepublic.com · 21 days ago

Microsoft and Trend Micro found hotel phishing attacks using fake guest complaints and photo links to target staff in Japan.

Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings

www.securityweek.com · 21 days ago

Microsoft's new Teams admin policy requires organizer approval for external AI bots, giving organizations greater visibility and control over automated participants in sensitive meetings.

SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

thehackernews.com · 21 days ago

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT. Kaspersky said the activity is part of a "massive, multi-domain, multi-language" campaign that distributes malicious installer archives hosted on spoofed websites. These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam, among others.

DHS confirms hackers breached HSIN info-sharing platform

www.bleepingcomputer.com · 21 days ago

The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector partners.

VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

thehackernews.com · 21 days ago

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEILDROP by Securonix.

Webinar: Why traditional email security is no longer enough

www.bleepingcomputer.com · 21 days ago

Modern phishing, business email compromise, and account takeover attacks increasingly exploit trusted identities and legitimate business workflows, making them harder for traditional email defenses to detect. This webinar explores how behavioral AI can help organizations automate detection and response.

Hackers target Microsoft 365 accounts with 81 million login attempts

www.bleepingcomputer.com · 21 days ago

An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period.

Zero-Click Prompt Injection to RCE in Cursor IDE: DuneSlide

www.catonetworks.com · 21 days ago

Cato AI Labs just disclosed DuneSlide, two critical RCE vulnerabilities found in Cursor IDE: CVE-2026-50548 and CVE-2026-50549. Both are rated Critical. The interesting part is the attack path. This was not just prompt injection changing model output. The agent could ingest untrusted content from sources like MCP servers or web search results, then act through the app around it.

Microsoft named a leader in the Frost Radar for cloud and application runtime security

www.microsoft.com · 21 days ago

Frost & Sullivan names Microsoft a leader as cloud and application security converge into unified, runtime risk reduction.

Cisco Catalyst Center Arbitrary File Read Vulnerability

sec.cloudapps.cisco.com · 21 days ago

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.

ClamAV Vulnerabilities Affecting Cisco Products: July 2026

sec.cloudapps.cisco.com · 21 days ago

Multiple vulnerabilities in ClamAV could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations. For more information about these vulnerabilities, see the Details section of this advisory. For additional information on these vulnerabilities in ClamAV, see the ClamAV blog. Cisco has released software updates that address these vulnerabilities.

6 security settings every GitHub maintainer should enable this week

github.blog · 21 days ago

These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors. Turn these on, and your project will be meaningfully harder to attack than it was before.

Turning Indicators into Intelligence in OpenCTI with Criminal IP

gbhackers.com · 21 days ago

Torrance, California, USA, July 1st, 2026, CyberNewswire Cyber threat intelligence becomes more valuable when indicators are enriched with context that supports investigation, correlation, and decision-making.

When Too Much Security Data Became the Risk

www.darkreading.com · 21 days ago

Rapid growth turned routine firewall logs into a security and budget liability. One CISO used artificial intelligence to filter what data truly belongs in the SIEM.

Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

thehackernews.com · 21 days ago

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its real payload inside an image.

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

thehackernews.com · 21 days ago

Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic. The ColdFusion updates "resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass," Adobe said in an alert released Tuesday.

'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat

www.darkreading.com · 21 days ago

LLMs consistently hallucinate Web domains for legitimate brands that attackers can register for malicious activity in a difficult-to-detect attack vector.

Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands

thehackernews.com · 21 days ago

Two flaws in Cursor, an AI code editor, could let a single, ordinary-looking prompt break out of the editor's safety sandbox and run any command on a developer's computer. There is no click to fall for and no approval box to ignore. Cato AI Labs found the pair and named them DuneSlide. They are tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 out of 10 (or 9.

Turning Indicators into Intelligence in OpenCTI with Criminal IP

www.bleepingcomputer.com · 21 days ago

Threat intelligence is only as useful as the context behind it. Criminal IP explains how its integration enriches threat indicators in OpenCTI with risk scoring, infrastructure intelligence, and phishing analysis.

Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts

thehackernews.com · 21 days ago

A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an advisory from eSentire's Threat Response Unit (TRU). The Canadian cybersecurity company said it identified exploitation attempts targeting CVE-2026-8037 (CVSS score: 9.

Mitigating Attacks Before They Impact Infrastructure: Link11 provides next generation network DDoS protection

gbhackers.com · 21 days ago

Frankfurt am Main, Deutschland, July 1st, 2026, CyberNewswire Link11, a leading European provider of cloud-based cybersecurity solutions, today announced the launch of its completely rebuilt Layer 3/4 DDoS mitigation solution, designed to address the growing complexity of modern network attacks. Today’s DDoS attacks are not just simple volume or protocol attacks anymore.

r/netsec monthly discussion & tool thread

www.reddit.com · 21 days ago

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links. Rules & Guidelines Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary. Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.

Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657)

syntetisk.tech · 21 days ago

An unprivileged user inside a Lima QEMU guest could reach the root-owned guest-agent socket and run commands as root in the VM. Fixed in Lima v2.1.3. Lima scored it High, CVSS 8.2 with Scope: Changed, reflecting that crossing from an unprivileged account to root within the VM crosses a security boundary that other components rely on. Full write up is available on the Syntetisk blog.

Safe Events Start With Threat Intel and Digital Security

www.darkreading.com · 21 days ago

Planning ahead to defend against cyber threats is the work that keeps events uneventful.

AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android

thehackernews.com · 21 days ago

Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both Windows and Android devices.