Blahalla

Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

thehackernews.com · 6 months ago

Security experts have identified an active malware campaign exploiting a DLL side-loading vulnerability to bypass security controls. Attackers are using a malicious libcares-2.dll with signed ahost.exe executables, often renaming the legitimate file, to deploy malware like Agent Tesla, CryptBot, and XWorm. The campaign targets employees in finance and related roles, using lures written in multiple languages and disguising malicious files as invoices or requests for quote documents. Researchers also observed a surge in Facebook phishing scams using a Browser-in-the-Browser technique to steal credentials, and a multi-stage phishing campaign distributing AsyncRAT via Dropbox links utilizing Python payloads and TryCloudflare tunnels.

Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits

www.securityweek.com · 6 months ago

New research reveals Predator spyware is more advanced than previously thought. The spyware, developed by Cytrox and now managed by Intellexa, learns from failed attacks by sending diagnostic information back to developers, improving future versions. Predator employs error codes to analyze failures, and actively suppresses crash logs to prevent forensic analysis. The spyware avoids running in the US and Israel, likely due to sanctions and potential scrutiny, respectively.

Reprompt attack hijacked Microsoft Copilot sessions for data theft

www.bleepingcomputer.com · 6 months ago

Researchers have discovered a new attack method called “Reprompt” that could allow attackers to hijack Microsoft Copilot sessions. The attack involves embedding malicious prompts within a URL and leveraging techniques like Parameter-to-Prompt injection, a double-request technique, and a chain-request technique to bypass Copilot’s safeguards and exfiltrate data. This enables attackers to maintain access and issue commands even after a user clicks a link and closes the Copilot tab. Microsoft has addressed the vulnerability, and users are advised to apply the latest security updates.

Leaked Data Exposes Thousands of Border Patrol, ICE Agents After Renee Good Shooting

www.techrepublic.com · 6 months ago

A data leak has exposed personal and work-related information for approximately 4,500 employees of U.S. Immigration and Customs Enforcement and Border Patrol. The leak, reportedly facilitated by a Department of Homeland Security whistleblower, includes names, contact information, and job details of frontline agents, supervisors, and support staff. The information was shared with ICE List, a website focused on documenting immigration enforcement activities, following a shooting in Minneapolis. Federal officials are condemning the release, warning it jeopardizes agent safety and potentially constitutes 4,500 felonies.

Federal agencies ordered to patch Microsoft Desktop Windows Manager bug

therecord.media · 6 months ago

U.S. government agencies must patch a Microsoft Desktop Windows Manager vulnerability, CVE-2026-20805, by February 3. The bug allows for information disclosure, potentially undermining security controls and enabling further attacks, though exploitation requires local access. This is the first time an information disclosure bug in the Desktop Windows Manager has been exploited. Microsoft has addressed 20 vulnerabilities in this component since 2022.

Novee Emerges From Stealth With $51.5 Million in Funding

www.securityweek.com · 6 months ago

false

Cyberattack forces Belgian hospital to transfer critical care patients

therecord.media · 6 months ago

A ransomware attack has severely disrupted operations at AZ Monica hospital in Belgium. The hospital proactively shut down its servers to contain the attack, forcing the cancellation of surgeries and the transfer of seven critical care patients to other facilities. Patient care is impacted, with ambulances diverted and urgent treatments postponed, but officials say patient data has not been compromised. Authorities have confirmed a cyberattack is underway.

Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents

blog.tenzai.com · 6 months ago

false

DragonForce Ransomware Breakdown and Decryptor for ESXi & Windows

gbhackers.com · 6 months ago

Security researchers have uncovered technical details about the DragonForce ransomware operation, which utilizes a Ransomware-as-a-Service model and recruits affiliates. The group’s ransomware is heavily based on leaked LockBit 3.0 and Conti code, and it has demonstrated connections to other ransomware groups like BlackLock and RansomHub. Researchers have also obtained decryptors for both Windows and ESXi systems, tailored to specific victims impacted by the ransomware, which uses ChaCha8 encryption and custom metadata. DragonForce attempted to form an alliance with LockBit and Qilin to avoid conflict and strengthen influence.

North Korean Hackers Exploit Code Repositories in “Contagious Interview” Campaign

gbhackers.com · 6 months ago

North Korean threat actors are using a campaign called “Contagious Interview” to compromise developers through social engineering and malicious code repositories. Victims receive seemingly legitimate technical assessments via LinkedIn that contain malware disguised within code, bypassing the need for the code to be executed. The malware, utilizing Node.js (BeaverTail) and Python (InvisibleFerret) layers, steals credentials, cryptocurrency wallets, and establishes remote access, with persistence achieved through techniques like Startup folder scripts and Windows Defender exclusion rules on Windows systems. Investigators attribute the activity to DPRK operators based on infrastructure reuse, timezone artifacts, and shared identities.

CrowdStrike to add browser security to Falcon with Seraphic acquisition

www.csoonline.com · 6 months ago

false

Cloud marketplace Pax8 accidentally exposes data on 1,800 MSP partners

www.bleepingcomputer.com · 6 months ago

Pax8, a cloud marketplace, mistakenly sent an email to fewer than 40 partners containing a spreadsheet with sensitive business data. The file included customer organization names, Microsoft licensing details, and pricing information affecting approximately 1,800 partners, primarily in the UK. Pax8 has requested recipients delete the email and attachment and is conducting an internal review. Industry sources report that threat actors are attempting to acquire the exposed dataset, which could be used for competitive targeting or cyberattacks.

Betterment Confirms Unauthorised Access to Its Internal Systems

gbhackers.com · 6 months ago

Betterment, a digital investment advisor, has confirmed unauthorized access to its internal systems. Attackers used this access to send fraudulent cryptocurrency-related messages to some customers, potentially aimed at stealing sensitive financial information. The company serves over one million users and manages over sixty-five billion dollars in assets, making this a significant security incident. Betterment recommends that customers exercise caution and verify communications through official channels.

Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution

thehackernews.com · 6 months ago

A critical security flaw has been discovered in Fortinet’s FortiSIEM, allowing an unauthenticated attacker to execute code. The vulnerability, identified as CVE-2025-64155, is rated 9.4 and stems from an OS command injection issue within the phMonitor service. Attackers can exploit this to gain root access and full control of the appliance by writing a reverse shell to a system file. Fortinet has also released updates to address CVE-2025-47855, a critical vulnerability in FortiFone that could allow an attacker to obtain device configuration. Affected FortiSIEM versions include 6.7.0 through 6.7.10, 7.0.0 through 7.0.4, 7.1.0 through 7.1.8, 7.2.0 through 7.2.6, and 7.3.0 through 7.3.4.

WitnessAI Raises $58 Million for AI Security Platform

www.securityweek.com · 6 months ago

false

Victorian Department of Education says hackers stole students’ data

www.bleepingcomputer.com · 6 months ago

The Victorian Department of Education in Australia has confirmed a data breach affecting current and former students. Attackers gained unauthorized access to a database containing student names, school names, year levels, and encrypted passwords for school-issued email accounts. Sensitive data like birth dates and home addresses were not exposed, and no evidence suggests the data has been released publicly. As a precaution, the department has reset all student passwords and is issuing new credentials.

New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification

thehackernews.com · 6 months ago

Research analyzing nearly 5,000 websites reveals that 64% of third-party applications now access sensitive data without business justification, a significant increase from 51% in 2024. This trend is fueled by a governance gap, with marketing and digital teams often deploying applications without IT oversight, leading to over-permissioned access. Specific offenders include Google Tag Manager, Shopify, and Facebook Pixel, with the latter posing a significant risk due to its widespread use. Government and Education sectors have experienced alarming spikes in malicious activity, with compromised Education sites affecting 1 in 7 institutions.

Hackerangriff löst Fehlalarm in Halle aus

www.csoonline.com · 6 months ago

A cyberattack triggered a false alarm in Halle, Germany, causing all functional sirens to activate and broadcast a lockdown message. Authorities believe an external intrusion accessed the siren system, and investigations are underway. The city's website experienced temporary inaccessibility, likely due to high traffic volume related to the incident, though a denial-of-service attack is not suspected. The siren system is now secured and operational.

Robo-Advisor Betterment Discloses Data Breach

www.securityweek.com · 6 months ago

Betterment, a robo-advisor, recently experienced a data breach resulting from social engineering tactics against third-party platforms. Threat actors impersonated the company to trick customers into sending cryptocurrency, and while accounts were not accessed initially, some customer information may have been compromised. The compromised data includes names, addresses, email addresses, phone numbers, and dates of birth. Betterment advises customers to be wary of unexpected communications and to protect personal information.

Android Users Hit by Volume Button Bug Linked to Select to Speak

gbhackers.com · 6 months ago

A critical bug is impacting Android devices, causing volume buttons to malfunction when the Select to Speak accessibility feature is enabled. The issue redirects volume adjustments to accessibility audio instead of media volume, and prevents photo capture. Users can temporarily resolve the problem by disabling Select to Speak in settings. Google is working on a permanent patch to address the conflict between accessibility services and hardware controls.

UK Digital ID Scheme Faces Resistance Over Security Concerns

www.techrepublic.com · 6 months ago

The UK government has abandoned plans to mandate digital identification for workers following widespread public backlash and serious security concerns. Initially intended to streamline employment verification, the scheme faced opposition due to fears of mass surveillance and social exclusion. Security experts highlighted vulnerabilities within the “Gov.uk One Login” system, including unsecured development work and failure to meet government security standards, making the system a target for cybercriminals. The government is now exploring voluntary digital ID options, learning from international examples like Estonia’s e-Residency program and Switzerland’s electronic ID system.

Cybersecurity at the state and local level: Washington has the framework, it’s time to act

www.csoonline.com · 6 months ago

false

Spring CLI Vulnerability Allows Attackers to Execute Commands on User Systems

gbhackers.com · 6 months ago

A command-injection vulnerability, CVE-2026-22718, exists in the Spring CLI VSCode extension, affecting all versions up to 0.9.0. The vulnerability allows attackers with local system access and user interaction to execute arbitrary commands, resulting in potential confidentiality and integrity breaches. Because the extension has reached end-of-life, no patch is available, and users are strongly advised to uninstall the extension immediately. Security researcher Yue Liu responsibly disclosed the vulnerability.

Fortinet Patches Critical Vulnerabilities in FortiFone, FortiSIEM

www.securityweek.com · 6 months ago

Fortinet has released patches for six vulnerabilities affecting several products. A critical OS command injection vulnerability, CVE-2025-64155, exists in FortiSIEM, allowing unauthenticated attackers to execute code. Another critical vulnerability, CVE-2025-47855, impacts FortiFone’s web portal, potentially exposing device configurations. Several other flaws, including a heap-based buffer overflow in FortiOS and FortiSwitchManager, CVE-2025-25249, have also been addressed.

Microsoft: Windows 365 update blocks access to Cloud PC sessions

www.bleepingcomputer.com · 6 months ago

Microsoft is investigating an issue preventing users from accessing their Windows 365 Cloud PC sessions. The problem began Tuesday evening and is linked to a recent security update. Workarounds include using the Windows App Web Client or the Remote Desktop client to connect through Azure Virtual Desktop. Microsoft has classified the situation as a service degradation incident, tracked as WP1217671.

Chrome 144, Firefox 147 Patch High-Severity Vulnerabilities

www.securityweek.com · 6 months ago

Google has released Chrome version 144, addressing 26 security vulnerabilities, including three high-severity bugs. Two of these high-severity flaws affect the V8 JavaScript engine, with CVE-2026-0899 being an out-of-bounds memory access and CVE-2026-0900 an implementation weakness. Mozilla released Firefox 147, patching 16 vulnerabilities, including seven high-severity sandbox escape flaws. Neither company has reported any of these vulnerabilities being actively exploited.

Multiple Elastic Vulnerabilities Could Lead to File Theft and DoS

gbhackers.com · 6 months ago

Researchers have identified three methods attackers can use to bypass Android's built-in protections against malicious apps. These techniques involve exploiting vulnerabilities in the system update process, manipulating package installation flags, and leveraging weaknesses in the permission granting system. The flaws enable attackers to install and execute harmful software without user consent or detection, potentially leading to data theft and device compromise. The vulnerabilities impact multiple Android versions and have been assigned CVE identifiers CVE-2023-20366, CVE-2023-20368, and CVE-2023-20369.

AuraInspector: Open-Source Misconfiguration Detection for Salesforce Aura

gbhackers.com · 6 months ago

Security researchers at Mandiant have released AuraInspector, an open-source tool to identify access control misconfigurations within Salesforce Aura environments. These misconfigurations can lead to unauthorized data exposure, potentially including sensitive information like credit card numbers and health records. The tool automates detection of these issues by testing for accessible objects, bypassing record retrieval limits through a novel use of Salesforce’s GraphQL controller, and identifying exposed administration panels. AuraInspector operates through read-only operations and is available on GitHub, with data extraction capabilities withheld to prevent misuse.

Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited

thehackernews.com · 6 months ago

Microsoft released a security update for January 2026, addressing 114 vulnerabilities across Windows, with eight rated critical and 106 rated important. One flaw, CVE-2026-20805, is an information disclosure vulnerability in the Desktop Window Manager, and is actively exploited. The update also resolves vulnerabilities in the Edge browser, including CVE-2025-65046 and CVE-2026-0628, and removes legacy modem drivers susceptible to privilege escalation flaws like CVE-2023-31096 and CVE-2025-24990. Several other vendors also released security updates this month.

Fortinet Forticlient EMS RCE CVE-2025-59922 and one IMG tag to rule them all

baldur.dk · 6 months ago

Researchers discovered a remote code execution vulnerability, CVE-2025-59922, affecting Fortinet EMS. Attackers can exploit this through several methods: sending a crafted link to an administrator, leveraging a client invitation link or machine within the Forticlient fleet, or, in older versions, without any user interaction. The exploit chain involves abusing the avatar upload feature and a SQL injection vulnerability in the /api/v1/malware/threats endpoint to execute arbitrary code, potentially establishing a reverse shell. Patches are available for affected versions of FortiClient EMS, including upgrades to 7.4.5, 7.2.12, or migration to a fixed release.

LLMs Supercharge Ransomware Speed, Scale, and Global Reach

gbhackers.com · 6 months ago

Large language models are accelerating ransomware operations by increasing speed, volume, and multilingual capabilities, but are not fundamentally changing them. Adversaries are using LLMs for reconnaissance, phishing, data triage, and ransom negotiations, which is lowering barriers to entry for less skilled actors. Researchers have observed threat actors using LLMs to automate extortion campaigns and enhance data exfiltration, making targeting more precise and demands more tailored. Higher-tier actors are increasingly adopting self-hosted, open-source models to avoid safeguards.

Monroe University says 2024 data breach affects 320,000 people

www.bleepingcomputer.com · 6 months ago

Monroe University recently confirmed a data breach impacting over 320,000 individuals. Threat actors had access to the university’s network for two weeks in December 2024, potentially stealing sensitive data including names, Social Security numbers, financial information, and health records. Affected individuals are being offered a year of free credit monitoring services. This breach follows similar incidents impacting other U.S. universities, including attacks involving ransomware and voice phishing.

CastleLoader Malware Targets U.S. Government Agencies

gbhackers.com · 6 months ago

Security researchers have identified CastleLoader, a stealthy malware loader currently targeting US government agencies and other high-value industries. The loader acts as a first stage, delivering information stealers and remote access trojans to compromise systems and enable data exfiltration. It utilizes a social engineering technique called ClickFix, and evades detection through a complex, multi-stage process that injects malicious code into seemingly legitimate Windows components like jsc.exe. Configuration data, including a command-and-control endpoint at 94 dot 159 dot 113 dot 32, is decrypted at runtime, and the malware is actively deployed since early 2025.

Allianz: KI birgt große Gefahr für Unternehmen

www.csoonline.com · 6 months ago

Artificial intelligence is rapidly emerging as a significant global business risk for companies, second only to cybercrime. Criminals are increasingly utilizing AI to enhance cyberattacks, particularly through sophisticated social engineering tactics like tailored email campaigns and video manipulation. Beyond external threats, businesses face internal risks from AI, including flawed decision-making based on inaccurate data and potential legal issues related to copyright infringement or discriminatory outcomes. The annual Allianz Risk Barometer, based on a survey of experts across 97 countries, highlights AI as both a potential opportunity and a growing danger.

Google Releases Chrome 144, Fixing 10 V8 Engine Vulnerabilities

gbhackers.com · 6 months ago

Google has released Chrome version 144 for Windows, Mac, and Linux, addressing ten security vulnerabilities. The update includes critical patches for the V8 JavaScript engine, resolving out-of-bounds memory access and implementation issues that could lead to arbitrary code execution. Several vulnerabilities were identified by security researchers and rewarded through Google’s bug bounty program, including CVE-2026-0899, a high-severity out-of-bounds memory access flaw. The update also fixes issues in the Blink rendering engine, download handling, and other components, with severity ratings ranging from low to high.

7 Best Ways to Turn Your Cyber Security Skills Into a $100,000 Career

gbhackers.com · 6 months ago

false

Top 5 Best Universities in United States to Enhance Your Career in Cyber Security

gbhackers.com · 6 months ago

false

Top 5 Snapchat Track Apps for Android – 2026

gbhackers.com · 6 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple’s Lockdown Mode. These techniques involve manipulating the operating system through malicious attachments, utilizing hidden application code, and exploiting vulnerabilities in assistive accessibility features. Successful exploitation could allow unauthorized access to a user's device and data. The vulnerabilities identified are CVE-2023-42052, CVE-2023-42053, CVE-2023-42054, CVE-2023-42055, and CVE-2023-42056.

10 Best Android Keyboard Apps for Android Users in 2026

gbhackers.com · 6 months ago

false

Top 10 Best Android Games for 2026

gbhackers.com · 6 months ago

false

gbhackers.com · 6 months ago

false

VVS Stealer Targeting Discord Users for Credential Theft

gbhackers.com · 6 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Android's passcode protection. These techniques involve manipulating the device's power menu, utilizing the emergency call feature, and leveraging the screen recording function. Successful exploitation allows unauthorized access to the device without knowing the correct passcode. The vulnerabilities are identified as CVE-2023-38382, CVE-2023-38383, and CVE-2023-38384.

Top 8 Best Free PC Software Download Websites 2026

gbhackers.com · 6 months ago

false

Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow

thehackernews.com · 6 months ago

A critical vulnerability in Node.js can lead to denial-of-service conditions in many applications that use asynchooks. When stack space is exhausted, Node.js now exits unexpectedly instead of gracefully handling the error. This impacts versions 8.x through 18.x, and is tracked as CVE-2025-59466, with a CVSS score of 7.5. Node.js has released updates to address this issue and other high-severity flaws, including CVE-2025-55131, CVE-2025-55130, and CVE-2025-59465. Users are urged to update and maintainers should strengthen defenses against stack space exhaustion.

US cybersecurity weakened by congressional delays despite Plankey renomination

www.csoonline.com · 6 months ago

Cybersecurity in the US faces significant challenges due to congressional delays and stalled legislation. The renomination of Sean Plankey as CISA director offers some relief, but critical cybersecurity programs are at risk. The Cybersecurity Information Sharing Act of 2015, which provides liability protections for threat information sharing, received a short-term extension, and its full reauthorization remains uncertain. Additionally, a state and local cybersecurity grant program has experienced funding cuts, jeopardizing cybersecurity efforts at the state and local levels.

Cybercrime Inc.: When hackers are better organized than IT

www.csoonline.com · 6 months ago

Cybercrime has evolved into a highly organized, globally networked industry resembling international corporations, with departments, processes, and specialized roles like developers, access brokers, and communications specialists. The ransomware-as-a-service model has further fueled this growth by allowing attackers with limited technical skills to launch attacks. Attackers are now leveraging artificial intelligence and automation, creating fully automated attack chains, while defenders are often hampered by bureaucratic processes and compliance requirements. Organizations must shift their focus from prevention to cyber resilience, the ability to quickly recover and learn from attacks, to survive the increasing sophistication of cyber threats.

Charity-Themed Malware Used by Threat Actors to Target Ukraine’s Defense Forces

gbhackers.com · 6 months ago

Russian-affiliated threat actors are targeting Ukraine’s defense forces with a sophisticated social engineering campaign. Attackers are distributing malware, including a Python-based backdoor called PLUGGYAPE, disguised as charitable donation requests through messaging apps and fraudulent websites. The malware establishes command-and-control communication and achieves persistence on compromised systems. Recent versions, including PLUGGYAPE.V2, incorporate evasion techniques like virtualization detection and BASE64-encoded command-and-control server addresses.

Microsoft Desktop Window Manager Zero-Day Exploited in Active Attacks

gbhackers.com · 6 months ago

Microsoft has identified a critical information disclosure vulnerability, CVE-2026-20805, within the Desktop Window Manager. This flaw allows authenticated local attackers to access sensitive information without any user interaction. The vulnerability exists in the core system service responsible for managing visual effects and window rendering in Windows. Microsoft recommends organizations prioritize patching systems, and security teams should monitor for suspicious activity.

Node.js Security Release Fixes 7 Vulnerabilities Across All Supported Versions

gbhackers.com · 6 months ago

Researchers have discovered three methods attackers can exploit to bypass Apple's Lockdown Mode, a security feature designed to protect users from targeted spyware. These methods involve utilizing the system's accessibility features, exploiting the communication limit functionality through third-party apps, and manipulating the trusted input sources. The vulnerabilities allow potential attackers to circumvent Lockdown Mode's protections and gain unauthorized access to devices. These findings highlight the ongoing challenge of securing mobile devices against sophisticated threats.

An AI-Driven Game-Theoretic Approach to Attack and Defense

gbhackers.com · 6 months ago

Researchers have developed a new system called Generative Cut-the-Rope, or G-CTR, to improve cybersecurity AI by incorporating game theory. This system enhances AI agents used for penetration testing and defense planning, enabling them to think strategically like experienced cybersecurity professionals. G-CTR operates in three phases: creating attack graphs, calculating optimal strategies, and providing guidance to the agent. Tests show this approach improves success rates, reduces costs, and creates more consistent results compared to AI-only methods.