Blahalla

The Hidden Cost of Recurring Credential Incidents

thehackernews.com · 6 months ago

Recurring credential incidents are a persistent problem for organizations, costing more than just major data breaches. Repeated account lockouts and compromised credentials lead to increased helpdesk tickets and disruptions in workflows, costing organizations significant time and money. Password resets alone account for up to 30% of helpdesk tickets, with each costing around $70. Tools like Specops Password Policy’s Breached Password Protection, which scans against a database of over 5.8 billion compromised passwords, can help mitigate these risks.

Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems

www.securityweek.com · 6 months ago

The Medusa ransomware group, also known as Storm-1175, is rapidly exploiting vulnerabilities to compromise organizations. This ransomware-as-a-service has targeted over 300 organizations, particularly in critical infrastructure, healthcare, education, and finance sectors across Australia, the United Kingdom, and the United States. The group quickly weaponizes newly disclosed vulnerabilities and exploits zero-day flaws, demonstrated by exploiting a SAP NetWeaver bug just one day after public disclosure. Microsoft attributes exploitation of CVE-2026-23760 and CVE-2025-10035 to the threat actor.

Microsoft says Medusa-linked Storm-1175 is speeding ransomware attacks

www.csoonline.com · 6 months ago

Microsoft has identified Storm-1175, a cybercrime group linked to the Medusa ransomware, as conducting exceptionally rapid ransomware attacks. This group is exploiting vulnerable web-facing systems, sometimes moving from initial access to ransomware deployment within just 24 hours, and has targeted organizations in healthcare, education, finance, and professional services. They have leveraged zero-day vulnerabilities and chained multiple exploits to accelerate their operations, highlighting a shift away from traditional, longer dwell times. Experts emphasize the need for proactive attack surface reduction, rapid patching, and improved network segmentation to counter this accelerated threat.

Hackers Exploit Next.js React2Shell Vulnerability, Breach 766 Hosts in 24 Hours

gbhackers.com · 6 months ago

Hackers are exploiting a critical vulnerability, CVE-2025-55182, known as React2Shell, in Next.js applications to steal credentials and secrets. The automated campaign, tracked as UAT-10608, has already compromised at least 766 servers in under 24 hours, using a framework called NEXUS Listener to organize stolen data. The vulnerability allows for remote code execution without authentication, enabling attackers to extract sensitive information such as database credentials, SSH keys, and cloud tokens. Stolen data is uploaded and accessible through a password-protected interface, and researchers have observed instances left exposed. Security experts advise immediate patching and a thorough audit of server-side configurations.

Tor-Backed ClickFix Campaign Drops Node.js RAT on Windows

gbhackers.com · 6 months ago

Hackers are utilizing a deceptive technique called ClickFix to distribute a Node.js-based remote access Trojan targeting Windows users. The attack begins with a fake CAPTCHA prompt, which triggers a hidden PowerShell command to silently install a malicious MSI file. This malware operates with a fileless-like architecture, dynamically downloading components from a command-and-control server through the Tor network to evade detection. An operational security failure exposed a malware-as-a-service platform, revealing features like multi-operator dashboards and automated attack rules.

Supply chain security is now a board-level issue: Here’s what CSOs need to know

www.csoonline.com · 6 months ago

Supply chain security has become a critical, board-level issue due to increasing regulations and the widespread use of open-source software, with 97% of applications containing open-source code and 86% including vulnerabilities. The Log4Shell vulnerability highlighted the interconnectedness of software ecosystems and the potential for rapid exploitation. Organizations now face pressure from regulations like the European Cyber Resilience Act, which carries potential fines of up to 2.5% of global turnover, and must utilize Software Bills of Materials, or SBOMs, to manage vulnerabilities and communicate effectively with customers. Finding the right security tools involves careful evaluation to minimize false positives and automate workflows, and documentation is crucial for demonstrating responsible software stewardship.

Hong Kong Police Can Force You to Reveal Your Encryption Keys

www.schneier.com · 6 months ago

Hong Kong police now have the authority to compel individuals to reveal encryption keys, even those passing through the airport. This change, enacted March 23, 2026, expands enforcement of the National Security Law allowing police to demand passwords and access to electronic devices like cellphones and laptops. Refusal to comply with these demands is now a criminal offense. Authorities can also seize and retain personal electronic devices if deemed connected to national security offenses.

Critical Android Flaw Allows Zero-Interaction Denial-of-Service Attacks

gbhackers.com · 6 months ago

Researchers have identified several vulnerabilities affecting Ivanti Connect Secure and Policy Secure gateways. These flaws include an authentication bypass allowing unauthorized access and a cross-site scripting vulnerability that could lead to sensitive information disclosure. One vulnerability allows for remote code execution with sufficient privileges. Affected versions include 21.12.0.0 through 23.7.1, and 23.8.0.0 through the latest build, 23.8.2.2, with associated CVEs including CVE-2024-20247, CVE-2024-23292, CVE-2024-23293, CVE-2024-23294, and CVE-2024-23295.

German Police Unmask REvil Ransomware Leader

www.securityweek.com · 6 months ago

German authorities have identified Daniil Maksimovich Shchukin as the leader of the GandCrab and REvil ransomware operations. Shchukin, along with co-conspirator Anatoly Sergeevitsch Kravchuk, orchestrated over 130 extortion attempts between 2019 and 2021, resulting in over 40 million dollars in damages and 2 million dollars in ransom payments. These operations utilized a ransomware-as-a-service model and targeted both businesses and public institutions. Shchukin, also known as Oneiilk2, is believed to be currently residing in Russia.

The rise of proactive cyber: Why defense is no longer enough

www.csoonline.com · 6 months ago

false

The noisy tenants: Engineering fairness in multi-tenant SIEM solutions

www.csoonline.com · 6 months ago

There are growing concerns that major SIEM offerings advertise features like round the clock SOC monitoring, proactive threat hunting, and AI-driven detection without explaining how they prevent multi-tenant interference, leaving platforms exposed to the noisy neighbor effect where one tenant’s high-volume workload can increase ingestion latency and violate SLAs for others. There are clear architectural layers in modern SIEMs, ingestion, normalization, rule based detection, ad hoc search, storage, and analytics, and fairness can be engineered through admission control and soft rate shaping such as token buckets, tenant aware fair share scheduling via weighted fair queuing and per tenant partitions, virtual resource isolation with quotas and reservations, and per tenant buffering to decouple backpressure. There are trade offs: provisioning a dedicated cluster per tenant eliminates noisy neighbors and simplifies compliance at much higher cost, while shared deployments must be transparent about fairness engineering to preserve real time detection and response.

Life imprisonment for Cambodian scam compound operators – but will it make a difference?

www.bitdefender.com · 6 months ago

Cambodia has enacted a new law to combat online scams, imposing severe penalties including life imprisonment for ringleaders involved in violence, trafficking, or forced labor. The law aims to protect individuals forced into scamming operations from criminal liability. Authorities claim to have shut down hundreds of scam centers and arrested numerous leaders, but concerns remain about corruption and the links between scam operations and state-licensed casinos. An estimated 100,000 to 150,000 people are exploited in these compounds, contributing to over 12.5 billion US dollars in annual fraud.

Attackers Exploit Flowise Injection Vulnerability as 15,000+ Instances Remain Exposed

gbhackers.com · 6 months ago

A critical security vulnerability, tracked as CVE-2025-59528, is currently being exploited in the Flowise AI development platform. The flaw allows remote attackers to execute malicious code and gain complete control of servers due to improper handling of external server configurations. Approximately 15,000 Flowise instances remain exposed online, making them targets for attackers who can execute arbitrary commands and potentially exfiltrate sensitive data. Users should immediately update to version 3.0.6 to mitigate the risk, as previous vulnerabilities like CVE-2025-8943 and CVE-2025-26319 have also been actively exploited.

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

thehackernews.com · 6 months ago

New research has identified vulnerabilities in high-performance GPUs, enabling privilege escalation and potential system compromise. The GPUBreach attack exploits RowHammer bit-flips in GDDR6 memory to corrupt GPU page tables, allowing unprivileged processes to gain control and escalate privileges to the CPU. This attack bypasses IOMMU protections and can lead to the leaking of cryptographic keys and the degradation of machine learning model accuracy. Concurrent research, GDDRHammer and GeForge, also targets GPU memory corruption, with GeForge requiring IOMMU to be disabled.

White House Seeks to Slash CISA Funding by $707 Million

www.securityweek.com · 6 months ago

false

Fake Installers Spread RATs, Monero Miners in Ongoing Malware Campaign

gbhackers.com · 6 months ago

A persistent malware campaign, tracked as REF1695, is using fake software installers to infect systems with various malicious tools. Attackers are deploying RATs, Monero cryptominers, and a new.NET implant called CNB Bot, alongside tools like PureRAT, PureMiner, and SilentCryptoMiner. The operation utilizes techniques like Microsoft Defender exclusion abuse, custom loaders with driver deployment for enhanced mining efficiency, and GitHub for payload delivery to evade detection and maximize profits through cryptomining and Cost Per Action fraud. Researchers estimate the actor has received over 9,400 USD in Monero.

Detecting CI/CD Supply Chain Attacks with Canary Credentials

tracebit.com · 6 months ago

A threat actor group, TeamPCP, recently compromised several open-source tools including Trivy, KICS, LiteLLM, and Telnyx, using stolen credentials to propagate through the supply chain. The malware harvests secrets like SSH keys and cloud credentials, with the LiteLLM compromise resulting in approximately 300GB of data exfiltration. To detect credential exfiltration, a technique called canary credentials, fake credentials injected into build environments, can provide an alert when compromised actions or packages exfiltrate them. Tracebit offers a free GitHub Action to deploy these canaries, providing context and detection of compromised workflows.

Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns

gbhackers.com · 6 months ago

Researchers have identified several methods attackers can use to bypass security controls on Apple macOS devices. These techniques include exploiting vulnerabilities in system daemons, manipulating entitlements, and leveraging code injection to gain elevated privileges. Attackers can also abuse System Integrity Protection, a security feature designed to protect system files, to install malicious software. The vulnerabilities include CVE-2023-32376, CVE-2023-32377, CVE-2023-32378, CVE-2023-32379, and CVE-2023-32380.

Iran-Linked Hackers Hit M365 Tenants in Middle East Password Spray Campaign

gbhackers.com · 6 months ago

Iran-linked threat actors conducted a password-spraying campaign targeting Microsoft 365 environments across the Middle East throughout March 2026. The campaign impacted over 300 entities in Israel and more than 25 in the United Arab Emirates, with limited targeting also observed in Europe, the United States, the United Kingdom, and Saudi Arabia. Attackers utilized VPN services and rotating IP addresses, including Tor exit nodes, to evade detection while attempting to gain access to municipal systems, government agencies, energy sector organizations, and private companies. Researchers attribute the activity to an Iran-based threat actor with similarities to known groups like Gray Sandstorm and Peach Sandstorm.

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

thehackernews.com · 6 months ago

A China-based threat actor, known as Storm-1175, is rapidly deploying Medusa ransomware by exploiting a combination of zero-day and recently disclosed vulnerabilities. This group targets healthcare, education, finance, and professional services organizations in Australia, the United Kingdom, and the United States, often compromising systems within days or even 24 hours. Their attacks leverage tools like PowerShell, PsExec, and RMM software, and they routinely modify security configurations to evade detection. Storm-1175 has exploited over 16 vulnerabilities since 2023, including CVE-2023-21529, CVE-2023-27351, CVE-2023-46805, CVE-2024-1708, CVE-2024-27198, CVE-2025-10035, and CVE-2026-23760.

New Microsoft Defender Update Issued for Windows 11, Windows 10, and Server Images

gbhackers.com · 6 months ago

false

Wynn Resorts Says 21,000 Employees Affected by ShinyHunters Hack

www.securityweek.com · 6 months ago

Wynn Resorts has confirmed a data breach impacting more than 21,000 employees. The cybercrime group ShinyHunters initially claimed responsibility, alleging the theft of 800,000 records including Social Security numbers. The company likely paid a ransom of over one point five million dollars to have the data removed from a leak site. The attack targeted HR systems in October 2025 and is believed to be the work of Scattered Lapsus$ Hunters, a group formed from multiple cybercriminal organizations.

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

thehackernews.com · 6 months ago

Threat actors are actively exploiting a critical security vulnerability in the Flowise AI platform. The vulnerability, identified as CVE-2025-59528, allows for remote code execution due to a lack of security validation when parsing user-provided configuration settings. Over twelve thousand instances of Flowise are currently exposed, making them targets for opportunistic attacks. This vulnerability grants access to sensitive system modules, enabling attackers to execute arbitrary code and potentially compromise data, and follows similar previous vulnerabilities CVE-2025-8943 and CVE-2025-26319.

Microsoft Warns Storm-1175 Exploiting Web-Facing Vulnerabilities to Deploy Medusa Ransomware

gbhackers.com · 6 months ago

A threat actor, tracked as Storm-1175, is rapidly exploiting recently disclosed vulnerabilities to deploy the Medusa ransomware. The group targets organizations in Australia, the U.K., and the U.S., often breaching systems and deploying ransomware within 24 hours of exploiting a vulnerability. Storm-1175 has exploited vulnerabilities in Microsoft Exchange, PaperCut, Ivanti Connect Secure, and other products, including CVE-2025-31324, and uses tools like PowerShell, PsExec, and RMM software for lateral movement and persistence. Microsoft recommends hardening internet-facing assets, implementing VPN and WAF protections, and enabling MFA to mitigate this threat.

50,000 WordPress Sites Running Ninja Forms Vulnerable to Critical File Upload RCE

gbhackers.com · 6 months ago

A critical vulnerability has been discovered in the Ninja Forms File Upload plugin for WordPress, allowing unauthorized users to upload malicious files and gain remote code execution. The flaw, tracked as CVE-2026-0740, impacts approximately 50,000 websites and received a CVSS score of 9.8. The vulnerability stems from inadequate file extension validation during the upload process, enabling attackers to bypass security filters and upload executable files. Users are urged to update to version 3.3.27 to mitigate the risk.

CISA Alerts Defenders to Actively Exploited Fortinet Zero-Day Vulnerability

gbhackers.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a critical zero-day vulnerability actively being exploited in Fortinet products. This vulnerability, tracked as CVE-2026-35616, impacts FortiClient Enterprise Management Server and allows unauthenticated attackers to execute code without credentials. Organizations are urged to apply patches, follow security guidelines, or discontinue use of the product if mitigations are unavailable. Federal agencies and those following CISA guidance must address this vulnerability by April 9, 2026.

Fake TradingView Premium Reddit Posts Spread Vidar and AMOS Stealers

gbhackers.com · 6 months ago

Cybercriminals are exploiting Reddit to distribute fake TradingView Premium software, which secretly installs Vidar and AMOS information-stealing malware on Windows and macOS systems. The attackers create seemingly legitimate Reddit accounts and subreddits to lure victims seeking free or pirated software. Downloaded files are password-protected ZIP archives hosted on compromised business domains and contain malicious components that harvest credentials, cookies, and cryptocurrency wallets. Security experts advise blocking distribution domains, monitoring for suspicious downloads, and educating users about the risks of free premium software.

Windows Defender 0-Day Published Online, Giving Attackers Potential Full Access

gbhackers.com · 6 months ago

A zero-day vulnerability, called BlueHammer, has been publicly disclosed affecting Windows Defender. This flaw allows attackers to gain local privilege escalation and potentially full administrative access to compromised systems. The exploit targets permission processing weaknesses and the proof of concept code is available on GitHub. Security experts are warning of potential misuse by threat actors, and Microsoft has not yet released a patch.

I was targeted by a fake job interview on Wellfound. Instead of becoming a victim I reverse-engineered the malware. Here's the full analysis: 571 encrypted config values decrypted, C2 and Sentry DSN exposed, DPRK/Contagious Interview attribution.

www.virustotal.com · 6 months ago

NULL

Taking a Break - 2026-04-06

blog.badsectorlabs.com · 6 months ago

false

DeepZero: An automated LLM/Ghidra pipeline for finding BYOVD zero-days in Windows drivers

blog.ahmadz.ai · 6 months ago

Researchers have developed an automated pipeline named DeepZero to identify potential vulnerabilities in Windows kernel drivers. The pipeline utilizes a combination of tools, including Ghidra for decompilation, Semgrep for pattern matching, and Google’s Gemini 2.5 for analysis, to flag exploitable drivers. During its initial run, the pipeline successfully identified a zero-day vulnerability in an ASUS driver, which is currently undergoing responsible disclosure. The system prioritizes drivers with Windows 10/11 compatibility, deduplicates drivers by SHA256 hash, and relies on a filter based on dangerous APIs like MmMapIoSpace and IoAllocateMdl.

German authorities identify REvil and GandCrab ransomware bosses

www.bleepingcomputer.com · 6 months ago

German authorities have identified two Russian nationals as leaders of the GandCrab and REvil ransomware operations, which occurred between 2019 and 2021. Daniil Shchukin and Anatoly Kravchuk are accused of orchestrating over 130 extortion cases, resulting in over two point two million dollars in ransom payments and more than forty million dollars in total financial damage. REvil, also known as Sodinokibi, utilized tactics established by GandCrab and targeted organizations including Texas local governments and Kaseya. Both suspects are believed to be in Russia and are now listed on the EU’s Most Wanted portal.

German authorities identify REvil and GandCrab ransomware bosses

www.bleepingcomputer.com · 6 months ago

German authorities have identified two Russian nationals, Daniil Shchukin and Anatoly Kravchuk, as the leaders of the GandCrab and REvil ransomware operations spanning 2019 to 2021. Shchukin, using the alias UNKN/UNKNOWN, and Kravchuk allegedly orchestrated at least 130 extortion cases, resulting in over $2.2 million in ransom payments and an estimated $40 million in financial damage. REvil, built on the affiliate model of GandCrab, notably impacted Acer, Texas local governments, and was involved in the Kaseya supply-chain attack. Both suspects are believed to be in Russia and are now on the EU’s Most Wanted portal.

Understanding Current Threats to Kubernetes Environments

unit42.paloaltonetworks.com · 6 months ago

Kubernetes environments are experiencing a significant increase in threat actor activity, with a 282 percent rise in the last year, often targeting the IT sector. Attackers are exploiting misconfigurations and vulnerabilities, including CVE-2025-55182, to steal credentials, escalate privileges, and compromise cloud infrastructure. Compromise typically results from a combination of weaknesses like overly permissive access and long-lived credentials. Security recommendations include enforcing strict role-based access control, using short-lived service account tokens, and implementing continuous runtime monitoring for malicious activity.

New GPUBreach attack enables system takeover via GPU rowhammer

www.bleepingcomputer.com · 6 months ago

Researchers have developed a new attack, called GPUBreach, that exploits Rowhammer vulnerabilities in GDDR6 memory on GPUs to gain system-level control. This technique allows an attacker to corrupt GPU page tables, enabling arbitrary memory access and potentially escalating privileges to the CPU. The attack bypasses IOMMU protections and may lead to complete system compromise, even without disabling IOMMU. NVIDIA is expected to update its security advisories, and consumer GPUs are currently unmitigated without ECC memory.

What Teens Are Doing With Those Role-Playing Chatbots

www.nytimes.com · 6 months ago

NULL

AI-Assisted Supply Chain Attack Targets GitHub

www.darkreading.com · 6 months ago

A threat actor has been using AI-assisted automation to target open-source software repositories on GitHub in a campaign called "prt-scan," beginning March 11. The attacker opened over 475 malicious pull requests in a short period, attempting to steal credentials and compromise NPM packages, with a roughly 10% success rate. This campaign follows a similar February attack, "hackerbot-claw," exploiting the pullrequesttarget workflow trigger to access sensitive data. Experts note the attacker’s payload, while ambitious, contained illogical elements, demonstrating a lack of full understanding of GitHub’s permissions model.

Axios Attack Shows How Complex Social Engineering Is Industrialized

www.darkreading.com · 6 months ago

A recent cyberattack on the Axios NPM package exposed a sophisticated and industrialized social engineering campaign likely conducted by the North Korean threat group UNC1069. Attackers spent weeks building rapport with a lead maintainer, using cloned personas and a convincing Slack workspace to gain access through a malicious Microsoft Teams file containing a remote access Trojan. This technique, previously reserved for high-value targets, now poses a significant risk to the open-source software community due to the potential for widespread compromise through commonly used packages. The attackers exploited advances in AI and delivery mechanisms, highlighting a permanent shift in the threat landscape.

Fortinet Issues Emergency Patch for FortiClient Zero-Day

www.darkreading.com · 6 months ago

Fortinet has released an emergency patch to address a zero-day vulnerability, CVE-2026-35616, in its FortiClient Endpoint Management Server software. This improper access control flaw allows an unauthenticated attacker to execute code and has been exploited in the wild. The vulnerability received a severity score of 9.1 and versions 7.4.5, 7.4.6, and 7.4.7 are affected; a hotfix is available. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to address it by April 9.

Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit

www.bleepingcomputer.com · 6 months ago

A security researcher has publicly released exploit code for a Windows privilege escalation vulnerability, known as BlueHammer. The flaw allows attackers to gain SYSTEM or elevated administrator permissions and access the Security Account Manager database. The researcher expressed frustration with Microsoft’s handling of the vulnerability disclosure process, leading to the public release. While the exploit code contains bugs and may not function reliably on all systems, it represents a significant risk if local access is achieved.

Microsoft fixes Classic Outlook bug causing email delivery issues

www.bleepingcomputer.com · 6 months ago

false

Responsible disclosure is structurally dead — not dying. Here's the analysis and what replaces it.

www.thecrucible.systems · 6 months ago

This report discusses the concept of responsible disclosure. It emphasizes that findings should be considered a starting point for verification rather than a final verdict. The report was produced using a reasoning methodology called Crucible. A PDF document of this whitepaper is available for download.

New Mexico’s Meta Ruling and Encryption

www.schneier.com · 6 months ago

A recent New Mexico court ruling against Meta raises concerns about the future of end-to-end encryption and overall security. The state argues that Meta’s implementation of encryption in Facebook Messenger enabled harmful activity, like the exchange of child sexual abuse material, and is seeking changes to protect minors. This “design liability” framework could discourage companies from implementing security improvements if those improvements can be portrayed as shielding bad actors. The ruling may lead to companies avoiding internal risk assessments and documentation, ultimately making everyone less safe.

Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations

thehackernews.com · 6 months ago

A password-spraying campaign targeting Microsoft 365 environments in Israel and the U.A.E. has impacted over 300 organizations, with activity also observed in Europe, the United States, the United Kingdom, and Saudi Arabia. This campaign, attributed to an Iran-nexus threat actor, uses a technique where a single password is tested against multiple usernames to discover weak credentials. Simultaneously, the Iranian ransomware group Pay2Key recently targeted a U.S. healthcare organization, deploying a new ransomware variant with enhanced evasion capabilities, and previously offered affiliates increased ransom shares for attacks against Iran's enemies. The activity aligns with Iranian hacking groups like Peach Sandstorm and Gray Sandstorm.

Microsoft removes Support and Recovery Assistant from Windows

www.bleepingcomputer.com · 6 months ago

false

Microsoft links Medusa ransomware affiliate to zero-day attacks

www.bleepingcomputer.com · 6 months ago

A China-based cybercriminal group known as Storm-1175 is rapidly exploiting vulnerabilities, including zero-day exploits, to deploy Medusa ransomware. The group moves quickly from initial network access to data exfiltration and ransomware deployment, often within 24 hours. Storm-1175 has exploited over 16 vulnerabilities across 10 software products, including Microsoft Exchange (CVE-2023-21529), Papercut (CVE-2023-27351 and CVE-2023-27350), Ivanti (CVE-2023-46805 and CVE-2024-21887), and ConnectWise (CVE-2024-1709 and CVE-2024-1708), among others. This activity has impacted healthcare, education, professional services, and finance organizations in multiple countries, and has affected over 300 critical infrastructure organizations in the United States.

Drift $280M crypto theft linked to 6-month in-person operation

www.bleepingcomputer.com · 6 months ago

A sophisticated cyberattack has resulted in the theft of over 280 million dollars from the Solana-based Drift Protocol. Investigations by blockchain intelligence firms indicate North Korean hackers, specifically the group UNC4736, were responsible for the theft, which involved a six-month operation including in-person interactions with Drift contributors at industry conferences. The attackers reportedly compromised contributor accounts through a malicious code repository possibly exploiting a VSCode/Cursor vulnerability and a compromised TestFlight application. The group has also been linked to the 3CX supply-chain attack, the Radiant cryptocurrency theft, and Chrome zero-day exploitation.

Inside an AI‑enabled device code phishing campaign

www.microsoft.com · 6 months ago

Security researchers have uncovered a complex phishing campaign targeting users of Microsoft services. Attackers are leveraging AI and automation to generate device codes on demand, bypassing multi-factor authentication and extending the timeframe for successful credential theft. The phishing attacks use personalized lures and redirect traffic through trusted cloud services to evade detection, allowing for data exfiltration and account persistence. Mitigations include disabling the Device Code flow, strengthening anti-phishing policies, and using phishing-resistant MFA.

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

thehackernews.com · 6 months ago

North Korean state-sponsored hackers are increasingly using GitHub as command-and-control infrastructure to target organizations in South Korea. Attackers distribute malicious Windows shortcut files via phishing emails, which then deploy decoy documents and PowerShell scripts. These scripts evade detection by checking for security tools and establish persistence through scheduled tasks, ultimately exfiltrating host data to a GitHub repository. Security firms have also observed similar campaigns using Dropbox and a Python-based backdoor, alongside a shift to HWP OLE-based droppers to deliver RokRAT.

CISA orders feds to patch exploited Fortinet EMS flaw by Friday

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency is directing U.S. federal agencies to quickly address a security vulnerability in Fortinet’s Enterprise Management Server. The flaw, tracked as CVE-2026-35616, allows attackers to bypass authentication and potentially execute code. Fortinet has released fixes, and Shadowserver reports nearly two thousand exposed instances are currently online. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and urges all organizations to patch promptly.