Blahalla

New “Ghost Tap” Attack Hijacks Android Phones to Drain Bank Accounts

gbhackers.com · 6 months ago

Chinese threat actors are exploiting Near Field Communication technology on Android devices to steal funds from bank accounts remotely. This “Ghost Tap” attack uses malicious applications to relay payment data from victims' devices to attackers, enabling unauthorized transactions. Cybercriminals have processed approximately $355,000 in fraudulent transactions through this scheme, utilizing compromised point-of-sale terminals and mobile wallets. Several malware vendors, including TX-NFC, X-NFC, and NFU Pay, operate within Chinese cybercrime communities on Telegram, offering malware and support for prices ranging from $45 to $1,050. Authorities worldwide are responding with arrests and advisories regarding these attacks.

Microsoft Mandates MFA for Microsoft 365 Admin Center Access

gbhackers.com · 6 months ago

Microsoft is requiring multi-factor authentication for all users accessing the Microsoft 365 admin center to strengthen cloud security. The policy will be fully enforced on February 9, 2026, following a phased rollout beginning in early 2025. This change blocks password-only logins for high-privilege admin portals, mitigating credential attacks like phishing and password reuse. Microsoft recommends organizations enable MFA using available tools and audit privileged accounts to prevent disruptions.

Enterprises still aren’t getting IAM right

www.csoonline.com · 6 months ago

CyberArk research reveals many organizations are struggling with identity and access management, with 63% of cybersecurity leaders reporting employees bypass security controls for speed. A significant number of organizations continue to use always-on privileged access, and a concerning 54% regularly discover unmanaged accounts and secrets. Experts advise treating AI agents as distinct identities with unique access controls and implementing just-in-time privilege access to improve security posture and reduce risky behaviors like sharing credentials and using shared admin accounts. Ultimately, organizations need to prioritize security integration into workflows to minimize friction and ensure user compliance.

CISA retires 10 emergency cyber orders in rare bulk closure

www.bleepingcomputer.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has retired ten Emergency Directives, marking the largest number closed at one time. These directives, issued between 2019 and 2024, addressed urgent cybersecurity threats and are now considered resolved or covered by Binding Operational Directive 22-01. This directive requires agencies to patch vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, with some fixes required within days, as seen with CVE-2025-20333 and CVE-2025-20362. CISA says Emergency Directives are intended to be temporary measures.

5 Top Cybersecurity-Zertifizierungen: So pushen Sie Ihre CISO-Karriere

www.csoonline.com · 6 months ago

false

“The Conscience of a Hacker” is 40 today

phrack.org · 6 months ago

A manifesto written by someone identifying as "The Mentor" explores the motivations of hackers. It describes a sense of alienation from traditional schooling and societal norms, leading individuals to find community and purpose within the world of computers and technology. The author argues that their activities, driven by curiosity and a desire for knowledge, are unfairly labeled as criminal when compared to larger societal injustices. The author concludes that while individual hackers may be caught, the movement itself cannot be stopped.

Cisco identifies vulnerability in ISE network access control devices

www.csoonline.com · 6 months ago

A vulnerability has been identified in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) devices, assigned CVE-2026-20029. The flaw, stemming from improper handling of XML data, could allow an authenticated attacker with administrative privileges to access sensitive information, including potentially user credentials. Experts recommend rotating credentials, limiting access, and patching the affected systems as soon as possible to mitigate the risk. Proof-of-concept exploit code is available, and the vulnerability is classified as medium criticality with a CVSS score of 4.9. The issue highlights the ongoing problem of default or compromised credentials on network devices.

Gmail's new AI Inbox uses Gemini, but Google says it won’t train AI on user emails

www.bleepingcomputer.com · 6 months ago

false

New China-linked hackers breach telcos using edge device exploits

www.bleepingcomputer.com · 6 months ago

A China-linked threat actor, known as UAT-7290, is targeting telecommunications providers and expanding operations into Southeastern Europe. The group uses Linux-based malware, including RushDrop, SilentRaid, and Bulbature, along with Windows implants like RedLeaves and ShadowPad, to compromise systems. UAT-7290 establishes Operational Relay Boxes using Bulbature, which have been linked to other malicious activity. They exploit known vulnerabilities and use techniques like SSH brute force to gain access to edge devices.

CrowdStrike to Buy SGNL to Expand Identity Security Capabilities

www.darkreading.com · 6 months ago

false

67% of AI usage is through unmanaged personal accounts. IT has literally no visibility.

layerxsecurity.com · 6 months ago

Generative AI has rapidly become a major enterprise technology, with 45% of employees using tools like ChatGPT daily. Surprisingly, data exfiltration primarily occurs through copy and paste actions, with 77% of employees pasting sensitive data into generative AI prompts using personal accounts. Traditional data loss prevention tools are ineffective against this fileless data movement, highlighting a significant governance gap that leaves enterprises vulnerable. Security leaders must prioritize governing AI, focusing on browser-level controls and reclassifying non-federated corporate logins as shadow IT.

Who Benefited from the Aisuru and Kimwolf Botnets?

krebsonsecurity.com · 6 months ago

Researchers have uncovered the Kimwolf botnet, which infected over two million devices to facilitate malicious activities like ad fraud and data scraping through residential proxy services. The botnet is linked to the earlier Aisuru botnet, with key players identified as Dort and Snow. The operation involved a hosting provider, a Discord server used for coordination, and proxy providers like Plainproxies and Maskify, who sold Kimwolf-powered proxies. In response to a report exposing the botnet, operators launched a DDoS attack and doxxed a researcher.

FBI warns about Kimsuky hackers using QR codes to phish U.S. orgs

www.bleepingcomputer.com · 6 months ago

The Federal Bureau of Investigation has issued a warning regarding the North Korean state-sponsored hacker group Kimsuky, also known as APT43, who are using QR codes to target U.S. organizations. These QR codes, in spearphishing campaigns, redirect victims to malicious websites disguised as questionnaires or login pages, aiming to steal credentials or tokens and bypass multi-factor authentication. Attackers impersonate various entities, such as foreign investors and conference organizers, to trick victims into scanning the codes. The FBI recommends employee training, QR code verification, mobile device management, and reporting any suspicious activity.

xAI teases major Grok upgrade, hints at Grok Code CLI

www.bleepingcomputer.com · 6 months ago

false

Maximum Severity HPE OneView Flaw Exploited in the Wild

www.darkreading.com · 6 months ago

A critical vulnerability, CVE-2025-37164, has been identified in HPE's OneView software-defined management platform. The Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, assigning it a maximum severity score of 10. The vulnerability allows for remote code execution, granting attackers centralized control over an organization’s infrastructure. While HPE has released a hotfix and reports no customer exploitation, users are urged to apply the patch immediately due to the vulnerability’s broad access privileges. Rapid7 notes the risk stems from the software’s trusted status and deep network integration.

New Jersey Is Latest State to Ban Student Phones in Schools

www.nytimes.com · 6 months ago

false

CISA sunsets 10 emergency directives thanks to evolution of exploited vulnerabilities catalog

therecord.media · 6 months ago

false

Fake AI Chrome Extensions Steal 900K Users' Data

www.darkreading.com · 6 months ago

Malicious Google Chrome extensions disguised as AI tools have stolen data from nearly a million users. The extensions, "ChatGPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with DeepSeek, ChatGPT, Claude and more," secretly copied user conversations and browsing history to a command-and-control server. Stolen data includes proprietary code, business strategies, URLs, and potentially financial information, posing risks of corporate espionage and identity theft. Both extensions have since been removed from the Chrome store.

VMware ESXi zero-days likely exploited a year before disclosure

www.bleepingcomputer.com · 6 months ago

Chinese-speaking threat actors likely exploited a sophisticated toolkit to compromise VMware ESXi environments, potentially as early as February 2024. The attackers initially gained access through a compromised SonicWall VPN appliance and used Remote Desktop Protocol to move laterally within a network. The toolkit leveraged vulnerabilities to escape virtual machines and gain access to the hypervisor, involving components like MAESTRO, MyDriver.sys, and VSOCKpuppet. The exploited vulnerabilities include CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225. Security experts recommend applying VMware security updates and using detection rules to mitigate the risk.

CPPA fines data broker selling lists of Alzheimer's patients

therecord.media · 6 months ago

California regulators have fined a Texas-based data broker, Rickenbacher Data LLC, also known as Datamasters, for selling sensitive personal information. The company was selling lists containing names, addresses, and other data of individuals with medical conditions like Alzheimer's disease and drug addiction. Datamasters also categorized people based on age, perceived race, political views, and banking activities. The $45,000 fine requires the company to cease selling California residents’ personal data.

G.M. Books a $7.1 Billion Loss as It Scales Back E.V. Ambitions

www.nytimes.com · 6 months ago

false

Cisco switches hit by reboot loops due to DNS client bug

www.bleepingcomputer.com · 6 months ago

Cisco switches are experiencing repeated reboot loops due to a bug in the internal DNS client service. The issue causes switches to treat DNS lookup failures as fatal errors, leading to reboots occurring every few minutes. Affected models include the CBS250, CBS350, Catalyst C1200, SG350, SG350X, and SG550X series. Temporary workarounds involve disabling DNS resolution, SNTP, or blocking internet access.

CVE-2026-21876: OWASP Modsecurity CRS WAF bypass blogpost is out!

coreruleset.org · 6 months ago

A critical vulnerability, identified as CVE-2026-21876, exists in the OWASP Core Rule Set affecting versions 3.3.x and 4.0.0 through 4.21.0. The vulnerability allows attackers to bypass security checks in multipart HTTP requests due to insufficient charset validation. The issue impacts ModSecurity versions 2 and 3, and can be exploited easily, earning a CVSS score of 9.3. A fix is now available in CRS versions 3.3.8 and 4.22.0, requiring no configuration changes and strongly recommended for immediate implementation.

ChatGPT's Memory Feature Supercharges Prompt Injection

www.darkreading.com · 6 months ago

Researchers have discovered a new exploit chain called "ZombieAgent" that leverages ChatGPT’s memory and connector features to enhance indirect prompt injection (IPI) attacks. Attackers can now embed malicious instructions within emails, which ChatGPT remembers and executes persistently, potentially recording sensitive information. While OpenAI has implemented a fix preventing dynamic URL modifications and restricting domains, experts believe deeper structural changes are needed to distinguish prompt origins and user intent. The vulnerability highlights the challenges of securing AI agents, as even basic conversations can be manipulated to extract private information.

AI and the Future of Work: 5 Predictions for 2026

www.techrepublic.com · 6 months ago

false

China Is Investigating Meta’s Acquisition of the AI Start-Ip Manus

www.nytimes.com · 6 months ago

false

Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691) - watchTowr Labs

labs.watchtowr.com · 6 months ago

A critical vulnerability, designated CVE-2025-52691, has been identified in the SmarterMail email server. This flaw allows for unauthenticated remote code execution through manipulation of the guid parameter within file upload processes. Attackers can upload arbitrary files, potentially including malicious web shells, by exploiting a path traversal issue. SmarterTools silently deployed a patch to remediate the vulnerability, which included improved GUID validation.

The 2 faces of AI: How emerging models empower and endanger cybersecurity

www.csoonline.com · 6 months ago

Artificial intelligence is significantly impacting cybersecurity, presenting both opportunities and risks. Attackers are leveraging AI to automate cybercrime, reduce expertise needed, and create new threats like malware that dynamically adapts during execution. For example, researchers identified PROMPTFLUX and PROMPTSTEAL malware, with the latter linked to APT28. Conversely, AI is also being used defensively for vulnerability detection, autonomous penetration testing, and advanced threat hunting, enabling faster response and more comprehensive protection.

ChatGPT Health feature draws concern from privacy critics over sensitive medical data

therecord.media · 6 months ago

false

WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging

thehackernews.com · 6 months ago

Cybersecurity researchers have identified a new malware campaign targeting Brazil, using WhatsApp to distribute the Astaroth banking trojan. The campaign, called Boto Cor-de-Rosa, spreads by automatically sending malicious messages to contacts after infecting a device. The malware uses a Python-based module to propagate and a Delphi-based module to steal banking credentials. Threat actors are actively tracking propagation metrics, including successful message deliveries and sending rates.

Texas court blocks Samsung from collecting smart TV viewing data

www.bleepingcomputer.com · 6 months ago

A Texas court has temporarily blocked Samsung from collecting audio and visual data from Texas consumers' smart TVs. The ruling stems from a lawsuit alleging Samsung’s Automated Content Recognition technology violates the Texas Deceptive Trade Practices Act. The court found Samsung’s data collection enrollment practices are deceptive, confusing, and potentially grant access to user data by the Chinese Communist Party. The temporary restraining order prevents Samsung from collecting, using, selling, and transferring this data until January 19th.

Texas court blocks Samsung from tracking TV viewing, then vacates order

www.bleepingcomputer.com · 6 months ago

A Texas court initially issued a temporary restraining order against Samsung, prohibiting the company from collecting audio and visual data from Texas consumers' TVs using Automated Content Recognition technology. The court cited deceptive practices, confusing enrollment processes, and concerns about data access by the Chinese Communist Party as reasons for the order. However, the court later vacated the restraining order, meaning it is no longer in effect. Samsung is still facing a lawsuit from the Texas Attorney General’s office regarding the data collection practices.

Apple’s John Ternus Could Be Tim Cook’s Successor as CEO

www.nytimes.com · 6 months ago

false

UK Government Unveils New Cyber Action Plan

www.securityweek.com · 6 months ago

false

CrowdStrike to Buy Identity Security Firm SGNL for $740 Million in Cash

www.securityweek.com · 6 months ago

false

Blackbird.AI Raises $28 Million for Narrative Intelligence Platform

www.securityweek.com · 6 months ago

false

NSA cyber directorate gets new acting leadership

therecord.media · 6 months ago

false

Six for 2026: The cyber threats you can’t ignore

www.bleepingcomputer.com · 6 months ago

Cybersecurity threats are rapidly evolving due to advances in artificial intelligence and automation. Experts predict increased exploitation through agentic AI, AI-driven social engineering, and ransomware powered by AI orchestration. Attackers are also leveraging AI to quickly find and hide vulnerabilities, exploiting dynamic network infrastructure and bypassing traditional security tools. To defend against these threats, organizations should improve network visibility, implement zero trust network access policies, strengthen ransomware defenses, continuously scan for vulnerabilities, and utilize network detection and response systems to analyze cloud data flows.

Here's What Cloud Security's Future Holds for the Year Ahead

www.darkreading.com · 6 months ago

false

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

thehackernews.com · 6 months ago

A China-linked threat actor, known as UAT-7290, is targeting telecommunications providers in South Asia and organizations in Southeastern Europe. The group conducts extensive reconnaissance before deploying malware, including RushDrop, DriveSwitch, and SilentRaid. Researchers have observed UAT-7290 establishing Operational Relay Box nodes, which may be used by other actors, and using backdoors like Bulbature. The threat actor utilizes readily available exploits and tools, including RedLeaves and ShadowPad, and is linked to groups Stone Panda and RedFoxtrot.

Cybersecurity at the edge: Securing rugged IoT in mission-critical environments

www.csoonline.com · 6 months ago

Rugged Internet of Things devices are increasingly critical for mission-critical operations in sectors like defense, utilities, and public safety, but their unique deployment environments pose significant cybersecurity challenges. Traditional security models are ineffective due to factors like intermittent connectivity, harsh conditions, and legacy system integration. Organizations must adopt adaptive, decentralized security architectures including device hardening, access controls, network segmentation, physical security measures, and robust life cycle management practices. Gartner reports IoT-related incidents in critical infrastructure have surged 400% in recent years, emphasizing the need for proactive risk mitigation.

Phishing-Angreifer setzen vermehrt auf E-Mail-Routing-Lücken

www.csoonline.com · 6 months ago

Microsoft has reported a rise in phishing attacks exploiting vulnerabilities in email routing configurations. Attackers are manipulating MX DNS entries and lax DMARC and SPF policies to make phishing emails appear as internal communications, bypassing filters and potentially stealing credentials. This technique allows attackers to use Phishing-as-a-Service platforms like Tycoon 2FA and can even facilitate adversary-in-the-middle attacks to bypass multi-factor authentication. Microsoft recommends strengthening email authentication configurations and implementing phishing-resistant MFA to mitigate these threats.

New OAuth Attack Lets Hackers Bypass Microsoft Entra Authentication and Steal Keys

gbhackers.com · 6 months ago

Researchers have identified a new attack, dubbed ConsentFix, that exploits Microsoft Entra ID's OAuth 2.0 authentication flows to steal privileged access tokens. The attack leverages a malicious website to trick users into providing authorization codes, which attackers then redeem for access tokens, ID tokens, and refresh tokens. Security teams can detect the attack by monitoring Entra ID sign-in logs for correlated events sharing the same SessionId, ApplicationId, and UserId. Mitigations include user assignment controls, Conditional Access policies, and Microsoft Entra ID’s Token Protection feature.

Rethinking Security for Agentic AI

www.securityweek.com · 6 months ago

false

New DocuSign-Themed Phishing Scam Delivers Stealth Malware to Windows Devices

gbhackers.com · 6 months ago

A new phishing campaign is targeting Windows users by impersonating DocuSign. Attackers use a realistic phishing site and a fake installer signed with a legitimate code signing certificate to distribute Vidar malware. The malware employs access code checks and time-based execution barriers to evade detection, and utilizes packing and obfuscation to hinder reverse engineering. Vidar steals sensitive information such as browser data, credentials, and cryptocurrency wallet details.

Critical Vulnerability Patched in jsPDF

www.securityweek.com · 6 months ago

A critical vulnerability has been patched in the jsPDF library, a popular tool for creating PDF documents. The flaw, identified as CVE-2025-68428, allows attackers to read sensitive files like configuration files and credentials through a local file inclusion issue. This vulnerability impacts Node.js builds and arises when user-controlled input is used as a file path argument. Users are advised to update to version 4.0.0 and restrict file access to mitigate the risk.

Trump Signals Possible Cyber Involvement in Caracas Power Loss During Maduro Extraction

gbhackers.com · 6 months ago

President Trump has indicated the United States may have used cyber capabilities to cause a power outage in Caracas during a military operation targeting Nicolás Maduro. Reports show significant internet connectivity losses coincided with power cuts, and Venezuela’s energy ministry attributed the outages to U.S. attacks. The operation reportedly disrupted Chinese-made radar and Russian-built air defense systems, signaling a shift toward more public acknowledgment of cyber operations as a tool of national power. Officials suggest integrated cyber and kinetic campaigns will become increasingly common in future military planning.

Critical Vulnerability Exposes n8n Instances to Takeover Attacks

www.securityweek.com · 6 months ago

A critical vulnerability, tracked as CVE-2026-21858, has been identified in the n8n workflow automation platform. The vulnerability, dubbed Ni8mare, allows attackers to gain unauthorized access to files and potentially take complete control of n8n instances. Attackers can exploit a content-type confusion to manipulate file paths, extract sensitive data, and even execute code, including accessing the database and configuration files. Version 1.121.0 of n8n addresses this issue, and users are strongly advised to update immediately or temporarily restrict access to vulnerable endpoints.

Cisco ISE Vulnerability Enables Access to Sensitive Data

gbhackers.com · 6 months ago

Cisco has identified a medium severity vulnerability, CVE-2026-20029, within its Identity Services Engine and ISE Passive Identity Connector. This XML External Entity vulnerability allows authenticated administrators to potentially read sensitive data from the operating system. Exploitation requires administrative credentials, but could expose configuration data, logs, or other secrets if those credentials are compromised. Cisco recommends upgrading to a fixed software release as no mitigations are available, and proof-of-concept exploit code is publicly accessible. Organizations should limit administrative access and monitor ISE interfaces closely.

ChatGPT Health: A New Secure Space for Trusted Health and Medical Conversations

gbhackers.com · 6 months ago

false