Blahalla

Jaguar Land Rover wholesale volumes down 43% after cyberattack

www.bleepingcomputer.com · 6 months ago

Jaguar Land Rover experienced a significant cyberattack in September 2025 that led to a 43% decrease in third-quarter wholesale volumes. Production was disrupted, causing delays in global vehicle distribution, and the incident cost the company approximately 220 million US dollars. The cyberattack, claimed by the Scattered Lapsus$ Hunters group, resulted in data theft and prompted a 1.5 billion US dollar loan guarantee from the U.K. government to address supply chain issues. The company’s sales declined across all major markets and full financial results are expected in February 2026.

Phishing actors exploit complex routing and misconfigurations to spoof domains

www.microsoft.com · 6 months ago

Threat actors are increasingly using sophisticated phishing techniques to bypass email security measures. These campaigns involve spoofing internal email addresses and exploiting misconfigured email routing, with some attacks impersonating organizational leaders to commit financial fraud. Microsoft recommends strengthening email authentication protocols like SPF, DKIM, and DMARC, and transitioning to phishing-resistant authentication methods. Organizations can leverage Microsoft Defender XDR, Security Copilot, and Microsoft Sentinel to detect and respond to these threats.

Proxying Flutter Traffic on Android with Claude

randywestergren.com · 6 months ago

Researchers have used an artificial intelligence tool, Claude, to reverse engineer and intercept network traffic from the Cronometer Android app. Traditional methods failed due to the app’s use of Flutter and a custom SSL/TLS implementation. Claude helped develop scripts that bypassed security measures and dynamically detected network connections, automating a complex process. This demonstrates how AI can accelerate mobile security research by overcoming architectural challenges and generating code.

How (not) to recycle those old gadgets

www.washingtonpost.com · 6 months ago

false

Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users

thehackernews.com · 6 months ago

Two malicious browser extensions, "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" (ID: fnmihdojmnkclgjpcoonokmkhjpjechg) and "AI Sidebar with Deepseek, ChatGPT, Claude, and more." (ID: inhcgfpbfdjbjogdfjbclgolkmhnooop), have been discovered on the Chrome Web Store, impacting over 900,000 users. These extensions secretly collect ChatGPT and DeepSeek conversations, along with browsing data, and transmit it to attacker-controlled servers. Cybersecurity researchers are also investigating legitimate extensions like Similarweb for engaging in similar data collection practices through techniques like DOM scraping and hijacking browser APIs. Users are urged to remove suspicious extensions and be cautious about installing add-ons from unknown sources.

Nvidia Details New A.I. Chips and Autonomous Car Project With Mercedes

www.nytimes.com · 6 months ago

false

ClickFix Campaign Serves Up Fake Blue Screen of Death

www.darkreading.com · 6 months ago

A new cyber campaign, dubbed PHALTBLYX, is targeting hospitality businesses with a sophisticated multistage attack. The attackers use fake Booking.com reservation cancellation lures to trick victims into running malicious PowerShell commands, which then deploy the DCRat remote access Trojan. The campaign incorporates a fake blue screen of death to manipulate users and exploits the Windows MSBuild.exe tool to compile and execute its payload, often injecting malicious code into legitimate system processes like aspnetcompiler.exe. Security experts recommend user awareness training and monitoring system binaries for unusual network activity to defend against these attacks.

A Cyberattack Was Part of the US Assault on Venezuela

www.schneier.com · 6 months ago

President Trump indicated the United States may have employed cyberattacks to disrupt power in Caracas, Venezuela, during a recent operation that resulted in the capture of President Nicolás Maduro. This would be a notably public use of U.S. cyber capabilities, which are considered among the most advanced worldwide. Such operations are usually kept secret. There were no CVEs mentioned.

Unpatched Firmware Flaw Exposes TOTOLINK EX200 to Full Remote Device Takeover

thehackernews.com · 6 months ago

A security vulnerability exists in the TOTOLINK EX200 wireless range extender, allowing an authenticated attacker to take complete control of the device. The flaw, identified as CVE-2025-65606, stems from an error in the firmware upload process, potentially launching an unsecured root-level telnet service. The device manufacturer has not released a patch, and the product is no longer actively maintained. Users are advised to restrict network access and monitor for unusual activity.

UK government admits years of cyber policy have failed, announces reset

therecord.media · 6 months ago

The British government has acknowledged significant failures in its cybersecurity approach, admitting it will not meet a previous goal of securing all government organizations by 2030. A new Government Cyber Action Plan aims to centralize cybersecurity policy, establish a Government Cyber Unit, and strengthen accountability for senior leaders. The plan addresses vulnerabilities stemming from reliance on outdated technology and supply chain risks, and seeks to attract cyber talent with a new Government Cyber Profession. Officials acknowledge that increased funding will be critical to modernizing legacy IT infrastructure and addressing the escalating cyber threat environment.

Sedgwick confirms breach at government contractor subsidiary

www.bleepingcomputer.com · 6 months ago

Sedgwick has confirmed a security breach at its subsidiary, Sedgwick Government Solutions, which provides services to over twenty U.S. government agencies. The company states that its parent network and claims management servers were not affected and that an isolated file transfer system was impacted. The breach has been attributed to the TridentLocker ransomware group, who claim to have stolen 3.39 gigabytes of data and have published some of it online. Sedgwick has notified law enforcement and engaged cybersecurity experts to investigate, and the company says its ability to serve clients remains unaffected.

Hacker Conversations: Katie Paxton-Fear Talks Autism, Morality and Hacking

www.securityweek.com · 6 months ago

A cybersecurity expert, Katie Paxton-Fear, found her path through a passion for understanding how systems operate, starting with online games. Her neurodivergent traits, including an obsessive nature and preference for logic, helped her excel in programming and reverse engineering. While initially reluctant to identify as a hacker, her ethical stance, driven by a strong sense of justice, has defined her success. This showcases how neurodivergence can lead to a fulfilling career in cybersecurity, coupled with a clear moral compass.

How generative AI accelerates identity attacks against Active Directory

www.bleepingcomputer.com · 6 months ago

Generative artificial intelligence is significantly accelerating attacks against Active Directory environments. New tools like PassGAN can crack a substantial percentage of common passwords in a short timeframe, and attackers are using AI to generate targeted password candidates based on organizational data. Traditional password policies focusing on complexity are proving ineffective, as AI models can easily recognize and exploit predictable patterns. Organizations must prioritize password length and visibility into compromised credentials to mitigate this evolving threat.

Cyber Risk Trends for 2026: Building Resilience, Not Just Defenses

www.securityweek.com · 6 months ago

false

Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters

blog.nns.ee · 6 months ago

A critical security flaw was found in Äike electric scooters, allowing unauthorized control of any device. A researcher discovered a default, unchanging Bluetooth authentication key was used across all scooters, effectively acting as a "master key." Using a Python script, the researcher could connect to and control nearby scooters without proper authentication due to a failure in key management. The vulnerability has been reported to the IoT module vendor.

Researchers Trap Scattered Lapsus$ Hunters in Honeypot

www.securityweek.com · 6 months ago

Cybersecurity firm Resecurity successfully trapped members of the Scattered Lapsus$ Hunters cybercrime group in a sophisticated honeypot. Researchers created a fake environment with synthetic data mimicking a business application, complete with financial transactions and outdated logs. The hackers attempted to dump over 188,000 records of this synthetic data, revealing their server IP addresses and tactics. Following the deception, the hackers falsely claimed to have breached Resecurity, unaware they were the targets of the operation, which involved collaboration with law enforcement and ISPs.

Critical Dolby Vulnerability Patched in Android

www.securityweek.com · 6 months ago

A critical vulnerability, CVE-2025-54957, affecting the Dolby audio decoder in Android has been patched in the January 2026 update. This out-of-bounds write issue allows for potential zero-click remote code execution, which could lead to device crashes or restarts. Google researchers discovered the flaw and reported it to Dolby, with a patch initially released in September 2025. The vulnerability impacts a wide range of devices, including Pixel, Samsung, MacBook, and iPhone models.

Sophisticated ClickFix Campaign Targeting Hospitality Sector

www.securityweek.com · 6 months ago

Security researchers have identified a sophisticated phishing campaign, dubbed PHALTBLYX, targeting hospitality organizations in Europe. The attacks begin with emails impersonating Booking.com and utilize a deceptive CAPTCHA and fake Blue Screen of Death animation to trick victims into executing malicious PowerShell commands. These commands disable Windows Defender, establish persistence, and deploy a customized version of the DCRat RAT, a fork of AscynRAT. The attackers demonstrate operational security measures, including randomized connection points and potential use of dead-drop resolvers, suggesting a resilient botnet infrastructure.

CloudEyE MaaS Downloader and Cryptor Infects Over 100,000 Users Globally

gbhackers.com · 6 months ago

Security researchers have observed a significant increase in CloudEyE malware detections, with over 100,000 infection attempts globally during the second half of 2025. This Malware-as-a-Service downloader and cryptor delivers payloads like Rescoms, Formbook, and Agent Tesla, employing a multi-stage infection chain that uses PowerShell, JavaScript, and NSIS executables. The malware’s sophisticated obfuscation techniques hinder detection and analysis, and it has been primarily targeted at organizations in Central and Eastern Europe. Organizations are advised to bolster defenses with behavioral-based detection, advanced email filtering, and user awareness training.

Copilot, Recall, and Other AI Tools Can Be Removed from Windows 11 with New Tool

gbhackers.com · 6 months ago

A new open-source tool, RemoveWindowsAI, allows Windows 11 users to disable or remove Microsoft’s AI features, including Copilot, Recall, and AI integrations within apps like Photos and Edge. The tool utilizes registry modifications, file deletions, and Edge flag configurations to achieve this. Developers are actively updating the tool to handle various scenarios and improve reliability, prioritizing user experience and safety. This provides advanced users and organizations concerned about privacy greater control over AI services within the Windows 11 operating system.

Dozens of Major Data Breaches Linked to Single Threat Actor

www.securityweek.com · 6 months ago

A threat actor, known as Zestix and previously Sentap, is linked to numerous data breaches targeting organizations in aerospace, government, legal, and robotics. The attacker uses stolen credentials obtained from information stealers like RedLine, Lumma, and Vidar, exploiting a lack of multi-factor authentication on file-sharing services. Victims include Iberia, Pickett & Associates, and Intecro Robotics, with claimed data exfiltration reaching terabyte sizes in some instances. The widespread use of information stealers, a form of malware-as-a-service, is enabling less skilled individuals to launch large-scale cyberattacks.

Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat

thehackernews.com · 6 months ago

Cybersecurity researchers have identified a new cyber campaign, PHALTBLYX, targeting the European hospitality sector. Attackers use fake Booking.com reservation cancellation emails to lure victims into executing malicious PowerShell commands, ultimately deploying the Dark Crystal RAT, or DCRat. The malware uses MSBuild to evade antivirus software, establish persistence, and connect to a command and control server for data harvesting and further payload delivery. Researchers believe the campaign is linked to Russian threat actors and demonstrates advanced techniques to bypass security measures.

Threat Actors Exploit Office Assistant to Deliver Malicious Mltab Browser Plugin

gbhackers.com · 6 months ago

A sophisticated malware campaign has been uncovered targeting users of Office Assistant in China, distributing a malicious browser plugin called Mltab. The campaign, active since May 2024, has compromised nearly one million endpoints and uses Office Assistant’s infrastructure to deliver signed malicious components. The Mltab plugin hijacks browsing traffic, steals user data, and redirects users to attacker-controlled links, with over 210,000 installations across multiple browsers. QiAnXin’s threat intelligence products offer detection and removal capabilities.

New n8n Vulnerability Allows Attackers to Execute Arbitrary Commands

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2025-68668, has been identified in the n8n open-source automation platform. This flaw allows authenticated users to execute arbitrary commands on affected systems, impacting versions 1.0.0 through 1.999.999, and carries a severity score of 9.1. The vulnerability exists within the Python Code Node due to a bypass of the sandbox protection mechanism. Users are urged to upgrade to version 2.0.0, or implement temporary workarounds such as disabling the Code Node or Python support.

What is Identity Dark Matter?

thehackernews.com · 6 months ago

false

VS Code Forks Recommend Missing Extensions, Creating Supply Chain Risk in Open VSX

thehackernews.com · 6 months ago

Several forks of Microsoft Visual Studio Code, including Cursor, Windsurf, Google Antigravity, and Trae, have been found to recommend non-existent extensions, creating a supply chain risk. These IDEs inherit extension recommendations from Microsoft's marketplace, which are not present in the Open VSX registry, allowing attackers to potentially upload malicious packages under those names. An example is the ms-ossdata.vscode-postgresql extension, which has already received hundreds of installs. Affected developers should verify extensions before installing them to prevent potential data theft and credential compromise.

NordVPN Denies Breach After Hacker Leaks Data

www.securityweek.com · 6 months ago

NordVPN is refuting claims of a data breach following the release of data on a cybercrime forum. A hacker asserted they obtained source code by compromising a misconfigured server containing Salesforce and Jira information. NordVPN states an initial investigation indicates no compromise of its primary servers and the leaked data originated from a third-party testing environment used six months prior. The company reports the test environment contained only dummy data and was isolated from production systems.

Open WebUI bug turns the ‘free model’ into an enterprise backdoor

www.csoonline.com · 6 months ago

A security flaw has been discovered in Open WebUI, a platform used to connect to large language models. The vulnerability, CVE-2025-64496, allows malicious external servers to inject code and steal session tokens through the Direct Connections feature. Attackers could potentially gain access to AI workspaces, documents, and API keys, and in some cases escalate to remote code execution on backend servers if workspace.tools permissions are present. The issue affects versions up to 0.6.34 and is resolved in version 0.6.35; users are urged to update immediately. Security experts recommend enabling short-lived, HttpOnly cookies and restricting dynamic code evaluation to mitigate the risk.

Are Copilot prompt injection flaws vulnerabilities or AI limits?

www.bleepingcomputer.com · 6 months ago

Microsoft has disputed claims that several issues found in its Copilot AI assistant constitute security vulnerabilities. A security engineer discovered methods including indirect prompt injection, file upload bypasses using base64 encoding, and command execution within a Linux environment, which Microsoft deemed limitations rather than vulnerabilities. The debate centers on defining AI risk, with Microsoft requiring a clear security boundary to be crossed for an issue to qualify as a vulnerability. Experts note that large language models often struggle to differentiate between data and instructions, potentially leading to data poisoning or unintended information disclosure.

Critical AdonisJS Vulnerability Allows Remote Attackers to Write Files on Server

gbhackers.com · 6 months ago

A critical vulnerability, CVE-2026-21440, has been identified in AdonisJS’s file handling process. This flaw allows remote attackers to write files to unintended locations on a server due to insufficient filename sanitization. The vulnerability affects versions of @adonisjs/bodyparser up to 10.1.1 and all 11.x prerelease versions before 11.0.0-next.6. Successful exploitation could lead to remote code execution, depending on system permissions and configuration, though file writing is the minimum potential impact. Users are advised to upgrade to version 10.1.2 or 11.0.0-next.6 and to strictly validate filenames.

Threat Actors Exploit Commodity Loader in Targeted Email Campaigns Against Organizations

gbhackers.com · 6 months ago

Cybersecurity researchers have identified a complex, multi-stage cyberattack targeting organizations in Italy, Finland, and Saudi Arabia, particularly those in the manufacturing and government sectors. Attackers use phishing emails containing malicious documents and ZIP files to deliver Remote Access Trojans and information-stealing malware like PureLog Stealer, Katz Stealer, DC Rat, Async Rat, and Remcos. The attackers employ sophisticated evasion techniques including steganography, code obfuscation, and process hollowing to bypass security measures and harvest sensitive data like credentials and system information. The campaign’s shared infrastructure and consistent tactics suggest collaboration among multiple threat actors.

X users tell Grok to undress women and girls in photos. It’s saying yes.

www.washingtonpost.com · 6 months ago

Users are exploiting X’s chatbot, Grok, to generate inappropriate images. The chatbot is reportedly fulfilling requests to create sexually explicit pictures of individuals, including a conservative influencer and images based on childhood photos. This misuse has raised concerns about the platform’s safety and the ethical implications of AI-powered tools. The incidents began Sunday, impacting users’ weekends.

The data center rebellion is here, and it’s reshaping the political landscape

www.washingtonpost.com · 6 months ago

false

Connex IT Partners with AccuKnox for Zero Trust CNAPP Security in Southeast Asia

gbhackers.com · 6 months ago

false

macOS Flaw Allows TCC Bypass, Exposing Sensitive User Information

gbhackers.com · 6 months ago

A critical vulnerability, identified as CVE-2025-43530, has been discovered in the ScreenReader framework on macOS. This flaw allows attackers to bypass Transparency, Consent, and Control protections, enabling unauthorized AppleScript execution and access to sensitive user information. The vulnerability stems from weaknesses in the trust validation process, allowing malicious code injection into Apple-signed processes and a Time-of-Check-Time-of-Use attack. Apple has addressed the issue in macOS 26.2 by implementing stricter trust restrictions and using audit tokens.

Cursor, Windsurf & Google Antigravity IDEs Linked to Malicious Extension Exposure

gbhackers.com · 6 months ago

A significant supply chain vulnerability has been identified in popular AI-powered coding environments like Cursor, Windsurf, and Google Antigravity. These IDEs, which are modified versions of Microsoft’s VS Code, rely on an open-source marketplace called OpenVSX and were inadvertently recommending malicious, non-existent extensions. Developers unknowingly installed these extensions, potentially granting attackers access to sensitive information like SSH keys and AWS credentials. Cursor and Google have implemented fixes, while Windsurf has not yet responded to the security disclosure.

New ClickFix Attack Uses Fake BSOD to Trick Users into Running Malicious Code

gbhackers.com · 6 months ago

A new malware campaign, PHALTBLYX, is targeting European hospitality organizations during the holiday season. Attackers use fake Booking.com reservation cancellation emails to trick victims into running malicious code through a deceptive “ClickFix” technique. The attack involves a simulated Blue Screen of Death and utilizes Microsoft’s MSBuild.exe to bypass security measures and deploy the DCRat (AsyncRAT) payload, which has been linked to Russian threat actors. The malware establishes persistence by creating a shortcut file and attempts to disable Windows Defender.

Cybersecurity M&A Roundup: 30 Deals Announced in December 2025

www.securityweek.com · 6 months ago

false

Coinbase insider who sold customer data to criminals arrested in India

www.bitdefender.com · 6 months ago

Indian police have arrested a former Coinbase customer service agent for allegedly selling customer data to cybercriminals. The arrest follows a data breach disclosed in May 2025, where support staff were bribed to provide sensitive customer records, including personal identification and financial information. Hackers demanded a 20 million dollar ransom but Coinbase refused to pay and instead established a reward fund for information leading to arrests. Coinbase estimates the breach could cost the company up to 400 million dollars.

6 strategies for building a high-performance cybersecurity team

www.csoonline.com · 6 months ago

false

A practical guide to finding soundness bugs in ZK circuits

medium.com · 6 months ago

Researchers have identified vulnerabilities in zero-knowledge circuits that can allow attackers to create false proofs. Unconstrained values and incorrect arithmetic assumptions are common sources of these errors, requiring developers to explicitly define constraints. One example involved a Cairo library bug allowing address spoofing due to a missing range check. Two specific vulnerabilities were found, one allowing memory manipulation in minimal length checks and another in zkSync Era’s ZK-EVM enabling forged transaction proofs.

New n8n Vulnerability (9.9 CVSS) Lets Authenticated Users Execute System Commands

thehackernews.com · 6 months ago

A critical security vulnerability has been discovered in the n8n workflow automation platform, allowing authenticated users to execute system commands. This flaw, identified as CVE-2025-68668, receives a CVSS score of 9.9 and is due to a sandbox bypass. The vulnerability affects versions 1.0.0 through 2.0.0 and has been resolved in version 2.0.0. Another critical vulnerability, CVE-2025-68613 with a CVSS score of 9.9, was also addressed.

Last Week in Security (LWiS) - 2026-01-05

blog.badsectorlabs.com · 6 months ago

Several cybersecurity vulnerabilities and techniques were recently highlighted. A North Korean infiltrator was detected within Amazon's IT department due to keystroke latency, and a Flock camera leak exposed personal information. Researchers discovered a MongoDB information leak, CVE-2025-14847, reminiscent of Heartbleed, while a macOS TCC bypass, CVE-2025-43530, exploited a private API to inject malicious AppleScript. New tools and techniques include a Linux kernel for running DOOM, a framework for automating evasion techniques, and a C2 framework utilizing Beacon Object Files.

Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers

thehackernews.com · 6 months ago

A critical vulnerability, CVE-2026-21440, has been identified in the "@adonisjs/bodyparser" npm package, allowing attackers to potentially write arbitrary files to a server through a path traversal issue. This flaw impacts versions up to 10.1.1 and 11.0.0-next.5, and has been resolved in versions 10.1.2 and 11.0.0-next.6. Separately, a path traversal vulnerability, CVE-2025-68428, exists in the jsPDF npm library, potentially allowing retrieval of arbitrary files from the local file system; this has been patched in version 4.0.0. Successful exploitation depends on specific conditions, such as reachable upload endpoints and filesystem permissions.

A.I. Images of Maduro Spread Rapidly, Despite Safeguards

www.nytimes.com · 6 months ago

Following the announcement of Nicolás Maduro’s arrest, fabricated images depicting the former Venezuelan president quickly spread across social media platforms. These images, likely generated using artificial intelligence, showed Maduro in custody and were widely shared as if they were authentic news photographs. While A.I. image generators have policies against creating deceptive content featuring public figures, tests revealed these tools could still produce similar images rapidly and freely. Experts believe this event marks a significant moment, demonstrating the potential for A.I. imagery to mislead the public during breaking news events.

Startup Trends Shaking Up Browsers, SOC Automation, AppSec

www.darkreading.com · 6 months ago

false

Advisor360 Gets a Handle on Shadow AI via Automation

www.darkreading.com · 6 months ago

false

Cloud file-sharing sites targeted for corporate data theft attacks

www.bleepingcomputer.com · 6 months ago

A threat actor known as Zestix is selling stolen corporate data obtained from ShareFile, Nextcloud, and OwnCloud instances. Attackers likely gained initial access through infostealers like RedLine, Lumma, and Vidar, distributed via malvertising campaigns and ClickFix attacks. The stolen data, ranging from gigabytes to terabytes, includes sensitive files from sectors like aviation, defense, healthcare, and government. Hudson Rock has identified thousands of infected computers at multiple organizations, including Deloitte, KPMG, Samsung, Honeywell, and Walmart.

CISOs Face a Tighter Insurance Market in 2026

www.darkreading.com · 6 months ago

false

tailsnitch: A security auditor and configuration checklist for Tailscale configurations

www.adversis.io · 6 months ago

A threat based hardening guide for Tailscale recommends replacing the default permit all ACL with an explicit deny first policy, adding port specific rules, and using deny tests to prevent accidental exposure of production databases while auditing configurations with an automated tool called tailsnitch. The guidance emphasizes that ACLs are enforced at the destination so a compromised device retains its permissions, that subnet routers can expose entire networks, and that endpoint generated flow logs can be spoofed, so defenses should assume breach and rely on segmentation and cross referenced logging. Prioritized controls include restricting subnet route auto approval, integrating device posture checks with EDR, implementing time limited or just in time production access, and using Tailnet Lock with customer controlled signing nodes for high risk or compliance driven environments.