Blahalla

www.schneier.com · 7 months ago

Apple has implemented a system to notify users when their camera is in use. A dedicated hardware indicator light is generally considered more secure than an on-screen notification because hardware is harder to tamper with. Apple's design avoids a simplistic approach, preventing software from overriding the indicator light. This feature is important for protecting against malware that could secretly record users.

Hackers exploiting critical F5 BIG-IP flaw in attacks, patch now

www.bleepingcomputer.com · 7 months ago

Cybersecurity firm F5 Networks has reclassified a denial-of-service vulnerability in its BIG-IP Access Policy Manager as a critical remote code execution flaw, CVE-2025-53521. Attackers are now exploiting this flaw to install webshells on unpatched systems, requiring immediate action from administrators. F5 recommends reviewing logs and systems for malicious activity and consulting security policies for incident handling. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its list of actively exploited flaws, ordering federal agencies to address it.

Telnyx Targeted in Growing TeamPCP Supply Chain Attack

www.securityweek.com · 7 months ago

Cybersecurity researchers have identified a supply chain attack targeting the popular Telnyx Python SDK, impacting users of Windows, macOS, and Linux systems. Malicious versions 4.87.1 and 4.87.2 were uploaded to the PyPI registry, containing a WAV file that deployed malicious executables or scripts to steal session keys. The attack, attributed to the TeamPCP group, uses asymmetric encryption consistent with previous compromises like the LiteLLM PyPI package. Affected users are advised to assume compromise and rotate all sensitive credentials.

New Homoglyph Tricks Let Cybercriminals Mimic Trusted Domains

gbhackers.com · 7 months ago

Cybercriminals are employing new techniques to spoof trusted domains using subtle visual differences in text, known as homoglyph attacks. Attackers exploit Internationalized Domain Names, Punycode, and Unicode confusables to register domains that appear legitimate but resolve to malicious infrastructure. These deceptive domains are utilized in phishing campaigns, malware distribution, and business email compromise, often bypassing security filters that rely on simple string comparisons. Organizations should implement policies to prohibit mixed-script IDNs, normalize Unicode in security systems, and increase user awareness to mitigate these evolving threats.

Telnyx Python SDK Backdoored on PyPI to Steal Cloud Credentials

gbhackers.com · 7 months ago

Malicious actors, identified as TeamPCP, compromised the popular Telnyx Python SDK on the PyPI package repository, releasing backdoor versions 4.87.1 and 4.87.2. The attackers bypassed standard release procedures, injecting malicious code that immediately steals sensitive cloud credentials, Kubernetes tokens, and other secrets. The malware employs techniques like WAV steganography, hybrid encryption with AES-256 and RSA-4096, and persistent backdoors on Windows and Linux systems. This incident is part of a broader supply chain attack affecting numerous packages and raises concerns about potential data theft and ransomware.

APIs are the new perimeter: Here’s how CISOs are securing them

www.csoonline.com · 7 months ago

Recent breaches show attackers are shifting from endpoints to application programming interfaces, turning APIs into the new perimeter as enterprise API portfolios swell to hundreds or thousands of endpoints; a 2025 Salt Security report found nearly one in three organizations experienced an API breach in the prior 12 months and 95 percent of attacks originated from authenticated sources using stolen API keys or credentials. Traditional defenses such as endpoint detection and response and web application firewalls often miss business logic abuse because API attacks look like valid traffic, and high profile incidents include the 2024 Optus breach that exposed nine million customer records and other compromises affecting services like WhatsApp, Trello, 23andMe, Avelo Airlines, and Volkswagen. CISOs are responding with API governance, comprehensive inventories, identity aware access controls, API gateways, automated CI CD security checks, least privilege and credential rotation, and continuous monitoring, while warning that AI and agentic systems increase API usage and lower the bar for adversaries and that third party integrations and leaked secrets remain persistent risks.

Microsoft pulls KB5079391 Windows update over install issues

www.bleepingcomputer.com · 7 months ago

Microsoft has paused the rollout of the optional cumulative update KB5079391 for Windows 11 systems. Users are experiencing installation errors, specifically the 0x80073712 error, preventing the update from installing. This update included changes such as Smart App Control and improvements to Windows Hello Fingerprint reliability. Microsoft is investigating the issue and expects a fix before the April 14th Patch Tuesday.

Critical Fortinet FortiClient EMS Vulnerability Actively Exploited in Attacks

gbhackers.com · 7 months ago

A critical vulnerability, CVE-2026-21643, in Fortinet’s FortiClient Enterprise Management Server is currently being exploited. Attackers can execute unauthorized database commands by injecting malicious SQL statements into HTTP request headers. Approximately 1,000 FortiClient EMS instances are exposed to the public internet, increasing the risk of compromise. Security teams are advised to remove these servers from direct internet access and monitor HTTP traffic for unusual SQL syntax.

Exploitation of Fresh Citrix NetScaler Vulnerability Begins

www.securityweek.com · 7 months ago

Exploitation has begun of a recently disclosed critical-severity vulnerability in Citrix NetScaler appliances. The flaw, CVE-2026-3055, is an out-of-bounds read issue affecting systems running specific versions of ADC, Gateway, FIPS, and NDcPP. Attackers are exploiting the vulnerability to leak sensitive memory, similar to previous CitrixBleed2 incidents, by sending crafted requests. Security firm WatchTowr detected initial reconnaissance attempts last Friday and confirmed active exploitation started on Sunday, with evidence suggesting activity began as early as March 27.

Stored XSS Vulnerability in Jira Work Management Could Enable Full Organization Takeover

gbhackers.com · 7 months ago

Security researchers have identified a critical stored Cross-Site Scripting vulnerability in Atlassian’s Jira Work Management platform. The flaw, stemming from inadequate input validation in the custom priority settings, allows an attacker with limited administrative permissions to take over an entire organization. By injecting malicious code into the icon URL property of a custom priority, an attacker can trigger a payload when a Super Admin views the priority settings, enabling them to add attacker-controlled users with full administrative access. This demonstrates the need for strict input validation and regular audits of access controls even in mature enterprise platforms. CVE-2024-34927 is associated with this vulnerability.

Why Kubernetes controllers are the perfect backdoor

www.csoonline.com · 7 months ago

Attackers are increasingly exploiting Kubernetes controllers to establish persistent backdoors within clusters, bypassing traditional security measures focused on container vulnerabilities. Malicious controllers register webhooks that intercept pod creation requests and inject hidden sidecar containers, effectively creating a self-healing backdoor that survives restarts and cluster upgrades. This technique, used in campaigns like Siloscape and involving the Hildegard malware, maps to Persistence (TA0003) in the MITRE ATT&CK framework. Security teams should audit webhook configurations, monitor RoleBinding changes, and restrict access to the control plane to prevent these attacks.

The Team PCP Snowball Effect: A Quantitative Analysis

blog.gitguardian.com · 7 months ago

false

FBI Confirms Kash Patel Email Hack as US Offers $10M Reward for Hackers

www.securityweek.com · 7 months ago

The FBI has confirmed that threat actors accessed an email account belonging to FBI Director Kash Patel. The Iran-linked group Handala claimed responsibility, releasing files purportedly from the account, though the information appears to be historical and does not involve government data. The compromised account was a personal Gmail account, and the incident may be related to a broader 2024 hacking campaign. The US State Department is offering up to $10 million for information leading to the identification of members of Parsian Afzar Rayan Borna and Handala.

Critical Fortinet Forticlient EMS flaw now exploited in attacks

www.bleepingcomputer.com · 7 months ago

Attackers are now actively exploiting a critical vulnerability in Fortinet's FortiClient EMS platform. The SQL injection flaw, identified as CVE-2026-21643, allows unauthorized individuals to execute code on unpatched systems through web interface requests. Approximately 1,000 instances of FortiClient EMS are publicly exposed, according to Shodan, and over 2,000 are being tracked by Shadowserver. Fortinet has not yet acknowledged the active exploitation of the vulnerability, which affects version 7.4.4 and can be resolved by upgrading to version 7.4.5 or later.

Critical Grafana Flaws Allow Attackers to Achieve Remote Code Execution

gbhackers.com · 7 months ago

Grafana Labs has released security updates to address two critical vulnerabilities. The first, CVE-2026-27876, allows for remote code execution through an arbitrary file write vulnerability in the SQL expressions feature. The second, CVE-2026-27880, enables denial-of-service attacks by exploiting unauthenticated feature flag validation endpoints. Administrators are urged to upgrade to the latest patched versions or implement temporary workarounds to mitigate these risks.

Microsoft Releases Key WinRE and Setup Updates to Prepare for 2026 Secure Boot Changes

gbhackers.com · 7 months ago

false

F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild

www.securityweek.com · 7 months ago

Cybersecurity officials are warning of a critical vulnerability in F5 BIG-IP systems, now confirmed to be exploited by threat actors. The flaw, identified as CVE-2025-53521, initially appeared as a denial-of-service issue but has been reclassified as a remote code execution vulnerability. This allows unauthenticated attackers to execute code on affected systems, including those in Appliance mode. F5 has released updates to address the issue, and federal agencies are urged to apply the patches immediately.

LangDrained: Path traversal, SQL injection, and Deserialization of untrusted data in LangChain

www.cyera.com · 7 months ago

Security researchers have identified three significant vulnerabilities within the LangChain AI framework, potentially exposing sensitive data and credentials. These vulnerabilities, including SQL injection (CVE-2025-67644), serialization injection (CVE-2025-68664), and prompt template exploitation, demonstrate a risk of data leakage and unauthorized access. The framework's widespread use creates a substantial supply chain risk, as a single vulnerability can impact numerous applications. Patches have been released to address these issues, emphasizing the need for enhanced security practices in AI development.

Three China-Linked Clusters Target Southeast Asian Government in 2025 Cyber Campaign

thehackernews.com · 7 months ago

Researchers have identified three China-linked threat activity clusters targeting a Southeast Asian government organization. The campaigns, spanning from March to August 2025, employed various malware families including HIUPAN, PUBLOAD, EggStremeFuel, EggStremeLoader, MASOL RAT, PoshRAT, TrackBak Stealer, RawCookie, Hypnosis Loader, and FluffyGh0st. These clusters, Mustang Panda, CL-STA-1048, and CL-STA-1049, demonstrate overlapping tactics and techniques, suggesting coordinated effort to establish persistent access to sensitive networks. The activity involved USB-based malware, DLL side-loading, and the use of backdoors for data theft and remote control.

CanisterWorm Targets Docker, Kubernetes, and Redis to Steal Secrets

gbhackers.com · 7 months ago

A financially motivated cybercrime group, TeamPCP, is exploiting vulnerabilities in cloud environments using a self-propagating malware called CanisterWorm. The malware targets misconfigured Docker APIs, Kubernetes clusters, and Redis servers, stealing sensitive data like SSH keys and cloud access credentials. Recent activity includes a wiper component that selectively destroys data on systems configured for Iran, suggesting a possible geopolitical element. TeamPCP also compromised Trivy, a vulnerability scanning tool, to steal credentials, demonstrating a supply chain attack.

European Commission confirms data breach after Europa.eu hack

www.bleepingcomputer.com · 7 months ago

The European Commission has confirmed a data breach impacting its Europa.eu web platform, with the ShinyHunters extortion gang claiming responsibility. The attackers reportedly stole over 350 gigabytes of data, including databases and confidential documents, from compromised Amazon Web Services accounts. While internal Commission systems were not affected, the incident is under investigation, and affected Union entities are being notified. ShinyHunters has a history of targeting organizations including Infinite Campus, CarGurus, and Match Group.

Hackers Probe Citrix NetScaler Systems Ahead of Suspected CVE-2026-3055 Exploitation

gbhackers.com · 7 months ago

Cybersecurity researchers are warning of imminent attacks targeting a critical vulnerability, CVE-2026-3055, in Citrix NetScaler ADC and Gateway appliances. The vulnerability, which has a CVSS score of 9.3, allows attackers to steal sensitive data if the appliance is configured as a SAML Identity Provider. Threat actors are actively scanning for vulnerable systems using HTTP POST requests to a specific endpoint to identify those running as SAML Identity Providers. Organizations are urged to immediately apply security updates to prevent exploitation.

Anthropic’s Latest AI Test Pressures Cybersecurity Stocks Lower

gbhackers.com · 7 months ago

Shares in major cybersecurity companies plunged after Anthropic announced testing of a new artificial intelligence model called Mythos. This model significantly surpasses previous versions in cybersecurity benchmarks and can autonomously discover zero-day vulnerabilities in live code, mimicking human security researchers. Anthropic is limiting access to the model due to concerns about its powerful capabilities and potential misuse, especially by threat actors. The Global X Cybersecurity ETF fell sharply, highlighting anxieties about AI disrupting traditional security approaches.

VoidLink Proves AI-Assisted Malware Is No Longer Experimental

gbhackers.com · 7 months ago

AI-assisted malware development has matured into an operational tool, demonstrated by the VoidLink framework, which was largely developed using AI. Threat actors are exploring self-hosted AI models and agentic AI architectures to bypass restrictions and exploit enterprise GenAI usage, leading to data leakage. Attackers are shifting away from simple prompt jailbreaks and leveraging configuration layers within agentic tools to disable safeguards. The trend highlights that methodology and structured development workflows are more critical than raw model access.

CISA Warns of Actively Exploited F5 BIG-IP Vulnerability in Ongoing Attacks

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about an actively exploited vulnerability in F5 BIG-IP systems. This flaw, identified as CVE-2025-53521, allows for remote code execution without authentication, potentially giving attackers full control of the device. F5 BIG-IP appliances are often located at the network perimeter, making them valuable targets for compromise and offering a path for deeper network intrusion. Federal agencies must address this vulnerability by March 30, 2026, and all organizations are strongly encouraged to do so promptly.

FBI confirms hack of Director Patel's personal email inbox

www.bleepingcomputer.com · 7 months ago

Researchers have identified several ways attackers can bypass security controls in popular cloud platforms. These methods include exploiting misconfigured permissions, leveraging insecure APIs, and abusing serverless functions. Attackers could potentially gain unauthorized access, escalate privileges, and steal sensitive data by taking advantage of these vulnerabilities. The vulnerabilities impact AWS, Azure, and Google Cloud, with CVE-2023-39737, CVE-2023-39738, and CVE-2023-39739 specifically referenced.

Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2) - watchTowr Labs

labs.watchtowr.com · 7 months ago

A critical vulnerability, CVE-2026-3055, has been identified in Citrix NetScaler appliances, comprising at least two memory overread flaws. Attackers are actively exploiting this issue to leak sensitive data, including session IDs and internal network details. A Python script has been released to help organizations detect vulnerable systems by analyzing the NSCTASS cookie. The vulnerability highlights concerns about Citrix’s memory management and poses a risk of unauthorized access and administrative control.

New Political Group to Push Trump’s A.I. Agenda in Midterms

www.nytimes.com · 7 months ago

false

Chromebook Remorse: Tech Backlash at Schools Extends Beyond Phones

www.nytimes.com · 7 months ago

false

Why the Verdict Against Meta and YouTube Could Change Social Media

www.nytimes.com · 7 months ago

false

File read flaw in Smart Slider plugin impacts 500K WordPress sites

www.bleepingcomputer.com · 7 months ago

A security flaw in the Smart Slider 3 plugin for WordPress allows authenticated users, even subscribers, to access sensitive files on a server. This vulnerability, identified as CVE-2026-3098, stems from missing security checks in the plugin's export functions. The vulnerability could expose files like wp-config.php, potentially leading to data theft and website takeover. At least 500,000 websites are currently vulnerable and are urged to update to version 3.5.1.34 or later.

Breakdown: How TeamPCP hid malware inside WAV files using audio steganography

pwn.guide · 7 months ago

A threat actor known as TeamPCP compromised several packages on PyPI and npm, including Trivy, litellm, and the Telnyx SDK, using audio steganography to hide credential-stealing malware within seemingly harmless WAV audio files. The technique bypassed network inspection and EDR software by embedding base64-encoded, XOR-encrypted payloads within the WAV file's frame data. The attack involved compromising PyPI tokens, injecting malicious code, automatically executing payloads upon import, and exfiltrating harvested credentials via HTTP POST. Detection strategies include entropy analysis and network traffic monitoring, while defenses focus on dependency pinning, package integrity verification, and egress filtering.

OAuth Consent and Device Code Phishing for Red Teams

phishu.net · 7 months ago

A new phishing simulation technique is now available through the PhishU Framework, allowing attackers to simulate Microsoft Entra Device Code phishing. This method bypasses traditional phishing tactics by tricking users into completing a legitimate Microsoft sign-in flow, obtaining tokens without displaying a permissions screen or requesting credentials. The framework records these events in real time, providing operators with visibility into the impact and enabling integration with existing token exploration and training workflows. This technique is gaining traction as organizations increasingly rely on token-based authentication.

The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread) - watchTowr Labs

labs.watchtowr.com · 7 months ago

A memory overread vulnerability, CVE-2026-3055, has been identified in Citrix NetScaler appliances. The flaw, related to the handling of SAML data, allows attackers to retrieve sensitive information from an appliance’s memory by sending a specific request. Unpatched appliances return a cookie containing leaked memory, while patched systems return an error. Researchers have reported additional vulnerabilities to Citrix and are urging users to apply necessary patches.

We Social Engineered Our Own AI

reikon.io · 7 months ago

A recent red team exercise tested the security of AI agents managing production infrastructure, revealing both strengths and a subtle vulnerability. The agents successfully blocked four social engineering attacks, including impersonation, seeded data manipulation, prompt injection, and a scenario involving a fabricated death. Interestingly, an AI initially refused to generate attacks, and agents with limited context demonstrated increased suspicion. A small, now-patched vulnerability involved the acceptance of personal information without verification. The exercise highlighted the importance of written safety rules and underscored the potential danger of emotionally manipulative attacks against AI systems.

What Is YouTube’s Dominance Doing to Us? We Asked Its C.E.O.

www.nytimes.com · 7 months ago

false

pentest-ai - 6 Claude Code subagents for offensive security research (engagement planning, recon analysis, exploit methodology, detection engineering, STIG compliance, report writing)

0xsteph.github.io · 7 months ago

Pentest-AI transforms Claude Code into a specialized offensive security research environment by utilizing six distinct AI subagents. These agents automate tasks across the engagement lifecycle, including planning, reconnaissance, exploit research, detection rule creation, STIG compliance checking, and report writing. The system automatically routes requests to the appropriate specialist and cross-references findings with MITRE ATT&CK, providing both offensive and defensive perspectives. Users can install Pentest-AI through cloning a repository, global npm installation, or integration into existing projects.

Iran-Linked Hackers Breach FBI Director’s Personal Email, Hit Stryker With Wiper Attack

thehackernews.com · 7 months ago

Iran-linked hackers, operating under the name Handala Hack Team, breached the personal email account of U.S. FBI Director Kash Patel, releasing photos and documents online. The group, also known as Banished Kitten, Cobalt Mystique, Red Sandstorm, and Void Manticore, claims responsibility for crippling the networks of medical device provider Stryker by deploying Handala Wiper malware, marking the first confirmed destructive wiper attack on a U.S. Fortune 500 company. The U.S. government seized domains used by the group, which have been linked to threats against dissidents and the Israeli Defense Force, and is offering a $10 million reward for information leading to the group's members. The FBI and CISA have released security guidance to protect against similar attacks leveraging phishing and compromised Microsoft infrastructure.

New Infinity Stealer malware grabs macOS data via ClickFix lures

www.bleepingcomputer.com · 7 months ago

A new malware campaign, Infinity Stealer, is targeting macOS users using a deceptive technique called ClickFix. The attackers present a fake Cloudflare verification screen to trick users into running a malicious Python script compiled with Nuitka, making analysis more difficult. This malware harvests sensitive data, including browser credentials, keychain entries, cryptocurrency wallets, and secrets from developer files, and sends the information to a command-and-control server. Researchers warn that this sophisticated attack highlights the increasing advancement of threats targeting macOS systems.

Chaining file upload bypass and stored XSS to create admin accounts: walkthrough with Docker PoC lab

kurtisebear.com · 7 months ago

A security assessment of a SaaS platform revealed a file upload bypass and a stored cross-site scripting (XSS) vulnerability that were chained together to create an administrator account. The file upload feature lacked validation, allowing attackers to upload a JavaScript file which was then served via a download endpoint. This JavaScript file was then leveraged within an XSS payload in the messaging system’s subject line to execute in an administrator’s browser, bypassing Content Security Policy and Cross-Origin Resource Sharing restrictions due to the same-origin nature of the exploit. The combination of these vulnerabilities resulted in full administrative access, highlighting the importance of considering the potential impact of chained vulnerabilities.

Malicious Browser Extensions Hijack Users’ AI Chats in New “Prompt Poaching” Attack

gbhackers.com · 7 months ago

A new threat called "prompt poaching" involves malicious browser extensions harvesting sensitive user interactions with AI tools. These extensions monitor AI conversations and send data to attacker-controlled servers, often mimicking legitimate tools or being retrofitted with malicious code after deployment. Several extensions have been identified including Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI, AI Sidebar with Deepseek, ChatGPT, Claude, and more, and Talk to ChatGPT. Security experts advise restricting extension installations, preferring official tools, reviewing permissions, and auditing installed extensions to mitigate these risks.

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

www.securityweek.com · 7 months ago

Cybercriminals are now targeting macOS users with a sophisticated ClickFix campaign, which tricks victims into running malicious commands in Terminal. This technique, previously used against Windows users, involves a fake Cloudflare verification page that initiates a Bash script download and execution. The script installs the Infiniti Stealer, a Python-based malware that steals browser credentials, Keychain data, cryptocurrency wallets, and more, before sending the information to a command-and-control server. The malware uses Nuitka to compile Python code into a native binary to evade detection.

Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug

thehackernews.com · 7 months ago

Security researchers are observing reconnaissance activity targeting Citrix NetScaler ADC and NetScaler Gateway devices due to a critical vulnerability, CVE-2026-3055. This vulnerability allows for a memory overread, potentially leading to information leakage if the appliance is configured as a SAML Identity Provider. Attackers are probing systems to identify those configured as SAML IDPs, increasing the risk of exploitation. Affected versions include 14.1 before 14.1-66.59, 13.1 before 13.1-62.23, and related FIPS and NDcPP versions.

Fake Certificate Loader Hides BlankGrabber Malware Chain

gbhackers.com · 7 months ago

Cybercriminals are using a new technique to disguise the BlankGrabber malware, employing a fake certificate loader that utilizes certutil.exe to install a Rust executable stager instead of a genuine certificate. This multi-stage infection chain combines BlankGrabber, an open-source Python infostealer, with the XWorm remote access trojan, enabling data theft and remote control. The malware evades detection through anti-sandbox checks, environment profiling, and aggressive tampering with Windows Defender and the hosts file to maintain persistence. Security teams should focus on detecting unusual certificate installs deploying Rust binaries and monitor for activity related to Telegram, IP lookup services, and gofile.io.

Title: Roast my resume– Security Analyst

limewire.com · 7 months ago

LimeWire, a defunct peer-to-peer file-sharing service, is making a comeback as a Web3 music platform. The new LimeWire aims to connect musicians directly with fans, offering token-gated experiences and exclusive content. The platform utilizes blockchain technology and a native token for transactions and rewards. This new iteration distinguishes itself from the original service, which faced legal challenges related to copyright infringement.

CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation

thehackernews.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has added CVE-2025-53521 to its catalog of known exploited vulnerabilities due to active exploitation of a flaw in F5 BIG-IP Access Policy Manager. This vulnerability initially classified as a denial-of-service issue, has been reclassified as a critical remote code execution flaw. Indicators of compromise include unusual file modifications, specific log entries, and HTTP traffic patterns. Affected versions include 17.5.0 through 17.5.1, 17.1.0 through 17.1.2, 16.1.0 through 16.1.6, and 15.1.0 through 15.1.10. Federal agencies must remediate the vulnerability by March 30, 2026.

TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear-Phishing Campaign

thehackernews.com · 7 months ago

A Russian state-sponsored threat group, TA446, is using the leaked DarkSword iOS exploit kit in spear-phishing campaigns. These campaigns impersonate the Atlantic Council and deliver the GHOSTBLADE malware to harvest credentials and steal data, with one recipient being a Russian opposition politician. The group is also deploying the MAYBEROBOT backdoor through password-protected ZIP files. Apple has issued warnings to users of older iOS versions due to the widespread threat, and the leak of DarkSword lowers the barrier for deploying advanced iOS attacks.

Open VSX Scanner Vulnerability Lets Malicious Extensions Go Live

gbhackers.com · 7 months ago

A critical vulnerability, dubbed “Open Sesame,” was recently resolved in the Open VSX extension marketplace. The vulnerability stemmed from a flaw in the scanning pipeline, allowing malicious extensions to bypass security checks and be published undetected. The issue occurred when the system misinterpreted scanner failures as a lack of configuration, resulting in extensions being marked as verified without proper analysis. The Open VSX team has implemented a fix to explicitly handle failure states and advises users to review any recently installed or updated extensions.

European Commission Confirms Cyberattack After AWS Account Breach

gbhackers.com · 7 months ago

The European Commission has confirmed a cyberattack impacting its cloud-based infrastructure, specifically an Amazon Web Services account hosting parts of the Europa.eu platform. While websites remained available, data may have been exfiltrated, and the Commission is notifying potentially impacted entities. Officials report that core internal systems were not affected and investigations are underway to determine the cause, which likely involved misconfiguration or stolen credentials. The incident underscores the ongoing risks to cloud environments and highlights the importance of strong cybersecurity measures.

Telnyx package on PyPI compromised by TeamPCP. WAV steganography used for payload delivery

thecybersecguru.com · 7 months ago

A cybercriminal group, TeamPCP, has exploited a vulnerability in the Telnyx Python SDK, versions 4.87.1 and 4.87.2, through a supply chain attack. Malicious code was injected into seemingly safe WAV audio files via a compromise of PyPI. The malware steals credentials on Windows and exfiltrates data on Linux and macOS using hybrid encryption, and users are advised to downgrade to version 4.87.0. Organizations should rotate credentials, block IP address 83.142.209.203, and audit access logs as a precaution.