Blahalla

A company is trying to unlock a key to aging, in a long-overlooked body part

www.washingtonpost.com · 7 months ago

false

GPS is key to the global economy. It’s also surprisingly easy to attack.

www.washingtonpost.com · 7 months ago

Pilots recently reported navigation issues with the Global Positioning System, requiring them to use backup systems. The Federal Aviation Administration issued a warning to air traffic controllers due to the disruptions. Jamming and spoofing of GPS signals are increasing, creating risks to critical networks. These attacks pose a growing threat to vital infrastructure and operations.

Our personal data is all over the dark web. Here’s what you can do.

www.washingtonpost.com · 7 months ago

Personal data is increasingly appearing on the dark web, impacting many individuals. People are receiving notifications from monitoring services or banks confirming this exposure. This situation is widespread, affecting a significant number of people. It is becoming a common experience for personal information to be found in unauthorized online locations.

Disney will pay $10 million to settle children's data privacy lawsuit

www.bleepingcomputer.com · 7 months ago

Disney has agreed to a $10 million settlement with the Justice Department over violations of the Children’s Online Privacy Protection Act. The company allegedly failed to properly label videos as “Made for Kids” on YouTube, allowing the collection of personal data from children for targeted advertising. This mislabeling occurred even after YouTube alerted Disney to the issue. The settlement requires Disney to notify parents before collecting children’s data and ensure accurate video labeling.

European Space Agency Confirms Breach After Hacker Offers to Sell Data

www.securityweek.com · 7 months ago

The European Space Agency confirms a data breach after a hacker offered to sell stolen information. The hacker, known online as “888,” claims to have compromised systems and is offering 200 gigabytes of data, including source code and credentials, for sale. The breach affected external servers supporting collaborative engineering activities and occurred December 18. The agency is investigating the incident and working to secure its systems.

New Cybercrime Tool “ErrTraffic” Enables Automated ClickFix Attacks

gbhackers.com · 7 months ago

A new cybercrime tool called ErrTraffic v2 has emerged, enabling automated ClickFix attacks through a service model. The tool, priced at $800, exploits a disconnect in security architecture by presenting fake system errors that trick users into executing malicious code with user privileges. ErrTraffic uses "fake glitch" rendering to create a sense of urgency, leading to high conversion rates nearing 60%, and distributes payloads like Lumma, Vidar, and Atomic Stealer based on the victim’s operating system. The platform also facilitates a self-perpetuating cycle of website compromise by leveraging stolen credentials to spread the malicious script.

NeuroSploit v2 Launches as AI-Powered Penetration Testing Framework

gbhackers.com · 7 months ago

NeuroSploit v2 is a new AI-powered penetration testing framework designed to automate and improve offensive security operations. The framework utilizes large language models like Gemini, Claude, GPT, and Ollama, and includes features like modular agent roles and hallucination mitigation strategies. It supports integrations with tools like Nmap, Metasploit, and Burp Suite, and offers both command-line and conversational interaction modes. NeuroSploit v2 is open-source and available on GitHub under the MIT license.

Equifax Europe CISO: Notorious breach spurred cybersecurity transformation

www.csoonline.com · 7 months ago

The 2017 Equifax breach affected more than 147 million people and resulted in about 700 million dollars in fines, compensation, and remediation, prompting a broad corporate overhaul. Equifax invested nearly three billion dollars to rebuild technology and security, migrating over 300 systems and more than 30 product families to a cloud native Equifax Cloud in partnership with Google Cloud, eliminating legacy systems and enabling monthly platform updates. Security is now embedded in company operations using the NIST Cybersecurity Framework and a privacy framework, with a company wide security culture that includes employee bonuses tied to security, an annual security report, published core controls, and collaboration with the FBI and more than thirty security forums. Equifax reports neutralizing over 15 million cyber threats daily, a 25 percent increase from 2023, and is addressing rising AI driven attacks and deepfakes with multifactor and biometric authentication, hybrid AI defenses, regulatory alignment with DORA and NIS2, and preparations for the post quantum era under regional CISO Javier Checa.

DarkSpectre Malware Campaign Hits Chrome, Edge, and Firefox Users

gbhackers.com · 7 months ago

Researchers have uncovered a large-scale malware operation called DarkSpectre, attributed to a Chinese threat actor, impacting over 8.8 million users of Chrome, Edge, and Firefox. The campaign involved three distinct malware operations: The Zoom Stealer targeted corporate meeting intelligence, ShadyPanda focused on surveillance and affiliate fraud, and GhostPoster delivered payloads covertly. DarkSpectre used a “review-once, update-anytime” model to bypass security checks, and maintains numerous “sleeper” extensions awaiting weaponization. The group leveraged infrastructure on Alibaba Cloud and targeted platforms like Zoom, Microsoft Teams, and Google Meet.

Malicious Manipulation of LLMs for Scalable Vulnerability Exploitation

gbhackers.com · 7 months ago

Researchers have discovered a method to use large language models to automatically generate working exploits from publicly available vulnerability disclosures. This technique, called RSA, allows even novice users to compromise systems by crafting prompts, bypassing safety mechanisms. Testing against the Odoo ERP platform showed a 100% success rate in generating exploits, including database exfiltration and privilege escalation, with authenticated vulnerabilities proving easier to exploit. Over 700 publicly accessible Odoo instances in Africa are currently vulnerable, with CVE-2023-48050 and CVE-2024-36259 posing immediate threats.

Two U.S. Cybersecurity Professionals Plead Guilty to Acting as ALPHV/BlackCat Affiliates

gbhackers.com · 7 months ago

Two cybersecurity professionals have pleaded guilty to conspiring to commit extortion through ransomware attacks. Ryan Goldberg and Kevin Martin, of Georgia and Texas respectively, used their cybersecurity expertise to deploy ALPHV BlackCat ransomware against multiple victims in 2023, operating as affiliates within a ransomware-as-a-service model. The group extorted approximately $1.2 million in Bitcoin from one victim, sharing the proceeds. The Justice Department previously disrupted ALPHV BlackCat operations and seized related websites, saving victims approximately $99 million in ransom payments.

Critical Apache StreamPipes Flaw Allows Attackers to Take Over Admin Accounts

gbhackers.com · 7 months ago

A critical vulnerability, CVE-2025-47411, has been identified in Apache StreamPipes versions 0.69.0 through 0.97.0, allowing attackers with standard user access to gain administrator privileges. This flaw is due to improper handling of user ID assignment, allowing manipulation of authentication tokens to hijack administrator accounts. Successful exploitation grants complete control over the platform, potentially leading to data breaches and system modifications. Apache recommends upgrading to version 0.98.0 to resolve the issue.

APT36 Targets Indian Government Systems Using Malicious Windows LNK Files

gbhackers.com · 7 months ago

APT36, also known as Transparent Tribe, is conducting a cyber-espionage campaign targeting Indian government, academic, and strategic organizations. The attackers use spear-phishing emails containing malicious Windows shortcut files disguised as PDF documents to deliver a Remote Access Trojan. This RAT, ki2mtmkl.dll, exhibits adaptive persistence, dynamically adjusting its behavior based on installed antivirus software, and offers capabilities for surveillance, data theft, and remote control. The command and control server is located at IP address 2.56.10.86 on TCP port 8621, using the AES key “ZAEDF98768@$%QCHF.”

U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware

thehackernews.com · 7 months ago

false

New AI-Enhanced Crypter Promoted as Capable of Evading Windows Defender

gbhackers.com · 7 months ago

Cybersecurity researchers have identified a new malware loader called InternalWhisper x ImpactSolutions being promoted on dark web forums. This tool, offered by a threat actor known as ImpactSolutions, uses an AI-driven metamorphic engine to rewrite its code, creating unique binaries that evade antivirus solutions like Windows Defender. The service offers features like runtime encryption, stealth loading techniques, and signed binary sideloading, and is positioned as a Malware-as-a-Service product with tiered pricing. Security teams are advised to focus on behavioral detection to counter this threat.

New Open-Source C2 Framework AdaptixC2 Debuts With Improved Stability and Speed

gbhackers.com · 7 months ago

AdaptixC2 version 1.0, a new open-source Command and Control framework, has been released with significant improvements to stability and speed. The network tunnels have been completely overhauled to comply with RFC standards, now including IPv6 support. The user interface has been redesigned with a new layout and visual cues, and performance issues have been addressed through asynchronous functions and text batching. This is a breaking change, as database structures have been modified and are not backward compatible.

Cybercrime Inc.: Wenn Hacker besser organsiert sind als die IT

www.csoonline.com · 7 months ago

Cybercrime is now a highly organized and industrial-scale operation, akin to legitimate businesses. Models like Ransomware-as-a-Service have created specialized roles and efficient supply chains within this shadow economy. Experts suggest companies should prioritize building cyber resilience and viewing cybersecurity as a strategic asset, rather than trying to prevent all attacks. The key to success lies in the ability to rapidly recover and learn from inevitable security incidents.

Daran scheitert Passwordless

www.csoonline.com · 7 months ago

false

External Attack Surface Management (EASM): Mit diesen vier Schritten minimieren Sie das Cyberrisiko

www.csoonline.com · 7 months ago

Businesses face evolving cyber risks that traditional security measures often fail to address. A four-step process called External Attack Surface Management, or EASM, is recommended to proactively minimize these risks. The steps include identifying and classifying assets, detecting risks, assessing vulnerabilities, and prioritizing remediation. Continuous monitoring and automation are crucial components of an effective EASM program, as a small configuration change can expose significant vulnerabilities.

New ErrTraffic service enables ClickFix attacks via fake browser glitches

www.bleepingcomputer.com · 7 months ago

A new cybercrime tool called ErrTraffic is enabling automated ClickFix attacks. This service generates fake browser glitches on compromised websites to trick users into running malicious commands, with reported conversion rates as high as 60 percent. The platform, sold for 800 dollars, distributes payloads such as Lumma and Vidar info-stealers, the Cerberus trojan, AMOS, and Linux backdoors. Hudson Rock researchers report that the tool’s developers have excluded CIS countries, potentially indicating their origin.

RMM Abuse in a Crypto Wallet Distribution Campaign

malwr-analysis.com · 7 months ago

A sophisticated email campaign is targeting the Cardano community, enticing users with promises of token rewards and secure execution. The email directs users to download “Eternl Desktop,” which is distributed as an MSI installer from a newly registered domain. The installer secretly deploys LogMeIn Resolve, a Remote Monitoring and Management tool, using unattended access configurations to enable remote system control, raising significant concerns about potential post-exploitation activity. The malicious software connects to several domains including zerotrust[.]services and dumpster[.]console[.]gotoresolve[.]com, indicating a potential attempt to transmit event information.

New ‘GhostPairing’ Technique Enables Undetected WhatsApp Access

www.techrepublic.com · 7 months ago

Researchers have identified a new attack called "GhostPairing" that compromises WhatsApp accounts without the user’s knowledge. The attack exploits WhatsApp's device-linking feature through social engineering, tricking users into entering their phone number on a fake Facebook login page. Attackers then use this number to silently pair their device to the victim’s account, allowing them to monitor messages and gather personal information. Users are advised to avoid suspicious links, verify links before clicking, be cautious of Meta codes, and regularly review linked device settings.

Treasury removes sanctions for three executives tied to spyware maker Intellexa

therecord.media · 7 months ago

false

The best and worst technologies of 2025

www.washingtonpost.com · 7 months ago

false

Ransomware responders plead guilty to using ALPHV in attacks on US organizations

therecord.media · 7 months ago

Two cybersecurity professionals, Ryan Goldberg and Kevin Martin, have pleaded guilty to conspiring to commit extortion through ransomware attacks. They worked with a third, unidentified individual to launch attacks on organizations including a Florida medical company, a Maryland pharmaceutical company, and a California doctor’s office, between April and December 2023. The pair leveraged their incident response and negotiation expertise to extort victims and shared proceeds with the ALPHV/BlackCat ransomware group, which operated a ransomware-as-a-service model and impacted over 1,000 victims globally. The men face up to 20 years in prison and their actions highlight concerns about the cyber insurance and ransomware negotiation industry.

Gmail to Let Users Change Their Addresses While Keeping Data

www.nytimes.com · 7 months ago

Under the shift, which Google said would eventually be rolled out to all users, old addresses would remain active. Messages and services would not be lost.

CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

thehackernews.com · 7 months ago

The Cyber Security Agency of Singapore has issued a warning regarding a critical security vulnerability in SmarterMail email software. This flaw, identified as CVE-2025-52691, allows unauthenticated attackers to upload files and potentially execute code remotely. The vulnerability affects versions Build 9406 and earlier, and has a CVSS score of 10.0. Users are urged to update to Build 9483 to resolve the issue.

European Space Agency confirms breach of "external servers"

www.bleepingcomputer.com · 7 months ago

The European Space Agency has confirmed a recent cybersecurity breach impacting external servers. Attackers claim to have accessed JIRA and Bitbucket servers for a week and stolen over 200 gigabytes of data, including source code and credentials. The agency states the compromised servers contained unclassified information related to collaborative engineering activities and that a forensic analysis is underway. This incident follows a previous breach of ESA's web shop last year, which involved the theft of customer payment data.

Zoom Stealer browser extensions harvest corporate meeting intelligence

www.bleepingcomputer.com · 7 months ago

A new cyber campaign, Zoom Stealer, is affecting over 2.2 million users of Chrome, Firefox, and Microsoft Edge browsers through 18 malicious extensions. Researchers attribute this activity, along with campaigns GhostPoster and ShadyPanda, to a China-linked threat actor known as DarkSpectre. The extensions collect sensitive data from online meetings, including URLs, IDs, passwords, and participant information, which can be used for corporate espionage. Many of the extensions remain available in the Chrome Web Store despite being reported as malicious.

US cybersecurity experts plead guilty to BlackCat ransomware attacks

www.bleepingcomputer.com · 7 months ago

Two former cybersecurity professionals have pleaded guilty to participating in BlackCat ransomware attacks against U.S. companies. Ryan Goldberg and Kevin Martin, formerly of Sygnia and DigitalMint respectively, conspired to extort companies in exchange for a share of ransom payments. Victims included a pharmaceutical company, an engineering firm, and a medical device manufacturer, with one company paying $1.27 million after a $10 million demand. The FBI created a decryption tool after breaching BlackCat's servers and found the operation collected over $300 million in ransom payments.

CISA orders feds to patch MongoBleed flaw exploited in attacks

www.bleepingcomputer.com · 7 months ago

The U.S. Cybersecurity and Infrastructure Security Agency has issued a directive for government agencies to address a critical vulnerability in MongoDB, identified as CVE-2025-14847. This flaw, nicknamed MongoBleed, allows attackers to remotely access sensitive data, including credentials and personally identifiable information, without user interaction. Security researchers have demonstrated the vulnerability with a proof-of-concept exploit, and reports indicate a significant number of internet-exposed, vulnerable instances exist. Federal agencies must patch the vulnerability by January 19, 2026.

Cybersecurity Predictions 2026: An AI Arms Race and Malware Autonomy

www.darkreading.com · 7 months ago

Cybersecurity experts predict significant changes in 2026, driven by artificial intelligence. Offensive attacks using AI will intensify, including automated phishing and vulnerability exploitation, while defenses will also leverage AI for threat detection and response. A key concern is the rise of AI malware that can learn and adapt to evade detection, essentially creating self-preservation aware cyber worms. Additionally, expect increased consolidation in the cybersecurity market as larger platforms acquire smaller vendors to strengthen their data fabrics.

New Tech Deployments That Cyber Insurers Recommend for 2026

www.darkreading.com · 7 months ago

false

Magecart Campaign Deploys 50+ Malicious Scripts to Hijack E-Commerce Transactions

gbhackers.com · 7 months ago

A widespread Magecart campaign is targeting e-commerce platforms worldwide, using more than 50 malicious scripts to steal data. Unlike traditional attacks, this campaign actively manipulates checkout processes and account creation flows by deploying custom scripts tailored to specific payment gateways like Stripe, Mollie, and PayPal. The attackers use techniques like injecting fake payment forms, validating data with the Luhn algorithm, and employing hidden input fields to evade detection and exfiltrate sensitive information. This campaign goes beyond credit card theft, aiming to compromise user identities and gain long-term access to e-commerce systems.

8 Cybersecurity Acquisitions Surpassed $1 Billion Mark in 2025

www.securityweek.com · 7 months ago

false

ESET Flags Rising Threat of AI-Driven Malware and Ransomware

gbhackers.com · 7 months ago

The cybersecurity landscape is facing a rapidly evolving threat with the emergence of AI-powered malware and an expanding ransomware economy. Researchers have identified PromptLock, the first AI-powered ransomware, which uses OpenAI models to dynamically generate malicious code, making traditional detection methods less effective. Additionally, other AI-powered threats like PromptFlux, PromptSteal, and QuietVault are now being used in espionage campaigns. The ransomware-as-a-service market is booming, with Qilin and Akira dominating, while new groups like Warlock employ sophisticated evasion techniques, including exploitation of ToolShell vulnerabilities. Organizations must now prioritize behavioral analytics and zero-trust architecture to combat these increasingly complex and automated cyberattacks.

Critical IBM API Connect Flaw Allows Attackers to Bypass Authentication

gbhackers.com · 7 months ago

A critical vulnerability, CVE-2025-13915, has been identified in IBM API Connect, allowing attackers to bypass authentication without credentials or special privileges. The flaw, scoring 9.8 in severity, impacts versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0, potentially granting unauthorized access to backend systems and sensitive data. IBM recommends immediate patching or, as a temporary measure, disabling self-service sign-up functionality. Organizations are urged to prioritize remediation efforts due to the ease of exploitation and potential for complete compromise.

Using AI-Generated Images to Get Refunds

www.schneier.com · 7 months ago

Artificial intelligence image generation tools are being exploited to obtain refunds from businesses. Individuals are creating fake images of damaged products, then submitting them to request reimbursement. This technique leverages the ease of generating realistic imagery and the reluctance of companies to dispute claims. The practice highlights the potential for misuse of emerging technologies.

The Wirecutter Show: Tips for Using A.I. Smartly With Kevin Roose

www.nytimes.com · 7 months ago

false

Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware

thehackernews.com · 7 months ago

Cybercriminals known as Silver Fox are targeting users in India with phishing emails disguised as communications from the Income Tax Department. These emails distribute ValleyRAT, a modular remote access trojan, through a complex process involving DLL hijacking and the sideloading of malicious components. The group, also tracked as SwimSnake and others, has broadened its scope beyond Chinese-speaking individuals and organizations, now impacting sectors like finance and technology. Researchers discovered a panel used by Silver Fox to track download activity from malicious installer applications targeting popular software like Microsoft Teams.

New Spear-Phishing Attack Targeting Security Individuals in the Israel Region

gbhackers.com · 7 months ago

A spear-phishing campaign is currently targeting security and defense personnel in Israel. The attacks use WhatsApp messages disguised as legitimate organizations to lure victims to spoofed websites designed to steal credentials and sensitive information. Researchers attribute the operation to APT42, also known as Charming Kitten, based on the use of a custom URL shortener, msnl[.]ink, and shared infrastructure. The attackers leverage persistent infrastructure, including Microsoft IIS servers hosted in Europe, and dynamic DNS services, indicative of state-sponsored activity.

Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit

www.securityweek.com · 7 months ago

The Chinese APT group Mustang Panda, also known as HoneyMyte, is now employing a kernel-mode rootkit to deploy its ToneShell backdoor. This rootkit uses a signed driver file to protect itself from security tools and intercepts file operations before antivirus components. The driver also monitors registry operations and blocks attempts to remove or quarantine it, effectively circumventing security checks. Kaspersky researchers observed the rootkit delivering two user-mode payloads, including shellcode and the ToneShell backdoor, marking the first time ToneShell has been delivered through a kernel-mode loader.

Decoding the A.I.-Driven Tech Lingo From 2025

www.nytimes.com · 7 months ago

false

ChatGPT is overrated. Here’s what to use instead.

www.washingtonpost.com · 7 months ago

false

Critical SmarterMail Flaw Allows Attackers to Execute Remote Code

gbhackers.com · 7 months ago

A critical vulnerability has been identified in SmarterMail software, potentially allowing unauthenticated attackers to gain complete control of affected servers. The flaw, CVE-2025-52691, is rated 10.0 in severity and stems from a failure to properly restrict file uploads, enabling Remote Code Execution. Successful exploitation could lead to data theft, server takeover, and network pivoting. SmarterTools has released a patch, Build 9413, and immediate updates are strongly recommended.

Hackers Impersonated Jackson JSON Library to Infiltrate Maven Central

gbhackers.com · 7 months ago

A sophisticated malware campaign targeted Maven Central, the Java dependency repository, through a typosquatting attack impersonating the Jackson JSON library. The malicious package exploited a weakness in Maven Central's namespace protection, using a prefix-swap technique to masquerade as the legitimate library. The malware, a Trojan downloader, operates in multiple stages, establishes a connection to a command-and-control server, and downloads platform-specific binaries, including Cobalt Strike beacons. Security experts recommend enhanced namespace detection and verification procedures to prevent future supply chain attacks.

How to Integrate AI into Modern SOC Workflows

thehackernews.com · 7 months ago

false

Korean Air Data Compromised in Oracle EBS Hack

www.securityweek.com · 7 months ago

Korean Air has confirmed a data breach impacting approximately 30,000 employee records. The breach originated from a cyberattack targeting Korean Air Catering & Duty-Free, a former subsidiary and current supplier. Hackers reportedly stole employee names and bank account numbers, though customer data was not compromised. The incident is linked to a larger campaign exploiting vulnerabilities in Oracle E-Business Suite, which has affected numerous organizations, including American Airlines subsidiary Envoy Air, and is believed to be connected to the Cl0p ransomware group.

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

thehackernews.com · 7 months ago

A Chinese hacking group, Mustang Panda, is using a new, previously unseen kernel-mode rootkit driver to deploy the TONESHELL backdoor. The driver, signed with a stolen digital certificate from Guangzhou Kingteller Technology Co., Ltd, hides malicious activity and protects the backdoor from security tools. TONESHELL allows for reverse shell and downloader capabilities, communicating with command-and-control servers over TCP port 443 to receive commands and upload or download files. The campaign targeting government organizations in Asia began in February 2025 and utilizes memory forensics for analysis.

6 cyber insurance gotchas security leaders must avoid

www.csoonline.com · 7 months ago

false