Blahalla

Trust Wallet confirms extension hack led to $7 million crypto theft

www.bleepingcomputer.com · 7 months ago

A security incident involving version 2.68.0 of the Trust Wallet Chrome browser extension resulted in approximately $7 million in stolen cryptocurrency. Malicious code within the extension was found to exfiltrate wallet data to a suspicious external server, metrics-trustwallet[.]com. Attackers simultaneously launched a phishing campaign using a deceptive website, fix-trustwallet[.]com, to steal recovery seed phrases from panicked users. Trust Wallet has advised users to update to version 2.69 and take steps to secure their wallets.

Trust Wallet confirms extension hack led to $7 million crypto theft

www.bleepingcomputer.com · 7 months ago

A security incident has impacted the Trust Wallet Chrome extension, resulting in losses exceeding six million dollars worth of cryptocurrency. A malicious code within version 2.68.0 of the extension was exfiltrating sensitive wallet data to a suspicious external server. Attackers are also exploiting the situation with a phishing campaign, directing users to a fake website requesting wallet recovery seed phrases. Trust Wallet advises users to immediately update to version 2.69 of the extension and to create new wallets if they suspect compromise.

Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection

thehackernews.com · 7 months ago

A critical security vulnerability has been discovered in LangChain Core, allowing attackers to potentially steal secrets and manipulate large language model responses. The flaw, CVE-2025-68664, stems from a serialization injection issue where dictionaries with "lc" keys are not properly escaped, enabling attackers to instantiate arbitrary objects and extract secrets. A similar vulnerability, CVE-2025-68665, exists in LangChain.js, impacting several npm packages. Users are urged to update to patched versions to mitigate the risk.

‘All brakes are off’: Russia’s attempt to rein in illicit market for leaked data backfires

www.theguardian.com · 7 months ago

Russia is attempting to shut down a widespread illicit market known as "probiv," where leaked personal data is bought and sold for minimal fees. This market, fueled by corruption within government and corporate institutions, has historically been used by journalists, law enforcement, and criminals. Efforts to crack down on probiv, including new laws and arrests, have ironically led to operators moving abroad and releasing more sensitive data, such as the Kordon-2023 FSB database. Pro-Ukrainian hackers are also contributing to the problem by publicly releasing stolen data, making personal information readily accessible.

7 SASE certifications to validate converged network and security skills

www.csoonline.com · 7 months ago

false

Critical LangChain Vulnerability Allows Attackers to Steal Sensitive Secrets

gbhackers.com · 7 months ago

A critical vulnerability has been identified in the LangChain AI framework, allowing attackers to potentially steal sensitive secrets and achieve code execution. The vulnerability, CVE-2025-68664, stems from improper handling of serialization functions, enabling attackers to inject malicious data during deserialization. LangChain has released updated versions, 1.2.5 and 0.3.81, to address the issue by restricting deserialization to core objects, disabling secrets from environment variables by default, and blocking Jinja2 templates. Due to LangChain’s widespread use with approximately 847 million total downloads, immediate updates are strongly recommended.

Resurrect Your Dead Windows 10 Computer without Spending a Penny

adm1n.substack.com · 7 months ago

false

They Seek to Curb Online Hate. The U.S. Accuses Them of Censorship.

www.nytimes.com · 7 months ago

NULL

ChatGPT’s new formatting blocks make its UI look more like a task tool

www.bleepingcomputer.com · 7 months ago

false

Prominent Leaders Amplify Disinformation About Brown University Shooting

www.nytimes.com · 7 months ago

Following a shooting at Brown University that left two students dead, misinformation rapidly spread online. False claims emerged, including assertions that a victim was targeted for their political beliefs and that the incident was a terrorist attack. Prominent business and government figures amplified these rumors, contributing to public anxiety. Experts describe the situation as an "internet witch hunt," highlighting a concerning trend of leaders fueling disinformation for political gain.

Google will finally allow you to change your @gmail.com address

www.bleepingcomputer.com · 7 months ago

false

ThreatsDay Bulletin: Stealth Loaders, AI Chatbot Flaws AI Exploits, Docker Hack, and 15 More Stories

thehackernews.com · 7 months ago

Cybersecurity threats are evolving with attackers leveraging everyday tools and systems to conceal malicious activity. New tactics include using fake exploits, exploiting Android device vulnerabilities, and manipulating AI chatbots for data compromise. Phishing campaigns are targeting industries like defense and energy, utilizing convincing social engineering and sophisticated techniques linked to the threat actor RomCom. Experts emphasize increased vigilance and skepticism to counter these emerging threats, noting a shift in operations for some actors.

LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

thehackernews.com · 7 months ago

A 2022 data breach at LastPass allowed attackers to steal encrypted vault backups, which they have since used to crack weak master passwords and steal cryptocurrency. Blockchain intelligence firm TRM Labs has traced over $35 million in stolen digital assets linked to the breach, with activity continuing as recently as late 2025. Russian cybercriminal actors are believed to be involved, using exchanges like Cryptex and Audia6 to launder the funds, with Cryptex being sanctioned by the U.S. Treasury Department. TRM Labs was able to track the funds despite the use of CoinJoin techniques, highlighting the importance of ecosystem-level analysis in attribution.

CSRF Protection without Tokens or Hidden Form Fields

blog.miguelgrinberg.com · 7 months ago

A new method for Cross-Site Request Forgery (CSRF) protection has emerged, utilizing the Sec-Fetch-Site header, which modern browsers include in requests. This header indicates the origin of the request, same-origin, same-site, cross-site, or user-originated, and servers can block requests with a "cross-site" value to prevent CSRF attacks. As a fallback for older browsers, the Origin header can be used, although accurately validating it presents challenges. The Open Web Application Security Project (OWASP) has recently added this method to their cheat sheet, though it is currently listed as a defense-in-depth measure.

AI spending frenzy reaches India, sparking enthusiasm and concern

www.washingtonpost.com · 7 months ago

false

When robot taxis get stuck, a secret army of humans comes to the rescue

www.washingtonpost.com · 7 months ago

false

Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability

thehackernews.com · 7 months ago

Fortinet has observed active exploitation of a vulnerability, CVE-2020-12812, in FortiOS SSL VPN. This improper authentication flaw allows users to bypass two-factor authentication under specific configurations involving LDAP integration. Successful exploitation requires local users with 2FA referencing LDAP, group memberships, and specific authentication policy configurations. Fortinet recommends updating to FortiOS versions 6.0.10, 6.2.4, or 6.4.1 or using the "set username-sensitivity disable" command to mitigate the vulnerability. Organizations should also consider removing unnecessary secondary LDAP groups and resetting credentials if unauthorized access is suspected.

CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution

thehackernews.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has identified a security vulnerability in Digiever DS-2105 Pro network video recorders. This vulnerability, CVE-2023-52163, allows attackers to execute code remotely through command injection following authentication. Threat actors are actively exploiting this flaw to deploy botnets, and an additional arbitrary file read bug, CVE-2023-52164, also exists but remains unpatched because the device is no longer supported. Federal agencies are urged to mitigate the risk or discontinue using the affected product by January 12, 2025.

CERN: how does the international research institution manage risk?

www.csoonline.com · 7 months ago

false

Unpatched FortiGate Security Flaw Allows Attackers to Bypass 2FA Controls

gbhackers.com · 7 months ago

A critical vulnerability, CVE-2020-12812, allows attackers to bypass two-factor authentication on vulnerable FortiGate devices. The flaw occurs when case-sensitive username handling conflicts with case-insensitive LDAP directories, allowing attackers to authenticate without 2FA. Successful exploitation requires specific configurations including local FortiGate users, LDAP group memberships, and firewall policies using LDAP groups. Fortinet released a patch in July 2020, and administrators are advised to disable username case sensitivity and audit configurations to mitigate the risk.

A Father and Son’s $108 Billion Hostile Bid for Warner Bros. Discovery

www.nytimes.com · 7 months ago

false

WebSocket RCE in the CurseForge Launcher

elliott.diy · 7 months ago

A remote code execution vulnerability was discovered in the CurseForge modding platform’s desktop launcher. The launcher accepts WebSocket messages without authentication, allowing an attacker to launch modpacks with arbitrary Java Virtual Machine arguments. This enables attackers to execute commands on a victim’s system, potentially through a malicious website. The vulnerability, which existed for over three months, has been addressed with origin checking in version 1.289.3.

OpenAI is reportedly testing Claude-like Skills for ChatGPT

www.bleepingcomputer.com · 7 months ago

false

Fake MAS Windows activation domain used to spread PowerShell malware

www.bleepingcomputer.com · 7 months ago

A fake domain, get.activate[.]win, is being used to spread malware that infects Windows systems with the Cosmali Loader. Attackers are exploiting users who mistype the legitimate Microsoft Activation Scripts domain, get.activated.win, by just one character. The Cosmali Loader has been known to deliver cryptomining utilities and the XWorm remote access trojan. Experts recommend users avoid executing unfamiliar code and always verify commands before running them.

ServiceNow to acquire cyber firm Armis in $7.75 billion deal

therecord.media · 7 months ago

false

New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper

thehackernews.com · 7 months ago

Cybersecurity researchers have identified a new MacSync malware variant targeting macOS devices. The malicious software is distributed as a digitally signed application disguised as a messaging app installer to bypass Apple’s security measures. The installer downloads and executes an encoded script, and researchers note changes in payload retrieval methods designed to evade detection. This campaign uses a large DMG file containing unrelated PDF documents, and the MacSync agent includes remote command and control capabilities.

Microsoft Teams to let admins block external users via Defender portal

www.bleepingcomputer.com · 7 months ago

false

Europe condemns U.S. move to bar individuals over tech monitoring

www.washingtonpost.com · 7 months ago

The United States has barred five Europeans from entering the country due to accusations of censoring digital free speech. This action has drawn condemnation from European officials who are defending the Digital Services Act. The US State Department’s move is being described as an act of repression by those criticizing the decision. Secretary of State Marco Rubio recently spoke about the matter.

Pro-Russian Hackers Claim Cyberattack on French Postal Service

www.securityweek.com · 7 months ago

A pro-Russian hacking group called Noname057 claimed responsibility for a cyberattack that disrupted operations at France’s national postal service, La Poste. The distributed denial of service attack knocked out central computer systems, preventing package tracking and disrupting online payments. French authorities have taken over the investigation, as Noname057 has been linked to previous cyberattacks in Europe. This incident is part of a broader campaign of hybrid warfare alleged to be orchestrated by Russia.

MongoDB warns admins to patch severe vulnerability immediately

www.bleepingcomputer.com · 7 months ago

MongoDB is urging users to immediately patch a severe vulnerability that could allow unauthenticated attackers to access sensitive data. The flaw, tracked as CVE-2025-14847, stems from improper handling of a length parameter and could potentially allow attackers to execute arbitrary code. Affected versions include MongoDB 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, and numerous other releases back to version 3.6. Administrators are advised to upgrade to the latest available patched version or disable zlib compression as a temporary workaround.

MongoDB warns admins to patch severe RCE flaw immediately

www.bleepingcomputer.com · 7 months ago

MongoDB is urging administrators to immediately address a severe remote code execution vulnerability, tracked as CVE-2025-14847. The flaw allows unauthenticated attackers to execute arbitrary code and gain control of vulnerable servers due to improper handling of length parameters. Affected versions include MongoDB 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, and various other older versions, as well as MongoDB Server versions 4.2, 4.0, and 3.6. Until patched, administrators are advised to disable zlib compression.

certgrep: a free CT search engine

certgrep.sh · 7 months ago

false

FBI seizes domain storing bank credentials stolen from U.S. victims

www.bleepingcomputer.com · 7 months ago

The U.S. government has seized the web3adspanels.org domain and associated database following a cybercrime scheme involving stolen bank login credentials. Cybercriminals used phishing campaigns on Google and Bing to target American citizens, resulting in attempted losses of approximately 28 million dollars and actual losses of approximately 14.6 million dollars. The FBI identified at least 19 victims and the server hosting the stolen credentials was active as recently as November. Authorities recommend online banking users bookmark official portals or use ad blockers to avoid phishing attempts.

Nomani Investment Scam Surges 62% Using AI Deepfake Ads on Social Media

thehackernews.com · 7 months ago

A fraudulent investment scheme called Nomani has surged 62% recently, expanding beyond Facebook to platforms like YouTube. Cyber security researchers have blocked over 64,000 malicious URLs linked to the scam this year, primarily impacting Czechia, Japan, Slovakia, Spain, and Poland. The fraudsters are using increasingly sophisticated AI-generated deepfakes, with improved resolution and synchronization, to deceive potential victims into investing in fake products. Attackers are also employing legitimate social media tools and AI to generate phishing pages and avoid detection, often redirecting users to benign pages to lower their digital footprint.

Evasive Panda APT: Malware Delivery via AitM and DNS Poisoning

gbhackers.com · 7 months ago

A sophisticated threat actor known as Evasive Panda, also called Bronze Highland, Daggerfly, and StormBamboo, has been conducting a two-year campaign targeting victims in Turkey, China, and India. The group uses adversary-in-the-middle attacks and DNS poisoning to redirect traffic and deliver malware disguised as legitimate application updates from companies like SohuVA and Tencent QQ. Attackers employ multiple encryption layers and a novel injector to execute malicious code within legitimate processes, persisting on compromised systems for over a year. The group’s methods include manipulating DNS responses to redirect users to attacker-controlled infrastructure, and utilizing a hybrid encryption method combining DPAPI and RC5 to protect payloads.

Urban VPN Proxy Surreptitiously Intercepts AI Chats

www.schneier.com · 7 months ago

A popular VPN proxy application, Urban VPN, is secretly intercepting and collecting user conversations across ten different artificial intelligence platforms. The application harvests data including prompts, responses, timestamps, and platform information, regardless of the VPN’s active status. This data collection is enabled by default and cannot be disabled by users without uninstalling the application. The harvesting occurs through dedicated scripts within the extension.

Technical Deep Dive: How Early-Boot DMA Attacks are bypassing IOMMU on modern UEFI systems

www.nexaspecs.com · 7 months ago

A critical security vulnerability has been discovered in Unified Extensible Firmware Interface, or UEFI, implementations from ASRock, ASUSTeK Computer, GIGABYTE, and MSI. This flaw allows attackers to perform early-boot Direct Memory Access, or DMA, attacks, granting unauthorized access to system memory before the operating system fully loads. The vulnerability arises because the firmware reports active DMA protection, but the Input-Output Memory Management Unit, or IOMMU, is not properly configured. This allows malicious devices to potentially compromise data or inject code, and requires firmware updates from manufacturers to resolve.

Attacks are Evolving: 3 Ways to Protect Your Business in 2026

thehackernews.com · 7 months ago

Cybercriminals are increasingly targeting small and medium-sized businesses due to enhanced security measures at larger companies and their willingness to avoid ransom payments. Data breaches in 2025 included Tracelo, where over 1.4 million records were stolen, PhoneMondo, which lost more than 10.5 million records, and SkilloVilla, impacting over 33 million customer records. Experts advise businesses to implement two-factor authentication, enforce strict access controls, and utilize secure password managers to protect sensitive data and mitigate the risk of future attacks. Retail, tech, and media businesses were particularly vulnerable.

Webrat turns GitHub PoCs into a malware trap

www.csoonline.com · 7 months ago

Attackers are now using GitHub to target security professionals with a new campaign leveraging the Webrat Trojan. The attackers create seemingly legitimate repositories containing exploit code for vulnerabilities, including CVE-2025-59295, CVE-2025-10294, and CVE-2025-59230. These repositories lure users into downloading password-protected archives containing the Webrat malware, which establishes a backdoor allowing for credential theft, data exfiltration, and surveillance. Security experts recommend analyzing potential exploits in isolated environments to mitigate risk.

Microsoft Enhances BitLocker with Hardware Acceleration Support

gbhackers.com · 7 months ago

false

Trump Administration Downplays A.I. Risks, Ignoring Economists’ Concerns

www.nytimes.com · 7 months ago

false

Handy Phone Features Can Save You Holiday Time

www.nytimes.com · 7 months ago

false

Cyber volunteer effort for small water utilities announces new MSSP effort

therecord.media · 7 months ago

false

SEC Files Charges Over $14 Million Crypto Scam Using Fake AI-Themed Investment Tips

thehackernews.com · 7 months ago

The Securities and Exchange Commission has filed charges against several entities involved in a $14 million cryptocurrency scam. The scheme lured investors through social media ads and WhatsApp groups, falsely promising AI-generated investment tips. Victims were directed to fake cryptocurrency trading platforms like Morocoin, Berge, and Cirkor, which claimed to have government licenses and offered non-existent Security Token Offerings. Fraudsters ultimately defrauded investors a second time by demanding fees to access their own funds, and the proceeds were moved overseas.

NVIDIA Isaac Vulnerabilities Enable Remote Code Execution Attacks

gbhackers.com · 7 months ago

NVIDIA has released critical security updates for its Isaac Launchable platform to address three severe vulnerabilities. These flaws, CVE-2025-33222, CVE-2025-33223, and CVE-2025-33224, could allow unauthenticated attackers to remotely execute code. The vulnerabilities stem from hard-coded credentials and execution with unnecessary privileges, enabling privilege escalation and potential system compromise. NVIDIA recommends users immediately update to version 1.1 to mitigate the risks.

Cyberattack Knocks La Poste Offline, Disrupting Postal and Banking Services Across France

www.techrepublic.com · 7 months ago

A major cyberattack has disrupted services for France’s national postal service, La Poste, and its banking arm, La Banque Postale. The incident, described as a major network incident, has temporarily disabled online platforms and impacted postal deliveries across the country. Officials suspect a distributed denial-of-service attack was the cause, though no official attribution has been made. Recovery efforts are ongoing, and a timeline for full restoration has not yet been announced.

Implementing NIS2 — without getting bogged down in red tape

www.csoonline.com · 7 months ago

false

Israeli Organizations Targeted by AV-Themed Malicious Word and PDF Files

gbhackers.com · 7 months ago

A sophisticated cyber campaign, dubbed "Operation IconCat" or UNG0801, is targeting Israeli organizations. The attackers are using malicious Microsoft Word and PDF files disguised as antivirus software from companies like SentinelOne and Check Point to distribute two distinct malware implants: PYTRIC and RUSTRIC. PYTRIC is a destructive wiper that deletes data and communicates via Telegram, while RUSTRIC is a reconnaissance implant that gathers information about systems, including installed antivirus products like Quick Heal, CrowdStrike, Microsoft Defender, Kaspersky, and Norton. The operation appears to originate from Western Asia and highlights the use of repurposed infrastructure.

M-Files Vulnerability Allows Attackers to Steal Active User Session Tokens

gbhackers.com · 7 months ago

A critical security vulnerability, CVE-2025-13008, has been identified in M-Files Server that allows authenticated attackers to steal active user session tokens. Exploiting this flaw enables attackers to impersonate legitimate users, potentially granting unauthorized access to sensitive information and privileged actions. The vulnerability affects several versions of M-Files Server and has a CVSS 4.0 score of 8.6. M-Files advises users to upgrade to patched versions to mitigate the risk.

Net-SNMP Vulnerability Triggers Buffer Overflow, Crashing the Daemon

gbhackers.com · 7 months ago

A critical vulnerability, tracked as CVE-2025-68615, has been identified in the Net-SNMP snmptrapd daemon, allowing remote attackers to crash the service by sending malicious packets. The flaw affects all versions of Net-SNMP prior to the latest patches and has a CVSS score of 9.8 out of 10. The vulnerability requires no authentication and can disrupt network monitoring operations; patched versions 5.9.5 and 5.10.pre2 are now available. Security experts recommend immediate upgrades and restricting SNMP port access to trusted networks.