Blahalla

Italy Fines Apple €98.6 Million Over ATT Rules Limiting App Store Competition

thehackernews.com · 7 months ago

Italy’s antitrust authority has fined Apple nearly 100 million euros for anticompetitive practices related to its App Tracking Transparency framework. The authority found Apple’s rules unfairly burden third-party app developers, requiring them to obtain consent for data collection in a way that Apple’s own apps do not. This double consent requirement harms developers who rely on advertising revenue. Apple plans to appeal the decision and maintains its privacy rules apply equally to all developers.

NtKiller Malware Advertised on Dark Web With Claims of Antivirus and EDR Bypass

gbhackers.com · 7 months ago

A new malware tool called NtKiller is being advertised on underground forums as a way to bypass antivirus and endpoint detection and response systems. The tool, promoted by a threat actor known as AlphaGhoul, claims to silently disable security products and evade detection by supporting Hypervisor-Protected Code Integrity, Virtualization-based Security, and Memory Integrity. NtKiller is offered in modular packages, with pricing ranging from 500 to 1100 dollars, targeting serious cybercriminals. While the claims have not been verified, the potential for advanced techniques like Bring Your Own Vulnerable Driver attacks poses a significant risk to organizations.

Operation PCPcat Exploits Next.js and React, Impacting 59,000+ Servers

gbhackers.com · 7 months ago

A widespread credential-stealing campaign called "Operation PCPcat" has compromised over 59,000 Next.js servers globally. Attackers are exploiting vulnerabilities CVE-2025-29927 and CVE-2025-66478 to gain remote code execution and steal sensitive data such as AWS credentials, Docker configurations, and GitHub tokens. The attackers’ command-and-control infrastructure, located in Singapore, is openly exposing campaign metrics, and the malware uses techniques like GOST proxy software for persistence. Organizations using Next.js should immediately review their systems and rotate credentials to mitigate the threat.

Linearizing SHA-256 via fractional modular analysis (Kaoru Method)

doi.org · 7 months ago

NULL

WebRAT Malware Campaign Leveraging GitHub-Hosted Proof-of-Concept Code

gbhackers.com · 7 months ago

Cybersecurity researchers have identified a new malware strain called Webrat, a remote access tool and information stealer that began appearing in early 2025. Attackers distribute Webrat through GitHub repositories, YouTube comments, and pirated software sites, often disguised as game cheats or software patches. The malware steals data like login credentials and cryptocurrency wallet information and grants attackers complete control over infected devices, sometimes used for blackmail and swatting. Security experts recommend advanced antivirus solutions and avoiding downloads from untrusted sources to mitigate the risk.

Critical MongoDB Flaw Leaks Sensitive Data Through zlib Compression

gbhackers.com · 7 months ago

A critical security vulnerability, tracked as CVE-2025-14847, has been identified in MongoDB servers. This flaw allows attackers to extract sensitive data from server memory without authentication by exploiting a weakness in the zlib compression implementation. The vulnerability affects a wide range of MongoDB versions, including 3.6 through 8.2. Users are strongly advised to upgrade to the latest patched versions or disable zlib compression as a temporary solution.

ServiceNow’s $7.75 billion cash deal for Armis illustrates shifting strategies

www.csoonline.com · 7 months ago

false

Texas Age-Verification Law for App Stores Is Blocked, a Win for Apple and Google

www.nytimes.com · 7 months ago

false

Interpol sweep takes down cybercrooks in 19 countries

www.csoonline.com · 7 months ago

A recent international operation, Operation Sentinel, targeted cybercriminals in 19 African countries, resulting in over 574 arrests. Law enforcement agencies decrypted six ransomware strains, disrupted thousands of malicious links, and uncovered a business email compromise scam that nearly cost a petroleum company millions. The operation also dismantled a cyber-fraud network in Ghana and took down numerous malicious domains and social media accounts in Benin, highlighting a shift towards disrupting cybercrime operations before they escalate globally. Authorities are focusing on these areas, as cybercriminals increasingly target data theft and destruction.

U.S. Bars 5 European Tech Regulators and Researchers

www.nytimes.com · 7 months ago

The U.S. government has imposed travel bans on five European individuals accused of attempting to pressure American tech platforms to censor content. Secretary of State Marco Rubio claims these individuals are involved in organized efforts to influence platforms like X, Facebook, and Instagram. The action follows the European Union’s recent $140 million penalty against X for misleading users and restricting data access. The administration alleges these Europeans and affiliated organizations are targeting American speakers and companies.

Availability of old crypto exchange user email addresses? - Help to notify victims of the Bitfinex Hack - Now the largest forfeiture (113000 Bitcoins)

www.courtlistener.com · 7 months ago

There was an attempt more than a year earlier by the government to email victims about recovered funds but Bitfinex denied permission. Security researchers say they possess historic leaked exchange user data and offer to help return amounts in the nine digits to victims if outreach is coordinated now. There was a request for suggestions on places to contact and a ranked list of crypto exchanges active in 2016 was provided to guide outreach efforts.

Who Does Cybersecurity Need? You!

unit42.paloaltonetworks.com · 7 months ago

false

Strengthening supply chain security: Preparing for the next malware campaign

github.blog · 7 months ago

Recent campaigns, like Shai-Hulud, demonstrate a sophisticated, evolving threat to the JavaScript supply chain. Attackers compromise credentials to steal secrets, inject malicious code into packages via lifecycle scripts, and target CI environments, often employing obfuscation and staged payloads. To mitigate these risks, users should enable multi-factor authentication, regularly audit and revoke unused app access, and utilize tools like trusted publishing and branch protection. GitHub is accelerating its security roadmap with features like bulk OIDC onboarding, staged publishing, and expanded provider support to improve package security.

Dissecting a Multi-Stage macOS Infostealer

blog.threatuniverse.co.uk · 7 months ago

A sophisticated macOS infostealer, known as UserSyncWorker and a variant of MacSync Stealer, is utilizing a multi-stage infection process involving Swift downloaders, Zsh scripts, and AppleScript commands to collect and exfiltrate data. The malware employs techniques to bypass security measures like Gatekeeper and utilizes code signing. Apple has revoked the developer certificate used by the attackers, and the stealer communicates with command-and-control servers via HTTP POST requests to domains including focusgroovy.com and gatemaden.space. Suricata rules have been developed to detect the malware, focusing on indicators such as specific User-Agent strings and file paths.

Guide to preventing the most common enterprise social engineering attacks

cacm.acm.org · 7 months ago

Social engineering attacks are a significant cybersecurity risk, often bypassing technical defenses by exploiting human behavior. Common attack types include remote access scams, phishing, business email compromise, watering hole attacks, and deepfake impersonation. AI is enabling more sophisticated attacks, like deepfakes that impersonate executives, as demonstrated by a recent incident resulting in a substantial financial loss. Companies should prioritize employee training, strong policies, technical controls like multi-factor authentication, and a security-conscious culture to mitigate these threats.

Industry Continues to Push Back on HIPAA Security Rule Overhaul

www.darkreading.com · 7 months ago

Industry organizations are voicing significant concerns about proposed updates to the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, citing impractical implementation deadlines and potential financial burdens. The proposed changes aim to strengthen cybersecurity within the healthcare sector, addressing areas such as patch management, multi-factor authentication, and network segmentation. Healthcare leaders are urging the Department of Health and Human Services (HHS) to collaborate with stakeholders and revise the rule to ensure it aligns with how healthcare organizations operate, particularly considering the need for continuous patient care and the complexity of business associate agreements. Some suggest the Health Care Cybersecurity and Resilience Act of 2025 offers a more realistic approach, combining mandates with financial assistance for healthcare facilities.

Microsoft rolls out hardware-accelerated BitLocker in Windows 11

www.bleepingcomputer.com · 7 months ago

false

ServiceNow Buys Armis for $7.75B, Boosts 'AI Control Tower'

www.darkreading.com · 7 months ago

false

More than 22 million Aflac customers impacted by June data breach

therecord.media · 7 months ago

A data breach at Aflac has impacted over 22 million customers. The company determined the intrusion was stopped quickly, but cybercriminals stole files containing sensitive information like insurance claims, health data, and Social Security numbers. Officials have notified state regulators and are offering identity protection services to affected individuals. The breach is linked to the Scattered Spider cybercriminal group, which has targeted the insurance industry and extorted millions of dollars from victims.

WebRAT malware spread via fake vulnerability exploits on GitHub

www.bleepingcomputer.com · 7 months ago

Cybercriminals are now distributing WebRAT malware through fake vulnerability exploits hosted on GitHub repositories. This malware, which previously spread through pirated software, steals credentials for accounts like Steam, Discord, and Telegram, and can also spy on victims. The malicious repositories falsely claim to offer exploits for vulnerabilities including CVE-2025-59295, CVE-2025-10294, and CVE-2025-59230. Kaspersky researchers believe the descriptions within the repositories were generated using artificial intelligence and have removed the malicious content, but caution users to exercise caution when downloading and executing code from untrusted sources.

How Much Water Does the A.I. Industry Use?

www.nytimes.com · 7 months ago

false

Is Australia’s Social Media Ban for Kids a Good Idea?

www.nytimes.com · 7 months ago

false

It’s a Hard Forkin’ Christmas!

www.nytimes.com · 7 months ago

false

FCC bans new DJI Chinese drones, citing national security

www.washingtonpost.com · 7 months ago

The Federal Communications Commission has prohibited the sale of new foreign-made drones, including those manufactured by DJI. This decision is based on national security concerns and potential harm to American drone manufacturers. The ban effectively restricts U.S. consumers from purchasing new models of DJI and other foreign drones. The commission's determination reflects an effort to protect U.S. interests.

Former Roomba C.E.O. Reminisces on 2008’s Viral ‘Shark Cat’ Meme

www.nytimes.com · 7 months ago

false

Google Buys Data Center Company for $4.75 Billion

www.nytimes.com · 7 months ago

false

Amazon Fends Off 1,800 Suspected DPRK IT Job Scammers

www.darkreading.com · 7 months ago

Amazon has blocked more than 1,800 suspected North Korean operatives from gaining employment since April 2024. These individuals attempt to secure remote IT positions to steal intellectual property, conduct espionage, and funnel wages back to North Korea to support weapons programs. Amazon’s detection methods include credential verification, AI-powered background checks, and structured interviews, while scammers increasingly use stolen or fabricated credentials and laptop farms. The threat is widespread across industries, prompting recommendations for organizations to scrutinize resumes and report suspicious activity to law enforcement.

Start 2026 by paying less for your phone, internet and other services

www.washingtonpost.com · 7 months ago

false

Sprawling 'Operation Sentinel' Neutralizes African Cybercrime Syndicates

www.darkreading.com · 7 months ago

A global law enforcement operation, codenamed Operation Sentinel, has disrupted several cybercrime organizations across 19 African countries. The coordinated effort resulted in 574 arrests and the seizure of approximately 3 million dollars, alongside the dismantling of over 6,000 malicious links and decryption of six ransomware variants. Cybercrime activity has impacted sectors including finance and energy, with notable incidents including a 7.9 million dollar business email compromise scam against a Senegalese petroleum company and a ransomware attack on a Ghanian financial institution causing 120,000 dollars in losses. Interpol reports a sharp rise in cybercrime across Africa, highlighting the need for cybersecurity to support stability and development.

MacSync Stealer malware bypasses macOS Gatekeeper security warnings

www.csoonline.com · 7 months ago

A new malware variant, MacSync Stealer, is bypassing macOS Gatekeeper security by disguising itself as a legitimate, code-signed application. Attackers are distributing the malware through ordinary-looking utility URLs, retrieving the payload script from a command-and-control server after initial installation. This technique exploits a weakness in Apple’s notarization system, allowing malicious software to appear legitimate and avoid security warnings. The malware targets user credentials, API keys, and cryptocurrency wallet data, following a trend of increasing economically motivated macOS malware.

UK Government Urged to Review Palantir Contracts After Swiss Security Report

www.techrepublic.com · 7 months ago

UK politicians are now scrutinizing government contracts with Palantir following reports of repeated rejections of the company’s data-analysis software by Swiss authorities. Swiss agencies expressed concerns about potential access to sensitive data by US government entities and intelligence services, citing a loss of national sovereignty and operational control. Palantir’s CEO's public statements regarding the company’s mission to disrupt and potentially harm adversaries have also raised concerns. Palantir denies these claims and insists clients retain full control over their data.

The AI Fix #82: Santa Claus doesn’t exist (according to AI)

grahamcluley.com · 7 months ago

false

Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites

thehackernews.com · 7 months ago

Two malicious Google Chrome extensions, Phantom Shuttle, have been discovered with over 2,000 and 180 users respectively, masquerading as network speed test tools. These extensions secretly intercept user traffic, steal credentials, and operate as man-in-the-middle proxies after users pay for a subscription. The extensions route traffic through threat-actor controlled servers and exfiltrate sensitive data, including passwords and API keys, to a command-and-control server at phantomshuttle[.]space. Users are advised to remove the extensions immediately and security teams should implement extension allowlisting and monitor for suspicious proxy authentication attempts.

ServiceNow to Acquire Armis for $7.75 Billion in Cash

www.securityweek.com · 7 months ago

false

Amazon has stopped 1,800 job applications from North Korean agents

www.csoonline.com · 7 months ago

Amazon has identified and blocked over 1800 job applications originating from North Korean agents since April 2024. These applications aim to secure remote positions with US companies and funnel income towards North Korea's weapons program. The company utilizes artificial intelligence and manual verification processes to detect fraudulent applications, noting trends such as identity theft, compromised LinkedIn accounts, and fabricated credentials. Amazon recommends that other businesses review their security practices and report suspicious activity.

French postal service brought down by cyber attack

www.csoonline.com · 7 months ago

France’s postal service, La Poste, is experiencing a widespread network failure impacting its website, digital services, and mobile app. The disruption has lasted more than twelve hours, though counter services are still operational. Reports indicate a distributed denial of service attack is the likely cause. La Poste’s bank services and SMS verification remain functional.

Malicious extensions in Chrome Web store steal user credentials

www.bleepingcomputer.com · 7 months ago

Two malicious Chrome extensions named "Phantom Shuttle" are currently available in the Chrome Web Store. These extensions masquerade as proxy service plugins, targeting users in China, and have been active since 2017. They route user traffic through attacker-controlled proxies, steal sensitive data like credentials and API tokens, and dynamically reconfigure Chrome's proxy settings. Researchers have notified Google, but the extensions remain available.

Microsoft Teams strengthens messaging security by default in January

www.bleepingcomputer.com · 7 months ago

Microsoft Teams will automatically enable enhanced messaging security features beginning January 12, 2026. This update will protect users from malicious content by implementing weaponizable file type protection, malicious URL detection, and a false positive reporting system. Organizations that have already customized these settings will not be affected, and administrators are encouraged to review their configurations before the deadline. The changes are part of Microsoft's response to increased cybersecurity threats targeting Teams users.

One-time codes used to hack corporate accounts

www.csoonline.com · 7 months ago

Hackers are exploiting a loophole to gain access to corporate accounts, circumventing multi-factor authentication. They are leveraging one-time codes generated through the OAuth 2.0 standard, often tricking users into entering codes on fake Microsoft authentication pages. This allows the attackers to completely compromise Microsoft 365 accounts and the data within. The technique involves impersonating devices requiring authentication to obtain the necessary codes.

Why outsourced cyber defenses create systemic risks

www.csoonline.com · 7 months ago

Outsourcing critical IT and cybersecurity functions, initially intended for efficiency, now presents a significant systemic fragility risk. Breaches like SolarWinds and MOVEit demonstrate how a single vendor compromise can impact numerous organizations across industries and nations, potentially triggering geopolitical concerns. The rise of AI-driven cyberattacks further exacerbates these risks, highlighting the need for boards, CISOs, and regulators to prioritize trust-based vendor oversight, resilience design, and proactive governance to mitigate potential economic disruption and global instability. Regulators must harmonize standards and enforce stress tests for critical vendors to address the escalating threat.

SEC Targets Crypto Platforms in Social Media Scam Crackdown

www.techrepublic.com · 7 months ago

The Securities and Exchange Commission has launched a crackdown on several cryptocurrency trading platforms and investment clubs for defrauding retail investors out of over $14 million. These platforms used sophisticated techniques, including automated trading bots to generate fake trading volume and fabricated social media testimonials, to manipulate markets and target vulnerable users. Regulators are responding with increased scrutiny and initiatives like “Project Crypto” to combat these increasingly complex schemes and protect investors, resulting in record-breaking cryptocurrency penalties this year. Investigations reveal criminals are weaponizing social media algorithms and exploiting the efficiency of cryptocurrency for financial gain.

INTERPOL Dismantles Six Ransomware Operations, Detains 500+ Individuals

gbhackers.com · 7 months ago

Law enforcement officials across 19 African countries recently concluded Operation Sentinel, a month-long initiative resulting in the arrest of over 574 suspects and the recovery of approximately three million US dollars. The operation targeted ransomware, business email compromise, and digital extortion, dismantling six ransomware variants and neutralizing thousands of malicious links. Investigations revealed estimated financial losses exceeding 21 million US dollars, with significant successes including the prevention of a nearly eight million US dollar fraudulent wire transfer and the recovery of nearly 30 terabytes of data from a ransomware attack. The operation underscored the importance of public-private partnerships in combating cybercrime.

HardBit 4.0 Ransomware Abuses Unsecured RDP and SMB for Access Persistence

gbhackers.com · 7 months ago

The HardBit ransomware family has released version 4.0, employing sophisticated techniques to gain and maintain network access. Attackers are exploiting unsecured Remote Desktop Protocol and Server Message Block services for initial entry and lateral movement, often using tools like NLBrute and Mimikatz. This variant utilizes the Neshta file infector and includes a runtime authorization requirement to bypass security analysis, while also aggressively disabling Windows Defender and employing data destruction capabilities through a “Wiper” mode. Organizations should prioritize securing network services and maintaining robust backup solutions to mitigate the risk.

South Korean firm hit with US investor lawsuit over data breach disclosure failures

www.csoonline.com · 7 months ago

A U.S. federal securities class action lawsuit has been filed against Coupang, a South Korean ecommerce giant, alleging a failure to promptly disclose a data breach affecting 33.7 million customer accounts. The company waited nearly a month to report the incident, violating SEC cybersecurity disclosure rules requiring reports within four business days. The breach occurred because a former employee retained valid authentication credentials after leaving the company, exposing vulnerabilities in key management practices. South Korean authorities are investigating, and Coupang faces potential fines and regulatory scrutiny.

Cyberattack knocks offline France's postal, banking services

www.bleepingcomputer.com · 7 months ago

A major network incident has disrupted digital banking and online services for millions of customers in France. La Poste, the national postal service, confirmed its information systems were knocked offline, impacting its website, mobile app, and digital services. La Banque Postale, the banking arm, reported online and mobile services were also down, but core banking operations remain functional. French media reports suggest the outage was caused by a distributed denial-of-service attack.

Nissan Confirms Impact From Red Hat Data Breach

www.securityweek.com · 7 months ago

Nissan has confirmed it was impacted by a data breach originating from a Red Hat Consulting GitLab instance. The Crimson Collective hacking group claims responsibility for stealing data, potentially including information about Red Hat customers. Nissan reports that the personal information of approximately 21,000 Nissan Fukuoka Sales customers was compromised, including names, addresses, phone numbers, and email addresses. The company states that credit card data was not stolen and has notified affected individuals and authorities.

Denmark Accuses Russia of Conducting Two Cyberattacks

www.schneier.com · 7 months ago

Denmark’s Defence Intelligence Service recently attributed two cyberattacks to Russia. A pro-Russian group, Z-Pentest, was responsible for an attack targeting a Danish water utility in 2024. Additionally, NoName057(16), linked to the Russian state, conducted distributed denial-of-service attacks against Danish websites prior to elections. These actions highlight Russia’s alleged involvement in targeting Danish infrastructure and political processes.

WhatsApp API worked exactly as promised, and stole everything

www.csoonline.com · 7 months ago

A malicious npm package called “lotusbail,” disguised as a WhatsApp Web API library, has been stealing data from developer environments for six months. The package, which has over 56,000 downloads, acts as a trojanized wrapper around a legitimate library, intercepting messages, credentials, and contact data, and exfiltrating it using multiple layers of encryption and obfuscation. Attackers exploited WhatsApp’s multi-device pairing feature to maintain persistent access even after the package is removed, enabling continued data theft. Security experts recommend runtime behavioral analysis to detect such supply chain threats, as traditional security measures proved ineffective.

INTERPOL Arrests 574 in Africa; Ukrainian Ransomware Affiliate Pleads Guilty

thehackernews.com · 7 months ago

A coordinated international law enforcement operation, Operation Sentinel, resulted in the arrest of 574 suspects across 19 African nations and the recovery of $3 million. The operation targeted business email compromise, digital extortion, and ransomware attacks, leading to the takedown of over 6,000 malicious links and decryption of six ransomware variants. Separately, a Ukrainian national, Artem Aleksandrovych Stryzhak, pleaded guilty in the U.S. to involvement in Nefilim ransomware attacks, facing a potential 10-year prison sentence. Authorities are also seeking Volodymyr Viktorovich Tymoshchuk, administrator of LockerGoga, MegaCortex, and Nefilim, with an $11 million reward offered for his capture.

Passwd: A walkthrough of the Google Workspace Password Manager

thehackernews.com · 7 months ago

false