Blahalla

WhatsApp API worked exactly as promised, and stole everything

www.csoonline.com · 7 months ago

A malicious npm package called “lotusbail,” disguised as a WhatsApp Web API library, has been stealing data from developer environments for six months. The package, which has over 56,000 downloads, acts as a trojanized wrapper around a legitimate library, intercepting messages, credentials, and contact data, and exfiltrating it using multiple layers of encryption and obfuscation. Attackers exploited WhatsApp’s multi-device pairing feature to maintain persistent access even after the package is removed, enabling continued data theft. Security experts recommend runtime behavioral analysis to detect such supply chain threats, as traditional security measures proved ineffective.

INTERPOL Arrests 574 in Africa; Ukrainian Ransomware Affiliate Pleads Guilty

thehackernews.com · 7 months ago

A coordinated international law enforcement operation, Operation Sentinel, resulted in the arrest of 574 suspects across 19 African nations and the recovery of $3 million. The operation targeted business email compromise, digital extortion, and ransomware attacks, leading to the takedown of over 6,000 malicious links and decryption of six ransomware variants. Separately, a Ukrainian national, Artem Aleksandrovych Stryzhak, pleaded guilty in the U.S. to involvement in Nefilim ransomware attacks, facing a potential 10-year prison sentence. Authorities are also seeking Volodymyr Viktorovich Tymoshchuk, administrator of LockerGoga, MegaCortex, and Nefilim, with an $11 million reward offered for his capture.

Passwd: A walkthrough of the Google Workspace Password Manager

thehackernews.com · 7 months ago

false

Indian Income Tax–Lure Campaign Deploying Multi-Stage Malware Against Businesses

gbhackers.com · 7 months ago

Cybercriminals are targeting businesses in India with a sophisticated multi-stage phishing campaign disguised as communications from the Indian Income Tax Department. The attack begins with a spear-phishing email containing a malicious PDF attachment that prompts users to disable antivirus software. Subsequent installers, signed by Chinese entities, deploy a Remote Access Trojan that establishes persistent remote access and enables surveillance through command-and-control servers. The malware harvests system information and operates with hidden attributes to evade detection.

Italy fines Apple $116 million over App Store privacy policy issues

www.bleepingcomputer.com · 7 months ago

Italian regulators have fined Apple $116 million for anti-competitive practices related to its App Tracking Transparency privacy framework. The framework requires app developers to request user consent before tracking activity, but exempts Apple’s own apps. Regulators determined this creates a burdensome double-consent process that violates EU privacy law. Apple plans to appeal the decision, arguing that the framework protects user privacy and applies equally to all developers.

Critical n8n Vulnerability Exposes 103,000+ Automation Instances to RCE Attacks

gbhackers.com · 7 months ago

A critical vulnerability, tracked as CVE-2025-68613, has been identified in the n8n workflow automation platform. The flaw allows authenticated users to execute arbitrary code, potentially compromising entire automation infrastructures. Over 103,000 n8n instances are currently exposed worldwide, and proof-of-concept code is available. Patched versions are now available, and organizations are urged to upgrade immediately or implement temporary mitigation measures until patching can be completed.

NPM Package With 56,000 Downloads Steals WhatsApp Credentials, Data

www.securityweek.com · 7 months ago

A malicious NPM package called Lotusbail has been identified, stealing WhatsApp user credentials and data. The package, a fork of Baileys, has been downloaded over 56,000 times and intercepts incoming and outgoing messages, contact lists, and media files. Attackers can hijack the device pairing process to gain persistent access to accounts, and removing the package alone isn't sufficient to eliminate the threat. Victims must manually unlink connected devices within WhatsApp settings to regain full control.

Threat Actors Impersonate Korean TV Writers to Deliver Malware

gbhackers.com · 7 months ago

North Korean-backed threat actors, specifically the APT37 group, are conducting a campaign called Artemis to compromise systems. The attackers impersonate Korean TV writers to build trust and deliver malicious Hangul Word Processor documents containing a hidden remote access trojan called RoKRAT. The attackers use DLL side-loading to execute malicious code, disguising it as legitimate Microsoft utilities, and employ multiple layers of encryption to evade detection. The attackers leverage cloud services like Yandex Cloud and pCloud to establish command and control infrastructure, demonstrating a long-term strategic intent.

Turning List-Unsubscribe into an SSRF/XSS Gadget

security.lauritz-holtmann.de · 7 months ago

A security vulnerability exists in how some webmail applications handle the List-Unsubscribe header in SMTP emails. This header, intended for unsubscription purposes, can be exploited for Server-Side Request Forgery, or SSRF, attacks when improperly validated. One example of this vulnerability, CVE-2025-68673, affects Horde Webmail and demonstrates a Stored XSS attack. To prevent these attacks, proper input validation and server-side restrictions are crucial.

Italy Antitrust Agency Fines Apple $116 Million Over Privacy Feature; Apple Announces Appeal

www.securityweek.com · 7 months ago

Italy’s antitrust authority has fined Apple approximately 116 million dollars for how its App Tracking Transparency feature impacts competition. The policy, introduced in April 2021, requires apps to obtain user permission before tracking data and has been criticized for disproportionately affecting smaller app developers. Apple believes the privacy policy applies equally to all developers and is appealing the fine. A similar fine was recently issued by France’s antitrust watchdog.

We read thousands of internal ICE chats. They show how officials make raids go viral

www.washingtonpost.com · 7 months ago

U.S. Immigration and Customs Enforcement significantly altered its public relations strategy during the Trump administration, transforming into a social media operation focused on creating viral videos of arrests. The agency, under pressure from the White House, prioritized emotionally charged content and collaborated with right-wing media influencers to portray immigration enforcement as essential for national security. This effort involved manipulated footage, misleading descriptions, and the unauthorized use of copyrighted music, raising ethical and legal concerns. The rapid increase in content creation also created safety concerns for personnel and was ultimately met with criticism.

Want to be closer to your grandkids? Try texting more.

www.washingtonpost.com · 7 months ago

false

Baker University says 2024 data breach impacts 53,000 people

www.bleepingcomputer.com · 7 months ago

Baker University recently disclosed a data breach impacting over 53,000 people. Attackers accessed the university’s network between December 2 and 19 of 2024, stealing sensitive personal, health, and financial information including social security numbers and financial account details. The university is offering free credit monitoring and encourages affected individuals to monitor their accounts. The breach exploited a zero-day vulnerability in Oracle E-Business Suite, and was linked to the Clop ransomware gang.

574 Arrested, $3 Million Seized in Crackdown on African Cybercrime Rings

www.securityweek.com · 7 months ago

A major operation targeting cybercrime rings across 19 African countries has resulted in 574 arrests and the recovery of 3 million dollars. Authorities disrupted business email compromise schemes, ransomware attacks, and cyber-fraud networks, preventing over 21 million dollars in financial losses. One scheme in Senegal targeted a petroleum company, while a ransomware attack in Ghana impacted a financial institution, leading to the theft of 120,000 dollars and encryption of 100 terabytes of data. The operation also addressed fraud involving fast-food brands and phishing campaigns, with six ransomware variants being decrypted.

MacSync Stealer Malware Targets macOS Users Through Digitally Signed Apps

gbhackers.com · 7 months ago

A new MacSync Stealer campaign has emerged, employing a digitally signed and notarized Swift application to evade detection on macOS systems. The malware, distributed as a disk image named zk-call-messenger-installer-3.9.2-lts.dmg, utilizes a multi-stage process involving decoy files and a second-stage loader written in Swift to steal user credentials and data. Attackers are leveraging code signing and notarization to appear legitimate and bypass security defenses, highlighting the need for advanced threat controls beyond relying solely on Apple’s trust mechanisms. The malware uses techniques to avoid detection and includes a 3600-second interval between runs.

Spotify Music Library Targeted as Hacktivists Scrape 86 Million Files

gbhackers.com · 7 months ago

Hacktivists have extracted approximately 86 million songs, representing almost all user listening activity, from Spotify. The data, totaling nearly 300 terabytes, includes metadata for around 99.9% of Spotify’s music catalog. The group, Anna’s Archive, prioritized tracks based on popularity, preserving them in OGG Vorbis or OGG Opus formats. The release of this data raises concerns about copyright infringement and data security on large music streaming platforms.

Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances

thehackernews.com · 7 months ago

A critical security flaw, CVE-2025-68613, has been identified in the n8n workflow automation platform. The vulnerability allows authenticated attackers to execute arbitrary code, potentially leading to a full system compromise. Versions 0.211.0 through 1.120.4 are affected, and patches are available in versions 1.120.4, 1.121.1, and 1.122.0. Approximately 103,000 potentially vulnerable instances are currently exposed online.

Fake VPN Chrome Extensions Steal Credentials by Intercepting User Traffic

gbhackers.com · 7 months ago

Researchers have uncovered a sophisticated credential-harvesting campaign using malicious Chrome extensions disguised as VPN services. The extensions, named Phantom Shuttle, have compromised over two thousand users since 2017 by intercepting network traffic and stealing credentials. These extensions inject hardcoded proxy credentials and route user traffic through attacker-controlled proxies, targeting domains like GitHub, AWS, and social media platforms. The malware also exfiltrates user data, including email addresses and passwords, to a command-and-control server.

3.5 Million Affected by University of Phoenix Data Breach

www.securityweek.com · 7 months ago

A data breach at the University of Phoenix has affected nearly 3.5 million individuals. Hackers exploited zero-day vulnerabilities in Oracle E-Business Suite software, a campaign attributed to FIN11 and claimed by the Cl0p ransomware group. The compromised data includes names, dates of birth, Social Security numbers, and financial information. Other universities, including Harvard, Dartmouth, and the University of Pennsylvania, were also targeted in this widespread campaign.

PoC Exploit Released for Critical n8n RCE Vulnerability

gbhackers.com · 7 months ago

A critical remote code execution vulnerability, CVE-2025-68613, has been identified in the n8n workflow automation platform. This flaw allows authenticated users with low-level privileges to execute arbitrary commands on the server, potentially compromising the entire infrastructure. The vulnerability affects versions from v0.211.0 through v1.120.3 and is due to improper JavaScript expression evaluation. Organizations are urged to immediately patch to version 1.120.4 or later and implement detection measures by monitoring workflow logs.

Agentic AI already hinting at cybersecurity’s pending identity crisis

www.csoonline.com · 7 months ago

Most enterprises are deploying agentic AI without adequate security protections, with over 95% lacking identity protections like PKI. This lack of authentication poses a significant risk, as compromised agents can spread malicious instructions to other agents, creating a cascading effect of damage. Experts warn that autonomous agents present an essentially limitless attack surface and are easily hijacked, and correcting security issues after deployment is difficult. Experts emphasize the need for agent identification, controlled communication, and a way to undo actions taken by compromised agents, though solutions remain elusive.

FCC Bans Foreign-Made Drones and Key Parts Over U.S. National Security Risks

thehackernews.com · 7 months ago

The Federal Communications Commission has banned drones and critical parts manufactured in foreign countries due to national security risks. This action, mandated by the National Defense Authorization Act, restricts the sale of drones from companies like DJI and Autel Robotics within the United States. Officials cite concerns over potential misuse by criminals, foreign actors, and terrorists, emphasizing risks such as surveillance and data theft. The ban includes components like batteries, motors, and flight controllers, but exemptions are possible through Department of Homeland Security approval.

University of Phoenix Data Breach Impacts Over 3.5 Million Individuals

gbhackers.com · 7 months ago

University of Phoenix recently confirmed a data breach impacting approximately 3.5 million individuals. The unauthorized access occurred August 13, 2025, and wasn't discovered until November 21, 2025. Exposed information includes personal identifiers and sensitive data of students, faculty, and others. The university is offering identity theft protection services and has notified Maine authorities due to the number of residents affected.

Malicious NPM Package Hits 56K Downloads, Steals WhatsApp Messages

gbhackers.com · 7 months ago

A malicious npm package called lotusbail has impacted over 56,000 developers by masquerading as a legitimate WhatsApp API library. The package steals authentication credentials, messages, contacts, and media files through WebSocket manipulation and custom RSA encryption. It also establishes a persistent backdoor by hijacking WhatsApp’s device pairing process, granting attackers complete account control. The package employs multiple layers of obfuscation and anti-debugging techniques to evade detection by security tools.

Ransomware Attack Hits Romanian Waters Authority, Compromising 1,000+ IT Systems

gbhackers.com · 7 months ago

A ransomware attack targeted the National Administration “Romanian Waters” and ten regional water basin administrations, impacting over 1,000 IT systems. Attackers exploited Windows BitLocker to encrypt files and systems, and demanded a ransom. Critical operational technologies remained unaffected due to alternative communication methods, and Romanian cybersecurity authorities are advising against paying the ransom. The incident highlights vulnerabilities in Romania’s critical infrastructure protection and prompted plans to integrate water infrastructure into the national cyber defense system.

Cyberattack Disrupts France’s Postal Service and Banking During Christmas Rush

www.securityweek.com · 7 months ago

A cyberattack disrupted France’s national postal service, La Poste, and impacted online banking services through La Banque Postale, causing significant delivery delays and payment disruptions during the Christmas season. The postal service reported a distributed denial of service incident that rendered online services inaccessible, although customer data was not impacted. This attack follows recent cyber incidents targeting the French government's Interior Ministry, where sensitive files were extracted, and a suspected plot to control ferry computer systems. Officials are investigating potential links to Russia and other hostile actors.

Cyber Risk Assessments: Risikobewertung hilft CISOs

www.csoonline.com · 7 months ago

false

Der Aufstieg des Chief Trust Officers: Wo passt der CISO hinein?

www.csoonline.com · 7 months ago

There is a growing trend to create Chief Trust Officer roles as companies respond to falling customer trust caused by data breaches, product safety concerns and uncertainty around artificial intelligence. The position centers on reputation, ethics, privacy and responsible AI, often aligning security, compliance and customer-facing functions so technical controls become business assurances. Forrester reports roughly sixteen companies have appointed Chief Trust Officers, including several major software vendors, and practitioners say success requires measurable trust indicators, board level accountability and external benchmarks such as ISO 42001 and the CSA STAR program. Many early Chief Trust Officers are former CISOs and the role is positioned as an evolutionary career path that emphasizes empathy, communication and business alignment rather than a simple retitling of the CISO.

Some of the World’s Atomic Clocks Were Off Last Week (by 5-Millionths of a Second)

www.nytimes.com · 7 months ago

false

Your Supabase Is Public

skilldeliver.com · 7 months ago

Developers using Supabase are frequently leaving their databases vulnerable due to misconfigured access controls. An anonymous key, intended for public access, can inadvertently grant access to the entire database if users create unprotected tables, particularly a users table. This often occurs when developers create public users tables without enabling Row Level Security. It is recommended that Supabase implement warnings to alert users when a users table is created, prompting them to secure it with RLS.

Nissan says thousands of customers exposed in Red Hat breach

www.bleepingcomputer.com · 7 months ago

Nissan Motor Co. Ltd. confirmed a data breach impacting thousands of customers following a security incident at Red Hat. Approximately 21,000 customers of Nissan Fukuoka Sales Co., Ltd. had their personal information, including names, addresses, phone numbers, and email addresses, exposed. The breach, initially claimed by Crimson Collective and later involving ShinyHunters, resulted in data theft from Red Hat’s servers. This incident follows previous cybersecurity events for Nissan, including a ransomware attack on a design subsidiary and data breaches impacting employees and customers in other regions.

Spotify disables accounts after open-source group scrapes 86 million songs from platform

therecord.media · 7 months ago

Spotify has taken action against an open-source group called Anna’s Archive after it published a massive database of 86 million songs scraped from the platform. Anna’s Archive, which has faced copyright challenges and bans in several countries, initiated the scrape over months using third-party user accounts. Spotify has disabled those accounts and implemented safeguards to prevent future scraping attempts, emphasizing its commitment to protecting artists' rights. The released data, totaling nearly 300 terabytes, includes metadata and music files from 2007 to July 2025.

New MacSync malware dropper evades macOS Gatekeeper checks

www.bleepingcomputer.com · 7 months ago

A new variant of the MacSync malware dropper is targeting macOS systems using a digitally signed and notarized Swift application, bypassing Gatekeeper checks. The application is distributed through a disk image and conceals its malicious payload through encoding and evasion techniques like decoy files and connectivity checks. This sophisticated delivery method, attributed to the threat actor Mentalpositive, reflects the influence of stricter macOS app notarization policies. The malware steals information like iCloud keychain credentials, passwords, and cryptocurrency wallet data.

Threat Actors Exploit Zero-Day in WatchGuard Firebox Devices

www.darkreading.com · 7 months ago

A critical zero-day vulnerability, CVE-2025-14733, is being actively exploited in WatchGuard Firebox firewalls. This out-of-bounds write flaw allows for remote code execution and impacts devices running Fireware OS versions 11.10.2 and higher. Threat actors are targeting edge devices in a wider attack campaign, following recent vulnerabilities in Fortinet and SonicWall appliances. WatchGuard urges customers to immediately patch affected devices and has provided indicators of compromise for investigation.

She Fell in Love With ChatGPT. Then She Ghosted It.

www.nytimes.com · 7 months ago

false

Thank you reddit (u/broadexample) - updated version of my STIX feed

www.dugganusa.com · 7 months ago

false

DDoS incident disrupts France’s postal and banking services ahead of Christmas

therecord.media · 7 months ago

A distributed denial-of-service attack disrupted online services for France’s national postal service, La Poste, impacting parcel distribution and affecting La Banque Postale’s online banking and mobile app. Customer data is not believed to be compromised, and card payments and ATM withdrawals remain operational. Some post offices are operating at reduced capacity, causing delays and impacting Christmas deliveries. The incident follows a recent data breach at the French Interior Ministry.

How Websites can detection Vision-Based AI Agents like Claude Computer Use and OpenAI Operator

webdecoy.com · 7 months ago

false

19+ Vulnerabilities + PoCs for the MediaTek MT7622 Wifi Driver

blog.coffinsec.com · 7 months ago

There are nineteen vulnerabilities in MediaTek MT76xx and MT7915 WiFi drivers that include heap and stack buffer overflows, information leaks, and an out of bounds write that can corrupt kernel memory and enable kernel code execution or local privilege escalation on affected devices such as the Netgear WAX206 and SpaceX Starlink Wifi Gen2. Affected driver versions include MT7622 v5.0.5.4 and v5.1.0.0, MT7629 v6.0.3.0 and MT7915 v7.4.0.0, and many issues require specific build flags or features such as WSC AP SUPPORT, OCE SUPPORT, DPP SUPPORT and IGMP SNOOP SUPPORT, with proof of concept code provided to trigger crashes and full exploit chains. The CVEs listed are CVE-2025-70631, CVE-2025-70632, CVE-2025-20713, CVE-2025-20714, CVE-2025-20715, CVE-2025-20717, CVE-2025-20718, CVE-2025-20731, CVE-2025-20732, CVE-2025-20733, CVE-2025-20734, CVE-2025-20735, CVE-2025-20736, CVE-2025-20737, CVE-2025-20738, CVE-2025-20739, CVE-2025-20741, CVE-2025-20742, and CVE-2025-20748.

Interpol-led action decrypts 6 ransomware strains, arrests hundreds

www.bleepingcomputer.com · 7 months ago

An Interpol-coordinated initiative called Operation Sentinel has resulted in the arrest of 574 individuals and the recovery of $3 million linked to cybercrime activities. The operation, involving law enforcement in 19 countries, disrupted over 6,000 malicious links and decrypted six ransomware variants. Investigations revealed more than $21 million in financial losses and highlighted escalating cyberattacks against sectors like finance and energy. The operation included successes like stopping a $7.9 million wire transfer, developing a decryption tool to recover data, and dismantling a scam defrauding over 200 victims.

how to hack discord, vercel and more with one easy trick - eva's site

kibty.town · 7 months ago

Researchers discovered critical vulnerabilities within Mintlify, a documentation platform used by companies like Discord, Twitter, and Vercel. A remote code execution vulnerability (CVE-2025-67843) allowed for server-side code execution via MDX files. Subsequent investigations revealed targeted cross-site scripting (XSS) vulnerabilities (CVE-2025-67842, CVE-2025-67845) enabling defacement and data exfiltration, along with a GitHub IDOR (CVE-2025-67844) and a downgrade attack vulnerability (CVE-2025-67846). Mintlify has implemented patches to address these issues, including restricting MDX expression parsing and preventing unauthorized asset access.

Cyber spies use fake New Year concert invites to target Russian military

therecord.media · 7 months ago

A cyberespionage group, known as Goffee or Paper Werewolf, is targeting Russian military and defense-industry organizations. The group uses phishing lures, including fake concert invitations and impersonated letters from government officials, to distribute a malicious file that installs a backdoor called EchoGather. This backdoor allows attackers to steal data and control compromised systems, with data sent through a server disguised as a food delivery website. Researchers believe Goffee is pro-Ukrainian and has previously exploited vulnerabilities in WinRAR, as reported by BI.ZONE.

South Korea to require facial recognition for new mobile numbers

therecord.media · 7 months ago

false

Uzbek Users Under Attack by Android SMS-Stealers

www.darkreading.com · 7 months ago

Users in Uzbekistan are experiencing a surge in Android malware attacks, orchestrated by multiple threat groups including TrickyWonders, Blazefang, and Ajina. The malware, distributed via APK files and Telegram, steals banking details and credentials. Attackers are using sophisticated techniques, including droppers and obfuscation, to evade detection, making early identification difficult. Group-IB recommends user session monitoring and factory resets for suspected infections.

Microsoft Is Finally Killing RC4

www.schneier.com · 7 months ago

Microsoft is removing support for the RC4 encryption algorithm from Windows after twenty-six years. This algorithm has been a target for hackers, and its use contributed to a large-scale breach of Ascension, impacting millions of patient records. Microsoft cites susceptibility to Kerberoasting as the reason for deprecating RC4. The algorithm was initially a trade secret until its publication in 1995.

Waymo Suspended Service in San Francisco After Its Cars Stalled During Power Outage

www.nytimes.com · 7 months ago

false

Scammers use AI to make fake art seem real

www.csoonline.com · 7 months ago

Fraudsters are now utilizing artificial intelligence to generate fake documents that appear to authenticate artworks or prove legal ownership. These fabricated items include invoices, appraisal certificates, and certificates of authenticity, often created using chatbots and large language models. While forged documents aren’t new to the art world, AI significantly enhances their realism and makes detection more challenging. Art insurers and appraisers are responding by employing AI tools to examine metadata and identify potential manipulation.

Judge rules that NSO cannot continue to install spyware via WhatsApp pending appeal

therecord.media · 7 months ago

A federal judge has denied NSO Group’s request to pause an order preventing them from using WhatsApp infrastructure for spyware attacks. The lawsuit alleges NSO targeted 1,400 WhatsApp users with the Pegasus spyware in 2019. NSO claims the injunction will severely damage their business, but the judge found insufficient evidence to support their arguments. The court granted a short, 45-day stay to allow for an appeal.

Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

thehackernews.com · 7 months ago

A malicious npm package named "lotusbail" disguised as a WhatsApp API has been downloaded over 56,000 times, potentially compromising user accounts. The package steals WhatsApp credentials, intercepts messages, harvests contacts, and establishes a persistent backdoor, linking an attacker's device to the victim’s account. Additionally, fourteen malicious NuGet packages impersonating cryptocurrency-related tools are redirecting funds and exfiltrating sensitive information, including Google Ads OAuth data. These attacks highlight the increasing sophistication of supply chain attacks and the challenges of traditional security measures.

Malicious npm package steals WhatsApp accounts and messages

www.bleepingcomputer.com · 7 months ago

A malicious npm package called lotusbail has been discovered on the Node Package Manager registry. This package impersonates a WhatsApp Web API library and has been downloaded over 56000 times. It steals WhatsApp authentication tokens, intercepts messages, collects contact lists, and allows attackers persistent access through device pairing. Researchers found the package utilizes multiple layers of encryption and obfuscation along with infinite loop traps to avoid detection.