Blahalla

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

thehackernews.com · 7 months ago

Threat actors are increasingly using dropper applications to distribute Android malware like Wonderland, targeting users in Uzbekistan and other regions. This malware steals SMS messages and one-time passwords, enabling financial fraud and lateral movement through infected devices, often leveraging Telegram for coordination. New malware families such as Cellik, Frogblight, and NexusRoute are emerging, with Cellik offering a one-click APK builder to disguise malicious payloads within legitimate apps, and NexusRoute impersonating Indian government services to steal financial data. These evolving tactics indicate a growing sophistication and maturation of mobile malware operations.

When OAuth Becomes a Weapon: Lessons from CVE-2025-6514

amlalabs.com · 7 months ago

A critical vulnerability, CVE-2025-6514, was recently discovered in the mcp-remote software, impacting 558,846 downloads and enabling arbitrary OS command execution. The flaw stemmed from a design pattern where clients request authentication endpoints from servers, allowing malicious servers to exploit this trust. The vulnerability highlights a fundamental problem with OAuth’s trust assumptions when applied to autonomous agents, where agents delegate authority to one another. Capability-based delegation is proposed as a more secure alternative, offering cryptographic verification and eliminating the need for dynamic discovery.

6 wichtige Punkte für Ihren Incident Response Plan

www.csoonline.com · 7 months ago

An effective incident response plan should include a business impact analysis to understand potential disruptions and a communication strategy for stakeholders. Clear roles and workflows extending beyond IT are also crucial, along with awareness of evolving threats like supply chain attacks. Resilience planning and regular testing are essential to maintaining operations and refining the plan's effectiveness. Experts recommend modular playbooks and post-incident reviews for continuous improvement and simplified action during a crisis.

Podcast: Die IT-Tops und -Flops 2025

www.csoonline.com · 7 months ago

false

Why Do A.I. Chatbots Use ‘I’?

www.nytimes.com · 7 months ago

false

Power Restored for Most of San Francisco After Widespread Outage

www.nytimes.com · 7 months ago

false

Docker Hardened Images now open source and available for free

www.bleepingcomputer.com · 7 months ago

false

Vulnhalla: Picking the true vulnerabilities from the CodeQL haystack

www.cyberark.com · 7 months ago

A threat research team built an open source tool called Vulnhalla that feeds CodeQL alerts and surrounding code context into GPT-4o so the model can reason about whether each alert represents a real vulnerability. The tool stripped away roughly ninety six percent of false positives, enabling researchers in two days of running and triaging the output to confirm vulnerabilities in the Linux Kernel, FFmpeg, Redis, Bullet3, and RetroArch. Early runs cost under eighty dollars in API fees and researchers say longer runs and improved models can reveal additional vulnerabilities.

When Something Goes Wrong With Your Flight, These People Take Charge

www.nytimes.com · 7 months ago

false

Iranian Infy APT Resurfaces with New Malware Activity After Years of Silence

thehackernews.com · 7 months ago

Iranian threat actors known as Infy, also called Prince of Persia, have resumed activity after a period of silence. The group, one of the oldest advanced persistent threats, has targeted victims in Iran, Iraq, Turkey, India, Canada, and Europe, using updated versions of malware, Foudre and Tonnerre. Attack techniques include phishing emails with embedded executables, a domain generation algorithm for resilient command and control, and communication through a Telegram group. Recent versions of Tonnerre include a mechanism to contact a Telegram group named "سرافراز" for command and control.

U.S. and Venezuela Jam Caribbean GPS Signals to Thwart Attacks, Raising Flight Hazard

www.nytimes.com · 7 months ago

Tensions between the United States and Venezuela have resulted in both militaries jamming GPS signals in the Caribbean. U.S. warships are reportedly targeting drug trafficking operations, while Venezuelan forces are protecting critical infrastructure like military bases and oil refineries. Experts believe this jamming is a defensive measure against drone and precision munitions attacks. The Federal Aviation Administration has issued a warning regarding operations at Maiquetia International Airport in Caracas.

RansomHouse upgrades encryption with multi-layered data processing

www.bleepingcomputer.com · 7 months ago

RansomHouse, a ransomware-as-a-service operation, has upgraded its encryption tool, nicknamed ‘Mario,’ to improve efficiency and evade detection. The new encryptor uses a two-stage encryption process with multiple keys, dynamic chunk sizing, and complex memory management to increase encryption strength and complicate analysis. Researchers have noted the advanced tooling and encryption methods make data recovery more difficult. RansomHouse continues to target virtual machine files and uses the ‘.emario’ extension for encrypted files.

U.S. DOJ Charges 54 in ATM Jackpotting Scheme Using Ploutus Malware

thehackernews.com · 7 months ago

The U.S. Department of Justice has indicted 54 individuals linked to a multi-million dollar ATM jackpotting scheme orchestrated by the Tren de Aragua, a designated foreign terrorist organization. The group used Ploutus malware to hack ATMs across the U.S. and force them to dispense cash, with over 1,500 incidents and approximately 40.73 million dollars lost since 2021. The malware, first detected in 2013, allowed criminals to control ATMs and delete evidence of their actions. Individuals involved face potential sentences of up to 335 years in prison.

Bangladeshi Operator of Fake ID Marketplaces Charged in International Fraud Case

gbhackers.com · 7 months ago

A 29-year-old Bangladeshi man has been indicted for operating online marketplaces that sold fraudulent identification document templates. The man, Zahid Hasan, allegedly used websites called TechTreek and EGiftCardStoreBD to sell templates for passports, Social Security cards, and driver’s licenses, earning over $2.9 million from more than 1,400 customers. Transactions were conducted using virtual currencies like Bitcoin to conceal identities. Authorities have seized the domains associated with the operation and face potential prison sentences and fines if convicted.

25,000+ FortiCloud SSO-Enabled Systems Vulnerable to Remote Exploitation

gbhackers.com · 7 months ago

Over 25,000 internet-facing Fortinet devices globally have FortiCloud Single Sign-On enabled, creating a potential security risk. The Shadowserver Foundation discovered these exposed systems through scanning and is alerting network administrators. The vulnerabilities, CVE-2025-59718 and CVE-2025-59719, allow unauthorized access through authentication bypass. Fortinet customers are advised to verify patch status, disable FortiCloud SSO, and register for security notifications.

Microsoft Teams Outage Causes Global Messaging Delays and Service Interruptions

gbhackers.com · 7 months ago

false

Iranian APT Prince of Persia returns with new malware and C2 infrastructure

www.csoonline.com · 7 months ago

The Iranian threat group, Prince of Persia, also known as Infy, has resurfaced after appearing dormant in 2022, continuing its operations and targeting victims in Iran, Europe, Iraq, Turkey, India, and Canada. Researchers have observed significant updates to the group’s malware, including versions 34 of Foudre and 17 of Tonnerre, which are used for reconnaissance and data exfiltration, respectively. The attackers have implemented a new domain generation algorithm and are now utilizing Telegram for command and control with a user named Ehsan, who is believed to be an Iranian hacker. Security researchers have identified numerous command-and-control servers and are sharing data with law enforcement.

Court restores Elon Musk’s disputed $56 billion Tesla payday

www.washingtonpost.com · 7 months ago

false

Friday Squid Blogging: Petting a Squid

www.schneier.com · 7 months ago

false

Criminal IP and Palo Alto Networks Cortex XSOAR integrate to bring AI-driven exposure intelligence to automated incident response

gbhackers.com · 7 months ago

false

TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering

www.evilsocket.net · 7 months ago

Security researcher Simone Margaritelli discovered several critical vulnerabilities in TP-Link Tapo IP cameras. The vulnerabilities include an integer overflow crash, the ability to remotely configure WiFi settings without authentication, and the exposure of nearby WiFi networks. The researcher utilized AI tools to reverse engineer the camera's firmware, revealing these issues after a protracted and unsuccessful responsible disclosure process with TP-Link. These vulnerabilities impact approximately 25,000 devices and could allow for Man-in-the-Middle attacks and location tracking.

Cisco VPNs, Email Services Hit in Separate Threat Campaigns

www.darkreading.com · 7 months ago

Two separate cybersecurity incidents are impacting Cisco customers. A China-linked advanced persistent threat, identified as UAT-9686, is exploiting a zero-day vulnerability, CVE-2025-20393, in Cisco AsyncOS email security appliances when the Spam Quarantine feature is accessible online. Separately, a large-scale brute force attack targeted Cisco and Palo Alto Networks VPNs, generating millions of login attempts, likely to identify vulnerable systems. Security experts recommend strong passwords and multifactor authentication for VPNs to prevent such attacks.

Microsoft confirms Teams is down and messages are delayed

www.bleepingcomputer.com · 7 months ago

false

Should you worry that most robot vacuums are Chinese now?

www.washingtonpost.com · 7 months ago

Robot vacuum cleaner ownership is increasingly linked to Chinese manufacturers. The company iRobot, known for the Roomba vacuum, recently filed for bankruptcy. A Chinese company is expected to acquire iRobot, following a trend among popular brands like Roborock and Ecovacs. This consolidation places a significant portion of the robot vacuum market under Chinese control.

Palo Alto Networks, Google Cloud Expand Partnership in Multibillion-Dollar Deal

www.techrepublic.com · 7 months ago

false

Thailand Conference Launches International Initiative to Fight Online Scams

www.securityweek.com · 7 months ago

Similar pledges to fight scam networks were made by members of the Association of Southeast Asian Nations in the months leading up to the Bangkok conference.

DOJ charges gang for ATM hacks using Ploutus malware

therecord.media · 7 months ago

The Justice Department has indicted 54 individuals linked to the Tren de Aragua gang for their involvement in ATM thefts utilizing the Ploutus malware. Between 2024 and 2025, the group allegedly targeted ATMs, stealing over 5.4 million dollars and attempting to steal an additional 1.4 million. Members of the gang gained physical access to ATMs to install the malware, which bypasses security systems and dispenses cash. The Ploutus malware, initially detected in 2013, has evolved through numerous variants, targeting various ATM vendors and operating systems.

Transforming InfoSec - How the next generation of security products should not require any IT knowledge

securityautopsy.com · 7 months ago

Cybersecurity faces challenges in hiring junior staff and in ensuring that most systems are secure by default. A key problem is that modern software often requires extensive technical knowledge for users to implement necessary security features. To improve the security of the economy and infrastructure, there is a need for entrepreneurs to build simple, plug and play security features that require minimal user input. Improving the field requires changing the industry narrative and providing clear incentives for building solutions to real world, local problems.

Nigeria arrests dev of Microsoft 365 'Raccoon0365' phishing platform

www.bleepingcomputer.com · 7 months ago

The Nigerian police have arrested three individuals linked to targeted Microsoft 365 cyberattacks via Raccoon0365 phishing-as-a-service.

Trump Media Merger With Nuclear Fusion Firm Raises Ethics Questions

www.nytimes.com · 7 months ago

false

University of Sydney reports data breach affecting over 20,000 staff, affiliates

therecord.media · 7 months ago

The University of Sydney recently experienced a data breach impacting over 20,000 staff, affiliates, and students. Hackers gained access to an internal code library, exposing personal data including names, dates of birth, addresses, and job details from a retired system. The compromised data pertains to approximately 20,500 current and former staff and 5,000 students and alumni. University officials state there is no evidence of misuse or publication of the data at this time, and an investigation is underway.

Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers

thehackernews.com · 7 months ago

A suspected Russia-aligned group has been attributed to a phishing campaign that employs device code authentication workflows to steal victims' Microsoft 365 credentials and conduct account takeover attacks. The activity, ongoing since September 2025, is being tracked by Proofpoint under the moniker UNKAcademicFlare. The attacks involve using compromised email addresses belonging to government

Nigeria arrests suspected RaccoonO365 phishing kit developer on tip from Microsoft, FBI

therecord.media · 7 months ago

Nigerian police arrested a suspect, Okitipi Samuel, accused of developing the RaccoonO365 phishing kit, following collaboration with Microsoft, the FBI, and the U.S. Secret Service. RaccoonO365 allowed cybercriminals to create fake Microsoft login pages to steal user credentials and gain access to corporate email accounts, with subscriptions costing around $365 per month. The kit has been linked to the theft of at least 5,000 Microsoft credentials across 94 countries and has been used in business email compromise attacks. Authorities seized digital equipment during the raids and previously obtained a court order to seize hundreds of websites associated with the operation.

WatchGuard fixes ‘critical’ zero-day allowing firewall takeover

www.csoonline.com · 7 months ago

WatchGuard has issued an urgent patch alert for its Firebox firewall appliances due to a critical zero-day vulnerability, CVE-2025-14733. This flaw allows for remote code execution without authentication, enabling attackers to potentially take control of the appliance. Threat actors are actively exploiting this vulnerability, and administrators should check for signs of compromise, such as unusual outbound traffic or IKE authentication log messages. Patches are available for certain Fireware OS versions, but administrators may need to rotate stored secrets if compromise is confirmed.

Microsoft 365 accounts targeted in wave of OAuth phishing attacks

www.bleepingcomputer.com · 7 months ago

Microsoft 365 accounts are being targeted by a surge of phishing attacks that exploit the OAuth device code authorization process. Attackers deceive users into entering codes on legitimate Microsoft login pages, granting unauthorized access without stealing credentials or bypassing multi-factor authentication. Proofpoint has observed campaigns using tools like SquarePhish and Graphish, as well as activity from threat actors TA2723 and a suspected Russia-aligned group, UNKAcademicFlare. Experts recommend using Microsoft Entra Conditional Access and sign-in origin policies to mitigate these risks.

Denmark summons Russian ambassador over alleged cyberattacks on water utility, elections

therecord.media · 7 months ago

Denmark has accused Russia of conducting cyberattacks against its water utility and political parties, summoning Russia’s ambassador in response. The Danish Defence Intelligence Service identified Russia-linked hacker groups Z-Pentest and NoName057(16) as responsible for the attacks, which included manipulating water pressure and launching distributed denial-of-service attacks. Russia denies the allegations and accuses Denmark of harboring Ukrainian-linked hackers. This incident follows similar accusations against Russia by Germany regarding cyberattacks and disinformation campaigns.

LongNosedGoblin Caught Snooping on Asian Governments

www.darkreading.com · 7 months ago

Researchers have identified a new Chinese-backed advanced persistent threat group called LongNosedGoblin targeting governments in Japan and Southeast Asia since 2023. The group uses custom C/.NET applications and exploits Group Policy for malware deployment and lateral movement, potentially compromising domain administrator credentials. Their tools include NosyHistorian for reconnaissance, NosyDoor for backdoors utilizing Microsoft OneDrive for command and control, and additional malware such as NosyStealer, NosyDownloader, and NosyLogger. LongNosedGoblin shares some characteristics with ToddyCat and Erudite Mogwai, but employs unique tactics like Group Policy abuse.

In Other News: Docker AI Attack, Google Sues Chinese Cybercriminals, Coupang Hacked by Employee

www.securityweek.com · 7 months ago

The Trump administration is developing a national cyber strategy that may involve private companies conducting offensive operations. Concerns exist regarding cybersecurity risks to the US power grid due to reliance on Chinese-made equipment. Google has filed a lawsuit against a Chinese cybercrime group named "Dracula," alleging they stole nearly 900,000 credit card numbers. Docker recently patched a vulnerability in its AI assistant, Ask Gordon, which could have allowed for prompt injection and data exfiltration. Coupang confirmed a former employee was likely responsible for a recent data breach impacting over 33 million customers.

Smart TV manufacturer ordered to stop collecting viewer data while court case proceeds in Texas

therecord.media · 7 months ago

A Texas judge has temporarily blocked smart TV manufacturer Hisense from collecting viewer data from state residents. The restraining order prevents the use of automated content recognition, or ACR, technology to gather and share personal information. The lawsuit, filed by the Texas Attorney General, alleges deceptive trade practices and concerns about data privacy, including potential exposure to foreign governments. The lawsuits state that ACR data sales can be more profitable for TV manufacturers than selling televisions.

New UEFI flaw enables pre-boot attacks on motherboards from Gigabyte, MSI, ASUS, ASRock

www.bleepingcomputer.com · 7 months ago

A UEFI firmware flaw in some motherboards from ASUS, Gigabyte, MSI, and ASRock enables direct memory access attacks that can bypass early boot memory protections. The issue is tracked as CVE-2025-11901, CVE-2025-14302, CVE-2025-14303, and CVE-2025-14304 and arises when firmware reports DMA protections active while failing to initialize the IOMMU during the early boot handoff, allowing a malicious PCIe device with physical access to read or modify RAM before the operating system starts. Researchers noted the flaw can prevent anti-cheat software such as Riot Games Vanguard from launching and more broadly permits pre-boot malware to evade OS-level defenses. Vendors have published firmware bulletins and users are advised to install available firmware updates after backing up important data.

Palo Alto Networks, Google Cloud Strike Multibillion-Dollar AI and Cloud Security Deal

www.securityweek.com · 7 months ago

Palo Alto Networks and Google Cloud announced a multibillion dollar agreement that deepens their strategic partnership and will see Palo Alto migrate key internal workloads to Google Cloud and adopt Vertex AI and Gemini large language models to power its security copilots. The companies are integrating Palo Alto Networks Prisma AIRS platform into Google Cloud developer tools and optimizing VM Series firewalls for deep packet inspection across public and hybrid environments. Prisma Access will leverage Google Cloud global network and Cloud Interconnect to provide global SASE connectivity with lower latency for remote workers, and both firms said they will engineer pre vetted solutions to reduce operational friction when deploying third party security in cloud environments. The deal builds on more than two billion dollars of prior sales through the Google Cloud Marketplace, but both companies declined to disclose a precise dollar amount or contract timeframe.

Cracked Software and YouTube Videos Spread CountLoader and GachiLoader Malware

thehackernews.com · 7 months ago

Cybersecurity researchers have identified new campaigns using cracked software and YouTube videos to distribute malware. One campaign leverages CountLoader, a modular loader, to deliver payloads like ACR Stealer, and employs tactics like creating scheduled tasks disguised as Google to establish persistence, while also evading detection by checking for CrowdStrike's Falcon security tool. Another campaign utilizes GachiLoader, a JavaScript malware loader spread through compromised YouTube accounts, to deploy malware such as Rhadamanthys, and employs techniques like Portable Executable injection and disabling Microsoft Defender. Both loaders demonstrate sophisticated evasion techniques and highlight the need for enhanced security measures.

AI Security Firm Ciphero Emerges From Stealth With $2.5 Million in Funding

www.securityweek.com · 7 months ago

false

Dismantling Defenses: Trump 2.0 Cyber Year in Review

krebsonsecurity.com · 7 months ago

false

Identity Fraud Among Home-Care Workers Puts Patients at Risk

www.darkreading.com · 7 months ago

Healthcare fraud is increasing, with a growing concern being home care workers sending unqualified individuals to work shifts using their identities. This practice is driven by labor shortages and a desire for financial gain, sometimes with devastating consequences for patients. Verification methods combining biometrics and geofencing are recommended, but many providers are not implementing robust security measures. The issue extends beyond healthcare, impacting industries like construction, cleaning, and hospitality, and highlights the challenge of verifying identities in a digital world.

Over 25,000 FortiCloud SSO devices exposed to remote attacks

www.bleepingcomputer.com · 7 months ago

Over 25,000 Fortinet devices are currently exposed online with FortiCloud SSO enabled, leaving them vulnerable to remote attacks. The vulnerability, tracked as CVE-2025-59718 and CVE-2025-59719, allows attackers to gain administrative access through malicious single sign-on logins. Compromised devices expose sensitive data like hashed passwords and network configurations. The Cybersecurity and Infrastructure Security Agency has added the vulnerability to its list of actively exploited flaws and is urging immediate patching.

Senate confirms new Pentagon CIO

therecord.media · 7 months ago

false

Denmark Blames Russia for Cyberattacks Ahead of Elections and on Water Utility

www.securityweek.com · 7 months ago

Researchers have identified several vulnerabilities in multiple versions of SolarWinds Orion, a network management platform. These flaws could allow an unauthenticated attacker to execute arbitrary code on affected systems, potentially leading to complete compromise. The vulnerabilities include insecure direct object reference, cross-site scripting, and SQL injection flaws. Affected versions range from 5.0 to the latest, and include CVE-2023-43034, CVE-2023-43035, CVE-2023-43036, and CVE-2023-43037.

OWASP Drops First AI Agent Risk List

www.techrepublic.com · 7 months ago

The Open Web Application Security Project, or OWASP, has released its first “Top 10 for Agentic Applications,” highlighting unprecedented security risks associated with AI agents. These agents, which access data and tools to perform tasks with minimal human oversight, represent a new attack surface where intent can be hijacked. The list includes risks like agent goal hijack, tool misuse, privilege abuse, and cascading failures, emphasizing the need for a principle of “least agency” and unified visibility across systems. Security teams are urged to prioritize threat modeling and implement mitigation strategies such as strict input validation and least privilege enforcement.

Chinese APT ‘LongNosedGoblin’ Targeting Asian Governments

www.securityweek.com · 7 months ago

A Chinese advanced persistent threat group, known as LongNosedGoblin, has been targeting government organizations in Southeast Asia and Japan since September 2023. The group uses Group Policy for malware deployment and lateral movement, employing tools like NosyHistorian to collect browser history and NosyDoor as a backdoor with Microsoft OneDrive for command and control. Their arsenal includes NosyStealer, NosyDownloader, NosyLogger, and a reverse SOCKS5 proxy, often bypassing antivirus measures. The activity overlaps with ToddyCat, and the group’s tactics resemble those of Erudite Mogwai, focused on cyberespionage.