Blahalla

Windows 10 OOB update released to fix Message Queuing (MSMQ) issues

www.bleepingcomputer.com · 7 months ago

A recent extended security update for Windows 10 inadvertently disrupted Message Queuing, or MSMQ, functionality. This issue, affecting primarily enterprise and managed IT environments, can cause problems such as inactive message queues and errors preventing applications from writing to queues. Microsoft has released an out-of-band update, KB5074976, to resolve the problem, and it is available through the Update Catalog. The issue occurred after updates released December 9, 2025, and impacts clustered MSMQ environments under load.

Massachusetts Battery Start-Up to List on Stock Exchange

www.nytimes.com · 7 months ago

false

Austria’s high court orders Meta to change its personalized ad practices

therecord.media · 7 months ago

Austria’s Supreme Court has declared Meta’s personalized advertising practices illegal, establishing a precedent for the European Union. The ruling requires Meta to provide users with access to their data within two weeks and to share details about data collection, sources, and usage. Meta had argued it was permitted to use personal data without consent, but the court found this violated the General Data Protection Regulation. Privacy advocate Max Schrems, who initiated the legal action, was awarded damages for delays in data access.

SonicWall Edge Access Devices Hit by Zero-Day Attacks

www.darkreading.com · 7 months ago

SonicWall has disclosed a zero-day vulnerability, CVE-2025-40602, impacting its SMA1000 access platform, which is currently being exploited. This medium-severity vulnerability allows for local privilege escalation and often requires the presence of another critical vulnerability, CVE-2025-23006, to be exploited. SonicWall advises users to update to version 12.4.3-03245 or higher, or 12.5.0-02283 or higher, and implement access restrictions to mitigate the risk. Earlier this year, customers have already experienced attacks linked to CVE-2025-23006 and a breach of a cloud backup service.

New China-linked hacker group spies on governments in Southeast Asia, Japan

therecord.media · 7 months ago

A new China-linked hacker group, identified as LongNosedGoblin, has been targeting government institutions in Southeast Asia and Japan since at least September 2023. The group utilizes the Windows Group Policy feature to deploy malware and move through networks, distinguishing them from other similar actors. Their tools include NosyHistorian, NosyDoor, NosyStealer, NosyDownloader, and NosyLogger, with NosyDoor appearing to be a potentially commercialized backdoor used by multiple actors. ESET researchers noted that some versions of NosyDoor include safeguards suggesting carefully selected targets.

University of Sydney suffers data breach exposing student and staff info

www.bleepingcomputer.com · 7 months ago

The University of Sydney recently experienced a data breach involving an online coding repository. Hackers accessed and downloaded personal information impacting over 27,000 individuals, including current and former staff, students, and supporters. Stolen data includes names, dates of birth, addresses, and job details. The university has notified affected individuals, established a support service, and advises vigilance regarding potential scams.

Clop ransomware targets Gladinet CentreStack in data theft attacks

www.bleepingcomputer.com · 7 months ago

The Clop ransomware gang is targeting Gladinet CentreStack file servers in a new extortion campaign. These servers, used by businesses in nearly 50 countries, allow secure file sharing. Threat researchers have identified over 200 potentially vulnerable servers, but the specific vulnerability being exploited is currently unknown. Clop has a history of targeting secure file transfer products and recently exploited a zero-day vulnerability in Oracle EBS, CVE-2025-61882, impacting numerous organizations.

I am not a robot: ClickFix used to deploy StealC and Qilin

news.sophos.com · 7 months ago

Cybercriminals are using a fake human verification process, called ClickFix, to compromise devices and deploy malware. The process begins when a user visits a legitimate website containing malicious code, which then leads to the download of NetSupport Manager, a remote access tool. This tool ultimately installs StealC V2, an infostealer, and subsequently facilitates a Qilin ransomware attack. Attackers exploited stolen credentials, potentially obtained through the infostealer, to gain access to a network via a Fortinet VPN device.

pathfinding.cloud - A library of AWS IAM privilege escalation paths

securitylabs.datadoghq.com · 7 months ago

false

Over $3.4 billion in crypto stolen throughout 2025, with North Korea again the top culprit

therecord.media · 7 months ago

More than three point four billion dollars in cryptocurrency was stolen throughout 2025, with North Korea being the primary source of the losses. North Korean hackers are estimated to have stolen over two billion dollars, a significant increase from the previous year. These attacks often targeted large, centralized platforms, frequently exploiting vulnerabilities and stealing private keys. Experts link these thefts to North Korea’s IT worker program, which places North Korean military personnel in Western tech companies to gain access and place backdoors.

WhatsApp accounts targeted in ‘GhostPairing’ attack

www.csoonline.com · 7 months ago

Cybercriminals have developed a new attack called "GhostPairing" that compromises WhatsApp accounts without needing passwords or account details. The attack tricks users into clicking a malicious link which initiates a device pairing process, allowing the attacker to access messages and message history. Users can check linked devices in their WhatsApp settings and enable two-step PIN verification to mitigate the risk. This vulnerability highlights potential security gaps within WhatsApp and poses a threat to businesses with employees using the platform for communication.

China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

thehackernews.com · 7 months ago

A China-aligned threat group, known as LongNosedGoblin, has been actively conducting cyber espionage campaigns against governmental entities in Southeast Asia and Japan since at least September 2023. The group uses Windows Group Policy to deploy malware across compromised networks and leverages cloud services like Microsoft OneDrive and Google Drive for command and control. Their custom tools include NosyHistorian, NosyDoor, NosyStealer, NosyDownloader, and NosyLogger, which are used for data theft and keystroke logging. Researchers noted similarities to ToddyCat and Erudite Mogwai, suggesting possible connections or shared resources among threat actors.

New password spraying attacks target Cisco, PAN VPN gateways

www.bleepingcomputer.com · 7 months ago

A recent automated campaign is targeting VPN platforms, specifically Palo Alto Networks GlobalProtect and Cisco SSL VPN gateways, using credential-based attacks. Threat monitoring shows a peak of 1.7 million login attempts against GlobalProtect, originating from over 10,000 IP addresses primarily linked to a German hosting provider. Similar activity then targeted Cisco SSL VPN endpoints, significantly increasing the number of unique attack IPs. While Cisco has warned of a zero-day vulnerability, CVE-2025-20393, this activity is not linked to the vulnerability, and involves automated credential probing rather than exploitation.

I built a mitmproxy AI agent using 4000 paid security disclosures

instavm.io · 7 months ago

Researchers have developed a system using large language model coding agents to automate security auditing and identify vulnerabilities. This innovative process involves feeding real-world bug descriptions and data from public reports into the LLMs, allowing them to autonomously discover security flaws. The technique utilizes tools like mitmproxy to analyze network traffic and specifically targets IDOR vulnerabilities, documented with a standardized report format. This system transforms commands into reusable skills, enhancing compatibility and enabling automated security checks, while requiring explicit permission before testing any domain.

Someone Boarded a Plane at Heathrow Without a Ticket or Passport

www.schneier.com · 7 months ago

A man successfully boarded a plane at Heathrow Airport without a ticket or passport. He reportedly gained access by tailgating through security screening and deceiving a British Airways check-in agent by impersonating a family member. This incident allowed him to bypass security checks and avoid detection of prohibited items. The situation highlights vulnerabilities in current airport security procedures.

Chinese attackers exploiting zero-day to target Cisco email security products

therecord.media · 7 months ago

Chinese hackers are actively exploiting a critical vulnerability, CVE-2025-20393, in Cisco email security products. The vulnerability affects appliances with certain ports exposed to the internet and allows attackers to maintain persistent access. Cisco attributes the attacks to a Chinese threat group linked to previous cyber operations and recommends customers restrict internet access and rebuild compromised appliances. The Cybersecurity and Infrastructure Security Agency has ordered federal agencies to apply mitigations for this actively exploited vulnerability.

US seizes E-Note crypto exchange for laundering ransomware payments

www.bleepingcomputer.com · 7 months ago

Law enforcement agencies have seized the servers and domains of the E-Note cryptocurrency exchange. The exchange was allegedly used to launder more than seventy million dollars linked to ransomware attacks and account takeovers. The U.S. Department of Justice, along with international partners, confiscated the platform's domains, mobile applications, and seized customer data. A Russian national, Mykhalio Petrovich Chudnovets, is now facing charges for conspiring to commit money laundering.

The innovative CISO’s bucket list: Human-led transformation at the core

www.csoonline.com · 7 months ago

false

UEFI Vulnerability in Major Motherboards Enables Early-Boot Attacks

www.securityweek.com · 7 months ago

A vulnerability affecting UEFI implementations on motherboards from several major vendors allows for early-boot attacks. The flaw involves a protection mechanism failure related to the Input-Output Memory Management Unit, potentially enabling data access or code injection. Exploitation requires physical access to connect a malicious device and occurs because DMA protections are falsely indicated as enabled. Affected vendors include ASRock, Asus, Gigabyte, and MSI, and the vulnerability has been assigned CVE identifiers CVE-2025-11901, CVE-2025‑14302, CVE-2025-14303, and CVE-2025-14304.

HPE Patches Critical Flaw in IT Infrastructure Management Software

www.securityweek.com · 7 months ago

Tracked as CVE-2025-37164, the critical flaw could allow unauthenticated, remote attackers to execute arbitrary code.

NIS2 compliance: How to get passwords and MFA right

www.bleepingcomputer.com · 7 months ago

NIS2 puts identity and access controls under the spotlight, with weak passwords and poor authentication now a compliance risk. Specops Software explains how to align password policies and MFA with NIS2 requirements.

RansomHouse RaaS Enhances Double Extortion with Data Theft and Encryption

gbhackers.com · 7 months ago

RansomHouse, a ransomware-as-a-service operated by Jolly Scorpius, has upgraded its encryption methods to evade detection and increase extortion effectiveness. The group utilizes a double-extortion strategy, stealing data before encryption, and has impacted sectors like healthcare, finance, and government. Their attack chain involves development, infiltration, exfiltration, and deployment, relying on tools like MrAgent for deployment and Mario for encryption, with Mario now employing a complex two-factor encryption scheme. Organizations should focus on network segmentation, ESXi hardening, and robust offline backups to counter this evolving threat.

HPE OneView Flaw Rated CVSS 10.0 Allows Unauthenticated Remote Code Execution

thehackernews.com · 7 months ago

Hewlett Packard Enterprise (HPE) has resolved a maximum-severity security flaw in OneView Software that, if successfully exploited, could result in remote code execution. The critical vulnerability, assigned the CVE identifier CVE-2025-37164, carries a CVSS score of 10.0. HPE OneView is an IT infrastructure management software that streamlines IT operations and controls all systems via a

New Lazarus and Kimsuky Infrastructure Discovered with Active Tools and Tunneling Nodes

gbhackers.com · 7 months ago

Security researchers have uncovered a network of operational infrastructure controlled by North Korean state-sponsored threat actors Lazarus and Kimsuky. The investigation revealed interconnected clusters of malicious assets, including credential-theft toolkits and Fast Reverse Proxy tunneling nodes deployed across multiple servers. Researchers discovered a staging environment on 154.216.177[.]215 containing reconnaissance tools, Nuclei template libraries, and development artifacts. The consistent operational tradecraft, such as identical FRP tunneling nodes and certificate reuse, suggests automated provisioning and persistent access techniques.

Beware of Malicious Scripts in Weaponized PDF Purchase Orders

gbhackers.com · 7 months ago

A sophisticated phishing campaign is targeting businesses with weaponized PDF purchase order documents. The emails contain a PDF attachment that prompts users to view a purchase order, which redirects them to a fraudulent login page designed to steal credentials for services like Microsoft Outlook and Google Workspace. Attackers are using legitimate cloud infrastructure, specifically ionoscloud.com, to host the phishing site and exfiltrate stolen data directly to a Telegram bot, bypassing traditional command-and-control servers. Security experts recommend verifying attachments, inspecting links, using password managers, and deploying endpoint protection to mitigate this threat.

France arrests Latvian for installing malware on Italian ferry

www.bleepingcomputer.com · 7 months ago

French authorities arrested two crew members of an Italian passenger ferry suspected of infecting the ship with malware that could have enabled them to remotely control the vessel.

Active HubSpot Phishing Campaign

evalian.co.uk · 7 months ago

A sophisticated phishing campaign targeting HubSpot users utilizes a combination of business email compromise and website compromise. Attackers successfully bypassed email security gateways by placing malicious URLs within the sender’s display name and using legitimate email platforms for mass distribution. The attack redirects victims to a convincing spoofed login page hosted on infrastructure linked to Russian bulletproof services. Forensic analysis of the hosting environment revealed an overexposed virtual private server, a setup commonly abused for rapid phishing campaigns.

APT35 Leak Reveals Spreadsheets Containing Domains, Payments, and Server Information

gbhackers.com · 7 months ago

A recent intelligence dump has revealed the inner workings of APT35, an Iranian cyber unit also known as Charming Kitten. The leak includes spreadsheets detailing domain registrations, cryptocurrency payments, and server infrastructure used in cyber operations. These files expose how Tehran procures and funds its cyber activities, including support for the Moses Staff group, which conducts ransomware campaigns against Israeli organizations. The data highlights a bureaucratic system of persistent infrastructure and sanctions evasion, emphasizing that administrative processes, not just technological innovation, are key to maintaining state-sponsored cyber power.

Pa. high court rules that police can access Google searches without a warrant

therecord.media · 7 months ago

In a decision that only affects Pennsylvanians but could have privacy implications elsewhere, the state's Supreme Court ruled that police did not need a warrant to access a rape suspect's Google searches.

CISA Warns of Exploited Flaw in Asus Update Tool

www.securityweek.com · 7 months ago

Tracked as CVE-2025-59374, the issue is a software backdoor implanted in Asus Live Update in a supply chain attack.

Datenbank mit 4,3 Milliarden Datensätzen offen im Netz

www.csoonline.com · 7 months ago

srcset="https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?quality=50&strip=all 13019w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2504511609.jpg?resize=444%2C250&quality=50&strip=all 444w" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px" Eine ungesicherte Datenbank legte Milliarden berufsbezogene Informationen offen. giragraphic, shutterstock.com Cybernews berichtete kürzlich, dass Forscher auf eine ungesicherte MongoDB-Datenbank mit 16 Terabyte Umfang gestoßen sind. Demnach waren dadurch rund 4,3 Milliarden personen- und berufsbezogene Datensätze offengelegt. Welche Informationen befinden sich in den Datensätzen? Das Forscherteam fand insgesamt neun Datenbank-Sammlungen. Mindestens drei dieser Sammlungen enthielten personenbezogene Daten. Dazu zählen: vollständige Namen, E-Mail-Adressen und Telefonnummern, LinkedIn-URLs und Profilnamen, Berufsbezeichnungen, Angaben zu Arbeitgebern und dem beruflichen Werdegang, Ausbildung, Abschlüsse, Zertifizierungen Standortdaten, Sprachen, Fähigkeiten, Funktionen, Social-Media-Konten, sowie Bild-URLs (eindeutige Profile). Laut Cybernews deutetet die Datenbankstruktur darauf hin, dass die Datenbank mittels LinkedIn-Scraping erstellt wurde. Es sei schwierig, das Alter der LinkedIn-Daten zu bestimmen, heißt es im Forschungsbericht. Zeitstempel würden zeigen, dass die Datensätze im Jahr 2025 erfasst oder aktualisiert wurden. Die Forscher vermuten allerdings, dass einige Daten bereits einige Jahre alt sein könnten. Möglicherweise stammen sie aus großen LinkedIn-Leaks. Bereits im Jahr 2021 behaupteten Cyberkriminelle, an Hunderte Millionen LinkedIn-Datensätze gelangt zu sein. Bisher ist unklar, wem die Datenbank gehört. Cybernews zufolge gibt es jedoch Hinweise auf ein Unternehmen im Bereich Lead-Generierung. Wie lange die Datenbank öffentlich zugänglich war, ist ebenfalls nicht bekannt. Der Betreiber hat sie erst zwei Tage, nachdem die Forscher das Leck am 25. November 2025 entdeckten, abgesichert. Warum ist das Datenleck gefährlich? Cybernews weist darauf hin, dass solch große Kontaktdatenbanken Unternehmen zwar viel Zeit sparen können, aber auch ein großes Sicherheitsrisiko bergen: „Wenn sie ungeschützt bleiben, kann ein einziger offengelegter Datensatz die Privatsphäre von Millionen von Nutzern gefährden.“ Ungesicherte Datenbanken mit personen- und unternehmensbezogenen Informationen sind ein attraktives Ziel für Cyberangreifer, um gezielte Phishing-Attacken zu starten. Zudem könnten sie CEOs aus den Datensätzen auswählen und Betrugsangriffe durchführen. Darüber hinaus lassen sich die persönlichen Mitarbeiterdaten für gezielte Social-Engineering -Angriffe nutzen.

Hackers breach internal servers of tech provider for Britain’s health service

therecord.media · 7 months ago

In a disclosure to the London Stock Exchange, the the U.K. healthcare IT provider DXS said it discovered a data breach on December 14.

ThreatsDay Bulletin: WhatsApp Hijacks, MCP Leaks, AI Recon, React2Shell Exploit and 15 More Stories

thehackernews.com · 7 months ago

This week’s ThreatsDay Bulletin tracks how attackers keep reshaping old tools and finding new angles in familiar systems. Small changes in tactics are stacking up fast, and each one hints at where the next big breach could come from. From shifting infrastructures to clever social hooks, the week’s activity shows just how fluid the threat landscape has become. Here’s the full rundown of what

Dormant Iran APT is Still Alive, Spying on Dissidents

www.darkreading.com · 7 months ago

"Prince of Persia" has rewritten the rules of persistence with advanced operational security and cryptographic communication with its command-and-control server.

North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft

thehackernews.com · 7 months ago

Threat actors with ties to the Democratic People's Republic of Korea (DPRK or North Korea) have been instrumental in driving a surge in global cryptocurrency theft in 2025, accounting for at least $2.02 billion out of more than $3.4 billion stolen from January through early December. The figure represents a 51% increase year-over-year and $681 million more than 2024, when the threat actors stole

France arrests 22-year-old over Interior Ministry hack

therecord.media · 7 months ago

The Paris Prosecutor’s Office said a person had been arrested on charges “including an attack on an automated personal data processing system operated by the State, as part of an organized group.”

Human-in-the-loop isn’t enough: New attack turns AI safeguards into exploits

www.csoonline.com · 7 months ago

Human-in-the-loop (HITL) safeguards that AI agents rely on can be subverted, allowing attackers to weaponize them to run malicious code, new research from CheckMarx shows. HITL dialogs are a safety backstop (a final “are you sure?”) that the agents run before executing sensitive actions like running code, modifying files, or touching system resources. Checkmarx researchers described it as an HITL dialog forging technique they’re calling Lies-in-the-Loop (LITL), where malicious instructions are embedded into AI prompts in ways that mislead users reviewing approval dialogs. The research findings reveal that keeping a human in the loop is not enough to neutralize prompt-level abuse. Once users can’t reliably trust what they’re being asked to approve, HITL stops being a guardrail and becomes an attack surface. “The Lies-in-the-Loop (LITL) attack exploits the trust users place in these approval dialogs,” CheckMarx researchers said in a blog post. “By manipulating what the dialog displays, attackers turn the safeguard into a weapon, once the prompt looks safe, users approve it without question.” Dialog forging turns oversight into an attack primitive The problem stems from how AI systems present confirmation dialogs to users. HITL workflows typically summarize the action an AI agent wants to perform, expecting the human reviewer to spot anything suspicious before clicking approve. CheckMarx demonstrated that attackers can manipulate these dialogs by hiding or misrepresenting malicious instructions, like padding payloads with benign-looking text, pushing dangerous commands out of the visible view, or crafting prompts that cause the AI to generate misleading summaries of what will actually execute. In terminal-style interfaces, especially, long or formatted outputs make this kind of deception easy to miss. Since many AI agents operate with elevated privileges, a single misled approval can translate directly into code execution, running OS commands, file system access, or downstream compromise, according to CheckMarx findings. Beyond padding or truncation, the researchers also described other dialog-forging techniques that abuse how confirmation is rendered. By leveraging Markdown rendering and layout behaviors, attackers can visually separate benign text from hidden commands or manipulate summaries so the human-visible description isn’t malicious. “The fact that attackers can theoretically break out of the Markdown syntax used for the HITL dialog, presenting the user with fake UI, can lead to much more sophisticated LITL attacks that can go practically undetected,” the researchers added. Defensive steps for agents and users Checkmarx recommended measures primarily for AI agent developers, urging them to treat HITL dialogs as potentially manipulative rather than inherently trustworthy. Recommended steps include constraining how dialogs are rendered, limiting the use of complex UI formatting, and clearly separating human-visible summaries from the underlying actions that will be executed. The researchers also advised validating approved operations to ensure they match what the user was shown at confirmation time. For AI users, they noted that agents operating in richer UI environments can make deceptive behavior easier to detect than text-only terminals. “For instance, VS Code extensions provide full Markdown rendering capabilities, whereas terminals typically display content using basic ASCII characters,” they said. CheckMarx said the issue was disclosed to Anthropic and Microsoft, both of which acknowledged the report but did not classify it as a security vulnerability. Neither company immediately responded to CSO’s request for comments.

HPE OneView Vulnerability Allows Remote Code Execution Attacks

gbhackers.com · 7 months ago

A critical security vulnerability, CVE-2025-37164, has been identified in HPE OneView software, allowing unauthenticated attackers to execute code remotely. The flaw affects versions prior to 11.00, impacting data centers and hybrid cloud environments. HPE has released version 11.00 as a permanent fix and temporary security hotfixes for versions 5.20 through 10.20. Security researcher brocked200 responsibly reported the vulnerability.

HPE warns of maximum severity RCE flaw in OneView software

www.bleepingcomputer.com · 7 months ago

Hewlett Packard Enterprise (HPE) has patched a maximum-severity vulnerability in its HPE OneView software that enables attackers to execute arbitrary code remotely.

The Case for Dynamic AI-SaaS Security as Copilots Scale

thehackernews.com · 7 months ago

Within the past year, artificial intelligence copilots and agents have quietly permeated the SaaS applications businesses use every day. Tools like Zoom, Slack, Microsoft 365, Salesforce, and ServiceNow now come with built-in AI assistants or agent-like features. Virtually every major SaaS vendor has rushed to embed AI into their offerings. The result is an explosion of AI capabilities across

FBI Shuts Down Crypto Exchange Linked to Criminal Money Laundering Operations

gbhackers.com · 7 months ago

Federal authorities have dismantled E-Note, a cryptocurrency exchange implicated in laundering illicit funds. The exchange was reportedly used by cybercriminals to move more than 70 million dollars in proceeds from ransomware and account takeover attacks since 2017. Mykhalio Petrovich Chudnovets, a Russian national, has been indicted for his role in operating the money laundering network. Servers, applications, and domains associated with the exchange have been seized, along with customer data and transaction records.

Microsoft December Update Breaks Critical IIS Servers

www.techrepublic.com · 7 months ago

The security updates delivered through KB5071546 have fundamentally broken Message Queuing (MSMQ) functionality across multiple Windows versions.

NuGet Malware Mimic: .NET Integration Library Steals Crypto Wallets and OAuth Tokens

gbhackers.com · 7 months ago

Researchers have discovered a malware campaign targeting.NET developers through malicious packages distributed via the NuGet package manager. Fourteen packages mimic legitimate cryptocurrency libraries to steal crypto wallets, redirect funds, and exfiltrate Google Ads OAuth tokens. The malware uses techniques like version bumping, artificial inflation of download counts, and typosquatting to deceive developers. Three groups of packages were identified: one steals wallet data, another redirects funds during transactions, and the third targets Google Ads credentials.

113,000 Impacted by Data Breach at Virginia Mental Health Authority

www.securityweek.com · 7 months ago

Threat actors stole names, Social Security numbers, and financial and health information, and deployed ransomware on RBHA’s systems.

Cisco confirms zero-day exploitation of Secure Email products

www.csoonline.com · 7 months ago

Cisco has warned that a China-linked hacking group is actively exploiting a previously unknown vulnerability in its Secure Email appliances to gain persistent access, forcing affected organizations to consider disruptive rebuilds of critical security infrastructure while patches remain unavailable. Cisco Talos said the campaign has been active since at least late November, raising concerns for security leaders about unseen compromise and how far incident response efforts may need to extend beyond the affected devices. The vulnerability affects Cisco Secure Email Gateway, Cisco Secure Email, and Web Manager appliances running AsyncOS, but only in configurations where the Spam Quarantine feature is enabled and exposed to the internet, according to Cisco. The company said there is currently no patch available, and that rebuilding affected appliances is the only way to fully remove the attackers’ persistence mechanisms in confirmed compromise cases. Enterprise exposure and risk scope Cisco said that systems where the Spam Quarantine feature is not enabled are not affected, but analysts said this does not necessarily reduce enterprise risk. “This vulnerability may remain a high-risk issue because affected appliances typically sit in privileged network positions, even though the feature is not enabled by default,” said Sunil Varkey, a cybersecurity analyst. It is also not clear how many enterprises may have enabled the feature in production environments, said Keith Prabhu, founder and CEO of Confidis. “The Spam Quarantine provides a way for administrators to review and release ‘false positives,’ i.e., legitimate email messages that the appliance has deemed to be spam,” Prabhu said. “In today’s remote support and 24×7 operations, it is entirely possible that this feature has been enabled by many enterprises.” Akshat Tyagi, associate practice leader at HFS Research, said the bigger concern is the nature of the target. Unlike a user laptop or a standalone server, email security systems sit at the center of how organizations filter and trust email traffic, meaning attackers would be operating inside infrastructure designed to stop threats rather than receive them. “The fact that there’s no patch yet elevates the risk further,” Tyagi said. “When the vendor’s guidance is to rebuild appliances rather than clean them in place, it tells you this is about persistence and control, not just a one-off exploit.” Varkey added that exploitation may not require direct internet exposure and could also occur from internal or VPN-reachable networks, advising organizations to close or restrict access to affected management ports temporarily. Rebuild guidance and operational tradeoffs Cisco has said that wiping and rebuilding appliances is currently required in cases where compromise has been confirmed. “From a security standpoint, it is indeed the right call,” Tyagi said. “When there’s a risk that attackers have embedded themselves deep in a system, patching alone won’t solve the issue. Rebuilding is the only way to be confident the threat is fully removed.” But Varkey said that this may not be a viable option for many organizations, as it introduces business risks, including downtime, misconfiguration, and the potential reintroduction of persistence through contaminated backups. Enterprises will need to balance remediation speed with business continuity while relying on compensating controls to limit exposure. “Cisco Secure Email Gateway, Cisco Secure Email, and Web Manager are critical components of the email infrastructure,” Prabhu said. “Organizations would need to plan this activity in a way that minimizes downtime, but at the same time reduces the time window of compromise. In the interim, they could use other security measures like blocking ports on the firewall to limit exposure.”

IoT Security Firm Exein Raises €100 Million

www.securityweek.com · 7 months ago

The Italian company has raised nearly $200 million in 2025 for its widely used embedded cybersecurity platform.

Local Privilege Escalation (CVE-2025-34352) in JumpCloud Agent

xmcyber.com · 7 months ago

A critical local privilege escalation vulnerability, CVE-2025-34352, has been discovered in the JumpCloud Agent. This flaw allows an attacker with low-level access to escalate their privileges to local administrator rights. Users are strongly advised to update the JumpCloud Agent immediately to prevent unauthorized access to their systems.

France Probes ‘Foreign Interference’ After Remote Control Malware Found on Passenger Ferry

www.securityweek.com · 7 months ago

France’s counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry

Microsoft: Recent Windows updates break RemoteApp connections

www.bleepingcomputer.com · 7 months ago

Microsoft has confirmed that recent Windows updates trigger RemoteApp connection failures on Windows 11 24H2/25H2 and Windows Server 2025 devices in Azure Virtual Desktop environments.

Sleep Cots and Graham Crackers at Elon Musk’s Child Care Program

www.nytimes.com · 7 months ago

Mr. Musk has ambitions to remake education, but his latest effort to open an elementary school in Texas appears to have faltered.