Blahalla

CISA Alerts on Apple WebKit Zero-Day Actively Used in Cyberattacks

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical zero-day vulnerability affecting Apple’s WebKit rendering engine to its Known Exploited Vulnerabilities catalog. This use-after-free vulnerability, cataloged as CVE-2025-43529, allows attackers to execute arbitrary code and access files when a user visits a malicious webpage. The vulnerability impacts Apple’s Safari browser and any third-party applications using WebKit. Organizations have until January 5, 2026, to remediate the vulnerability, and security teams should prioritize patching and monitoring for exploitation attempts.

Amazon: Russian Hackers Now Favor Misconfigurations in Critical Infrastructure Attacks

www.securityweek.com · 7 months ago

Russian state-sponsored threat actors, likely linked to the GRU military intelligence agency, are increasingly targeting misconfigured network devices to gain access to critical infrastructure organizations. Amazon’s threat intelligence team observed this shift in tactics, with attackers favoring misconfigurations over exploiting vulnerabilities, beginning in 2025. Previously, vulnerabilities such as CVE-2022-26318, CVE-2021-26084, CVE-2023-22518, and CVE-2023-27532 were exploited. The attackers target routers, VPNs, and collaboration platforms, leveraging packet capture to steal credentials for replay attacks and lateral movement.

Russian Hackers Launch Attacks on Network Edge Devices in Western Critical Infrastructure

gbhackers.com · 7 months ago

Russian state-sponsored hackers, linked to the GRU and Sandworm groups, are increasingly targeting misconfigured network edge devices in Western critical infrastructure. Instead of exploiting zero-day vulnerabilities, attackers are quietly abusing exposed devices to gain persistent access and harvest credentials. Targeted resources include routers, VPN gateways, and cloud-based collaboration platforms, impacting energy sector organizations and telecommunications providers across North America and Europe. Observed CVEs include CVE-2022-26318, CVE-2021-26084, CVE-2023-22518, and CVE-2023-27532.

Microsoft to block Exchange Online access for outdated mobile devices

www.bleepingcomputer.com · 7 months ago

Microsoft will block outdated mobile devices from accessing Exchange Online services beginning March 1, 2026. This change affects devices using older versions of the Exchange ActiveSync protocol, specifically those running versions below 16.1. Devices utilizing Outlook Mobile and iPhones running iOS 10 or later will not be affected. IT administrators can use a PowerShell command to identify devices using older versions within their organizations.

SoundCloud Confirms Data Breach After Hackers Steal User Account Information

gbhackers.com · 7 months ago

SoundCloud has confirmed a data breach impacting approximately 20 percent of its user base. Unauthorized actors accessed a dashboard, leading to the exposure of email addresses and publicly visible profile information. No sensitive data like passwords or payment details were compromised, and the company has implemented security enhancements, including strengthened monitoring and access controls. SoundCloud advises users to practice online safety measures like changing passwords and enabling two-factor authentication.

Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

thehackernews.com · 7 months ago

Amazon has revealed a years-long campaign by the Russian state-sponsored group APT44, also known as FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear, targeting critical infrastructure in Western nations. The attackers primarily exploited misconfigured network devices and leveraged vulnerabilities such as CVE-2022-26318, CVE-2021-26084, CVE-2023-22518, and CVE-2023-27532. The campaign involved credential harvesting, replay attacks, and establishing persistent access to compromised networks, and shares infrastructure with another Russian-linked cluster, Curly COMrades. Amazon has notified affected customers and disrupted ongoing operations.

Internet-Ausfall im Bundestag wohl kein Cyberangriff

www.csoonline.com · 7 months ago

The German Bundestag experienced a widespread internet and network outage Monday afternoon, impacting internet, intranet, email, and file access. The disruption was caused by an overload situation between the Bundestag's data centers and is not attributed to a cyberattack. The Federal Office for Information Security is involved in the investigation and confirms no indications of a cyberattack. In 2015, the Bundestag was the target of a successful cyberattack that resulted in computers being infected with spyware.

LLM-Driven Automation: A New Catalyst for Ransomware and RaaS Ecosystems

gbhackers.com · 7 months ago

Large Language Models are accelerating the ransomware and Ransomware-as-a-Service ecosystem by lowering barriers to entry and optimizing workflows. Threat actors are utilizing LLMs to automate tasks like data triage, communication, and code generation, blurring the lines between cybercriminals and state-aligned actors. Emerging trends include the use of self-hosted AI models to bypass safety guardrails and the development of AI-driven negotiation tools. Researchers have observed malware like QUIETVAULT leveraging locally installed AI for reconnaissance, searching for cryptocurrency wallets and sensitive data.

Chinese Surveillance and AI

www.schneier.com · 7 months ago

A new report details how China is expanding its use of artificial intelligence to reshape human rights. The report highlights four key areas of AI expansion: image censorship, criminal justice integration, online information control, and the use of AI platforms by Chinese companies internationally. The surveillance technology is also being exported, potentially spreading repression beyond China's borders. The report focuses on developments between 2023 and 2025 to reveal how AI is strengthening the Chinese Communist Party’s political control.

‘Featured’ Urban VPN caught stealing private AI chats

www.csoonline.com · 7 months ago

Security researchers have discovered that Urban VPN Proxy, a popular free browser extension, has been secretly collecting and exporting users' full AI chat conversations. The extension injects scripts that capture prompts and responses across various AI platforms, including ChatGPT and Gemini, even when VPN features are disabled. This data collection is reportedly linked to BiScience, a data broker company, and has affected over eight million users. Google has been contacted for comment, and the extension remains available in browser stores.

European authorities dismantle call center fraud ring in Ukraine

www.bleepingcomputer.com · 7 months ago

European law enforcement agencies have dismantled a fraud network operating call centers in Ukraine that defrauded victims across Europe of over 10 million euros. Twelve suspects were arrested and authorities seized vehicles, weapons, computers, and counterfeit documents during searches in Dnipro, Ivano-Frankivsk, and Kyiv. The network employed approximately 100 people and used tactics like impersonating bank employees and police officers to trick victims into transferring funds or providing account credentials. The investigation is part of a recent series of actions targeting fraud rings across Europe.

OpenShift GitOps Vulnerability Allows Attackers to Escalate Privileges to Root

gbhackers.com · 7 months ago

Red Hat has disclosed a security vulnerability, CVE-2025-13888, in OpenShift GitOps that allows namespace administrators to escalate privileges to root access. The flaw involves the mishandling of permissions for ArgoCD Custom Resources, enabling malicious administrators to gain control of the entire cluster. Exploitation requires existing namespace administrator credentials, limiting the threat to insider threats or compromised accounts. Security updates are available for OpenShift GitOps versions 1.16, 1.17, and 1.18, and immediate patching is advised.

JumpCloud Remote Assist Vulnerability Can Expose Systems to Takeover

www.securityweek.com · 7 months ago

A vulnerability has been discovered in JumpCloud Remote Assist for Windows, allowing attackers to potentially gain control of systems. The flaw, identified as CVE-2025-34352, arises because the uninstaller performs privileged operations on user-controlled directories without proper validation. Attackers can exploit this by redirecting privileged operations to protected system files, potentially causing system crashes or enabling privilege escalation. JumpCloud has released version 0.317.0 to address the issue, and organizations are urged to update promptly.

Why Data Security and Privacy Need to Start in Code

thehackernews.com · 7 months ago

false

Internet-Based Solar Panel Systems Vulnerable to Rapid Cyberattacks

gbhackers.com · 7 months ago

The increasing use of internet-connected solar panel systems is creating new cyber vulnerabilities. Security researchers have found that many systems rely on decades-old industrial protocols like Modbus, which lack security measures, allowing attackers to remotely shut down power generation. Threat actors can now use readily available tools and even AI-powered frameworks to rapidly exploit these weaknesses, potentially causing damage, grid instability, and financial losses. Experts recommend network segmentation, limiting internet exposure, and continuous traffic monitoring to protect these systems.

Critical FortiGate SSO Vulnerability Actively Exploited in Real-World Attacks

gbhackers.com · 7 months ago

Critical vulnerabilities, CVE-2025-59718 and CVE-2025-59719, are actively being exploited in Fortinet FortiGate appliances. These flaws allow unauthenticated attackers to bypass Single Sign-On authentication protections through malicious SAML messages. Affected products include FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, and organizations are urged to upgrade to patched versions immediately. As a mitigation step, administrators should disable FortiCloud SSO until patching is complete and reset administrator credentials if exploitation is suspected.

Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass

thehackernews.com · 7 months ago

Threat actors are actively exploiting security flaws in Fortinet FortiGate devices. The vulnerabilities, identified as CVE-2025-59718 and CVE-2025-59719, allow unauthenticated users to bypass single sign-on authentication through crafted SAML messages. Attackers are using this bypass to export device configurations and have been linked to specific hosting providers. Organizations are urged to immediately apply available patches and disable FortiCloud SSO.

Microsoft Outlines Mitigation for React2Shell RCE Vulnerability in React Server Components

gbhackers.com · 7 months ago

A critical remote code execution vulnerability, CVE-2025-55182, also known as React2Shell, affects React Server Components and the Next.js framework. Attackers can execute arbitrary code on vulnerable servers with a single malicious HTTP request, and exploitation began December 5, 2025. Compromised systems have seen cryptocurrency miners, VShell, EtherRAT, SNOWLIGHT, ShadowPAD, and XMRig deployed, along with attempts to steal credentials from cloud platforms like Azure, AWS, and Google Cloud. Affected versions include React 19.0.0 through 19.2.0 and Next.js 14.3.0-canary.77 through 16.0.6, requiring immediate patching.

Google to Kill Popular Dark Web Report Tool

www.techrepublic.com · 7 months ago

false

User Data Compromised in SoundCloud Hack

www.securityweek.com · 7 months ago

SoundCloud recently experienced a cyberattack resulting in unauthorized access to user data. The compromised information includes email addresses and data visible on public profiles, but not passwords or financial details, impacting roughly 20 percent of users. The company has taken measures to secure its systems, which caused temporary disruptions and VPN access issues. Following the attack, distributed denial-of-service attacks were launched against the platform.

GhostPairing Attack Exposes WhatsApp Accounts to Full Takeover via Phone Numbers

gbhackers.com · 7 months ago

A new WhatsApp account takeover campaign called “GhostPairing Attack” has emerged, allowing attackers to gain full access to accounts without passwords or SIM swaps. The attack begins with a deceptive message containing a link that mimics a Facebook login page, tricking users into entering their phone number. Attackers then intercept WhatsApp’s authentication code and proxy it back to the victim, leading them to unknowingly approve the attacker’s browser as a linked device. This allows attackers to read messages, access media, and forward malicious content to the victim’s contacts, with no immediate warning to the user.

We asked five AIs to give The Rock hair, draw fingers and delete an ex. Only one was a clear winner.

www.washingtonpost.com · 7 months ago

false

She was MAGA’s favorite conspiracist. Then she dug into Charlie Kirk’s killing.

www.washingtonpost.com · 7 months ago

false

In-the-Wild Exploitation of Fresh Fortinet Flaws Begins

www.securityweek.com · 7 months ago

Threat actors are actively exploiting vulnerabilities in Fortinet products, specifically CVE-2025-59718 and CVE-2025-59719, which allow authentication bypass. These flaws impact FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Exploitation began just days after patches were released on December 9, with attackers targeting admin accounts and exporting device configurations to obtain hashed credentials. Fortinet advises disabling the FortiCloud SSO login feature and applying the available patches for FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb.

Coupang CEO Quits After Breach Hits 33.7M South Koreans

www.techrepublic.com · 7 months ago

The CEO of Coupang has resigned following a massive data breach affecting 33.7 million South Koreans, nearly two-thirds of the country’s population. Hackers exploited stolen encryption keys and authentication vulnerabilities over a five-month period, accessing names, phone numbers, email addresses, and delivery information. South Korean authorities are investigating, and Coupang faces potential fines up to 681 million dollars under the nation’s Personal Information Protection Act. The breach highlights concerns about cybersecurity investment and corporate negligence within South Korea’s tech sector.

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

thehackernews.com · 7 months ago

Cyberattacks are actively exploiting a security vulnerability, CVE-2025-55182, to deploy malware such as KSwapDoor and ZnDoor. Threat actors are using the flaw to run arbitrary commands, establish reverse shells, and harvest credentials from cloud infrastructures like Azure, AWS, and GCP. Attackers are also targeting environments with Next.js, exploiting vulnerabilities like CVE-2025-29927 and CVE-2025-66478 to extract sensitive data and create persistence. Operation PCPcat, a large-scale intelligence and data exfiltration campaign, has reportedly breached tens of thousands of servers, with over 111,000 IP addresses currently vulnerable.

Autonomous AppSec via Chrome DevTools (MCP): 600 min → 3.5 min on OWASP Juice Shop

aliasrobotics.com · 7 months ago

Security professionals are facing difficulties keeping pace with rapid web application development and evolving attack vectors. CAI is an advanced AI security framework designed to address these challenges, integrating with web browsers through MCP to perform automated security assessments. CAI autonomously analyzes application behavior, identifies vulnerabilities, and executes exploits, significantly accelerating the discovery of security flaws. This framework was demonstrated analyzing the OWASP Juice Shop application, proving its efficiency and reproducibility.

Fake ‘Leonardo DiCaprio’ Torrent Spreads Agent Tesla Malware

www.techrepublic.com · 7 months ago

Cybercriminals are using a fake torrent of the Leonardo DiCaprio movie "One Battle After Another" to spread Agent Tesla malware. The malicious torrent disguises a staged infection chain, which uses familiar Windows tools like PowerShell to install the trojan, enabling attackers to steal credentials and gain remote access. This campaign demonstrates a shift towards using high-demand lures and trusted system tools to evade detection and exploit user trust, rather than software vulnerabilities. Organizations are advised to block pirated content, monitor PowerShell activity, and educate users about suspicious downloads.

How to create a ransomware playbook that works

www.csoonline.com · 7 months ago

Ransomware attacks are increasingly sophisticated, utilizing artificial intelligence and ransomware-as-a-service models, requiring organizations to develop comprehensive playbooks. These playbooks should include cybersecurity tabletop exercises to simulate attacks, regular security training for all employees, and layered technology solutions like firewalls and multi-factor authentication. A key element is ensuring data backups are verified and readily available for rapid recovery, alongside clear communication strategies for stakeholders. Organizations should prioritize preparedness over reactive measures, investing in people and training alongside technology to build a resilient defense.

SantaStealer Malware Steals Sensitive Files, Credentials, and Crypto Wallet Data

gbhackers.com · 7 months ago

Cybersecurity researchers have identified SantaStealer, a new malware-as-a-service information stealer previously known as BluelineStealer. The malware is designed to steal sensitive files, credentials, and cryptocurrency wallet data, transmitting the information over unencrypted HTTP connections. SantaStealer utilizes techniques to bypass security measures and includes anti-analysis features, although preliminary development builds have leaked, revealing significant operational security flaws. It is priced at $175 to $300 per month and is actively promoted on Telegram and hacker forums.

JumpCloud Remote Assist Windows Agent Vulnerability Allows Privilege Escalation

gbhackers.com · 7 months ago

A critical vulnerability, tracked as CVE-2025-34352, exists in the JumpCloud Remote Assist for Windows agent, allowing local privilege escalation. Versions prior to 0.317.0 are affected, and exploitation allows low-privileged users to gain SYSTEM privileges or crash the machine. The vulnerability stems from a design flaw where a privileged process performs file operations in a user-writable directory, enabling attackers to manipulate files and gain control of the system. JumpCloud has released a fix, and users should immediately update to version 0.317.0 or later.

Google to Shut Down Dark Web Monitoring Tool in February 2026

thehackernews.com · 7 months ago

false

Can OpenAI Respond After Google Closes the A.I. Technology Gap?

www.nytimes.com · 7 months ago

false

Elon Musk Tests Europe’s Willingness to Enforce Its Online Laws

www.nytimes.com · 7 months ago

false

Jaguar Land Rover Confirms August Cyberattack Led to Employee Data Theft

gbhackers.com · 7 months ago

Jaguar Land Rover has confirmed a cyberattack in August led to the theft of employee data. The incident severely disrupted production across the United Kingdom, resulting in losses exceeding $890 million. Stolen data includes names, addresses, salaries, and National Insurance numbers, impacting current and former employees. The company has notified regulators and is providing identity monitoring services.

Chrome Extension with 6M+ Users Found Collecting AI Chatbot Inputs

gbhackers.com · 7 months ago

A popular Chrome extension, Urban VPN Proxy, with over six million users has been found secretly collecting AI chatbot conversations including those using ChatGPT, Claude, Gemini, and Microsoft Copilot. The extension, and seven related ones affecting an estimated eight million users, began collecting data in version 5.5.0, released in July 2025, even when the VPN function is disabled. This data, including full conversations and metadata, is transmitted to servers controlled by Urban Cyber Security Inc., a company affiliated with a known data broker. Users are advised to remove the extension to stop data collection.

Last Week in Security (LWiS) - 2025-12-15

blog.badsectorlabs.com · 7 months ago

Criminals are using altered AI-generated media for virtual kidnapping and ransomware scams, highlighting the need for safe words. Researchers detailed an Android "zero click" exploit targeting Samsung phones, while others revealed stack modification techniques in malware called Moonwalk++. Several vulnerabilities were discovered in Mediatek WiFi chipsets, including nineteen with proof-of-concept exploits. Microsoft's System Center Operations Manager is now a target for privilege escalation and credential harvesting, and researchers found several authentication bypasses in SAML implementations. Multiple CVEs were mentioned, including CVE-2025-66039, CVE-2025-53772, and CVE-2024-50629.

Autonomous code analyzer beats all human teams at OSS zero-day competition

theori.io · 7 months ago

false

SoundCloud confirms breach after member data stolen, VPN access disrupted

www.bleepingcomputer.com · 7 months ago

SoundCloud has confirmed a security breach impacting users after outages and VPN connection issues were reported. Threat actors stole a database containing user information, but SoundCloud states no sensitive data like passwords or financial information was accessed. The stolen data included email addresses and information from public profiles, potentially affecting around 28 million accounts, or 20% of SoundCloud's user base. The incident is attributed to the ShinyHunters extortion gang, and the company is working to restore VPN access and enhance security measures.

Google is shutting down its dark web report feature in January

www.bleepingcomputer.com · 7 months ago

false

Askul confirms theft of 740k customer records in ransomware attack

www.bleepingcomputer.com · 7 months ago

Japanese e-commerce company Askul Corporation confirmed that approximately 740,000 customer records were stolen in a ransomware attack by the RansomHouse group. The breach involved business and individual customer service data, along with information about business partners, executives, and employees. Attackers gained access through compromised administrator credentials lacking multi-factor authentication and used multiple ransomware variants, evading existing security measures. Order shipping remains impacted, and the company is working to fully restore systems and has applied multi-factor authentication to key systems.

Ford Will Take $19.5 Billion Hit as It Rolls Back E.V. Plans

www.nytimes.com · 7 months ago

false

New SantaStealer malware steals data from browsers, crypto wallets

www.bleepingcomputer.com · 7 months ago

A new malware-as-a-service, SantaStealer, is being promoted on Telegram and hacker forums. Security researchers state this is a rebranded version of BluelineStealer and is operated by a Russian-speaking developer with subscription tiers starting at $175 per month. The malware steals data from browsers, cryptocurrency wallets, and other applications, utilizing 14 data-collection modules. It also bypasses Chrome’s App-Bound Encryption, initially introduced in July 2024.

How Cyber Insurance MGAs Shape Policies for Evolving Cyber-Risks

www.darkreading.com · 7 months ago

false

Texas sues 5 smart TV manufacturers over data collection practices

therecord.media · 7 months ago

Texas has filed lawsuits against Sony, Samsung, LG, Hisense, and TCL for allegedly deceiving consumers through the use of automated content recognition, or ACR, technology. This technology captures viewing habits and can be used for targeted advertising or selling data. State officials claim the companies fail to adequately inform consumers about this data collection, potentially exposing sensitive personal information, including race, sex, and political beliefs. The Attorney General expressed concern about the companies' ties to China and potential data harvesting.

PornHub extorted after hackers steal Premium member activity data

www.bleepingcomputer.com · 7 months ago

PornHub is facing an extortion attempt by the ShinyHunters group, who claim to have stolen data related to Premium member activity. The stolen data, reportedly 94 gigabytes in size, includes records of search, watch, and download history, containing email addresses, locations, video URLs, and keywords. Mixpanel, the analytics vendor impacted by a November 2025 smishing attack, initially confirmed the breach but now disputes the data originated from their incident. The ShinyHunters group, linked to vulnerabilities like CVE-2025-61884 and Salesforce/Drift attacks, is also developing a new ransomware-as-a-service called ShinySpid3r.

PornHub extorted after hackers steal Premium member activity data

www.bleepingcomputer.com · 7 months ago

PornHub is facing extortion from the ShinyHunters group following a data breach at analytics vendor Mixpanel. The breach, which occurred November 2025, involved an SMS phishing attack against Mixpanel. ShinyHunters claims to have stolen 94 gigabytes of data containing over 200 million records of PornHub Premium members' search and watch history. While passwords and payment details were not compromised, the exposed data includes email addresses, activity types, locations, video URLs, and keywords; ShinyHunters is linked to the exploitation of CVE-2025-61884 and is developing a ransomware-as-a-service called ShinySpid3r.

Apple Patches More Zero-Days Used in 'Sophisticated' Attack

www.darkreading.com · 7 months ago

Apple recently released security updates to address two zero-day vulnerabilities found in WebKit, its web browser engine. CVE-2025-43529 is a use-after-free issue, while CVE-2025-14174 is a memory corruption vulnerability. Both flaws were reportedly exploited in a sophisticated attack targeting specific individuals prior to iOS 26. The vulnerabilities are linked to a Chrome zero-day vulnerability patched by Google, which also involves a memory access issue. Neither Apple nor Google have provided further details regarding the exploitation.

Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses

www.acronis.com · 7 months ago

Researchers have observed increased activity from the Makop ransomware group, a variant of Phobos, targeting businesses, particularly in India. Attackers are exploiting exposed Remote Desktop Protocol systems and using readily available tools to move laterally and encrypt systems. They’re customizing their tools, such as uninstallers, based on the victim's region. The group utilizes outdated exploits and credential dumping tools like Mimikatz to bypass security measures.

How Tech’s Biggest Companies Are Offloading the Risks of the A.I. Boom

www.nytimes.com · 7 months ago

false