Blahalla

Betterleaks, a new open-source secrets scanner to replace Gitleaks

www.bleepingcomputer.com · 7 months ago

A new open-source tool, Betterleaks, is available to scan for sensitive information like credentials and API keys in code repositories. This tool is designed to be an improved successor to Gitleaks, offering features like rule-defined validation using CEL and faster scanning through parallelized Git analysis. Betterleaks was developed by the original author of Gitleaks and aims to combine user-friendly features with support for automated tools, including those used for analyzing AI-generated code. The project uses an open-source license and is maintained by a team including contributors from Royal Bank of Canada, Red Hat, and Amazon.

GlassWorm V2 analysis: Part 2. Infrastructure rotation and GitHub injection

codeberg.org · 7 months ago

Git functionality includes a sparse checkout feature, allowing developers to selectively retrieve parts of a repository. Bundles enable the transfer of Git objects and are related to Git pack-objects. Signing commits uses a GnuPG binary and can be configured to allow pushes from branches. This process involves creating and managing bundle creation tokens for remote repositories.

We audited authorization in 30 AI agent frameworks — 93% rely on unscoped API keys

grantex.dev · 7 months ago

A recent audit of 30 popular AI agent projects revealed widespread security flaws related to authorization. Nearly all projects rely on unscoped API keys, lack per-agent identities, and provide no user consent or granular revocation mechanisms. This allows compromised agents broad access and makes it difficult to trace actions. Several real-world incidents, including exposed OpenClaw instances and Google Cloud API key misconfigurations, highlight the risks, which aligns with emerging OWASP Agentic Top 10 vulnerabilities. The report recommends implementing scoped tokens, per-agent identities, user consent, granular revocation, audit trails, and delegation control to address these critical security gaps.

Post AI Agent Hacked Amazon & McKinsey, I compiled a list of 5 situations where deploying agents can be catastrophic

nanonets.com · 7 months ago

AI agents offer great potential but pose significant risks when deployed without proper safeguards. A recent data breach at McKinsey resulted from an AI agent gaining access to sensitive data through a SQL injection. Businesses are rapidly adopting these agents, creating potential for damage like altered financial models and corrupted advice, driven by errors scaling rapidly due to inadequate human oversight and incomplete context. Careful assessment and infrastructure development are needed before widespread implementation to prevent data breaches and regulatory penalties.

Loblaw Data Breach Impacts Customer Information

www.securityweek.com · 7 months ago

Canadian retailer Loblaw has announced a data breach impacting customer information. The compromised data includes names, email addresses, and phone numbers, but passwords, health information, and credit card data were not affected. Loblaw states PC Financial was not impacted and the number of affected customers is currently unknown. No ransomware group has claimed responsibility for the breach.

CVE-2024-45163: Remote DoS in Mirai C2 – research writeup + what it led me to build

flowtriq.com · 7 months ago

NULL

Quick question for people running CrowdStrike, Zscaler, Netskope or similar in production.

www.crowdstrike.com · 7 months ago

false

Analysis of 1,808 MCP servers: 66% had security findings, 427 critical (tool poisoning, toxic data flows, code execution)

agentseal.org · 7 months ago

A large-scale scan of 1,808 Model Context Protocol servers found that 66 percent had at least one security finding, totaling 8,282 tool-level issues including 427 critical and 1,841 high severity findings. The most common risks were code execution capabilities and toxic cross-server data flows, with real-world examples including a malicious npm package used for email exfiltration, a JFrog-disclosed command injection tracked as CVE-2025-6514 that allowed remote code execution, and two Cursor bugs tracked as CVE-2025-54136 and CVE-2025-54135 that enabled silent remote shells and configuration poisoning. Observed attack patterns include invisible prompt injections embedded in tool descriptions, rug pulls where servers change behavior after approval, and a reported zero-click remote code execution from calendar events with a CVSS score of 10.0.

Microsoft releases Windows 11 OOB hotpatch to fix RRAS RCE flaw

www.bleepingcomputer.com · 7 months ago

There is an out of band hotpatch KB5084597 that Microsoft released to fix remote code execution vulnerabilities in the Windows Routing and Remote Access Service affecting Windows 11 Enterprise devices that receive hotpatch updates instead of regular Patch Tuesday cumulative updates. The update applies to Windows 11 versions 25H2 and 24H2 and to Windows 11 Enterprise LTSC 2024 and addresses CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 which were also fixed in the March 10, 2026 Patch Tuesday updates. The hotpatch is cumulative, performs in memory patching to avoid reboot on mission critical systems, updates files on disk for the next restart, is offered only to devices enrolled in the hotpatch program and managed through Windows Autopatch, and was re released to ensure comprehensive coverage across affected scenarios.

OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration

thehackernews.com · 7 months ago

China's National Computer Network Emergency Response Technical Team warned that OpenClaw, an open source self hosted autonomous AI agent formerly called Clawdbot and Moltbot, has inherently weak default security and elevated system privileges that could allow attackers to seize control of endpoints. Adversaries can perform prompt injection attacks, including indirect or cross domain prompt injection, to make the agent disclose sensitive data or run manipulated instructions, and researchers showed that link preview features in messaging apps can be abused to exfiltrate data automatically. CNCERT also highlighted risks that the agent may irreversibly delete data, that malicious skills uploaded to repositories can execute arbitrary commands or deploy malware, and that recently disclosed vulnerabilities could be exploited, and it recommended isolating the service, blocking exposure of management ports, avoiding plaintext credentials, restricting skill sources, disabling automatic skill updates, and keeping the agent updated.

Upcoming Speaking Engagements

www.schneier.com · 7 months ago

false

AppsFlyer Web SDK hijacked to spread crypto-stealing JavaScript code

www.bleepingcomputer.com · 7 months ago

The AppsFlyer Web SDK was temporarily hijacked and delivered obfuscated malicious JavaScript that targeted cryptocurrency transfers. The payload monitored pages for wallet input, replaced detected Bitcoin, Ethereum, Solana, Ripple, and TRON addresses with attacker controlled addresses, and exfiltrated the original addresses and metadata. The exposure window is estimated between March 9, 2026 at 22:45 UTC and March 11, 2026, and AppsFlyer reported a domain registrar incident on March 10, 2026 that allowed unauthorized code to reach a segment of customer websites before the issue was contained. Organizations using the web SDK, which AppsFlyer says is deployed by about 15,000 businesses across more than 100,000 applications, are advised to review telemetry for requests from websdk.appsflyer.com, downgrade to known good SDK versions, and investigate possible compromise.

GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

thehackernews.com · 7 months ago

There is a new iteration of the GlassWorm supply chain campaign that represents a significant escalation in how it propagates through the Open VSX registry. There are at least 72 malicious Open VSX extensions discovered since January 31, 2026 that target developers by mimicking linters, formatters, code runners and AI coding assistant tools and by abusing extensionPack and extensionDependencies to turn benign appearing extensions into transitive delivery vehicles that install GlassWorm linked packages after trust has been established. The campaign hides loaders using invisible Unicode characters, uses Solana transactions as a dead drop resolver for command and control, rotates Solana wallets and increases obfuscation to evade detection, and related injections affected over 151 GitHub repositories and multiple npm packages in early March 2026. Separately, a mass npm campaign uploaded 88 malicious packages between November 2025 and February 2026 that abused remote URL dependencies to change payloads on the fly and harvest environment variables, CI CD tokens and system metadata before some payloads were later replaced with innocuous code on March 12, 2026.

scans2any: Convert and merge infrastructure scan results (Nmap, Nessus, Masscan) into Markdown, HTML, CSV and more

www.softscheck.com · 7 months ago

A major new release of scans2any, version 1.0, was released on March 5, 2026 and introduces persistent project databases, a unified column filter, a redesigned terminal interface, custom columns with trusted fields, and broad performance improvements. Persistent SQLite project databases let parsed scans be saved and reloaded in milliseconds to speed iterative workflows, while the new column filter replaces previous host and service filters and supports regular expression matching, negation, chaining, a value mode to trim multi value fields, and a host mode to preserve whole hosts when any service matches. Under the hood the core engine was rewritten for smarter host merging, adaptive multi process parsing to bypass the Python global interpreter lock, faster startup by loading heavy libraries only when needed, a test suite that runs about twenty times faster, and Pydantic based data models, and the removal of the old filters is listed as a breaking change.

Critical HPE AOS-CX Vulnerability Allows Admin Password Resets

www.securityweek.com · 7 months ago

Hewlett Packard Enterprise released patches for a critical vulnerability in Aruba Networking AOS CX that can be exploited remotely without authentication to reset administrator passwords. The flaw is tracked as CVE-2026-23813 with a CVSS score of 9.8 and affects the web based management interface of CX 4100i, CX 6000, CX 6100, CX 6200, CX 6300, CX 6400, CX 8320, CX 8325, CX 8360, CX 9300 and CX 10000 series switches. HPE issued AOS CX software updates version 10.17.1001, 10.16.1030, 10.13.1161 and 10.10.1180 to address CVE-2026-23813 and three additional high severity vulnerabilities tracked as CVE-2026-23814, CVE-2026-23815 and CVE-2026-23816 that could allow authenticated remote command injection, and a medium severity flaw that could redirect users to arbitrary URLs. Organizations are advised to apply updates promptly, restrict access to management interfaces, disable HTTP and HTTPS on switched virtual interfaces and routed ports, enforce access control lists and enable logging and monitoring.

Looking for an arXiv cs.CR endorser

arxiv.org · 7 months ago

false

GlassWorm Spreads via 72 Malicious Open VSX Extensions Hidden in Transitive Dependencies

gbhackers.com · 7 months ago

The GlassWorm campaign now uses transitive dependencies in Open VSX and VS Code compatible editors to deliver malware by publishing clean extensions that later add malicious extensionDependencies or extensionPack entries, allowing infected extensions to be pulled in after initial trust is established. Researchers found at least 72 malicious Open VSX extensions identified since January 31, 2026, and observed packages that quietly pulled in known malicious extensions in later versions, showing that a one time review is no longer sufficient. Operators target developer workstations to steal local credentials, tokens, configuration data and environment secrets, and have enhanced evasion through infrastructure rotation, use of Solana transaction memos and wallets as dead drops, geofencing, and heavier obfuscation with external decryption keys retrieved from HTTP headers. Recommended mitigations include auditing extension version histories and install chains for newly introduced dependencies, monitoring for staged loaders and known GlassWorm indicators, securing developer endpoints for exposed tokens, and using automated scanners to block suspicious dependency additions.

Global Authorities Take Down 45,000 Malicious IPs Used in Ransomware Campaigns

gbhackers.com · 7 months ago

Operation Synergia III ran from July 18, 2025 to January 31, 2026 and was coordinated by INTERPOL with support from private cybersecurity firms including Group-IB, Trend Micro, and S2W. Law enforcement across 72 countries disrupted more than 45,000 malicious IP addresses and servers used in phishing, malware, and ransomware campaigns. Raids resulted in 94 arrests, 110 suspects under active investigation, and the seizure of 212 electronic devices and servers, while regional actions dismantled over 33,000 phishing and fraudulent websites and multiple fraud rings. The coordinated action converted shared intelligence into tactical raids and underscores how international public private cooperation can cripple cybercriminal infrastructure and protect digital systems worldwide.

TikTok Investors Set to Pay $10 Billion Fee to Trump Administration

www.nytimes.com · 7 months ago

false

TikTok Investors Set to Pay $10 Billion Fee to Trump Administration

www.nytimes.com · 7 months ago

false

I Found 39 Algolia Admin Keys Exposed Across Open Source Documentation Sites

benzimmermann.dev · 7 months ago

There are 39 exposed Algolia admin API keys discovered across open source documentation sites. Most were found by scraping roughly 15,000 deployed documentation sites and by searching git histories, with 35 of the 39 discovered in frontend code and every key active at the time of discovery, and affected projects include Home Assistant, KEDA, and vcluster. These admin keys grant search plus full write and administrative permissions such as addObject, deleteObject, deleteIndex, editSettings, listIndexes, and browse, enabling attackers to modify or delete indexed content, export or dump data, or poison search results to redirect users to malicious pages. Remediation has been uneven with some vendors rotating or revoking keys and others still active, and the root cause is sites embedding write or admin keys in frontends instead of using search only keys, so the recommended fix is to verify frontend configs use search only keys and rotate any exposed credentials.

Technical challenge: Can a blockchain-published account be traced to its IP? (20,000 QORT bounty)

qortal.dev · 7 months ago

There is a 20,000 QORT bounty offered for a reproducible method to identify the IP address behind a specific publishing account on the Qortal network. The target is an account named Who Am I that is publishing on the Qortal Data Network from a local node that is not using a VPN or anonymity service. Participants must use only publicly observable network data to demonstrate a consistent and repeatable tracing method that reveals the publishing node IP address, with the bounty awarded if the method works reliably. A successful trace would indicate a vulnerability in the decentralized data network that would need to be addressed.

Microsoft: Windows 11 users can't access C: drive on some Samsung PCs

www.bleepingcomputer.com · 7 months ago

There is an issue affecting some Samsung laptops running Windows 11 that appeared after installing the February 2026 security updates, in which users lose access to their C drive and cannot launch applications. Microsoft is investigating the problem and working on a resolution for impacted devices.

Phishing campaign abusing Google Cloud Storage redirectors to multiple scam pages

malwr-analysis.com · 7 months ago

There is an ongoing phishing campaign that abuses Google Cloud Storage as a redirect layer to send victims to numerous scam sites hosted primarily on the autos top level domain. The campaign uses a single Google Cloud Storage page as a central traffic distribution hub that rotates victims across themes including fake Walmart surveys, Dell laptop giveaways, Netflix reward scams, antivirus renewal alerts, cloud storage full warnings, and fake job offers. Attackers reuse the same domains and a shared phishing kit or centralized backend to present multiple scam themes and quickly change destinations while keeping the initial delivery link stable. High volumes of phishing emails were observed, with around forty to fifty messages within a 24 hour period containing links to the redirector infrastructure and multiple phishing domains serving as indicators of compromise.

Friday Squid Blogging: Increased Squid Population in the Falklands

www.schneier.com · 7 months ago

false

FBI seeks victims of Steam games used to spread malware

www.bleepingcomputer.com · 7 months ago

The FBI's Seattle Division is asking gamers who installed any of eight malicious Steam titles between May 2024 and January 2026 to come forward. The identified games include BlockBlasters, Chemia, Dashverse also known as DashFPS, Lampy, Lunara, PirateFi, and Tokenova, and investigators say the titles delivered information stealer and cryptodrainer malware such as HijackLoader, Vidar, and a custom Fickle Stealer that led to account hijacks and cryptocurrency theft, with reports including a streamer losing more than thirty two thousand dollars and blockchain analysis estimating roughly one hundred fifty thousand dollars stolen from hundreds of accounts. The FBI requests affected users or anyone with relevant information to complete its questionnaire or to contact the agency by email at [email protected] and says victims may be eligible for services and restitution and that identities will be kept confidential.

Google warns of two actively exploited Chrome zero days

www.csoonline.com · 7 months ago

Two high severity zero day vulnerabilities in Chrome, CVE-2026-3909 and CVE-2026-3910, are being actively exploited and Google has issued emergency patches. CVE-2026-3910 allows remote code execution inside Chrome's V8 JavaScript and WebAssembly engine via a crafted HTML page. CVE-2026-3909 enables out of bounds memory access through an out of bounds write in the Skia graphics library and affects browsers before version 146.0.7680.75. Organizations are urged to update all Chromium and Chromium based browsers immediately, enable automatic updates, monitor for outdated versions, consider browser isolation, and note that Google is withholding technical details until most users are patched.

Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos

www.darkreading.com · 7 months ago

There are fake proof of concept exploits and misleading demonstrations circulating in the wake of Cisco Catalyst SD-WAN vulnerabilities, creating opportunities for fraud and confusing defenders. A maximum severity authentication bypass in Cisco Catalyst SD-WAN Controller tracked as CVE-2026-20127 and an older local privilege escalation tracked as CVE-2022-20775 have been exploited in the wild and prompted emergency guidance and a multinational threat hunting guide. Security teams are advised to avoid running untrusted PoCs, test exploits in isolated environments, apply vendor patches immediately, and hunt for indicators such as rogue peers, version downgrades, unexpected reboots, and unauthorized local accounts.

Adobe Settles With U.S. Over Hard-to-Cancel Subscriptions

www.nytimes.com · 7 months ago

false

Critical Chrome Security Flaws Threaten Billions of Users Worldwide

www.techrepublic.com · 7 months ago

There are two high severity zero day vulnerabilities in Google Chrome that are being actively exploited, affecting the Skia graphics library and the V8 JavaScript engine and potentially allowing attackers to crash browsers or execute malicious code. The flaws are tracked as CVE-2026-3909, an out of bounds write in Skia that can cause memory corruption, and CVE-2026-3910, an inappropriate implementation issue in V8 that can lead to memory errors or attacker controlled code execution. Because Chrome is used by roughly 3.8 billion people worldwide, these actively exploited flaws could put billions of systems at risk until patches are applied. Google has released patches while limiting technical details, and users and organizations are urged to update Chrome, verify deployments, and apply mitigations such as browser isolation, endpoint monitoring, least privilege, and extension control to reduce exposure.

Coding After Coders: The End of Computer Programming as We Know It

www.nytimes.com · 7 months ago

Silicon Valley programmers are increasingly using AI agents and a practice called vibe coding, supplying high level goals to models like Claude and ChatGPT instead of hand writing most code. Engineers are spending more time orchestrating agent workflows, designing prompts, debugging outputs, and configuring tools than writing line by line implementations. Some workers and critics report strange new work patterns and feelings of uselessness or sadness, while others warn that AI generated code can be error prone and raise maintenance and security risks. The shift is reshaping job roles and hiring, particularly for entry level programming positions, and raising questions about how software work and career paths will evolve.

OSS Cartography can now map AI agents to cloud attack paths

cartography.dev · 7 months ago

Cartography can now automatically discover AI agents inside container images by using Cisco AIBOM to detect frameworks such as pydanticai, langchain, and openai and to extract declared tools, models, memory, embeddings, and prompts. Detected components become AIBOMComponent and AIAgent nodes that are joined by manifest digest to ECR images so the graph can trace from an agent through ECS containers and tasks to IAM roles, network interfaces, load balancers, and DNS records to determine internet exposure and permissions. This enables queries that return which agents are reachable from the internet, their DNS names, IAM roles, tools and models, and supports security rules and governance alerts to flag agents that violate policies.

The Data Gap: Why Nonprofit Cyber Incidents Go Underreported

www.darkreading.com · 7 months ago

Nonprofits face rising cyberattacks but the true scale is obscured because reporting requirements are inconsistent and incident data are scattered and incomplete. In March 2025 advanced email attacks against nonprofits grew by 35 percent year over year and phishing targeting nonprofits increased by 50 percent, while an identity and access management vendor found nonprofits to be the second most targeted industry across its customers. Incidents are often recorded as collateral damage from third party breaches, which deepens the underreporting problem and makes it harder for organizations to justify additional support. Experts say nonprofits need more than funding; they require education, training, dedicated time, and to be treated like businesses with immediate support rather than waiting for perfect data.

Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

thehackernews.com · 7 months ago

There is a suspected China-based cyber espionage operation targeting Southeast Asian military organizations that dates back to at least 2020 and is tracked by Palo Alto Networks Unit 42 as CL-STA-1087. The campaign shows hallmarks of an advanced persistent threat, demonstrating strategic operational patience and a focus on harvesting specific intelligence such as military organizational structures and C4I capabilities rather than bulk data theft. Observed tools include two backdoors called AppleChris and MemFun and a credential harvester named Getpass, with both backdoors using Pastebin as a dead drop resolver and AppleChris sometimes using Dropbox as a fallback to retrieve command and control addresses. Initial intrusion methods remain unknown but the actors used suspicious PowerShell with long sleep timers, DLL hijacking, process hollowing, in-memory loaders, and a custom Mimikatz variant to escalate privileges and extract credentials enabling modular payload delivery and prolonged access.

U.S. Tech Giants Flocked to the Persian Gulf. Now They Are Targets.

www.nytimes.com · 7 months ago

NULL

Alipay (1B+ users) DeepLink vulnerability allows silent GPS extraction via URL - 6 regulators now investigating, vendor says normal functionality

packetstorm.news · 7 months ago

There are seventeen vulnerabilities in the Alipay mobile app that allow a single crafted URL to silently exfiltrate precise GPS coordinates via a DeepLink to WebView to JSBridge chain, achieving roughly eight point eight meter accuracy in about seven seconds without prompting the user. The attack flow exploits a trusted domain open redirect to trigger the alipays scheme deep link, which opens a privileged WebView and invokes AlipayJSBridge.call getLocation to return location silently, while iOS exposes five additional APIs including tradePay that broaden the impact. Six CVEs were submitted to MITRE CNA-LR with CVSS scores reported between 7.4 and 9.3, testing captured three hundred eight server side GPS logs across three devices in three countries including the vendor security lead's location, and the vendor characterized the behavior as normal functionality then issued a takedown complaint.

Microsoft Authenticator Flaw on Android, iOS Could Leak Login Codes for Millions

www.techrepublic.com · 7 months ago

A vulnerability in Microsoft Authenticator for Android and iOS can allow a malicious app installed on the same device to intercept one time login codes and sign in links by mishandling deep links, potentially enabling attackers to complete logins and access emails and files tied to compromised accounts. The flaw is tracked as CVE-2026-26123 and requires the victim to install and then select a malicious application to handle an authentication deep link. A patch has been released and users are urged to update via the Apple App Store or Google Play Store, and Microsoft plans additional protections that will restrict the app on jailbroken or rooted phones with a staged rollout that began on Android in late February 2026 and is scheduled to start on iOS in April 2026.

Cyberattackers Don't Care About Good Causes

www.darkreading.com · 7 months ago

Nonprofit organizations are being heavily targeted by threat actors because they hold sensitive data but often operate with weak security due to limited funding and a shortage of skilled personnel. Experts say the sector should be treated as critical infrastructure and needs better incident reporting, appropriate technologies, training, and sustained attention, though many nonprofits lack the resources to implement these defenses. Panelists warn that donating free tools or applying one size fits all security can be harmful when nonprofits lack staff to configure and monitor solutions, and that adopting AI tools without assessing data use and operational capacity can introduce new risks. They recommend tailored engagement that prioritizes mission needs, practical basics such as log monitoring and risk based decisions, and partnerships with companies that understand nonprofit constraints.

RegPwn - Windows LPE vulnerability (now fixed)

www.mdsec.co.uk · 7 months ago

There is an Elevation of Privilege vulnerability named RegPwn affecting Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025 that was fixed on Patch Tuesday and is tracked as CVE-2026-24291. The issue arises because Windows Accessibility features create per user ATConfig registry entries that are copied by system processes into system registry locations, allowing a low privilege user to influence data copied into HKLM and HKU dot DEFAULT. An exploit wins a short race window by placing an opportunistic lock on a shared system file, replacing the target ATConfig key with a registry symbolic link to achieve an arbitrary registry write as SYSTEM, allowing overwriting of a service ImagePath to escalate to SYSTEM, and a proof of concept is publicly available.

Poland's nuclear research centre targeted by cyberattack

www.bleepingcomputer.com · 7 months ago

Poland's National Centre for Nuclear Research reported that hackers targeted its IT infrastructure but detection and blocking prevented any impact. Built in security systems and internal procedures allowed a rapid response that secured targeted systems and ensured the MARIA research reactor remained uncompromised and operating safely at full power. The institute notified authorities and opened an investigation, and although no attribution was made, outside reporting noted indicators that Iran may be behind the attack while investigators cautioned these could be false flags.

Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026

thehackernews.com · 7 months ago

Meta will discontinue support for end to end encryption for chats on Instagram after May 8, 2026. Users with impacted chats will be shown instructions to download any media or messages they want to keep and may need to update older versions of the Instagram app to do so. The feature was first tested in 2021 and is currently available only in some areas, and the change follows reports that Meta moved forward with encrypted messaging despite internal warnings in 2019 that it could hinder detection of illegal content.

Microsoft investigates classic Outlook sync and connection issues

www.bleepingcomputer.com · 7 months ago

false

Cyber criminals too are working from home… your home

www.csoonline.com · 7 months ago

The FBI warns that cybercriminals are using residential proxy networks that reroute internet traffic through compromised Internet of Things devices, smartphones and home routers to mask the origin of illegal online activity. Enterprises and consumers are both at risk because compromised devices let attackers blend into legitimate traffic, with older and end of life devices singled out as especially vulnerable. The FBI urges installing software updates, enforcing strong device policies, segmenting networks, blocking IP addresses associated with residential proxy networks and strengthening firewall rules, and security researchers report a major incident that exposed nine million Android phones in January and widespread proxy exposure across 671 government entities, 263 energy and utility organizations and nearly 1,900 education environments.

Will AI Save Consumers From Smartphone-Based Phishing Attacks?

www.darkreading.com · 7 months ago

New research shows phishing is the most prevalent smartphone security issue with 27 percent of consumers reporting phishing scams and 26 percent reporting malware or viruses. Incidence varies by country with the United States highest at 40 percent followed by the United Kingdom at 36 percent Ireland 35 percent Canada 32 percent Australia 30 percent and Singapore 26 percent. AI is being deployed for on device scam detection but the most sophisticated and novel scam messages still bypass protections while AI also enables attackers to produce deepfakes and craft more convincing campaigns. The research finds consumer skepticism toward AI features declining timely software updates that leave many devices exposed and no smartphone scored full marks in anti phishing protection although Pixel 10 Pro and Galaxy S25 ranked highest and iPhone 17 Pro Max showed room for improvement.

CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root

cdn2.qualys.com · 7 months ago

NULL

Starbucks Data Breach Impacts Employees

www.securityweek.com · 7 months ago

There was a data breach that exposed personal information of nearly 900 Starbucks employees after unauthorized access to Partner Central accounts was detected on February 6, 2026. Attackers obtained user credentials through phishing that used fake websites mimicking the employee portal, and unauthorized access occurred between January 19 and February 11, 2026. Some impacted personal data included names, social security numbers, dates of birth, and financial account and routing numbers. Law enforcement has been notified, affected employees are being offered free identity protection, and the company said its systems and networks do not appear to have been directly compromised.

INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime

thehackernews.com · 7 months ago

INTERPOL announced the takedown of 45,000 malicious IP addresses and servers used in phishing, malware and ransomware campaigns. The operation involved 72 countries and territories and aimed to dismantle criminal networks, disrupt emerging threats and safeguard victims from scams.

In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown

www.securityweek.com · 7 months ago

A flaw in the open source workflow automation tool n8n, tracked as CVE-2025-68613, has been added to the Known Exploited Vulnerabilities catalog and is reported to allow remote code execution. Researchers disclosed nine CrackArmor AppArmor vulnerabilities that enable unprivileged local users to bypass kernel protections, escalate to root, and break container isolation, with Qualys urging immediate kernel patching. An Interpol coordinated operation dismantled more than 45,000 malicious IP addresses and servers between July 2025 and January 2026, yielding multiple arrests and ongoing investigations across dozens of countries. IBM X Force reported an AI generated PowerShell backdoor called Slopoly used by the Hive0163 group in later stage ransomware activity, while vendors issued advisories on critical Veeam product vulnerabilities and Telus Digital is investigating a claimed one petabyte data theft.

Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials

thehackernews.com · 7 months ago

Microsoft disclosed a Storm-2561 credential theft campaign that uses SEO poisoning to redirect users searching for legitimate enterprise VPN software to attacker-controlled sites and GitHub-hosted ZIP files that deploy digitally signed trojans masquerading as trusted VPN clients to harvest credentials. The installers sideload malicious DLLs including a dwmapi.dll loader and an inspector.dll Hyrax infostealer, use the Windows RunOnce registry key for persistence, and the malicious binaries were signed with a certificate from Taiyuan Lihua Near Information Technology Co., Ltd. which has since been revoked. Microsoft and defenders took down the repositories and revoked the certificate, and organizations are advised to enable multi factor authentication, verify download sources, and exercise caution when downloading VPN clients.

Police sinkholes 45,000 IP addresses in cybercrime crackdown

www.bleepingcomputer.com · 7 months ago

There was an Interpol-led international law enforcement action codenamed Operation Synergia III that sinkholed roughly 45,000 IP addresses and seized servers tied to cybercrime worldwide between July 2025 and January 2026. Authorities from 72 countries seized 212 electronic devices and servers, arrested 94 suspects with another 110 under investigation, and Chinese investigators in Macau identified more than 33,000 phishing and fraudulent websites used to steal credit card details and personal information. The operation follows earlier Synergia actions that disrupted thousands of servers and tens of thousands of IP addresses and complements other coordinated efforts such as Operation Red Card 2.0, which led to 651 arrests and the recovery of over 4.3 million dollars.