Blahalla

Investigating a New Click-Fix Variant

thehackernews.com · 7 months ago

Researchers identified a new ClickFix variant that lures victims into using the Run dialog to mount a remote WebDAV share and execute a hosted batch file which downloads and launches a trojanized Electron application. The batch unpacks a ZIP into the user profile and runs an older WorkFlowy desktop executable whose app dot asar contains an injected main dot js that executes in the Electron main process with full user privileges. The injected code creates a persistent victim identifier written to an AppData file named id dot txt, beacons host metadata every two seconds to a command and control server, and can receive base64 encoded payloads to write and execute, while the dropper itself implements no operating system level persistence. Detection required proactive threat hunting focused on suspicious commands recorded in the RunMRU registry because the technique abuses native utilities and trusted applications that are rarely inspected.
Fake enterprise VPN sites used to steal company credentials

www.bleepingcomputer.com · 7 months ago

Threat actor Storm-2561 is distributing fake enterprise VPN clients impersonating vendors including Ivanti, Cisco, and Fortinet by manipulating search results to redirect users to spoofed vendor sites. The fake installers, hosted in a ZIP on a GitHub repository, install a Pulse executable, drop a loader and a Hyrax information stealer variant, and present a legitimate looking login interface that captures and exfiltrates VPN credentials. The malware is digitally signed with a now revoked certificate issued to Taiyuan Lihua Near Information Technology Company Limited, steals VPN configuration data from connectionsstore.dat, and establishes persistence via the Windows RunOnce registry key. The fake client displays an installation error and redirects victims to the real vendor site to lower suspicion, and defenders are advised to enable cloud delivered protection in Defender, run endpoint detection and response in block mode, enforce multi factor authentication, use SmartScreen enabled browsers, and hunt using provided indicators of compromise.
Most Google Cloud Attacks Start With Bug Exploitation

www.darkreading.com · 7 months ago

Exploitation of user-managed cloud software has overtaken credential abuse as the leading initial access vector in Google Cloud, with software-based entry accounting for about 44 percent of initial-access activity. AI-driven vulnerability analysis and automated exploit development have accelerated near-instant weaponization of newly disclosed vulnerabilities, shrinking defenders' response windows to hours. Google recommends virtually patching vulnerabilities within 24 hours of public disclosure and fully remediating within 72 hours while adopting identity-centric proxies and automated posture enforcement because attackers increasingly target publicly exposed assets such as virtual machines, containers, serverless functions, and edge devices. Outside Google Cloud, platform-agnostic incidents still center on identity, with about 83 percent of initial-access vectors tied to identity issues including phishing and stolen credentials.
Real-Time Banking Trojan Strikes Brazil's Pix Users

www.darkreading.com · 7 months ago

A new Android banking Trojan called PixRevolution targets Brazil's Pix instant payment system by remaining dormant until a user initiates a payment, then hijacking the transfer in real time. Actors distribute the malware through fake Google Play store pages hosting malicious APKs that trick users into enabling a bogus accessibility feature, which grants the Trojan full control of taps, on-screen text, microphone audio, and real-time screen capture. The Trojan connects to a command and control server on port 9000, watches for Portuguese banking terms, displays an HTML overlay to stall the victim while funds are diverted, and defenders are advised to incorporate mobile threat visibility into fraud detection and authentication workflows to identify compromised devices.
Iran-Linked Hackers Take Aim at US and Other Targets, Raising Risk of Cyberattacks During War

www.securityweek.com · 7 months ago

Pro-Iranian hackers have expanded operations from the Middle East into the United States since the war began on February 28, 2026, increasing the risk to American defense contractors and critical infrastructure. Groups claiming responsibility, including Handala, said they disrupted systems at medical device maker Stryker, and researchers report attempts to penetrate cameras to aid missile targeting alongside attacks on data centers, industrial sites, a school, and an airport. Experts say the attackers often seek easy targets such as local water plants and hospitals, favor data destruction and denial of service over financial extortion, and urge organizations to apply patches, update firewalls, and remove stale accounts to prepare for disruption.
New Critical AdGuard Home Flaw Lets Attackers Bypass Authentication

gbhackers.com · 7 months ago

There is a critical authentication bypass in AdGuard Home tracked as CVE-2026-32136 and assigned a CVSS score of 9.8, prompting an emergency hotfix from the maintainers. The flaw allows unauthenticated remote attackers to send an HTTP 1.1 request that upgrades the connection to HTTP 2 Cleartext called h2c, which is then passed into an internal multiplexer lacking authentication middleware so subsequent HTTP 2 requests are treated as authenticated and can grant full administrative privileges. The issue was reported by researcher mandreko and fixed in AdGuard Home version 0.107.73, and administrators are urged to upgrade immediately, block public internet access to the management interface, and audit DNS routing and access logs for signs of compromise.
Veeam warns admins to patch now as critical RCE flaws hit Backup & Replication

www.csoonline.com · 7 months ago

Veeam released security updates for Backup and Replication that fix five vulnerabilities including three critical remote code execution flaws that can allow an authenticated user to execute code on backup servers. The RCE bugs are tracked as CVE-2026-21666, CVE-2026-21667, and CVE-2026-21708, and the two additional high severity flaws are CVE-2026-21668 which allows arbitrary file manipulation by users with repository access and CVE-2026-21672 which enables local privilege escalation. Patches are available in build 12.3.2.4465 and organizations are urged to upgrade immediately because backup systems are high value targets for ransomware and past vulnerabilities such as CVE-2024-40711 and CVE-2025-23120 were exploited in the wild.
Authorities Shut Down Proxy Service Linked to Malware Campaign Targeting Thousands of Users

gbhackers.com · 7 months ago

There was a coordinated international law enforcement operation led by the U.S. Justice Department that dismantled SocksEscort, a malicious residential proxy network that compromised thousands of residential and small business routers worldwide. Authorities executed seizure warrants against dozens of U.S.-registered domains to halt a criminal service that sold routing access to other cybercriminals and routed third-party internet traffic through infected devices to evade security filters and geolocation blocks. Since the summer of 2020 the service offered access to approximately 369,000 distinct IP addresses, and just before the takedown in February 2026 it listed about 8,000 infected routers available for immediate use, including roughly 2,500 in the United States. Criminals used the proxies to carry out banking takeovers, drain cryptocurrency accounts, and file fraudulent unemployment claims that resulted in losses ranging from hundreds of thousands to millions of dollars, and the disruption involved investigators from the FBI, IRS, European partners, and private cybersecurity organizations.
AI-HealthTech Innovator Humata Health Partners with AccuKnox for Zero Trust CNAPP

gbhackers.com · 7 months ago

On March 13, 2026 in Menlo Park, California, Humata Health announced a partnership with AccuKnox to implement a Zero Trust Cloud Native Application Protection Platform to streamline security for its SaaS platform. AccuKnox, described as a leader in Code to Cognition Security, will support an on premise deployment to help Humata meet HIPAA mandates. The initiative is intended to align Humata Health’s AI health technology with healthcare security requirements.
Bold Security Emerges From Stealth With $40 Million in Funding

www.securityweek.com · 7 months ago

Bold Security emerged from stealth with 40 million in funding from Bessemer Venture Partners, Picture Capital, and Red Dot Capital Partners. Co founded by Nati Hazut and based in New York, Bold runs AI agents directly on enterprise endpoints to turn passive monitoring into active real time protection by understanding user behavior, the data they interact with, and business context. Running AI locally enables behavior monitoring, real time data classification, and policy enforcement with low latency while keeping data analysis on device, not using customer data to train Bold models, and leaving evidence storage under customer control. The company reports adoption by large US enterprises and says the funding will be used to advance its AI capabilities and scale go to market globally.
Starbucks Data Breach Exposes Personal Data of Hundreds of Users

gbhackers.com · 7 months ago

A targeted cybersecurity incident compromised the personal and financial information of 889 Starbucks employees by accessing the Partner Central human resources and payroll platform. Threat actors harvested credentials through fraudulent phishing websites, first gaining access on January 19, 2026, with the activity detected on February 6 and attackers removed by February 11 after a three week window of unauthorized access. Exposed information included full names, dates of birth, Social Security numbers, and bank account and routing numbers for direct deposit, and affected individuals are being offered 24 months of identity theft protection and credit monitoring through Experian Credit Plus 1B. A data breach notification was filed with the Maine Attorney General on March 10, 2026.
Storm-2561 Uses SEO Poisoning, Fake Signed VPN Apps to Steal Enterprise Credentials

gbhackers.com · 7 months ago

A financially motivated threat actor known as Storm-2561 has run a credential theft campaign since May 2025 that uses SEO poisoning and fake, code signed VPN installers to harvest enterprise VPN credentials. Victims searching for enterprise VPN clients are redirected to spoofed vendor download pages that lead to a trojanized MSI which installs signed malicious components that load shellcode, side-load a Hyrax information stealer, collect VPN configuration and stored sign-in data, and exfiltrate it to attacker command and control. The campaign abused a legitimate code signing certificate to evade warnings and allowlisting, maintained persistence via RunOnce registry entries, was detected as Trojan Malgent and TrojanSpy Hyrax, and mitigation recommendations include enabling cloud protection and endpoint detection and response in block mode, enforcing multifactor authentication, disabling storage of corporate credentials in personal browsers, and applying attack surface reduction rules.
Google Paid Out $17 Million in Bug Bounty Rewards in 2025

www.securityweek.com · 7 months ago

There were 17.1 million dollars in bug bounty rewards paid by Google in 2025, bringing the company total to 81.6 million dollars over the past 15 years. Payouts rose 40 percent from 12 million dollars the previous year, with more than 700 researchers rewarded and a top individual haul of 811,000 dollars; Chrome vulnerabilities attracted just over 3.7 million dollars in payments, including 250,000 dollar awards for demonstrated full chain sandbox escapes. Cloud vulnerability rewards exceeded 3.5 million dollars in 2025, with the Cloud vulnerability reward program processing 1,774 reports in its first full year after launching in October 2024 and 143 researchers paid. Other programs awarded over 2.9 million dollars for Android and Devices, about 890,000 dollars via the AI vulnerability reward program, 482,000 dollars via the Abuse program and 327,000 dollars via the open source program, and the findings prompted architectural changes and platform hardening including increased use of memory safe languages and hardware mitigations.
Academia and the “AI Brain Drain”

www.schneier.com · 7 months ago

In 2025, Google, Amazon, Microsoft and Meta collectively spent US$380 billion on building artificial intelligence tools and that spending is expected to rise to US$650 billion in 2026 to fund infrastructure, with firms reportedly offering massive compensation packages such as US$250 million over four years to recruit individual AI researchers. There is a growing AI brain drain from academia, with studies indicating that early career, highly cited researchers are much more likely to move to industry, one model estimating they are about one hundred times more likely than ten year veterans based on data from nearly seven million papers. Experts warn this outflow threatens curiosity driven and independent academic research and weakens science that relies on collaborative teams, with evidence showing larger teams and collaborations produce higher impact work. Recommended responses include developing public interest AI initiatives that share code and data, equitably distributing academic pay to support graduate students and postdocs, strengthening researcher networks across career stages, and rewarding public goods and intellectual freedom instead of engaging in a compensation arms race.
A.I. Goes to War + Is ‘A.I. Brain Fry’ Real? + How Grammarly Stole Casey’s Identity

www.nytimes.com · 7 months ago

There are rising concerns that AI being used to find and prioritize military targets is blurring accountability, because when strikes kill civilians or miss intended targets people will ask whether a human or an AI system made the mistake. There are reports of an emerging phenomenon called AI brain fry, where heavy workplace use of multiple AI tools and oversight duties produces cognitive overload and mental fatigue for workers. There are allegations that a new Grammarly feature used writing patterns from real authors and produced edits that some writers say amount to stealing their identities, prompting online backlash.
Iran-Linked Hacker Attack on Stryker Disrupted Manufacturing and Shipping

www.securityweek.com · 7 months ago

There was an attack linked to Iran against Stryker that caused global disruption to its Microsoft environment, affecting order processing, manufacturing and shipping. Evidence indicates attackers abused Microsoft Intune endpoint management to remotely wipe devices using living off the land techniques rather than deploying malware, and Stryker reported no malware or ransomware was detected. The group Handala claimed responsibility, saying it wiped more than 200,000 devices and stole 50 terabytes of data, and reports say Stryker staff in Ireland were sent home and used WhatsApp for coordination. Researchers view Handala as a cover for Void Manticore, a state sponsored Iranian actor that has increased operations against targets aligned with Israel and its allies.
Iran War Bait Fuels TA453, TA473 Phishing Campaigns

gbhackers.com · 7 months ago

State aligned threat clusters including TA453 and TA473 and several UNK clusters are exploiting breaking Iran war developments to mount highly targeted phishing campaigns against governments and policy organizations across the Middle East and beyond. The surge follows a US Israeli strike on February 28 2026 and Iran's subsequent missile and drone retaliation, and adversaries are using the crisis both as topical cover for routine espionage and to broaden intelligence collection priorities. These operations combine long term espionage with opportunistic credential theft and malware delivery, leveraging compromised government accounts, consumer freemail, and trusted cloud services to increase credibility and bypass defenses. Observed tradecraft includes LNK shortcuts that trigger DLL sideloading to load malicious DLLs and decrypt Cobalt Strike beacons, OWA and OneDrive credential harvesting pages prefilled with victim addresses and redirected to legitimate sites to reduce suspicion, geofenced decoys that deliver.NET loaders which pull a Rust based backdoor via PowerShell, and tracking pixels to identify when targets open lures.
Onyx Security Launches With $40 Million in Funding

www.securityweek.com · 7 months ago

false
Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8

thehackernews.com · 7 months ago

Google released security updates for the Chrome browser to address two high severity vulnerabilities that have been exploited in the wild. There is an out of bounds write in the Skia 2D graphics library tracked as CVE-2026-3909 with a CVSS score of 8.8 that can allow out of bounds memory access via a crafted HTML page, and an inappropriate implementation in the V8 JavaScript and WebAssembly engine tracked as CVE-2026-3910 with a CVSS score of 8.8 that can enable remote code execution inside a sandbox via a crafted HTML page. Both issues were reported by Google on March 10, 2026, Google confirmed exploits exist in the wild, users are advised to update Chrome to versions 146.0.7680.75 or 146.0.7680.76 on Windows and macOS and 146.0.7680.75 on Linux, and other Chromium based browsers should apply their fixes when available; this follows an earlier fix for CVE-2026-2441 and brings the count of actively weaponized Chrome zero days this year to three.
Hybrid resilience: Designing incident response across on-prem, cloud and SaaS without losing your mind

www.csoonline.com · 7 months ago

Organizations should adopt a single incident language and one incident channel led by an incident commander with lightweight domain leads so on-prem, cloud and SaaS teams converge on one shared timeline, one hypothesis, severity driven by customer impact, predictable communication cadence, and named owners with expected times to learn. Telemetry must be portable across domains by instrumenting end to end user journey signals for latency, error rate and volume, propagating correlation identifiers and enforcing clock discipline, and maintaining a single change table that records what changed, where, when and whether it is suspected or confirmed. Escalation should be engineered before incidents by defining realistic time to human targets, keeping one page escalation cards with contacts, entitlements and rapid evidence, and using a rollback, failover and degradation decision matrix that scores reversibility, blast radius and time to learn. A pragmatic month one plan is to publish the incident contract, enforce one war room, instrument three core user journeys, standardize correlation IDs and time discipline, and build escalation cards and the decision matrix to reduce ambiguity under pressure.
Apple Releases Emergency iOS 15.8.7 Update to Block ‘Coruna’ Exploit Kit

gbhackers.com · 7 months ago

Apple rolled out an emergency iOS 15.8.7 and iPadOS 15.8.7 update on March 11, 2026 to protect older iPhones and iPads from the Coruna exploit kit. The release backports four critical fixes, one Kernel and three WebKit vulnerabilities, that attackers could chain to execute arbitrary code and escape browser sandboxes. The addressed CVEs are CVE-2023-41974, CVE-2024-23222, CVE-2023-43000, and CVE-2023-43010. Affected devices include iPhone 6s, iPhone 7, first generation iPhone SE, iPad Air 2, fourth generation iPad mini, and iPod touch seventh generation, and users are urged to install the update via Settings General Software Update immediately.
Storm-2561 targets enterprise VPN users with SEO poisoning, fake clients

www.csoonline.com · 7 months ago

Microsoft warns enterprises that the threat actor Storm-2561 is poisoning search engine results for enterprise VPN downloads to push trojanized, digitally signed installers that impersonate major vendors and are hosted on trusted platforms. The installers drop a fake Pulse Secure client and side-load two malicious DLLs including inspector.dll, a Hyrax infostealer variant, which extracts stored VPN credentials and URI data and exfiltrates them to attacker controlled infrastructure. After stealing credentials the fake client shows an installation error and redirects victims to the legitimate vendor site to conceal the compromise while the malware establishes persistence via the Windows RunOnce registry key, and the signed certificate used to evade detection has since been revoked. Mitigations include enforcing multifactor authentication, disabling browser password syncing on managed devices, running endpoint detection and response in block mode, and enabling web and network protections and browser features that block malicious sites.
Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet

www.securityweek.com · 7 months ago

Law enforcement in the United States and Europe disrupted SocksEscort, a malicious proxy service powered by the AVrecon botnet that has affected about 363,000 IP addresses across 163 countries since 2020. Authorities seized 34 domains and 23 servers in seven countries and the United States froze 3.5 million dollars in cryptocurrency while estimating customers paid more than 5.7 million dollars for access to the service. The FBI said AVrecon targeted roughly 1,200 device models from vendors such as Cisco, D Link, Hikvision, MikroTik, Netgear, TP Link and Zyxel by exploiting known remote code execution and command injection vulnerabilities to infect small office and home routers, with about 8,000 hacked routers supporting the service in February 2026 and roughly 2,500 of those in the United States. Authorities and private partners shared indicators of compromise and mitigation guidance as part of the takedown and disruption effort.
Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation

thehackernews.com · 7 months ago

There are nine confused deputy vulnerabilities in the Linux kernel AppArmor module, collectively codenamed CrackArmor by the Qualys Threat Research Unit, that allow unprivileged users to bypass kernel protections, escalate to root, and undermine container isolation. The flaws date back to 2017, affect all kernels since version 4.11 on distributions that integrate AppArmor including Ubuntu, Debian, and SUSE, and Qualys says it is withholding proof of concept exploit code while urging immediate kernel patching. No CVE identifiers had been assigned at publication, and administrators are advised to apply vendor kernel updates and monitor AppArmor profile files for unauthorized changes.
Starbucks discloses data breach affecting hundreds of employees

www.bleepingcomputer.com · 7 months ago

Starbucks disclosed a data breach that compromised 889 Partner Central accounts after attackers obtained login credentials through websites impersonating Partner Central. Attackers had access between January 19 and February 11, 2026, and the company discovered the incident on February 6, 2026. Exposed information included employee names, Social Security numbers, dates of birth, and financial account and routing numbers. Affected partners were notified, law enforcement was informed, and impacted employees are being offered two years of identity theft protection and credit monitoring through Experian.
Chrome 146 Update Patches Two Exploited Zero-Days

www.securityweek.com · 7 months ago

There are two exploited zero day vulnerabilities in Chrome 146 that Google patched in an emergency update. They are tracked as CVE-2026-3909 and CVE-2026-3910, each rated CVSS 8.8, and were discovered by Google on March 10, 2026. CVE-2026-3909 is an out of bounds write defect in the Skia graphics library that can be triggered by malicious HTML to corrupt memory and enable arbitrary code execution or crashes, and CVE-2026-3910 is an inappropriate implementation weakness in the V8 JavaScript engine that can allow crafted HTML pages to execute arbitrary code and potentially enable sandbox escape. Fixes were shipped in Chrome 146.0.7680.75 and 76 for Windows and macOS, in 146.0.7680.75 for Linux, and in 146.0.76380.115 for Android, and users are urged to update immediately.
Two Newly Discovered Chrome Zero-Days Exploited in the Wild to Run Malicious Code

gbhackers.com · 7 months ago

An urgent security update for Chrome desktop addresses two critical zero-day vulnerabilities, CVE-2026-3909 and CVE-2026-3910, that are being actively exploited in the wild. CVE-2026-3909 is an out-of-bounds write in the Skia graphics library that can lead to crashes or arbitrary code execution, and CVE-2026-3910 is an inappropriate implementation in the V8 JavaScript engine that can enable sandbox bypass and stealthy remote code execution. Attackers can trigger these flaws by luring users to specially crafted websites without requiring additional interaction. Google released a Stable Channel update on March 12, 2026 with fixes in Chrome 146.0.7680.75 and 146.0.7680.76 for Windows and Mac and 146.0.7680.75 for Linux, and users and administrators are urged to update immediately while vendors of other Chromium based browsers publish corresponding patches.
PsExec and Renamed Backup Tools Enabled Data Theft Before INC Ransomware Attack

gbhackers.com · 7 months ago

Attackers used PsExec to escalate privileges and created a scheduled task named Recovery Diagnostics to run a Base64 encoded PowerShell script that contained plaintext cloud credentials and configured a Wasabi S3 backup repository. They placed a renamed copy of the open source backup tool restic as winupdate.exe in the Windows system directory to exfiltrate files listed in a file named new dot txt, then on February 25, 2026 disabled endpoint protections including VIPRE and Microsoft Defender before deploying INC ransomware and leaving ransom notes titled INC README. Investigators determined the intrusion began at least February 24, 2026, noted a nearly identical incident on February 9, 2026, and advised monitoring unusual PowerShell activity, scheduled tasks, and unexpected backup operations to detect data theft before ransomware deployment.
The cyber perimeter was never dead. We just abandoned it.

www.csoonline.com · 7 months ago

There are coordinated federal efforts addressing a neglected network perimeter: the FBI's Operation Winter SHIELD is conducting a concentrated hardening push to expose weak authentication, excessive administrator privileges, unpatched edge devices, and poor crisis readiness, while CISA's BOD 26-02 mandates identifying, removing, and replacing unsupported edge hardware. Security leaders are being told to achieve total edge visibility and act decisively by enforcing hardware based authentication, limiting and monitoring privileged access, patching internet facing systems within 72 hours for critical flaws, eliminating permanent vendor access, protecting and offsite storing logs and backups, shutting down unnecessary exposed services, and running regular crisis exercises. The perimeter was not dead but ignored, and organizations that keep end of life edge gear are effectively donating persistent footholds to adversaries who can bypass identity controls and sustain lateral movement and persistence.
Google fixes two new Chrome zero-days exploited in attacks

www.bleepingcomputer.com · 7 months ago

Google released emergency security updates to patch two high severity Chrome zero day vulnerabilities being exploited in the wild, tracked as CVE-2026-3909 and CVE-2026-3910. CVE-2026-3909 is an out of bounds write in Skia, the open source 2D graphics library, that can crash the browser or allow code execution, while CVE-2026-3910 is an inappropriate implementation flaw in the V8 JavaScript and WebAssembly engine. Fixes were rolled out to the Stable Desktop channel for Windows 146.0.7680.75, macOS 146.0.7680.76 and Linux 146.0.7680.75, and Google said updates may take days or weeks to reach all users.
Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Full Root Takeover

gbhackers.com · 7 months ago

There are nine newly disclosed vulnerabilities called CrackArmor that exploit a confused deputy implementation flaw in AppArmor, enabling unprivileged local users to bypass container isolation and gain full root control on affected Linux systems. Qualys Threat Research Unit reports the flaws have existed in the kernel since 2017 and affect more than 12.6 million enterprise Linux servers, with impacts including local privilege escalation, denial of service, container breakout, and security downgrades. No CVE identifiers have been officially assigned yet, and administrators are urged to apply vendor kernel patches, scan for exposed assets, and monitor AppArmor profile integrity until fixes are deployed.
Six Packagist Packages Linked to Trojanized jQuery Campaign

gbhackers.com · 7 months ago

Six malicious Packagist packages masquerading as OphimCMS themes shipped trojanized jQuery and other JavaScript that silently redirect visitors, exfiltrate page URLs, inject ads, and block analysis. The attacker embedded obfuscated malicious logic in bundled JavaScript while leaving PHP code and metadata looking benign, publishing 26 packages in total with only six carrying payloads and an estimated 2,750 installs. Victim sites were steered to gambling and adult content through a staged payload hosted on infrastructure linked to FUNNULL, a provider sanctioned by the U.S. Treasury in May 2025, and an FBI advisory associated the network with hundreds of thousands of malicious domains. Recommended mitigations include removing the malicious themes, auditing outbound traffic for connections to the hostile infrastructure, and inspecting bundled jQuery and vendor JavaScript for appended or inline obfuscated code where integrity checks are absent.
New Critical MediaTek Vulnerability Exposes Android Phone PINs to Theft in 45 seconds

gbhackers.com · 7 months ago

There is a hardware vulnerability in the MediaTek Dimensity 7300 Boot ROM that allows a physical attacker to bypass device security and steal device PINs, decrypt storage, and extract cryptocurrency seed phrases in about 45 seconds. Ledger Donjon researchers demonstrated the exploit using Electromagnetic Fault Injection on a Nothing CMF Phone 1 and recovered PINs and seed phrases from wallets including Trust Wallet, Kraken Wallet, Phantom, Base, Rabby, and Tangem. The flaw impacts phones that pair the Dimensity 7300 with Trustonic’s Trusted Execution Environment and is present in many budget and midrange devices from vendors such as Realme, Motorola, Oppo, Vivo, Tecno, and Nothing, affecting roughly a quarter of the global Android market. MediaTek released a January 2026 software update that mitigates specific exploitation paths but cannot fully remediate the silicon defect, and users are advised to apply patches immediately and move high value cryptocurrency assets to dedicated hardware wallets.
Iran-Linked Handala Ramps Up Wiper Attacks on Israeli, Western Targets

gbhackers.com · 7 months ago

Iran-linked hackers, known as Handala Hack and tracked as Void Manticore, COBALT MYSTIQUE, Storm‑1084, and Storm‑0842, have increased destructive wiper attacks targeting organizations in Israel and the United States. These attacks involve malware that permanently erases data and disrupt operations, differing from ransomware. The group utilizes identity-based attacks, stealing credentials through phishing and exploiting administrative tools like Microsoft Intune to remotely wipe devices and escalate privileges. Security experts advise strengthening identity security and maintaining offline backups to mitigate these risks.
Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries

thehackernews.com · 7 months ago

A court authorized international law enforcement operation dismantled SocksEscort, a criminal proxy service that enslaved residential and small business routers into a botnet to tunnel internet traffic and sell access to criminals. The service used AVrecon malware to infect devices by exploiting remote code execution and command injection flaws and to establish persistence by flashing custom firmware, with the malware targeting about 1,200 models from vendors including Cisco, D Link, Hikvision, Mikrotik, Netgear, TP Link and Zyxel. SocksEscort is estimated to have offered access to roughly 369,000 IPs in 163 countries since 2020, with nearly 8,000 infected routers listed as of February 2026 and 2,500 in the United States, and victims included individuals and businesses defrauded of amounts such as one million dollars in cryptocurrency and seven hundred thousand dollars from a manufacturing firm. Operation Lightning removed 34 domains and 23 servers across seven countries and froze three and a half million dollars in cryptocurrency.
OpenSSH GSSAPI Flaw Can Be Exploited to Crash SSH Child Processes

gbhackers.com · 7 months ago

A security vulnerability, tracked as CVE-2026-3497, has been identified in OpenSSH’s GSSAPI Key Exchange patch, impacting Linux distributions like Ubuntu and Debian. Attackers can trigger denial-of-service conditions and potentially leak sensitive data to the root monitor process using a single crafted packet, without authentication. The flaw results from an incorrect function call in the error-handling logic, leading to memory corruption and a process crash. System administrators are urged to update OpenSSH packages or disable the GSSAPIKeyExchange feature to mitigate the risk.
Fileless Remcos RAT Attack Uses JavaScript and PowerShell to Slip Past Detection

gbhackers.com · 7 months ago

A recent cyber campaign utilizes the Remcos RAT malware to bypass security measures through a fileless attack. The process begins with phishing emails containing JavaScript files that download and execute an AES-encrypted PowerShell script in memory, avoiding disk-based detection. This script then loads a.NET injector which hollows a legitimate Windows binary, aspnetcompiler.exe, to hide the Remcos RAT payload and execute it within a trusted process. The malware dynamically resolves APIs and decrypts configuration details from an embedded resource before establishing a connection to a command-and-control server.
Microsoft Copilot Email and Teams Summarization Flaw Opens Door to Phishing Attacks

gbhackers.com · 7 months ago

Microsoft Copilot, an AI assistant integrated into Microsoft 365 applications, is vulnerable to Cross Prompt Injection Attacks, or XPIA. Attackers can hide malicious instructions within emails that manipulate Copilot’s output, generating convincing phishing content. The Teams interface is particularly susceptible, while the Outlook “Summarize” button and Copilot pane are more cautious. This technique can trick users into clicking malicious links, potentially leading to credential phishing or even data exfiltration from internal systems like Teams, OneDrive, and SharePoint. Security teams are advised to educate users, implement DLP policies, monitor data retrieval, filter emails, and enforce web filtering to mitigate this risk.
Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

thehackernews.com · 7 months ago

Veeam has released updates to address critical vulnerabilities in its Backup & Replication software, allowing for potential remote code execution. Several flaws, including CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21708, CVE-2026-21669, and CVE-2026-21671, allow authenticated users to execute code or manipulate files on affected systems. Version 12.3.2.4465 and Backup & Replication 13.0.1.2067 contain the necessary patches. Experts advise users to immediately update to the latest version to prevent exploitation by threat actors.
10 Kennzahlen, die CISOs weiterbringen

www.csoonline.com · 7 months ago

Geht es um Security-Kennzahlen, sollten CISOs sich auf das Wesentliche fokussieren. Foto: Vadym Nechyporenko, shutterstock.com Die Security-Performance zu messen, gehört vielleicht nicht zu den aufregendsten Aufgaben eines CISOs, kann allerdings sehr nützlich sein, um eine ganze Reihe von Herausforderungen zu bewältigen. Neben der Erkenntnis darüber, wie effektiv ihre Security-Bemühungen sind, können Sicherheitsentscheider mit den richtigen Kennzahlen unter anderem auch strategisches Alignment mit dem Business demonstrieren. Um jedoch einen echten Nutzen aus den Metriken ziehen zu können, ist das oberste Gebot, sich auf diejenigen zu konzentrieren, die belegen, dass die Security das Business stützt. Kennzahlen, denen es an Bedeutung oder Kontext mangelt, sind hingegen zu vernachlässigen, wie Richard Absalom, Principal Research Analyst beim Information Security Forum, unterstreicht: “Man kann unzählige Dinge in Sachen Security Performance messen, was mit Blick auf Extraktion und Reporting viel Zeit, Mühe und Ressourcen kostet. Fragen Sie sich: Warum messen wir das? Wie hilft uns das? Welche Frage können wir damit beantworten? Wenn die Messung nicht dazu beiträgt, Stakeholdern oder Entscheidern wichtige Informationen zu liefern, wird sie sehr wahrscheinlich ignoriert.” 10 Security-Metriken, von denen CISOs profitieren Im Folgenden haben wir im Gespräch mit Experten und Entscheidern zehn Benefits identifiziert, die CISOs mit den jeweils richtigen Security-Metriken realisieren können. 1. Incident-Response-Metriken Mean Time to Detect ( MTTD ) oder Mean Time to Respond ( MTTR ) liefern beispielsweise quantitative Daten, die CISOs dabei unterstützen, objektive Entscheidungen zu treffen. Frank Kim, Fellow am SANS Institute, erklärt: “Indem sie wichtige Sicherheitsindikatoren analysieren und nachverfolgen, können CISOs Prioritäten setzen, Ressourcen zuweisen und sich auf die Bereiche konzentrieren, die am dringendsten optimiert werden müssen.” 2. Security-Investment-Metriken Beispielsweise zu wissen, wie hoch der Prozentsatz wichtiger Business-Initiativen mit eingebetteten Sicherheitsprozessen ist, kann CISOs dabei unterstützen, den Return on Investment (ROI) von Security-Initiativen gegenüber der Geschäftsleitung und den Stakeholdern nachzuweisen. Insofern aufgezeigt wird, wie diese Bemühungen zur Risikominderung und dazu beitragen, Zwischenfälle zu verhindern. “Die Stakeholder interessieren sich nicht für die Cyberrisiken, sondern die Geschäftsrisiken, die sich aus dem Cyberbereich ergeben”, konstatiert Brian Contos, CSO bei Sevco Security. Er fügt hinzu: “Genauer gesagt geht es dabei um Risiken im Zusammenhang mit Umsatz, Brands, Operations sowie ESG, Environmental, Social, Governance.” 3. Security-Awareness-Metriken In diesen Bereich fällt beispielsweise der Prozentsatz der Fachabteilungen, die an entsprechenden Programmen beteiligt sind. Diese Kennzahlen unterstützen dabei, zu ermitteln, ob im Unternehmen eine Security-Kultur existiert, oder entsteht. So lässt sich darstellen, wie effektiv entsprechende Initiativen auf die allgemeine Sicherheitslage des Unternehmens einzahlen, was für Sicherheitsentscheider traditionell eine Herausforderung darstellt. Fred Rica, ehemals Head of Cyber Practice bei KPMG und Partner beim Wirtschaftsprüfungsunternehmen BPM, erläutert: “CISOs, die dem Vorstand technische Kennzahlen präsentieren, schießen oft am Ziel vorbei, weil der Kontext fehlt. Dem Board mitzuteilen, dass 100.000 Events per Firewall blockiert wurden, wird ohne entsprechenden Kontext nicht fruchten.” 4. Vulnerability-Management-Metriken Metriken im Bereich Schwachstellenmanagement, wie das “Window of Exposure”, können CISOs dabei unterstützen, das Risikoprofil ihrer Organisationen besser zu verstehen und Bedrohungen aktiv zu begegnen. “Letztlich geht es darum, die zerbrochenen Fenster und unverschlossenen Türen eines Unternehmens anzugehen”, verbildlicht SANS-Experte Kim. “Vulnerability-Management-Metriken geben Aufschluss darüber, wie lange die Türen potenziell offenstehen und unterstützen dabei, tägliche Arbeitsabläufe zu etablieren, zum Beispiel im Bereich Scanning oder Patching.” 5. Security-Process-Improvement-Metriken Metriken zur Verbesserung von Sicherheitsprozessen erfassen den Fortschritt im Zeitverlauf und ermöglichen CISOs, spezifische Ziele zu setzen beziehungsweise zu verfolgen. Ein Beispiel für eine Kennzahl in diesem Bereich wäre der Prozentsatz von Vorfällen mit derselben wiederkehrenden Grundursache. “Dieser datengesteuerte Ansatz trägt zur kontinuierlichen Verbesserung der Sicherheitspraktiken bei und fördert eine Kultur der Verantwortlichkeit”, hält Kim fest. Anschließend könnten risikobasierte Metriken in Jahresberichte oder Corporate-Governance-Dokumente einfließen. 6. Security-Maturity-Metriken Metriken zum Security-Reifegrad, beispielsweise Capability Maturity Scores, lassen sich mit Branchen-Benchmarks (beispielsweise denen des Center for Internet Security ) oder auch früheren Ergebnissen abgleichen. Das ermöglicht Sicherheitsentscheidern, den Security-Reifegrad ihrer Organisation zu verstehen, um im Anschluss realistische Sicherheitsziele und -strategien zu entwickeln. Laut ISF-Chefanalyst Absalom sollten Sicherheitsverantwortliche nach Indikatoren und Metriken Ausschau halten, die Aufschluss darüber geben, wie gut die Organisation: Bedrohungen und gefährdete Assets identifiziert; die identifizierten Assets schützt; Bedrohungsereignisse erkennt; auf erkannte Ereignisse reagiert; sich nach Vorfällen erholt und deren Auswirkungen begrenzen kann. 7. Compliance-Metriken Da viele Vorschriften und Standards auch ein Reporting zu bestimmten Security-Metriken erfordern, ist es sinnvoll, über Compliance-Metriken zu verfügen, beispielsweise den Prozentsatz der Systeme, die mit bestimmten Anforderungen im Einklang stehen. Kim bringt es auf den Punkt: “Das erleichtert es, Compliance-Anforderungen zu erfüllen und potenzieller Strafzahlungen zu vermeiden.” 8. Threat-Detection-Metriken Kennzahlen im Bereich Bedrohungserkennung, wie die Anzahl der erkannten Vorfälle oder False-Positive/Negative-Raten, können als Frühwarnzeichen für potenzielle Sicherheitsvorfälle oder Schwachstellen in der Infrastruktur dienen. Das ermöglicht CISOs, Probleme aktiv anzugehen und größeren Sicherheitsverletzungen vorzubeugen. 9. Ressource-Utilization-Metriken Metriken zur Ressourcennutzung wie der prozentuale Anteil der Zeit, der für aktive gegenüber reaktiven Sicherheitsaufgaben aufgewendet wird, können CISOs in die Lage versetzen, ineffiziente Bereiche oder redundante Sicherheitskontrollen zu identifizieren. Das kann in der Konsequenz zu einer besseren Ressourcenzuweisung und damit zu Kostenoptimierungen führen. In Zeiten des immer noch ausgeprägten Security-Fachkräftemangels könnte das eine entscheidende Unterstützung für Sicherheitsverantwortliche darstellen. 10. Security-Transparency-Metriken Kennzahlen zur Security-Transparenz, etwa die Anzahl der dem Unternehmen mitgeteilten Sicherheitsvorfälle oder die Bewertungen der internen Stakeholder zur Security-Kommunikation, können das Vertrauen zwischen Security-Team und anderen Geschäftseinheiten stärken. “Wenn die Wirksamkeit von Sicherheitsmaßnahmen quantifiziert und transparent kommuniziert wird, stärkt das das Vertrauen in das Sicherheitsprogramm”, konstatiert SANS-Experte Kim. (fm) Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
Android Vulnerability Reproduction with OpenClaw

mp.weixin.qq.com · 7 months ago

Researchers have discovered a vulnerability in the widely used Atlassian Confluence collaboration platform. The flaw allows for unauthorized access and potential data breaches, stemming from insufficient input validation. Successful exploitation requires a user to be able to send HTTP requests to the Confluence server. This issue has been assigned the CVE identifier CVE-2023-39788.
GlassWorm V2 Analysis

gist.github.com · 7 months ago

NULL
Meta Delays Rollout of New A.I. Model After Performance Concerns

www.nytimes.com · 7 months ago

false
Telus Digital hit with massive data breach

www.csoonline.com · 7 months ago

Telus Digital, a business process outsourcing provider, experienced a significant cyberattack by the extortion group ShinyHunters. The attackers reportedly stole over one petabyte of data from Telus Digital and its customers, utilizing a strategic approach that involved long-term persistence, lateral movement, and controlled data exfiltration. Security experts emphasize that attackers are increasingly gaining access through trusted pathways rather than exploiting technical vulnerabilities, highlighting the need for organizations to focus on identity management, multi-factor authentication, data-centric monitoring, and behavioral analytics to prevent data theft. This incident underscores the shift in focus from ransomware prevention to protecting against data exfiltration.
Insights: Increased Risk of Wiper Attacks

unit42.paloaltonetworks.com · 7 months ago

Security researchers are tracking an increased risk of wiper attacks linked to the conflict with Iran, with incidents impacting organizations in Israel and the US. The Handala Hack group, assessed to be a state-directed front for Iran’s Ministry of Intelligence and Security, is using phishing and exploiting Microsoft Intune to gain access. Recommendations include implementing just-in-time access, limiting administrative account numbers, enhancing Azure security controls, securing administrative workstations, and maintaining offline backups to aid in recovery. Organizations should also focus on data governance, monitoring anomalous activity, and conducting regular security training.
Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia

unit42.paloaltonetworks.com · 7 months ago

A sustained espionage campaign, CL-STA-1087, originating from China, has been targeting Southeast Asian military organizations since 2020. Attackers use custom tools, including the AppleChris and MemFun backdoors and a credential harvester called Getpass, to gather intelligence and maintain network access. The threat actors employ sophisticated techniques like DLL hijacking and Pastebin to hide command and control server addresses. Palo Alto Networks recommends using their products for detection and prevention.
Why Post-Quantum Cryptography Can't Wait

www.darkreading.com · 7 months ago

There is a growing harvest-now, decrypt-later threat in which cybercriminals are quietly collecting encrypted data now to decrypt later when quantum computers can break current encryption. Organizations must audit cryptographic assets and data sensitivity to determine what requires long term protection and begin controlled pilots using NIST approved post quantum algorithms to measure performance and compatibility. Best practices include deploying hybrid encryption that combines traditional and quantum resistant schemes, testing across internal, cloud, and third party systems, and maintaining crypto agility with continuous oversight. Despite the risk, only half of organizations have taken necessary actions and only 14 percent report their infrastructure is ready, leaving delayed actors vulnerable to years of compromised archived data.
Canadian retail giant Loblaw notifies customers of data breach

www.bleepingcomputer.com · 7 months ago

Canadian retailer Loblaw recently experienced a data breach impacting a portion of its IT network. Hackers accessed basic customer information including names, phone numbers, and email addresses. The company has found no evidence of compromised financial data, health information, or account passwords but has logged customers out of their accounts as a precaution. Loblaw operates over 2,500 stores and has annual revenue of 45 billion dollars.
Iran MOIS Colludes With Criminals to Boost Cyberattacks

www.darkreading.com · 7 months ago

Iranian intelligence, specifically the Ministry of Intelligence and Security, is increasingly collaborating with cybercriminals to enhance its cyberattack capabilities and obscure its involvement. This includes utilizing commercial tools like the Rhadamanthys infostealer and integrating into ransomware-as-a-service and infostealer-as-a-service operations. This tactic allows Iran to leverage criminal infrastructure, tooling, and expertise, often at a lower cost than developing such resources independently, and complicates attribution for investigators. The collaboration has been observed in incidents like the Stryker attack, initially attributed to a pro-Palestine hacktivist group, but later linked to Iran’s Void Manticore APT.
England Hockey investigating ransomware data breach

www.bleepingcomputer.com · 7 months ago

England Hockey is investigating a potential data breach after the AiLock ransomware gang claimed responsibility for stealing data. The threat actor reportedly took 129 gigabytes of data and threatens to publish it unless a ransom is paid. England Hockey is working with internal teams and external specialists to determine the scope of the incident and is cooperating with law enforcement. AiLock is a relatively new ransomware operation that uses double-extortion tactics and employs ChaCha20 and NTRUEncrypt for file encryption.