Blahalla

Electric Eye – a Rust/WASM Firefox extension to detect AitM proxies via DOM analysis, TLS fingerprinting and HTTP header inspection

bytearchitect.io · 7 months ago

A new browser extension called Electric Eye is being developed to protect users from Adversary-in-the-Middle phishing attacks, specifically Evilginx. The extension examines various aspects of a webpage, including DNS, HTTP headers, TLS, and the DOM, to identify inconsistencies indicative of malicious activity. Electric Eye uses a risk scoring system based on observed indicators and is designed to be user-friendly. It currently achieves a 100 percent true positive rate against Evilginx and is awaiting approval for distribution.

Your Duolingo Is Still Talking to ByteDance: How Pangle Fingerprints You Across Apps After You Said No

www.buchodi.com · 7 months ago

Researchers discovered the Pangle SDK, owned by ByteDance, collects detailed device information even when users deny ad tracking through Apple's App Tracking Transparency (ATT) framework. This data, including exact storage capacity and boot timestamps, creates a unique device fingerprint across different apps, potentially circumventing ATT's purpose. The analysis of 874 Pangle events from 26 apps revealed that even with a zeroed IDFA, ByteDance can link user activity across apps using these fingerprinting signals. This practice potentially violates Apple's guidelines regarding device identification and user data privacy.

I replaced manual pen tests with automation. Here’s what I learned.

www.csoonline.com · 7 months ago

Traditional manual penetration testing has limitations including cost, time constraints, and a lack of continuous validation. Organizations are increasingly adopting automated penetration testing platforms, such as Pentera and NodeZero, which offer continuous, on-demand simulations and immediate feedback. These platforms reveal vulnerabilities that traditional CVSS severity scores may miss, highlighting actual attack paths and exposing gaps in security controls. Automated testing improves team capabilities, validates detection and response, and provides continuous security validation, though manual testing still holds value for specific scenarios.

Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool

thehackernews.com · 7 months ago

Salesforce is reporting increased threat actor activity targeting misconfigured Experience Cloud sites. Attackers are using a modified version of the AuraInspector tool, originally developed by Mandiant, to scan sites and extract data by exploiting overly permissive guest user settings. The activity is focused on customer configuration errors, not vulnerabilities in the Salesforce platform itself, and is linked to a group possibly associated with ShinyHunters. Salesforce recommends customers review and restrict guest user access and monitor logs for suspicious activity.

Signed malware posing as Teams and Zoom apps drops RMM backdoors

gbhackers.com · 7 months ago

Cybercriminals are using phishing campaigns to distribute malware disguised as legitimate applications like Microsoft Teams, Zoom, and Adobe Reader. These malicious files, signed with a compromised Extended Validation certificate from TrustConnect Software, install remote monitoring and management (RMM) backdoors such as ScreenConnect, Tactical RMM, and MeshAgent. The attackers use convincing emails and fake download pages to trick users into installing the RMM tools, which then establish persistent remote access and command-and-control connections. Security experts recommend strict controls for RMM tools, multifactor authentication, and blocking non-approved software signing chains to mitigate this threat.

When AI safety constrains defenders more than attackers

www.csoonline.com · 7 months ago

AI safety measures designed to prevent misuse are inadvertently hindering security professionals while attackers easily bypass these restrictions. Security teams are finding that AI tools block legitimate activities like phishing simulations and penetration testing, while attackers leverage jailbroken models and underground markets to generate increasingly sophisticated attacks, including AI-obfuscated phishing campaigns. This creates a significant defense gap, impacting employee training, research, and vulnerability assessments, and ultimately making organizations less secure. Solutions include authentication for authorized users and purpose-built security tools with controlled environments.

Signal Confirms Sophisticated Phishing Scheme Caused Account Compromises

gbhackers.com · 7 months ago

Signal has confirmed targeted phishing campaigns are causing account takeovers among high-profile individuals like government officials and journalists. The attacks involve manipulating users into sharing SMS verification codes and their Signal PIN through impersonation and psychological tactics, allowing attackers to register accounts on their devices. Signal’s infrastructure and encryption remain secure, with the breaches resulting from social engineering rather than technical vulnerabilities. The company advises users that Signal support will never request verification codes through any communication channel.

Hackers Exploit .arpa and IPv6 Infrastructure to Evade Phishing Defenses

www.neuracybintel.com · 7 months ago

NULL

Chinese APT Campaign Uses Middle East Lures to Target Qatar With PlugX

gbhackers.com · 7 months ago

Chinese state-linked cyber espionage groups are exploiting recent geopolitical tensions in the Middle East to target organizations in Qatar. Attackers rapidly deployed the PlugX backdoor and a previously unseen Rust-based malware loader using lures related to regional conflicts, such as missile strikes in Bahrain and attacks on Gulf energy infrastructure. These campaigns employed DLL hijacking techniques, including abuse of the NVDA screen reader, and often deploy Cobalt Strike for post-exploitation activities. The activity indicates an expanding operational focus for Chinese APT groups in the Gulf region, capitalizing on current events for intelligence gathering.

CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited

thehackernews.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has added three vulnerabilities to its list of actively exploited weaknesses. These include a server-side request forgery flaw in VMware Workspace One UEM, identified as CVE-2021-22054, a deserialization vulnerability in SolarWinds Web Help Desk, CVE-2025-26399, and an authentication bypass in Ivanti Endpoint Manager, CVE-2026-1603. Threat actors are currently exploiting the SolarWinds vulnerability, reportedly linked to the Warlock ransomware group, while the VMware vulnerability has been observed in a coordinated campaign. Federal agencies must apply patches for these flaws by mid-March of 2026.

Anthropic Files Lawsuit Against U.S. Government Over Claude Risk Designation

gbhackers.com · 7 months ago

false

GhostClaw Masquerades as OpenClaw in Bid to Plunder Developer Data

gbhackers.com · 7 months ago

A malicious npm package, @openclaw-ai/openclawai, masquerades as the legitimate OpenClaw CLI to deploy an infostealer and remote access trojan, nicknamed GhostClaw. The package uses social engineering to trick developers into entering their system passwords, which are then used to retrieve and execute a second-stage payload. GhostClaw harvests sensitive data, including SSH keys, cloud credentials, and AI agent configurations, and exfiltrates it via multiple channels. Once installed, it functions as a persistent RAT, enabling attackers to execute commands, clone browser profiles, and steal crypto keys.

Hackers Use Microsoft Teams to Manipulate Employees Into Allowing Remote Access

gbhackers.com · 7 months ago

Cybercriminals are targeting finance and healthcare organizations using a sophisticated attack chain involving Microsoft Teams and email bombing. Attackers impersonate IT support staff to trick employees into granting remote access via the Quick Assist tool, deploying a new backdoor called A0Backdoor. This malware uses DLL sideloading and complex techniques, including a time-based decryption and a hidden character, to evade detection and maintain stealth. The A0Backdoor then employs DNS tunneling to exfiltrate data through trusted public resolvers, disguising malicious communication as routine email traffic.

Dutch Intelligence Warns of Russian-Linked Campaign Targeting Signal and WhatsApp Accounts

www.neuracybintel.com · 7 months ago

NULL

Trojanized Red Alert App Spreads Spyware Through Smishing Campaign Targeting Israeli Users

www.neuracybintel.com · 7 months ago

NULL

U.S. Solar Installations Fell in 2025 as Trump Attacked Clean Energy

www.nytimes.com · 7 months ago

false

Last Week in Security (LWiS) - 2026-03-09

blog.badsectorlabs.com · 7 months ago

Several cybersecurity events occurred recently, including the discovery of a powerful iOS exploit kit capable of targeting devices from 2023, and direct attacks on UAE datacenter services using drones. A significant deal involves Ziff Davis selling Ookla and Downdetector for $1.2 billion. Researchers identified a critical authentication bypass vulnerability in pac4j-jwt, noted as CVE-2026-29000, and a pre-authentication SQL injection vulnerability in FortiClient EMS, CVE-2026-21643. New tools emerged, such as an evasion-as-a-service platform and a Windows malware emulation framework.

Beware! Fake CleanMyMac Website can steal your credential through malicious infostealers.

www.neuracybintel.com · 7 months ago

NULL

Security-Tools für KI-Infrastrukturen – ein Kaufratgeber

www.csoonline.com · 7 months ago

Tools, die die KI-Infrastruktur unter die Lupe nehmen, optimieren und absichern, liegen im Trend. Unser Ratgeber führt Sie zur richtigen AI-Security-Posture-Management-Lösung. Julien Tromeur | shutterstock.com Weil sich Generative-AI-Lösungen branchenübergreifend verbreiten, wächst das Sicherheitsbedürfnis der Anwender. Diesem gerecht zu werden, ist vor allem deshalb eine Challenge, weil die Technologie enormen Einfluss auf die IT-Infrastruktur und die Unternehmensdaten nimmt. Und weil kriminelle Cyberakteure längst erkannt haben, welches Potenzial für sie in diesem Umstand schlummert. Gefragt sind deshalb neue, breit gefächerte Schutz- und Notfallmaßnahmen und Sicherheitssoftware, die spezifisch darauf ausgelegt ist, KI-Infrastrukturen abzusichern. Das hat längst diverse Cybersecurity-Anbieter dazu bewogen, entsprechende Lösungen zu entwickeln. Oder bestehende Produkte mit entsprechenden Features anzureichern. Dieses Wachstumssegment des Security-Markts läuft auch unter der Bezeichnung “AI Security Posture Management”, kurz AI-SPM. In diesem Artikel erfahren Sie: was Security-Lösungen ausmacht, die KI-Infrastrukturen absichern. was AI-SPM-Tools leisten sollten und welche Anbieter und Produkte in diesem Bereich wichtig sind. CSPM, DSPM und AI-SPM AI Security Posture Management fokussiert darauf, die Integrität und Sicherheit von KI- und ML-Systemen zu gewährleisten. Dabei umfasst AI-SPM Strategien, Tools und Techniken, um Daten, Pipelines, Applikationen und Services mit Blick auf ihre Sicherheitslage: zu überwachen, zu bewerten und zu optimieren. Bisher wurden Security Posture Management Tools für zwei separate Bereiche entwickelt: Cloud Security Posture Management (CSPM-) Tools sollen den Cloud-Betrieb allgemein absichern, in erster Linie gegen Fehlkonfigurationen und Missbrauch. Data Security Posture Management (DSPM-) Tools sollen vor Datenlecks und Malware-Infektionen schützen. Das Aufkommen von künstlicher Intelligenz (KI) und Large Language Models (LLMs) hat Bedarf für eine dritte Produktkategorie geschaffen, die gemanagte KI-Cloud-Services und ihre SDKs (beispielsweise Hugging Face Transformer oder Azure Open AI) überwacht und KI-Modellmissbrauch verhindert, AI-SPM. Dass das nötig war, unterstreichen diverse Research-Erkenntnisse, -Beiträge und weitere Ressourcen: Eine Studie des API-Spezialisten Kong (Download gegen Daten) kommt zu dem Ergebnis, dass eine Mehrheit der Befragten Wege gefunden hat, Beschränkungen mit Blick auf die KI-Nutzung zu umgehen. Ein Viertel muss sich erst gar nicht mit so etwas wie Guidelines herumschlagen. Die Non-Profit-Organisation MITRE stellt mit seiner Adversarial Threat Landscape for Artificial Intelligence Systems (ATLAS) eine umfassende Datenbank mit Angriffstaktiken zur Verfügung, die auf “in the wild”-Beobachtungen beruht. Auch das MIT betreibt eine aktive Datenbank, die mehr als 1.600 Risiken in Zusammenhang mit KI-Systemen bereithält. Eine weitere Quelle, um sich mit KI-bezogenen Angriffsmethoden auseinanderzusetzen, bietet das 2023 von OWASP veröffentlichte LLM-Exploit-Ranking (PDF). Die Non-Profit-Organisation hat zudem eine Checkliste für GenAI-Sicherheit veröffentlicht. Sich mit diesen Quellen auseinanderzusetzen, empfiehlt sich, bevor Sie sich für ein Sicherheits-Tool oder -Feature aus dem Bereich AI-SPM entscheiden. Was Security Posture Management für KI leisten sollte Tools im Bereich AI Security Posture Management: bieten im Regelfall agentenlose Konfigurationen, greifen auf Cloud-basierte Modelle zu und belassen Daten auf den vorhandenen Plattformen. Letzteres dient sowohl der Sicherheit als auch dazu, die Verlagerung der damit verbundenen, massiven Datenbestände zu vermeiden. Darüber hinaus spielen bei Security-Tools für KI-Infrastrukturen natürlich auch KI-bezogene Funktionen eine Rolle. Zum Beispiel um große Datenmengen zu klassifizieren, zu tracken und gegen mögliche Missbrauchs- und Angriffsversuche abzusichern. Einige Anbieter haben ihre bestehenden CSPM- oder DSPM-Lösungen um AI-SPM-Features erweitert, inklusive Compliance-Prüfverfahren, Best Practices und Richtlinien, die alle drei Security-Posture-Management-Arten abdecken. Andere offerieren umfassendere Lösungen, die eine Vielzahl KI-bezogener Sicherheitsmaßnahmen beinhalten. Zum Beispiel, um: KI-Pipelines und Workloads schützen, zu erkennen, wenn KI-Modelle sensible Daten referenzieren, Trainingsdaten auf Manipulationen durch Dritte oder externe Applikationen zu überprüfen oder KI-Services und -Plattformen abzusichern. Wichtige AI-SPM-Anbieter Im Folgenden haben wir die AI-SPM-Produkte und -Features neun verschiedener Anbieter für Sie zusammengefasst. Sämtliche Lösungen versprechen, Ihre KI-Infrastruktur abzusichern, verlassen sich dazu jedoch auf unterschiedliche Ansätze. Dabei ist zu beachten, dass es sich um einen Markt handelt, der im Wachstum begriffen ist. Die Produkte sind also noch nicht so umfassend ausgestaltet und integriert, wie sie sein könnten. Zudem arbeiten diverse weitere Sicherheitsanbieter aktiv an ähnlichen Offerings. Cyera.io ist auf Datenklassifizierung spezialisiert und hat eine DSPM-Plattform im Angebot, die um AI-SPM-Features erweitert wird. Die Lösung verspricht beispielsweise Einblicke, auf welche Datenklassen und Data Stores Microsoft-Copilot-Nutzer zugreifen können. LegitSecurity hat sich auf die Fahnen geschrieben, das “AI Visibility Gap” schließen zu wollen. Dazu untersucht die AI-SPM-Plattform KI-Modelle, Code Repositories, kryptografische Secrets und andere KI-bezogene Instanzen. Auf dieser Grundlage entstehen schließlich Risk Scores, um entsprechend priorisieren zu können. Mit dieser Lösung können Sie beispielsweise nachvollziehen, welche User Github Copilot auf der Basis von unsicheren KI-Modellen verwenden. Microsoft stellt AI-Security-Posture-Management-Funktionen im Rahmen einer Preview für sein CSPM-Angebot zur Verfügung. Das fertige Produkt soll Ende 2024 zur Verfügung stehen und zum Einsatz kommen, um GenAI-Applikationen in Multi- oder Hybrid-Cloud-Szenarien abzusichern. Dazu wird zum Beispiel eine GenAI-Softwarestückliste (AI BOM) erfasst. Orca Security verspricht mit seiner Mehrzweck-Sicherheitsplattform unter anderem eine “Ende-zu-Ende”-AI-SPM-Lösung. Diese scannt unter anderem mehr als 50 verschiedene KI-Modellquellen und schlägt Alarm, wenn sie dort, oder in Trainingsdaten-Repositories, sensible Informationen oder Geheimnisse entdeckt. Palo Alto Networks hat Ende 2023 die Übernahme des DSPM-Spezialisten Dig Security abgeschlossen und diesen inzwischen vollständig integriert. Das Ergebnis heißt Prisma Cloud AI-SPM und ermöglicht zum Beispiel Top-Level-Scans der KI-Services von AWS, Google Cloud und Azure. Zudem hat der Sicherheitsanbieter MItte 2025 auch den KI-Sicherheitsanbieter Protect AI übernommen. Securiti.ai verspricht mit seinem Produkt “AI Security & Governance” Schutz für KI-Instanzen. Dieses ermöglicht zum Beispiel KI-Modellrisiken zu bewerten und zu klassifizieren, Compliance-Prüfungen vorzunehmen oder Kontrollmaßnahmen für Daten und KI-Systeme zu etablieren. Varonis hat seine Sicherheitsplattform ebenfalls um “AI Security” erweitert. Das ermöglicht unter anderem, risikobehaftete KI-Fehlkonfigurationen zu erkennen und zu beheben, KI-generierte Inhalte mit Sensibilitäts-Labels zu versehen sowie KI-Workloads oder Datenflüsse zu erkennen, die sensible Informationen beinhalten. Für Microsoft Copilot steht ein eigenes (aufpreispflichtiges) Modul zur Verfügung, demnächst sollen weitere für Salesforce Einstein und Google Gemini folgen. Wiz Security verfügt über einschlägige DSPM- und CSPM-Erfahrungswerte und hat auch eine dedizierte KI-SPM-Lösung im Angebot. Diese verspricht zum Beispiel umfassende Einblicke in KI-Pipelines sowie Detektions-Möglichkeiten für Angriffspfade oder Fehlkonfigurationen. Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.

Hacker abusing .arpa domain to evade phishing detection, says Infoblox

www.csoonline.com · 7 months ago

A new phishing technique has emerged that combines IPv6 tunneling and abuse of the.arpa domain to bypass security defenses. Hackers are exploiting a vulnerability in DNS record management systems to create A records for reverse DNS names, allowing them to host malicious websites on domains that shouldn't resolve to an IP address. This tactic circumvents security measures that rely on domain reputation and blocklists, and has been used to redirect victims to phishing sites requesting credit card information. Security providers recommend monitoring DNS traffic and examining web traffic origins to detect and prevent this abuse.

Microsoft Teams phishing targets employees with A0Backdoor malware

www.bleepingcomputer.com · 7 months ago

Cybercriminals are targeting employees at financial and healthcare organizations through Microsoft Teams. Attackers initiate contact using social engineering, posing as IT support to gain remote access via Quick Assist. They then deploy a new backdoor called A0Backdoor, utilizing digitally signed MSI installers and DLL sideloading techniques to evade detection. Communication with the command-and-control server is masked within DNS traffic.

Anthropic Sues Department of Defense Over ‘Supply Chain Risk’ Label

www.nytimes.com · 7 months ago

false

Google: Cloud attacks exploit flaws more than weak credentials

www.bleepingcomputer.com · 7 months ago

Hackers are increasingly exploiting newly disclosed software vulnerabilities to breach cloud environments, with the time between vulnerability disclosure and attack shrinking to just days. Exploits now account for nearly half of all intrusions, with remote code execution flaws like those in React2Shell (CVE-2025-55182) and XWiki (CVE-2025-24893) being frequently leveraged. Attackers are also using compromised identities and techniques like phishing to gain access, often targeting cloud platforms for data exfiltration and long-term persistence. North Korean actors have also used fraudulent identities and malicious archives to steal cryptocurrency and gain access to sensitive systems.

Dutch govt warns of Signal, WhatsApp account hijacking attacks

www.bleepingcomputer.com · 7 months ago

Russian state-sponsored hackers are targeting government officials, military personnel, and journalists in a phishing campaign impacting Signal and WhatsApp accounts. Attackers are using social-engineering techniques to trick users into sharing verification codes and Signal PINs, allowing them to take over accounts and monitor messages. Another method involves malicious QR codes that link attacker devices to victim accounts, granting access to messages and enabling impersonation. Users are advised to verify the legitimacy of invitations, links, and QR codes, and regularly review linked devices on their accounts.

White House Cyber Strategy Prioritizes Offense

www.darkreading.com · 7 months ago

The White House released a new cyber strategy prioritizing offensive capabilities and deregulation to assert American dominance in cyberspace. A new executive order aims to disrupt transnational criminal organizations involved in ransomware and other cybercrimes through a dedicated National Coordination Center unit. The strategy emphasizes preemption, targeting adversaries before attacks materialize, and utilizes a range of cyber capabilities, including recent operations against Iran and Venezuela. The document outlines six pillars, including detecting adversaries, streamlining regulations, modernizing government networks, hardening critical infrastructure, ensuring technological leadership, and developing the cybersecurity workforce.

Autonomous agent traffic as an emerging attack surface

www.usevigil.dev · 7 months ago

NULL

Mobile spyware campaign impersonates Israel's Red Alert rocket warning system

www.acronis.com · 7 months ago

A cyber campaign is exploiting geopolitical tensions by distributing a fake version of Israel's Red Alert rocket warning app. Attackers use SMS messages to trick users into installing the malicious application, which steals sensitive data including contacts, SMS messages, location, and device account information. The malware bypasses Android security measures and uses techniques to hide its presence. Users are advised to verify SMS senders, check app permissions, and only install applications from trusted sources.

'InstallFix' Attacks Spread Fake Claude Code Sites

www.darkreading.com · 7 months ago

Cybercriminals are using a technique called InstallFix to distribute the Amatera Stealer malware by creating fake installation pages for Anthropic's Claude Code and other AI coding tools. Malicious actors use Google-sponsored links to lure users into copying and pasting fraudulent install commands, which then deploy the malware, potentially compromising developer credentials and enterprise environments. This tactic exploits the common practice of directly executing commands from websites, and attackers are leveraging the rapid adoption of AI tools to target a broader, less security-conscious audience. Researchers caution users to verify the authenticity of command sources before execution to avoid potential compromise.

Anthropic sues Pentagon over national security risk label

www.washingtonpost.com · 7 months ago

Anthropic has filed a lawsuit against the Trump administration. The lawsuit challenges a government order that prevents military contractors from working with the AI company. The order was issued after President Trump directed agencies to cease using Anthropic’s chatbot, Claude, due to concerns about its potential use in warfare. Anthropic claims the order is unlawful and seeks a federal judge's intervention.

Are We Ready for Auto Remediation With Agentic AI?

www.darkreading.com · 7 months ago

false

Ericsson US discloses data breach after service provider hack

www.bleepingcomputer.com · 7 months ago

Ericsson US recently disclosed a data breach impacting an undisclosed number of employees and customers. Attackers accessed a service provider who stored personal data for Ericsson, with unauthorized access occurring between April 17 and April 22, 2025. The exposed information includes names, addresses, Social Security Numbers, and financial and medical information. Affected individuals in Texas number 4,377 and are being offered free identity protection services.

Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credentials

thehackernews.com · 7 months ago

A malicious npm package disguised as an OpenClaw installer, named "@openclaw-ai/openclawai," has been discovered on the npm registry. The package uses social engineering tactics, including a fake command-line interface and iCloud Keychain prompt, to steal sensitive data such as macOS Keychain databases, browser data, cryptocurrency wallet information, and developer credentials. It then establishes a persistent remote access trojan, enabling attackers to control the compromised system and exfiltrate data through various channels including Telegram and GoFile.io. The package also monitors clipboard content for sensitive information and clones browser sessions to maintain authenticated access.

CVE program funding secured, easing fears of repeat crisis

www.csoonline.com · 7 months ago

A funding crisis that threatened the Common Vulnerabilities and Exposures Program, a cornerstone of cybersecurity, has been resolved. The Cybersecurity and Infrastructure Security Agency and MITRE Corporation have renegotiated the contract, moving it to a protected funding line within CISA’s budget. This shift elevates the program from a discretionary item to a core operational program, addressing concerns about transparency and long-term stability. While the contract details remain largely undisclosed, CISA is committing to modernization and international partnerships, prompting discussions about alternative systems and governance models.

Microsoft Teams will tag third-party bots trying to join meetings

www.bleepingcomputer.com · 7 months ago

false

ShinyHunters claims ongoing Salesforce Aura data theft attacks

www.bleepingcomputer.com · 7 months ago

Salesforce customers are facing data theft attacks targeting misconfigured Experience Cloud platforms. Hackers are exploiting vulnerabilities in guest user access controls to query sensitive data without authentication. The extortion gang ShinyHunters claims responsibility for compromising hundreds of organizations, including many in the cybersecurity sector, beginning in September of 2025, and has modified an open-source auditing tool, AuraInspector, for reconnaissance. Salesforce recommends customers audit guest user permissions, disable guest access to public APIs, and monitor logs for unusual activity.

Cybersecurity M&A Roundup: 42 Deals Announced in February 2026

www.securityweek.com · 7 months ago

false

Built an Automated SOC Pipeline That Thinks for Itself, AI-Powered Multi-Pass Threat Hunting using Analyzers

aradhyacp.in · 7 months ago

false

Security Risk Advisors Releases “The Purple Perspective 2026” Report

gbhackers.com · 7 months ago

false

FBI warns of phishing attacks impersonating US city, county officials

www.bleepingcomputer.com · 7 months ago

The Federal Bureau of Investigation is alerting businesses and individuals to phishing attacks where criminals impersonate city and county planning officials. These scams target those with pending land-use permits, requesting payment of fraudulent fees through wire transfer, peer-to-peer payments, or cryptocurrency. The FBI advises verifying the legitimacy of messages by checking email domains and contacting government offices directly. Previously, the FBI has warned of impersonations of government officials, IC3 employees, and the use of AI-generated audio in voice phishing attacks.

Anthropic Sues Pentagon Over ‘Supply Chain Risk’ Label

www.nytimes.com · 7 months ago

false

UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File to Work Device

thehackernews.com · 7 months ago

A North Korean threat actor, tracked as UNC4899, targeted a cryptocurrency organization in 2025, resulting in millions of dollars in cryptocurrency theft. The attack began with social engineering, tricking a developer into transferring a malicious file to their work device via AirDrop. Attackers then exploited DevOps workflows, compromised a bastion host, and employed living-off-the-cloud techniques to escalate privileges, steal credentials, and manipulate customer accounts to facilitate the theft. Google recommends organizations strengthen identity validation, restrict data transfers, and enhance cloud environment isolation to mitigate similar risks.

The Former Coal Miner in the Middle of the A.I. Data Center Boom

www.nytimes.com · 7 months ago

false

Why Password Audits Miss the Accounts Attackers Actually Want

www.bleepingcomputer.com · 7 months ago

Password audits often miss critical security risks by focusing solely on password complexity and expiry policies. Attackers frequently target over-privileged users, forgotten accounts, service accounts, and credentials already exposed in breaches, which traditional audits fail to identify. To improve security, audits should incorporate breached password screening, prioritize high-value accounts, include dormant and service accounts, and employ continuous monitoring. Solutions like Specops Password Policy and Specops Password Auditor can assist with these enhanced auditing processes.

Microsoft still working to fix Windows Explorer white flashes

www.bleepingcomputer.com · 7 months ago

false

Using cookies to hack into a tech college's admission system

eaton-works.com · 7 months ago

A vulnerability at the Sri Krishna College of Engineering and Technology in India allowed unauthorized access to student admission data. The college’s admission system, SparK, lacked authentication on its APIs, enabling an attacker to manually insert a cookie and gain access to 4,110 student records. Exposed information included names, addresses, Aadhaar numbers, medical details, grades, income levels, and sensitive documents, impacting both students and their parents. The vulnerability was resolved by the college within a week, with confirmation received by India’s Computer Emergency Response Team.

⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware

thehackernews.com · 7 months ago

There were multiple high-profile incidents this week including the law enforcement and industry takedown of the Tycoon2FA service and LeakBase, the discovery of a Qualcomm graphics buffer over-read tracked as CVE-2026-21385 being exploited in the wild, and Google's disclosure of the Coruna iOS exploit kit that uses five full exploit chains and 23 exploits against iOS 13.0 through 17.2.1. The report flags trending vulnerabilities that organizations should prioritize patching, naming CVE-2026-2796 for Firefox alongside other notable entries such as CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 for AWS-LC and CVE-2026-28289 for Mail2Shell. Researchers also detailed the AirSnitch technique that can bypass Wi-Fi client isolation and warned of AI-assisted vibeware used by Transparent Tribe to generate polyglot binaries for targeted attacks. While defenders achieved meaningful takedowns, the coverage warns the cybercrime ecosystem adapts quickly and urges immediate patching and heightened vigilance.

Unpinched - Instant point-in-time detection of PinchTab and agentic browser bridge artifacts.

helixar.ai · 7 months ago

Helixar Labs has released several open-source AI security tools to help teams secure Model Context Protocol deployments. The MCP Security Checklist provides structured security controls across seven domains, while Sentinel is a CLI scanner for identifying misconfigurations in MCP server infrastructure. Additionally, Unpinched is a tool for detecting PinchTab artifacts. Future projects include Kubernetes manifest scanning and agent behavioral baselining toolkits, and these tools are provided as-is with no guarantee of complete coverage.

Fake CleanMyMac Site Spreads SHub Stealer, Targets Crypto Wallets

gbhackers.com · 7 months ago

Hackers are using a fake CleanMyMac website to distribute the SHub Stealer, an infostealer that targets cryptocurrency wallets and sensitive data on macOS devices. The attack involves tricking users into pasting a command into Terminal that downloads and executes a malicious script, bypassing standard security protections. SHub steals data from numerous browsers and crypto wallets, including Exodus, Atomic Wallet, Ledger Live, and Trezor Suite, and also installs persistent backdoors within those wallet applications. The malware communicates with a command-and-control server at res2erch-sl0ut[.]com and uses a builder field called BUILDNAME to track victims.

InferShield v1.0 – Zero-Custody OAuth Proxy: Client-Side Token Encryption for AI Workflows

blog.infershield.io · 7 months ago

false

ClickFix Attack Uses Windows Terminal to Evade Detection

www.securityweek.com · 7 months ago

A new ClickFix attack is evading detection by instructing users to utilize Windows Terminal instead of the traditional Run dialog. Attackers are guiding victims to open Windows Terminal directly, bypassing protections and creating a more trustworthy appearance. This technique leads to the execution of malicious PowerShell commands, often resulting in Lumma Stealer infections or, in some cases, batch scripts that harvest sensitive data from web browsers. A related attack, InstallFix, uses cloned websites to deliver malicious commands and also leads to information-stealer infections.