Blahalla

Teenage hacker myth primed for a middle-age criminal makeover

www.csoonline.com · 7 months ago

A recent analysis of cybercrime cases reveals a shift away from the traditional image of teenage hackers. Cybercriminals are increasingly older, with the peak age range for involvement being 35 to 44, accounting for 37% of cases. These older offenders are more likely to engage in profit-motivated activities like cyber extortion, malware deployment, and money laundering, often operating within organized syndicates that require business acumen and experience. The analysis suggests a career path within cybercrime, with younger individuals often providing initial access before experienced adults handle the high-stakes operations.

FBI investigates breach of surveillance and wiretap systems

www.bleepingcomputer.com · 7 months ago

The Federal Bureau of Investigation is investigating a breach of its systems used to manage surveillance and wiretap warrants. The agency confirmed suspicious activity was identified and addressed, though details remain limited. This incident is potentially linked to the Salt Typhoon hacking group, which recently compromised U.S. telecommunications networks and accessed private communications of government officials. Previous incidents include a 2021 hack of FBI email servers and a 2023 investigation involving a New York Field Office computer system.

New Linux Rootkits Leverage Advanced eBPF and io_uring Techniques for Stealthy Attacks

gbhackers.com · 7 months ago

New Linux rootkits are increasingly employing advanced kernel interfaces to evade detection. Attackers are exploiting eBPF, initially designed for kernel tracing, to hook system calls and execute code without requiring kernel modules, bypassing traditional security tools like rkhunter and Secure Boot. Additionally, iouring, a high-performance asynchronous I/O interface, is being leveraged to batch system operations and obscure malicious activity from endpoint detection and response systems. These techniques, demonstrated by tools like TripleCross, Boopkit, and RingReaper, represent a shift towards living-off-the-land attack methods.

China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks

thehackernews.com · 7 months ago

A China-linked advanced persistent threat, known as UAT-9244, has been targeting telecommunications infrastructure in South America since 2024. The group is associated with FamousSparrow and shares targeting similarities with Salt Typhoon. Attack chains involve three previously unknown implants: TernDoor for Windows, PeerTime for Linux, and BruteEntry for network edge devices. TernDoor utilizes DLL side-loading, PeerTime employs a peer-to-peer network for command and control, and BruteEntry facilitates brute-force attacks against Postgres, SSH, and Tomcat servers.

China-Nexus Hackers Target Telecommunication Providers with New Malware Attack

gbhackers.com · 7 months ago

A China-linked threat actor, UAT-9244, is targeting telecommunications providers in South America, exhibiting similarities to FamousSparrow and Tropic Trooper. The group employs a three-stage malware arsenal including TernDoor, a custom Windows backdoor utilizing DLL side-loading and an embedded driver for evasion. PeerTime, a Linux backdoor leveraging BitTorrent for communication, and BruteEntry, a GoLang-based scanner, are also used to compromise systems and establish proxy nodes for automated scanning of SSH, Postgres, and Tomcat servers. The attackers use scheduled tasks and custom scripts for persistence, and report successful intrusions using JSON formatted data.

Challenges and projects for the CISO in 2026

www.csoonline.com · 7 months ago

false

Zero-day exploits hit enterprises faster and harder

www.csoonline.com · 7 months ago

Zero-day attacks are increasing, driven by Chinese state hackers and commercial surveillance vendors. Google’s Threat Intelligence Group tracked 90 exploited zero-day vulnerabilities last year, with enterprise software and security devices being primary targets. Financially motivated groups are also increasingly leveraging zero-days, with ransomware gangs exploiting vulnerabilities in Oracle E-Business Suite (CVE-2025-61882, CVE-2025-61884), GoAnywhere MFT (CVE-2025-10035), WinRAR (CVE-2025-8088), and others. Experts warn that AI will further accelerate exploitation and recommend organizations prioritize threat awareness, segmentation, and rapid patching procedures.

Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer

thehackernews.com · 7 months ago

Microsoft has identified a new social engineering campaign called ClickFix that uses Windows Terminal to trick users into running malicious commands. The campaign bypasses security measures designed for the Windows Run dialog by leveraging the legitimacy of Windows Terminal, guiding users through a series of steps to download and execute Lumma Stealer malware. This involves decoding scripts, setting up persistence, and deploying the stealer by injecting it into browser processes. The attack chain utilizes techniques like LOLBin abuse and etherhiding, targeting stored credentials and exfiltrating data.

Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV Catalog

thehackernews.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities to its catalog of known exploited vulnerabilities. Hikvision products are affected by a privilege escalation vulnerability, CVE-2017-7921, which has already been seen in exploit attempts. Rockwell Automation’s Studio 5000 Logix Designer, RSLogix 5000, and Logix Controllers are impacted by CVE-2021-22681, an insufficiently protected credentials vulnerability. Federal agencies are directed to address these vulnerabilities by March 26, 2026, and all organizations are encouraged to prioritize remediation.

FBI Detains U.S. Government Contractor in Massive $46 Million Fraud Scheme

gbhackers.com · 7 months ago

A U.S. government contractor, John Daghita, has been arrested for allegedly stealing over 46 million dollars in cryptocurrency from the United States Marshals Service. The arrest occurred on Saint Martin following a joint operation between the FBI and French tactical units. Law enforcement used blockchain forensics to track the stolen funds and ultimately locate Daghita. The incident highlights the need for stricter access controls and security measures when handling digital assets within government agencies.

WordPress Membership Plugin Flaw Lets Attackers Create Admin Accounts

gbhackers.com · 7 months ago

A critical security vulnerability allows attackers to create administrator accounts on WordPress sites using the User Registration & Membership plugin. The flaw, identified as CVE-2026-1492, affects versions up to 5.1.2 and requires no authentication to exploit, earning a CVSS severity score of 9.8. Attackers can inject an administrator role during registration, granting them full control over the website. Users are urged to update to version 5.1.3 or newer and audit user accounts, as this plugin has a history of security issues including CVE-2026-1779.

Google Uncovers 90 Zero-Day Vulnerabilities Under Active Exploitation in 2025

gbhackers.com · 7 months ago

Google's Threat Intelligence Group reported ninety zero-day vulnerabilities were actively exploited during 2025. Attackers increasingly targeted enterprise software, security appliances, and mobile operating systems, with commercial surveillance vendors now surpassing state-sponsored groups in zero-day exploitation. Financially motivated groups exploited vulnerabilities such as CVE-2025-61882, CVE-2025-8088, CVE-2025-40602, CVE-2025-21042, and CVE-2025-21590. Experts warn that artificial intelligence will likely accelerate vulnerability discovery and require proactive defensive measures.

7 Anzeichen für akuten MSSP-Bedarf

www.csoonline.com · 7 months ago

Managed Security Service Provider können das Sicherheitsniveau nachhaltig steigern. Godlikeart | shutterstock.com Ein Managed Security Service Provider (MSSP) bietet seinen Kunden ein umfassendes Spektrum an Sicherheits-Services. Als Drittanbieter kann ein MSSP die Arbeitsbelastung der internen IT-Teams deutlich reduzieren und Zeit freisetzen, um sich mit essenziellen Unternehmensprozessen und strategischen Überlegungen auseinanderzusetzen. Darüber hinaus kann ein MSSP unter anderem auch dazu beitragen, Qualifikationslücken zu schließen und Alarmmeldungen zu reduzieren. Die folgenden sieben Anzeichen deuten darauf hin, dass Ihr IT-Team die Grenze seiner Belastbarkeit erreicht oder bereits überschritten hat. In diesem Fall sollten Sie dringend in Erwägung ziehen, mit einem MSSP zusammenzuarbeiten. 1. Unzureichender Schutz Ein MSSP bietet Zugang zu Sicherheitssupport auf Expertenniveau, ganz ohne ein internes Team aufbauen und unterhalten zu müssen. “Managed Security Service Provider bieten Tools, Knowhow und Rund-um-die-Uhr- Monitoring. Das können die meisten Unternehmen nicht so einfach intern umsetzen”, meint Gyan Chawdhary, Gründer und CEO des Cybersecurity-Schulungsanbieters Kontra. Ein MSSP könne sowohl Bedrohungen frühzeitig erkennen als auch gewährleisten, dass auf Vorfälle eine schnelle Reaktion folge, so der Manager. Dabei sollten Sicherheitsentscheider nicht nur auf Tools achten, sondern auch auf “weiche” Faktoren, rät Chawdhary: “Was wirklich zählt, sind Erfahrung, Zuverlässigkeit und die Kommunikationsfähigkeit eines MSSP. Sie brauchen einen Anbieter, der Ihre Branche versteht, schnell reagiert, wenn etwas schief geht, und transparent darüber informiert, was er tut und warum.” Der CEO warnt jedoch, dass MSSPs zwar im Umgang mit technischen Problemen und Bedrohungen versiert sind, aber nicht alles lösen können: “Eine schwache Sicherheitskultur, schlechte interne Richtlinien oder Insider-Bedrohungen liegen oft außerhalb ihrer Kontrolle.” 2. Lähmende Warnmeldungen Wenn Ihr SOC-Team täglich 300 Warnmeldungen ignoriert und manuell triagiert, ist das ein deutliches Zeichen dafür, dass Sie einen Managed Security Service Provider in Betracht ziehen sollten. Das sieht auch Toby Basalla, Gründer und Principal Data Consultant bei Synthelize, so. “Wenn Chaos herrscht, wer weiß dann noch, welche Red Flags wirklich ernst zu nehmen sind? Sie würden wahrscheinlich auch nicht Daten rund um die Uhr ohne Redundanz verarbeiten. Mit Blick auf Security verhält es sich nicht anders.” 3. Brandbekämpfung First Wenn sich das interne Team nicht nur schwer damit tut, Alerts zu bewältigen, sondern auch damit, zeitnah auf Vorfälle zu reagieren oder mit den Compliance-Anforderungen Schritt zu halten, ist das ebenfalls ein Warnsignal für akuten MSSP-Bedarf. Ensar Seker, CISO beim Sicherheitsanbieter SOCRadar, erläutert, welche Folgen in so einem Fall drohen: “Wenn interne Teams von der schieren Menge der operativen Aufgaben überwältigt sind und sich nicht auf die strategische Verteidigung konzentrieren können, ist Burnout unausweichlich.” Laut Seker sollten Unternehmen, die MSSPs evaluieren vor allem auf Erfahrung, Transparenz und Integrationsbereitschaft achten: “Suchen Sie nach Anbietern, die detaillierte SLAs, Echtzeit-Transparenz bei Warnmeldungen, klare Eskalationswege und native Integrationen bieten. Ebenso wichtig ist eine enge kulturelle und kommunikative Abstimmung. Der MSSP muss sich wie eine Erweiterung Ihres Teams anfühlen, nicht wie eine Black Box.” 4. Keine internen Ressourcen Viele kleinere Unternehmen können es sich schlicht nicht leisten, ein Team von Cybersicherheitsspezialisten in Vollzeit zu beschäftigen. Das macht diese Firmen besonders anfällig für sämtliche Arten von Cyberangriffen. Einen Managed Security Service Provider zu engagieren, bietet einen Ausweg aus dieser Situation, wie Trevor Young, Chief Product Officer bei Security Compass, erklärt: “MSSPs können Skaleneffekte, proaktive Threat Intelligence und ein tiefgehendes Verständnis der Security Best Practices bieten.” Der größte Fehler, den Unternehmen bei der Suche nach einem MSSP machen können, ist nach Meinung des Produktentscheiders, das als rein kostenorientierte Entscheidung zu betrachten. Weitere häufige Fehler sind laut Young in diesem Zusammenhang, sämtliche Sicherheits-Tasks an einen MSSP auszulagern, ohne zuvor eine ordnungsgemäße Due Diligence durchzuführen: “Unternehmen versäumen es oft, ihre Sicherheitsanforderungen, die erwarteten Ergebnisse und den Umfang der Dienstleistungen klar zu definieren. Das führt zu falschen Erwartungen und unzureichendem Schutz.” 5. Interner Wissensmangel Wenn ein internes Team immer wieder auf Fragen stößt, die es nicht einhundertprozentig beantworten kann, ist es möglicherweise ebenfalls an der Zeit, die Hilfe eines Managed Security Provider in Anspruch zu nehmen. “Selbst wenn nur in einem oder zwei Cybersecurity-Bereichen spezifisches Wissen fehlt, kann das zu erheblichen Versäumnissen führen und das Potenzial für Effizienzsteigerungen verringern”, hält Aimee Simpson, Director beim Sicherheitsanbieter Huntress, fest. In Simpsons Erfahrung können insbesondere kleine IT-Teams in vielen Fällen bereits mit grundlegenden Cybersicherheitsaufgaben überlastet sein. “Ein MSSP kann Ihr Team entlasten, sodass es sich darauf konzentrieren kann, die IT-Sicherheit zu optimieren, statt sie nur aufrechtzuerhalten.” 6. Kein Schutz nach Feierabend Für Unternehmen, die nach einer 24/7-Sicherheitslösung suchen, bietet ein Managed Security Service Provider eine praktische und in der Regel erschwingliche Komplettlösung. “Der Umfang der Betreuung, die ein MSSP bietet, stellt an sich bereits eine erhebliche Verbesserung der Sicherheitslage dar”, meint Huntress-Managerin Simpson. CPO Young empfiehlt an dieser Stelle: “Suchen Sie nach einem MSSP, der eine umfassende Palette von Dienstleistungen anbietet und der sich dazu verpflichtet, neuen Bedrohungen einen Schritt voraus zu sein.” 7. Schmerzhaftes Reporting “Reportings stellen für viele Unternehmen einen erheblichen Mehraufwand dar”, konstatiert Tony Anscombe, Chief Security Evangelist beim Sicherheitsdienstleister ESET. Insbesondere Unternehmen, die aufgrund ihres Standortes einer Meldepflicht von Cybervorfällen unterliegen, müssten unter Umständen ganze Teams beschäftigen, um die damit zusammenhängenden Reporting-Tasks abdecken zu können. “Diese Belastung lässt sich wahrscheinlich am effizientesten durch einen Managed Security Service Provider oder ein externes Cyber-Incident-Response-Team bewältigen, das mit den spezifischen Berichtsmethoden und -anforderungen vertraut ist”, meint der Sicherheitsexperte. Darüber hinaus ist Anscombe der Ansicht, dass ein gutes MSSP-Paket neben Meldepflichten und Reportings auch einen Incident-Response-Plan und regelmäßiges Security-Testing umfassen sollte: “So lässt sich sicherzustellen, dass Patches und Software-Updates schnell und effektiv angewendet werden.” (fm) Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.

Europa im Visier von Cyber-Identitätsdieben

www.csoonline.com · 7 months ago

More than half of cyberattacks in Europe now originate from compromised cloud or email accounts, a significant shift from traditional network intrusions. Germany is the most targeted country, particularly impacting manufacturers, due to the dissolving of traditional network boundaries through cloud adoption and hybrid work models. Threat actors, including Lazarus (North Korea), ShadowPad (China), and Akira, are increasingly targeting sensitive sectors like healthcare, finance, and energy, exploiting vulnerabilities like the 48,185 CVEs documented in 2025. Darktrace recommends continuous monitoring of privileged accounts and heightened vigilance for unusual VPN activity to detect and contain these evolving threats.

House panel marks up kids digital safety act amid Democrat backlash

therecord.media · 7 months ago

false

LeakBase marketplace unplugged by cops in 14 countries

www.csoonline.com · 7 months ago

Law enforcement agencies across 14 countries have seized the LeakBase cyberforum, a marketplace for stolen data and cybercrime tools. The operation, which began March 3rd, resulted in arrests and the capture of a database containing sensitive information like usernames, passwords, credit card numbers, and bank account details. Authorities are actively working to identify additional offenders and disrupt their operations, but experts caution that the impact may be limited due to the resilience of cybercriminal networks. The takedown follows a recent dismantling of the Tycoon2FA phishing-as-a-service infrastructure.

Pentagon Officially Notifies Anthropic It Is a ‘Supply Chain Risk’

www.nytimes.com · 7 months ago

false

S.E.C. Settles Its Case Against Justin Sun, an Investor in the Trumps’ Crypto Coins

www.nytimes.com · 7 months ago

false

Chinese state hackers target telcos with new malware toolkit

www.bleepingcomputer.com · 7 months ago

Chinese state-linked hackers, known as UAT-9244, have been targeting telecommunication service providers in South America since 2024. Researchers have linked this activity to the FamousSparrow and Tropic Trooper groups, using previously unknown malware. This includes TernDoor, a Windows backdoor employing DLL side-loading; PeerTime, a Linux backdoor utilizing BitTorrent for command and control; and BruteEntry, a tool used to create proxy infrastructure for scanning and brute-forcing access to systems. Cisco Talos has released indicators of compromise to help defenders detect and prevent these attacks.

Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware

www.bleepingcomputer.com · 7 months ago

Threat actors have been exploiting Microsoft Bing’s AI-powered search results to distribute malware disguised as legitimate OpenClaw installers. Malicious GitHub repositories, posing as OpenClaw installers, were recommended by Bing AI, leading users to download files containing information stealers and proxy malware. The attackers used fake repositories and copied code from legitimate projects to appear trustworthy and employed malware like Atomic Stealer and GhostSocks, with Vidar Stealer connecting to Telegram and Steam for command and control. These malicious installers targeted both macOS and Windows users, and affected files were detected by endpoint security solutions.

Nation-State Actor Embraces AI Malware Assembly Line

www.darkreading.com · 7 months ago

A Pakistan-linked threat group, APT36, is using AI coding tools, termed "vibeware," to generate a large volume of low-quality malware in obscure programming languages. This tactic, called "Distributed Denial of Detection," aims to overwhelm defenses through sheer quantity rather than technical sophistication. The group is leveraging legitimate cloud services like Slack and Google Sheets for command and control, and deploying multiple malware implants simultaneously to maintain network access. Experts caution that while the technique represents a technical regression for the group, the increasing use of AI in malware development poses a significant risk.

Tycoon 2FA Goes Boom as Europol, Vendors Bust Phishing Platform

www.darkreading.com · 7 months ago

Law enforcement and cybersecurity firms have disrupted Tycoon 2FA, a widespread phishing-as-a-service platform that emerged in 2023. The platform was responsible for approximately 62 percent of phishing attempts blocked by Microsoft, impacting over 96,000 victims and stealing authentication tokens to bypass multifactor authentication. Tycoon 2FA used an adversary-in-the-middle attack to proxy legitimate login pages and steal session tokens, allowing attackers to compromise accounts and conduct business email compromise campaigns. Security experts recommend adopting phishing-resistant MFA methods like hardware keys to mitigate similar attacks.

How $800 Monthly Car Payments Are Hurting Car Sales

www.nytimes.com · 7 months ago

false

New Jersey county says malware attack took down phone lines, IT systems

therecord.media · 7 months ago

Passaic County in New Jersey is experiencing a malware attack that has disrupted phone lines and IT systems across government offices. County officials are working with federal and state agencies to investigate and contain the incident, which began Wednesday morning. This attack is part of a trend where cybercriminals are increasingly targeting smaller municipalities and local governments, following similar incidents in other New Jersey counties like Somerset, Camden, Bergen, Montclair and Hoboken. Recently, hospitals have also become targets of cyberattacks.

Wikipedia hit by self-propagating JavaScript worm that vandalized pages

www.bleepingcomputer.com · 7 months ago

The Wikimedia Foundation experienced a security incident involving a self-propagating JavaScript worm that vandalized Wikipedia pages and modified user scripts. The worm originated from a malicious script uploaded to Russian Wikipedia in March 2024, and was initially executed by a Wikimedia employee account while testing user script functionality. The script spread by injecting malicious code into user and global JavaScript files, affecting approximately 85 users and 3,996 pages. Editing was temporarily restricted while engineers reverted changes and removed the malicious code.

Hackers Used New Exploit Kit to Compromise Thousands of iPhones

www.techrepublic.com · 7 months ago

Google’s Threat Intelligence Group recently uncovered Coruna, a sophisticated iOS exploit kit used to compromise thousands of iPhones between 2025 and 2026. The toolkit contains 23 exploits across five attack chains, targeting devices running iOS versions from September 2019 to December 2023. Coruna was used by multiple threat actors, initially for surveillance, then by a Russian espionage group and later by a financially motivated Chinese group. Key vulnerabilities exploited include CVE-2021-30952, CVE-2023-32409, CVE-2023-32434, CVE-2024-23222, and CVE-2024-23225. Security teams are advised to update devices, enable Lockdown Mode, deploy mobile threat defense solutions, and restrict access to high-risk websites.

Cisco Drops 48 New Firewall Vulnerabilities, 2 Critical

www.darkreading.com · 7 months ago

Cisco has announced 48 vulnerabilities in its firewall products, including Adaptive Security Appliance (ASA), Secure FTD, and Secure Firewall Management Center (FMC). Two vulnerabilities, CVE-2026-20079 and CVE-2026-20131, are classified as critical, potentially allowing attackers to gain root access and execute code. These critical flaws, along with nine others, have received high CVSS scores, raising concerns about potential exploitation and abuse. Experts warn that compromising the FMC could undermine network security controls and allow attackers to modify firewall rules and disable security features. Organizations are urged to update their software and run the Cisco Software Checker to mitigate these risks.

WordPress membership plugin bug exploited to create admin accounts

www.bleepingcomputer.com · 7 months ago

Hackers are actively exploiting a critical vulnerability, CVE-2026-1492, in the User Registration & Membership plugin used by over 60,000 WordPress sites. This flaw allows attackers to create administrator accounts without authentication, granting them full control of a website. Researchers have observed numerous exploitation attempts, and the plugin developer has released version 5.1.3 to address the issue; users should update to the latest version, 5.1.4. The vulnerability represents the most severe disclosed this year for the User Registration & Membership plugin.

FBI arrests suspect linked to $46M crypto theft from US Marshals

www.bleepingcomputer.com · 7 months ago

A U.S. government contractor's son, John Daghita, has been arrested in Saint Martin for allegedly stealing over $46 million in cryptocurrency from the U.S. Marshals Service. Daghita, who also goes by the online handle "Lick," is the son of the CEO of Command Services & Support, a firm managing seized digital assets for the Marshals Service. The stolen funds are reportedly connected to the 2016 Bitfinex hack, involving the theft of 120,000 bitcoins. Blockchain investigator ZachXBT initially uncovered the scheme and reported his findings to authorities after Daghita inadvertently revealed his actions in a Telegram chat.

Ukrainian women fleeing war exploited in multimillion-dollar gambling fraud scheme

therecord.media · 7 months ago

A criminal network in Spain exploited dozens of Ukrainian women displaced by war in a multimillion-dollar gambling fraud scheme. The group recruited women, brought them to Spain, and used them to open bank accounts and obtain credit cards, which were then controlled by the criminals to move illicit funds through online betting platforms. Authorities estimate the network generated roughly 5.5 million dollars in illegal profits and invested some proceeds in luxury real estate. Twelve suspects have been arrested, and searches were conducted in both Spain and Ukraine.

Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges

therecord.media · 7 months ago

A Russian national has pleaded guilty to wire fraud charges related to his involvement in the Phobos ransomware gang. Evgenii Ptitsyn, 43, developed and marketed the ransomware, distributing it to affiliates and profiting from their attacks on organizations worldwide. The group, also linked to the 8Base ransomware strain, reportedly collected over $16 million in ransoms since 2019. Authorities have arrested multiple members of the group, and a free decryption tool is available for victims.

Israel Hacked Traffic Cameras in Iran

www.schneier.com · 7 months ago

Reports indicate Israel hacked traffic cameras in Iran. The hacking allegedly aided in the killing of Iranian leadership. The New York Times has published a report detailing this broader intelligence operation. The incident has resulted in the potential for more hard-line figures to assume leadership positions.

Cisco issues emergency patches for critical firewall vulnerabilities

www.csoonline.com · 7 months ago

Cisco has released emergency security patches to address critical vulnerabilities in its firewall products. The most significant issues are two “perfect 10” vulnerabilities, CVE-2026-20079 and CVE-2026-20131, found in the Secure Firewall Management Center software. These flaws allow unauthenticated attackers to gain remote root access through the web management interface. The update also resolves 46 other CVEs, including six rated as “high,” with vulnerabilities impacting the VPN web server and potentially causing denial-of-service states.

Women’s History Month: Encouraging women in cybersecurity at every career stage

www.microsoft.com · 7 months ago

false

Credential Protection for AI Agents: The Phantom Token Pattern

nono.sh · 7 months ago

A new system called nono protects AI coding agents by preventing them from directly handling sensitive API credentials. Instead of directly providing keys, agents receive temporary tokens that are validated and replaced by a proxy. The system offers features like proxy-based authentication, domain filtering, and 1Password integration, alongside security measures like constant-time comparison and memory wiping. A less secure alternative, --env-credential, is available when proxying isn't possible.

Software Development Practices Help Enterprises Tackle Real-Life Risks

www.darkreading.com · 7 months ago

false

Demand for AI Data Centers Sends Prospectors Hunting for Land and Power

www.nytimes.com · 7 months ago

false

The Smart Home Never Quite Worked. Now It’s Getting an A.I. Reboot.

www.nytimes.com · 7 months ago

false

Anthropic CEO Calls OpenAI’s Military Messaging ‘Straight Up Lies’

www.techrepublic.com · 7 months ago

false

Malicious AI Assistant Extensions Harvest LLM Chat Histories

www.microsoft.com · 7 months ago

Malicious browser extensions impersonating AI assistant tools have been identified as harvesting user data from platforms like ChatGPT and DeepSeek. Approximately 900,000 installations are reported, impacting over 20,000 enterprise tenants. These extensions collect URLs and AI chat content, potentially exposing sensitive information, and were distributed through the Chrome Web Store for use with both Google Chrome and Microsoft Edge. Microsoft Defender XDR detections are available to help identify and mitigate this threat.

Preparing for the Quantum Era: Post-Quantum Cryptography Webinar for Security Leaders

thehackernews.com · 7 months ago

Attackers are collecting encrypted data now with the intent to decrypt it later using quantum computers, a tactic called “harvest now, decrypt later.” Security leaders are advised to prepare for this future threat by transitioning to quantum-resistant encryption methods, such as hybrid cryptography combining traditional algorithms with quantum-resistant algorithms like ML-KEM. Organizations should identify sensitive data, understand current encryption usage, and implement hybrid cryptographic strategies. A webinar will discuss practical steps and how to build a quantum-ready security strategy.

Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities

thehackernews.com · 7 months ago

Cisco has confirmed active exploitation of vulnerabilities in its Catalyst SD-WAN Manager software. Two vulnerabilities, CVE-2026-20122 and CVE-2026-20128, are currently being targeted. CVE-2026-20122 allows for arbitrary file overwrites while CVE-2026-20128 enables information disclosure. Users are advised to immediately update to a fixed software release and implement security best practices to mitigate the risk.

Google says 90 zero-days were exploited in attacks last year

www.bleepingcomputer.com · 7 months ago

Google’s Threat Intelligence Group reports 90 zero-day vulnerabilities were exploited in attacks last year, a 15% increase from 2024. The vulnerabilities primarily targeted enterprise software and operating systems, with memory safety issues accounting for a significant portion. Microsoft was the most targeted vendor, and commercial spyware vendors are now the largest users of these vulnerabilities. Google anticipates zero-day exploitation will remain high due to the increasing use of AI tools.

2026 Browser Data Reveals Major Enterprise Security Blind Spots

www.bleepingcomputer.com · 7 months ago

A recent report reveals the browser has become the most critical and least protected control point for enterprises, particularly with the rise of AI-native browsers and copilots. Employees are increasingly using AI tools within browsers, often bypassing formal governance and exposing sensitive data like source code and financial information. Attackers are exploiting this shift, using techniques like phishing and malicious browser extensions to bypass traditional security controls. The report highlights a need for enhanced browser-based visibility and control to address these evolving risks.

Google: Half of 2025’s 90 Exploited Zero-Days Aimed at Enterprises

www.securityweek.com · 7 months ago

Google's Threat Intelligence Group reported 90 zero-day vulnerabilities were exploited in 2025, a slight increase from previous years. Enterprises are facing a growing threat, with nearly half of these vulnerabilities impacting enterprise technologies. Commercial surveillance vendors were the leading threat actors, exploiting 15 vulnerabilities, while state-sponsored groups, particularly those linked to China, accounted for 12. Google anticipates artificial intelligence will play an increasing role in both attack and defense strategies in 2026.

HPD (Hex Packet Decoder) now have AI feature – looking for feedback

hpd.gasmi.net · 7 months ago

false

Google says 90 zero-days exploited in 2025 as commercial vendor activity grows

therecord.media · 7 months ago

Google's Threat Intelligence Group reports a significant increase in zero-day exploits, tracking 90 in 2025, compared to 78 in 2024. Commercial surveillance vendors are increasingly exploiting zero-days, often targeting mobile devices and browsers to sell intrusion tools. State-sponsored groups, particularly those from China, prioritize exploiting edge devices and security appliances, with Chinese groups being the most prolific users of zero-day vulnerabilities. Exploits were attributed to vulnerabilities such as CVE-2025-21590, CVE-2025-0282, CVE-2025-61882, CVE-2025-61884, and CVE-2025-8088.

‘We’re not trying to remake the economy’: FTC’s Mufarrige charts new course on tech enforcement

therecord.media · 7 months ago

false

Coruna iOS exploit kit moved from spy tool to mass criminal campaign in under a year

www.csoonline.com · 7 months ago

Researchers at Google and iVerify have uncovered a sophisticated iOS exploit kit called Coruna, initially used by a commercial surveillance company, then by a suspected Russian espionage group, and now by Chinese cybercriminals. The kit targets iPhones running iOS 13.0 through iOS 17.2.1, exploiting 23 vulnerabilities to deliver a payload, Plasmagrid, designed to steal cryptocurrency wallet credentials by targeting applications like MetaMask and scanning for seed phrases. This incident highlights a thriving secondary market for zero-day exploits and underscores the need for stronger mobile security measures beyond traditional device management. Users are urged to update to the latest iOS version and enable Lockdown Mode if possible.

LatAm Now Faces 2x More Cyberattacks Than US

www.darkreading.com · 7 months ago

Latin America is experiencing a significant surge in cyberattacks, averaging nearly three thousand weekly threats compared to just under fifteen hundred in the United States. Cyberattacks involving ransomware, infostealers, banking malware, and botnets are notably more prevalent in Latin America. Email remains a primary attack vector in Latin America, unlike the United States where web-based attacks dominate, likely due to lower cyber awareness and uneven security investments in the region. A recent supply chain incident at Brazilian fintech provider C&M Software, involving insider threat and ransomware (Dragonforce), highlights the vulnerability of even larger organizations.