Blahalla

2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk

blog.gitguardian.com · 7 months ago

Researchers from GitGuardian and Google have identified a significant problem: leaked private keys are being used to secure valid TLS certificates, often protecting major organizations. Since 2021, approximately one million private keys have been leaked, mapping to over 140,000 certificates, with 2,600 remaining valid as of September 2025. A disclosure campaign revealed a concerning lack of response from organizations and Certificate Authorities, highlighting a widespread misunderstanding of the risks and inadequate revocation practices. The research emphasizes the need for shorter key lifetimes, preventing key reuse, and implementing better blacklisting procedures to protect against data interception and impersonation.

ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine & More

thehackernews.com · 7 months ago

Reddit has been fined by U.K. regulators for improperly handling children’s data. Texas is restricting Samsung’s data collection practices for smart TVs, while NATO has approved iPhones and iPads for classified use. Phishing attacks are increasingly sophisticated, employing techniques like infrastructure abuse and spoofed email chains to target users and steal credentials. Experts caution against the risks of over-relying on AI coding tools and warn that new AI models can deanonymize internet users.

YGGtorrent — Fin de partie [French]

yggleak.top · 7 months ago

There was a comprehensive compromise of YGGtorrent infrastructure exposing source code, server configurations, logs and databases containing about 6.6 million user accounts with emails and SHA 512 password hashes, one million torrents, 28 million peers and roughly 16.6 gigabytes of exfiltrated data. Monetization and laundering operations were documented, including a paid Turbo Mode charging 86 euros, estimated revenues between 5 and 8.5 million euros, automated payment proxy domains using a CardsShield WooCommerce plugin, multiple payment processors and conversion to cryptocurrency with mixing via Tornado Cash. Operational weaknesses included an exposed unauthenticated SphinxQL service, FastCGI cross user and PHP FPM escalation vectors, a CloudPanel vulnerability tracked as CVE-2024-44765, and an attempted PHP CGI argument injection exploit identified as CVE-2024-4577 which failed during assessment.

Europol: Großer Markt für gestohlene Daten geschlossen

www.csoonline.com · 7 months ago

Europol coordinated an international operation to shut down Leakbase, a major online marketplace for stolen data. The platform, based in Amsterdam, had over 142,000 registered users worldwide and was described as a central hub for cybercrime. Law enforcement agencies in 14 countries conducted raids targeting key users of the platform. Authorities warn that stolen data is often resold and used for various types of fraud.

New MongoDB Vulnerability Allows Attackers to Crash Servers, Exposing Critical Data

gbhackers.com · 7 months ago

A high-severity denial-of-service vulnerability, CVE-2026-25611, has been discovered in MongoDB versions 7.0, 8.0, and 8.2. Attackers can exploit this flaw by sending crafted packets that trick the server into allocating excessive memory, potentially crashing the server. The vulnerability affects any MongoDB deployment with compression enabled and requires no authentication, impacting over 200,000 exposed instances. Patches are available in versions 7.0.29, 8.0.18, and 8.2.4, and users are urged to upgrade immediately.

LastPass Review: Features, Pricing, Security, and Who It’s Best For

www.techrepublic.com · 7 months ago

false

Threat Actors Exploit Fake Claude Code Downloads to Deploy Infostealer Malware

gbhackers.com · 7 months ago

Threat actors are exploiting interest in Anthropic’s Claude Code tools by creating fake download pages that distribute infostealer malware. Attackers use compromised domains and lure developers with fake installers, which then execute a lightweight infostealer via the Windows HTML Application Host, mshta.exe. This method allows attackers to steal credentials, browser data, and system information without complex malware. Security professionals should monitor mshta.exe activity, as it can be a key indicator of compromise in data theft operations.

Russian Ransomware Operator Pleads Guilty in US

www.securityweek.com · 7 months ago

A Russian national, Evgenii Ptitsyn, has pleaded guilty in the United States to charges related to his involvement in the Phobos ransomware operation. Ptitsyn was arrested in South Korea and extradited to the US, facing up to 20 years in prison for wire fraud conspiracy. He assisted with the sale, distribution, and operation of the ransomware, which targeted over 1,000 organizations worldwide and resulted in over 16 million dollars in ransom payments. Authorities have been actively dismantling the Phobos operation, with recent arrests including a suspected affiliate in Poland.

Police dismantle major phishing platform blamed for attacks on hospitals and schools

therecord.media · 7 months ago

International law enforcement agencies have dismantled Tycoon 2FA, a phishing-as-a-service platform that targeted over 500,000 organizations worldwide. The service allowed criminals to bypass multi-factor authentication and steal login credentials, impacting hospitals, schools, and other institutions. Authorities seized over 330 domains used to operate the platform, which sent tens of millions of phishing emails monthly. Microsoft estimates Tycoon 2FA was involved in about 62% of phishing attempts they blocked.

PoC Exploit for Cisco SD-WAN 0-Day Vulnerability Now Released, Actively Exploited in the Wild

gbhackers.com · 7 months ago

A critical zero-day vulnerability, CVE-2026-20127, is actively being exploited in Cisco Catalyst SD-WAN infrastructure, affecting the Controller and Manager. The vulnerability allows unauthenticated attackers to bypass authentication and gain administrative privileges. Threat actors linked to UAT-8616 are exploiting this flaw, sometimes escalating privileges further by leveraging CVE-2022-20775 after downgrading the system’s software version. A public proof-of-concept exploit has been released, significantly increasing the risk to critical infrastructure sectors.

Police dismantles online gambling ring exploiting Ukrainian women

www.bleepingcomputer.com · 7 months ago

Spanish and Ukrainian law enforcement have dismantled a criminal organization exploiting war-displaced Ukrainian women in an online gambling scheme. The group recruited vulnerable women, facilitated their travel to Spain, and controlled their bank accounts to launder approximately 4.75 million euros. The criminals used stolen identities from over 5000 citizens across 17 nationalities to place bets on online gambling platforms and generate fraudulent profits. Authorities arrested 12 suspects and seized assets including vehicles, computers, and bank accounts in multiple countries.

RingH23 Threat Actors Target MacCMS and CDN Infrastructure with New Arsenal

gbhackers.com · 7 months ago

Threat actors linked to the Funnull cybercrime group are using a new Linux toolkit called RingH23 to compromise MacCMS video sites and hijack CDN infrastructure. Attackers are poisoning MacCMS’s update channel and infiltrating GoEdge-based CDNs to inject malicious JavaScript and redirect users to scam sites. The toolkit includes components like officebin (Badredis2s), module.so (Badnginx2s), and libutilkeybd.so (Badhide2s) for backdoors, JavaScript injection, and rootkit functionality. Security professionals are advised to audit MacCMS deployments, inspect CDN environments, and consider migrating away from vulnerable platforms.

Cisco Warns of More Catalyst SD-WAN Flaws Exploited in the Wild

www.securityweek.com · 7 months ago

Cisco has reported that two vulnerabilities in its Catalyst SD-WAN Manager are currently being exploited. These flaws include CVE-2026-20128, an information disclosure vulnerability, and CVE-2026-20122, which allows for arbitrary file overwrites. The exploitation involves chaining these vulnerabilities with others, including CVE-2026-20127 and CVE-2022-20775. Cybersecurity agencies attribute these attacks to threat actors UAT-8616 and UAT-9686.

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

thehackernews.com · 7 months ago

A threat actor, tracked as Dust Specter and suspected to have ties to Iran, is targeting Iraqi government officials through a sophisticated cyber campaign. The attacks use impersonation of Iraq's Ministry of Foreign Affairs to deliver malware, including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. The malware uses techniques like geofencing, in-memory PowerShell execution, and even generative AI, along with compromised Iraqi government infrastructure, to evade detection and establish persistence. The campaign also utilizes social engineering tactics similar to ClickFix attacks, with fake Google Forms and Cisco Webex invitations.

Europol schließt riesigen Markt für gestohlene Daten

www.csoonline.com · 7 months ago

Europol and law enforcement agencies have shut down Leakbase, an online marketplace for stolen data. The platform, based in Amsterdam, had approximately 142,000 registered users worldwide and facilitated the trade of compromised data. Investigations, which began in the Netherlands in 2023 and involved multiple countries including Germany and the United States, resulted in around 100 raids targeting key users. Authorities warn that such platforms fuel cybercrime and enable fraudulent activities.

DPRK Hackers Target Crypto Firms, Steal Keys and Cloud Assets in Coordinated Attacks

gbhackers.com · 7 months ago

North Korean-linked threat actors are targeting cryptocurrency firms in a coordinated campaign. Attackers exploit the React2Shell vulnerability (CVE-2025-55182) to gain initial access and subsequently compromise AWS and Kubernetes environments. They steal source code, private keys, and credentials, including sensitive data from Terraform state files, and exfiltrate proprietary exchange logic via container images. Command and control uses a licensed VShell server and Fast Reverse Proxy for covert tunneling, with infrastructure hosted in South Korea.

Hacked App Part of US/Israeli Propaganda Campaign Against Iran

www.schneier.com · 7 months ago

Iranians received notifications on their phones shortly after explosions, with messages appearing to originate from a hacked prayer-timing app called BadeSaba Calendar, which has over 5 million downloads. The messages began with the phrase "Help has arrived" and were delivered rapidly. Security experts suspect a government operation, potentially involving the US or Israel. No group has yet claimed responsibility for the apparent hack.

Security architecture question: controlling system authority when sensor trust degrades

burakoktenli-ai.github.io · 7 months ago

The HMAA Simulation Dashboard assesses an authority engine's safety and reliability through various simulations and validations. The system uses a tiered authority structure, with escalating pressure and sensor confidence influencing decision-making. Simulations validate monotonicity, tier reachability, and hysteresis effectiveness, alongside tests for sensor jamming, environment denial, and self-destruction protocols. The system incorporates fault-tolerant controls, including hysteresis to prevent authority oscillation under noise, and employs a seeded random number generator to ensure reproducibility of results.

Where Multi-Factor Authentication Stops and Credential Abuse Starts

thehackernews.com · 7 months ago

Multi-factor authentication, or MFA, isn't always enough to protect Windows environments from attackers. Many Windows logons, such as those occurring during interactive logins, RDP access, and through SMB, bypass MFA controls and rely on Active Directory authentication. Attackers exploit vulnerabilities like NTLM authentication, Kerberos ticket abuse, and compromised service accounts to gain unauthorized access, often moving laterally within a network. Security teams should focus on strengthening password policies, blocking compromised credentials, reducing reliance on legacy protocols, and regularly auditing service accounts to mitigate these risks.

62 people indicted by Taiwanese prosecutors over ties to cyber scam company Prince Group

therecord.media · 7 months ago

Taiwanese prosecutors have indicted 62 individuals and 13 companies linked to the Prince Group for involvement in cyber scam operations. The group, led by Chen Zhi, allegedly laundered at least 339 million dollars into Taiwan, using stolen funds to purchase assets. The operation, which spanned multiple countries and involved human trafficking and extortion, targeted victims in the U.S., Europe, and China. Authorities have seized approximately 174 million dollars in assets, and Chen Zhi has been extradited to China.

LeakBase Cybercrime Forum Shut Down, Suspects Arrested

www.securityweek.com · 7 months ago

Law enforcement has dismantled the LeakBase cybercrime forum, a platform active since 2021. The forum, which had roughly 142,000 registered users, facilitated the trade of stolen data like account credentials, payment card information, and bank details. During Operation Leak, authorities seized the forum's database and arrested suspects following house searches and user identification. Europol highlighted a unique trust-based system within the forum and noted a rule prohibiting data related to Russia.

Critical pac4j-jwt Authentication Bypass Vulnerability Allows Attackers to Impersonate Any User

gbhackers.com · 7 months ago

A critical vulnerability, tracked as CVE-2026-29000, has been identified in the pac4j-jwt Java authentication library. This flaw allows attackers to bypass authentication and impersonate users, including administrators, by crafting unsigned tokens and exploiting a misplaced null check. The vulnerability impacts deployments using RSA-encrypted tokens and the JwtAuthenticator configuration, allowing attackers to forge tokens with arbitrary claims. Users are urged to update to version 4.5.9 or newer for the 4.x line, 5.7.9 or newer for the 5.x branch, or 6.3.3 or newer for the 6.x line.

Cisco flags more SD-WAN flaws as actively exploited in attacks

www.bleepingcomputer.com · 7 months ago

Cisco has identified several actively exploited security vulnerabilities in its Catalyst SD-WAN Manager software. Two flaws, CVE-2026-20122, an arbitrary file overwrite, and CVE-2026-20128, an information disclosure, are currently being exploited. A critical authentication bypass vulnerability, CVE-2026-20127, has been exploited since 2023, enabling attackers to introduce malicious devices into networks, and CISA has issued directives for federal agencies to address this issue. Additionally, Cisco recently patched vulnerabilities in its Secure Firewall Management Center software, including CVE-2026-20079 and CVE-2026-20131.

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

thehackernews.com · 7 months ago

Researchers have identified a new cyber campaign targeting Ukrainian entities, attributed with moderate confidence to the APT28 threat actor. The attack begins with a phishing email leading to a ZIP archive containing a lure document disguised as a border crossing appeal. This triggers the deployment of a.NET-based loader called BadPaw, which then downloads and runs a sophisticated backdoor named MeowMeow, allowing remote PowerShell command execution and file system manipulation. The malware incorporates decoy mechanisms, including a cat-themed GUI that displays a message when triggered independently, to evade detection and mislead analysis.

You’ve Never Seen Ants Like This Before

www.nytimes.com · 7 months ago

false

A Word to the Wise: Don’t Trust A.I. to File Your Taxes

www.nytimes.com · 7 months ago

false

ClickFix Campaign Exploits Fake LinkedIn VCs to Spread Malware Among Crypto and Web3 Experts

gbhackers.com · 7 months ago

A sophisticated malware campaign is targeting cryptocurrency and Web3 professionals using fake venture capital identities on LinkedIn. Attackers create convincing profiles for fictitious investment firms and lure victims into scheduling meetings via Calendly, which redirects to malicious Zoom or Google Meet links. The campaign employs a “ClickFix” technique, presenting a fake CAPTCHA that, when bypassed, prompts users to execute malicious commands directly in their terminal, bypassing standard security defenses. Researchers suspect links to the financially motivated UNC1069 group.

Google Rolls Out Emergency Chrome Update to Patch 10 Critical Security Vulnerabilities

gbhackers.com · 7 months ago

Google has released an emergency security update for Chrome, addressing ten vulnerabilities including three critical flaws and seven high-severity issues. The update, version 145.0.7632.159/160 for Windows and Mac, and 145.0.7632.159 for Linux, resolves memory management and lifecycle errors within the browser's core components. Critical vulnerabilities CVE-2026-3536, CVE-2026-3537, and CVE-2026-3538, involving integer overflows and object lifecycle issues, received substantial bug bounties. Users are advised to manually update their browsers immediately to prevent potential exploits.

Cisco Patches Critical Vulnerabilities in Enterprise Networking Products

www.securityweek.com · 7 months ago

Cisco has released updates to address 50 vulnerabilities impacting its enterprise networking products. Two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20131, exist in the Secure FMC software, allowing attackers to bypass authentication and execute code with root privileges. Nine additional high-severity vulnerabilities were also patched, potentially enabling SQL injection and denial-of-service attacks. Cisco reports that no vulnerabilities are currently being exploited.

Phobos ransomware admin pleads guilty to wire fraud conspiracy

www.bleepingcomputer.com · 7 months ago

A Russian national has pleaded guilty to wire fraud conspiracy for his role in administering the Phobos ransomware operation. The ransomware-as-a-service has impacted over 1,000 entities worldwide, generating more than $39 million in ransom payments. The administrator oversaw the sale and distribution of the ransomware through a darknet website, collecting fees for decryption keys. International law enforcement, through Operation Aether, has targeted Phobos-linked individuals and disrupted the operation, warning over 400 companies of potential attacks. The defendant faces up to 20 years in prison.

Cisco Secure Firewall Management Flaw Allows Remote Code Execution

gbhackers.com · 7 months ago

Cisco recently disclosed a critical security vulnerability in its Secure Firewall Management Centre software and Cisco Security Cloud Control Firewall Management systems. The flaw, identified as CVE-2026-2013 with a severity score of 10.0, allows unauthenticated attackers to execute arbitrary code and gain root privileges through insecure deserialization. There are no temporary workarounds available, and organizations must immediately apply vendor patches to mitigate the risk. Cisco Security Cloud Control users do not need to take action as the platform automatically receives security upgrades.

Reclaim Security Raises $26M to Eliminate the 27-Day Remediation Gap

gbhackers.com · 7 months ago

Cybersecurity firms face a widening gap between vulnerability detection and remediation, with attackers now able to exploit weaknesses in as little as 27 seconds, while remediation often takes 27 days. Reclaim Security has secured $26 million in funding to address this challenge with its preemptive exposure-remediation platform. The platform utilizes a Productivity Impact Prediction Engine, or PIPE, to simulate the effects of security changes before deployment, automating remediation and reducing timelines from weeks to minutes. Reclaim aims to shift security strategies from reactive approaches to proactive exposure removal.

RedAlert Mobile Espionage Campaign Exploits Trojanized Rocket Alert App to Spy on Civilians

gbhackers.com · 7 months ago

A new mobile espionage campaign called "RedAlert" is exploiting the Israel-Iran conflict by distributing a trojanized version of the official Israeli Rocket Alert app. Attackers use SMS phishing to trick users into sideloading the fake app, which then steals sensitive data like SMS messages, contacts, and GPS location while displaying legitimate emergency alerts. The malware uses a three-tier infection chain to bypass security checks, including spoofing digital signatures and concealing malicious code. Data is exfiltrated to attacker-controlled servers via HTTP POST requests, and the campaign utilizes infrastructure associated with domains like api.ra-backup.com and IP addresses including 44.208.242.141.

we at codeant found a bug in pac4j-jwt (auth bypass)

www.codeant.ai · 7 months ago

A critical authentication bypass in pac4j-jwt allows an attacker possessing only the server RSA public key to craft an encrypted unsigned JWT that authenticates as any user, including administrators; this vulnerability is tracked as CVE-2026-29000 with a CVSS score of 10.0. The bypass occurs because pac4j decrypts the JWE and calls toSignedJWT on the inner payload, and when that returns null for a PlainJWT the code skips signature verification and accepts the unverified claims. Maintainers shipped patches on March 2, 2026 and users are urged to upgrade to 4.5.9 or newer, 5.7.9 or newer, or 6.3.3 or newer; the CVE was assigned on March 4, 2026.

Cisco Secure Firewall Vulnerability Exposes Networks to Authentication Bypass Attacks

gbhackers.com · 7 months ago

Cisco has disclosed a critical vulnerability, CVE-2026-20079, in its Secure Firewall Management Centre software, allowing unauthenticated attackers to gain root access. The flaw, discovered during internal testing, results from a faulty system process and can be exploited through specially crafted HTTP requests. This bypasses authentication and enables attackers to control the underlying operating system, potentially compromising the entire network. Only on-premises deployments are affected, and Cisco provides a Software Checker tool to help administrators identify and apply the necessary updates.

State-affiliated hackers set up for critical OT attacks that operators may not detect

www.csoonline.com · 7 months ago

Threat groups linked to state-sponsored actors are actively mapping and preparing to disrupt industrial control systems, posing a significant risk to critical infrastructure. Fewer than 1 in 10 OT networks have adequate monitoring to detect this activity. Groups like Voltzite, Kamacite, and Electrum are demonstrating increasingly sophisticated tactics, including exploiting vulnerabilities like those in Ivanti EPMM and SAP NetWeaver, and deploying wiper malware. This shift highlights a concerning lack of visibility and preparedness within OT environments, and could be triggered by geopolitical conflict.

Threat Actors Intensify Targeting of IP Cameras Across the Middle East Amid Ongoing Conflict

gbhackers.com · 7 months ago

Iran-nexus threat actors are targeting IP cameras across the Middle East, beginning February 28, 2026, to gather intelligence and support military operations. The attacks, utilizing commercial VPNs and cloud servers, have primarily targeted cameras from Hikvision and Dahua, exploiting vulnerabilities like CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, and CVE-2021-33044. Researchers suggest increases in camera targeting may foreshadow kinetic escalation, and advise organizations to strengthen security measures, including patching firmware and segmenting networks. The activity demonstrates the increasing intersection of cyber operations and physical warfare.

Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks

thehackernews.com · 7 months ago

Law enforcement agencies have dismantled Tycoon 2FA, a phishing-as-a-service toolkit linked to over 64,000 attacks and impacting nearly 100,000 organizations globally. The subscription-based kit allowed cybercriminals to stage adversary-in-the-middle attacks, generate tens of millions of phishing emails monthly, and steal credentials, MFA codes, and session cookies. Microsoft has tracked the operators of this service as Storm-1747, noting it became the most prolific platform in 2025. The takedown involved seizing 330 domains that comprised the criminal service.

FBI and Europol Seize LeakBase Forum Used to Trade Stolen Credentials

thehackernews.com · 7 months ago

Law enforcement agencies, including the FBI and Europol, have dismantled LeakBase, a significant online forum used by cybercriminals to trade stolen credentials and cybercrime tools. The forum, active since 2021, had over 142,000 members and facilitated the sale of hacked databases containing hundreds of millions of account credentials and financial information. During Operation Leak, authorities executed search warrants, made arrests, and seized forum content for evidentiary purposes. LeakBase was linked to the threat actor known as Chucky, who is also associated with the monikers Chuckies and Sqlrip.

14 old software bugs that took way too long to squash

www.csoonline.com · 7 months ago

There are 14 noteworthy software bugs that lingered for years or decades in widely used operating systems, libraries, and applications before being discovered and fixed. Notable examples include libpng CVE-2026-25646, Python tarfile CVE-2007-4559, Redis CVE-2025-49844, HashiCorp Vault CVE-2025-6000, LionWiki CVE-2020-27191, sudo CVE-2025-32462, and Telnet CVE-2026-24061. The flaws range from buffer overflows and use after free to local file inclusion, authentication bypass, and logic errors that enabled remote code execution, privilege escalation, data loss, and supply chain exposure, driving coordinated patching and mitigation across vendors and distributions.

Cisco Catalyst SD-WAN Flaws Expose Devices to Root Access, Threatening Network Security

gbhackers.com · 7 months ago

Cisco has released critical software updates to address vulnerabilities in the Catalyst SD-WAN Manager that could allow attackers to bypass authentication and gain elevated privileges. Exploitation of CVE-2026-20129 allows unauthenticated attackers to obtain netadmin privileges, while CVE-2026-20126 enables local attackers to achieve root access. Active exploitation of CVE-2026-20122 and CVE-2026-20128 is also underway, allowing threat actors to overwrite files and disclose credentials. Immediate software upgrades are mandatory, and Cisco recommends restricting internet access and disabling HTTP for the administrator portal.

Operation Leak: Authorities Dismantle LeakBase Forum, Secure User Data and IP Logs

gbhackers.com · 7 months ago

Law enforcement agencies, including the FBI, have dismantled the LeakBase online forum, a marketplace for stolen data and credentials. The action, called Operation Leak, resulted in the seizure of the forum's domains and infrastructure using court orders from Germany and the United States. Authorities secured a significant amount of data including user accounts, forum posts, private messages, financial credit details, and IP logs. Anyone who used the platform or communicated with LeakBase administrators is urged to contact the FBI directly.

Cyberattack Alert: Hackers Impersonate LastPass Support to Steal Vault Passwords

gbhackers.com · 7 months ago

A phishing campaign is targeting LastPass users by impersonating support emails. Attackers are crafting fake email chains that mimic internal communications regarding suspicious account activity, such as unauthorized data exports or device registrations. The emails direct users to fake LastPass login pages designed to steal master passwords and vault data, utilizing display name spoofing to appear legitimate. LastPass advises users to verify email addresses, avoid clicking links, and enable multi-factor authentication.

Tycoon 2FA Phishing Operation Dismantled in Joint Raid by Microsoft and Europol

gbhackers.com · 7 months ago

Microsoft and Europol have dismantled the Tycoon 2FA Phishing-as-a-Service platform, which bypassed multi-factor authentication to infiltrate over 96,000 victims globally. The platform, operated by Saad Fridi from Pakistan, allowed low-skilled attackers to hijack authenticated sessions on Microsoft 365 and Google platforms, peaking at 62% of Microsoft's blocked phishing attempts. The coordinated disruption involved seizing hundreds of domains and servers across multiple countries, requiring extensive international collaboration. Organizations are advised to enforce phishing-resistant MFA, implement session controls, and update threat intelligence to defend against similar attacks.

Die besten Cyber-Recovery-Lösungen

www.csoonline.com · 7 months ago

false

Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks

www.securityweek.com · 7 months ago

Security researchers have identified a sophisticated iOS exploit kit called Coruna, initially used by Russian state actors against Ukrainians, now in the hands of Chinese criminal groups. The kit targets iOS versions 13 through 17.2.1, employing 23 exploits across five exploit chains, and utilizes non-public exploitation techniques. It has been observed in watering hole attacks and is now used to steal financial information and bitcoin wallets through fake websites. Users are advised to update to iOS 17.3 or higher, or enable Lockdown Mode for increased security.

Elon Musk Defends Social Media Posts in Twitter Shareholder Lawsuit

www.nytimes.com · 7 months ago

false

Microsoft leads takedown of Tycoon2FA phishing service infrastructure

www.csoonline.com · 7 months ago

Law enforcement and IT companies, led by Microsoft, have dismantled Tycoon2FA, a phishing-as-a-service infrastructure used to target millions with malicious emails. The service allowed criminals with limited technical skills to create sophisticated phishing campaigns mimicking legitimate login pages for services like Microsoft 365, Outlook, and Gmail. Tycoon2FA intercepted multi-factor authentication codes and session cookies, enabling access to sensitive information even after password resets. Experts caution that similar tools will likely emerge, emphasizing the need for stronger identity security and phishing-resistant authentication methods like FIDO2/WebAuthn.

Normalized Certificate Transparency logs as a daily JSON dataset

hefftools.dev · 7 months ago

false

Your Duolingo Is Talking to ByteDance: Cracking the Pangle SDK's Encryption

www.buchodi.com · 7 months ago

Researchers discovered that several popular mobile applications, including Duolingo, BeReal, and Character.AI, are transmitting sensitive device data to ByteDance’s Pangle ad SDK. This data includes device models, IP addresses, battery levels, and more. The “encryption” used, labeled "cypher:3," is easily broken because the decryption key is embedded within each message, essentially acting as obfuscation rather than true encryption. A second, stronger encryption method, "cypher:4," is used for ad-related data.