Blahalla

Iran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay Low

www.securityweek.com · 7 months ago

Following recent US and Israeli strikes against Iran, hacktivist activity has increased, but state-sponsored cyberattacks from Iran remain subdued. Cybersecurity firms have observed website defacements, DDoS attacks, and claims of compromised systems by pro-Iran groups, though many of these claims lack verification. Several groups, including FAD Team and Fatimion Cyber Team, have targeted Israeli and allied entities, while others like Handala Hack team are active on Telegram and X. While overall state-sponsored cyber activity has not significantly escalated, security officials advise organizations to review their defenses and remain vigilant.

On Moltbook

www.schneier.com · 7 months ago

false

Zerobot Malware Exploits Tenda Command Injection Vulnerabilities to Deploy Malicious Payloads

gbhackers.com · 7 months ago

A new malware campaign, dubbed Zerobot, is exploiting vulnerabilities to build a botnet and compromise systems. The campaign utilizes CVE-2025-7544, a buffer overflow in Tenda AC1206 routers, and CVE-2025-68613, a remote code execution flaw in the n8n automation platform. Exploitation involves deploying a Mirai-based payload, Zerobotv9, which downloads and executes a malicious script from an external server. This activity was first observed in January 2026, targeting both traditional IoT devices and enterprise automation infrastructure.

Amazon: Drone strikes damaged AWS data centers in Middle East

www.bleepingcomputer.com · 7 months ago

Drone strikes have damaged Amazon Web Services data centers in the United Arab Emirates and Bahrain, causing widespread outages and impacting numerous cloud computing services. The attacks, which physically damaged infrastructure and disrupted power, affected the AWS Middle East (UAE) Region and the AWS Middle East (Bahrain) Region. Amazon is working to restore infrastructure and implement software-based recovery solutions, advising customers to back up data and migrate workloads to unaffected regions. The United Kingdom’s National Cyber Security Centre has warned organizations of increased Iranian cyberattack risks due to the ongoing conflict.

HPE AutoPass Vulnerability Allows Remote Attackers to Bypass Authentication

gbhackers.com · 7 months ago

A vulnerability has been identified in Hewlett Packard Enterprise’s AutoPass License Server, allowing attackers to bypass authentication controls remotely. The issue, tracked as CVE-2026-23600, is rated 7.3 in severity and requires no privileges or user interaction to exploit. Affected versions are those prior to 9.19, and HPE recommends upgrading to version 9.19 or later to resolve the problem. Additional security measures include restricting network access and monitoring for unusual activity.

As War Continues, Pro-Iranian Actors Launch Barrage of Cyberattacks

www.darkreading.com · 7 months ago

Following a US-Israeli military action against Iran, a surge of cyberattacks has been launched by pro-Iranian actors. These attacks include distributed denial of service hits, critical infrastructure attacks, and network compromises, targeting organizations in the US, Israel, and allied nations. Groups like Cotton Sandstorm, FAD Team, and Handala Hack have claimed responsibility for various incidents, including data leaks, SQL injection campaigns, and disruptions to energy and healthcare sectors. Additionally, pro-Russian hacktivist groups are coordinating attacks in support of Iran, intensifying the cyber threat landscape.

AI Agents: The Next Wave Identity Dark Matter - Powerful, Invisible, and Unmanaged

thehackernews.com · 7 months ago

false

New ‘StegaBin’ Campaign Deploys Multi-Stage Credential Stealer via 26 Malicious npm Packages

gbhackers.com · 7 months ago

A new cyber campaign called StegaBin is targeting JavaScript developers through 26 malicious npm packages disguised as popular open-source libraries. These packages deploy a multi-stage credential-stealing toolkit and a Remote Access Trojan, which researchers attribute to the North Korean-aligned FAMOUS CHOLLIMA threat actor. The malware uses text steganography to decode command-and-control domains from Pastebin and then delivers platform-specific shell payloads and an infostealer toolkit capable of keylogging, credential harvesting, and secret scanning. The attack simulates a compromised host and establishes persistence through techniques like modifying VSCode tasks.

Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication

thehackernews.com · 7 months ago

Cybersecurity researchers have identified a new phishing suite called Starkiller that utilizes an AitM reverse proxy to bypass multi-factor authentication. This platform, advertised by the Jinkusu threat group, allows attackers to impersonate legitimate websites and capture user credentials without updating phishing page templates. Simultaneously, the 1Phish kit has evolved to include advanced features like browser fingerprinting and OTP capture, and attackers are exploiting the OAuth 2.0 device authorization grant flow to compromise Microsoft 365 accounts. Recent phishing campaigns have also targeted financial institutions using deceptive Cloudflare CAPTCHA pages and obfuscated scripts to harvest credentials.

Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild

unit42.paloaltonetworks.com · 7 months ago

There are growing reports that adversaries embed hidden or manipulated instructions inside web content that large language models and AI agents then ingest, a technique known as web based indirect prompt injection. Telemetry shows these attacks are being weaponized in the wild, including a December 3, 2025 case that attempted to bypass an AI ad review system, and analysts identified twenty two distinct payload engineering techniques and a taxonomy of attacker intents ranging from low nuisance to critical data destruction. Consequences include credential and payment leakage, unauthorized transactions, denial of service and system prompt leakage, and attackers use obfuscation methods such as invisible content, multi layer encoding and dynamic injection to evade safeguards. Defenders are urged to deploy proactive, web scale detection and content validation capabilities to distinguish benign from malicious prompts before ingestion.

AWS Data Centers Hit: Drone Strikes Cripple Cloud

www.techrepublic.com · 7 months ago

Amazon Web Services experienced drone strikes impacting three data centers in the Middle East, specifically in the UAE and Bahrain. The attacks caused structural damage, power disruptions, and water damage, affecting core services like EC2, S3, and DynamoDB. Recovery is expected to take at least a day due to the physical damage, and the operating environment remains unpredictable. Organizations with workloads in the affected regions should treat this as a disaster recovery scenario, focusing on identifying impacted areas and validating backup and recovery procedures.

Star Citizen game dev discloses breach affecting user data

www.bleepingcomputer.com · 7 months ago

Cloud Imperium Games, the developer of Star Citizen, recently disclosed a data breach that occurred on January 21, 2026. Attackers gained unauthorized access to backup systems containing limited personal data, including usernames, dates of birth, and contact details. The company reports that no financial information, passwords, or credentials were compromised, and there is no indication the data was released publicly. While CIG believes the incident poses no risk to users, the exposed data could potentially be used in phishing campaigns.

Fortinet FortiGate Devices Targeted by CyberStrikeAI, Allowing Hackers to Bypass Security

gbhackers.com · 7 months ago

Researchers have identified CyberStrikeAI, an AI-powered security testing platform, being used to target Fortinet FortiGate devices globally. Threat actors exploited exposed management ports and weak authentication to compromise over 600 FortiGate devices across 55 countries between January 11 and February 18, 2026. The tool's developer, Ed1s0nZ, has links to China’s Ministry of State Security and the People’s Liberation Army, and has deleted references to a CNNVD Level 2 Contribution Award from their GitHub profile. Security teams are advised to audit FortiGate devices, enforce multi-factor authentication, and monitor network traffic for suspicious activity.

Vulnerability in MS-Agent AI Framework Can Allow Full System Compromise

www.securityweek.com · 7 months ago

A vulnerability exists within the ModelScope MS-Agent AI framework, allowing attackers to execute arbitrary operating system commands. The flaw, tracked as CVE-2026-2256, stems from insufficient input sanitization within the framework's Shell tool, which enables agents to run OS commands. Exploitation can occur through crafted content injected into data sources, potentially leading to full system compromise and data exfiltration. Users are advised to deploy MS-Agent in trusted environments and implement stricter security measures like allowlists and sandboxing.

Hackers Exploit Telegram for Initial Access to Corporate VPN, RDP, and Cloud Systems

gbhackers.com · 7 months ago

Cybercriminals are increasingly exploiting Telegram to gain initial access to corporate networks. Threat actors use the platform to buy and sell stolen credentials from info-stealer data, often sourcing valid VPN and RDP credentials. Telegram’s structure allows for rapid recovery from disruptions and acts as a coordination layer for financially and politically motivated groups. The platform now encompasses multiple stages of the attack lifecycle, lowering the barrier to entry for attackers and accelerating breaches.

Epic Fury Cyber Shock: Iran’s Internet Down, Hacktivists Hit Back

gbhackers.com · 7 months ago

Military action between the United States, Israel, and Iran has triggered a widespread cyber conflict. Iran’s national internet connectivity has been severely disrupted, impacting leadership communications and potentially leading state-sponsored actors to deviate from standard tactics. Numerous hacktivist groups are exploiting the situation with DDoS attacks, website defacement, phishing campaigns, and data theft, including a malicious copy of Israel’s Home Front Command RedAlert application. Threat actors, including financially motivated groups like Tarnished Scorpius, are actively taking advantage of the chaos.

Studie: Hacker legen Betrieb bei vielen Unternehmen lahm

www.csoonline.com · 7 months ago

A recent study reveals that German companies experienced significant cyberattacks last year. Approximately one in seven IT and media service companies and one in eight industrial firms reported damages due to these attacks. Larger companies, those with at least 100 employees, were disproportionately affected, with a fifth of IT firms and 17 percent of industrial firms reporting losses. The most common consequence of these attacks was disruption of business operations, impacting nearly 9 percent of IT firms and 7 percent of industrial firms.

Epic Fury introduces new layer of enterprise risk

www.csoonline.com · 7 months ago

The US military operation, Epic Fury, has introduced a new layer of operational risk for multinational enterprises with interests in the Middle East and globally. Iran possesses a range of capabilities, including physical attacks, cyber operations, proxy networks, targeted assassinations, and disinformation campaigns, which pose a direct threat to enterprise personnel, infrastructure, travel, and digital posture. Organizations should validate assumptions, establish evacuation triggers for personnel, secure essential services, reassess international travel policies, and strengthen cybersecurity defenses against Iranian state-aligned actors who exploit vulnerabilities and target opportunities. Prioritizing preparation and clear execution are vital for mitigating these risks.

UH Cancer Center data breach affects nearly 1.2 million people

www.bleepingcomputer.com · 7 months ago

The University of Hawaii confirmed a ransomware attack on its Cancer Center’s Epidemiology Division in August 2025, impacting nearly 1.2 million people. Compromised data includes names, Social Security numbers, driver's license numbers, and health information from various research studies. The university paid the attackers to obtain a decryption tool and ensure the information was destroyed. This incident follows a previous ransomware attack on a Hawaiʻi Community College in 2023.

Researchers Uncover Method to Track Cars via Tire Sensors

www.securityweek.com · 7 months ago

Researchers have discovered a method to track vehicles using data transmitted from Tire Pressure Monitoring Systems, or TPMS. These systems broadcast unique identifiers in clear text, allowing inexpensive receivers to capture and potentially track vehicles over time. The academics demonstrated the ability to track approximately 20,000 vehicles using five receivers, collecting over six million transmissions. This technology raises concerns about mass driver tracking and potential misuse, such as spoofing sensor signals to hijack cargo.

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

thehackernews.com · 7 months ago

Microsoft has identified phishing campaigns targeting government and public sector organizations that abuse OAuth redirection features. Attackers create malicious applications with rogue redirect URLs to deliver malware without stealing credentials. Victims inadvertently download malware disguised within ZIP archives containing shortcuts and installers, leading to host reconnaissance and potential ransomware activity. The phishing emails use various lures and encoding techniques to increase credibility and sometimes redirect users to credential-stealing frameworks.

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A critical security vulnerability, identified as CVE-2026-20127, exists in Cisco Catalyst SD-WAN Controller and Manager software. This flaw allows unauthenticated attackers to potentially gain administrative access and manipulate network configurations across various deployment types. Cisco recommends immediate upgrades to fixed software releases, ranging from version 20.9.8.2, and advises additional security measures such as access restrictions and log monitoring. The vulnerability was reported by the Australian Cyber Security Centre and has seen limited exploitation.

MS-Agent Vulnerability Exposes AI Agents to Remote Hijacking, Granting Full System Control

gbhackers.com · 7 months ago

A critical vulnerability, tracked as CVE-2026-2256, has been identified in the MS-Agent framework, enabling remote attackers to potentially hijack AI agents and gain control of connected systems. The flaw arises from a command injection vulnerability within the framework’s “Shell tool,” which executes commands on the host operating system. Attackers can bypass security filters through prompt injection techniques, allowing them to run arbitrary commands and access sensitive data. Experts recommend limiting MS-Agent usage to trusted environments, utilizing sandboxes, and implementing stricter allowlist controls to mitigate the risk.

Android gets patches for Qualcomm zero-day exploited in attacks

www.bleepingcomputer.com · 7 months ago

Google has released security updates to address 129 Android vulnerabilities, including a zero-day flaw in a Qualcomm display component that is currently being targeted in limited attacks. This vulnerability, CVE-2026-21385, is an integer overflow that could lead to memory corruption. The updates also resolve ten critical vulnerabilities allowing for remote code execution. Qualcomm’s advisory indicates that the flaw affects 235 chipsets.

Malvertising Campaign Spreads AMOS ‘malext’ macOS Infostealer via Fake Text-Sharing Ads

gbhackers.com · 7 months ago

Researchers have discovered three methods attackers can use to bypass Apple’s Lockdown Mode. These techniques involve exploiting flaws in the Universal Control feature, Bluetooth connections, and the handling of incoming attachments. Attackers could potentially gain unauthorized access to devices and data through these vulnerabilities. The findings highlight a need for enhanced security measures and user awareness regarding potential risks.

Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited

thehackernews.com · 7 months ago

Google has confirmed a high-severity vulnerability, CVE-2026-21385, affecting a Qualcomm component used in Android devices. The flaw is described as a buffer over-read caused by an integer overflow and may be under limited, targeted exploitation. Google’s March 2026 security update addresses 129 vulnerabilities, including CVE-2026-0006, which allows for remote code execution. Several other critical issues were also patched, including privilege escalation bugs (CVE-2026-0047, CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031) and a denial-of-service vulnerability (CVE-2025-48631).

7 factors impacting the cyber skills gap

www.csoonline.com · 7 months ago

false

Google Chrome Introduces Merkle Tree Certificates to Protect HTTPS from Quantum Attacks

gbhackers.com · 7 months ago

Researchers have identified several vulnerabilities affecting Ivanti's Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. These flaws include improper access controls, allowing unauthorized users to potentially gain administrative privileges, and command injection vulnerabilities which could lead to arbitrary code execution. Exploitation of these issues may enable attackers to compromise sensitive data and gain control over managed devices. The identified vulnerabilities have been assigned CVE identifiers CVE-2024-22027, CVE-2024-22028, CVE-2024-22029, CVE-2024-22030, CVE-2024-22031, and CVE-2024-22032.

Hackerbot-Claw Bot Exploits GitHub Actions CI/CD Flaw to Attack Microsoft and DataDog

gbhackers.com · 7 months ago

Researchers have discovered a vulnerability affecting multiple network devices from several vendors. The flaw allows for remote code execution, potentially enabling attackers to gain control of affected systems. There are three methods attackers could exploit this vulnerability: through malformed packets, HTTP requests, and crafted SSH connections. This issue is tracked as CVE-2024-3094.

SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

thehackernews.com · 7 months ago

Cybersecurity researchers have identified a threat activity cluster known as SloppyLemming, also tracked as Outrider Tiger and Fishing Elephant, targeting government entities and critical infrastructure in Pakistan and Bangladesh. The attacks, occurring between 2025 and 2026, utilize two distinct malware chains involving the BurrowShell backdoor and a Rust-based keylogger. These campaigns involve spear-phishing emails with malicious PDF and Excel documents, along with an increased use of Cloudflare Workers infrastructure. The threat actor demonstrates moderate capability and likely pursues intelligence collection aligned with regional strategic competition.

Angular i18n Flaw Lets Hackers Execute Malicious Code via Critical XSS Vulnerability

gbhackers.com · 7 months ago

A critical security flaw has been identified in the Angular web application framework, tracked as CVE-2026-27970. This high-severity Cross-Site Scripting vulnerability exists because Angular improperly sanitizes HTML content within internationalization messages, allowing attackers to execute malicious code if translation files are compromised. Successful exploitation could lead to credential theft or application vandalism. Patched versions are available, and developers should also review translated content, implement Content Security Policy, and enable Trusted Types to mitigate the risk.

Cyberattackers Exploit OpenVSX Aqua Trivy with Malicious AI Prompts to Hijack Coding Tools

gbhackers.com · 7 months ago

Cyberattackers compromised versions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension on OpenVSX between February 27th and 28th, 2026. Malicious code injected prompts to hijack AI coding tools, like Claude, Codex, Gemini, Copilot, and Kiro, to perform system reconnaissance and data exfiltration. The attack, part of a wider campaign called “hackerbot-claw,” involved stealing tokens, taking over repositories, and pushing malicious artifacts. Affected users should uninstall versions 1.8.12 and 1.8.13 and review their systems for unauthorized access.

Android Security Update Fixes 129 Flaws and Tackles Actively Exploited Zero-Day Flaw

gbhackers.com · 7 months ago

Google released the March 2026 Android Security Bulletin addressing 129 vulnerabilities. A high-severity zero-day flaw, CVE-2026-21385, affecting Qualcomm’s Display and Graphics component is under limited, targeted exploitation. The bulletin also resolves critical vulnerabilities including CVE-2026-0006, a Remote Code Execution flaw, and multiple Elevation of Privilege issues within the Kernel and virtualization components. Users are urged to update devices promptly to patch levels 2026-03-05 or later.

AuraStealer Infostealer Targeting Users with 48 C2 Domains in Ongoing Campaigns

gbhackers.com · 7 months ago

A new infostealer called AuraStealer has emerged, rapidly gaining popularity among cybercriminals as a competitor to LummaC2. Threat actors are using it in ongoing campaigns, often leveraging TikTok scams and cracked software distribution to infect users. The malware employs a subscription model and incorporates anti-analysis techniques, including a JavaScript proof-of-work puzzle and code virtualization in development. Researchers have identified 48 command-and-control domains, primarily using.SHOP and.CFD top-level domains, fronted by Cloudflare.

Last Week in Security (LWiS) - 2026-03-02

blog.badsectorlabs.com · 7 months ago

Several cybersecurity vulnerabilities and tools were recently highlighted. Researchers discovered a remote code execution flaw in SolarWinds Web Help Desk, addressed with a workaround that was subsequently bypassed, leading to SYSTEM-level code execution, documented as CVE-2025-40552 and CVE-2025-40553. Windows 11 also has a local privilege escalation vulnerability, CVE-2025-60710, while Unitree robots have two remote code execution vulnerabilities, CVE-2026-27509 and CVE-2026-27510. Additionally, a technique allows abuse of Cortex XDR Live Terminal as a command and control channel and a vulnerability in Telnetd allows root access through environment variables.

Chrome Gemini Vulnerability Lets Attackers Access Victims’ Camera and Microphone Remotely

gbhackers.com · 7 months ago

A high-severity vulnerability, CVE-2026-0628, was recently discovered in Google Chrome’s Gemini Live integration. The flaw allowed malicious browser extensions to hijack the Gemini panel, potentially granting unauthorized access to a user’s camera, microphone, and local files. Researchers found that the vulnerability stems from how Chrome handles the Gemini web app within the new side panel, allowing attackers to exploit elevated privileges. Google released a patch in January 2026 to address the security risk.

Das gehört in Ihr Security-Toolset

www.csoonline.com · 7 months ago

Es gibt 13 essenzielle Security-Toolkategorien für Unternehmen, die als Pflichtbestandteile moderner Sicherheits-Toolsets empfohlen werden. Zu den wichtigsten gehören KI-gestützte Extended Detection and Response zur Echtzeit-Erkennung und Priorisierung von Bedrohungen, Multifaktor-Authentifizierung, Network Access Control, Data Loss Prevention, Next-Generation-Firewalls, Intrusion Prevention Systeme, Identity and Access Management, Cloud Access Security Broker, Anti-Malware, Mobile Threat Defense, Backup und Disaster Recovery, Incident Response sowie AI Security Posture Management zur Absicherung von KI-Infrastrukturen. Diese Lösungen sollen komplexe IT-Umgebungen, regulatorische Vorgaben sowie Mobile- und IoT-Geräte schützen, Datenabfluss und Insider-Bedrohungen verhindern und die Wiederherstellbarkeit nach Ransomware- und anderen Angriffen gewährleisten.

OpenAI Amends A.I. Deal With the Pentagon

www.nytimes.com · 7 months ago

OpenAI has revised its agreement with the Defense Department following public criticism. The amended contract includes additional safeguards to prevent the technology from being used for domestic surveillance of U.S. citizens. Specifically, the agreement prohibits tracking, surveillance, or monitoring of U.S. persons and nationals. OpenAI’s CEO emphasized the importance of protecting civil liberties and plans to continue refining the technology.

CyberStrikeAI tool adopted by hackers for AI-powered attacks

www.bleepingcomputer.com · 7 months ago

Researchers have linked a newly identified open-source AI security testing platform called CyberStrikeAI to a recent campaign targeting hundreds of Fortinet FortiGate firewalls. CyberStrikeAI integrates over 100 security tools and uses AI models like GPT to automate tasks, including vulnerability discovery and attack-chain analysis. The platform’s developer, known as Ed1s0nZ, has connections to organizations linked to Chinese government cyber operations and has received awards from the China National Vulnerability Database. Experts warn that tools like CyberStrikeAI will likely increase automated targeting of edge devices and lower the barrier to entry for complex network exploitation.

The Pentagon’s Favorite Tech Guy Is This Hawaiian Shirt-Wearing Founder

www.nytimes.com · 7 months ago

false

Critical OpenClaw Vulnerability Exposes AI Agent Risks

www.darkreading.com · 7 months ago

A recently patched vulnerability in the AI agent OpenClaw, previously known as MoltBot, allowed attackers to hijack a developer's agent through a malicious website without user interaction. The flaw stemmed from OpenClaw's failure to verify connections, enabling attackers to potentially gain control of a developer's device. Security experts recommend immediate updates to version 2026.2.25 or later and layered defenses, including API security and credential controls, to mitigate risks associated with locally run AI agents. Several vulnerabilities have been identified, including CVE-2026-25253, CVE-2026-24763, CVE-2026-25157 and CVE-2026-25475.

The Tug-of-War Over Firewall Backlogs in the AI-Driven Development Era

www.darkreading.com · 7 months ago

false

How Talks Between Anthropic and the Defense Dept. Fell Apart

www.nytimes.com · 7 months ago

false

Cyber Command disrupted Iranian comms, sensors, top general says

therecord.media · 7 months ago

U.S. Cyber Command played a key role in recent military operations against Iran, disrupting communications and sensor networks to support the bombing campaign. These operations, alongside U.S. Space Command efforts, aimed to disorient and confuse Iranian forces. Previous Cyber Command activities have included disrupting missile defense systems in Iran and targeting power infrastructure in Venezuela. Jordanian officials recently prevented an Iranian cyberattack targeting their wheat storage systems.

30 Alleged Members of 'The Com' Arrested in Project Compass

www.darkreading.com · 7 months ago

Law enforcement agencies across 28 countries have launched "Project Compass" to disrupt "The Com," a network of cybercriminals targeting young people. The operation has resulted in 30 arrests and the identification of 179 members, with 62 victims identified and four safeguarded. "The Com" recruits and radicalizes individuals, primarily between 13 and 25, through social media and online platforms, engaging in cyber activity, offline acts of terrorism, and extortion. A sub-group, "764," is known for grooming tactics and producing child sexual exploitation material, and was previously targeted by US authorities.

Fake Google Security site uses PWA app to steal credentials, MFA codes

www.bleepingcomputer.com · 7 months ago

A phishing campaign is using a fake Google security website to trick users into installing a malicious Progressive Web App, or PWA. This PWA can steal one-time passcodes, cryptocurrency wallet addresses, and harvest data like contacts and GPS locations. The malware also functions as an HTTP proxy, allowing attackers to route traffic through the victim’s browser and scan internal networks. An accompanying malicious Android application requests excessive permissions, including access to SMS texts and call logs, furthering the potential for device compromise.

Vulnerability monitoring service secures public-sector websites faster

www.csoonline.com · 7 months ago

A new vulnerability monitoring service in the UK has significantly improved the speed of fixing cybersecurity weaknesses across 6,000 public bodies. The service has reduced median remediation time for general cyber vulnerabilities from 53 days to 32, and slashed DNS-specific fix times from 50 days to eight. The government is also launching a £210 million Cyber Action Plan and a Cyber Profession to address workforce skills gaps and enhance overall cyber resilience. Experts emphasize that clear communication of vulnerability impact is more crucial than simply deploying technology.

OAuth redirection abuse enables phishing and malware delivery

www.microsoft.com · 7 months ago

Researchers have discovered a new phishing technique that exploits OAuth authentication protocols. Attackers craft malicious URLs that redirect users to attacker-controlled websites without stealing authentication tokens, effectively bypassing traditional phishing defenses. The attack involves creating fake OAuth applications and manipulating URL parameters to trigger error redirects, ultimately delivering malware through methods such as malicious ZIP files and PowerShell execution. Organizations are advised to strengthen OAuth governance and implement Conditional Access policies to mitigate this evolving threat.

Paramount Won Over Warner Bros. Now for the Regulators.

www.nytimes.com · 7 months ago

false

University of Hawaiʻi Cancer Center confirms data leak following ransomware attack

therecord.media · 7 months ago

A ransomware attack on the University of Hawaiʻi Cancer Center’s epidemiology division has resulted in a data leak affecting up to 1.2 million people. Stolen information includes Social Security numbers, driver’s license numbers, voter registration records, and health-related data from various research studies. The university engaged with the threat actors to protect sensitive information and claims the stolen data has not been misused. Investigations are ongoing, and the University of Hawaiʻi system is now reviewing its information technology systems.