Blahalla

Alabama man pleads guilty to hacking, extorting hundreds of women

www.bleepingcomputer.com · 7 months ago

A 22-year-old Alabama man has pleaded guilty to multiple charges including extortion and cyberstalking after gaining unauthorized access to hundreds of young women's social media accounts. Between 2022 and 2025, the suspect impersonated individuals to obtain login credentials and then threatened to release private images and videos unless victims complied with his demands. Authorities describe a calculated scheme exploiting trust to steal intimate content and extort victims for money or further access. Another individual, Kyle Svara, recently pleaded guilty to a similar crime involving Snapchat accounts.

Florida woman imprisoned for massive Microsoft license fraud scheme

www.bleepingcomputer.com · 7 months ago

A Florida woman has been sentenced to 22 months in prison for a years-long scheme involving stolen Microsoft Certificate of Authenticity labels. Heidi Richards, operating as Trinity Software Distribution, obtained tens of thousands of these labels and extracted their product key codes. She then sold these keys in bulk online, generating over five million dollars. Prosecutors say these labels should only be sold with the software they accompany, and not as standalone items.

New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel

thehackernews.com · 7 months ago

A security vulnerability has been discovered and patched in Google Chrome that could have allowed attackers to escalate privileges. The flaw, CVE-2026-0628, involved insufficient policy enforcement in the WebView tag, potentially enabling malicious extensions to inject scripts into the Gemini Live panel. This could have given attackers unauthorized access to a user's camera, microphone, screenshots, and local files. Researchers warn that integrating AI features directly into browsers creates new attack vectors and underscores the importance of carefully managing permissions.

Google Develops Merkle Tree Certificates to Enable Quantum-Resistant HTTPS in Chrome

thehackernews.com · 8 months ago

Google is developing Merkle Tree Certificates, or MTCs, to create a quantum-resistant HTTPS system for Chrome. This new system will replace traditional X.509 certificates, reducing the size of data transmitted during secure connections. The implementation will occur in three phases, beginning now with a feasibility study and culminating in the third quarter of 2027 with a new Quantum-resistant Root Store. Google’s goal is to maintain internet speed and performance while enhancing security against future quantum computing threats.

Reporters Seek Comment. What Happens Next May Surprise You.

www.nytimes.com · 8 months ago

false

Alleged India-linked espionage campaign targeted Pakistan, Bangladesh, Sri Lanka

therecord.media · 8 months ago

A cybersecurity firm identified a year-long espionage campaign targeting government agencies and critical infrastructure in Pakistan, Bangladesh, and Sri Lanka. The attacks, attributed to the SloppyLemming group with ties to India, involved malicious PDF and Excel documents containing malware like BurrowShell, which has keylogging and reconnaissance capabilities. Targets included nuclear regulatory bodies, telecommunications providers, energy utilities, and financial institutions. The campaign utilized deceptive domain names and social engineering tactics to distribute the malware.

UK warns of Iranian cyberattack risks amid Middle-East conflict

www.bleepingcomputer.com · 8 months ago

The United Kingdom's National Cyber Security Centre is warning organizations about a heightened risk of cyberattacks from Iran due to the ongoing conflict in the Middle East. While the direct threat level to the UK has not significantly changed, it could escalate quickly. Iranian state-sponsored hacking groups are likely still capable of launching attacks, even amidst internet restrictions within Iran. Organizations are advised to review security measures, particularly those with Middle Eastern operations or supply chains.

Google and Cloudflare testing Merkel Tree Certificates instead of normal signatures for TLS

blog.cloudflare.com · 8 months ago

false

Vulnerability Allowed Hijacking Chrome’s Gemini Live AI Assistant

www.securityweek.com · 8 months ago

A recently patched vulnerability in Chrome, identified as CVE-2026-0628, could have allowed malicious browser extensions to hijack the Gemini Live AI assistant. This vulnerability permitted extensions to inject JavaScript code, granting them access to privileged system resources like the camera, microphone, and local files. The flaw stemmed from the declarativeNetRequests API, which enables extensions to modify web requests. Google addressed this issue in Chrome version 143 for Windows, macOS, and Linux.

Free browser-based steganography CTF generator create challenges with randomized encoding pipelines, auto-generated solutions, and progressive hints

8gwifi.org · 8 months ago

false

How Deepfakes and Injection Attacks Are Breaking Identity Verification

www.bleepingcomputer.com · 8 months ago

Cybercriminals are increasingly using sophisticated techniques like deepfakes, injection attacks, and replayed footage to bypass identity verification systems. These attacks target customer onboarding, remote hiring, and account recovery processes, enabling fraud and persistent access to sensitive systems. Traditional deepfake detection alone is insufficient; organizations need full-session validation including perception, device integrity, and behavioral signals to verify identity. Researchers at Purdue University's Political Deepfakes Incident Database benchmark found that Incode’s Deepsight demonstrated strong results for media detection under real-world conditions, but noted that a layered approach is required to combat the evolving threat landscape.

OpenClaw Vulnerability Allowed Websites to Hijack AI Agents

www.securityweek.com · 8 months ago

A vulnerability in the OpenClaw AI assistant allowed attackers to hijack agents through malicious websites. The vulnerability exploited the system’s default configuration, which trusted connections made to localhost. Attackers could brute-force the gateway’s password due to the absence of rate limiting for local connections, then gain full control of the AI agent. Users should update to version 2026.2.25 or later to address this high-severity issue.

Link11 Releases European Cyber Report 2026: DDoS Attacks Become a Constant Threat

gbhackers.com · 8 months ago

A new report from Link11 reveals a significant increase in distributed denial-of-service, or DDoS, attacks across Europe. In 2025, the number of documented attacks rose 75 percent, with the longest attack lasting over 12,300 minutes, or more than eight days. Experts note a concerning trend where 70 percent of companies initially targeted experience follow-up attacks, with an average of 2.8 additional attacks recorded. The report emphasizes the need for proactive, automated, and architecturally anchored resilience measures, including web application and API protection.

German court convicts alleged mastermind behind global investment scam network

therecord.media · 8 months ago

A German court has sentenced a man to seven-and-a-half years in prison for his role in a global investment scam network known as the Milton Group. The scheme, operating between 2017 and 2019, defrauded victims, primarily in German-speaking countries, of approximately €8 million through fake online trading platforms. The defendant created and sold software, PumaTS, that allowed other criminal groups to replicate the scam, resulting in an additional €42 million in damages. He confessed as part of a plea agreement and the court ordered the confiscation of €2.4 million.

Madison Square Garden Data Breach Confirmed Months After Hacker Attack

www.securityweek.com · 8 months ago

Madison Square Garden has confirmed a data breach linked to a cybercrime campaign targeting customers of Oracle’s E-Business Suite. Hackers, associated with the Cl0p ransomware group, exploited zero-day vulnerabilities to steal data from over 100 organizations. Personal information, including names and Social Security numbers, was compromised in August 2025. MSG Entertainment is now notifying affected individuals, with at least 11 residents of Maine known to be impacted.

British organizations urged to be alert to threat of Iranian cyberattacks

therecord.media · 8 months ago

British organizations are being urged to strengthen their cyber defenses due to the escalating conflict in the Middle East. While the direct cyber threat from Iran to the UK remains unchanged, there is a heightened risk of indirect attacks targeting those with interests in the region. The National Cyber Security Centre recommends organizations review guidance and prepare for potential cyber compromises. Prime Minister Keir Starmer confirmed British armed forces are intercepting Iranian strikes and protecting regional assets.

MSHTML Zero-Day in Windows Exploited by APT28 Prior to Feb 2026 Security Update

gbhackers.com · 8 months ago

A critical zero-day vulnerability, CVE-2026-21513, has been identified in the Windows MSHTML framework, allowing attackers to bypass security features and execute code. The Russian state-sponsored threat group, APT28, was actively exploiting this flaw before Microsoft released a security patch in February 2026. Attackers used malicious Windows Shortcut files containing hidden HTML payloads to connect to attacker-controlled domains and deliver malware, bypassing security defenses like Mark of the Web and Internet Explorer Enhanced Security Configuration. Microsoft’s February 2026 update addressed the vulnerability by implementing stricter hyperlink protocol validation.

TPMS Flaw in Toyota, Mercedes, and Other Major Brands Enables Covert Vehicle Tracking

gbhackers.com · 8 months ago

Tire pressure monitoring systems, or TPMS, in vehicles from major brands like Toyota, Mercedes, and others are broadcasting unencrypted radio signals that can be used to track vehicles. Researchers demonstrated that a network of low-cost receivers can collect these signals to map vehicle movements, infer driver routines, and even identify vehicle types. This passive tracking is difficult to detect and poses a privacy risk as drivers cannot easily disable TPMS due to legal requirements. Experts recommend manufacturers implement encrypted, rotating identifiers for TPMS to address this vulnerability.

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More

thehackernews.com · 8 months ago

Cybersecurity threats are intensifying with attacks now exploiting vulnerabilities in Cisco SD-WAN equipment, identified as CVE-2026-20127, and leveraging AI models. Chinese cyber espionage groups are targeting organizations using novel backdoors, while misconfigured cloud API keys are exposing sensitive data. Supply chain risks are also a growing concern, particularly related to AI development tools, and numerous critical vulnerabilities across multiple vendors require immediate remediation. These developments underscore the need for proactive security measures and continuous vigilance against increasingly sophisticated attacks.

Proof-of-Concept Released for Windows ALPC Privilege Escalation via Error Reporting

gbhackers.com · 8 months ago

A critical local privilege escalation vulnerability, CVE-2026-20817, impacts Windows Error Reporting, allowing low-privileged users to gain SYSTEM access. The flaw arises from insufficient privilege validation within the SvcElevatedLaunch method, enabling attackers to execute arbitrary code. Microsoft patched the vulnerability in the January 2026 security updates, and organizations should deploy those updates immediately. Security teams should also monitor for unusual WerFault.exe activity to detect potential exploitation.

Quantum-Resistant Data Diode Secures Sensitive Data on Edge Devices, Critical Systems

www.darkreading.com · 8 months ago

A startup called Forward Edge-AI has developed a quantum-resistant data diode, called Isidore Quantum, to protect sensitive data on edge devices and critical systems. The device ensures data flows in only one direction and encrypts it using quantum-resistant algorithms, co-developed with the U.S. government and Microsoft. The device has been validated through 23 government pilots and is designed to prevent harvest-and-decrypt-later attacks as quantum computing capabilities advance, with the U.S. government anticipating widespread adoption of quantum-safe protocols by the early 2030s. Isidore Quantum achieves compliance with NIST’s FIPS 140-3 and utilizes machine learning to detect and respond to potential cyberattacks.

Nick Andersen Appointed Acting Director of CISA

www.securityweek.com · 8 months ago

false

UXSS Vulnerability in DuckDuckGo Browser’s AutoConsent JS Bridge Allows Cross-Origin Attacks

gbhackers.com · 8 months ago

A critical vulnerability has been discovered and patched in the DuckDuckGo browser for Android. The flaw, found in the AutoConsent JS bridge, allowed malicious code from untrusted sources to execute on trusted webpages, bypassing the Same-Origin Policy. This Universal Cross-Site Scripting vulnerability could have allowed attackers to steal cookies, modify data, or inject content. The vulnerability has a CVSS score of 8.6 and users are urged to update their DuckDuckGo browser.

AWS Expands Security Hub Into a Cross-Domain Security Platform

www.securityweek.com · 8 months ago

false

Anthropic confirms Claude is down in a worldwide outage

www.bleepingcomputer.com · 8 months ago

false

OneUptime Command Injection Vulnerability Poses Major Risk of Full System Takeover

gbhackers.com · 8 months ago

A critical command injection vulnerability, CVE-2026-27728, has been discovered in the OneUptime platform. The flaw allows authenticated users to execute arbitrary commands on the Probe server, potentially leading to full system takeover. The vulnerability arises from improper handling of user-supplied input within the NetworkPathMonitor.performTraceroute() function and is resolved in version 10.0.7 by replacing the vulnerable exec() function with execFile(). Organizations are urged to immediately upgrade to a patched version and review existing configurations.

LLM-Assisted Deanonymization

www.schneier.com · 8 months ago

Large language model agents can now de-anonymize individuals from anonymous online posts. Researchers have demonstrated the ability to identify users from a small number of comments across platforms like Hacker News, Reddit, and LinkedIn. This process involves inferring personal details like location and interests, then using those details to search for the individual online. The technique scales to identify tens of thousands of potential candidates and overcomes previous limitations regarding unstructured data.

GTFire Phishing Campaign Exploits Google Services to Bypass Detection and Harvest Credentials

gbhackers.com · 8 months ago

A large-scale phishing campaign called GTFire is using Google services to bypass security measures and steal credentials. Attackers are hosting fake login pages on free Firebase Hosting domains and masking them with Google Translate links to appear legitimate. The operation has targeted over 1,000 organizations across more than 100 countries, with Mexico, the United States, Spain, India, and Argentina being particularly affected. Stolen data is then sent to command-and-control servers using automated PHP scripts.

Langflow CSV Agent Flaw Could Let Attackers Execute Arbitrary Code

gbhackers.com · 8 months ago

A critical vulnerability, CVE-2026-27966, has been found in Langflow, a low-code application building tool. The flaw resides in the CSV Agent node and allows attackers to execute arbitrary code through a Remote Code Execution vulnerability. This occurs because a parameter controlling the Python REPL tool was hardcoded to True, enabling prompt injection attacks. Users are urged to update to version 1.8.0 to resolve the issue, or disable the dangerous Python REPL tool by default.

How to Protect Your SaaS from Bot Attacks with SafeLine WAF

thehackernews.com · 8 months ago

SaaS products are increasingly facing automated attacks, including fake sign-ups, credential stuffing, API scraping, and abusive automation, which can lead to rising server costs and strained resources. A self-hosted web application firewall, like SafeLine, can protect these applications by inspecting HTTP requests and understanding traffic behavior rather than just blocking known bad IPs. SafeLine utilizes rule-based checks, semantic analysis, anti-bot challenges, rate limiting, and identity access controls to detect and mitigate these threats, allowing teams to focus on product development and customer experience. Deployment is simple, and a free edition is available, with advanced features requiring a paid license.

North Korean APT Targets Air-Gapped Systems in Recent Campaign

www.securityweek.com · 8 months ago

A North Korea-linked threat actor, known as APT37, recently launched a campaign called Ruby Jumper, targeting air-gapped systems. The campaign utilizes multiple malicious tools, including RestLeaf, SnakeDropper, and ThumbsBD, which leverage cloud storage for command and control and employ USB drives for data exfiltration and propagation. VirusTask replaces legitimate files with malicious shortcuts to spread malware and FootWine, an Android package, provides surveillance capabilities. Security experts recommend focusing on endpoint activity and physical access points to mitigate this threat.

Google Working Towards Quantum-Safe Chrome HTTPS Certificates

www.securityweek.com · 8 months ago

Google is working to safeguard Chrome’s HTTPS certificates against potential threats from quantum computers. The company plans to transition to Merkle Tree Certificates, which will reduce bandwidth usage and improve the speed of TLS connections while maintaining security. This phased approach involves inviting Certificate Transparency Log operators to create public Merkle Trees and establishing a new Quantum-resistant Root Store. The transition is expected to be completed by the third quarter of 2027, allowing sites to optionally use quantum-resistant certificates.

US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates

www.securityweek.com · 8 months ago

Escalating tensions between the United States, Israel, and Iran have resulted in both physical attacks and widespread cyber operations. US and Israeli forces reportedly launched cyberattacks against Iranian news agencies, communications infrastructure, and government services, while Iranian-linked groups have targeted Israeli and US military logistics providers, industrial control systems, and air defense systems. Cybersecurity experts warn of potential DDoS attacks and data-wiping operations, and note that claims of cyberattack impact may be exaggerated, though vigilance remains crucial. The conflict has seen Iran leverage what hackers call “The Great Epic” cyber campaign.

Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel

unit42.paloaltonetworks.com · 8 months ago

Researchers discovered a high-severity vulnerability, CVE-2026-0628, in Google Chrome’s new Gemini AI feature. A malicious browser extension could have injected code into the Gemini panel, allowing it to access sensitive system resources like the camera, microphone, local files, and take screenshots without user consent. Google released a fix in early January 2026, and Palo Alto Networks products, such as Prisma Browser, are designed to prevent similar extension-based attacks. The incident highlights emerging security risks associated with integrating AI into web browsers.

Innovation without exposure: A CISO’s secure-by-design framework for business outcomes

www.csoonline.com · 8 months ago

Security leaders must enable AI, connect IoT, and modernize cloud while reducing exposure, so innovation must be disciplined to prevent shadow IT, tool sprawl, and fragile architectures. A secure by design framework grounded in four outcomes operational capacity security advantage risk containment and business velocity starts by automating toil to reduce burnout and giving teams ownership of measurable experiments that must have clear exit plans. For AI minimize data sent to models apply context aware controls keep humans in the loop make outputs auditable and treat adversarial AI as a first class threat while for IoT enforce device identity secure updates segmentation inventory and end of life and for cloud build guardrailed landing zones policy as code secure CI CD pipelines and golden path templates. Run innovation like a portfolio by defining business and security outcomes measuring impact and following a 90 day plan to establish a runway run two pilots with exit criteria and then operationalize successful patterns while retiring failures to avoid innovation debt.

Cyberattack briefly disrupts Russian internet regulator and defense ministry websites

therecord.media · 8 months ago

Russian government websites, including those of the internet regulator Roskomnadzor and the defense ministry, experienced brief disruptions last week due to a distributed denial-of-service attack. The attack originated from servers and botnets located in Russia, the United States, China, the United Kingdom, and the Netherlands. Roskomnadzor, which oversees internet censorship in Russia, stated that the attack has been contained, although some users continued to report access problems. The group responsible for the incident has not yet been identified.

APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

thehackernews.com · 8 months ago

Researchers have linked the threat actor APT28 to the exploitation of CVE-2026-21513, a security feature bypass vulnerability in Microsoft’s MSHTML Framework. The flaw, which has a CVSS score of 8.8, was patched in February 2026 but was used as a zero-day. Attackers could trick victims into opening malicious HTML or shortcut files to bypass security features and potentially execute code. This exploit leverages infrastructure previously associated with APT28 and was flagged by the Computer Emergency Response Team of Ukraine.

Bug in Google's Gemini AI Panel Opens Door to Hijacking

www.darkreading.com · 8 months ago

A security flaw has been found and fixed in Google's Gemini AI panel within the Chrome browser. The vulnerability, tracked as CVE-2026-0628, allowed malicious browser extensions to escalate privileges and access sensitive user data, including camera, microphone, screenshots, and local files. Researchers demonstrated how an extension could hijack the Gemini panel, and Google has since patched the issue. This incident highlights new security risks associated with agentic AI browsers and the need for enhanced browser security and monitoring.

A scorecard for cyber and risk culture

www.csoonline.com · 8 months ago

There are five places where cybersecurity and risk culture shows up: when someone asks for an exception, when a change goes in late, when an alert fires at two a.m., when a junior analyst spots something odd and wonders whether to escalate, and when executives trade speed for safety. Organizations should redesign their operating system to make ownership the obvious move by making the secure path the easiest choice, clarifying decision rights in plain language, embedding lightweight security checks into workflows, creating local ownership roles with authority, and handling consequences consistently to protect good faith reporting. Culture should be measured with a simple scorecard focused on five metrics that drive ownership, including speak up rate, time to escalation, repeat exception rate, phishing reporting ratio, and fix forward rate, and those metrics must be owned, reviewed regularly, and validated to ensure they reduce harm rather than generate theater.

Project Compass Operation Cracks Down on “The Com” Cybercrime Collective – 30 Arrested, 179 Suspects Identified

gbhackers.com · 8 months ago

An international law enforcement operation called Project Compass has targeted "The Com," a transnational virtual network involved in cybercrime, extortion, and manipulation. Thirty suspects have been arrested and 179 potential perpetrators identified through a collaborative effort involving agencies from 30 nations. The network operates through specialized divisions including Cyber Com, Offline Com, and (S)extortion Com, with a subgroup known as "764" particularly concerning due to its violent tactics and exploitation of young people. Project Compass aims to combat the decentralized nature of these networks through intelligence sharing and coordinated action.

Hackers Launch Massive SonicWall Firewall Attack Using 4,000+ IP Addresses

gbhackers.com · 8 months ago

Hackers are actively scanning SonicWall firewalls worldwide to identify vulnerable devices with exposed SSL VPN services. The activity, which occurred between February 22 and 25, 2026, involved over 84,000 scanning sessions from more than 4,000 unique IP addresses. The scans primarily targeted a single SonicOS REST API endpoint, indicating reconnaissance for future credential stuffing and vulnerability exploitation. Security researchers note that this activity mirrors a previous campaign and highlights SonicWall VPNs as a prime target for ransomware groups like Akira and Fog, and CVE-2024-53704 is of particular concern. Organizations are urged to immediately restrict access, enforce multi-factor authentication, and patch vulnerabilities.

Angular SSR Flaw Enables Unauthorized Server-Side Requests in Web Apps

gbhackers.com · 8 months ago

A critical vulnerability, tracked as CVE-2026-27739, has been identified in Angular Server-Side Rendering (SSR) that allows for Server-Side Request Forgery (SSRF) and Header Injection attacks. The flaw arises from Angular's insufficient validation of HTTP headers like Host and X-Forwarded- when reconstructing URLs, potentially leading to credential theft, internal network probing, and data exposure. Successful exploitation requires the application to use Angular SSR and HttpClient, and relies on the attacker's ability to influence headers without proper validation. Developers are advised to update affected packages or implement workarounds like using absolute URLs and strict header validation.

North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT

thehackernews.com · 8 months ago

North Korean hackers are using a new technique called StegaBin to distribute malware through malicious npm packages. Twenty-six packages disguised as developer tools have been published to the npm registry, employing Pastebin steganography to hide command-and-control URLs. Once installed, the packages deploy a credential-stealing remote access trojan, targeting developers and leveraging Vercel infrastructure for payload delivery. The malware includes modules for keylogging, browser credential theft, and Git repository exfiltration, connecting to 103.106.67[.]63:1244 and 103.106.67[.]63:1247.

Hacker erpressen weniger Lösegeld

www.csoonline.com · 8 months ago

Ransomware attacks generated 820 million dollars in 2025, a 28 percent decrease from the previous year. Despite the drop in overall earnings, the number of attacks increased by 50 percent. The decline in total revenue is attributed to more organizations refusing to pay ransoms, due to the risk of repeat attacks and potential legal consequences. Although overall earnings decreased, the average ransom payment rose significantly to almost 60000 dollars.

OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure

gbhackers.com · 8 months ago

A new botnet Trojan campaign called OCRFix is using deceptive tactics to infect systems. The operation begins with a fake Tesseract OCR download site and ClickFix-style PowerShell prompts to trick users into executing malicious scripts. The botnet employs EtherHiding on the BNB Smart Chain TestNet to conceal its command and control infrastructure, making detection difficult. The malware drops multiple executables and DLLs, ultimately turning infected machines into bot listeners that beacon data to control panels hosted on domains such as ldlture.com. No CVEs were mentioned.

Middle East AWS Outage Sends Shockwaves Through Cloud Infrastructure Service

gbhackers.com · 8 months ago

A significant infrastructure incident in the Middle East caused a widespread Amazon Web Services outage impacting the ME-CENTRAL-1 and ME-SOUTH-1 regions. Physical damage to a data center in the UAE, specifically mec1-az2, initiated the event when external objects struck the facility, leading to a fire and a complete power shutdown. The disruption affected numerous AWS services including EC2, RDS, DynamoDB, Lambda, and EKS, with over 84 services experiencing issues across both regions. AWS implemented mitigation strategies by rerouting traffic and advising administrators to utilize alternative Availability Zones to minimize further impact.

CISA Alerts on RESURGE Malware Exploiting Ivanti Connect Secure Zero-Days

gbhackers.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has identified a new malware family called RESURGE, which exploits a zero-day vulnerability in Ivanti Connect Secure devices. RESURGE builds upon earlier malware and can create web shells, manipulate integrity checks, and steal credentials, even persisting through system reboots. The intrusions are linked to CVE-2025-0282, a stack-based buffer overflow vulnerability. CISA recommends a full factory reset of affected appliances and resetting passwords for all accounts, including the krbtgt account, to ensure complete removal.

How CISOs can build a resilient workforce

www.csoonline.com · 8 months ago

false

Prayer App Used by Millions Hacked to Broadcast Defection Messages Amid U.S.-Israel Strikes on Iran

gbhackers.com · 8 months ago

A popular Iranian prayer application, BadeSaba Calendar, was hacked to send anti-government messages to over 5 million users during coordinated U.S. and Israeli military strikes on Iran. The messages, appearing as push notifications, urged military personnel to surrender and promised amnesty. Following the incident, Iran experienced a significant digital blackout, with network traffic dropping to just 4 percent of normal levels and international connectivity lost at major data centers. Cybersecurity experts believe this was a sophisticated, pre-planned operation likely conducted by a nation-state.

Pixel Perfect Browser Extension Exploited for Stealth Script Injection and Security Header Stripping

gbhackers.com · 8 months ago

A popular Chrome extension, QuickLens, Search Screen with Google Lens, has been compromised and transformed into a remote code-execution platform. Malicious actors acquired the extension and introduced version 5.8, adding capabilities to strip security headers like Content-Security-Policy and X-XSS-Protection, allowing arbitrary script injection. The extension now communicates with api.extensionanalyticspro.top, utilizing a pixel-based technique to execute JavaScript payloads and potentially steal user data. The extension has been removed from the Chrome Web Store due to a policy violation.