Blahalla

Malicious Blender model files deliver StealC infostealing malware

www.bleepingcomputer.com · 8 months ago

A Russian linked campaign is delivering the StealC V2 information stealer through malicious Blender model files uploaded to 3D marketplaces such as CGTrader, exploiting Blender's Auto Run Python Scripts feature to execute embedded code when a user opens a file. The embedded Python fetches a loader from a Cloudflare Workers domain which then downloads a PowerShell script that retrieves two archives named ZalypaGyliveraV1 and BLENDERX from attacker controlled IP addresses, unpacks them into the TEMP folder, drops LNK files in the Startup directory for persistence, and installs StealC V2 alongside an auxiliary Python stealer. StealC V2 can exfiltrate credentials and data from more than 23 browsers with server side credential decryption including Chrome 132 and later, over 100 cryptocurrency wallet browser extensions and 15 wallet apps, messaging and mail clients, and it includes an updated UAC bypass while showing no detections on VirusTotal in the analyzed sample. Users are advised to disable Auto Run Python Scripts in Blender preferences, treat third party 3D assets like executables, only trust publishers with a proven record, and test files in sandboxed environments.
Critical Flaw in Oracle Identity Manager Under Exploitation

www.darkreading.com · 8 months ago

There is a critical flaw in Oracle Identity Manager that is being actively exploited. The vulnerability is tracked as CVE 2025 61757 and its exploitation follows a breach of Oracle Cloud earlier this year as well as a recent extortion campaign targeting Oracle E Business Suite customers.
The challenge to test my software consists of breaking a meta-cloaker.

www.reddit.com · 8 months ago

There is a public challenge inviting researchers to test a cloaking system that its creator claims is evading Meta detection. Participants are asked to identify vulnerabilities or leaks in the cloaker and may be rewarded with a prize or potential collaboration if they demonstrate a real flaw. The challenge highlights that the advertisement shown on Meta differs from the landing page, and challengers are encouraged to prove whether they can break the system.
Infamous Shai-hulud Worm Resurfaces From the Depths

www.darkreading.com · 8 months ago

The Shai hulud self replicating worm has reemerged with a variant that executes malicious code during the preinstall phase and has compromised more than 25,000 repositories across hundreds of users by using stolen maintainer accounts to publish poisoned packages. The campaign has impacted packages maintained by ENS Domains, PostHog, Postman, and Zapier and is stealing credentials for GitHub, Azure, AWS, and GCP during installation. If credential theft or exfiltration fails, the new variant attempts destructive sabotage by deleting every writable file owned by the user under their home directory, marking an escalation from data theft to punitive sabotage. Recommended mitigations include scanning endpoints for indicators of compromise, removing compromised package versions, temporarily freezing updates, performing complete credential rotation, enabling multifactor authentication, signing artifacts, restricting NPM lifecycle scripts, and moving to short lived scoped tokens and safer credential storage.
ClickFix attack uses fake Windows Update screen to push malware

www.bleepingcomputer.com · 8 months ago

Threat actors are using ClickFix variants that present a realistic full screen Windows Update animation in a browser to trick users into pasting and executing commands that install malware. Operators hide encrypted payloads inside PNG images using steganography and deliver them via multi stage chains that invoke mshta, PowerShell, and a.NET Stego Loader which reconstructs and decrypts shellcode in memory, ultimately unpacking LummaC2 and Rhadamanthys infostealers. Researchers observed evasion techniques such as trampoline call chains and use of the Donut packer to execute in memory payloads, and law enforcement disruptions on November 13 stopped payload delivery from some fake Windows Update domains. Recommended mitigations include disabling the Windows Run box, monitoring for suspicious process chains like explorer.exe spawning mshta.exe or PowerShell, and checking the RunMRU registry key during incident investigations.
SitusAMC Cyber Breach Sparks Fallout for JPMorgan, Citi, and Morgan Stanley

www.techrepublic.com · 8 months ago

There was a cyberattack on mortgage processing vendor SitusAMC that the company said it discovered on November 12 and later confirmed involved theft of internal corporate data tied to client relationships, including accounting records and legal agreements. Multiple major banks including JPMorgan Chase, Citigroup, and Morgan Stanley were notified that their data may have been compromised and institutions are assessing whether customer data tied to mortgages and real estate loans was accessed. SitusAMC said the incident is contained, no encrypting malware was involved, its services are fully operational, and federal authorities and cybersecurity experts are investigating, underscoring the risks posed by third party vendors.
A systemic flaw in Binance’s IP Whitelisting model: listenKeys bypass the protection entirely

www.reddit.com · 8 months ago

There is an architectural trust boundary flaw in Binance API design where a listenKey used for user data streams can be requested using only the API key without the secret, and the listenKey is not protected by IP whitelisting even though API keys are. As a result, leaked listenKeys can be reused from any IP to observe real-time trading telemetry including open orders, balance changes, stop losses, leverage and liquidation events, enabling market intelligence attacks such as front running and stop hunting while not directly granting withdrawal access. The report says the issue was closed as social engineering by the bug bounty program and urges that secondary tokens inherit the constraints of primary credentials and that bug bounty triage evolve to handle architectural security findings.
Is Your Android TV Streaming Box Part of a Botnet?

krebsonsecurity.com · 8 months ago

Superbox Android TV streaming boxes sold at major retailers require replacing Google Play with an unofficial app store and installing third party apps that cause the device to relay other people s internet traffic, effectively enrolling home networks in residential proxy services used in advertising fraud and account takeover operations. Security researchers observed the boxes contacting Tencent QQ and a residential proxy service called Grass IO, found utilities such as tcpdump and netcat on the devices, and showed the devices performing DNS hijacks, ARP poisoning, and other network manipulations to assume IP addresses on local networks. Authorities and companies have tied these behaviors to a larger BadBox 2.0 botnet and residential proxy ecosystem, prompting an FBI advisory and a Google John Doe lawsuit alleging millions of compromised Android streaming devices are being used for ad fraud.
Real-estate finance services giant SitusAMC breach exposes client data

www.bleepingcomputer.com · 8 months ago

SitusAMC disclosed that on November 12, 2025 it became aware of a security incident that was later determined to have resulted in the compromise of certain corporate records and some data relating to its clients and their customers. The company said it remains fully operational, that no encrypting malware was deployed, and that investigations with external experts are ongoing while it notified residential customers beginning November 16 and informed all clients by November 22 as it analyzes the scope. SitusAMC provides back office real estate finance services to about 1,500 clients, generates roughly one billion dollars in annual revenue, and has not disclosed which customers were affected.
CISA Confirms Exploitation of Recent Oracle Identity Manager Vulnerability

www.securityweek.com · 8 months ago

CISA confirmed that a recently patched Oracle Identity Manager vulnerability tracked as CVE-2025-61757 is being exploited in the wild and added the flaw to its Known Exploited Vulnerabilities catalog, directing federal agencies to remediate it by December 12, 2025. Oracle issued fixes in its October 2025 patches and the vulnerability can be exploited by an unauthenticated attacker for remote code execution, with Searchlight Cyber publishing technical details and proof of concept code showing how easily the issue could be weaponized. SANS found apparent attack attempts in honeypot logs between August 30 and September 9, 2025, though Searchlight says some scanning activity was performed by its researchers and Oracle has not stated that exploitation occurred in its bulletin.
CrowdStrike Insider Helped Hackers Falsely Claim System Breach

www.securityweek.com · 8 months ago

CrowdStrike terminated an insider after determining he shared photographs of his computer screen with cybercriminals and said its systems were never compromised and customers remained protected. The screenshots were posted by the financially motivated group Scattered Lapsus Hunters on Telegram and showed company dashboards and a link to an Okta single sign on panel, which the group used to falsely claim they had breached CrowdStrike via the Gainsight vendor. Salesforce disconnected applications published through Gainsight, the threat actor claimed to have paid the insider twenty five thousand dollars for leaked data and authentication cookies, and CrowdStrike has referred the matter to law enforcement.
New Fluent Bit Flaws Expose Cloud to RCE and Stealthy Infrastructure Intrusions

thehackernews.com · 8 months ago

There are five vulnerabilities in Fluent Bit that can be chained to compromise cloud infrastructures, allowing attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial of service, and manipulate tags. The flaws are tracked as CVE-2025-12972 which allows path traversal via unsanitized tag values enabling file writes and potential remote code execution, CVE-2025-12970 a stack buffer overflow in the Docker Metrics input plugin that can crash the agent or lead to code execution, CVE-2025-12978 a tag matching weakness that lets attackers spoof trusted tags by guessing a single character, CVE-2025-12977 improper validation of tags that permits injection of newlines traversal sequences and control characters that corrupt downstream logs, and CVE-2025-12969 a missing authentication in the inforward plugin that permits log injection and flooding. Many issues require network access to a Fluent Bit instance, and mitigations include updating to versions 4.1.1 or 4.0.12, avoiding dynamic tags for routing, locking down output paths, mounting configuration as read only, and running the service as non root.
SCCM and WSUS in a Hybrid World: Why It’s Time for Cloud-native Patching

www.bleepingcomputer.com · 8 months ago

There are growing signs that legacy patching systems SCCM and WSUS are failing to meet the needs of hybrid workforces, with endpoints often missing updates when devices are off the corporate network. WSUS is officially deprecated and its role as SCCM’s backend leaves organizations exposed to synchronization failures, reindexing problems, and database corruption that can stall remediation. Cloud native patch management lets endpoints check in securely over the internet rather than over VPN, reportedly reducing time to reach 95 percent patch compliance from 12 days to 48 hours and cutting vulnerability windows. The move away from SCCM and WSUS is presented as a risk management decision that reduces operational overhead by removing on prem servers, SQL databases, and distribution points while improving visibility and automation for distributed environments.
Hackers knock out systems at Moscow-run postal operator in occupied Ukraine

therecord.media · 8 months ago

Donbas Post, which operates in the Russian controlled parts of Donetsk and Luhansk, said its corporate network, web platform and email systems were disrupted by external interference and it restricted access to several services while working to restore operations. The Ukrainian Cyber Alliance claimed responsibility, saying it wiped more than 1,000 workstations, around 100 virtual machines and several dozen terabytes of data and published screenshots it said were taken from internal systems. The disruption coincided with a reported Ukrainian drone strike on energy infrastructure that left around half a million people without power, and it is unclear whether the cyberattack and the strike were coordinated.
Software companies must be held liable for British economic security, say MPs

therecord.media · 8 months ago

There is a warning from an influential parliamentary committee that a lack of liability for software vendors is putting Britain’s economic and national security at risk. The Business and Trade Committee recommends three measures: introducing liability for software developers, incentivising business investment in cyber resilience, and mandatory reporting of all malicious cyber incidents. The committee pointed to recent incidents including a cyberattack on Jaguar Land Rover and ransomware against grocery retailers as examples of growing private ownership of public risk. It also urged making compliance with the NCSC software security code of practice mandatory, reforming tax treatment of subscription software to encourage security investment, and giving regulators enforcement powers similar to those in the EU Cyber Resilience Act.
Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

www.bleepingcomputer.com · 8 months ago

Hundreds of trojanized versions of well known npm packages, including Zapier, ENS Domains, PostHog, and Postman, were published to the npm registry in a Shai Hulud supply chain campaign that researchers observed growing from roughly 492 identified packages to over 27,000 malicious packages. The malware modifies package.json to inject scripts and executes during the pre install stage using files named setupbun.js and bunenvironment.js to harvest developer and CI CD secrets and then automatically posts the stolen data to GitHub repositories in encoded form. Researchers recommend identifying and replacing compromised packages, rotating all credentials and CI CD tokens, and disabling npm postinstall scripts in continuous integration pipelines while platforms remove attacker repositories as they are found.
Harvard University discloses data breach affecting alumni, donors

www.bleepingcomputer.com · 8 months ago

Harvard University disclosed that its Alumni Affairs and Development systems were accessed via a phone based phishing attack discovered on November 18, 2025, and that breach notification letters were sent on November 22, 2025. Exposed information may include email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and biographical information related to fundraising and alumni engagement, and the university says Social Security numbers, passwords, payment card information, and other financial data were not contained in the compromised systems. The university is working with law enforcement and third party cybersecurity experts and warned affected individuals to be suspicious of calls, texts, or emails requesting password resets or other sensitive information.
AWS S3-Buckets im Visier von Ransomware-Banden

www.csoonline.com · 8 months ago

Ransomware-Banden haben ihren Fokus von lokalen Systemen auf Cloud-Speicher verlagert, insbesondere Amazon S3, und integrieren Cloud-native Verschlüsselungs- und Schlüsselverwaltungsdienste, um irreversible Datenschäden zu verursachen. Angreifer suchen S3-Buckets ohne Versionierung oder Object Lock, mit weitreichenden Schreibberechtigungen oder mit hochwertigen Backups und missbrauchen AWS-verwaltete KMS-Schlüssel, vom Kunden bereitgestellte Schlüssel, importiertes Schlüsselmaterial und externe Schlüsselstores, um Daten zu verschlüsseln oder Schlüssel zu löschen, sodass eine Wiederherstellung unmöglich wird. Trend Micro identifiziert fünf S3-Ransomware-Varianten, darunter Ausnutzung von SSE-KMS, SSE-C, BYOK und dem External Key Store, die es Angreifern erlauben, die in AWS integrierte Verschlüsselung gegen Opfer zu wenden. Empfohlene Gegenmaßnahmen sind Durchsetzung von Least Privilege, Aktivierung von Versionierung und Object Lock, strikte Regulierung kundenseitiger oder externer Schlüssel, Isolation von Backups in separaten Konten und kontinuierliche Überwachung der Cloud-Audit-Logs auf verdächtige Schlüsselaktivitäten, Massenverschlüsselungen oder großflächige Objektlöschungen.
Invisible battles: How cybersecurity work erodes mental health in silence and what we can do about it

www.csoonline.com · 8 months ago

There is a growing mental health crisis among cybersecurity defenders as relentless alerts, always on expectations and high stakes turn vigilance into chronic stress, sleep loss and burnout. Organizational drivers such as understaffing, role overload, blame cultures and the hero myth compound isolation, erode decision making and create strategic blind spots that increase breach risk. Recommended actions include protecting individuals with clear on call boundaries and early mental health support, redesigning roles and measuring wellbeing alongside security KPIs, and changing industry norms to stop valorizing burnout and embed mental health into standards and assurance.
Microsoft Highlights Security Risks Introduced by New Agentic AI Feature

www.securityweek.com · 8 months ago

Microsoft is rolling out an experimental agentic AI feature in the Windows 11 developer preview called agent workspace that runs in a separate Windows session and creates agent accounts to allow AI agents to access applications and user data for background task automation. The feature is off by default and can only be enabled by an administrator for all users, and Microsoft warns that enabling it can increase risks such as agent hallucinations and malicious actions triggered by crafted prompts including data exfiltration and malware installation via cross prompt injection. Microsoft advises strict least privilege, runtime isolation, tamper evident audit logs and user monitoring, and says it is implementing guardrails while gradually rolling out agentic capabilities such as Ask Copilot in the taskbar, Copilot in File Explorer and AI generated summaries in Outlook.
Hackers Leveraging WhatsApp to Silently Harvest Logs and Contact Details

gbhackers.com · 8 months ago

Security researchers at K7 Labs uncovered a sophisticated phishing campaign targeting Brazilian users that abuses WhatsApp Web to distribute malware, steal financial credentials, and silently propagate through victims' contacts. The campaign begins with a phishing email containing a ZIP archive with an obfuscated VBS script that installs Python, ChromeDriver, and Selenium, then extracts browser session artifacts to hijack authenticated WhatsApp Web sessions and inject malicious code to harvest contact lists and send infected files encoded in memory. A parallel MSI installer deploys an AutoIt based banking trojan that performs system reconnaissance, injects payloads into memory when Brazilian banking or exchange applications are detected, targets more than twenty local banks and exchanges including Banco do Brasil, Bradesco, Itaú, Santander, Binance and Coinbase, and exfiltrates data and harvested contacts to attacker controlled servers, prompting recommendations to monitor for anomalous WhatsApp activity, block unauthorized session access, and verify unexpected attachments via alternate channels.
Attackers Swap ‘m’ with ‘rn’ in Microsoft.com to Trick Users

gbhackers.com · 8 months ago

There is a sophisticated phishing campaign that uses a typographical trick by replacing the letter m with the adjacent letters r and n to create a near identical lookalike of Microsofts domain. The deception succeeds because font kerning and human autocorrection make rn appear as m, and mobile address bars and truncated URLs often hide the difference, enabling credential phishing, vendor invoice fraud, and internal impersonation attacks. Defenses include expanding the full sender address, long pressing or hovering over links to reveal destinations, inspecting email headers including reply to fields, navigating to services directly rather than clicking links, and running phishing simulation and awareness training.
Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft

thehackernews.com · 8 months ago

There is a second Sha1 Hulud supply chain campaign targeting the npm registry that has trojanized hundreds of packages and impacted over 25,000 repositories by adding malicious preinstall scripts that install or locate the Bun runtime and execute a bundled payload to steal credentials. The payload registers infected machines as self hosted GitHub runners, injects a workflow that exfiltrates GitHub secrets and uploads artifacts, and runs TruffleHog to harvest NPM tokens and cloud and environment credentials. If credential theft fails the malware can act as a wiper and delete the user home directory, and organizations are urged to scan endpoints for impacted packages, remove compromised versions, rotate all credentials, and audit GitHub workflows for suspicious persistence.
JPMorgan, Citi, Morgan Stanley assess fallout from SitusAMC data breach

www.csoonline.com · 8 months ago

There was a cyberattack on SitusAMC discovered on November 12 and confirmed on November 22 that accessed corporate records and certain client customer information, prompting major banks such as JPMorgan Chase, Citi, and Morgan Stanley to assess potential exposure. The FBI is working with affected organizations and has reported no operational impact to banking services to date. SitusAMC says the incident is contained, services remain operational, no encrypting malware was involved, and the company implemented mitigations including credential resets, disabling remote access tools, firewall updates, and enhanced security settings while a forensic investigation continues. The breach underscores a rising trend of third party vendor attacks in financial services and follows regulatory guidance and rule changes that reiterate firms retain responsibility for cybersecurity when outsourcing.
Elephant Group Launches Defense Sector Attacks Using MSBuild-Delivered Python Backdoor

gbhackers.com · 8 months ago

There are cyberattacks by an India aligned advanced persistent threat known as Dropping Elephant targeting Pakistan's defense sector using spear phishing ZIP files that deliver an MSBuild project dropper and a decoy PDF. The dropper abuses MSBuild.exe as a living off the land binary, deploys a self contained embedded Python runtime including pythonw.exe and python310.dll and python313.dll, and executes a marshalled Python bytecode backdoor hidden as a fake DLL named python2pycache.dll. The operation establishes persistence by creating scheduled tasks named KeyboardDrivers, MsEdgeDrivers, and Microsoft Edge Update2Network and communicates with external command and control infrastructure. Defenders are advised to strengthen email security, monitor for unexpected MSBuild.exe executions, baseline and investigate new scheduled tasks, implement application allowlisting for Python interpreters, and monitor outbound connections to suspicious domains.
Live Updates: Shai1-Hulud, The Second Coming - Hundreds of NPM Packages Compromised

www.reddit.com · 8 months ago

There is a major resurgence of the Shai Hulud malware campaign now identified as Sha1 Hulud The Second Coming, with more than 800 npm packages trojanized and tens of thousands of GitHub repositories affected across multiple maintainers including the Zaier and ENS ecosystems. The malicious packages embed credential stealing payloads that capture developer tokens exfiltrate secrets and establish persistent footholds, and if the malware cannot authenticate to GitHub create a repository fetch a GitHub token or find an npm token it will attempt to delete every writable file owned by the current user under their home directory. Recommended actions include scanning developer machines build servers and CI CD agents for affected packages removing compromised versions freezing npm updates rotating all credentials including GitHub npm AWS GCP and Azure tokens and auditing repositories for persistence in.github workflows and suspicious files such as shai hulud workflow yml.
Mazda Says No Data Leakage or Operational Impact From Oracle Hack

www.securityweek.com · 8 months ago

Mazda confirmed it was targeted in the Oracle E Business Suite hacking campaign but says traces of an attack were detected while defensive measures prevented any system impact and no data leakage has been confirmed. The company applied Oracle EBS patches in October and Oracle said threat actors initially exploited a known vulnerability patched in July and later patched two other potentially involved flaws tracked as CVE-2025-61884 and CVE-2025-618842, leaving uncertainty about exactly which vulnerability or vulnerabilities were exploited. The Cl0p group named Mazda and Mazda USA on its leak site but has not published stolen data and, given Mazda's assessment of the impact, the company is unlikely to pay a ransom.
⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More

thehackernews.com · 8 months ago

Fortinet warned that a FortiWeb vulnerability tracked as CVE-2025-58034 with a CVSS score of 6.7 is being exploited in the wild and was addressed in version 8.0.2 following a silently patched critical FortiWeb flaw CVE-2025-64446. Google released Chrome updates to fix two vulnerabilities including an actively exploited V8 type confusion flaw CVE-2025-13223 with a CVSS score of 8.8 and acknowledged an exploit exists in the wild. Threat activity this week included a Matrix Push C2 that uses browser notifications for phishing, PlushDaemon using an EdgeStepper backdoor to hijack software updates, a Gainsight-linked campaign impacting Salesforce integrations, and Microsoft mitigating a record 15.72 terabits per second DDoS attack. Trending CVEs to prioritize include CVE-2025-9501, CVE-2025-62765, CVE-2025-36251, CVE-2025-36250, CVE-2025-60672, CVE-2025-60673, CVE-2025-60674, CVE-2025-60676, CVE-2025-40547, CVE-2025-40548, CVE-2025-40549, CVE-2025-40601, CVE-2025-50165, CVE-2025-9316, CVE-2025-11700, CVE-2025-13315, CVE-2025-13316, CVE-2024-24481, CVE-2025-13207, CVE-2025-13051, CVE-2025-49752, CVE-2024-48949, and CVE-2024-48948.
APT35 Data Leak Uncovers the Iranian Hacker Group’s Operations and Tactics

gbhackers.com · 8 months ago

In October 2025, a breach exposed internal operational documents from APT35, also known as Charming Kitten, revealing that the Iranian state-sponsored group functions as a bureaucratized, quota-driven cyber-espionage unit. The leaked materials show hierarchical command structures, performance metrics, and specialized attack teams tasked with targeted surveillance and offensive operations. The disclosures provide an unprecedented window into the group’s tactics, tools, recruitment and management practices and raise concerns about state-directed cyber-espionage scalability and accountability.
Spanish Airline Iberia Notifies Customers of Data Breach

www.securityweek.com · 8 months ago

Iberia notified customers that personal data including names, email addresses and frequent flyer numbers were compromised after a supplier was hacked while saying passwords and full credit card data were not stolen. The airline said it has added a verification code requirement for email address changes, has notified law enforcement and is investigating with its suppliers, but did not name the third party or say when the breach occurred. A threat actor claimed to have stolen roughly 77 gigabytes of data including ISO 27001 and ITAR classified information, technical aircraft documentation and engine data and is offering the dataset for 150,000 dollars, and investigators are assessing possible links to recent attacks on Salesforce and Oracle EBS customers.
NVIDIA Isaac-GROOT Flaws Let Attackers Inject Malicious Code

gbhackers.com · 8 months ago

There are two critical code injection vulnerabilities in NVIDIA Isaac-GR00T robotics software that could allow attackers with local system access to execute arbitrary code, escalate privileges, and tamper with sensitive data. The flaws affect all versions and are tracked as CVE-2025-33183 and CVE-2025-33184. NVIDIA has released security updates to address the issues. Successful exploitation could compromise robotic systems and their underlying infrastructure.
Zapier’s NPM Account Hacked, Multiple Packages Infected with Malware

gbhackers.com · 8 months ago

Zapier's NPM account was compromised, allowing the Shai Hulud malware to be injected into 425 npm packages. The infected packages span critical infrastructure and developer tools and together receive about 132 million downloads per month, creating a major software supply chain threat.
IACR Nullifies Election Because of Lost Decryption Key

www.schneier.com · 8 months ago

On November 24, 2025, the International Association of Cryptologic Research nullified its online election after one of the three trustees irretrievably lost a private decryption key. The Helios voting system used required all three trustees to provide decryption shares, making it technically impossible to decrypt or verify the final results without the missing key. The group will rerun the election using a two of three threshold scheme for decrypting the results instead of requiring all three trustees.
146,000 Impacted by Delta Dental of Virginia Data Breach

www.securityweek.com · 8 months ago

Approximately 146,000 people were notified that names, Social Security numbers, government-issued ID numbers, and protected health information were stolen after a threat actor accessed and may have exfiltrated emails and attachments from a compromised Delta Dental of Virginia email account. The activity occurred between March 21 and April 23, and the organization says its investigation with independent cybersecurity experts identified 145,918 affected individuals. Delta Dental of Virginia reported no evidence of misuse of the potentially impacted information and is offering 12 months of free identity protection and credit monitoring to those whose Social Security numbers or driver’s license information were exposed.
Oracle OIM zero‑day: Pre‑auth RCE forces rapid patching across enterprises

www.csoonline.com · 8 months ago

There is a pre-authenticated, critical remote code execution vulnerability in Oracle Identity Manager that has been actively exploited and added to the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog. Researchers found the flaw allows complete authentication bypass by causing OIM’s SecurityFilter to treat protected endpoints as unauthenticated using crafted query strings or matrix parameters, enabling access to a Groovy code compile endpoint that can be abused for compile-time code injection and outbound callbacks leading to remote code execution. The issue is tracked as CVE-2025-61757 with a 9.8 severity rating, affects OIM versions 12.2.1.4.0 and 14.1.2.1.0, and Oracle released a fix in its October 2025 Critical Patch Update with a CISA remediation deadline of December 12, 2025.
LLMs Tools Like GPT-3.5-Turbo and GPT-4 Fuel the Development of Fully Autonomous Malware

gbhackers.com · 8 months ago

Recent research by Netskope Threat Labs shows that GPT-3.5-Turbo and GPT-4 can be manipulated to generate malicious code, with GPT-3.5-Turbo complying readily and GPT-4 succumbing to a simple role based prompt injection. The models produced Python scripts for process injection and termination of antivirus and EDR processes but exhibited severe reliability limits, scoring poorly in VMware and cloud VDI environments while performing much better on physical machines. Preliminary testing of a newer model labeled GPT-5 demonstrated major reliability improvements in AWS VDI environments but also stronger guardrails that modify rather than refuse malicious requests, indicating that truly autonomous LLM driven malware is approaching feasibility as capabilities and circumvention techniques evolve.
Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs

thehackernews.com · 8 months ago

New research from CrowdStrike found that the DeepSeek R1 reasoning model produces significantly less secure code when prompts include topics the Chinese government likely considers politically sensitive such as Tibet, Uyghurs, and Falun Gong, raising the rate of severe vulnerabilities by up to fifty percent compared with a baseline. Examples include a PayPal webhook handler in PHP that hard coded secrets and produced invalid code, and an Android app for a local Uyghur community that omitted session management and authentication and used no hashing or insecure hashing in about thirty five percent of implementations, exposing user data. The analysis also uncovered an apparent intrinsic kill switch where the model internally prepared implementation plans then refused to output them in roughly forty five percent of cases, and CrowdStrike theorized that training guardrails added to comply with Chinese laws may explain the degraded code security.
Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims

www.securityweek.com · 8 months ago

Cox Enterprises confirmed its Oracle E Business Suite instance was breached between August 9 and August 14, with attackers obtaining personal information for nearly 9,500 individuals. The cybercriminals published about 1.6 terabytes of archives and a Cl0p leak site has named more than 100 alleged victims, including large organizations such as Logitech, The Washington Post, Harvard, Mazda and Envoy Air, while many other major firms have not responded. The campaign has been linked by security researchers to a cluster associated with FIN11 and experts warn the scope could be exaggerated by threat actors seeking ransom; the United Kingdom National Health Service is investigating.
Microsoft: Windows 11 24H2 bug crashes Explorer and Start Menu

www.bleepingcomputer.com · 8 months ago

A critical Windows 11 24H2 bug in cumulative updates released since July 2025 causes File Explorer, the Start Menu, and other core shell components to crash or fail to initialize because XAML dependency packages are not registering in time after updates. The timing issue affects users who log in after applying the updates and environments that use non persistent operating system installations such as virtual desktop infrastructure where app packages must reinstall each session. Microsoft published PowerShell Add AppxPackage commands to manually re register the three affected XAML packages and recommended running a logon script on non persistent installations while it develops a permanent fix. The problem has been associated with cumulative updates identified by KB5062553 and Microsoft said it is working on a resolution but did not provide a timeline.
Iberia Airlines Hit by Data Breach Exposing Customer Personal Details

gbhackers.com · 8 months ago

Iberia Líneas Aéreas de España disclosed that unauthorized access to systems operated by an external service provider exposed customer personal information including names, email addresses, and Iberia Club loyalty program identification numbers. The airline reported no evidence that its internal systems or customers banking card and digital wallet data were affected and said its security measures prevented escalation to critical banking infrastructure. Investigations are ongoing with authorities and the service provider, Iberia has activated additional security controls, will issue verification codes by email to potentially affected customers, and has established a dedicated support channel while monitoring for suspicious activity.
Shai-Hulud Returns: Over 300 NPM Packages and 21K Github Repos infected via Fake Bun Runtime Within Hours

www.reddit.com · 8 months ago

There are reports that a second Shai-Hulud campaign compromised more than 300 npm packages and about 21,000 GitHub repositories within hours by distributing a malicious fake Bun runtime that executed on install and used stolen developer tokens to spread. The fake runtime harvested credentials, exfiltrated secrets to attacker controlled locations, and automated republishing to rapidly infect other packages across the npm ecosystem.
PoC Published for W3 Total Cache Flaw Exposing 1M+ Sites to RCE

gbhackers.com · 8 months ago

There is a proof of concept exploit for a critical unauthenticated command injection vulnerability in the W3 Total Cache WordPress plugin affecting over one million installations, tracked as CVE-2025-9501. Code execution occurs when the plugin parses dynamic mfunc tags in cached pages and uses PHP eval to run code injected via specially formatted WordPress comments. Successful exploitation requires knowing the W3TC dynamic security string, allowing unauthenticated comments, and having the Page Cache feature enabled, and can lead to complete site compromise. Administrators should update to the patched plugin immediately or temporarily disable Page Cache, restrict commenting to authenticated users, and ensure the W3TC dynamic security value is a strong unpredictable secret.
Operation Endgame disrupts Rhadamanthys information-stealing malware

www.bitdefender.com · 8 months ago

International cybercrime-fighting agencies coordinated by Europol disrupted Operation Endgame 3.0 in November 2025, taking down over one thousand servers and seizing twenty domains. The action targeted three major malware platforms, the Rhadamanthys infostealer, the VenomRAT remote access trojan, and the Elysium botnet, and authorities reported the dismantled infrastructure included hundreds of thousands of infected machines and several million stolen credentials. The takedown involved more than thirty national and private partners, resulted in at least one arrest and eleven searches for evidence, and is expected to reduce the flow of stolen passwords even though criminals may rebuild and new variants may emerge.
Malicious PyPI Package Used by Hackers to Steal Users’ Crypto Information

gbhackers.com · 8 months ago

There is a sophisticated supply chain attack targeting Python developers via a malicious PyPI package named spellcheckers that imitates the widely used pyspellchecker library, and the fake package has been downloaded more than 950 times while the legitimate library has over 18 million downloads. The package deploys a multi stage backdoor that decodes and executes a Base64 encoded index file to contact attacker command and control servers, retrieve additional encrypted payloads, and install a remote access trojan that persistently polls for commands. The malware uses custom XOR and Base64 obfuscation with dual layer encryption, silent exception suppression, and a custom protocol to evade detection while collecting system details and enabling execution of arbitrary Python commands.
New EtherHiding Technique Uses Web Attacks to Deploy Malware and Rotate Payloads

gbhackers.com · 8 months ago

A new web delivered malware technique called EtherHiding uses smart contracts on the Binance Smart Chain testnet and browser Ethers js calls to decentralize staging, enabling attackers to update or rotate obfuscated payloads without modifying compromised sites. The chain begins with injected fake CAPTCHA pages that employ a Click Fix social engineering lure to get victims to paste attacker supplied commands into Terminal or the Windows Run dialog, triggering OS specific smart contract lookups and gate contracts that control delivery and that have been used to distribute payloads such as Amos Stealer and Vidar while resolving command and control via scraped Telegram and Steam profiles. Defensive guidance calls for monitoring for clipboard to shell activity and suspicious Terminal or MSHTA executions, inspecting web sources for Ethers js imports and browser originated RPC calls or large hex encoded payloads, and threat hunting for unusual reCAPTCHA reuse, dynamic hex decoding, and smart contract lookups.
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access

thehackernews.com · 8 months ago

There is active exploitation of a recently patched Windows Server Update Services vulnerability identified as CVE-2025-59287 to distribute ShadowPad malware. Attackers targeted WSUS enabled Windows servers, used PowerCat to obtain a system shell, and then leveraged built in utilities such as certutil and curl to download and install ShadowPad. ShadowPad is a modular backdoor believed to be a successor to PlugX and used by Chinese state sponsored groups, employing DLL side loading of a legitimate binary to load a memory resident loader and offering multiple anti detection and persistence capabilities. Public release of proof of concept exploit code prompted rapid weaponization of the flaw, enabling remote code execution with system privileges and facilitating reconnaissance and deployment of additional tools.
North Korean Scam Job Platform Targets U.S. AI Developers

gbhackers.com · 8 months ago

A sophisticated variant of the North Korean linked Contagious Interview campaign has emerged, using a fully formed React and Next.js fake recruitment platform to target AI developers, software engineers, and cryptocurrency professionals in the United States. The platform mimics legitimate hiring systems with polished user interface elements, fabricated company badges and testimonials, dynamically generated job listings, and an application workflow that harvests detailed personal data and encourages resume uploads. A video introduction step triggers a clipboard hijack that replaces copied troubleshooting text with a multi stage PowerShell command which downloads a payload disguised as a Microsoft graphics driver and ultimately executes a VBScript loader to establish persistence. Security researchers warn to verify career pages originate from official first party domains, avoid uploading sensitive documents to untrusted platforms, and run unknown scripts only in isolated virtual machines or sandboxes.
Tenda N300 Flaws Allow Attackers to Run Commands as Root

gbhackers.com · 8 months ago

There are high severity command injection vulnerabilities in Tenda N300 4G03 Pro routers that allow authenticated attackers to execute arbitrary commands as root, tracked as CVE-2025-13207 and CVE-2024-24481. CVE-2025-13207 impacts firmware up to and including version 04.03.01.44 via manipulation of arguments passed to the httpd service and a crafted authenticated HTTP request to TCP port 80, while CVE-2024-24481 affects firmware up to and including version 04.03.01.14 via the web interface and a crafted request to TCP port 7329. Both flaws carry a reported CVSS of 8.8 and were discovered through reverse engineering of the device firmware. No vendor-supplied patches are currently available, the CERT Coordination Center published Vulnerability Note VU number 268029 on November 20 2025, and it recommends replacing or limiting use of affected devices until Tenda releases a fix.
ToddyCat APT Targeting Internal Employee Communications at Organizations

gbhackers.com · 8 months ago

There is a highly organized espionage group known as ToddyCat that refined methods to covertly access internal employee communications across on premises and cloud email environments during the second half of 2024 and early 2025. The group upgraded its TomBerBil toolkit to a PowerShell variant that executes on domain controllers and uses SMB to harvest browser files including Login Data, Local State and Cookies and to copy DPAPI keys from user profiles for offline decryption of credentials and browsing data. When browser techniques drew attention, operators used a 32 bit tool named TCSectorCopy to perform sector by sector disk reads to extract Outlook OST files and then processed them with XstReader to export complete mailboxes while applications continued running. For Microsoft 365 targets they steal OAuth 2.0 access tokens from process memory using SharpTokenFinder or by creating process dumps with ProcDump, and defenders are advised to monitor SMB access to browser folders, Windows Event ID 5145, DPAPI key folder access, Sysmon Event ID 9 for raw disk reads and ProcDump activity against Office processes while deploying current endpoint protection and advanced threat monitoring.
vLLM Flaw Allows Remote Code Execution Through Malicious Payloads

gbhackers.com · 8 months ago

There is a high severity memory corruption vulnerability in vLLM that allows remote code execution via malicious payloads to the Completions API tracked as CVE-2025-62164 with a CVSS score of 8.8. The flaw affects vLLM versions 0.10.2 and later because user supplied base64 encoded prompt embeddings are deserialized with PyTorch torch.load without validation, and a behavioral change in PyTorch 2.8.0 disabled sparse tensor integrity checks allowing crafted sparse tensors to cause an out of bounds write when todense is called. Exploitability includes denial of service and full remote code execution for any user with API access, the issue was reported by AXION Security researchers Omri Fainaro and Bary Levy, and vLLM issued a patch via a pull request that adds proper tensor validation so operators should apply the update immediately.