Blahalla

EU lawmakers propose that youth under 16 be barred from social media without parental consent

therecord.media · 8 months ago

false

CISA warns that RESURGE malware can be dormant on Ivanti devices

www.bleepingcomputer.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency (CISA) has released updated information regarding the RESURGE malware, a sophisticated implant used in attacks exploiting CVE-2025-0282 on Ivanti Connect Secure devices. RESURGE uses advanced network-level evasion and authentication techniques, including a fake Ivanti certificate, to establish covert communication with attackers and avoid detection. The malware can remain dormant on compromised systems until an attacker initiates contact and is capable of tampering with system logs and manipulating firmware. CISA urges system administrators to use updated indicators of compromise to identify and remove any dormant RESURGE infections. The identified file hashes are: liblogblock.so - 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104, libdsupgrade.so - 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda, and dsmain - b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d.

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

thehackernews.com · 8 months ago

Security researchers have identified a malicious Go module impersonating a legitimate cryptography library. The module, github[.]com/xinfeisoft/crypto, steals passwords entered in terminal prompts and delivers the Rekoobe backdoor. The backdoor establishes persistent access through SSH, modifies firewall rules, and downloads additional payloads, including a reconnaissance tool and Rekoobe itself. This attack utilizes namespace confusion and leverages GitHub as a distribution point, and defenders should anticipate similar supply chain attacks targeting credential handling libraries.

In Other News: ATT&CK Advisory Council, Russian Cyberattacks Aid Missile Strikes, Predator Bypasses iOS Indicators

www.securityweek.com · 8 months ago

Spyware has been developed to suppress iOS camera and microphone indicators by intercepting and discarding sensor activity updates, requiring prior device compromise. Russian cyberattacks against Ukraine’s energy grid are now focused on gathering intelligence to aid missile strikes. A new Android remote access trojan, Oblivion, is available for around $300 and claims to bypass device security measures. ShinyHunters claimed responsibility for a breach at Dutch telecom Odido, potentially exposing 21 million customer records.

Third-Party Patching and the Business Footprint We All Share

www.bleepingcomputer.com · 8 months ago

Attackers often target common business software like PDF readers, spreadsheet tools, and email clients because they appear on most networks, making exploitation predictable and scalable. These tools frequently coexist in environments, creating pathways for attacks that move beyond individual applications. A significant risk arises from outdated versions of these utilities, which accumulate exploit potential over time, often unnoticed due to inconsistent patching practices. Addressing this requires visibility into third-party software and proactive remediation to reduce overall risk.

Millions at Risk as Android Mental Health Apps Expose Sensitive Data

www.techrepublic.com · 8 months ago

Research has revealed significant security vulnerabilities in ten popular Android mental health applications, totaling over 14.7 million installs. These apps contain 1,575 vulnerabilities, including high-severity flaws that could lead to credential interception, data leakage, and unauthorized access. The apps handle sensitive data such as therapy transcripts, mood tracking histories, and self-harm indicators, which could be valuable on the dark web. Weaknesses include insecure coding practices, exposed API endpoints, and a lack of root-detection safeguards.

Claude Code Security Shows Promise, Not Perfection

www.darkreading.com · 8 months ago

false

38 Million Allegedly Impacted by ManoMano Data Breach

www.securityweek.com · 8 months ago

A data breach at ManoMano, a European DIY retailer, has potentially impacted roughly 38 million customers. Hackers compromised a customer service subcontractor in Tunisia, gaining access to sensitive data including names, email addresses, phone numbers, and customer service interactions. The threat actor, known as Indra, claims to have stolen approximately 43 gigabytes of data, encompassing user account information, service tickets, and attachments. ManoMano operates in France, Germany, Italy, Spain, and the United Kingdom.

One of the ‘most influential cybersecurity’ roles will pay under $175,000

www.csoonline.com · 8 months ago

false

Twitch Ships Server-Side Eppo Keys in Its iOS App, Exposing Its Entire Product Roadmap

www.buchodi.com · 8 months ago

A security lapse at Twitch has exposed the platform's product roadmap due to improperly configured server-side SDK keys in its iOS app. Sensitive information including upcoming features, pricing strategies, and planned events were leaked in plaintext. The leak reveals Twitch’s extensive experimentation program, deep integration with Amazon, and internal product strategies. Twitch is addressing the vulnerability by implementing Eppo Client Tokens and releasing an app update.

900 Sangoma FreePBX Instances Infected With Web Shells

www.securityweek.com · 8 months ago

Approximately 900 Sangoma FreePBX instances are currently infected with web shells following attacks that began in December 2025. The attacks exploited a command injection vulnerability, CVE-2025-64328, which allows unauthorized command execution on compromised systems. A hacking group known as INJ3CTOR3 has been deploying a web shell called EncystPHP to achieve persistent access. Security experts advise users to update their systems and restrict access to the administrative panel to mitigate the threat.

Anthropic Says It Cannot ‘Accede’ to Pentagon in Talks Over A.I.

www.nytimes.com · 8 months ago

The Pentagon has given Anthropic until Friday to lift restrictions on how the military can use its Claude artificial intelligence model or face measures including invocation of the Defense Production Act and removal from the military supply chain. Defense Secretary Pete Hegseth told Anthropic’s chief executive that he could force compliance, cancel the department’s contract, or designate the company a supply chain risk if it does not agree. Anthropic has pushed back, saying it will not permit its models to be used to develop autonomous weapons or to carry out mass surveillance of Americans and is prepared to walk away from a roughly 200 million dollar Defense Department contract rather than remove safety guardrails. Pentagon officials and spokespeople say the department intends to use the technology only in lawful ways and does not seek to deploy systems that would commit mass surveillance or fully autonomous lethal operations.

Researchers Unveil Aeternum C2 Infrastructure with Advanced Evasion and Persistence Tactics

gbhackers.com · 8 months ago

Researchers have discovered a new command and control framework called Aeternum that utilizes the Polygon blockchain for persistent botnet operations. Unlike traditional botnets, Aeternum stores commands within smart contracts, making them virtually unremovable and distributed across numerous nodes. This architecture allows for efficient command propagation and targeted control of infected devices via hardware ID, and lowers the barrier to entry for cybercriminals. Security teams must shift focus from server takedowns to proactive network defenses as this framework presents a significant challenge to traditional disruption methods.

Stored XSS Vulnerability in RustFS Console Puts S3 Admin Credentials at Risk

gbhackers.com · 8 months ago

A critical security vulnerability has been discovered in the RustFS Console, allowing attackers to steal administrator credentials and potentially take over entire accounts. The vulnerability, tracked as CVE-2026-27822, is a Stored Cross-Site Scripting (XSS) flaw resulting from inadequate content type validation and a lack of origin separation. Attackers can exploit this by uploading a malicious file disguised as a PDF to execute JavaScript and access sensitive data stored in the browser's local storage. Users are strongly advised to immediately update to version 1.0.0-alpha.83 to mitigate the risk.

ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks

thehackernews.com · 8 months ago

A North Korean threat actor, known as ScarCruft, is employing a new campaign called Ruby Jumper to breach networks, even those isolated from the internet. The attackers use a malicious link to initiate a chain of events involving several malware families including RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and BLUELIGHT. They abuse legitimate cloud services like Zoho WorkDrive for command and control, and utilize removable media to spread malware between internet-connected and air-gapped systems. This technique allows for system surveillance, data exfiltration, and the execution of arbitrary commands.

Chilean Carding Shop Operator Extradited to US

www.securityweek.com · 8 months ago

A Chilean national, Alex Rodrigo Valenzuela Monje, has been extradited to the United States to face charges related to operating an online card shop. He is accused of running Telegram channels, MacacoCC Collective and Novato Carding, where he sold stolen credit card data from at least May 2021 to August 2023. The stolen data included account numbers, expiration dates, and CVV/CVC codes for approximately 26,000 cards from one brand. Valenzuela Monje pleaded not guilty following his transfer to US custody on February 25, 2026.

Anthropic Refuses to Bend to Pentagon on AI Safeguards as Dispute Nears Deadline

www.securityweek.com · 8 months ago

false

Ukrainian man pleads guilty to running AI-powered fake ID site

www.bleepingcomputer.com · 8 months ago

A Ukrainian man has pleaded guilty to running OnlyFake, a website that used artificial intelligence to create and sell over 10,000 fake identification documents. The platform generated counterfeit passports, driver’s licenses, and Social Security cards for customers worldwide, often used to bypass Know Your Customer verification requirements. Federal agents purchased fake identification from the site, which only accepted cryptocurrency payments. The man faces a maximum sentence of 15 years in prison and has agreed to forfeit 1.2 million dollars.

Bypassing Apache FOP Postscript Escaping to reach GhostScript

offsec.almond.consulting · 8 months ago

A security vulnerability exists in Apache FOP, a tool that converts XML to PDF, allowing for potential remote code execution. The flaw is due to improper handling of whitespace, long lines, and special characters during PostScript command processing. Attackers can inject malicious code into generated PDFs by crafting specific XML input, bypassing security protections. This vulnerability, identified as CVE-2025-46646, has been demonstrated to read and potentially modify system files.

Why Tehran’s Two-Tiered Internet Is So Dangerous

www.schneier.com · 8 months ago

false

Phishing Attacks Against People Seeking Programming Jobs

www.schneier.com · 8 months ago

North Korean hackers are targeting individuals seeking programming jobs through deceptive phishing attacks. They impersonate company recruiters and invite candidates to participate in coding challenges. Running the provided code unknowingly installs malware on the victim's system. This new tactic poses a risk to potential employees and organizations alike.

Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience

www.securityweek.com · 8 months ago

Security researchers have discovered a new botnet loader called Aeternum C2 that utilizes the Polygon blockchain for command-and-control functions. This innovative approach enhances the botnet’s resilience against disruption by eliminating the need for traditional central infrastructure. The malware, first appearing in December 2023, is offered for sale on underground forums with various licensing options. Threat actors can manage the botnet through a web panel and test builds using a built-in antivirus scanner, demonstrating a growing trend of decentralized botnet control.

Is A.I. Eating the Labor Market? + The Latest on the Pentagon, OpenClaw and Alpha School

www.nytimes.com · 8 months ago

false

Your personal OpenClaw agent may also be taking orders from malicious websites

www.csoonline.com · 8 months ago

A flaw in OpenClaw, tracked as CVE-2026-25253, allowed malicious websites to connect to locally running agents and gain full control. This occurred because the system implicitly trusted connections originating from "localhost," bypassing security measures like rate limits and authentication. Attackers could then brute-force passwords, silently register devices, and access sensitive data and functions held by the compromised agent. Security experts recommend stronger authentication, user approval for device pairing, and credential scoping to mitigate similar risks in AI agent deployments.

Study Finds 87% of Organizations Exposed to Attacks Due to Known Vulnerabilities

gbhackers.com · 8 months ago

Researchers have discovered three methods attackers can use to bypass security controls in Apple macOS devices. These techniques involve manipulating the system’s kernel cache to execute malicious code. Exploitation could allow unauthorized access and control of the affected systems. The vulnerabilities affect macOS versions prior to Sonoma 14.3.1, Ventura 13.6.4, Monterey 12.7.3, and Big Sur 11.7.10, and have been assigned CVE identifiers CVE-2024-23001, CVE-2024-23002, and CVE-2024-23003.

US authorities punish sellers of malware and spyware

www.csoonline.com · 8 months ago

US authorities are taking action against individuals involved in the illegal trade of cyberweapons. An Australian citizen, Peter Williams, received an 87-month prison sentence for selling sensitive national security software to a Russian company for approximately four million dollars in cryptocurrency. The Department of the Treasury has also sanctioned Sergey Sergeyevich Zelenyuk and his company, Operation Zero, for acquiring and distributing cyber tools and exploits, including those originally created for the US government. These actions demonstrate a commitment to protecting US intellectual property and national security.

Dohdoor Malware Targets U.S. Schools and Healthcare with Multi-Stage Attack

gbhackers.com · 8 months ago

A new backdoor, named Dohdoor, is targeting U.S. schools and healthcare organizations. The threat group, tracked as UAT-10027, likely has ties to North Korea due to similarities with the Lazarus Group’s tactics. The multi-stage attack uses social engineering, PowerShell scripts, and DNS-over-HTTPS to hide command-and-control traffic and deliver payloads, likely Cobalt Strike beacons, for deeper network compromise. Security experts are recommending detection measures, including ClamAV signatures and Snort rules.

Uncovering a Global macOS Malware Campaign

defensendepth.substack.com · 8 months ago

A cyberattack called ClickFix is exploiting user trust to distribute the Atomic macOS Stealer, or AMOS, to a wide range of organizations. Attackers use a deceptive "Traffic Delivery System" and a fake Cloudflare verification prompt to trick users into unknowingly installing the malware. The malicious script, loaded through JavaScript, copies commands to the user's clipboard, potentially stealing sensitive data like passwords and crypto wallet information. Website administrators are advised to audit their sites, rotate credentials, and users should avoid pasting commands from websites into their terminal.

Why application security must start at the load balancer

www.csoonline.com · 8 months ago

false

Juniper Networks PTX Routers Affected by Critical Vulnerability

www.securityweek.com · 8 months ago

A critical vulnerability, CVE-2026-21902, has been identified in Juniper Networks Junos OS Evolved software running on PTX series routers. This flaw allows an unauthenticated attacker with network access to execute code with root privileges, potentially taking complete control of the device. The vulnerability impacts the On-Box Anomaly detection framework, which is enabled by default. Patches are available in versions 25.4R1-S1-EVO and 25.4R2-EVO, while Juniper reports no evidence of this vulnerability being exploited in the wild.

South Korea Clears Way for Google Maps to Fully Operate

www.nytimes.com · 8 months ago

false

Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms

thehackernews.com · 8 months ago

Threat actors are using trojanized gaming utilities distributed through browsers and chat platforms to install a remote access trojan. Attackers use a portable Java runtime and PowerShell to evade detection and maintain persistence with scheduled tasks and startup scripts, connecting to a command-and-control server at 79.110.49[.]15. Security researchers have also disclosed a new Windows RAT called Steaelite that combines data theft and ransomware capabilities and offers extensive remote control features. Additionally, DesckVB RAT and KazakRAT have been recently discovered, with KazakRAT potentially linked to a state-affiliated group.

A World Where All Is Free? That’s Elon Musk’s Theory of ‘Sustainable Abundance.’

www.nytimes.com · 8 months ago

false

Elon Musk’s Secret Web of Companies in Texas

www.nytimes.com · 8 months ago

false

The hypothetical nuclear attack that escalated the Pentagon’s showdown with Anthropic

www.washingtonpost.com · 8 months ago

A dispute has emerged between Anthropic, an artificial intelligence firm, and the Pentagon regarding the military’s potential use of AI. The disagreement centers around a discussion concerning a hypothetical nuclear attack on the United States, with both sides presenting conflicting accounts. This standoff highlights a broader concern over the deployment of lethal autonomous weapons. No CVEs were mentioned.

We’re about to turn night into day. Is that a good idea?

www.washingtonpost.com · 8 months ago

Proposals are being considered that involve using mirrors to illuminate entire cities with artificial sunlight. SpaceX plans to deploy a million satellites intended to function as data centers. These technological advancements highlight a shift toward potentially transforming darkness into day. The imagery evokes a biblical reference to the separation of light and darkness.

Back to the repair shop for NASA’s lunar ambitions

www.washingtonpost.com · 8 months ago

false

Enterprise Spotlight: Data Center Modernization

us.resources.csoonline.com · 8 months ago

false

How to make LLMs a defensive advantage without creating a new attack surface

www.csoonline.com · 8 months ago

Large language models, or LLMs, are transforming security, offering benefits like automated alert triage and detection engineering assistance. However, these models also create new attack surfaces, enabling attackers to personalize social engineering and accelerate malware development. To mitigate risk, organizations should implement controls such as explicit data sourcing, restricting model access to sensitive data, and requiring human approval for actions that change system states. Security teams must also proactively threat model LLM deployments, focusing on areas like prompt injection and data leakage, and prioritize technical and behavioral signals over language cues for detection.

Critical Trend Micro Apex One Vulnerabilities Allow Remote Malicious Code Execution

gbhackers.com · 8 months ago

Trend Micro has identified eight security vulnerabilities within its Apex One endpoint protection platform. Two critical vulnerabilities, CVE-2025-71210 and CVE-2025-71211, allow unauthenticated remote attackers to execute code on Windows systems. Six additional vulnerabilities, rated high, enable local privilege escalation on both Windows and macOS. A critical patch, Solution ID KA-0022458, is available for Apex One 2019 on Windows and macOS platforms.

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor in Developer Environments

gbhackers.com · 8 months ago

Cybercriminals have compromised a Go cryptography module, identified as github.com/xinfeisoft/crypto, to steal passwords and deploy a Rekoobe Linux backdoor. The malicious module masquerades as a legitimate cryptography library, capturing typed passwords and storing them in an unusual location. It then exfiltrates this data to a dynamically supplied endpoint and executes a shell script that installs a Rekoobe backdoor, modifies SSH authorized keys, and alters iptables policies. The campaign uses GitHub Raw as an indirection layer and has been identified through indicators of compromise, including endpoints like img.spoolsv[.]cc and network addresses 154[.]84[.]63[.]184.

Europe’s ManoMano Hit: 38M Customer Records Compromised in Vendor Breach

www.techrepublic.com · 8 months ago

European online DIY marketplace ManoMano is notifying approximately 38 million customers about a data breach affecting a third-party customer service provider. Compromised data may include names, email addresses, phone numbers, and customer service communications, though passwords were not accessed. A threat actor claimed responsibility, alleging possession of user records and support tickets, which ManoMano’s notification confirms. The company has revoked the subcontractor’s access and is strengthening security measures while investigating the incident.

Meta Files Lawsuits Against Brazil, China, Vietnam Advertisers Over Celeb-Bait Scams

thehackernews.com · 8 months ago

false

Infostealers Drive Massive Brute-Force Attacks on Corporate SSO Gateways with Stolen Credentials

gbhackers.com · 8 months ago

Cybersecurity researchers have observed a significant increase in credential-stuffing attacks targeting corporate Single Sign-On systems, particularly F5 BIG-IP devices. These attacks utilize stolen credentials harvested by Infostealers like RedLine, Raccoon, and Vidar from compromised employee devices. Attackers then sell these logs on underground marketplaces, which are used to launch brute-force attacks against corporate portals. One attack originated from IP address 219.75.254.166, which involved a compromised Fortinet FortiGate-60E firewall hosted by OPTAGE Inc. in Japan, exposing ports 541/tcp and 10443/tcp.

We scanned 6,500+ ClawHub skills. 36% have security flaws. Built a Free Community run scanner to catch them before they execute

clawned.io · 8 months ago

NULL

Critical Flaws Exposed Gardyn Smart Gardens to Remote Hacking

www.securityweek.com · 8 months ago

Gardyn smart indoor gardens recently experienced critical security vulnerabilities that could have enabled remote hacking. These flaws include a command injection issue CVE-2025-29631, exposure of hardcoded admin credentials CVE-2025-1242, cleartext transmission of sensitive information CVE-2025-29628, and default SSH credentials CVE-2025-29629. Researchers estimate approximately 138,000 devices were potentially affected, and an attacker could have gained control of devices and accessed limited personal information. Gardyn has released patches, and there is no evidence of active exploitation.

1 Million Records from Dutch Telco Odido Leaked Online in Massive Data Breach

gbhackers.com · 8 months ago

A massive data breach at the Dutch telecommunications company Odido has exposed the personal information of nearly 700,000 customers. Attackers leaked the data in two phases, comprising a total of 2 million records with sensitive information including names, addresses, email addresses, phone numbers, bank account details, and government identification numbers. Odido is investigating the incident and advising affected customers to monitor their accounts and strengthen their online security. The leak presents a significant risk of identity theft and financial fraud for current and former customers.

FreeBSD Vulnerabilities Enable Attackers to Crash Entire System

gbhackers.com · 8 months ago

A critical security vulnerability, CVE-2025-15576, has been identified in FreeBSD versions 14.3 and 13.5. This flaw allows attackers to escape FreeBSD jail environments and gain unauthorized access to the entire host filesystem. The vulnerability stems from a flawed interaction involving nullfs mounts and Unix domain sockets, requiring control of two cooperating processes within separate jails. No workaround is available, and users are urged to immediately update their systems using the FreeBSD update utility or manually apply patches.

Ransomware groups switch to stealthy attacks and long-term access

www.csoonline.com · 8 months ago

Ransomware attackers are shifting tactics from disruptive attacks to stealthier, long-term access methods, prioritizing data theft and extortion over encryption. Attackers are increasingly routing command-and-control traffic through trusted enterprise services to evade detection. Experts note a rise in groups like Qilin, Cl0p, and Akira, with Scattered Spider/Lapsus$/ShinyHunters offering extortion-as-a-service. To counter these evolving threats, organizations should strengthen identity controls, monitor trusted applications, and focus detection strategies on persistence and data exfiltration.

Hacker kompromittieren immer schneller

www.csoonline.com · 8 months ago

Der CrowdStrike Global Threat Report zeigt, dass Angreifer 2025 im Schnitt nur noch 29 Minuten benötigten, um vollständigen Zugriff auf ein Netzwerk zu erreichen, rund 65 Prozent schneller als im Vorjahr. Die schnellste gemessene Breakout-Zeit lag bei 27 Sekunden, und in einem Fall begann die Datenexfiltration bereits vier Minuten nach dem initialen Zugriff. Als Hauptgrund wird der verstärkte Einsatz von KI-Tools genannt, wobei Angreifer, die KI nutzen, ihre Aktivitäten um 89 Prozent erhöhten. Staatlich unterstützte und kriminelle Gruppen wie Fancy Bear, Punk Spider und Famous Chollima setzen KI ein, unter anderem Lamehug Malware, KI-generierte Skripte zur schnellen Extraktion von Zugangsdaten und KI-generierte Identitäten, was Incident Response und Forensik deutlich erschwert.