Blahalla

iPhone Privacy Alert: Predator Spyware Can Hide Camera, Mic Indicators

www.techrepublic.com · 8 months ago

Researchers have identified three methods attackers can exploit to bypass Windows 11's Secure Boot implementation. These techniques involve manipulating the boot process through specially crafted USB drives or by injecting malicious code during system startup. One method leverages a vulnerability in the Unified Extensible Firmware Interface, or UEFI, driver, resulting in CVE-2024-22901. Another involves exploiting a flaw in the system management mode, or SMM, to gain control of the boot process and a third uses a technique to bypass the Secure Boot policy.

RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN

thehackernews.com · 8 months ago

A vulnerability dubbed RoguePilot in GitHub Codespaces allowed attackers to potentially leak sensitive data, including the GITHUBTOKEN, by injecting malicious instructions into GitHub issues. This passive prompt injection leverages Copilot’s automatic processing of issue descriptions to execute commands silently. Researchers have also discovered GRP-Obliteration, a technique to remove safety features from large language models, and Semantic Chaining, an image jailbreak attack that bypasses safety filters. A new class of malware, promptware, is emerging that manipulates LLMs to perform malicious actions across a cyberattack lifecycle.

CarGurus data breach exposes information of 12.4 million accounts

www.bleepingcomputer.com · 8 months ago

A data breach at CarGurus, an online automotive platform, has exposed information from over 12 million user accounts. The ShinyHunters extortion group published a 6.1 gigabyte archive containing compromised data, including email addresses, phone numbers, and financial application details. Approximately 3.7 million records are new, raising concerns about potential phishing attacks and scams. ShinyHunters has been actively targeting and extorting multiple companies through social engineering and malicious software.

AI Agent Threat Intel (Feb 2026 month to date): Tool chain escalation displaces instruction override as #1 technique, agent-targeting attacks hit 26.4% - 91K production interactions

raxe.ai · 8 months ago

This report provides a monthly overview of threats targeting artificial intelligence systems, classified for public distribution. It outlines threat vectors, attack techniques, and potential harm categories, with analysis mapped to the OWASP AI Top 10. The report offers recommendations for mitigation and includes varying levels of intelligence for public, industry, and organizational audiences. Services offered include threat modeling, red team exercises, and runtime protection for AI agent infrastructure.

Microsoft adds Copilot data controls to all storage locations

www.bleepingcomputer.com · 8 months ago

false

Developer-targeting campaign using malicious Next.js repositories

www.microsoft.com · 8 months ago

Cybersecurity researchers have uncovered a coordinated campaign targeting developers through malicious Next.js repositories. Attackers use deceptive "interview project" repositories to gain remote code execution, enabling reconnaissance, data collection, and command-and-control access. The attacks leverage techniques like dynamic code execution and beaconing to custom domains, potentially compromising developer machines and stealing sensitive data. Microsoft Defender tools are available to help organizations detect and mitigate this threat.

US ‘committed’ to fighting transnational gangs behind Southeast Asian scam compounds: FBI

therecord.media · 8 months ago

The U.S. Federal Bureau of Investigation is committed to combating transnational criminal networks operating scam compounds in Southeast Asia. Officials recently met with law enforcement in Thailand, Cambodia, and Vietnam to address these operations, which involve indentured labor and target victims worldwide with cryptocurrency investment scams. Recent enforcement actions include China’s execution of crime family leaders in Myanmar, the indictment and extradition of Prince Group’s chairman, Chen Zhi, and a crackdown by Cambodian authorities. The FBI emphasizes that this is a regional issue requiring coordinated international efforts.

ROP the ROM: Exploiting a Stack Buffer Overflow on STM32H5 in Multiple Ways

www.errno.fr · 8 months ago

Security researchers have identified a stack buffer overflow vulnerability in STM32H5 embedded systems. Exploitation techniques include shellcode injection, Return-Oriented Programming using the system’s ROM, and UART firmware dumping. Combining Return-Oriented Programming with shellcode execution is also possible to bypass security protections. Preventing this attack requires restricting access to the vulnerable ROM region through a Memory Protection Unit, though even this protection can be bypassed.

The Looming Taiwan Chip Disaster That Silicon Valley Has Long Ignored

www.nytimes.com · 8 months ago

false

Sendmarc Releases DMARCbis Fireside Chat Featuring Co-Editor Todd Herr

gbhackers.com · 8 months ago

false

Reddit fined $20 million by UK for not effectively checking users’ ages

therecord.media · 8 months ago

The United Kingdom’s data protection regulator, the Information Commissioner’s Office, has fined Reddit nineteen point five million dollars for failing to adequately verify users’ ages. The platform collected and used children’s data illegally due to a reliance on self-reporting and a lack of data protection impact assessments. Reddit’s practices exposed children to potentially harmful content and the company intends to appeal the decision. The ICO emphasized that self-declaration is not sufficient for age verification and encourages other companies to improve their data protection practices.

Crypto platform Step Finance shutting down after $40 million theft

therecord.media · 8 months ago

The decentralized finance platform Step Finance is ceasing operations following a theft of approximately 40 million dollars in January. Devices used by Step Finance executives were compromised, leading to the security breach and ultimately prompting the company to shut down after exploring potential solutions. Associated projects, SolanaFloor and Remora Markets, will also be closed. While authorities recovered around 4.7 million dollars in assets, the company is implementing a buyback program for STEP coin holders and a redemption process for Remora token holders.

‘Arkanix Stealer’ Malware Disappears Shortly After Debut

www.securityweek.com · 8 months ago

Researchers have identified several methods attackers can use to bypass Microsoft's Defender for Endpoint. These techniques include exploiting legitimate tools like PowerShell and MSXML to execute malicious code. Attackers can also leverage unusual file extensions or use process injection to disguise their activities. These evasion tactics highlight the ongoing need for continuous improvement in endpoint detection and response systems. CVE-2023-26955 is associated with the exploitation of MSXML.

Identity-First AI Security: Why CISOs Must Add Intent to the Equation

www.bleepingcomputer.com · 8 months ago

The increasing use of AI agents within organizations presents new security challenges as these agents often inherit excessive privileges and can deviate from their intended purpose. Traditional identity and access management, which focuses on “who” is accessing resources, is no longer sufficient. A new approach, combining identity-first security with intent-based permissioning, is needed to evaluate “why” an agent is requesting access, tying privileges to declared missions and context. This layered approach addresses privilege inheritance and mission drift while simplifying governance and improving auditability.

Most teens believe their peers are using AI to cheat in school

www.washingtonpost.com · 8 months ago

false

UK fines Reddit $19 million for using children’s data unlawfully

www.bleepingcomputer.com · 8 months ago

British regulators have fined Reddit over 19 million dollars for unlawfully collecting and using the personal information of children under 13. Reddit lacked adequate age verification measures until July 2025, despite its terms of service prohibiting users under 13. The Information Commissioner’s Office estimates a significant number of underage children used the platform, potentially exposing them to harmful content. Reddit plans to appeal the decision, asserting that most of its UK users are adults.

Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog

hacks.mozilla.org · 8 months ago

Firefox 148 introduces a new standardized Sanitizer API to enhance security and protect against cross-site scripting, or XSS, attacks. This API provides a straightforward way for developers to sanitize untrusted HTML, reducing the risk of attackers injecting malicious code. The setHTML() method integrates sanitization directly into HTML insertion, replacing error-prone innerHTML assignments. Combining the Sanitizer API with Trusted Types offers even stronger protection against XSS, which is categorized as CWE-79.

VMware Aria Operations Vulnerability Could Allow Remote Code Execution

www.securityweek.com · 8 months ago

Broadcom has released security updates to address several vulnerabilities in VMware Aria Operations. A command injection flaw, identified as CVE-2026-22719, allows unauthenticated attackers to potentially execute remote code. Another vulnerability, CVE-2026-22720, is a stored cross-site scripting issue that could enable attackers to perform administrative actions. A privilege escalation vulnerability, CVE-2026-22721, allows for the potential gain of administrative access.

UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware

thehackernews.com · 8 months ago

A Russia-aligned threat actor, known as UAC-0050 or Mercenary Akula, targeted a European financial institution with a social engineering attack. The attackers used a spoofed Ukrainian judicial domain to deliver a remote access payload through a multi-layered infection chain involving PixelDrain, password-protected archives, and a disguised executable. The attack deployed Remote Manipulator System, or RMS, a Russian remote desktop tool, to gain persistent access. This marks a potential expansion of the group’s targeting beyond Ukraine and into entities supporting the nation.

Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security

unit42.paloaltonetworks.com · 8 months ago

false

CISO Conversations: Timothy Youngblood; 4x Fortune 500 CISO/CSO

www.securityweek.com · 8 months ago

false

UAE claims it stopped ‘terrorist’ ransomware attack

therecord.media · 8 months ago

The United Arab Emirates reportedly prevented a recent ransomware attack targeting its digital infrastructure and vital sectors. Officials claim the attacks involved network infiltration, ransomware deployment, phishing campaigns, and the use of artificial intelligence. The incidents occur during heightened regional tensions and follow a 2023 cyber cooperation agreement between the UAE and the U.S. Treasury Department. Iranian-linked actors are suspected of involvement, with a significant percentage of threats believed to be state-sponsored.

Ukraine pushes tighter Telegram regulation, citing Russian recruitment of locals

therecord.media · 8 months ago

Ukrainian officials are calling for tighter regulation of the Telegram messaging app due to its use by Russia for recruitment and coordination of sabotage and terrorist attacks. Following a recent deadly attack in Lviv, President Zelenskyy stated Russia organized the attack through Telegram. Some officials are proposing restrictions on Telegram and similar platforms to protect national security, while others suggest banning the app or enforcing European regulatory standards. Telegram founder Pavel Durov denies accusations of facilitating terrorism, claiming Russia aims to control the platform.

New ‘Sandworm_Mode’ Supply Chain Attack Hits NPM

www.securityweek.com · 8 months ago

Security researchers have identified a new supply chain attack, dubbed SandwormMode, targeting the NPM registry. The attack uses malicious packages that employ typosquatting and weaponize AI coding assistants to steal credentials and secrets. Attackers abuse stolen NPM and GitHub credentials and use a weaponized GitHub Action for propagation and data exfiltration. The multi-stage attack includes harvesting secrets, injecting malicious code, and establishing persistence, with a configurable dead switch capability.

Using Passkeys for more than just Auth

conic.al · 8 months ago

false

VMware Aria Flaws Enable Attackers to Execute Remote Code

gbhackers.com · 8 months ago

Broadcom has announced three security vulnerabilities affecting VMware Aria Operations, VMware Cloud Foundation, and related products. The most severe flaw, CVE-2026-22719, is a command injection vulnerability that allows unauthenticated attackers to execute remote code. Other vulnerabilities include a stored cross-site scripting flaw, CVE-2026-22720, and a privilege escalation vulnerability, CVE-2026-22721. Patches and workarounds are now available to address these issues, and immediate application of the updates is strongly advised.

As Cybersecurity Firms Chase AI, VC Market Skyrockets

www.darkreading.com · 8 months ago

false

Critical SolarWinds Serv-U flaws offer root access to servers

www.bleepingcomputer.com · 8 months ago

SolarWinds has released updates to patch four critical vulnerabilities in its Serv-U file transfer software. One vulnerability, CVE-2025-40538, allows attackers with high privileges to gain root or administrator access. Other patched flaws include type confusion and an Insecure Direct Object Reference vulnerability, also leading to potential root access. While exploitation requires existing high privileges, over twelve thousand Serv-U servers remain exposed online, making them potential targets for attackers.

Threat Actors Exploit Weaponized AI to Seize Full Domain Access in Under 30 Minutes

gbhackers.com · 8 months ago

Threat actors are rapidly weaponizing artificial intelligence to compromise entire organizational domains, often within 30 minutes. Adversaries are using AI models to automate reconnaissance, escalate privileges, and scale post-exploitation, compressing the attack timeline and requiring defenders to respond with similar speed. Attack groups like PUNK SPIDER and FANCY BEAR are leveraging AI for tasks ranging from credential harvesting to data exfiltration, with one notable campaign involving the LAMEHUG malware utilizing the Hugging Face API. The increasing use of AI is leading to a shift towards malware-free, credential-driven intrusions, demanding that organizations prioritize identity security and automated containment to prevent full domain compromise.

GitHub Issues Abused in Copilot Attack Leading to Repository Takeover

www.securityweek.com · 8 months ago

Researchers have discovered a new attack called RoguePilot that exploits vulnerabilities in GitHub Codespaces to allow attackers to take over repositories. The attack involves injecting malicious instructions into GitHub issues, manipulating Copilot to leak a user’s GitHub token. Attackers leverage features like HTML comments, JSON schema downloads, and symbolic links to exfiltrate data and gain control of the repository. GitHub has since patched the vulnerability.

Is AI Good for Democracy?

www.schneier.com · 8 months ago

false

Cybercriminals Exploit Windows Management Instrumentation WMI to Maintain Stealthy Access and Silent Control

gbhackers.com · 8 months ago

Cybercriminals are exploiting Windows Management Instrumentation, or WMI, to maintain persistent and stealthy access to compromised networks. Attackers use WMI Event Subscriptions and Event Filters to trigger malicious scripts automatically based on system events like user logins or reboots. This method hides malicious logic within the operating system’s database, avoiding detection by typical antivirus scans. Security teams can detect this activity by using PowerShell to query the WMI namespace and audit for unauthorized entries.

Taiwan Security Firm Confirms Flaw Flagged by CISA Likely Exploited by Chinese APTs

www.securityweek.com · 8 months ago

A cybersecurity firm has confirmed that a vulnerability, CVE-2024-7694, was likely exploited by Chinese advanced persistent threat actors. This vulnerability allows unauthorized file uploads and command execution on affected servers, and was patched in August of last year. The attacks were highly coordinated and targeted specific customers, utilizing hundreds of IP addresses to mask the threat actors’ identity. The firm identifies the actors as Slime57 and Slime62, and has assisted affected customers with patching and mitigation efforts.

Identity Prioritization isn't a Backlog Problem - It's a Risk Math Problem

thehackernews.com · 8 months ago

false

Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks

thehackernews.com · 8 months ago

The Lazarus Group, linked to North Korea, is now using Medusa ransomware in attacks against healthcare and non-profit organizations in the Middle East and the United States. This marks a shift for the group, which previously developed custom ransomware, now opting to operate as affiliates within ransomware-as-a-service (RaaS) operations. The average ransom demand has been around $260,000, and the attackers use tools like RPProxy, Mimikatz, Comebacker, InfoHook, BLINDINGCAN, and ChromeStealer. This activity demonstrates the continued involvement of North Korean actors in cybercrime.

Shai-Hulud-style NPM worm hits CI pipelines and AI coding tools

www.csoonline.com · 8 months ago

A massive Shai Hulud style npm supply chain worm is infecting developer machines, continuous integration pipelines, and AI coding tools under an active campaign tracked as SANDWORMMODE. At least 19 typosquatted packages impersonating popular developer utilities and AI tools install a multi stage payload that harvests npm and GitHub tokens, environment secrets, and cloud keys, uses stolen credentials to push malicious changes and inject dependencies or workflows, and contains a dead switch that can wipe home directories when detection occurs. The campaign weaponizes GitHub Actions and a malicious Model Context Protocol server to poison AI coding assistants for prompt injection, includes a dormant polymorphic engine for code rewriting, and has led to registry hardening such as short lived scoped tokens, mandatory two factor authentication for publishing, and identity bound trusted publishing from CI.

ShinyHunters extortion gang claims Odido breach affecting millions

www.bleepingcomputer.com · 8 months ago

Dutch telecommunications provider Odido has confirmed a data breach impacting millions of customers, with the ShinyHunters extortion gang claiming responsibility. The breach initially involved the exposure of customer data such as names, addresses, bank account details, and identification information affecting 6.2 million customers. ShinyHunters now claims to have stolen nearly 21 million records, including internal corporate data and plaintext passwords, a claim Odido denies. The group has been linked to recent breaches of Panera Bread, Betterment, and Match Group, often using voice phishing and device code vishing techniques to compromise single sign-on accounts and access connected services.

North Korean state hackers seen using Medusa ransomware in attacks on US, Middle East

therecord.media · 8 months ago

North Korean hackers linked to the Lazarus group have begun using Medusa ransomware in financially-motivated attacks against organizations in the Middle East and the United States. Cybersecurity experts attribute these attacks to the Andariel unit, a subgroup within Lazarus, and note a shift from developing their own ransomware like Maui to utilizing ransomware-as-a-service models. U.S. law enforcement has previously sought the arrest of Rim Jong Hyok for his involvement in Maui ransomware attacks targeting healthcare providers, and a $10 million reward is offered for information leading to his arrest. The use of custom tools typically employed by Lazarus confirms the North Korean attribution of the recent Medusa attacks.

Massive Conduent Data Breach Exfiltrates 8 TB Affects Over 25 Million Americans

gbhackers.com · 8 months ago

A massive data breach at Conduent has exposed the personal information of over 25 million Americans. The SafePay ransomware group stole approximately 8 terabytes of data between October 2024 and January 2025. Compromised data includes names, Social Security numbers, medical records, and health insurance information, primarily impacting residents of Texas and Oregon. Affected individuals are being urged to place fraud alerts on their credit files.

Intel Strikes Deal With a Chip Start-Up Its C.E.O. Invested In

www.nytimes.com · 8 months ago

false

North Korean Lazarus group linked to Medusa ransomware attacks

www.bleepingcomputer.com · 8 months ago

Hackers linked to the North Korean Lazarus group are now using the Medusa ransomware to target U.S. healthcare organizations in extortion attacks. The Medusa ransomware-as-a-service operation has impacted over 300 organizations since January 2021, with the gang claiming at least 80 victims. Attack toolsets show associations with Diamond Sleet and include tools like Comebacker, Blindingcan, and Mimikatz. Stolen funds from these attacks are used to support espionage operations against entities in the defense, technology, and government sectors.

Malicious NuGet Packages Target ASP.NET Developers to Steal Login Credentials

gbhackers.com · 8 months ago

A coordinated attack is targeting ASP.NET developers through malicious NuGet packages disguised as legitimate utilities. Four packages, NCryptYo, DOMOAuth2, IRAOAuth2.0, and SimpleWriter, are being used to steal authentication credentials and create backdoors. These packages establish a localhost proxy on port 7152 to exfiltrate data and receive attacker-controlled authorization rules. The attackers are focused on weaponizing applications rather than directly compromising developer systems.

Chinese AI Labs Launch Massive Distillation Attacks on Anthropic Claude, Tracking 13M Exchanges

gbhackers.com · 8 months ago

Researchers have identified large-scale data extraction campaigns targeting Anthropic’s Claude models, orchestrated by Chinese AI labs DeepSeek, Moonshot, and MiniMax. These labs used over 16 million fraudulent interactions to steal advanced capabilities like coding, reasoning, and tool use through a process called distillation. The attackers employed sophisticated evasion techniques, including proxy networks and rapid adaptation to new model releases, to bypass restrictions and acquire capabilities quickly. Anthropic is implementing new detection methods and emphasizing the need for global cooperation to protect AI systems.

Anonymous Fénix Members Arrested in Spain

www.securityweek.com · 8 months ago

Spanish authorities have arrested four members of the Anonymous Fénix group for conducting distributed denial-of-service attacks against government, political, and public entities. The group's activity escalated after the October 2024 Valencia floods, with targets including public administration websites. Law enforcement also seized the group’s social media accounts. Separately, authorities arrested an 18-year-old suspect accused of cyberattacks against organizations including NATO, the US Army, and the International Civil Aviation Organization, allegedly stealing and leaking data.

Romanian Cybercriminal Admits Guilt in Scheme Selling Oregon State Government Network Access

gbhackers.com · 8 months ago

A Romanian national has pleaded guilty to unauthorized access and sale of network credentials, including a breach of an Oregon state government office network in June 2021. He sold this access on the dark web, enticing buyers with stolen personal information. The scheme impacted multiple U.S. victims, resulting in over $250,000 in losses. Dragomir faces up to seven years in prison for computer intrusion and aggravated identity theft.

UnsolicitedBooker Targets Central Asian Telecoms With LuciDoor and MarsSnake Backdoors

thehackernews.com · 8 months ago

A threat group known as UnsolicitedBooker has shifted its focus from Saudi Arabian targets to telecommunications companies in Kyrgyzstan and Tajikistan. The group uses phishing emails to deliver backdoors, LuciDoor and MarsSnake, both written in C++ and capable of executing commands and exfiltrating data. Researchers noted the group’s use of rare Chinese-origin tools and a tactic of alternating between backdoors, and at one point used a hacked router as a command-and-control server. Separately, two new groups, PseudoSticky and Cloud Atlas, are targeting Russian organizations with malware, with Cloud Atlas exploiting CVE-2018-0802.

Bitcoin-Milliarden von Raubkopie-Portal im Visier der Justiz

www.csoonline.com · 8 months ago

A trial has begun in Leipzig concerning the illegal streaming site movie2k.to and a substantial Bitcoin fortune. The main defendant and another man are accused of money laundering and tax evasion related to the operation of the site, which illegally distributed copyrighted films and series. Authorities allege the defendants accumulated approximately 2.64 billion euros in Bitcoin proceeds through advertising revenue. The court will decide the fate of these Bitcoin holdings, which are currently held by the state justice administration.

Malicious OpenClaw Tactics Deceive Users into Manual Password Entry for AMOS Infection

gbhackers.com · 8 months ago

Attackers are exploiting the OpenClaw AI agent ecosystem to distribute the Atomic (AMOS) Stealer malware. Malicious SKILL.md files trick users into manually entering their passwords, enabling the stealer to access sensitive data like Apple and KeePass keychains. The malware collects usernames, system metadata, browser data, and cryptocurrency wallet information before exfiltrating it via HTTPS POST requests. Security researchers advise defenders to implement marketplace vetting, containerized execution, and behavioral detection to mitigate similar attacks.

I reverse-engineered Intel ME so you don't have to: A decade of Ring -3 vulnerabilities that your EDR can't see

www.sbytec.com · 8 months ago

There is a separate Intel Management Engine coprocessor that runs a MINIX-based operating system at privilege Ring minus three with an independent TCP/IP stack and the ability to access host memory, storage, display, and USB and to operate across power states while remaining invisible to the host operating system. This creates a persistent firmware-level attack surface evidenced by CVE-2017-5689, an authentication bypass in AMT that allowed unauthenticated remote code execution with ME privileges, and CVE-2025-20037, a TOCTOU race condition in CSME enabling local privilege escalation into the ME context. A supply chain compromise called PKfail disclosed leaked Boot Guard private signing keys that undermine firmware integrity for affected platforms, and detection scanners, YARA rules, and documented neutralization procedures are provided for security researchers.

ZeroDayRAT Targets Android and iOS Devices for Surveillance and Financial Data Theft

gbhackers.com · 8 months ago

A new mobile spyware service called ZeroDayRAT is targeting Android and iOS devices, combining real-time surveillance with direct financial theft. The Malware-as-a-Service is promoted on Telegram and spreads primarily through smishing campaigns and fake app versions distributed on messaging platforms and rogue app stores. Once installed, attackers gain full control of the device, including live feeds, location tracking, camera and microphone activation, keylogging, and clipboard data exfiltration. The tool also features financial theft modules, including clipboard injection to hijack cryptocurrency transfers and overlay attacks to steal credentials from payment apps.