Blahalla

Deserialization Flaw in Ruby Workers That Could Enable Full Compromise

gbhackers.com · 8 months ago

A critical Remote Code Execution vulnerability has been discovered in RubitMQ job workers due to unsafe JSON deserialization. The flaw stems from using the Oj library, which allows attackers to execute commands by injecting malicious JSON payloads. Specifically, the vulnerability allows instantiation of a Node class containing a runfind method that uses Open3.capture3 to execute system commands. This issue, identified as CVE-2024-XXXX with a CVSS score of 9.8, enables attackers to compromise the entire infrastructure with the privileges of the background worker.

LUKS Encryption Compromised on Linux ICS Devices via TPM Bus Sniffing Exploit

gbhackers.com · 8 months ago

Security researchers have discovered a vulnerability affecting the Moxa UC-1222A Secure Edition industrial computer, allowing attackers to bypass LUKS full-disk encryption through passive sniffing of the SPI bus during system boot. This attack, tracked as CVE-2026-0714, involves intercepting a plaintext LUKS key transmitted during a TPM2NVRead command. Researchers successfully extracted the key using a logic analyzer and validated it by mounting the encrypted partition. Moxa has acknowledged the issue and released a security advisory, recommending mitigation through TPM parameter encryption.

Hackers Use Steganographic Images to Bypass Anti-Malware and Deploy Malware

gbhackers.com · 8 months ago

Hackers have compromised a Node Package Manager package, buildrunner‑dev, to deliver the Pulsar Remote Access Trojan. The attack uses typosquatting and a downloader script that retrieves a batch file from Codeberg, which then installs a persistence mechanism and bypasses User Account Control. The malware employs steganography to hide PowerShell scripts and a.NET executable within PNG images, utilizing multiple AMSI bypass techniques to evade detection and ultimately deploy Pulsar, a powerful RAT known for fileless execution and credential theft. The attackers dynamically resolve sensitive APIs to further obscure malicious activity.

It’s time to rethink CISO reporting lines

www.csoonline.com · 8 months ago

false

Fake Huorong Site Delivers ValleyRAT Backdoor in Targeted Malware Campaign

gbhackers.com · 8 months ago

A fake website mimicking Huorong Security is being used to distribute the ValleyRAT backdoor to users who believe they are downloading antivirus software. The attackers use typosquatting, registering huoronga[.]com to deceive victims. The malicious payload, disguised within a seemingly legitimate installer, employs DLL sideloading and a Catena-style loader to execute code and evade detection. The campaign uses a scheduled task and deletes files to maintain persistence and obscure traces, communicating with a command-and-control server at 161.248.87.250 over TCP port 443. The Silver Fox APT group is attributed to this activity, and the leaked ValleyRAT builder has significantly increased the prevalence of this threat.

Anthropic Facing Allegations from Musk Over Large‑Scale Data Misuse

gbhackers.com · 8 months ago

AI firm Anthropic is facing accusations of hypocrisy and data theft from tech billionaire Elon Musk. Anthropic recently accused Chinese AI developers, DeepSeek and MiniMax, of using fraudulent accounts to copy its Claude model through a technique called distillation. Musk alleges Anthropic has a history of data theft and has been involved in multi-billion dollar copyright settlements, including a $1.5 billion settlement and a pending $3 billion lawsuit. These incidents raise national security and cybercrime concerns regarding the rapid replication of advanced AI systems.

The rise of the evasive adversary

www.csoonline.com · 8 months ago

CrowdStrike’s latest report reveals a significant shift in adversary tactics, now prioritizing evasion over expansion. AI-driven attacks have increased by 89%, with adversaries using generative tools to refine phishing and accelerate reconnaissance. Zero-day exploitation surged 42%, with attackers often moving laterally within just 29 minutes, and cloud intrusions rose 37%, particularly among nation-state actors leveraging stolen credentials. China-nexus adversaries demonstrated a 38% increase in targeted intrusion activity, frequently exploiting vulnerabilities in edge devices.

Odido Faces Alleged Data Breach as ShinyHunters Claims 21M Records Exposed

gbhackers.com · 8 months ago

Cybercriminal group ShinyHunters claims a massive data breach at Dutch telecommunications provider Odido, alleging the company has not been transparent about the incident's scale. Approximately 21 million customer records, belonging to roughly 8 million customers, are reportedly compromised. The stolen data includes sensitive information like plaintext passwords, passport numbers, IBANs, and internal company documents. This incident poses significant risks for affected individuals and presents considerable challenges for Odido regarding security and regulatory compliance.

Anthropic’s Claude Code Security rollout is an industry wakeup call

www.csoonline.com · 8 months ago

Anthropic recently launched Claude Code Security, a code-checking tool, causing cybersecurity stocks to decline. The tool scans codebases for vulnerabilities and suggests patches for human review, but concerns exist about relying solely on AI, potentially outsourcing security definition and creating dependency on model updates. Experts caution that organizations must maintain human oversight and validate AI-suggested fixes to avoid creating new vulnerabilities and single points of failure. While impressive, the technology’s non-deterministic nature and potential for rapid changes require ongoing evaluation and governance.

ClickFix Infostealer Spreads via Fake CAPTCHA Traps, Targeting Unsuspecting Users

gbhackers.com · 8 months ago

A new ClickFix Infostealer campaign is using fake CAPTCHA pages to trick users into running malicious scripts. The malware targets a wide range of data, including browser credentials, cryptocurrency wallet information, VPN configurations, and gaming application logins. The attack chain involves PowerShell scripts fetching payloads from several IP addresses, including 91.92.240.219, 178.16.53.70, and 94.154.35.115, and uses process injection to remain undetected. Security professionals should monitor PowerShell network connections and RunMRU registry entries to prevent reinfection.

Anthropic Says Chinese AI Firms Used 16 Million Claude Queries to Copy Model

thehackernews.com · 8 months ago

Anthropic has identified industrial-scale campaigns by three Chinese AI companies, DeepSeek, Moonshot AI, and MiniMax, who illegally extracted capabilities from its Claude large language model. The companies used over 16 million queries through approximately 24,000 fraudulent accounts to train their own models, violating Anthropic's terms of service and regional access restrictions. DeepSeek targeted Claude’s reasoning and censorship avoidance, Moonshot AI focused on agentic reasoning and coding, and MiniMax concentrated on coding and tool use capabilities. Anthropic has implemented classifiers and safeguards to detect and mitigate these attacks, which pose national security risks by stripping necessary protections from illicitly distilled models.

WhatsApp Rolls Out Optional Password Feature to Strengthen User Security

gbhackers.com · 8 months ago

false

Hackers Exploit DeepSeek and Claude AI to Launch Global Attacks on FortiGate Devices

gbhackers.com · 8 months ago

Hackers are leveraging artificial intelligence models, DeepSeek and Claude, to automate attacks against FortiGate firewalls globally. The attackers exposed data on a server in Switzerland, including stolen configurations and attack plans, impacting organizations in Asia-Pacific, Turkey, and Asia. The AI models generate attack plans and automate tasks like vulnerability assessments and exploit execution, while tools like ARXON and CHECKER2 enable large-scale, parallel intrusions. The intrusions exploited vulnerabilities, including CVE-2019-6693, and indicate a financially motivated, Russian-speaking threat actor has compromised hundreds of FortiGate firewalls across dozens of countries.

Last Week in Security (LWiS) - 2026-02-23

blog.badsectorlabs.com · 8 months ago

Several cybersecurity vulnerabilities and tools were recently highlighted. A typo in Firefox’s web assembly component led to a remote code execution flaw. A use-after-free vulnerability was discovered in afd.sys, identified as CVE-2026-21241. Researchers also demonstrated how to leverage macOS apps for running unsigned code and explored techniques for bypassing SmartScreen through DLL sideloading within a VHDX file. New tools include a professional version of Havoc and a platform for automated evasion, along with an Ansible role for creating Windows SMB shares with privilege escalation misconfigurations.

Google Releases Emergency Chrome Patch Addressing Three Major Security Flaws

gbhackers.com · 8 months ago

Google has released an emergency update for Chrome, addressing three high-severity security vulnerabilities affecting Windows, Mac, and Linux users. One vulnerability involves an out-of-bounds read error in the Media component, while another is a more dangerous out-of-bounds read and write issue in the Tint component. A third flaw involves an inappropriate implementation within Chrome’s DevTools. These vulnerabilities are CVE-2026-3061, CVE-2026-3062, and CVE-2026-3063.

OT-Security: Warum der Blick auf Open Source lohnt

www.csoonline.com · 8 months ago

false

Russian group uses AI to exploit weakly-protected Fortinet firewalls, says Amazon

www.csoonline.com · 8 months ago

A Russian-speaking threat actor used commercial generative AI services to compromise over 600 Fortinet Fortigate firewalls across more than 55 countries between January 11 and February 18. The attackers exploited exposed management ports and weak credentials, bypassing basic security measures. They successfully compromised Active Directory, extracted credentials, and targeted backup infrastructure, demonstrating that AI amplifies the impact of attacks even by less-skilled actors. Experts emphasize the importance of implementing fundamental cybersecurity practices such as multifactor authentication and network segmentation to defend against such threats.

Android mental health apps with 14.7M installs filled with security flaws

www.bleepingcomputer.com · 8 months ago

Security researchers have identified significant vulnerabilities in ten mental health mobile applications with over 14.7 million combined downloads. These apps, which assist users with conditions like depression and anxiety, contain a total of 1,575 security flaws, including 54 rated as high-severity. Vulnerabilities include improper data validation, insecure data storage, and the use of weak encryption methods, potentially exposing sensitive therapy records. Several apps also lack root detection, increasing the risk of data compromise on compromised devices.

Pentagon Summons Anthropic Chief in Dispute Over A.I. Limits

www.nytimes.com · 8 months ago

false

Anthropic Accuses 3 Chinese Companies of Harvesting Its Data

www.nytimes.com · 8 months ago

Anthropic, a San Francisco based artificial intelligence start-up, alleges that three Chinese companies improperly obtained data from its Claude chatbot. DeepSeek, Moonshot, and MiniMax reportedly used approximately 24,000 fraudulent accounts to generate over 16 million conversations. This data was then used to train their own chatbots, violating Anthropic's terms of service. Similar accusations have been made against DeepSeek by OpenAI, raising national security concerns about China’s development of artificial intelligence technologies.

Spitting Cash: ATM Jackpotting Attacks Surged in 2025

www.darkreading.com · 8 months ago

ATM jackpotting attacks surged in 2025, resulting in over $20 million in losses for banks nationwide. Federal authorities have indicted 93 individuals, including members of the Tren de Aragua group, for deploying malware to manipulate ATMs and steal cash. The malware, often Ploutus, exploits vulnerabilities in the eXtensions for Financial Services (XFS) software layer, allowing attackers to bypass bank authorization. Security experts attribute the rise in attacks to outdated systems, weak physical security, and readily available tools and information.

More Than Dashboards: AI Decisions Must Be Provable

www.darkreading.com · 8 months ago

false

Spain arrests suspected hacktivists for DDoSing govt sites

www.bleepingcomputer.com · 8 months ago

Spanish authorities have arrested four alleged members of the hacktivist group Anonymous Fénix for conducting distributed denial-of-service attacks against government ministries, political parties, and public institutions. The group targeted sites in Spain and South America, with activity peaking after floods in Valencia. Members used social media platforms to spread anti-government messages and recruit volunteers. Authorities seized accounts on X and YouTube and shut down a Telegram channel following the arrests.

Microsoft Copilot Ignored Sensitivity Labels, Processed Confidential Emails

www.techrepublic.com · 8 months ago

Microsoft 365 Copilot improperly processed and summarized confidential emails, including legal memos, business agreements, and protected health information, despite configured sensitivity labels and data loss prevention policies. A code error in the “Work” tab allowed the AI to access emails from users’ Sent Items and Drafts folders, bypassing intended restrictions. This incident highlights a lack of independent AI governance controls, where all security measures resided within the same platform as the AI, creating a single point of failure. Organizations potentially face breach notification obligations under HIPAA and GDPR due to the incident.

Iran's MuddyWater Targets Orgs With Fresh Malware as Tensions Mount

www.darkreading.com · 8 months ago

Iran’s MuddyWater threat group is conducting a new cyber campaign, Operation Olalampo, targeting organizations in the Middle East and Africa. The campaign uses spear-phishing emails to deliver custom malware, including the Char backdoor controlled by a Telegram bot and the GhostFetch downloader. Researchers observed the use of artificial intelligence in the malware’s development, including debug strings containing emojis. MuddyWater, also known as TA450, has been steadily evolving its tactics and demonstrates continued dedication to expanding operations.

Binance Employees Find $1.7 Billion in Crypto Was Sent to Iranian Entities

www.nytimes.com · 8 months ago

Internal investigators at Binance discovered that more than 1,500 accounts on the platform were accessed by individuals in Iran over the past year. Approximately $1.7 billion flowed from Binance accounts to Iranian entities linked to terrorist groups, potentially violating global sanctions. Following the discovery, four employees involved in the investigation were fired or suspended, citing protocol violations. These findings emerged months before the founder of Binance received a pardon, raising questions about the company’s efforts to combat illegal activity.

Enigma Cipher Device Still Holds Secrets for Cyber Pros

www.darkreading.com · 8 months ago

The Enigma cipher machine, initially designed for businesses, was later adopted by Nazi Germany to protect communications during World War II. Polish cryptographers initially broke the code in 1932, sharing the information with British Intelligence before the war. The device's history highlights the dangers of overconfidence, a lack of security testing, and vulnerabilities created by user error. Cybersecurity professionals can learn valuable lessons about supply chain risks and the importance of proactive security measures from the Enigma’s story.

UK regulator fines porn company $1.8 million for failing to verify user ages

therecord.media · 8 months ago

British regulators have fined the porn company 8579 LLC £1.35 million, or $1.82 million, for failing to verify user ages. The Online Safety Act requires sites hosting pornography to implement rigorous age assurance methods, including photo ID and credit card checks. Ofcom is imposing a daily penalty of £1,000 for each day the company lacks an effective system. The regulator also issued a separate £50,000 fine for failing to respond to information requests.

Conduent Breach Surges to Over 25M, Could Be Largest in US History

www.techrepublic.com · 8 months ago

A data breach at government IT contractor Conduent has impacted an estimated 25 million Americans, potentially making it the largest in US history. The breach, discovered in January 2025, involved sensitive information like Social Security numbers, medical records, and health insurance details, affecting residents in multiple states including Texas and Oregon. Conduent is facing lawsuits for failing to adequately protect data and delayed notification, reporting a 25 million dollar charge related to breach notification. The company claims to have secured its networks and is working with law enforcement, but the full scope of the exposure remains under investigation.

APT28 Targeted European Entities Using Webhook-Based Macro Malware

thehackernews.com · 8 months ago

A Russia-linked threat actor, known as APT28, has launched a campaign called Operation MacroMaze, targeting European entities between September 2025 and January 2026. The attacks begin with spear-phishing emails containing documents with malicious macros that act as a beacon, alerting the attacker when opened. Subsequent payloads are delivered via Visual Basic Script and batch scripts, utilizing techniques like keyboard simulation and headless browser execution to evade detection. Data exfiltration is accomplished through Microsoft Edge, using standard HTML functionality to minimize detectable artifacts.

Microsoft says bug in classic Outlook hides the mouse pointer

www.bleepingcomputer.com · 8 months ago

Microsoft is investigating an issue impacting the classic Outlook desktop client where the mouse pointer disappears for some users. The problem, also affecting some OneNote and Microsoft 365 app users, makes the application difficult to use. Temporary workarounds include clicking emails, switching to PowerPoint and returning, or restarting the computer. Microsoft is asking administrators to submit diagnostic data to assist in resolving the problem.

600+ FortiGate Devices Hacked by AI-Armed Amateur

www.darkreading.com · 8 months ago

A financially motivated threat actor, believed to be based in Russia, has compromised over 600 FortiGate firewall instances across more than 55 countries. The attacker, lacking advanced technical skills, utilized generative AI tools throughout the operation, exploiting exposed management ports and weak credentials, including single-factor authentication. The attacker targeted Veeam Backup & Replication servers to steal credentials and compromise recovery capabilities, and moved on to easier targets when encountering resistance. Organizations are advised to restrict internet access to management interfaces, change default credentials, implement multi-factor authentication, and monitor for suspicious activity.

Backed by Anthropic, a Super PAC Group Begins an Ad Blitz in Support of A.I. Regulation

www.nytimes.com · 8 months ago

A new advertising campaign is urging New Jersey residents to contact their representatives regarding artificial intelligence regulation. The ads warn that Congress could leave people vulnerable to A.I.-related harm and oppose a bill blocking state protections against A.I. scams. The campaign, costing $300,000, is funded by Public First Action, a super PAC backed by the A.I. start-up Anthropic, which supports strict A.I. regulation. This effort reflects a growing political conflict over A.I. policy before the midterm elections.

Ad tech firm Optimizely confirms data breach after vishing attack

www.bleepingcomputer.com · 8 months ago

Ad tech firm Optimizely recently experienced a data breach resulting from a voice phishing attack. Threat actors gained access to Optimizely's systems and stole basic business contact information, but were unable to escalate privileges or access sensitive data. The company suspects the attackers are linked to the ShinyHunters extortion operation, which has targeted numerous other organizations using similar tactics. Optimizely is warning customers to be cautious of potential follow-up phishing attempts leveraging the stolen data.

Another exposed Supabase DB strikes: 20k+ attendees and FULL write access

obaid.wtf · 8 months ago

The Arts Council of Pakistan Karachi experienced a significant data exposure due to a publicly accessible Supabase database. This database contained personal information of over 20,000 attendees, including names, email addresses, phone numbers, and payment details. The vulnerability stemmed from intentionally disabled Row-Level Security and a publicly exposed API key, which had been present since September 2025. The exposed data could be exploited for scams, unauthorized ticket access, or sale on anonymous forums. The vulnerability has been mitigated by replacing the data with a synthetic dataset, and the Arts Council has been notified.

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

thehackernews.com · 8 months ago

Cybersecurity researchers have identified a new cryptojacking campaign utilizing social engineering to distribute malware-laced software bundles. The malware, which mines Monero using the XMRig miner, demonstrates worm-like capabilities by spreading through removable media and employs a logic bomb set to deactivate on December 23, 2025. The attackers leveraged a legitimate Windows driver using a Bring Your Own Vulnerable Driver technique, exploiting CVE-2020-14979 to enhance mining performance. A separate report indicates attackers are using a large language model to generate exploits targeting the React2Shell vulnerability, CVE-2025-55182.

Russian-speaking hackers used gen AI tools to compromise 600 firewalls, Amazon says

therecord.media · 8 months ago

A Russian-speaking hacking group compromised over 600 Fortinet FortiGate firewall devices in more than 55 countries earlier this year. The attackers used commercial generative AI tools to automate tasks and generate attack plans, allowing a group with low to medium skills to operate at a large scale. The campaign exploited weak security configurations and exposed administrative access points on the firewalls to steal device configurations and potentially prepare for ransomware attacks. Researchers noted the attackers’ reliance on AI-generated code often failed when encountering basic defenses.

Air Côte d'Ivoire confirms cyberattack following ransomware claims

therecord.media · 8 months ago

Air Côte d’Ivoire confirmed a cyberattack that began February 8, impacting parts of its information system. The INC ransomware gang claims to have stolen 208 GB of data and demanded a ransom, which has not been paid. Authorities in France, Côte d’Ivoire, and international experts are investigating the incident and working to mitigate the potential consequences for passengers, employees, and service providers. The INC ransomware gang has previously targeted government entities and airlines worldwide.

Global data protection authorities warn generative AI companies against replicating real people

therecord.media · 8 months ago

Data protection authorities from 61 countries have issued a warning to organizations developing generative AI systems. The warning addresses concerns about the creation of realistic images and videos depicting identifiable individuals without their consent. Recent incidents, including Grok AI generating nonconsensual images, prompted the action. Regulators are urging companies to implement safeguards against the creation of harmful content, including defamatory depictions and nonconsensual intimate imagery, and face potential fines and service blocking for noncompliance.

How likely is a man-in-the-middle attack?

www.certkit.io · 8 months ago

Adversary in the middle attacks account for less than four percent of incidents in the Verizon 2025 Data Breach Investigations Report, and most of those are real time phishing proxies such as Evilginx rather than network interception using stolen TLS private keys. Credential abuse represents twenty two percent of incidents, ransomware forty four percent, and phishing sixteen percent. Because modern TLS deployments use forward secrecy, a stolen private key cannot decrypt recorded past sessions for the vast majority of connections, about ninety four percent of the web, though a stolen key can still allow targeted impersonation if the attacker can get in the middle. In practice the main risks are endpoint compromises, DNS and BGP hijacks, and malicious pre installed root certificates, so organizations should focus security budgets on credential hygiene, endpoint protection, phishing defenses and ransomware preparedness while still encrypting and rotating keys and using short lived certificates.

Over 200K Australian Driver’s Licences Exposed in youX Cyber Breach

www.techrepublic.com · 8 months ago

A data breach at the Australian fintech platform youX has exposed sensitive borrower information, including over 200,000 driver’s license numbers. The attacker claims to have exfiltrated data from nearly 444,538 individuals, including names, addresses, loan applications, and financial records. The compromised data originated from around 800 broker organizations and more than 8,000 password hashes were accessed. Authorities are advising affected individuals to change passwords, enable multi-factor authentication, and consider obtaining new driver's license numbers.

US Healthcare Diagnostic Firm Says 140,000 Affected by Data Breach

www.securityweek.com · 8 months ago

A data breach has impacted nearly 140,000 people linked to healthcare diagnostic companies Vikor Scientific, now Vanta Diagnostics, KorPath, and Korgene. The breach originated from Catalyst RCM, a revenue cycle management provider, which experienced a compromise of its secure file management system. Stolen data included names, dates of birth, payment card details, medical information, and health insurance information. The Everest ransomware group claimed responsibility, publishing data allegedly stolen from the affected companies.

People Loved the Dot-Com Boom. The A.I. Boom, Not So Much.

www.nytimes.com · 8 months ago

false

When identity isn’t the weak link, access still is

www.bleepingcomputer.com · 8 months ago

Traditional security models often rely too heavily on identity verification, creating vulnerabilities as employees access systems from diverse devices and locations. Attackers are exploiting these weaknesses by reusing stolen credentials or compromising endpoints, bypassing multi-factor authentication. To improve security, organizations should implement continuous access verification that assesses both user and device conditions after initial authentication. Solutions like Infinipoint enable device-based access controls, self-service remediation, and proportionate enforcement to maintain trust and reduce disruption.

Ukrainian Gets 5 Years in US Prison for Aiding North Korean IT Fraud

www.securityweek.com · 8 months ago

A Ukrainian national has been sentenced to five years in prison for assisting North Korean IT workers in fraudulent activities. He operated a website that sold stolen US identities, enabling the workers to gain employment with US companies and access the financial system. Didenko also arranged for laptop farms to be hosted in multiple states, facilitating the operation. He forfeited over one million four hundred thousand dollars and faces restitution payments exceeding forty six thousand dollars.

GrayCharlie Hacks WordPress Sites, Spreads NetSupport RAT and Stealc Malware

gbhackers.com · 8 months ago

A financially motivated threat actor known as GrayCharlie is compromising WordPress sites to distribute malware. Attackers inject malicious JavaScript that tricks visitors into installing NetSupport RAT, often followed by Stealc and SectopRAT, using fake browser updates or ClickFix social engineering tactics. GrayCharlie operates a large infrastructure on providers like MivoCloud and HZ Hosting Ltd., and has recently targeted US law firms, possibly through a supply-chain compromise involving SMB Team. Security professionals are advised to block associated IP addresses and domains and monitor for suspicious activity.

⚡ Weekly Recap: Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More

thehackernews.com · 8 months ago

Cybersecurity threats significantly increased in 2025, with a surge in DDoS attacks, malicious bot activity, and e-commerce fraud impacting technology, telecommunications, and financial sectors. Malicious actors are exploiting trusted tools like Docker Hub and npm packages to deploy malware such as njRAT, Pulsar RAT, XWorm, and Prometei, frequently using techniques like process hollowing. Telegram is facing accusations of harboring criminal activity while a tax refund scam resulted in a prison sentence. New security tools are emerging to aid in configuration audits and Cobalt Strike interaction but require careful usage.

Autonomous AI Agents Provide New Class of Supply Chain Attack

www.securityweek.com · 8 months ago

Researchers have identified a new type of supply chain attack leveraging autonomous AI agents. Threat actors are using platforms like Clawhub and Moltbook to distribute malicious AI skills that compromise user data and financial assets. One active attack, involving the "bob-p2p" skill, tricks agents into storing private keys in plaintext and redirecting payments. This new attack class combines supply chain poisoning with social engineering, targeting algorithms instead of humans, and represents a repeatable and scalable threat.

On the Security of Password Managers

www.schneier.com · 8 months ago

New research has uncovered vulnerabilities in popular password managers like Bitwarden, Dashlane, and LastPass. These vulnerabilities allow unauthorized access to data and vaults if an attacker gains control of the server or compromises administrative access. The findings highlight security risks associated with account recovery features and shared vaults. Password Safe, a local encryption tool with no cloud component, is presented as an alternative.

Hacker stiehlt Daten von Tausenden RTL-Mitarbeitern

www.csoonline.com · 8 months ago

A cybercriminal known as LuneBF claims to have stolen data from over 27,000 employees of the RTL Group, a media company. The hacker reportedly accessed the company's intranet site and is offering the data for sale in the darknet, providing a sample of 100 records as proof. Leaked information includes names, email addresses, postal addresses, and phone numbers. Security experts warn of potential phishing attacks and risks to investigative journalists due to the exposed data.