Blahalla

Ukrainian gets 5 years for helping North Koreans infiltrate US firms

www.bleepingcomputer.com · 8 months ago

A Ukrainian national, Oleksandr Didenko, has been sentenced to five years in prison for facilitating a scheme where North Korean IT workers infiltrated U.S. companies using stolen identities. Didenko stole identities and sold them through an online platform, providing over 871 proxy identities and enabling “laptop farms” to disguise the North Koreans’ locations. This operation targeted 40 U.S. companies and involved a network of accomplices, including Christina Marie Chapman, who received a lengthy prison sentence as well. U.S. authorities have taken action against numerous individuals and companies linked to these North Korean IT worker schemes.

LLM-Generated Passwords Expose Security Risks with Predictability and Weakness

gbhackers.com · 8 months ago

New research indicates that passwords generated by large language models like Claude, GPT, and Gemini are surprisingly predictable and weak. These passwords, despite appearing complex, exhibit biased character distributions and repeated patterns, resulting in significantly lower effective entropy than traditional password generators suggest. Attackers can exploit these patterns to crack passwords more easily, and instances of LLM-generated passwords have already been found in exposed codebases. Experts recommend against using LLMs for password generation and suggest developers utilize secure, established methods instead.

Sonderkommission ermittelt zu Cyberangriff auf Kunstsammlungen Dresden

www.csoonline.com · 8 months ago

Authorities in Saxony, Germany, have launched a special investigative commission to examine a cyberattack that targeted the State Art Collections of Dresden in January. The attack disrupted the organization’s digital infrastructure, online shop, and visitor services. Officials assure the public that the security of visitors and the art collections remains a top priority, with close collaboration with a security firm. The State Art Collections comprise 15 museums, including renowned institutions like the Old Masters Picture Gallery and the Green Vault.

FBI Reports 1,900 ATM Jackpotting Incidents Since 2020, $20M Lost in 2025

thehackernews.com · 8 months ago

The Federal Bureau of Investigation reports a significant increase in ATM jackpotting incidents, with over 1,900 reported since 2020 and losses exceeding $20 million in 2025. Cybercriminals exploit vulnerabilities in ATMs using malware like Ploutus, often gaining access with generic keys and bypassing bank authorization. Attackers deploy malware by either removing or replacing the ATM’s hard drive, allowing for cash-outs that are difficult to detect. The FBI recommends enhanced physical security, regular audits, and strict access controls to mitigate these risks.

Google Rushes Out Critical Chrome Update to Address Serious PDFium and V8 Vulnerabilities

gbhackers.com · 8 months ago

Google has released a critical security update for Chrome, addressing three vulnerabilities that could allow attackers to execute malicious code. The issues affect the PDFium PDF engine, the V8 JavaScript processor, and media playback functionality. Three CVEs are being addressed: CVE-2026-2648, a heap buffer overflow in PDFium; CVE-2026-2649, an integer overflow in V8; and CVE-2026-2650, a heap buffer overflow in Media. Google is withholding specific details about the vulnerabilities to prevent exploitation while users update.

PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence

www.securityweek.com · 8 months ago

Researchers have discovered a new Android malware called PromptSpy, which is notable for using Google’s Gemini AI to maintain persistence on infected devices. The malware utilizes generative AI to determine where to tap or swipe on the screen, adding itself to the recent apps list, ensuring it survives reboots. PromptSpy also leverages Accessibility Services to hinder uninstallation by overlaying invisible elements on the screen, making removal difficult and requiring a Safe Mode reboot. Security experts believe the malware may be a proof of concept, and evidence suggests it was developed by Chinese developers.

PayPal launches latest struggle to get rid of SMS for MFA

www.csoonline.com · 8 months ago

PayPal is phasing out SMS-based multifactor authentication, citing security concerns and potential cost savings. While the company initially announced the change via email, the timeline for complete removal remains unclear and will likely occur in batches over time. Security experts have long criticized SMS authentication due to its vulnerability to attacks like SIM swapping and man-in-the-middle attacks. PayPal is encouraging customers to switch to more secure methods like authenticator apps or FIDO2 security keys.

Hackers Exploit Critical BeyondTrust Vulnerability to Deploy VShell and SparkRAT

gbhackers.com · 8 months ago

Hackers are actively exploiting a critical vulnerability, CVE-2026-1731, in BeyondTrust’s remote support software to deploy the VShell backdoor and SparkRAT remote access trojan. The vulnerability, rated CVSS 9.9, allows attackers to execute commands as the “site user” and compromise systems across multiple industries and countries. Attackers are using a multi-stage playbook involving web shells, data theft, and persistent backdoors, and CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog. Organizations are urged to patch BeyondTrust appliances immediately and implement layered security controls to detect and prevent exploitation.

Ongoing Campaign Targets Microsoft 365 to Steal OAuth Tokens for Persistent Access

gbhackers.com · 8 months ago

A new phishing campaign has been detected targeting Microsoft 365 users in North America, specifically those in technology, manufacturing, and financial services. Attackers exploit Microsoft’s OAuth 2.0 Device Authorization Grant flow to bypass traditional authentication methods, including multi-factor authentication. The attack involves malicious applications and phishing emails that trick users into providing device codes, allowing attackers to obtain OAuth access and refresh tokens for persistent access to corporate data and systems. Organizations are advised to audit OAuth applications, monitor email activity, and implement Conditional Access policies to mitigate this threat.

Former Google Engineers Indicted Over Trade Secret Transfers to Iran

thehackernews.com · 8 months ago

Two former Google engineers and another individual have been indicted in the U.S. for allegedly stealing trade secrets from Google and other tech companies and transferring them to Iran. The defendants, all Iranian nationals, worked in the mobile computer processor field and are accused of illegally accessing and exfiltrating confidential information related to processor security and cryptography. They attempted to conceal their actions by submitting false affidavits, destroying files, and taking photographs of sensitive data. If convicted, each defendant faces potential prison sentences and fines.

PromptSpy: First Android AI Malware Leverages Google’s Gemini for Decision-Making

gbhackers.com · 8 months ago

PromptSpy is new Android malware using Google's Gemini AI for UI manipulation & persistence. It's a remote access tool (VNC) allowing attackers to steal data & control devices, targeting users in Argentina. Google Play Protect now detects it. Multiple file hashes are listed.

10 Passwordless-Optionen für Unternehmen

www.csoonline.com · 8 months ago

false

New phishing campaign tricks employees into bypassing Microsoft 365 MFA

www.csoonline.com · 8 months ago

A new phishing campaign is targeting businesses and professionals, primarily in North America, to bypass Microsoft 365 multifactor authentication. Attackers trick employees into registering a malicious device to their account, obtaining OAuth tokens that grant persistent access to their Microsoft account and associated applications like Outlook, Teams, and OneDrive. While not directly stealing credentials, this tactic allows attackers to exploit OAuth access and refresh tokens. Security experts recommend restricting authorized applications and educating users to be wary of unusual login requests, and disabling device code flow within Microsoft Entra conditional access policies.

CVE-2026-0229 PAN-OS: Denial of Service in Advanced DNS Security Feature (Severity: MEDIUM)

security.paloaltonetworks.com · 8 months ago

A denial-of-service vulnerability, identified as CVE-2026-0229, exists in the Advanced DNS Security feature of Palo Alto Networks PAN-OS software. An unauthenticated attacker can trigger system reboots by sending a maliciously crafted packet, potentially leading to maintenance mode. Versions of PAN-OS 12.1, 11.2, and 11.1 are affected, requiring upgrades to fixed versions to resolve the issue. Cloud NGFW, Prisma Access, and PAN-OS versions 10.2 are not impacted and do not require action.

Leading Japanese semiconductor supplier responding to ransomware attack

therecord.media · 8 months ago

Advantest, a major Japanese supplier of semiconductor test equipment, is responding to a ransomware attack that has impacted its systems. The company detected unusual activity Sunday and isolated affected areas, suspecting unauthorized access and ransomware deployment. This follows a rising trend of ransomware attacks targeting manufacturing companies, with a nearly 50% increase in gangs hitting industrial organizations last year. Recent attacks have also targeted other semiconductor manufacturers, including Microchip Technology and Applied Materials.

Emerging Chiplet Designs Spark Fresh Cybersecurity Challenges

www.darkreading.com · 8 months ago

Emerging chiplet designs, which combine smaller silicon components, offer flexibility for technologies like AI and autonomous vehicles, but introduce new cybersecurity risks. The distributed manufacturing process involving multiple vendors increases the potential for hardware Trojans, supply chain attacks, and backdoored components. Experts emphasize the need for stronger security measures, traceability, and authentication across chiplet systems to prevent attacks like man-in-the-middle intrusions and ensure system integrity. Companies are beginning to implement stricter supply chain audits and in-house design control to mitigate these risks, particularly in the automotive sector.

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

unit42.paloaltonetworks.com · 8 months ago

A critical vulnerability, CVE-2026-1731, has been identified in BeyondTrust Remote Support software, enabling remote code execution and posing a significant risk to organizations. Attackers are actively exploiting this flaw to deploy web shells, install backdoors, and move laterally within compromised systems, targeting sectors like finance and healthcare. Exploitation techniques include using tools like SparkRAT and VShell, combined with methods to evade detection, and involve techniques such as DNS tunneling. CISA has deemed the vulnerability critical and urged immediate patching, with detection and protection available through certain cybersecurity products.

PromptSpy is the first known Android malware to use generative AI at runtime

www.bleepingcomputer.com · 8 months ago

Researchers have discovered a new Android malware family called PromptSpy, which is the first known instance of malware using generative AI in its execution. The malware utilizes Google’s Gemini model to dynamically adapt its persistence mechanisms across different Android devices, overcoming manufacturer-specific locking features. PromptSpy functions as spyware, providing threat actors with remote access and control over infected devices, including capabilities such as screen recording and data interception. The malware employs deceptive overlays to hinder uninstallation and requires a reboot into Safe Mode for removal.

PromptSpy is the first Android malware to use generative AI at runtime

www.bleepingcomputer.com · 8 months ago

Researchers have identified a new Android malware family called PromptSpy, marking the first known instance of malware using generative AI in its execution. The malware leverages Google’s Gemini model to adapt its persistence mechanisms across different Android devices by automatically determining how to "pin" apps to prevent termination. PromptSpy functions as spyware, providing threat actors with remote access and the ability to intercept credentials, record screen activity, and thwart uninstallation attempts by overlaying invisible buttons. While its current distribution appears limited, the malware demonstrates a concerning trend of threat actors integrating generative AI into malicious operations.

Supply Chain Attack Secretly Installs OpenClaw for Cline Users

www.darkreading.com · 8 months ago

A supply chain attack compromised the Cline AI coding tool, resulting in the unauthorized installation of OpenClaw on user systems. Attackers exploited a prompt injection vulnerability, gaining access to release tokens and using them to publish a tainted version of the Cline npm package. While OpenClaw itself is not considered malicious, it grants broad permissions and could provide a foothold for future attacks. Cline has released version 2.4.0 and revoked the compromised token, implementing OIDC provenance via GitHub Actions.

Best-in-Class 'Starkiller' Phishing Kit Bypasses MFA

www.darkreading.com · 8 months ago

A new phishing-as-a-service tool called Starkiller is bypassing traditional security measures by proxying real websites and stealing user credentials, including those obtained through multi-factor authentication. The tool’s sleek design and user-friendly interface, resembling legitimate software-as-a-service platforms, lowers the technical skill needed to conduct sophisticated phishing campaigns. Starkiller utilizes techniques like URL shorteners and the "@" symbol to mask malicious links, making them appear legitimate. Experts recommend organizations shift to behavioral and identity-aware detection methods to identify compromised sessions, rather than solely relying on MFA completion.

US dominance of agentic AI at the heart of new NIST initiative

www.csoonline.com · 8 months ago

The National Institute of Standards and Technology announced the AI Agent Standards Initiative to address risks and promote the adoption of agentic AI. The initiative, managed by the Center for AI Standards and Innovation, aims to foster US leadership in AI standards and interoperability. Concerns have arisen from incidents like the 2025 ‘EchoLeak’ vulnerability in Microsoft 365 Copilot and the OpenClaw agent, which could allow unauthorized access to data. Some experts worry that NIST’s process is too slow to keep pace with rapid advancements in agentic AI.

FBI: More than 700 ATM jackpotting incidents with losses over $20 million occurred in 2025

therecord.media · 8 months ago

The Federal Bureau of Investigation reports a significant increase in ATM jackpotting incidents, with over 700 occurring in 2025 alone, resulting in losses exceeding $20 million. Criminals are exploiting vulnerabilities in ATMs using malware like Ploutus to bypass bank authorization and dispense cash. These attacks often involve accessing the ATM's internal components to install or replace hard drives with malicious software, allowing direct control of the machine. A recent Justice Department indictment highlighted a criminal ring that stole at least $5.4 million using Ploutus malware targeting ATMs across multiple credit unions.

Abu Dhabi Finance Week Exposed VIP Passport Details

www.darkreading.com · 8 months ago

Sensitive personal data, including passport details and identification documents, of approximately 700 attendees was exposed due to a misconfigured cloud storage system associated with Abu Dhabi Finance Week. High-profile individuals affected include former British Prime Minister David Cameron, former White House communications director Anthony Scaramucci, and Binance co-CEO Richard Teng. The data was publicly accessible for at least two months before a security researcher discovered it and alerted the Financial Times, prompting the organizers to secure the server. This incident poses a significant reputational risk to Abu Dhabi as it seeks to establish itself as a global financial center.

Researchers warn Volt Typhoon still embedded in US utilities and some breaches may never be found

therecord.media · 8 months ago

Researchers warn that the Volt Typhoon hacking group continues to compromise U.S. critical infrastructure, particularly utilities, and some breaches may never be detected. The group aims to pre-position hackers for potential disruptive cyberattacks and focuses on strategically important targets. A separate group, SYLVANITE, is believed to initially compromise systems before handing access over to Volt Typhoon, targeting industries like oil, gas, water, and power. Recent attacks exploited vulnerabilities in Ivanti and Trimble Cityworks GIS software, allowing Volt Typhoon to gather data and directly interact with operational technology devices.

West Virginia sues Apple for alleged child sexual abuse material failures

therecord.media · 8 months ago

West Virginia has filed a lawsuit against Apple, alleging the company’s iCloud service is being used to distribute and store child sexual abuse material. The lawsuit claims Apple was aware of the issue and initially planned to implement child sexual abuse material detection tools but abandoned the effort due to privacy concerns. State officials assert Apple’s design of iCloud facilitates the sharing and storage of illicit content, and they are seeking damages and a court order to compel the implementation of detection tools. Apple reported 267 CSAM reports in 2023, significantly fewer than Meta and Google.

AI Agents Are Quietly Redefining Enterprise Security Risk

www.techrepublic.com · 8 months ago

A new social network called Moltbook has rapidly gained popularity with over 1.4 million AI agents, revealing a growing security risk within enterprises. These agents, increasingly common due to tools like LangChain and Auto-GPT, are accessing sensitive data and connected to real enterprise infrastructure, sharing API keys and commands. Security researchers warn of a "lethal trifecta" involving data access, untrusted input, and external communication, which can be exploited through techniques like prompt injection. Organizations must shift from identity-based security to data-centric zero trust models to control agent behavior and ensure compliance.

UK to require tech firms to remove nonconsensual intimate images within 48 hours or face fines

therecord.media · 8 months ago

A new U.K. law will require technology companies to remove nonconsensual intimate images within 48 hours of being reported, or face fines and potential service blocking. Victims will only need to report the images once, and removal will be enforced across all platforms. The law is a response to the proliferation of such images online, including incidents involving xAI’s Grok chatbot. The government plans to prioritize this offense under the Online Safety Act, treating it with the same severity as child abuse or terrorism content.

PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence

thehackernews.com · 8 months ago

Cybersecurity researchers have identified a new Android malware called PromptSpy that utilizes Google’s Gemini AI to maintain persistence by automating its presence in the recent apps list. The malware, linked to a Chinese-speaking development environment and targeting users in Argentina, employs Gemini to analyze screen layouts and receive instructions on how to interact with the device. PromptSpy aims to deploy a VNC module, granting attackers remote access, and also blocks uninstallation through accessibility services and invisible overlays, communicating with a command-and-control server at 54.67.2[.]84. The malware is considered an advanced version of VNCSpy and is distributed through a website masquerading as JPMorgan Chase.

INTERPOL Operation Red Card 2.0 Arrests 651 in African Cybercrime Crackdown

thehackernews.com · 8 months ago

Law enforcement agencies from 16 African countries collaborated on Operation Red Card 2.0, a cybercrime operation that resulted in 651 arrests and the recovery of more than 4.3 million dollars. The initiative targeted online scams, including high-yield investment schemes, mobile money fraud, and fraudulent mobile loan applications, which are linked to over 45 million dollars in financial losses. Authorities confiscated nearly 2,400 devices, shut down over 1,400 malicious IPs, domains, and servers, and dismantled several fraud rings utilizing phishing, social engineering, and compromised login credentials. The operation aimed to disrupt criminal syndicates that harm individuals, businesses, and communities through false promises.

West Virginia Sues Apple, Claiming It Allows Sharing of Child Sexual Abuse Material

www.nytimes.com · 8 months ago

West Virginia's attorney general has filed a lawsuit against Apple alleging the company knowingly allowed child sexual abuse material to be stored and shared on its iCloud service. The state claims Apple declined to utilize tools that could recognize this material, violating consumer protection laws. Apple states it prioritizes user safety and privacy, offering parental controls and innovative security measures. Previously, Apple has faced similar lawsuits from victims seeking damages related to the presence of this material on iCloud.

Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center

thehackernews.com · 8 months ago

Microsoft has resolved a security vulnerability in Windows Admin Center that could allow attackers to escalate their privileges. The flaw, identified as CVE-2026-26119, has a CVSS score of 8.8. This improper authentication allows an attacker to gain the rights of the user running the application. The vulnerability was discovered by Semperis researcher Andrea Pierini and patched in December 2025.

Flaw in Grandstream VoIP phones allows stealthy eavesdropping

www.bleepingcomputer.com · 8 months ago

A critical vulnerability, tracked as CVE-2026-2329, has been identified in Grandstream GXP1600 series VoIP phones, allowing unauthenticated attackers to gain root privileges and eavesdrop on communications. The flaw lies in the device’s web-based API, permitting a stack overflow that can be exploited for remote code execution. Researchers demonstrated the vulnerability with a Metasploit module, enabling attackers to steal credentials and redirect calls. Grandstream released firmware version 1.0.7.81 to address the issue, and users are urged to update promptly.

Google blocked over 1.75 million Play Store app submissions in 2025

www.bleepingcomputer.com · 8 months ago

Google blocked over 1.75 million apps from publication on Google Play due to policy violations in 2025. The company also banned more than 80,000 developer accounts and prevented over 255,000 apps from accessing sensitive user data. Play Protect scans over 350 billion apps daily and blocked 266 million installation attempts from risky apps. New protections were added to Android 16 to prevent tapjacking attacks.

New e-book: Establishing a proactive defense with Microsoft Security Exposure Management

www.microsoft.com · 8 months ago

false

Running OpenClaw safely: identity, isolation, and runtime risk

www.microsoft.com · 8 months ago

Self-hosted AI agent platforms, such as those utilizing OpenClaw, present substantial security risks due to the combination of untrusted code and valid credentials. Microsoft recommends caution and advises against deployment for many organizations. If deployed, strict isolation, limited access, continuous monitoring, and preparation for compromise are essential. Organizations should inventory deployments, verify permissions, and identify input vulnerabilities using tools like Microsoft Defender.

Figure Data Breach Exposes Nearly 1 Million Customers Online

www.techrepublic.com · 8 months ago

A data breach at fintech lender Figure exposed nearly a million customer records, including names, dates of birth, phone numbers, and addresses. The breach occurred in January 2026 after a social engineering attack compromised internal systems. The stolen data, approximately 2.5 gigabytes in size, was published online by the group ShinyHunters, who are known for exploiting misconfigured cloud environments and using data as leverage. Microsoft has also identified a high-severity Windows Admin Center vulnerability allowing for elevated access.

[CVE-2026-0714] TPM-sniffing LUKS Keys on an Embedded Device

www.cyloq.se · 8 months ago

A vulnerability, identified as CVE-2026-0714, has been found in the Moxa UC-1222A industrial computer. Attackers with physical access can now retrieve the LUKS disk encryption key by monitoring the SPI bus during a TPM2NVRead operation. This allows unauthorized decryption of the device's storage, despite the use of a TPM 2.0 chip. Researchers have developed a tool to automate the key extraction process, underscoring the need for improved protection of TPM bus traffic.

CISA orders feds to patch actively exploited Dell flaw within 3 days

www.bleepingcomputer.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has ordered federal agencies to patch a critical Dell vulnerability within three days. Security researchers have observed a suspected Chinese hacking group, UNC6201, actively exploiting the flaw, CVE-2026-22769, in Dell’s RecoverPoint software. This vulnerability allows the group to deploy malware, including a new backdoor called Grimbolt, and has overlaps with the Silk Typhoon group, previously linked to breaches of U.S. government agencies. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and issued a directive to prioritize patching.

Connected and Compromised: When IoT Devices Turn Into Threats

www.darkreading.com · 8 months ago

The proliferation of Internet of Things devices poses significant security risks for both homes and businesses. Security expert Mattia Epifani's research reveals many devices, including Amazon Echo, Apple TV, and smart refrigerators, store sensitive data insecurely, often lacking passcodes or encryption. Reused passwords and compromised devices can allow attackers to access other systems and sensitive information, potentially leading to impersonation attacks and network breaches. Experts recommend using separate accounts and dedicated networks for IoT devices to limit potential damage.

How infostealers turn stolen credentials into real identities

www.bleepingcomputer.com · 8 months ago

Researchers analyzed over 90,000 infostealer dumps, revealing how stolen credentials are increasingly linked to real identities and organizations. Attackers aggregate data including credentials, browsing history, and system files to build detailed profiles, facilitating targeted attacks and escalating risks beyond personal devices to enterprise environments. Common behaviors like password reuse and reliance on browser-stored credentials contribute to infostealer effectiveness, allowing attackers to operationalize stolen data. Organizations can mitigate this risk by preventing the reuse of known-compromised credentials and implementing stronger, continuously enforced password policies.

French Government Says 1.2 Million Bank Accounts Exposed in Breach

www.securityweek.com · 8 months ago

France’s Ministry of Economy has confirmed a data breach impacting 1.2 million bank accounts. Unauthorized access to the FICOBA national bank account registry occurred in late January, allowing an attacker to steal credentials from an official. Compromised data includes IBANs, account holder names, addresses, and tax identifiers, though banking operations were not affected. Authorities warn of potential scams and phishing attempts resulting from the exposure.

Ransomware gang threatens Cheyenne and Arapaho Tribes after shutting down schools

therecord.media · 8 months ago

The Cheyenne and Arapaho Tribes are facing extortion from the Rhysida ransomware gang following a cyberattack that began December 8, 2025. The gang is demanding 10 bitcoin, approximately 660,000 dollars, to prevent the release of stolen data and has targeted similar organizations including Target and Carnival Cruises. Tribal officials confirm they will not negotiate or pay the ransom and are working with federal authorities on recovery efforts. This incident is part of a broader trend of ransomware attacks targeting tribal governments across the United States.

Attackers breach France’s national bank account database

therecord.media · 8 months ago

French authorities confirmed a malicious actor illegally accessed a portion of the National Bank Accounts File, or FICOBA, a database containing information on over 80 million individuals. The breach, which began in late January, involved impersonating a civil servant to query the database and potentially exposed data for approximately 1.2 million accounts. The database, used by tax, customs, and law enforcement agencies, includes sensitive personal data like account numbers and tax identification numbers. Cybersecurity teams are investigating and alerting affected individuals and banks to potential fraud.

ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ Stories

thehackernews.com · 8 months ago

U.S. federal agencies must patch a critical GitLab vulnerability, CVE-2021-22175, due to ongoing exploitation. Attackers are employing techniques such as Telegram bots and phishing kits to steal credentials and commit financial fraud. Cybercriminals are increasingly abusing Remote Monitoring and Management tools for malicious purposes. Furthermore, a critical remote code execution vulnerability has been addressed in OpenSSL.

Nigerian man gets eight years in prison for hacking tax firms

www.bleepingcomputer.com · 8 months ago

A Nigerian national has been sentenced to eight years in prison for hacking tax preparation firms and filing fraudulent tax returns. The scheme, which occurred between 2016 and 2021, involved stealing client information to file over 1,000 fraudulent returns and attempt to obtain over $8.1 million in refunds, successfully collecting over $1.3 million. Akande used the Warzone remote-access trojan malware and phishing emails to compromise the firms' computer networks. He was apprehended in London and extradited to the United States to face charges.

Nearly 1 Million User Records Compromised in Figure Data Breach

www.securityweek.com · 8 months ago

A data breach at Figure Technology Solutions has compromised nearly one million user records. Cybercriminals, identified as the ShinyHunters group, gained access through a social engineering attack targeting an employee. The stolen data includes personal information such as names, dates of birth, email addresses, and phone numbers. ShinyHunters claims the breach is linked to a wider campaign targeting organizations with single sign-on accounts, including Betterment, Crunchbase, and Panera Bread.

China’s Parallel CVE Systems Expose Alternate Vulnerability Disclosure Timeline

gbhackers.com · 8 months ago

China maintains two national vulnerability databases, CNNVD and CNVD, which operate alongside Western systems like CVE and NVD. CNNVD closely mirrors CVE data, while CNVD has distinct characteristics and timelines. Regulations implemented in 2021 mandate vulnerability reporting, patching, and restrict public disclosure, influencing the timing and content of vulnerability information. Analysts should consider these parallel systems to gain a more comprehensive view of vulnerability exposures, recognizing that Western databases still offer more structured and transparent data.

Texas sues TP-Link over Chinese hacking risks, user deception

www.bleepingcomputer.com · 8 months ago

The state of Texas has filed a lawsuit against TP-Link, alleging deceptive marketing practices and security risks related to the company's routers. The lawsuit claims TP-Link misled consumers about the origin of its products, sourcing most components from China, which could compromise user data due to Chinese law. The company's routers have reportedly been exploited by Chinese state-backed hackers, utilized in botnets like Quad7 (CovertNetwork-1658, or xlogin), and contain actively exploited vulnerabilities, as documented by CISA. TP-Link denies the allegations and states user data is stored on domestic Amazon Web Services servers.

Hackers target Microsoft Entra accounts in device code vishing attacks

www.bleepingcomputer.com · 8 months ago

Hackers are employing a new tactic to compromise Microsoft Entra accounts, combining voice phishing and device code phishing to abuse the OAuth 2.0 Device Authorization flow. Attackers leverage legitimate Microsoft login forms and standard device code authentication workflows, avoiding traditional phishing methods that require password theft or MFA interception. This allows them to obtain authentication tokens and access connected single sign-on applications, like Microsoft 365, Salesforce, and Google Workspace, potentially leading to data theft and extortion. The extortion gang ShinyHunters has been linked to these attacks, which have also been observed combined with traditional phishing emails and websites. Microsoft recommends blocking malicious domains, auditing OAuth app consents, and disabling the device code flow when not needed.