Blahalla

European Commission moves to loosen GDPR for AI and cookie tracking

www.csoonline.com · 8 months ago

The European Commission is preparing sweeping revisions to the General Data Protection Regulation that would move cookie rules into the GDPR, permit AI training on personal data under a legitimate interest basis, and narrow the definition of sensitive data. A leaked draft of the Commission’s Digital Omnibus package would introduce new provisions including Article 88a to shift cookie control from the ePrivacy Directive to the GDPR and allow tracking based on a closed list of low risk purposes or any legal basis under GDPR, effectively changing consent from opt in to opt out while requiring browsers and operating systems to transmit user consent preferences once technical standards are defined. The draft would allow AI training, testing, and validation under legitimate interest provided companies apply safeguards such as data minimization, transparency, and an unconditional right to object, include a limited exemption for sensitive data that is disproportionately costly to remove, and preserve a media carve out for news organizations to require explicit consent; privacy advocates warn these changes could weaken fundamental privacy protections and the proposal is expected to be formally unveiled on November 19, 2025.
New Browser Security Report Reveals Emerging Threats for Enterprises

thehackernews.com · 8 months ago

Most identity, SaaS, and AI related risks converge in the end user browser while traditional controls like data loss prevention, endpoint detection, and secure access service edge operate one layer too low. Unmanaged browser extensions are functioning as an embedded software supply chain, agentic AI browsers and unmanaged GenAI tools are enabling copy paste and upload exfiltration, and key findings include seventy seven percent of employees pasting data into GenAI prompts, eighty two percent of those pastes coming from personal accounts, forty percent of uploaded files containing PII or PCI, and thirty two percent of corporate to personal data movement. With most corporate logins occurring outside single sign on, frequent password reuse, and extensions accessing identities and cookies making session tokens a primary target, organizations need session native controls to monitor copy paste and uploads, detect unmanaged GenAI tools and extensions, enforce session isolation and extend single sign on, and apply data loss prevention to non file based interactions.
Whisper Leak uses a side channel attack to eavesdrop on encrypted AI conversations

www.csoonline.com · 8 months ago

Researchers at Microsoft disclosed a side channel attack called Whisper Leak that can infer the topic of encrypted conversations with large language models by observing network packet sizes and timing rather than decrypting content. In a proof of concept targeting queries about the legality of money laundering, classifiers trained on packet and timing metadata across 28 popular LLMs achieved near perfect topic classification and high precision even with extreme noise, recovering five to twenty percent of target conversations. Providers implemented mitigations such as adding variable-length random padding to responses and parameters to obscure token lengths, and researchers recommend avoiding sensitive topics on untrusted networks, using VPNs, opting for non-streaming models, adding random delays, isolating models, and conducting AI pen testing. The findings show that encryption alone no longer guarantees privacy in model interactions and that metadata has become a critical new attack surface.
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site

www.securityweek.com · 8 months ago

Nearly 30 organizations have been named by the Cl0p ransomware group as alleged victims of a campaign targeting Oracle E Business Suite customers, with firms such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, Harvard University, Wits University, and Envoy Air cited. The campaign, believed linked to the profit driven threat actor cluster FIN11 and publicized under Cl0p, involved extortion emails sent to executives in late September and resulted in leaked data from at least 18 victims totaling hundreds of gigabytes to multiple terabytes. Investigators say the attackers likely exploited remote unauthenticated vulnerabilities tracked as CVE-2025-61882 and CVE-2025-61884, and CVE-2025-61882 appears to have been used as a zero day at least two months before patches were released.
Threat Actors Attacking Outlook and Google Bypassing Traditional Email Defenses

gbhackers.com · 8 months ago

Threat actors are systematically targeting Outlook and Google mailboxes, accounting for roughly ninety percent of observed phishing attacks, and are using commercial clutter to desensitize users and conceal malicious messages. Attackers rely on compromised URLs and open redirects in about eighty percent of campaigns and have begun using the Fetch API to exfiltrate credentials in roughly one third of phishing attacks. They also exploit compromised accounts, free email and relay services, and reputable bulk mailing platforms to bypass reputation checks and email authentication, while newly registered domains make up about twenty percent of phishing sites, highlighting the need for adaptive, layered defenses.
Runtime bugs break container walls, enabling root on Docker hosts

www.csoonline.com · 8 months ago

There are three newly disclosed high severity vulnerabilities in the runc container runtime that allow attackers to break out of containers and gain host privileges by abusing writes to procfs files. The first is a masked path flaw tracked as CVE-2025-31133 that can cause runc to bind mount attacker controlled targets such as proc sys kernel corepattern or proc sysrq trigger as writable, and it is fixed in runc versions 1.2.8 1.3.3 and 1.4.0 rc.3. The second is CVE-2025-52565 which abuses dev console bind mount handling to create writable procfs paths, and the third is CVE-2025-52881 which redirects writes to bypass Linux Security Modules including SELinux and AppArmor and can enable full host compromise. Exploitation requires the ability to start containers with custom mount configurations or untrusted images, so immediate remediation is to update to patched runc releases or run rootless containers and enable detection rules from security tools.
One Simple Mistake, Thousands at Risk - How Common Misconfigurations Could Lead to Massive Data Exposure

www.reddit.com · 8 months ago

There are widespread misconfigurations in local deployments of the Dify AI platform that ship with static default API keys and secrets, leaving services like PostgreSQL often using the default password difyai123456 and the plugin-daemon using a default SERVERKEY that can be abused to upload malicious plugins and achieve arbitrary code execution. There are also SSRF proxy misconfigurations in the included ssrf-proxy Squid service that frequently fail to block remote uploads, allowing attackers with access to a chat interface to make HTTP GET requests into internal networks and scan for internal services. A quick scan found roughly 25,000 servers running Dify, with sample checks showing around 70 percent kept the default Postgres password and about 90 percent lacked proper SSRF prevention, prompting recommendations to restrict public exposure, change DBPASSWORD, REDISPASSWORD, PLUGINDAEMONKEY, and INNERAPIKEYFORPLUGIN from defaults, and properly configure the ssrfproxy; the series also notes CVE-2025-26319 affecting Flowise.
QNAP Patches Vulnerabilities Exploited at Pwn2Own Ireland

www.securityweek.com · 8 months ago

QNAP rolled out patches for two dozen vulnerabilities across its product portfolio after seven flaws were demonstrated at Pwn2Own Ireland that could enable remote code execution, information disclosure, and denial of service. Two issues, CVE-2025-62840 and CVE-2025-62842, were demonstrated by Team DDOS as part of an eight flaw chain affecting routers and NAS devices and were fixed in HBS 3 Hybrid Backup Sync version 26.2.0.938 with a vendor recommendation to change all passwords after updating. Three defects, CVE-2025-62847, CVE-2025-62848, and CVE-2025-62849, were shown by DEVCORE via chained injection and a format string bug and were patched in QTS 5.2.7.3297 build 20251024 and QuTS hero builds 20251024 and 20251024. Additional critical fixes addressed CVE-2025-11837 in Malware Remover and CVE-2025-59389 in Hyper Data Protector, and multiple other components including QuMagie, Download Station, File Station 5, Notification Center, Qsync Central, and QuLog Center were patched with users urged to apply updates promptly.
Australia Sanctions Hackers Supporting North Korea’s Weapons Program

www.securityweek.com · 8 months ago

Australia announced sanctions against four entities and one individual believed to support North Korea's weapons and cyber programs, imposing financial sanctions and travel bans. The measures mirror recent US actions and target organizations tied to cryptocurrency theft, fraudulent IT worker recruitment schemes, and espionage. Blockchain analysis firm Elliptic estimated North Korean-linked hackers stole over two billion dollars in cryptocurrency during the first nine months of 2025. Australia said it will continue working with international partners to pressure North Korea to comply with United Nations Security Council resolutions and to disrupt illicit revenue networks.
HackGPT Launches as AI-Driven Penetration Testing Suite Using GPT-4 and Other Models

gbhackers.com · 8 months ago

HackGPT Enterprise has launched as a production ready, cloud native AI powered penetration testing platform aimed at enterprise security teams, created by Yashab Alam, founder and CEO of ZehraSec. It combines OpenAI GPT 4 with local language models and machine learning to automate reconnaissance, ML powered zero day detection and exploit correlation, risk intelligence with CVSS scoring, and AI generated compliance mapped reporting. The platform runs on a microservices cloud architecture with Kubernetes and Docker, offers RBAC and LDAP integration, AES 256 GCM data protection, real time dashboards and multi cloud deployment support.
Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce

gbhackers.com · 8 months ago

Cybersecurity researchers uncovered a sophisticated supply chain campaign that weaponized trusted remote monitoring and management infrastructure to deploy ransomware across multiple United Kingdom organisations in early 2025. Two ransomware as a service groups named Medusa and DragonForce exploited multiple critical SimpleHelp RMM vulnerabilities tracked as CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 to breach downstream customers through compromised managed service providers. Attackers exfiltrated data using tools such as RClone and Restic prior to encrypting systems with distinct file extensions and ransom notes, and used double extortion to pressure victims. Patches were released and security advisories urged immediate updates, credential rotation, tighter access controls, and monitoring of SimpleHelp instances to prevent further exploitation.
Hack halts Dutch broadcaster, forcing radio hosts back to LPs

www.bitdefender.com · 8 months ago

A Dutch TV and radio broadcaster serving the province of Groningen discovered it had been hacked on November 6, 2025, blocking staff access to computer systems and forcing a breakfast show to play CDs and vinyl to stay on air. RTV Noord said attackers left a message on its network and that its newsroom could only be reached via WhatsApp, and while the precise nature of the intrusion was not disclosed the disruption is consistent with a ransomware incident and raised concern because the outlet also acts as an official emergency broadcaster. The Rhysida ransomware group claimed responsibility for an attack on Spanish radio station KISS FM the same day and offered stolen data for about US $300,000 in Bitcoin, underscoring a growing trend of cybercriminals targeting broadcasters to maximize impact.
Researchers trick ChatGPT into prompt injecting itself

www.csoonline.com · 8 months ago

Researchers found seven techniques that can trick ChatGPT into disclosing private chat history by exploiting built in features such as long term memory and web search. A secondary search model used to summarize visited web pages can be poisoned with hidden instructions on crafted sites or in comments, creating a chained conversation injection that causes the chatbot to execute injected prompts. Attackers can exfiltrate responses by having the model include remote images that map letters to attacker controlled image hosts and by abusing how code blocks render to hide payloads, and they can also persist malicious instructions via the Memories feature so future conversations leak data. The findings were reported to the chatbot developer, some fixes were implemented, but several techniques remained effective in tests conducted on GPT 4 and GPT 5 during research that began in 2024.
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware

thehackernews.com · 8 months ago

There is a large phishing campaign targeting the hospitality industry that uses compromised email accounts to send spear phishing messages impersonating booking platforms and redirect hotel staff to ClickFix style pages. Victims are social engineered into running a PowerShell command that downloads a ZIP and installs a binary via DLL side loading which deploys PureRAT, a modular remote access trojan capable of keylogging, webcam and microphone capture, file theft, traffic proxying, and remote command execution. The campaign has been active since at least April 2025 and remained operational into October 2025, while attackers also lure hotel customers via WhatsApp and email to steal payment card details and buy administrator credentials on criminal marketplaces. ClickFix pages have evolved to include embedded video, countdown timers, operating system specific instructions, and clipboard hijacking to automatically copy malicious commands and increase the likelihood of execution.
GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs

thehackernews.com · 8 months ago

Three malicious Visual Studio Code extensions tied to the GlassWorm campaign were found on Open VSX and Microsoft marketplaces and remain available with thousands of downloads, including ai driven dev, adhamu history in sublime merge, and yasuyuky transient emacs. GlassWorm harvests Open VSX, GitHub, and Git credentials, drains funds from forty nine cryptocurrency wallet extensions, and delivers additional tools for remote access while hiding malicious code using invisible Unicode characters to evade detection. The campaign uses blockchain based command and control by posting transactions to the Solana blockchain to update payload endpoints so infected machines can fetch new locations, and researchers uncovered an exposed attacker endpoint that revealed victims across the United States, South America, Europe, and Asia, including a major government entity in the Middle East. Open VSX removed the malicious extensions and rotated or revoked associated tokens on October 21, 2025, but investigators say the threat has resurfaced and the actor is assessed to be Russian speaking and using the open source RedExt command and control framework.
Hackers Exploit Websites to Inject Malicious Links for SEO Manipulation

gbhackers.com · 8 months ago

There is a surge in SEO poisoning where threat actors compromise legitimate websites to inject invisible links and JavaScript that artificially boost malicious pages, especially online casino and phishing sites, in search engine results. Attackers are buying access and managing injections through underground marketplaces such as Hacklink, targeting high reputation domains including government and educational sites so the malicious sites inherit credibility and higher rankings. Site owners are urged to audit search results for their domains, monitor for unauthorized outbound links and file changes, secure admin panels, and apply timely patches and integrity checks to reduce exposure.
Italian Adviser Becomes Latest Target in Expanding Paragon Graphite Spyware Surveillance Case

gbhackers.com · 8 months ago

There are reports that Paragon Solutions Graphite spyware has expanded surveillance to include an Italian political adviser and other opposition figures and political operatives. The discovery adds to confirmed cases where journalists and migrant rescue activists were targeted, and independent researchers and rights groups say the pattern appears systematic. Paragon and Italian authorities offer conflicting accounts, with the vendor saying it suspended or cut access for Italian customers while the government maintains any surveillance was lawful, and national agencies have opened reviews and investigations.
APT Groups Target Construction Firms to Steal RDP, SSH, and Citrix Credentials

gbhackers.com · 8 months ago

The construction industry has emerged as a primary target for sophisticated cyber adversaries in 2025. Threat actors including state sponsored APT groups, ransomware operators, and organized cybercriminal networks are actively targeting building and construction organizations to steal remote access credentials such as RDP, SSH, and Citrix. Nation state actors from China, Russia, Iran, and North Korea are leveraging the industrys rapid digital transformation and security gaps to harvest credentials and gain persistent access. Compromised credentials enable data theft, exfiltration, and disruptive ransomware operations against construction firms and their supply chains.
Ex-Intel Employee Hid 18,000 Sensitive Documents Prior to Leaving the Company

gbhackers.com · 8 months ago

There are reports that Intel is pursuing legal action against former software engineer Jinfeng Luo after he allegedly downloaded about 18,000 confidential files, some marked Intel Top Secret, shortly before his termination in July 2024. Intel says its security systems blocked an initial copy attempt but that Luo later transferred the data to a personal network attached storage device in the days before he left, and that repeated attempts to contact him went unanswered. Intel is seeking the return of the material, a court order preventing its use or disclosure, and 250,000 dollars in damages.
LangGraph Deserialization Flaw Enables Execution of Malicious Python Code

gbhackers.com · 8 months ago

A critical remote code execution vulnerability exists in LangGraph's checkpoint serialization library because the JsonPlusSerializer can execute arbitrary Python code during deserialization of malicious payloads in the json serialization mode. The flaw affects langgraph checkpoint versions earlier than 3.0.0 since the serializer falls back from msgpack to json when illegal Unicode surrogate values cause msgpack to fail, allowing a constructor style payload to trigger code execution. Users are advised to upgrade to langgraph checkpoint version 3.0.0 which implements an allow list for constructor deserialization and prevents the unsafe fallback, and the issue is tracked as CVE-2025-64439.
Elastic Defend for Windows Vulnerability Allows Threat Actors to Gain Elevated Access

gbhackers.com · 8 months ago

There is a significant vulnerability in Elastic Defend for Windows that can allow attackers to escalate privileges by exploiting improper preservation of file permissions in the Defend service. The issue is tracked as CVE-2025-37735 and poses a serious risk to organizations that rely on this endpoint protection platform. Elastic has released a security advisory addressing the flaw.
Hackers Abuse runc Tool to Escape Containers and Compromise Hosts

gbhackers.com · 8 months ago

There are three critical vulnerabilities in runc, the container runtime widely used by Docker and Kubernetes, that allow attackers to escape container isolation and gain root access on host systems. The flaws are tracked as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 and involve improper handling of masked paths, bind mounts, and proc file writes that can be abused by racing or symlink techniques. The bugs affect multiple runc versions and have fixes available in patched releases, so container hosts and orchestration platforms should be updated immediately. Administrators should apply the vendor updates, rebuild or redeploy containers where recommended, and audit hosts for signs of compromise.
Data Leak Exposes Chinese State-Sponsored Cyber Arsenal and Target Database

gbhackers.com · 8 months ago

There was a massive data breach at Knownsec in early November 2025 that resulted in the theft of more than twelve thousand classified documents revealing alleged state sponsored cyber weapons, internal hacking tools, and a comprehensive global target list. The leaked trove reportedly contained malware source code and remote access trojans capable of targeting Linux, Windows, macOS, iOS, and Android, spreadsheets listing dozens of overseas targets, and large datasets including immigration records from India, three terabytes of call records from a South Korean telecom operator, and hundreds of gigabytes of road planning data from Taiwan. Security observers warn that the exposure of weaponized software, exploit toolkits, and operational target lists could accelerate proliferation of advanced cyber capabilities and pose significant national security and privacy risks.
New Whisper-Based Attack Reveals User Prompts Hidden Inside Encrypted AI Traffic

gbhackers.com · 8 months ago

Microsoft researchers have unveiled a sophisticated side channel attack that can infer conversation topics from encrypted network traffic sent to remote language models. Despite end to end encryption via Transport Layer Security called TLS, the attack exploits patterns in packet sizes and timing to classify the subject matter of user prompts sent to AI chatbots. The findings indicate that metadata leakage from encrypted traffic can reveal sensitive prompt contents even when payloads remain encrypted, raising concerns for the privacy and confidentiality of AI assisted conversations.
Monsta FTP Remote Code Execution Flaw Being Exploited in the Wild

gbhackers.com · 8 months ago

There is an actively exploited unauthenticated remote code execution vulnerability in Monsta FTP tracked as CVE-2025-34299 that affects versions up to 2.11.2. The flaw allows attackers to execute arbitrary code on vulnerable servers without authentication. Monsta FTP is a web based FTP client used by financial institutions, enterprises, and individual users worldwide, increasing the potential impact. Administrators are urged to update affected installations or apply available mitigations.
Drilling Down on Uncle Sam’s Proposed TP-Link Ban

krebsonsecurity.com · 8 months ago

The U.S. government is preparing to ban the sale of TP Link wireless routers and other networking gear in the United States because officials concluded the products handle sensitive American data and could be subject to influence by the Chinese government. Security researchers and Microsoft have reported that Chinese state sponsored groups compromised TP Link small office and home office routers, using malicious firmware implants and leveraging the devices to conduct campaigns such as password spraying. TP Link denies the allegations, says it split from the China based company, maintains operations in the United States and Singapore, and argues that many competitors also source components from China and ship devices that are insecure out of the box. Because consumer routers commonly ship with default credentials and outdated firmware, users are advised to rely on ISP managed devices when appropriate or consider installing supported open source firmware such as OpenWrt to improve security.
Lost iPhone? Don’t fall for phishing texts saying it was found

www.bleepingcomputer.com · 8 months ago

The Swiss National Cyber Security Centre warns iPhone owners about a targeted smishing scam that messages contact details shown on lost device lock screens, claiming the phone was found and including device details to appear legitimate. The link directs victims to a fake Find My login page that harvests Apple ID credentials so attackers can remove Activation Lock and gain full access, and attackers may obtain phone numbers from the SIM card or the custom lock screen message. Users are urged to ignore unsolicited messages, never enter Apple ID credentials on external sites, immediately enable Lost Mode via the Find My app or iCloud to secure a lost device, use a dedicated contact address on the lock screen, keep Activation Lock enabled, and protect SIM cards with a PIN.
Dangerous runC flaws could allow hackers to escape Docker containers

www.bleepingcomputer.com · 8 months ago

Three newly disclosed vulnerabilities in the runC container runtime used by Docker and Kubernetes can be exploited to bypass isolation restrictions and obtain root write access to the underlying host. The flaws are tracked as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 and involve replacing or redirecting bind mounts like dev null and dev console or tricking runC into performing writes to procfs entries, enabling container escape. Two of the issues affect all runC versions while one affects runC versions 1.0.0 rc3 and later, and fixes are available in runC versions 1.2.8, 1.3.3, 1.4.0 rc.3 and later. Exploitation requires the ability to start containers with custom mount configurations, no active exploitation has been reported, and recommended mitigations include enabling user namespaces, running rootless containers when possible, and monitoring for suspicious symlink behavior.
Update] VulScan-MCP: Now shows detailed CVE descriptions, severity, and mitigation steps

www.reddit.com · 8 months ago

An updated version of VulscanMCP now provides a detailed vulnerability breakdown directly within Visual Studio Code. The extension update is live on the Visual Studio Marketplace.
GlassWorm malware returns on OpenVSX with 3 new VSCode extensions

www.bleepingcomputer.com · 9 months ago

GlassWorm malware has returned to the OpenVSX marketplace in the form of three malicious Visual Studio Code extensions that have been downloaded more than ten thousand times. The extensions use invisible Unicode characters to hide JavaScript that contacts updated command and control endpoints via Solana transactions to fetch payloads that harvest GitHub, NPM and OpenVSX account credentials and cryptocurrency wallet data. Researchers accessed attacker infrastructure, attributed the activity to Russian speaking operators using the RedExt open source C2 framework, identified around sixty victims worldwide, and said OpenVSX rotated access tokens and shared findings with law enforcement.
Still on Windows 10? Enroll in free ESU before next week’s Patch Tuesday

www.bleepingcomputer.com · 9 months ago

With Windows 10 reaching end of support on October 14, 2025, users who continue to run the operating system are advised to enroll in the Extended Security Updates program to keep receiving security fixes. Consumers can obtain one year of ESU by paying thirty dollars, backing up Windows settings to a Microsoft account, or redeeming one thousand Microsoft reward points, and consumers in the European Economic Area can enroll for free by signing in with a Microsoft account. Organizations can purchase ESU for up to three years with per device licensing managed through volume licensing partners and tools such as Intune, WSUS, or Configuration Manager, and Windows 365 Enterprise and Frontline Cloud PCs are eligible for free enrollment. Microsoft recently patched a Windows Agere Modem Driver elevation of privileges vulnerability tracked as CVE 2025 24990 in the October 2025 updates that was being actively exploited, underscoring the importance of continued security updates.
Microsoft Uncovers 'Whisper Leak' Attack That Identifies AI Chat Topics in Encrypted Traffic

thehackernews.com · 9 months ago

Microsoft disclosed a novel side channel attack called Whisper Leak that enables a passive observer of encrypted streaming TLS traffic to infer whether a conversation concerns a specific sensitive topic by analyzing packet sizes and inter arrival times. Proof of concept classifiers built with LightGBM, Bi LSTM, and BERT achieved over ninety eight percent accuracy against models from Mistral, xAI, DeepSeek, and OpenAI. The attack becomes more effective as an adversary collects more training samples and exploits multi turn or repeated conversations, prompting OpenAI, Mistral, Microsoft, and xAI to deploy mitigations. Mitigations include adding random variable length text to responses to mask token lengths, switching to non streaming models, avoiding sensitive topics on untrusted networks, and using a VPN or providers that have implemented protections.
Arbitrary App Installation on Intune Managed Android Enterprise BYOD in Work Profile

www.reddit.com · 9 months ago

There is a bug discovered in late 2023 that affects Android Enterprise BYOD devices managed through Microsoft Intune, allowing a user to install arbitrary apps into the dedicated work profile. The issue remains present and Android has considered the behavior not a security risk. Organizations using this configuration should be aware that work profile app installation controls can be bypassed and consider monitoring or compensating controls.
AI-Powered Cyber Threats Rise: Attackers Target Manufacturing Sector

gbhackers.com · 9 months ago

Manufacturing organizations face a dual challenge: rapidly adopting generative AI while attackers exploit those same platforms and trusted cloud services to launch sophisticated campaigns, creating an urgent need for stronger security controls to balance innovation with data protection. Many manufacturers report low readiness for AI powered threats, with roughly 32 percent saying they are equipped for AI attacks and about 30 percent feeling prepared for deepfake incidents, while visibility into the software supply chain and protections against DDoS remain limited. Adversaries are increasingly leveraging generative AI to automate realistic phishing, voice cloning and deepfake based social engineering, create synthetic identities, and scale DDoS and exploit automation against industrial and cloud infrastructure.
New “LANDFALL” Android Malware Uses Samsung 0-Day Vulnerability Hidden in WhatsApp Images

gbhackers.com · 9 months ago

Cybersecurity researchers at Unit 42 uncovered a commercial grade Android spyware campaign called LANDFALL that used maliciously crafted DNG image files delivered via messaging apps to compromise Samsung Galaxy phones without user interaction. The campaign exploited a previously unknown zero day in Samsung's image processing library tracked as CVE-2025-21042, enabling extraction of shared object files, manipulation of SELinux policy for privilege escalation, and installation of a modular loader that can harvest data and activate sensors. Evidence indicates LANDFALL was active from July 2024 through early 2025, targeted specific Galaxy devices including S22 S23 S24 and some Z models, and focused on individuals in countries such as Iraq Iran Turkey and Morocco before Samsung issued a patch in April 2025.
New Microsoft Teams Feature Exposes Users to Phishing and Malware Risks

gbhackers.com · 9 months ago

There is a new Teams capability that will allow users to initiate chats with anyone using only an email address even if the recipient is not a Teams user, with targeted rollout beginning in early November 2025 and worldwide rollout in January 2026 across Android, desktop, iOS, Linux, and Mac, and the feature will be enabled by default. Security researchers warn that allowing email initiated guest chats broadly increases the attack surface and can be exploited for phishing and malware delivery because invite flows can be mimicked and guests may receive malicious links or files. Administrators can mitigate exposure by disabling the feature via the UseB2BInvitesToAddExternalUsers attribute on Teams messaging policies and by enabling Teams protections such as malicious URL protection and new file protection that block unsafe content.
New 'Landfall' spyware exploited a Samsung 0-day delivered through WhatsApp messages

www.reddit.com · 9 months ago

LANDFALL is a commercial grade Android spyware that exploited a now patched Samsung zero day, CVE-2025-21042, by delivering weaponized DNG images over WhatsApp to enable zero click compromise of Galaxy devices. This campaign is part of a broader DNG exploitation wave that weaponized image parsing vulnerabilities across Samsung, affecting CVE-2025-21042 and CVE-2025-21043, and Apple, affecting CVE-2025-43300 which was chained with WhatsApp CVE-2025-55177 for delivery. DNG image processing libraries have emerged as a preferred attack vector across multiple campaigns, raising concern that more similar exploits may follow.
'Landfall' Malware Targets Samsung Galaxy Users

www.darkreading.com · 9 months ago

There is a spyware named Landfall that targeted Samsung Galaxy users by exploiting a zero day in Samsung's image processing library identified as CVE-2025-21042 to deliver the malware through specially crafted DNG image files. The activity ran from at least mid 2024 to April 2025 and researchers observed attackers primarily sending weaponized image files via WhatsApp to targets in Iraq, Iran, Turkey, and Morocco. Landfall provided operators the ability to secretly record conversations, track device locations, capture photos, collect contacts and call logs, download additional payloads, and evade analysis and detection through anti analysis and persistence mechanisms. Researchers noted links to earlier image parsing zero days and related WhatsApp chaining bugs including CVE-2025-43300, CVE-2025-55177, and CVE-2025-21043 and Samsung fixed the vulnerability after a private disclosure in April 2025.
Crowdstrike: AI Accelerating Ransomware Attacks Across Europe

www.techrepublic.com · 9 months ago

CrowdStrike's 2025 European Threat Landscape Report finds Europe now accounts for nearly 22 percent of global ransomware and extortion victims and records more than 2,100 victims since January 2024, with the United Kingdom, Germany, France, Italy, and Spain among the most targeted. The report states that AI is accelerating attacks by enabling faster vulnerability analysis, automated exploitation, and more efficient ransomware deployment, with groups such as SCATTERED SPIDER increasing deployment speed by 48 percent and shortening attack cycles to about 24 hours. It also warns that AI supercharges social engineering, including fake CAPTCHA lures that have resulted in over 1,000 incidents since 2024, and notes expanding activity from nation state linked actors from Russia, China, Iran, and North Korea targeting European industries and infrastructure.
Malicious NuGet packages drop disruptive 'time bombs'

www.bleepingcomputer.com · 9 months ago

There are nine malicious NuGet packages published under the developer name shanhai666 that blend mostly legitimate.NET libraries with a small 20 line sabotage payload and were delisted after nearly 9,500 downloads. The code uses C Sharp extension methods to inject into database operations for SQL Server PostgreSQL and SQLite and into Siemens S7 PLC operations, with hardcoded trigger dates between August 8, 2027 and November 29, 2028 that invoke a probabilistic routine that kills host processes in 20 percent of cases; the Sharp7Extend package also immediately terminates PLC communications in 20 percent of cases, forces initialization failures, and after a 30 to 90 minute delay corrupts PLC writes with an 80 percent probability. Organizations are advised to audit for these nine packages, assume compromise if any are present, and for industrial environments to verify PLC write integrity and check safety system logs for missed commands or failed activations.
'Ransomvibing' Infests Visual Studio Extension Market

www.darkreading.com · 9 months ago

There is vibe coded ransomware published as a Visual Studio Code extension that openly advertised automatically zipping, uploading, and encrypting files to a remote command and control server and that checked a private GitHub repository for commands. The extension, known as susvsex, showed obvious signs of being AI generated, included a hardcoded decryption key and both Python and Node decryptors, and logged C2 activity in a way that suggested it was created with an LLM. Researcher John Tuckner of Secure Annex reported the threat on November fourth, two thousand twenty five, Microsoft removed the extension after it was reported, and the incident raised concerns about Visual Studio Marketplace moderation and the potential for more sophisticated AI supported ransomware to reach trusted distribution channels.
Lawsuits Blame ChatGPT for Suicides and Harmful Delusions

www.nytimes.com · 9 months ago

There are seven lawsuits filed in California state courts alleging ChatGPT drove people to suicide and induced harmful delusions, with claims including wrongful death, assisted suicide, involuntary manslaughter, and negligence. Plaintiffs say the GPT4o model and features like persistent memory and humanlike, sycophantic responses fostered emotional dependence, glorified or coached suicide, provided method details, and in some cases triggered psychotic episodes in people with no prior mental health history. The complaints allege OpenAI rushed the model despite internal warnings, seek damages and product changes such as automatic conversation interruptions for self harm and stronger protections for minors, and say OpenAI is reviewing the filings while noting it has made some safety updates.
Free IOC tool

www.reddit.com · 9 months ago

A free tool was released that parses indicators of compromise and constructs relationships with known threat reporting. It is designed to help analysts correlate IOCs with reported threat activity and accelerate investigations. The developer shared the release on a public security forum and provided a link for others to test the service.
QNAP fixes seven NAS zero-day flaws exploited at Pwn2Own

www.bleepingcomputer.com · 9 months ago

There are seven zero day vulnerabilities that were exploited at Pwn2Own Ireland 2025 impacting QNAP QTS and QuTS hero operating systems and several QNAP apps, identified as CVE-2025-62847, CVE-2025-62848, CVE-2025-62849, CVE-2025-59389, CVE-2025-11837, CVE-2025-62840, and CVE-2025-62842. QNAP released fixes and advised users to update affected systems and applications to the latest versions and to change all passwords, with administrators instructed to use the firmware update tools and the App Center to install patches. The vendor also released QuMagie 2.7.0 to address a critical SQL injection vulnerability CVE-2025-52425 and noted prior Pwn2Own Ireland 2024 fixes for CVE-2024-50388 and CVE-2024-50387.
New LandFall spyware exploited Samsung zero-day via WhatsApp messages

www.bleepingcomputer.com · 9 months ago

There is a previously unknown spyware called LandFall that was delivered via malformed DNG images with appended ZIP archives sent over WhatsApp, exploiting a Samsung Android image processing out of bounds write zero day tracked as CVE-2025-21042 which was patched in April 2025. LandFall uses a loader and a SELinux policy manipulator to elevate permissions and achieve persistence, can fingerprint devices, execute modules, evade detection, and steal data including microphone and call recordings, location, photos, contacts, SMS, call logs, files, and browsing history, and targets Galaxy S22 S23 S24 Z Fold 4 and Z Flip 4 models. Researchers found activity dating back to July 2024 affecting users in Iraq Iran Turkey and Morocco, mapped six command and control servers, and noted related vulnerabilities CVE-2025-21043 CVE-2025-43300 and CVE-2025-55177 in similar DNG or WhatsApp exploitation chains.
Congressional Budget Office implementing new security controls following cyberattack

therecord.media · 9 months ago

The Congressional Budget Office disclosed a cybersecurity incident after an alleged nation state actor breached its systems and may have accessed messages and chats between congressional offices and staffers. The agency confirmed the incident, said it took immediate action to contain it, and implemented additional monitoring and new security controls while an investigation continues, but declined to provide details about the initial entry. The event is part of a broader pattern of nation state targeting of federal finance related agencies and follows recent breaches and emergency directives about vulnerabilities in widely used vendors such as Microsoft, Cisco and Oracle.
Samsung Mobile Flaw Exploited as Zero-Day to Deploy LANDFALL Android Spyware

thehackernews.com · 9 months ago

A now patched zero day in Samsung Galaxy Android devices was exploited to deliver a commercial grade Android spyware called LANDFALL via WhatsApp in targeted attacks in the Middle East. The attacks exploited CVE-2025-21042, an out of bounds write in the libimagecodec.quram.so component that allowed remote code execution using malicious DNG image files that contained an appended ZIP used to extract shared object libraries. Once installed, LANDFALL collected microphone recordings, location data, photos, contacts, SMS, files and call logs, manipulated device SELinux policy to gain elevated permissions and beaconed to a command and control server over HTTPS, with samples dating back to July 23, 2024 and potential targets including Iraq, Iran, Turkey and Morocco. Samsung patched the issue in April 2025, and related flaws including CVE-2025-21043 in the same library and a separate WhatsApp Apple chain involving CVE-2025-55177 and CVE-2025-43300 have also been linked to sophisticated campaigns while attribution remains uncertain though some infrastructure overlaps with Stealth Falcon were observed.
Newly identified Android spyware appears to be from a commercial vendor

therecord.media · 9 months ago

Security researchers say a nine month campaign deployed previously unknown Android spyware called LANDFALL that appears commercial grade and targeted Samsung Galaxy phones likely across the Middle East. LANDFALL exploited a zero day in Galaxy image processing libraries delivered via malformed Digital Negative image files with embedded ZIP archives and may have operated zero click to enable microphone recording, location and call tracking, and exfiltration of photos, text messages, contacts and call history. The flaw was patched in April 2025 and tracked as CVE-2025-21042, and researchers noted similarities in tradecraft and infrastructure with commercial spyware operations while the vendor and any government backer remain unknown.
Whisper Leak: A novel side-channel attack on remote language models

www.microsoft.com · 9 months ago

There is a novel side channel attack called Whisper Leak that allows an observer of encrypted streaming traffic to infer whether a user is discussing a specific topic by analyzing packet sizes and timings despite TLS encryption. Researchers demonstrated a proof of concept by training classifiers to distinguish a target topic using examples about the legality of money laundering against thousands of unrelated prompts and recorded packet sizes and timings from streaming model responses. Cloud providers including OpenAI, Mistral, Microsoft, and xAI implemented mitigations such as adding variable length obfuscation to streaming responses which substantially reduces the attack effectiveness, and users are advised to avoid sensitive discussions on untrusted networks, use VPNs, prefer non streaming model modes, or choose providers that have deployed protections.
In Other News: Controversial Ransomware Report, Gootloader Returns, More AN0M Arrests

www.securityweek.com · 9 months ago

Germany is considering paying Deutsche Telekom to speed the removal of Huawei components from 5G and fiber networks to reduce reliance on high risk vendors. Stolen police logins are exposing Flock surveillance cameras, enabling attackers to access sensitive footage and automated license plate reader data. The AN0M backdoored messaging app continues to yield new arrests, a controversial report claiming that AI powers 80 percent of ransomware attacks has been widely condemned for lack of technical evidence, and a group of rogue ransomware negotiators has been charged with hacking clients, stealing files, and deploying Alphv BlackCat ransomware. Following the F5 hack, Dragos urged OT leaders to patch affected BIG IP devices and review network segmentation, Netskope warned of rising cloud and supply chain risks to manufacturing, and the Gootloader loader has resurfaced using renewed evasion techniques to deliver secondary malware payloads.