Blahalla

Whisper Leak: A novel side-channel attack on remote language models

www.microsoft.com · 9 months ago

There is a novel side channel attack called Whisper Leak that allows an observer of encrypted streaming traffic to infer whether a user is discussing a specific topic by analyzing packet sizes and timings despite TLS encryption. Researchers demonstrated a proof of concept by training classifiers to distinguish a target topic using examples about the legality of money laundering against thousands of unrelated prompts and recorded packet sizes and timings from streaming model responses. Cloud providers including OpenAI, Mistral, Microsoft, and xAI implemented mitigations such as adding variable length obfuscation to streaming responses which substantially reduces the attack effectiveness, and users are advised to avoid sensitive discussions on untrusted networks, use VPNs, prefer non streaming model modes, or choose providers that have deployed protections.
In Other News: Controversial Ransomware Report, Gootloader Returns, More AN0M Arrests

www.securityweek.com · 9 months ago

Germany is considering paying Deutsche Telekom to speed the removal of Huawei components from 5G and fiber networks to reduce reliance on high risk vendors. Stolen police logins are exposing Flock surveillance cameras, enabling attackers to access sensitive footage and automated license plate reader data. The AN0M backdoored messaging app continues to yield new arrests, a controversial report claiming that AI powers 80 percent of ransomware attacks has been widely condemned for lack of technical evidence, and a group of rogue ransomware negotiators has been charged with hacking clients, stealing files, and deploying Alphv BlackCat ransomware. Following the F5 hack, Dragos urged OT leaders to patch affected BIG IP devices and review network segmentation, Netskope warned of rising cloud and supply chain risks to manufacturing, and the Gootloader loader has resurfaced using renewed evasion techniques to deliver secondary malware payloads.
From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools

thehackernews.com · 9 months ago

A China linked threat actor targeted a U.S. non profit in April 2025 to establish long term persistence, conducting mass scans and exploiting legacy vulnerabilities including CVE-2022-26134, CVE-2021-44228, CVE-2017-9805, and CVE-2017-17562. The attackers set scheduled tasks that executed msbuild.exe to run payloads, used DLL side loading via legitimate antivirus components to load Deed RAT, ran a custom loader to unpack an in memory RAT, and employed credential harvesting tools such as Mimikatz. Researchers also linked exploitation of a WinRAR flaw tracked as CVE-2025-8088 to a DLL sideloading chain, and observed Chinese aligned groups abusing misconfigured IIS servers and publicly exposed ASP NET machine keys to deploy TOLLBOOTH SEO cloaking modules, web shells, and additional backdoors.
Cisco: Actively exploited firewall flaws now abused for DoS attacks

www.bleepingcomputer.com · 9 months ago

Two vulnerabilities are being exploited to force Cisco ASA and FTD firewalls into reboot loops and have been used in zero-day attacks; CVE-2025-20362 enables access to restricted URL endpoints without authentication and CVE-2025-20333 allows authenticated attackers to gain remote code execution on vulnerable devices. When chained they can allow remote unauthenticated attackers full control, prompting CISA to issue an emergency directive requiring federal agencies to secure affected Cisco firewall devices within 24 hours and to disconnect end of support ASA devices from networks. Security monitors report over 34,000 internet exposed ASA and FTD instances remain vulnerable and related Cisco vulnerabilities mentioned include CVE-2025-20363, CVE-2025-20352, CVE-2025-20358, CVE-2025-20354 and the earlier CVE-2024-20353 and CVE-2024-20359 tied to the ArcaneDoor campaign.
Landfall Android Spyware Targeted Samsung Phones via Zero-Day

www.securityweek.com · 9 months ago

Landfall is an Android spyware family that exploited CVE-2025-21042 in a Samsung image processing library and was delivered via malformed DNG image files sent over WhatsApp, likely as a zero click exploit against Samsung Galaxy models including S22, S23, S24, Z Fold4 and Z Flip4. The malware provides comprehensive surveillance capabilities including microphone recording, location tracking, and exfiltration of photos, contacts, and call logs. CVE-2025-21042 was patched by Samsung in April 2025 but was exploited in the wild since at least July 2024, and related zero days noted by researchers include CVE-2025-21043 as well as the iOS and WhatsApp chain involving CVE-2025-43300 and CVE-2025-55177.
ID verification laws are fueling the next wave of breaches

www.bleepingcomputer.com · 9 months ago

ID verification laws now require many organizations to collect and store government issued identification documents, forcing firms to retain highly sensitive personal data they might not otherwise hold. A recent breach of a third party handling Discord support data exposed government ID images along with names, email addresses, IP addresses and limited billing details, highlighting the real world consequences. Managed service providers face amplified risk because they host data for many clients and often rely on multiple point solutions, creating integration and monitoring gaps that expand the attack surface. Consolidating backup, cybersecurity and endpoint management into a natively integrated platform can reduce complexity close those gaps and shrink the attack surface by eliminating handoff points between tools.
AI Agents Are Going Rogue: Here's How to Rein Them In

www.darkreading.com · 9 months ago

Human-centered identity frameworks are being incorrectly applied to AI agents, a misfit that can give agents excessive permissions and enable catastrophic failures at machine speed. Experts urge treating agents as first-class identities tied to responsible humans, enforcing least agency and least privilege, and deploying composite identity mapping plus continuous monitoring and auditable guardrails to prevent rapid, large-scale misuse.
Ollama, Nvidia Flaws Put AI Infrastructure at Risk

www.darkreading.com · 9 months ago

Security researchers at Fuzzinglabs discovered multiple vulnerabilities in AI inference systems, finding four flaws in Ollama and a command injection bug in NVIDIA Triton Inference Server that could enable unauthenticated remote code execution. The Ollama issues include denial of service CVE-2024-12886 rated CVSS 7.5, authentication bypass CVE-2025-51471, arbitrary file copy CVE-2025-48889, and an additional heap overflow that has not yet been assigned a CVE. The Triton vulnerability was easy to exploit and could allow attackers to execute arbitrary commands or reliably achieve remote code execution without prior authentication. Both Ollama and NVIDIA issued fixes and the Fuzzinglabs team plans to present full research at Black Hat Europe on December 10, 2025.
Data Exposure Vulnerability Found in Deep Learning Tool Keras

www.securityweek.com · 9 months ago

A vulnerability in the Keras deep learning library allows model deserialization to load arbitrary local files or fetch external URLs, enabling arbitrary file reads and server side request forgery. The flaw, tracked as CVE-2025-12058 with a CVSS score of 5.9, stems from StringLookup and IndexLookup preprocessing layers accepting file paths or URLs as vocabulary inputs that are accessed during model load even when safe deserialization is enabled, which can expose SSH private keys or cloud instance metadata and lead to full compromise. Keras resolved the issue in version 3.11.4 by embedding vocabulary files into the archive and disallowing the loading of arbitrary vocabulary files when safemode is enabled.
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) - watchTowr Labs

www.reddit.com · 9 months ago

There is a pre-authenticated remote code execution vulnerability in Monsta FTP that allows an attacker to force the application to connect to a hostile SFTP server, download a payload, and write it to an arbitrary path on the host, enabling execution of that payload. The flaw was reproducible in versions 2.10.3, 2.10.4 and 2.11, was disclosed in August 2025, fixed in Monsta FTP version 2.11.3 on 26 August 2025, and assigned CVE-2025-34299 on 4 November 2025; earlier related CVEs include CVE-2022-31827, CVE-2022-27469 and CVE-2022-27468. A practical exploit involves sending a crafted POST request to the application API with parameters that instruct it to download a remote file and place it within the web root, resulting in a remotely accessible web shell.
German ISP aurologic GmbH Identified as Key Hub for Malicious Hosting Infrastructure

gbhackers.com · 9 months ago

Aurologic GmbH, operating ASN AS30823 from Langen, Germany, has emerged as a central upstream provider and transit hub that connects multiple high risk hosting networks and sanctioned entities. Routing and intelligence analysis show aurologic provides transit to several suspected threat activity enablers that host malware, command and control servers, phishing infrastructure, and other illicit services. These upstream relationships have helped sanctioned and high abuse networks maintain global availability and resilience despite enforcement actions, with measurable portions of observed C2 infrastructure routed through AS30823. Threat feeds and abuse databases record hundreds of indicators of compromise and repeated abuse reports associated with aurologic’s prefixes, prompting calls for stronger vetting and regulatory scrutiny.
Threat Actors Use Stolen RDP Credentials to Deploy Cephalus Ransomware

gbhackers.com · 9 months ago

A new ransomware group named Cephalus emerged in mid June 2025 and is gaining access to corporate networks by exploiting compromised Remote Desktop Protocol accounts that lack multi factor authentication. Operators stage data to the MEGA cloud storage service and deploy a multi stage payload by placing a legitimate SentinelOne executable named SentinelBrowserNativeHost.exe to sideload a malicious SentinelAgentCore.dll that in turn loads a data.bin file containing the encryptor. Observed post compromise actions include deleting volume shadow copies, disabling or excluding Windows Defender, stopping security services via hidden PowerShell, and publishing stolen data to pressure victims, with two mid August intrusion attempts documented and one blocked by Microsoft Defender.
ClickFix Attacks Against macOS Users Evolving

www.securityweek.com · 9 months ago

ClickFix prompts that once used Windows specific instructions are now being tailored to macOS users, with attackers copying malicious commands to the clipboard and instructing victims to open Spotlight and Terminal to paste and run the command. Researchers observed campaigns that deployed a macOS information stealer named SHAMOS, and a more advanced ClickFix variant mimics Cloudflare verification, automatically copies the command to the clipboard, embeds an instructional video, and displays a countdown timer to pressure victims while reducing the number of steps. Because victims manually execute the commands, traditional security controls are more likely to be bypassed, and vendors such as Microsoft are adding detections for malicious ClickFix landing pages while emphasizing that user training and awareness remain critical.
ClickFix Attack Evolves: Weaponized Videos Trigger Self-Infection Tactics

gbhackers.com · 9 months ago

ClickFix attacks have evolved to use embedded instructional videos and fake verification prompts that pressure victims into copying and executing commands, enabling self infection rather than relying on traditional phishing clicks. Many campaigns detect the target operating system and serve OS specific instructions, copy malicious code to the clipboard, and use timers and branded personas to increase the sense of authenticity. Attackers are leveraging social platforms including TikTok to distribute videos that tell users to run PowerShell or other commands that fetch and run infostealers such as Vidar, StealC, and Aura Stealer. These tactics have surged in recent months, including a reported 517 percent increase in ClickFix incidents in the first half of 2025, and the technique is being commodified through off the shelf builders sold to less technical criminals.
Herodotus Android Banking Trojan Takes Over Devices, Outsmarts Security Tools

gbhackers.com · 9 months ago

Herodotus is a new Android banking Trojan offered as Malware as a Service that has been active in recent weeks. It leverages social engineering and technical deception to evade conventional antivirus solutions and can take over devices to harvest users' banking credentials and financial data. The campaign outsources operations to customers and poses a serious threat to users' financial information and device security.
Defending digital identity from computer-using agents (CUAs)

www.csoonline.com · 9 months ago

Organizations that rely on passwords and multi factor authentication based on shared secrets now face an accelerating threat from AI driven computer using agents that can automate and scale credential theft and phishing. These agents observe screen pixels, interpret user interface elements, and perform human like clicks and typing, allowing them to bypass many anti automation defenses, adapt to changing layouts, and execute thousands of parallel credential stuffing attempts. They also enable highly personalized social engineering by scraping user data from social platforms and building credible personas to deliver phishing lures through collaboration tools and social media. To defend against this risk organizations and SaaS providers are urged to adopt phishing resistant, device bound cryptographic authentication such as FIDO2 passkeys and certificate based credentials and to integrate these solutions across identity platforms and SaaS applications.
Faking Receipts with AI

www.schneier.com · 9 months ago

AI can now generate highly realistic fake receipts that mimic paper wrinkles, detailed itemization, and signatures, making visual inspection unreliable. Expense management platforms are detecting a growing number of AI created receipts and are deploying AI scanners that check image metadata and contextual cues such as repeated server names, times, and travel details. Because metadata can be removed by taking photos or screenshots, this has created an AI powered security arms race between fraudsters producing convincing forgeries and companies developing detection and verification methods.
U.S. Congressional Budget Office Hit by Cyberattack, Sensitive Data Compromised

gbhackers.com · 9 months ago

The Congressional Budget Office confirmed it identified and contained a cybersecurity incident, implemented additional monitoring and new security controls, and said work for Congress continues. Reporting indicates a suspected foreign actor may have been involved though the CBO has not confirmed that, and the breach may have exposed sensitive financial research and internal communications including emails and office chat logs, which could be used to craft highly targeted phishing attacks against congressional staff. The Senate Sergeant at Arms notified multiple congressional offices that communications between the CBO and Senate may have been exposed and advised staff to verify any email voice or text messages as the incident is investigated.
New Analysis Reveals LockBit 5.0’s Core Features and Dual-Stage Attack Model

gbhackers.com · 9 months ago

There is a modular two stage architecture that separates a stealthy loader from the main ransomware payload, enabling flexible deployment and layered anti analysis measures. There are cross platform builds for Windows, Linux, and VMware ESXi that can encrypt workstations, servers, and virtual machines, with the Windows variant using DLL reflection and ETW patching to evade detection. There are aggressive evasion and anti forensic techniques including heavy obfuscation, randomized 16 character file extensions, event log wiping, removal of traditional infection markers, faster optimized encryption, and an affiliate focused ransomware as a service interface that simplifies deployment for attackers.
Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation

thehackernews.com · 9 months ago

There are nine malicious NuGet packages published in 2023 and 2024 by a user named shanhai666 that install logic bombs set to detonate years after installation and were downloaded 9,488 times. The most dangerous package, Sharp7Extend, targets Siemens S7 programmable logic controllers and uses C sharp extension methods to inject malicious code that immediately activates and runs until June 6, 2028, causing random process terminations with a twenty percent probability and causing write operations to fail about thirty to ninety minutes after installation about eighty percent of the time. Other packages are configured to trigger on August 8, 2027 and November 29, 2028, the staggered activation window is intended to prolong victim collection and frustrate forensic attribution, and all malicious packages have been removed from NuGet.
Vibe-coded ransomware proof-of-concept ended up on Microsoft’s marketplace

www.csoonline.com · 9 months ago

Unknown actors published a Visual Studio Code extension that embeds ransomware-style behavior called Ransomvibe, which compresses, encrypts and uploads files to a remote command server and contains hardcoded encryption keys and command and control details. The extension auto-activated on installation, included AI-generated comments and misplaced source files and decryptors with a hardcoded key, and used a private GitHub repository as a command and control channel by polling an index dot html file and writing outputs into requirements dot txt with a bundled personal access token. Secure Annex researchers say the package exposed traces linking to a GitHub user in Baku and included a README explicitly describing malicious functionality, while Microsoft’s marketplace review failed to flag the extension and it remained available after being reported. Secure Annex released indicators of compromise and an extension manager to help block known malicious add ons, and Microsoft did not respond to requests for comment.
New Android Malware ‘Fantasy Hub’ Spies on Users’ Calls, Contacts, and Messages

gbhackers.com · 9 months ago

Russian-based threat actors are distributing an Android Remote Access Trojan called Fantasy Hub via Telegram-based Malware-as-a-Service channels that include subscription bots, seller documentation, builder tools, and instructional videos. Fantasy Hub enables full device compromise including theft of SMS messages, contacts, call logs, images and videos, live audio and video streaming using WebRTC, interception and deletion of notifications, and deployment of fake banking windows to harvest credentials from institutions such as Alfa, PSB, Tbank and Sber. The malware abuses Android features like the SMS handler role and activity aliases to intercept two factor authentication messages and masquerade as legitimate apps or Google Play updates to evade detection, lowering the barrier for low skilled attackers to carry out sophisticated financial and espionage campaigns.
Attackers Exploit Active Directory Sites to Escalate Privileges and Compromise Domain

gbhackers.com · 9 months ago

Security researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical but often overlooked component of enterprise network infrastructure. A technical analysis by Quentin Roland shows attackers can abuse ACL based attack paths within AD Sites to escalate privileges and potentially compromise entire domains. This discovery highlights a significant security gap that organizations should address by reviewing AD Sites permissions, auditing access control lists, and implementing tighter access controls.
LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

unit42.paloaltonetworks.com · 9 months ago

LANDFALL is a previously unknown commercial grade Android spyware family delivered via malformed DNG image files that exploited a zero day in Samsung s image processing library tracked as CVE-2025-21042 and used in targeted intrusions in the Middle East. The DNG files contained embedded ZIP archives that unpacked loader and SELinux policy manipulator components such as b.so and l.so to gain elevated privileges and enable comprehensive surveillance including microphone recording location tracking photos contacts and call logs. Samsung patched CVE-2025-21042 in April 2025 and later patched a related image parsing flaw CVE-2025-21043 while related exploit chains also involved CVE-2025-43300 and CVE-2025-55177 and the campaign shared infrastructure and tradecraft with commercial spyware operations and remained undetected for months.
The Congressional Budget Office Was Hacked. It Says It Has Implemented New Security Measures

www.securityweek.com · 9 months ago

The Congressional Budget Office confirmed it was hacked, potentially exposing important government data to malicious actors. The agency said it identified and contained the incident, launched an investigation, and has implemented additional monitoring and new security controls while continuing its work for Congress. Reports indicate the intrusion was attributed by unnamed sources to a suspected foreign actor, though the CBO has not confirmed that attribution.
The DragonForce Cartel: Scattered Spider at the gate

www.reddit.com · 9 months ago

There is a Conti-derived ransomware cartel called DragonForce that rebranded in early 2025 to operate as an affiliate friendly RaaS offering white labeled payloads and customizable encryptors, and it has posted more than 200 victims since late 2023 including incidents linked to Marks and Spencer. There are clear code overlaps with Conti v3 and LockBit Green, recent samples rebuilt with MinGW, and the encryptor generates a per file ChaCha20 key that is then encrypted with a public RSA key while operators patched their encryptor after Akira encryption weaknesses were publicized. There are operational links to Scattered Spider, which gains initial access through spear phishing, vishing, SIM swapping and MFA bypass, uses RMM tools such as ScreenConnect, AnyDesk, TeamViewer and Splashtop for persistence and lateral movement, and exfiltrates data to services such as MEGA and Amazon S3 before ransomware deployment. There are BYOVD attacks that abuse vulnerable kernel drivers truesight.sys and rentdrv2.sys to terminate security processes and evade EDRs, and affiliates have produced variants including Devman and Mamona Global under the DragonForce cartel model.
Chrome 142 Update Patches High-Severity Flaws

www.securityweek.com · 9 months ago

Google released an update to Chrome 142 that patches five vulnerabilities, including three high severity flaws. An out-of-bounds write in the WebGPU graphics API tracked as CVE-2025-12725 with a CVSS score of 8.8 could be exploited for remote code execution. Two other high severity issues are CVE-2025-12726 in the Views framework and CVE-2025-12727 in the V8 JavaScript engine, and there are two medium severity Omnibox implementation flaws tracked as CVE-2025-12728 and CVE-2025-12729. The update is rolling out as Chrome versions 142.0.7444.134 and 142.0.7444.135 for Linux, Mac, and Windows, and there are no reports of exploitation in the wild.
Enterprise Credentials at Risk – Same Old, Same Old?

thehackernews.com · 9 months ago

Enterprise credentials are widely at risk because employees must manage many unique logins and often reuse or slightly alter passwords, which attackers obtain through phishing, brute force, third-party breaches, or exposed API keys. Stolen credentials are aggregated and sold on underground marketplaces, then tested by automated botnets and human operators to find valuable access, while organized groups may maintain access to plan ransomware, data theft, or resource abuse. Compromises enable account takeover, lateral movement, data exfiltration, cloud resource abuse, ransomware deployment, regulatory fines, costly remediation, and long term reputational damage. Organizations are urged to proactively search leak repositories and underground channels for compromised credentials and prioritize remediation and monitoring using domain leak checking tools.
Over 15 Malicious npm Packages Exploiting Windows to Deploy Vidar Malware

gbhackers.com · 9 months ago

Datadog Security Research uncovered a supply chain campaign tracked as MUT-4831 that published 17 malicious npm packages across 23 releases designed to deliver the Vidar infostealer to Windows systems, with the first packages flagged on October 21, 2025. The packages masqueraded as legitimate SDKs, Telegram bot helpers, icon libraries, or forks, used postinstall scripts to download a ZIP from an external host and execute a Vidar binary, and were published by two accounts that were subsequently banned. This campaign marks the first public disclosure of Vidar being distributed via npm, the malicious packages were removed after remaining live for approximately two weeks, and they were downloaded at least 2,240 times prior to takedown.
Destructive Russian Cyberattacks on Ukraine Expand to Grain Sector

www.securityweek.com · 9 months ago

Multiple state sponsored Russian groups are conducting cyberattacks against Ukrainian entities and European countries linked to Ukraine, typically relying on spear phishing for initial access. Sandworm has deployed destructive wipers including Zerolot and Sting against a Ukrainian university and, in subsequent months, targeted governmental, energy, logistics, and grain sector organizations in apparent efforts to weaken Ukraine's war economy, with UAC 0099 observed conducting initial intrusions before handing off to Sandworm. Other activity noted includes Gamaredon refining its PteroPSDoor and PteroVDoor stealers and working with Turla, an actor impersonating ESET via spear phishing and Signal, and RomCom exploiting a WinRAR zero day to deploy backdoors against defense, financial, logistics, and manufacturing targets in Europe and Canada.
Researchers Bypass Elastic EDR Call-Stack Signatures Using Call Gadgets

gbhackers.com · 9 months ago

Researchers developed a technique that uses call gadgets to insert arbitrary modules into the call stack during module loading, successfully defeating Elastic EDR signatures that rely on call-stack patterns. Elastic’s policy of making detection logic and payload testing tools public enabled this work and a proof of concept and accompanying code were released for demonstration.
Google Launches New Maps Feature to Help Businesses Report Review-Based Extortion Attempts

thehackernews.com · 9 months ago

Google is rolling out a dedicated form on Google Maps that lets businesses report extortion attempts in which threat actors post inauthentic negative reviews and then demand payment to remove them. The measure targets review bombing, where attackers flood a business profile with fake one star reviews and then contact owners through third party messaging apps to coerce payment by threatening further damage to ratings. Google also warned of related scams including online job scams, AI product impersonation, malicious VPN apps, fraud recovery schemes, and seasonal holiday fraud, and advised vigilance with unexpected messages, downloading apps only from trusted sources, and skepticism toward offers to recover lost funds.
18 Arrested in Crackdown on Credit Card Fraud Rings

www.securityweek.com · 9 months ago

Law enforcement agencies in Canada, Cyprus, Germany, Italy, Luxembourg, the Netherlands, Singapore, Spain and the United States arrested 18 people as part of Operation Chargeback for roles in three major credit card fraud and money laundering networks. Investigators say that between 2016 and 2021 the suspects used 19 million fake online subscriptions to defraud more than 4.3 million cardholders in 193 countries of about 300 million euros and that attempted damages exceed 750 million euros, with charges deliberately kept around 50 euros per month and described obscurely to avoid detection. Authorities executed 60 house searches, seized documents, laptops, mobile phones, cryptocurrency assets and luxury vehicles, and allege that six employees at German payment service providers and numerous shell companies assisted the schemes to launder proceeds and hinder chargebacks.
OPNsense Firewall Update Addresses Multiple Security Issues and Enhances Features

gbhackers.com · 9 months ago

There is a new OPNsense 25.7.7 release that delivers third party security updates, firewall live log improvements based on user feedback, and a range of performance and usability fixes for enterprise firewall deployments. A key security change simplifies RRD backup code and removes unsafe exec usage in backend components to close a recurring attack surface reported by Alex Williams working with the Trend Zero Day Initiative, alongside multiple system, firewall, interface and plugin corrections. A follow up hotfix labeled 25.7.7 underscore 2 fixes a high availability synchronization regression and an interface overview details bug.
New Phishing Campaign Targets Travelers via Compromised Hotel Booking.com Accounts

gbhackers.com · 9 months ago

A phishing campaign has exploited compromised hotel booking accounts since at least April 2025 to impersonate Booking.com and redirect guests to fraudulent billing pages and malicious downloads. Attackers obtain stolen credentials from hotel administrators, sell access on cybercrime forums, and use those accounts to send convincing messages that prefill real booking details on fake payment pages. Hundreds of malicious domains, lookalike URLs and social engineering techniques including ClickFix and homoglyph tricks have been observed, producing real financial losses and installations of credential stealing malware.
Influence of Chinese Hacker Organizations on U.S. Foreign Policy

gbhackers.com · 9 months ago

Chinese cyber espionage groups are targeting U.S. organizations with ties to international policy making and seek to establish a stealthy, persistent presence within compromised networks. The intrusions involved an initial breach followed by techniques to maintain long term access and evade detection. The activity underscores a persistent and evolving threat from state linked cyber actors to institutions involved in foreign policy and decision making.
Attackers Deploy LeakyInjector and LeakyStealer to Hijack Crypto Wallets and Browser Info

gbhackers.com · 9 months ago

There is a two stage malware campaign using LeakyInjector and LeakyStealer to target cryptocurrency wallet users and steal browser information. LeakyInjector employs advanced injection and evasion techniques to run code inside legitimate processes while LeakyStealer collects browser credentials, cookies, extensions data and wallet files for exfiltration. Together they present a significant risk to digital asset security and user privacy by enabling stealthy theft of session tokens and wallet keys.
Why can’t enterprises get a handle on the cloud misconfiguration problem?

www.csoonline.com · 9 months ago

Cloud misconfigurations remain widespread and continue to enable breaches, with a Qualys analysis finding that 28 percent of organizations reported a cloud or SaaS breach in the past year and that misconfigured resources affected 45 percent of AWS instances, 63 percent of Google Cloud instances and 70 percent of Azure instances, while 63 percent of publicly accessible virtual machines had no encryption on attached storage. Drivers include shadow IT, business units prioritizing speed over security, and default cloud service settings that require security to be added rather than being secure out of the box, leading to exposed storage buckets, excessive privileges, disabled logging and lack of multi factor authentication. Practical defenses include nine measures to reduce exposure: require multi factor authentication everywhere, default services to private networks, encrypt data at rest and in transit, enforce least privilege, treat infrastructure as code, scan continuously for misconfigurations, lock down storage and disable public access, enable comprehensive logging and monitoring, and build security from day one. Vendors tout generative AI to simplify security tasks, but experts warn that AI will not fix the problem quickly without organizational change and proactive governance.
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities

thehackernews.com · 9 months ago

There is a malicious Visual Studio Code extension named susvsex uploaded on November 5, 2025 that contains basic ransomware capabilities and appears to have been created with the help of artificial intelligence, and Microsoft removed it from the VS Code Extension Marketplace on November 6, 2025. The extension is designed to automatically zip, exfiltrate, and encrypt files from a configured test directory on first launch, can auto activate on install or launch, and uses GitHub as a command and control channel by polling a private repository and writing results back with an embedded access token, with included decryption tools and C2 keys that could enable takeover. Security researchers also uncovered 17 trojanized npm packages that used postinstall scripts to download and run Vidar infostealer, accounting for at least 2,240 downloads before the packages were taken down.
Cavalry Werewolf Launches Cyberattack on Government Agencies to Deploy Network Backdoor

gbhackers.com · 9 months ago

In July 2025, cybersecurity researchers identified a targeted campaign by the group Cavalry Werewolf that compromised a Russian government owned organization after spam messages sent from the organization’s own corporate address triggered an internal investigation. Initial access was achieved through spear phishing using password protected archives that delivered a new backdoor tracked as BackDoor.ShellNET.1, which is based on open source Reverse Shell CS code and opens a reverse shell for remote command execution. Operators used Windows BITSAdmin to fetch additional payloads including the Trojan FileSpyNET.5 infostealer and a BackDoor Tunnel 41 component that created SOCKS5 tunnels, while many implants were controlled via Telegram bots and attackers distributed trojanized installers of WinRAR, 7 Zip, and Visual Studio Code to seed secondary infections. The campaign, observed from May to August 2025 and associated with related tooling such as FoalShell and StallionRAT, focused on espionage, long term network mapping, and data exfiltration against state agencies and industrial sectors including energy, mining, and manufacturing.
Sandworm Hackers Target Ukrainian Organizations With Data-Wiping Malware

gbhackers.com · 9 months ago

Sandworm has intensified destructive cyber operations against Ukrainian organizations, deploying multiple data-wiping malware strains to disrupt critical infrastructure and weaken the national economy. The group has deployed new wipers including ZEROLOT, PathWiper, and SwiftSlicer, often pushing them via Active Directory Group Policy and using tactics that delete shadow copies, overwrite master boot records, and corrupt NTFS metadata to render systems unrecoverable. Recent operations have targeted governmental, energy, logistics, and grain sectors, with attackers focusing on Ukraine's grain production to undermine a key source of wartime revenue.
Amazon WorkSpaces for Linux Vulnerability Exposes Valid Auth Tokens to Attackers

gbhackers.com · 9 months ago

A recently disclosed vulnerability in the Amazon WorkSpaces client for Linux improperly handles authentication tokens, allowing a local user on the same machine to extract a valid token and access another user's DCV based WorkSpace. The flaw affects client versions 2023.0 through 2024.8 and was fixed in version 2025.0, and organizations are urged to upgrade immediately. The issue is tracked as CVE-2025-12779 and is rated high with a CVSS score of 8.8, reflecting high confidentiality, integrity, and availability impact. Exploitation requires local access with low privileges, placing shared or multiuser Linux clients at particular risk and prompting administrators to update affected clients without delay.
Claude Desktop Hit by Critical RCE Flaws Allowing Remote Code Execution

gbhackers.com · 9 months ago

Security researchers uncovered severe remote code execution vulnerabilities in three official Claude Desktop extensions published by Anthropic. The Chrome, iMessage and Apple Notes connectors, which together have more than 350,000 downloads and rank highly in Claude Desktop's extension marketplace, all contained the same critical flaw of unsanitized command injection that enables arbitrary command execution. Because Claude Desktop fetches and processes web content to answer queries, attackers can craft web pages that inject commands into the extensions and trigger silent local code execution with the extensions privileges. Successful exploitation could give attackers local shell access to steal credentials, exfiltrate data, install persistent backdoors, or otherwise fully compromise user systems.
Malicious npm packages contain Vidar infostealer

www.csoonline.com · 9 months ago

Researchers found 17 npm packages across 23 releases that contained postinstall scripts installing a downloader which executes the Vidar infostealer on Windows systems. The packages masqueraded as Telegram bot helpers, icon libraries, or forks of legitimate projects, remained on the registry for about two weeks, and were downloaded at least 2,240 times with many downloads likely from automated scrapers. Recommended controls include maintaining software bills of materials, deploying real time package scanning and software composition analysis, disabling third party install scripts, using internal package repositories to guard against typosquatting, and implementing formal supply chain risk management.
U.S. Congressional Budget Office hit by suspected foreign cyberattack

www.bleepingcomputer.com · 9 months ago

The U.S. Congressional Budget Office confirmed it suffered a cybersecurity incident after a suspected foreign hacker breached its network and said it acted quickly to contain the incident and implemented additional monitoring and security controls. Emails and exchanges between congressional offices and CBO analysts may have been exposed, and some congressional offices temporarily halted email communications with the CBO while the incident is investigated. The intrusion is connected to a broader campaign that also targeted the Committee on Foreign Investment in the United States and has been attributed to the Chinese state sponsored group known as Silk Typhoon, which previously exploited the ProxyLogon zero day flaws in Microsoft Exchange Server.
Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access Vulnerability

sec.cloudapps.cisco.com · 9 months ago

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication. Cisco has released software updates that address this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20362
Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 9 months ago

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device. Cisco has released software updates that address this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms. <br/Security Impact Rating: Critical <br/CVE: CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 9 months ago

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details section of this advisory. Cisco has released software updates that address this vulnerability and strongly recommends that customers upgrade to a fixed software release. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms. <br/Security Impact Rating: Critical <br/CVE: CVE-2025-20363
AI-Slop ransomware test sneaks on to VS Code marketplace

www.bleepingcomputer.com · 9 months ago

There is a malicious extension named susvsex published by suspublisher18 on the VS Code marketplace that openly advertises file theft and AES-256-CBC encryption and appears to be the product of vibe coding and likely AI generated code according to Secure Annex researcher John Tuckner. On activation the extension runs extension.js with hardcoded variables including an IP address, encryption keys and a command and control address, creates a ZIP archive of targeted files, exfiltrates them to the hardcoded C2 and replaces the originals with encrypted versions while also polling a private GitHub repository for commands using a hardcoded personal access token. The researcher was able to access the repository and identify a likely owner location in Azerbaijan, Microsoft initially ignored the report and did not remove the extension but it was no longer available by the time the report was published.
Sora 2 Makes Videos So Believable, Reality Checks Are Required

www.darkreading.com · 9 months ago

OpenAI launched Sora 2 in September as an update to its audio and video generation model that can create eerily realistic videos from text prompts and images and is now broadly available, raising deepfake risks. The model produces more believable facial and voice mechanics including pregnant pauses and emotional components, making generated videos increasingly indistinguishable from reality and enabling threat actors to enhance social engineering for identity and financial fraud. OpenAI added a watermark but experts warn it can be worked around, leaving little reliable evidence to prove authenticity, so organizations are urged to adopt multi-prong defenses such as randomized likeness checks, multifactor authentication, device and location verification, and scrutiny of virtual backgrounds. Legal and healthcare sectors are highlighted as particularly vulnerable, and industry experts say regulations lag behind the technology with expectations that initial rules may begin to appear within the next twelve to eighteen months.