Blahalla

Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services

slcyber.io · 8 months ago

There is a vulnerability in OpenText Directory Services that enables unsafe Java deserialization from a cookie in default configurations without authentication by calling readObject on decompressed cookie data. The weakness comes from a broken signing and parsing scheme where attacker-controlled two byte length fields let an adversary expand the IV and shrink the message so the HMAC over IV concatenated with the compressed message still validates, allowing a ysoserial payload to be positioned at the start of the deserialisation stream. Exploitation required overcoming modified UTF-8 character restrictions and compression behavior by shrinking ysoserial payloads and using an ASCII-compatible Deflate approach so the payload survives nested compression, and successful exploitation can yield remote code execution and compromise authentication across integrated OpenText applications.

Washington Hotel in Japan discloses ransomware infection incident

www.bleepingcomputer.com · 8 months ago

A ransomware attack compromised servers at Washington Hotel in Japan, impacting business data. The incident occurred on February 13, 2026, and prompted the company to engage cybersecurity experts and involve law enforcement. While customer data is reportedly secure, some operational disruptions have been noted, including temporary credit card terminal unavailability. Hackers are exploiting a command injection flaw in Soliton Systems’ FileZen products, identified as CVE-2026-25108, which is used by Japanese companies.

When Audits Fail Part 2: From Pre-Auth SSRF to RCE in TRUfusion Enterprise

www.rcesecurity.com · 8 months ago

Researchers have identified vulnerabilities in Rocket Software’s TRUfusion Enterprise data exchange platform that allow unauthenticated attackers to potentially compromise the system. A server-side request forgery vulnerability, CVE-2025-32355, permits attackers to use the platform as an open forward proxy. This SSRF, combined with a path traversal vulnerability in the WsPortalV6UpDwAxis2Impl service, CVE-2025-59793, and the default password "trubiquity," can lead to pre-authentication remote code execution. The path traversal vulnerability allows attackers to upload files to arbitrary locations on the file system.

nono - kernel-enforced capability sandbox for AI agents

nono.sh · 8 months ago

NULL

Was CISOs über OpenClaw wissen sollten

www.csoonline.com · 8 months ago

The rising popularity of the OpenClaw AI agent orchestration tool presents significant cybersecurity risks to businesses. Its flexible design, while appealing, allows broad access potentially bypassing existing security protocols and increasing the risk of data breaches and intellectual property theft. Security experts caution that easily exploited vulnerabilities and malicious content available through the ClawHub marketplace pose serious threats, recommending outright bans in some cases. Companies are advised to limit user permissions, utilize multi-factor authentication, and carefully monitor network activity to mitigate these risks.

TikTok Data Secrets Revealed by Engineer Who Reverse-Analyzed the App

www.boredpanda.com · 8 months ago

false

Open source maintainers being targeted by AI agent as part of ‘reputation farming’

www.csoonline.com · 8 months ago

Security company Socket has identified a concerning trend of AI agents generating activity in open-source projects to build trust, a practice called "reputation farming." One such agent, "Kai Gritun," rapidly submitted numerous pull requests to several projects, including those critical to the JavaScript and cloud ecosystems. This activity raises concerns about potential future supply chain attacks, as building reputation now takes significantly less time than previously required, potentially bypassing traditional trust-building safeguards. Experts suggest adapting by implementing machine-verifiable governance and controls around software changes to mitigate this evolving risk.

Eurail says stolen traveler data now up for sale on dark web

www.bleepingcomputer.com · 8 months ago

Eurail B.V. has confirmed that data stolen during a recent breach is now being offered for sale on the dark web. The company is working to identify the specific records and number of customers affected, including sensitive information like passport details, bank account information, and health data. Eurail is notifying impacted customers and data protection authorities, and advising users to update passwords and monitor bank accounts for suspicious activity. Customers with concerns can contact [email protected] for assistance.

Man arrested for demanding reward after accidental police data leak

www.bleepingcomputer.com · 8 months ago

A 40-year-old man in the Netherlands was arrested for computer hacking after attempting to extort the police. The incident began when an officer mistakenly shared a download link for confidential police documents instead of an upload link. The man downloaded the files and refused to delete them unless he received something in return. Dutch authorities are investigating the data breach and have not found evidence that the documents were distributed further.

Fake CAPTCHA Scam Tricks Windows Users Into Installing Malware

www.techrepublic.com · 8 months ago

A new social engineering scam is tricking Windows users into installing StealC malware through fake CAPTCHA verification pages. The attack uses compromised websites to instruct users to execute malicious PowerShell commands, which download and run the StealC payload. StealC harvests sensitive data like browser credentials, cryptocurrency wallets, and email logins, exfiltrating it to a command-and-control server using RC4 encryption. Organizations should focus on monitoring process activity, restricting PowerShell execution, and controlling application usage to mitigate this threat.

Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens

thehackernews.com · 8 months ago

Cybersecurity researchers have identified an information stealer, likely a variant of Vidar, successfully stealing configuration files from OpenClaw AI agent users. The malware harvests sensitive data like gateway tokens, cryptographic keys, and agent operational guidelines through a broad file-grabbing routine. This theft can allow attackers remote access to OpenClaw instances and potentially masquerade as clients. OpenClaw maintainers are partnering with VirusTotal to improve security, and concerns have been raised regarding malicious skills campaigns, account deletion issues on Moltbook, and widespread exposure of OpenClaw instances, leading to remote code execution risks.

Security audit for LLM skill files: skillaudit.sh

skillaudit.sh · 8 months ago

NULL

User Issues With X Appear to Have Resolved

www.nytimes.com · 8 months ago

false

Over 500,000 VKontakte accounts hijacked through malicious Chrome extensions

therecord.media · 8 months ago

Cybersecurity researchers have discovered a malware campaign that hijacked over half a million VKontakte accounts using malicious Chrome extensions. These extensions, disguised as customization tools, secretly subscribed users to attacker-controlled groups, manipulated settings, and recorded payments for premium features. The threat actor, known as “2vk,” leveraged VKontakte’s infrastructure to distribute the extensions, which were active from mid-2025 to January 2026. One extension, VK Styles, was removed from the Chrome Web Store following the discovery.

Study Uncovers 25 Password Recovery Attacks in Major Cloud Password Managers

thehackernews.com · 8 months ago

Researchers have identified 25 password recovery attacks affecting major cloud password managers, including Bitwarden, LastPass, and Dashlane. The attacks exploit vulnerabilities in key escrow designs, item-level encryption, sharing features, and backwards compatibility, potentially leading to data compromise. Password managers like 1Password and Dashlane have acknowledged the findings and implemented countermeasures, with Dashlane patching a downgrade vulnerability fixed in version 6.2544.1 to prevent compromise of encryption keys and vault items. There is no evidence of these vulnerabilities being exploited in the wild.

Operation DoppelBrand: Weaponizing Fortune 500 Brands

www.darkreading.com · 8 months ago

A financially motivated threat actor group known as GS7 is conducting a phishing campaign called Operation DoppelBrand, targeting Fortune 500 companies globally. The group mimics legitimate login portals of major financial institutions, technology, healthcare, and telecommunications firms with remarkable accuracy. Stolen credentials, IP addresses, and device information are immediately sent to attacker-controlled Telegram bots, and the group may act as an initial access broker. Researchers have identified over 150 malicious domains used in the operation and linked the group to Brazilian cybercrime forums.

Starlink restrictions hit Russian forces as Moscow seeks workarounds

therecord.media · 8 months ago

Russia is attempting to regain access to Starlink satellite internet services after Ukraine implemented a new verification system to prevent their use on attack drones. Ukrainian security forces are warning citizens not to assist Russian efforts to register Starlink terminals, with reports of Russian operatives offering cash and pressuring families of prisoners of war. Ukrainian hackers have reportedly tricked Russian soldiers into revealing sensitive information and financial support by posing as a terminal restoration service. Elon Musk has confirmed that measures taken to restrict unauthorized Russian use of Starlink appear to be working.

Infostealer malware found stealing OpenClaw secrets for first time

www.bleepingcomputer.com · 8 months ago

Malware has been observed targeting OpenClaw users, specifically stealing configuration files to extract sensitive information. This marks a shift in infostealer behavior, now targeting AI agent secrets rather than just browser credentials. Stolen files include openclaw.json, device.json, and soul.md, potentially enabling a full compromise of a victim's digital identity. Researchers predict continued targeting of OpenClaw and similar AI tools as they become more integrated into workflows; a flaw in the related Nanobot AI assistant was also discovered, tracked as CVE-2026-2577.

Fake ‘Antivirus’ App Spreads Android Malware, Steals Banking Credentials

www.techrepublic.com · 8 months ago

A malicious Android application called TrustBastion is spreading malware disguised as a security tool. Cybercriminals are hosting the fake antivirus app on Hugging Face, a platform for artificial intelligence tools, to appear legitimate. Once installed, the app uses scare tactics to trick users into activating a malware payload, which can steal sensitive data like banking credentials and lock-screen PINs by displaying fake login screens. Users should only download apps from official app stores and scrutinize app details to avoid such threats.

User Issues With X Appear to Have Resolved

www.nytimes.com · 8 months ago

Cloudflare is currently addressing an internal issue that has caused disruptions for users of X and Amazon Web Services. The company identified the problem around 7 a.m. Eastern time, and a fix is being implemented. Some customers using Cloudflare’s Data Loss Prevention suite are experiencing intermittent errors. This outage follows previous disruptions at Cloudflare, Amazon Web Services, and other major internet service providers.

Dior, Louis Vuitton, Tiffany Fined $25 Million in South Korea After Data Breaches

www.securityweek.com · 8 months ago

South Korea has fined Louis Vuitton, Dior, and Tiffany a total of 25 million dollars for data breaches impacting millions of individuals. Louis Vuitton faces the largest penalty of roughly 15 million dollars, stemming from malware infections on employee devices. Dior and Tiffany were fined for breaches resulting from voice phishing attacks, exposing personal data of hundreds of thousands and thousands of people, respectively. These breaches are linked to a campaign targeting Salesforce customers and leveraging social engineering tactics by the Scattered LAPSUS$ Hunters group.

Passwords to passkeys: Staying ISO 27001 compliant in a passwordless era

www.bleepingcomputer.com · 8 months ago

Businesses are transitioning from passwords to passkeys, a more secure authentication method, to improve security and streamline operations. Passkeys, built on FIDO2 and WebAuthn standards, eliminate the risks associated with compromised passwords, which account for nearly half of all security incidents. Organizations seeking ISO/IEC 27001 compliance must adapt their authentication processes, documenting new controls and risk assessments. While passkeys offer significant benefits, including reduced help desk costs and improved authentication success rates, challenges remain, such as potential downgrade attacks and complex account recovery procedures.

Their Secret to a Happy Marriage? A Translation App

www.nytimes.com · 8 months ago

false

260K+ Chrome Users Duped by Fake AI Browser Extensions

www.darkreading.com · 8 months ago

Researchers have identified thirty malicious Google Chrome extensions impersonating AI assistants, collectively accumulating over 260,000 downloads. These extensions trick users into entering sensitive information, such as API keys and personal data, which is then sent to attacker-controlled servers. The malicious functionality often relies on iframes and remote web applications to evade detection during Chrome Web Store reviews. Google is reportedly aware of the issue and working to address it.

Android 17 Beta Strengthens Secure-by-Default Design for Privacy and App Security

www.securityweek.com · 8 months ago

false

CISA Navigates DHS Shutdown With Reduced Staff

www.securityweek.com · 8 months ago

Due to a government shutdown beginning February 14, 2026, the Cybersecurity and Infrastructure Security Agency, or CISA, is operating at a reduced capacity, with approximately 888 of 2,341 staff remaining on duty without pay. While essential functions like maintaining the Known Exploited Vulnerabilities, or KEV, catalog will continue, new projects are halted and existing ones curtailed. Updates to the KEV catalog will be slower, and enforcement of compliance with it is likely weakened, though the catalog itself remains a vital resource for cybersecurity professionals worldwide. The shutdown’s impact is primarily felt within critical infrastructure sectors, though the KEV’s broad availability makes it relevant to businesses globally.

Windows 11 KB5077181 Update Triggers Infinite Restart Loop on Some Devices

gbhackers.com · 8 months ago

Microsoft’s recent cumulative update KB5077181 for Windows 11 is causing some devices to enter an infinite restart loop, preventing users from logging in. The issue primarily affects Windows 11 versions 24H2 and 25H2, and is reported to be linked to problems with the System Event Notification Service and DHCP. Microsoft’s February 2026 security release addresses 58 vulnerabilities, including six actively exploited zero-days: CVE-2026-21510, CVE-2026-21519, CVE-2026-21533, and CVE-2026-20841. Users are advised to uninstall the update or utilize the Windows Recovery Environment to resolve the issue.

Noodlophile Malware Authors Use Fake Job Ads and Phishing Schemes to Evolve Tactics

gbhackers.com · 8 months ago

Cybercriminals linked to Vietnam have adapted their Noodlophile infostealer tactics, now using fake job postings to distribute malware. The attackers, tracked as UNC6229, trick victims into downloading malicious files disguised as application forms or skills tests, which contain remote access trojans or updated infostealers. In response to being exposed, the group has embedded code containing insulting messages designed to disrupt malware analysis tools, specifically targeting those using Python’s dis.dis(obj) module. Security professionals should be aware of new technical indicators including a djb2 hashing algorithm, custom integrity checks, RC4-encrypted command files and XOR string obfuscation.

Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

thehackernews.com · 8 months ago

Cyberattacks are increasing and becoming more sophisticated, combining older methods with new technologies like artificial intelligence and cloud abuse. Attackers are exploiting overlooked tools and actively targeting organizations in the defense industrial base. Recent incidents include malicious add-ins stealing credentials, the exploitation of zero-day vulnerabilities in Chrome and Apple products, and the use of cloud infrastructure for cryptocurrency mining. New ransomware groups are emerging and researchers have uncovered techniques to de-anonymize VPN users.

CISA gives feds 3 days to patch actively exploited BeyondTrust flaw

www.bleepingcomputer.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has directed federal agencies to patch a critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access within three days. This vulnerability, tracked as CVE-2026-1731, allows unauthenticated attackers to execute operating system commands and potentially compromise systems. Approximately 11,000 BeyondTrust Remote Support instances are exposed online, and attackers are actively exploiting the flaw. The directive follows previous incidents where BeyondTrust vulnerabilities were exploited by groups like Silk Typhoon, which targeted U.S. government agencies and compromised systems like those at the Treasury Department.

Joomla Vulnerabilities in Novarain/Tassos Framework Expose SQL Injection Risks

gbhackers.com · 8 months ago

Security researchers have discovered multiple vulnerabilities within the Novarain/Tassos Framework, affecting several Joomla extensions. These flaws include an unauthenticated file read, file deletion, and a SQL injection condition, enabling attackers to potentially gain administrator access and execute code. Attackers can exploit these vulnerabilities by chaining them together to harvest session data and upload malicious code or modify existing PHP files. Affected versions include Novarain/Tassos Framework versions 4.10.14 through 6.0.37, along with several extensions including Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack.

Cybersecurity Alert: Fake Shops Target Winter Olympics 2026 Fans for Attacks

gbhackers.com · 8 months ago

Cybercriminals are exploiting the excitement surrounding the Milano-Cortina 2026 Winter Olympics by creating fake online stores that mimic the official shop. These sites offer significantly discounted merchandise, like the popular Tina mascot plush, to lure victims and steal their personal and financial information. Attackers are using automated tools and even AI to rapidly deploy these convincing replicas, making them difficult to distinguish from the legitimate site. Users should only purchase from shop.olympics.com and be wary of dramatic discounts or suspicious domain names.

CleanTalk Plugin for WordPress Exposes Sites to Authorization Bypass via Reverse DNS

gbhackers.com · 8 months ago

A critical security vulnerability, CVE-2026-1490, has been identified in the CleanTalk WordPress plugin, potentially allowing attackers to take complete control of websites. The flaw involves an authorization bypass due to improper reliance on Reverse DNS records, granting unauthenticated users the ability to install arbitrary plugins and achieve Remote Code Execution. This vulnerability affects sites with invalid CleanTalk API keys, which are commonly found on development sites or those with lapsed subscriptions. The CleanTalk development team has released version 6.72 to address the issue, and immediate updates are recommended.

The Promptware Kill Chain

www.schneier.com · 8 months ago

New research identifies "promptware," a class of malware utilizing generative artificial intelligence large language models. This malware follows a seven-step "promptware kill chain" beginning with initial access, often through indirect prompt injection embedded in content like web pages or images. The kill chain progresses through privilege escalation, reconnaissance, persistence, command-and-control, lateral movement, and actions on objectives, ultimately enabling data exfiltration or even physical world impact. Researchers have already demonstrated examples of this kill chain, such as attacks using malicious prompts in Google Calendar invitations and emails to achieve persistent infection and lateral movement.

Microsoft Warns of ClickFix Attack Abusing DNS Lookups

www.securityweek.com · 8 months ago

Microsoft is warning users about a new cyberattack using a modified ClickFix technique to distribute malware. Attackers display fake error messages, tricking users into running commands that perform custom DNS lookups to validate payload execution and evade detection. This process leads to the deployment of a reconnaissance Python script and ultimately installs the ModeloRAT remote access trojan. The threat actor known as KongTuke has been observed using this CrashFix variant to target corporate networks.

Safe and Inclusive E‑Society: How Lithuania Is Bracing for AI‑Driven Cyber Fraud

thehackernews.com · 8 months ago

false

Leaky Chrome extensions with 37M installs caught divulging your browsing history

www.csoonline.com · 8 months ago

Security researchers have discovered a significant data privacy breach involving numerous popular Chrome extensions, impacting an estimated 37 million users worldwide. These extensions, spanning categories like VPNs and productivity tools, were found to be transmitting users’ browsing histories, including URLs, referrers, and timestamps, to external servers often linked to data brokers and other entities. The data exfiltration was frequently encrypted using methods like AES-256, making detection difficult. The researcher's analysis identified extensions such as Pop up blocker for Chrome, Stylish, and SimilarWeb among those exhibiting this behavior.

[Analysis] Massive Active GitHub Malware Campaign | Hundreds of Malicious Repositories Identified

brennan.day · 8 months ago

A malicious actor has created a deceptive fork of the open-source macOS app Triton, distributing malware disguised as legitimate updates. The malware, targeting Windows machines, employs password protection, evasion tactics, and Lua scripting to avoid detection and establish command and control. The attack involves manipulating the GitHub repository’s commit history and promotes downloads of a ZIP file containing the malicious payload. The incident raises concerns about GitHub’s response to malicious content and suggests the malware may be the work of an amateur.

New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft

thehackernews.com · 8 months ago

Cybersecurity researchers have identified ZeroDayRAT, a new mobile spyware platform advertised on Telegram that enables real-time surveillance and data theft on Android and iOS devices. The malware, which operates through a self-hosted panel, collects extensive device information, including location data, SMS messages, and account credentials from apps like WhatsApp and banking apps such as MetaMask, Trust Wallet, Binance, and Coinbase. It also facilitates financial theft by substituting wallet addresses and stealing data from mobile payment platforms like Apple Pay and Google Pay. The tool lowers the barrier of entry for less-skilled hackers, combining spyware, surveillance, and information-stealing capabilities.

Finding a common language around risk

www.csoonline.com · 8 months ago

false

Hackers Exploit ‘Summarize with AI’ Feature to Inject Malicious Prompts into AI Recommendations

gbhackers.com · 8 months ago

Hackers are exploiting "Summarize with AI" features to manipulate AI assistants' memory, a practice Microsoft calls AI Recommendation Poisoning. Attackers embed hidden instructions within links to bias AI responses on topics like finance, healthcare, and security, making assistants favor specific sources or brands. Tools are readily available to simplify this process, lowering the barrier to entry. Microsoft is implementing defenses and advises users to be cautious of AI links and regularly review saved AI memories.

OpenClaw Founder Peter Steinberger Joins OpenAI to Strengthen AI Research

gbhackers.com · 8 months ago

false

New Joomla! Novarain/Tassos Framework Vulnerabilities Advisory

ssd-disclosure.com · 8 months ago

A critical vulnerability exists within the Novarain Tassos Framework and related Joomla! extensions. This security flaw enables unauthenticated file reading, deletion, and SQL injection. Exploitation of these vulnerabilities can lead to remote code execution and administrator account takeover. Users are advised to apply available patches or disable affected extensions as a temporary measure.

Critical Airleader Vulnerability Exposes Systems to Exploitable Remote Attacks

gbhackers.com · 8 months ago

A critical vulnerability, CVE-2026-1358, has been identified in Airleader Master software, posing a significant risk to industrial control systems across multiple critical infrastructure sectors. The flaw allows attackers to upload and execute malicious files, potentially granting them complete control over affected systems. This vulnerability, affecting versions up to 6.381, carries a CVSS score of 9.8, signifying a severe risk. Organizations are urged to implement immediate security measures, including network isolation and secure remote access, to mitigate potential exploitation.

Neue Kooperation soll souveräne Cloud-Lösungen bringen

www.csoonline.com · 8 months ago

false

Google patches first Chrome zero-day exploited in attacks this year

www.bleepingcomputer.com · 8 months ago

Google has released an emergency update to address a high-severity security vulnerability in Chrome. The vulnerability, identified as CVE-2026-2441, is a use-after-free issue related to CSS font features, and has been actively exploited in attacks. Google is restricting details about these attacks while the fix is widely deployed. Patches are now available for Windows, macOS, and Linux users.

sandboxec: A lightweight command sandbox for Linux, secure-by-default, built on Landlock.

gh.dw1.io · 8 months ago

sandboxec is a lightweight command sandbox for Linux designed for quick command-level isolation, offering an alternative to containers and virtual machines. It uses Landlock to restrict filesystem and network access based on allow-list rules, applied immediately before command execution. The tool requires a Linux kernel version 5.13 or later with Landlock support and is intended as a containment layer, not a replacement for full virtualization or protection against kernel vulnerabilities. Installation can be done via Go, pre-built binaries, or source code.

Architectural Isolation Tradeoffs in the OpenClaw Ecosystem After CVE-2026-25253

nvd.nist.gov · 8 months ago

A security vulnerability has been identified in OpenClaw, also known as clawdbot or Moltbot, versions prior to 2026.1.29. The application automatically establishes a WebSocket connection and transmits a token value without user confirmation, using a gateway URL obtained from a query string. This issue is classified as Incorrect Resource Transfer Between Spheres, with a CWE ID of CWE-669. The vulnerability is tracked as CVE-2026-25253, and a CVSS assessment from NIST is still pending.

Matryoshka Clickfix Variant Targets macOS Users, Deploys New Stealer Malware

gbhackers.com · 8 months ago

A new social engineering campaign targeting macOS users, codenamed Matryoshka, is employing sophisticated evasion techniques to steal data. The attack begins when users are redirected to deceptive websites that prompt them to paste commands into the Terminal, bypassing security measures. The malware then uses in-memory decompression and API-gated communication to steal browser credentials and cryptocurrency wallet information from applications like Ledger Live and Trezor Suite. Stolen data is packaged and uploaded, and Intego currently detects the malicious components as trojan:OSX/Stealer.sh and trojan:AppleScript/Stealer.gen.

CISO Julie Chatman offers insights for you to take control of your security leadership role

www.csoonline.com · 8 months ago

false