Blahalla

sandboxec: A lightweight command sandbox for Linux, secure-by-default, built on Landlock.

gh.dw1.io · 8 months ago

sandboxec is a lightweight command sandbox for Linux designed for quick command-level isolation, offering an alternative to containers and virtual machines. It uses Landlock to restrict filesystem and network access based on allow-list rules, applied immediately before command execution. The tool requires a Linux kernel version 5.13 or later with Landlock support and is intended as a containment layer, not a replacement for full virtualization or protection against kernel vulnerabilities. Installation can be done via Go, pre-built binaries, or source code.

Architectural Isolation Tradeoffs in the OpenClaw Ecosystem After CVE-2026-25253

nvd.nist.gov · 8 months ago

A security vulnerability has been identified in OpenClaw, also known as clawdbot or Moltbot, versions prior to 2026.1.29. The application automatically establishes a WebSocket connection and transmits a token value without user confirmation, using a gateway URL obtained from a query string. This issue is classified as Incorrect Resource Transfer Between Spheres, with a CWE ID of CWE-669. The vulnerability is tracked as CVE-2026-25253, and a CVSS assessment from NIST is still pending.

Matryoshka Clickfix Variant Targets macOS Users, Deploys New Stealer Malware

gbhackers.com · 8 months ago

A new social engineering campaign targeting macOS users, codenamed Matryoshka, is employing sophisticated evasion techniques to steal data. The attack begins when users are redirected to deceptive websites that prompt them to paste commands into the Terminal, bypassing security measures. The malware then uses in-memory decompression and API-gated communication to steal browser credentials and cryptocurrency wallet information from applications like Ledger Live and Trezor Suite. Stolen data is packaged and uploaded, and Intego currently detects the malicious components as trojan:OSX/Stealer.sh and trojan:AppleScript/Stealer.gen.

CISO Julie Chatman offers insights for you to take control of your security leadership role

www.csoonline.com · 8 months ago

false

Google Patches First Actively Exploited Chrome Zero-Day of 2026

www.securityweek.com · 8 months ago

Google has released an emergency update to Chrome to address a zero-day vulnerability that is currently being exploited. The vulnerability, CVE-2026-2441, is a high-severity use-after-free issue within the browser's CSS component. Exploiting this flaw could allow attackers to execute code within a sandbox, potentially leading to data theft or session hijacking. Researcher Shaheen Fazim reported the vulnerability and has been credited for his responsible disclosure.

10 years later, Bangladesh Bank cyberheist still offers cyber-resiliency lessons

www.csoonline.com · 8 months ago

Ten years ago, North Korean cyberespionage actors, specifically the Lazarus Group, orchestrated a cyberheist against the Bangladesh Bank, attempting to steal $951 million. While only $81 million was successfully transferred to the Philippines and a further $20 million recovered, the attack exposed significant security shortcomings, including a lack of network segmentation and inadequate monitoring. Investigations revealed the use of malware like Lazarus/BeagleBoyz and Dridex, and highlighted the need for stronger security controls and threat intelligence programs to combat evolving, well-resourced adversaries. Since the attack, North Korean actors have increasingly targeted cryptocurrency organizations.

FileZen Flaw Allows Attackers to Execute Commands Remotely

gbhackers.com · 8 months ago

A critical vulnerability, CVE-2026-25108, has been identified in FileZen, a file transfer solution, allowing authenticated attackers to remotely execute operating system commands. This flaw, an OS command injection weakness, is particularly dangerous when the Antivirus Check Option is enabled. Versions 5.0.0 through 5.0.10 and 4.2.1 through 4.2.8 are affected, though FileZen S is not. Organizations should immediately update to version 5.0.11 to mitigate the risk of system compromise.

LockBit 5.0 Emerges: Cross-Platform Ransomware Now Targeting Windows, Linux, and ESXi Systems

gbhackers.com · 8 months ago

LockBit 5.0, released in September 2025, is a ransomware variant actively targeting Windows, Linux, and ESXi systems. The ransomware utilizes a unified framework with distinct optimizations for each platform, including aggressive defense evasion techniques for the Windows build and virtualization-specific features for the ESXi build. Analysis links LockBit 5.0 infrastructure to historical SmokeLoader activity, indicating shared resources within the cybercriminal ecosystem. The ransomware group has impacted at least 60 organizations across various sectors, primarily in the United States, and continues to operate through mirror leak sites despite law enforcement efforts.

New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released

thehackernews.com · 8 months ago

Google has released a security update to address a zero-day vulnerability in Chrome, identified as CVE-2026-2441. The vulnerability is a use-after-free bug in the CSS component and allows a remote attacker to execute arbitrary code. An exploit for this flaw is currently being used, although Google has not released details about the attacks. Users are advised to update to the latest version of Chrome or other Chromium-based browsers.

CISA Issues Alert on ZLAN ICS Flaws Enabling Full Device Takeover

gbhackers.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about critical vulnerabilities in ZLAN Information Technology’s ZLAN5143D device server. These flaws, affecting firmware version 1.600, allow attackers to bypass authentication and gain full administrative control. Security researchers at KPMG discovered the issues, which have been assigned CVSS v3 scores of 9.8, specifically CVE-2026-25084 and CVE-2026-24789. Organizations are urged to isolate control system networks and use secure remote access methods like VPNs to mitigate the risk.

ZeroDayRAT Exploit Targets Android & iOS, Enabling Real-Time Surveillance and Massive Data Theft

gbhackers.com · 8 months ago

A new mobile spyware platform called ZeroDayRAT is gaining traction, offering attackers complete remote control over both Android and iOS devices. The tool facilitates real-time surveillance and data theft through a user-friendly interface, with infection occurring via smishing texts, phishing emails, and malicious apps. ZeroDayRAT harvests extensive device data, including location, account details, SMS messages, and even live camera and microphone feeds, and includes modules for cryptocurrency and bank credential theft. Security experts recommend avoiding sideloaded apps and implementing mobile threat defenses to protect against this increasingly accessible threat.

Attackers Exploit Critical BeyondTrust Flaw to Seize Full Active Directory Control

gbhackers.com · 8 months ago

A critical vulnerability, CVE-2026-1731, has been identified in BeyondTrust Remote Support and Privileged Remote Access deployments, allowing unauthenticated attackers to execute operating system commands. Threat actors are exploiting this flaw to gain control of Active Directory environments, escalating privileges by creating new domain accounts and joining them to high-privilege groups. Federal agencies are required to patch the vulnerability by February 16, 2026, and self-hosted environments require immediate patching with updates BT26-02-RS or BT26-02-PRA. Cloud-based customers were automatically patched on February 2, 2026.

Lotus Blossom Hackers Breach Official Notepad++ Hosting Infrastructure

gbhackers.com · 8 months ago

A state-sponsored threat group, Lotus Blossom, compromised the hosting infrastructure used to distribute Notepad++ updates between June and December 2025. Attackers redirected users to malicious servers, delivering trojanized installers that deployed advanced payloads using DLL sideloading and Lua script execution. The attackers utilized a custom backdoor called Chrysalis, incorporating code protection and stealthy persistence techniques to evade detection, and targeted organizations across multiple sectors and regions. Notepad++ has since migrated to a more secure hosting provider and implemented enhanced update verification measures in versions 8.8.9 and 8.9.2.

Chrome 0-Day Enables Remote Code Execution in Ongoing Campaign

gbhackers.com · 8 months ago

A critical security update has been released for Google Chrome to address a zero-day vulnerability currently being exploited. The vulnerability, CVE-2026-2441, is a "Use After Free" flaw in the browser’s CSS component that could allow attackers to execute code. Google confirmed that an exploit exists in the wild and has restricted details of the vulnerability while a majority of users update. Users are advised to manually check for and install the update immediately.

Canada Goose investigating as hackers leak 600K customer records

www.bleepingcomputer.com · 8 months ago

Canada Goose is investigating a data leak impacting over 600,000 customer records. The data, released by the data extortion group ShinyHunters, includes customer names, addresses, order histories, and partial payment card information like card brand and the last four digits. Canada Goose reports no evidence of a breach of its own systems, suggesting the data originated from a third-party payment processor breach dating back to August 2025. ShinyHunters has denied any connection to recent single sign-on attacks.

New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS

www.bleepingcomputer.com · 8 months ago

Threat actors are now using a new technique in ClickFix social engineering attacks to deliver malware through DNS queries. Victims are instructed to run a specific nslookup command that retrieves a malicious PowerShell script from an attacker-controlled DNS server. This script then executes a remote access trojan called ModeloRAT, which allows attackers remote control of the compromised system. This marks the first known use of DNS as a channel in ClickFix campaigns, allowing for on-the-fly payload modifications and blending with normal network traffic.

I built a free, open-source platform to learn GenAI security, learning content + hands-on labs against real LLMs (beta, looking for feedback)

prompttrace.airedlab.com · 8 months ago

NULL

Windows 11 KB5077181 fixes boot failures linked to failed updates

www.bleepingcomputer.com · 8 months ago

A bug affecting some commercial Windows 11 systems has been resolved in the February 2026 Patch Tuesday update, KB5077181. The issue caused boot failures with an "UNMOUNTABLEBOOTVOLUME" error after installing security updates from January 13, 2026, or later. The problem stemmed from a failed December 2025 security update installation and primarily impacted physical devices running Windows 11 versions 24H2 and 25H2. While an initial fix was released in January 2026, Microsoft now states the issue is fully resolved.

CTM360: Lumma Stealer and Ninja Browser malware campaign abusing Google Groups

www.bleepingcomputer.com · 8 months ago

A sophisticated malware campaign is leveraging Google Groups and hosted URLs to distribute malicious software globally. Attackers create seemingly legitimate discussions within industry-related forums to trick users into downloading credential-stealing malware or a trojanized browser disguised as “Ninja Browser.” Windows users receive the Lumma Stealer, while Linux users are infected with a browser containing hidden malicious extensions that track user data and facilitate future compromise. The campaign abuses trusted Google services to evade detection and gain user confidence.

Pastebin comments push ClickFix JavaScript attack to hijack crypto swaps

www.bleepingcomputer.com · 8 months ago

Cybercriminals are using Pastebin comments to lure cryptocurrency users into a new ClickFix-style attack. The scheme promises large profits through a fake Swapzone.io arbitrage exploit, but instead directs victims to execute malicious JavaScript code in their browser. This code hijacks Bitcoin swap transactions, redirecting funds to attacker-controlled wallets by manipulating the swap process and replacing legitimate Bitcoin addresses with those controlled by the attackers. This marks a novel use of ClickFix techniques, traditionally targeting operating systems, now exploiting JavaScript within a browser environment.

Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging

thehackernews.com · 8 months ago

Cybercriminals are increasingly using a social engineering tactic called ClickFix to distribute malware. This technique tricks users into running commands that execute malicious code, often disguised as troubleshooting steps. Attackers use DNS lookups to retrieve payloads, bypass security controls, and establish a staging channel before deploying malware like ModeloRAT and Lumma Stealer. Recent campaigns involve fake CAPTCHA pages and compromised websites, targeting both Windows and macOS systems to steal credentials and cryptocurrency.

Could an Electronic Coach Help Ski Jumpers Leap Farther?

www.nytimes.com · 8 months ago

false

More Than Ever, Videos Expose the Truth. And Cloud It, Too.

www.nytimes.com · 8 months ago

false

More Than Ever, Videos Expose the Truth. And Cloud It, Too.

www.nytimes.com · 8 months ago

false

He spent decades perfecting his voice. Now he says Google stole it.

www.washingtonpost.com · 8 months ago

NPR’s David Greene is suing Google, claiming the company unlawfully replicated his voice. Greene alleges Google’s NotebookLM artificial intelligence tool mimics his voice without consent or compensation. A former colleague alerted Greene to the similarity after noticing the AI’s vocal qualities. He is claiming the creation of this product violates his rights.

Introducing IDA-Free-MCP: mcp server for IDA Free version (native)

0xshlomil.github.io · 8 months ago

false

First Ever OffSec USA Chapter Meetup - DMV Area!

oxidized-root-d90.notion.site · 8 months ago

false

Cloudflare Pages “Continue Read” Redirect Kit Abused for Phishing, Adware, and Malware Delivery

malwr-analysis.com · 8 months ago

Attackers are abusing Cloudflare Pages to host seemingly legitimate SEO articles, like celebrity net worth blogs, which then trigger deceptive “Continue reading” pop-ups. Clicking these buttons redirects users to phishing pages, adware installers, or malware droppers, sometimes disguised as browser downloads or fake CAPTCHA challenges. Over 250 URLs have been observed using this technique, with activity persisting for five months, suggesting a coordinated effort to evade detection and attract organic traffic through search engine indexing. The operation utilizes a central redirect endpoint at preservationwristwilling[.]com/utx3iw6i?key= to manage traffic distribution and includes anti-analysis measures like proxy/VPN detection. A sample executable with SHA256 be590100ecdcae5ce4b7b42f87082e201fcb2f38c114c8fbc6640ad9b9a0708a has been classified as adware/PUP.

Meta Plans to Add Facial Recognition Technology to Its Smart Glasses

www.nytimes.com · 8 months ago

false

Upcoming Speaking Engagements

www.schneier.com · 8 months ago

false

One threat actor responsible for 83% of recent Ivanti RCE attacks

www.bleepingcomputer.com · 8 months ago

Security researchers have observed a single threat actor responsible for the majority of recent attacks exploiting vulnerabilities in Ivanti Endpoint Manager Mobile. This actor leveraged CVE-2026-21962 and CVE-2026-24061, which allow for remote code execution without authentication. The attacks primarily originate from a single IP address hosted on bulletproof infrastructure, accounting for over 83% of exploitation activity. This threat actor is also targeting vulnerabilities in Oracle WebLogic, GNU Inetutils Telnetd, and GLPI.

Snail mail letters target Trezor and Ledger users in crypto-theft attacks

www.bleepingcomputer.com · 8 months ago

Cybercriminals are targeting cryptocurrency hardware wallet users with sophisticated physical phishing campaigns. Threat actors are sending letters impersonating Trezor and Ledger, claiming mandatory authentication or transaction checks to pressure recipients into scanning QR codes. These codes direct victims to fake websites designed to steal recovery phrases, granting attackers control of their cryptocurrency wallets. Never share recovery phrases, as legitimate hardware wallet companies will never request them.

Hacking a pharmacy to get free prescription drugs and more

eaton-works.com · 8 months ago

Security vulnerabilities on the Dava India Pharmacy website allowed an unauthorized party to create a super administrator account. This account granted complete control over the pharmacy's online operations, including access to nearly 17,000 orders and the ability to modify product details and create coupons. The vulnerability, discovered in August 2025, enabled the creation of a 100 percent off coupon, though no orders were placed using it. Dava India addressed the issue in September 2025, and customers are not believed to have had their data compromised.

David J. Farber, ‘Grandfather of the Internet,’ Dies at 91

www.nytimes.com · 8 months ago

false

Over 300 Malicious Chrome Extensions Caught Leaking or Stealing User Data

www.securityweek.com · 8 months ago

Security researchers have identified over 300 malicious Chrome extensions that are leaking or stealing user data. These extensions are transmitting browsing history and search results to unsecured networks or collection servers, impacting over 37 million users. The data appears to be collected for monetization by data brokers, and some extensions are linked to known spyware distributors. LayerX also reported on 30 extensions posing as AI tools that inject iframes to manipulate content and steal data, with 15 specifically targeting Gmail.

Trump officials condemned Don Lemon. He’s bigger than ever after arrest.

www.washingtonpost.com · 8 months ago

false

REMnux v8 Linux Toolkit Released With AI-Powered Malware Analysis Capabilities

gbhackers.com · 8 months ago

REMnux v8, a Linux toolkit for malware analysis, has been released with significant updates. The toolkit now incorporates artificial intelligence to assist researchers in reverse engineering processes. The operating system has been upgraded to Ubuntu 24.04, and a new installer has been implemented for greater reliability. Over 200 tools are included, with a focus on analyzing modern programming languages and mobile threats.

Best Free Security Tools Everyone Should Use in 2026

techputs.com · 8 months ago

false

Viral AI Caricatures Highlight Shadow AI Dangers

www.techrepublic.com · 8 months ago

A viral social media trend where users generate caricatures of themselves and their jobs using AI tools like ChatGPT is raising security concerns. The trend inadvertently reveals how employees are using AI for work, potentially inputting sensitive data into public platforms and increasing the risk of social engineering attacks and data leakage. This highlights a broader problem of shadow AI, where organizations lack control over employee AI usage, and exposes a significant attack surface. Security teams should focus on AI governance, secure alternatives, and monitoring for compromised accounts and data exfiltration. The trend is associated with the OWASP LLM Top Ten risk of Sensitive Information Disclosure (LLM2025:02).

Homeland Security Demands Social Media Sites Reveal Names Behind Anti-ICE Posts

www.nytimes.com · 8 months ago

The Department of Homeland Security is seeking to identify individuals critical of Immigration and Customs Enforcement. They have issued hundreds of subpoenas to companies like Google, Meta, Reddit, and Discord, requesting personal information associated with social media accounts. These accounts have been identified for criticizing ICE or revealing the locations of ICE agents. Tech companies are reviewing these requests before complying, and some have notified users of the data requests, allowing them to challenge the subpoenas in court.

Critical BeyondTrust RS vulnerability exploited in active attacks

www.csoonline.com · 8 months ago

Cybersecurity researchers have observed attackers exploiting a critical vulnerability, CVE-2026-1731, in BeyondTrust Remote Support to compromise systems. The attacks have targeted self-hosted BeyondTrust appliances, including those from Bomgar, many of which are past their end-of-life. Attackers are deploying SimpleHelp, creating domain accounts, and utilizing tools like Impacket to move laterally within networks. The US Department of the Treasury experienced a compromise related to this vulnerability.

Phishing on the Edge of the Web and Mobile Using QR Codes

unit42.paloaltonetworks.com · 8 months ago

Threat actors are increasingly using QR codes to launch phishing and malware attacks on mobile devices, bypassing security measures. Attackers are masking destinations, exploiting in-app deep links, and distributing malicious apps directly. Targeted platforms include Telegram, WhatsApp, Signal, and Line, and campaigns have specifically targeted Signal users in Ukraine. Users should be cautious when scanning QR codes due to the potential for financial fraud, account takeovers, and malicious app installations.

I built a vulnerable AI banking CTF—5 flags covering prompt injection techniques (write-up in comments)

www.sbytec.com · 8 months ago

Prompt injection is a serious vulnerability that allows attackers to manipulate the input given to large language models. Attackers can use prompt injection to bypass security guardrails, forcing the AI model to perform unintended actions. These malicious inputs can potentially reveal sensitive data or cause the model to generate harmful and inappropriate content. Developers must implement robust input validation and established defensive techniques to mitigate this risk.

Fake job recruiters hide malware in developer coding challenges

www.bleepingcomputer.com · 8 months ago

North Korean threat actors are targeting JavaScript and Python developers through fake job postings, employing a campaign called "Graphalgo." Attackers create fraudulent companies in the blockchain and cryptocurrency sectors and require candidates to run malicious code during the interview process. These activities involve 192 malicious packages hosted on npm and PyPi, which install a remote access trojan (RAT) capable of stealing cryptocurrency and exfiltrating data. Researchers attribute the campaign to the Lazarus group and advise developers who may have been compromised to rotate credentials and reinstall their operating systems.

Friday Squid Blogging: Do Squid Dream?

www.schneier.com · 8 months ago

false

Zscaler-SquareX Deal Boosts Zero Trust, Secure Browsing Capabilities

www.darkreading.com · 8 months ago

false

Claude LLM artifacts abused to push Mac infostealers in ClickFix attack

www.bleepingcomputer.com · 8 months ago

Threat actors are using Claude artifacts and Google Ads to distribute MacSync infostealer malware to macOS users. Malicious search results lead users to either Claude artifacts or fake Apple Support pages, instructing them to execute shell commands in Terminal. These commands download and run the infostealer, which steals sensitive data like keychain information, browser data, and crypto wallet details before exfiltrating it to a command-and-control server. Researchers have observed over 27,000 views of the malicious Claude guide, highlighting the potential reach of this campaign.

Fingerprinting The Gentleman ransomware gang on Tor

www.sprocketsecurity.com · 8 months ago

A significant data leak has exposed details about the ransomware group "The Gentlemen" and their operational practices. Researchers found that the group uses a shared SFTP server at 194.87.31.69:2222 for data exfiltration, with multiple rclone configurations using different credentials for each victim. The SFTP server is linked to Vidar stealer infrastructure, and the leak also suggests potential affiliate relationships with other ransomware groups like Mallox. This incident highlights how open-source intelligence techniques can uncover valuable information about cybercriminals.

F.T.C. Chair Warns Apple Against Bias in Apple News

www.nytimes.com · 8 months ago

The Federal Trade Commission chair has cautioned Apple regarding potential violations of consumer protection laws. A recent study alleges Apple News is suppressing conservative viewpoints and favoring left-leaning media. The FTC chair stated consumers expect neutral coverage and the company may not be upholding its commitments. This action aligns with a broader effort by Trump-appointed officials to address perceived media bias.

Louis Vuitton, Dior, and Tiffany fined $25 million over data breaches

www.bleepingcomputer.com · 8 months ago

South Korea has fined Louis Vuitton, Dior, and Tiffany a combined $25 million for data security failures impacting over 5.5 million customers. Hackers accessed a shared cloud-based customer management service, resulting in data breaches including names, phone numbers, and purchase histories. Louis Vuitton’s breach stemmed from malware on an employee’s device, while Dior and Tiffany were compromised through phishing and voice phishing attacks on customer service employees. The South Korean Personal Information Protection Commission stressed that companies remain responsible for securing customer data, even when using third-party services.