Blahalla

Phishing on the Edge of the Web and Mobile Using QR Codes

unit42.paloaltonetworks.com · 8 months ago

Threat actors are increasingly using QR codes to launch phishing and malware attacks on mobile devices, bypassing security measures. Attackers are masking destinations, exploiting in-app deep links, and distributing malicious apps directly. Targeted platforms include Telegram, WhatsApp, Signal, and Line, and campaigns have specifically targeted Signal users in Ukraine. Users should be cautious when scanning QR codes due to the potential for financial fraud, account takeovers, and malicious app installations.

I built a vulnerable AI banking CTF—5 flags covering prompt injection techniques (write-up in comments)

www.sbytec.com · 8 months ago

Prompt injection is a serious vulnerability that allows attackers to manipulate the input given to large language models. Attackers can use prompt injection to bypass security guardrails, forcing the AI model to perform unintended actions. These malicious inputs can potentially reveal sensitive data or cause the model to generate harmful and inappropriate content. Developers must implement robust input validation and established defensive techniques to mitigate this risk.

Fake job recruiters hide malware in developer coding challenges

www.bleepingcomputer.com · 8 months ago

North Korean threat actors are targeting JavaScript and Python developers through fake job postings, employing a campaign called "Graphalgo." Attackers create fraudulent companies in the blockchain and cryptocurrency sectors and require candidates to run malicious code during the interview process. These activities involve 192 malicious packages hosted on npm and PyPi, which install a remote access trojan (RAT) capable of stealing cryptocurrency and exfiltrating data. Researchers attribute the campaign to the Lazarus group and advise developers who may have been compromised to rotate credentials and reinstall their operating systems.

Friday Squid Blogging: Do Squid Dream?

www.schneier.com · 8 months ago

false

Zscaler-SquareX Deal Boosts Zero Trust, Secure Browsing Capabilities

www.darkreading.com · 8 months ago

false

Claude LLM artifacts abused to push Mac infostealers in ClickFix attack

www.bleepingcomputer.com · 8 months ago

Threat actors are using Claude artifacts and Google Ads to distribute MacSync infostealer malware to macOS users. Malicious search results lead users to either Claude artifacts or fake Apple Support pages, instructing them to execute shell commands in Terminal. These commands download and run the infostealer, which steals sensitive data like keychain information, browser data, and crypto wallet details before exfiltrating it to a command-and-control server. Researchers have observed over 27,000 views of the malicious Claude guide, highlighting the potential reach of this campaign.

Fingerprinting The Gentleman ransomware gang on Tor

www.sprocketsecurity.com · 8 months ago

A significant data leak has exposed details about the ransomware group "The Gentlemen" and their operational practices. Researchers found that the group uses a shared SFTP server at 194.87.31.69:2222 for data exfiltration, with multiple rclone configurations using different credentials for each victim. The SFTP server is linked to Vidar stealer infrastructure, and the leak also suggests potential affiliate relationships with other ransomware groups like Mallox. This incident highlights how open-source intelligence techniques can uncover valuable information about cybercriminals.

F.T.C. Chair Warns Apple Against Bias in Apple News

www.nytimes.com · 8 months ago

The Federal Trade Commission chair has cautioned Apple regarding potential violations of consumer protection laws. A recent study alleges Apple News is suppressing conservative viewpoints and favoring left-leaning media. The FTC chair stated consumers expect neutral coverage and the company may not be upholding its commitments. This action aligns with a broader effort by Trump-appointed officials to address perceived media bias.

Louis Vuitton, Dior, and Tiffany fined $25 million over data breaches

www.bleepingcomputer.com · 8 months ago

South Korea has fined Louis Vuitton, Dior, and Tiffany a combined $25 million for data security failures impacting over 5.5 million customers. Hackers accessed a shared cloud-based customer management service, resulting in data breaches including names, phone numbers, and purchase histories. Louis Vuitton’s breach stemmed from malware on an employee’s device, while Dior and Tiffany were compromised through phishing and voice phishing attacks on customer service employees. The South Korean Personal Information Protection Commission stressed that companies remain responsible for securing customer data, even when using third-party services.

South Korea fines Louis Vuitton, Christian Dior, Tiffany $25M for SaaS security failures

www.csoonline.com · 8 months ago

South Korean authorities have fined Louis Vuitton, Christian Dior, and Tiffany a combined 25 million US dollars for security failures related to customer data. The breaches involved vishing attacks and malware compromising employee devices, impacting over 5 million customers. All three companies failed to implement basic security measures like IP-based access controls and stronger authentication, and missed breach notification deadlines. The Personal Information Protection Commission emphasized that using Software-as-a-Service does not relieve companies of their responsibility to protect personal information.

Space emerges as new front in great power competition, officials warn

therecord.media · 8 months ago

false

Researchers unearth 30-year-old vulnerability in libpng library

www.csoonline.com · 8 months ago

A decades-old vulnerability has been found and patched in the widely used libpng open-source library. The flaw, identified as CVE-2026-25646, is a heap buffer overflow that could potentially lead to information extraction or remote code execution, though exploitation requires specific conditions. The vulnerability exists in the pngsetquantize function and is fixed in version 1.6.55 of the library. Security experts caution against panic, noting the vulnerability’s complexity and relatively low usage, while also acknowledging that AI tools may uncover more dormant vulnerabilities in open-source software.

Battling bots face off in cybersecurity arena

www.csoonline.com · 8 months ago

false

Ring ends partnership plans with Flock days after privacy blowback from Super Bowl ad

therecord.media · 8 months ago

false

Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs

thehackernews.com · 8 months ago

Google’s Threat Intelligence Group has linked a suspected Russian-affiliated actor to cyberattacks on Ukrainian organizations using CANFAIL malware. This group has expanded its targeting to include aerospace, manufacturing, and humanitarian organizations, in addition to defense and government entities. Attackers are utilizing large language models to improve reconnaissance, social engineering, and technical tasks. The malware, disguised as a PDF, executes a PowerShell script and displays a fake error message.

Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks

www.darkreading.com · 8 months ago

Threat actors are increasingly using a technique called bring-your-own-vulnerable-driver, or BYOVD, to disable security products like EDR on targeted systems. This involves exploiting vulnerable drivers to gain kernel-level access and kill security processes. Microsoft faces a challenge because its operating system supports a wide range of drivers, inadvertently creating an arms race between attackers and defenders. A loophole exists allowing drivers with revoked certificates to load, as seen in a recent attack using a driver for EnCase, which had its certificate revoked in 2010. Microsoft maintains a Vulnerable Driver Blocklist, but it is updated infrequently and often blocks drivers used for legitimate purposes.

Nation-State Hackers Put Defense Industrial Base Under Siege

www.darkreading.com · 8 months ago

Nation-state hackers are increasingly targeting defense industrial base organizations through cyber espionage and attacks. Attackers, including those linked to China and Russia, are exploiting zero-day vulnerabilities in edge devices to gain initial access and establish persistent footholds within networks. Threat actors are also targeting defense workers through malicious job portals and credential theft. The Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog lists 26 vulnerabilities exploited in edge devices in 2025 and 35 in 2024.

BeyondTrust Gets Hit Again: Pre-Auth RCE in Remote Support Tools

foss-daily.org · 8 months ago

A critical pre-authentication remote code execution vulnerability, CVE-2026-1731, has been identified in BeyondTrust Remote Support and Privileged Remote Access tools. Attackers can execute commands as the site user without authentication or interaction by sending a crafted WebSocket request. This vulnerability exists in the same endpoint previously exploited by Chinese state actors, and impacts on-premise deployments, with roughly 8,500 internet-facing instances potentially vulnerable. Users should immediately apply patch BT26-02-RS for Remote Support or patch BT26-02-PRA for Privileged Remote Access or upgrade to version 25.1.1 or later.

EU can’t be ‘naive’ about enemies shutting down critical infrastructure, warns tech official

therecord.media · 8 months ago

European Union officials are urging increased vigilance and investment to protect critical infrastructure from cyberattacks and hybrid threats. Recent attacks targeting hospitals, energy networks, and democratic processes highlight Europe’s vulnerability due to its reliance on digital systems. The European Commission is proposing revisions to the Cybersecurity Act, including phasing out high-risk suppliers in critical infrastructure. Officials emphasized the need for stronger cyber capabilities and a domestic cyber industry to ensure Europe’s resilience against growing threats.

AI Agents 'Swarm,' Security Complexity Follows Suit

www.darkreading.com · 8 months ago

NULL

NATO must impose costs on Russia, China over cyber and hybrid attacks, says deputy chief

therecord.media · 8 months ago

false

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations

thehackernews.com · 8 months ago

Several state-sponsored actors from China, Iran, North Korea, and Russia are actively targeting the defense industrial base. These groups employ various tactics, including exploiting secure messaging applications like Telegram and Signal, using fake job offers, and compromising edge devices. Malware families observed in these campaigns include MESSYFORK, GREYBATTLE, GALLGRAB, and TINYWHALE. Threat actors are also utilizing artificial intelligence for reconnaissance and employing operational relay box networks to evade detection.

Ransomware Groups Claimed 2,000 Attacks in Just Three Months

www.techrepublic.com · 8 months ago

Ransomware attacks have significantly increased, with monthly attacks surging to nearly 700 and a 52% rise in total attacks recorded in 2025. Ransomware groups claimed over 2,000 attacks in the last three months of 2025 and continue to operate at a high pace into 2026. The group Qilin, known for sophisticated tactics and a ransomware-as-a-service model, led all ransomware groups with 1,138 successful breaches in 2025. The US remains the top target for ransomware attacks, and organizations are advised to prioritize cybersecurity best practices to protect against this growing threat.

Four new reasons why Windows LNK files cannot be trusted

www.csoonline.com · 8 months ago

A cybersecurity researcher has discovered four new methods to manipulate Windows shortcut (.LNK) files, potentially allowing attackers to spoof destinations, hide command-line arguments, and execute unintended programs. These techniques exploit inconsistencies in how Windows handles conflicting metadata within LNK files, enabling attackers to launch malicious actions disguised as harmless shortcuts. One method involves manipulating the "ExtraData" section of LNK files to hide command-line arguments while still executing them, offering an alternative to exploiting CVE-2025-9491. Microsoft considers these behaviors UI issues rather than vulnerabilities.

China may be rehearsing a digital siege, Taiwan warns

therecord.media · 8 months ago

false

Brutus: Open-source credential testing tool for offensive security

www.helpnetsecurity.com · 8 months ago

Brutus is a new open-source credential testing tool designed to streamline penetration testing workflows. It addresses issues with existing tools like THC Hydra and Medusa, offering a single binary with zero external dependencies and native JSON support. Brutus supports 22 protocols and includes embedded SSH bad key testing leveraging Rapid7 and HashiCorp collections, identifying compromised keys from vendors such as F5, ExaGrid, and Array Networks. An experimental AI feature uses Claude’s vision to automate the discovery of unidentified web admin panels and test default credentials.

UAT-9921 Deploys VoidLink Malware to Target Technology and Financial Sectors

thehackernews.com · 8 months ago

A threat actor known as UAT-9921 is using a new modular malware framework called VoidLink to target technology and financial sectors. VoidLink, written in Zig, C, and GoLang, allows for stealthy access to Linux-based cloud environments and appears to leverage large language models in its development. The framework includes features for reconnaissance, lateral movement, and evasion of security tools, and it uses a role-based access control system. Researchers believe the malware may have been in development since 2025 and that the actors possess a degree of Chinese language proficiency.

Cisco Unified Communications Products Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A critical vulnerability exists in several Cisco Unified Communications products, including Unified CM, Unified CM SME, Unified CM IM&P, Unity Connection, and Webex Calling Dedicated Instance. The vulnerability allows an unauthenticated attacker to remotely execute commands by sending crafted HTTP requests to the device's web management interface. Successful exploitation could grant an attacker user-level access, potentially allowing privilege escalation to root. Cisco has released software updates to address the issue, and no workarounds are available.

Estonia spy chief calls on Europe to invest in its own offensive cyber capabilities

therecord.media · 8 months ago

Estonia’s foreign intelligence chief is urging European governments and industry to invest in offensive cyber capabilities, noting a reliance on non-European tools. He stated that Europe needs to develop its own technology for intelligence collection and potential cyber sabotage activities, as much of the current data collection relies on external solutions. The official also warned that Russia may rebuild forces along its borders and highlighted the importance of intelligence cooperation, while observing that cyber espionage remains the primary activity. He cautioned against disruption tactics that risk losing access to valuable information.

Turning IBM QRadar Alerts into Action with Criminal IP

www.bleepingcomputer.com · 8 months ago

Criminal IP, an AI-powered threat intelligence platform, has integrated with IBM QRadar SIEM and SOAR to enhance security operations. The integration provides real-time threat visibility from firewall traffic logs, automatically classifying IP addresses as high, medium, or low risk. Analysts can now investigate suspicious IPs directly within QRadar and automate threat enrichment through pre-built SOAR playbooks for IP and URL threat services. This combination improves detection accuracy, shortens investigation cycles, and prioritizes responses by incorporating external threat context.

In Other News: Google Looks at AI Abuse, Trump Pauses China Bans, Disney’s $2.7M Fine

www.securityweek.com · 8 months ago

Threat actors are increasingly leveraging artificial intelligence in various stages of attacks, including model extraction attempts, according to Google. The Cybersecurity and Infrastructure Security Agency highlighted challenges in securing operational technology communications due to legacy systems and limited support for modern cryptography. The Environmental Protection Agency found vulnerabilities at 277 public drinking water systems, while a Department of Defense employee was indicted for laundering money through romance scams. California regulators fined Disney 2.75 million dollars for California Consumer Privacy Act violations. A supply chain flaw exposed sensitive systems at approximately 200 airports worldwide.

US needs to impose ‘real costs’ on bad actors, State Department cyber official says

therecord.media · 8 months ago

U.S. cyber strategy is shifting from a defensive posture to a deterrence model, aiming to make hacking attacks too costly for adversaries. Officials are emphasizing proactive disruption and imposing consequences on malicious actors, mirroring a broader shift towards assertive cyber operations. The State Department’s Bureau of Cyberspace and Digital Policy is leading diplomatic efforts concerning technology and responses to intrusions, highlighting the importance of technical standards and supply chains. However, the U.S. is reducing involvement in some international cyber partnerships while simultaneously encouraging allied coordination.

BSI läutet Ende der klassischen Verschlüsselung ein

www.csoonline.com · 8 months ago

Germany's Federal Office for Information Security, or BSI, has established deadlines for phasing out conventional asymmetric encryption methods. The BSI advises combining traditional encryption with post-quantum cryptography in a hybrid approach, with stricter requirements beginning at the end of 2030 for systems with high security needs. Conventional signature methods will be discontinued from sole use by 2035. The updated technical guidelines, TR-02102, also provide recommendations for implementing TLS, IPsec and IKEv2, and SSH.

Europe must adapt to ‘permanent’ cyber and hybrid threats, Sweden warns

therecord.media · 8 months ago

European security officials warn that cyber and hybrid threats are now a permanent feature of the security environment. These threats combine military force, economic pressure, information operations, and cyber activity, often aiming to undermine public trust. Sweden is undertaking a significant rearmament and strengthening its civil defense and national cybersecurity through a "total defense" concept. The nation is also restructuring its cybersecurity agency to improve coordination and collaboration with the private sector, which manages much of the country’s critical infrastructure.

Phishing Campaigns Target Users with Fake Meeting Invites and Update Alerts via Zoom, Teams, and Google Meet

gbhackers.com · 8 months ago

Cybercriminals are using fake meeting invitations and software update alerts through Zoom, Microsoft Teams, and Google Meet to trick users. These phishing campaigns redirect victims to deceptive websites that mimic legitimate login pages and prompt them to download malicious software updates. These updates install legitimate remote monitoring and management tools, like Datto RMM, LogMeIn, or ScreenConnect, granting attackers complete remote access to compromised systems. Organizations are urged to monitor RMM tool usage and educate employees to prevent these attacks.

Check Point Announces Trio of Acquisitions Amid Solid 2025 Earnings Beat

www.securityweek.com · 8 months ago

false

CISA flags critical Microsoft SCCM flaw as exploited in attacks

www.bleepingcomputer.com · 8 months ago

A critical vulnerability has been identified in Microsoft’s Configuration Manager, known as CVE-2024-43468. This SQL injection flaw allows attackers to execute commands and gain high-level privileges without authentication. While Microsoft initially considered exploitation unlikely, proof-of-concept code has been released, demonstrating the vulnerability’s potential for abuse. The Cybersecurity and Infrastructure Security Agency has classified the vulnerability as actively exploited and is requiring federal agencies to patch systems by March 5th.

CVE-2025-64712 in Unstructured.io Puts Amazon, Google, and Tech Giants at Risk of Remote Code Execution

gbhackers.com · 8 months ago

A critical vulnerability, CVE-2025-64712, has been identified in the Unstructured.io library, used for converting unstructured data into a format suitable for artificial intelligence. This flaw allows for arbitrary file writes, potentially enabling remote code execution. The vulnerability stems from a path traversal issue when processing Microsoft Outlook email attachments, allowing attackers to overwrite system files if they can control attachment filenames. The widespread use of Unstructured.io across many enterprise environments, including Fortune 1000 companies, raises concerns about the potential impact of this security risk.

Dutch Carrier Odido Discloses Data Breach Impacting 6 Million

www.securityweek.com · 8 months ago

Dutch mobile carrier Odido has reported a data breach impacting over 6 million customers of both Odido and its subsidiary Ben. The breach occurred February 7th through 8th, resulting in the theft of personal information including names, addresses, bank account numbers, and passport information. While services were not impacted and passwords and call records remain secure, Odido is urging customers to be cautious of potential phishing attempts and unusual activity. The source of the breach and any associated CVEs remain unknown.

‘Something Big Is Happening’ + A.I. Rocks the Romance Novel Industry + One Good Thing

www.nytimes.com · 8 months ago

false

The foundation problem: How a lack of accountability is destroying cybersecurity

www.csoonline.com · 8 months ago

false

CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks

therecord.media · 8 months ago

The Cybersecurity and Infrastructure Security Agency is requiring federal agencies to quickly patch ten newly identified vulnerabilities impacting SolarWinds, Apple, Microsoft, and Notepad++. A critical vulnerability, CVE-2025-40536, affecting SolarWinds Web Help Desk, must be addressed by Sunday. Apple disclosed CVE-2026-20700, which may have been exploited in a targeted attack, and Notepad++ is responding to CVE-2025-15556 after a Chinese state-sponsored group exploited it. Microsoft's CVE-2026-21510, CVE-2026-21513, and CVE-2026-21514 are also included due to active exploitation. Experts anticipate a record number of vulnerabilities will be disclosed in 2026, potentially exceeding 70,000.

Google fears massive attempt to clone Gemini AI through model extraction

www.csoonline.com · 8 months ago

Google has detected and blocked a campaign involving over 100,000 prompts aimed at extracting the proprietary reasoning capabilities of its Gemini AI model, which is considered intellectual property theft. Threat actors, including groups from China, Iran, North Korea, and Russia, are increasingly integrating Gemini into their operations for activities like social engineering, vulnerability analysis, and intelligence gathering. Malware families like HONESTCUE are now embedding Gemini’s APIs directly into malicious code to bypass safety filters, and organizations should monitor API access and implement output controls to prevent model extraction. Experts warn that traditional cybersecurity defenses are insufficient against this rapidly evolving threat landscape.

Malicious Chrome Extensions Caught Stealing Business Data, Emails, and Browsing History

thehackernews.com · 8 months ago

Cybersecurity reports indicate a rise in malicious Chrome extensions targeting user data. Several campaigns, including CL Suite, VK Styles, and AiFrame, have been identified as stealing Meta Business Suite data, hijacking VKontakte accounts, and harvesting credentials and browsing history. These extensions disguise themselves as legitimate tools to collect sensitive information without user consent. Security experts recommend installing only necessary extensions, regularly auditing them, and utilizing browser profiles for increased protection.

Chrome Extensions Infect 500K Users to Hijack VKontakte Accounts

gbhackers.com · 8 months ago

A malicious Chrome extension campaign hijacked over 500,000 VKontakte accounts, using them to subscribe users to attacker-controlled groups and reset their settings monthly. The extensions, disguised as VK customization tools, utilized a multi-stage architecture with configuration data hidden within VK profile meta tags and hosted on GitHub. The attacker leveraged VK’s own infrastructure as a command-and-control system, manipulating CSRF cookies and tracking donation status for monetization. The extensions involved include IDs ceibjdigmfbbgcpkkdpmjokkokklodmc, mflibpdjoodmoppignjhciadahapkoch, lgakkahjfibfgmacigibnhcgepajgfdb, bndkfmmbidllaiccmpnbdonijmicaafn, and pcdgkgbadeggbnodegejccjffnoakcoh.

BeyondTrust Vulnerability Targeted by Hackers Within 24 Hours of PoC Release

www.securityweek.com · 8 months ago

Hackers are actively exploiting a critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access products. The flaw, identified as CVE-2026-1731, allows for unauthenticated remote code execution and impacts thousands of deployments. Attack attempts began within 24 hours of a proof-of-concept exploit being released, with one IP address accounting for the majority of reconnaissance activity. This vulnerability is particularly concerning given BeyondTrust products' widespread use and history of exploitation by threat actors, including those linked to state-sponsored groups.

The democratization of AI data poisoning and how to protect your organization

www.csoonline.com · 8 months ago

AI models are now vulnerable to data poisoning attacks that require fewer malicious inputs than previously thought, with as few as 250 corrupted files capable of distorting model behavior. Attackers can easily inject harmful or biased data into training pipelines, potentially leading to model decay and the insertion of hidden backdoors, such as those capable of data exfiltration. Protecting AI systems involves establishing a clean, validated baseline model, implementing regular resets, and rigorously monitoring incoming data for anomalies, similar to web application filtering. Organizations should prioritize model integrity and assume attempts to manipulate AI behavior will occur.

npm’s Update to Harden Their Supply Chain, and Points to Consider

thehackernews.com · 8 months ago

Following the Sha1-Hulud incident, npm implemented changes including revoking classic tokens and defaulting to session-based tokens with multi-factor authentication for publishing. However, vulnerabilities remain, as attackers can still obtain short-lived tokens through MFA phishing and developers can create bypass tokens similar to the old system. To further improve security, it's recommended to adopt Open ID Connect, enforce MFA for local package uploads, and build packages from verifiable source code to minimize the risk of malicious artifacts. Chainguard Libraries for JavaScript builds from upstream source code, eliminating malware found in 98.5% of compromised packages.

Malicious Chrome AI Extensions Target 260,000 Users with Injected Iframes

gbhackers.com · 8 months ago

Security researchers have identified a coordinated campaign involving thirty malicious Chrome extensions disguised as AI assistants, impacting over 260,000 users. These extensions, which appeared legitimate in the Chrome Web Store, secretly inject iframes and extract data from browser tabs and Gmail accounts, sending it to external servers controlled by the tapnetic[.]pro domain. Attackers use "extension spraying" to evade detection and quickly republish replacements when extensions are removed. The malicious extensions leverage techniques like masquerading and data exfiltration.

CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities

www.securityweek.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning regarding several actively exploited vulnerabilities. A security bypass flaw, tracked as CVE-2025-40536, exists in SolarWinds Web Help Desk, potentially allowing unauthorized access and remote code execution. Additionally, a buffer overflow vulnerability in Apple, CVE-2026-20700, and an update integrity verification flaw in Notepad++, CVE-2025-15556, have been exploited in sophisticated attacks. A critical SQL injection vulnerability, CVE-2024-43468, in Microsoft Configuration Manager has also been added to the list, though prior exploitation reports are limited.