Blahalla

Gail Slater Leaves Role as Justice Dept.’s Antitrust Chief

www.nytimes.com · 8 months ago

false

Romania's oil pipeline operator Conpet confirms data stolen in attack

www.bleepingcomputer.com · 8 months ago

Romanian oil pipeline operator Conpet S.A. confirms a data breach by the Qilin ransomware gang. The attackers stole nearly 1 terabyte of data, including confidential documents with personal information like names, addresses, and bank account details. Conpet is working with the Romanian National Cyber Security Directorate to investigate the incident. The company warns potentially affected individuals to be cautious of fraudulent requests.

‘Dead’ Outlook add-in hijacked to phish 4,000 Microsoft Office Store users

www.csoonline.com · 8 months ago

A hacker hijacked an abandoned Outlook add-in called AgreeTo to conduct a phishing campaign targeting Microsoft Office Store users. The attacker exploited a weakness in Microsoft’s add-in delivery architecture, which allows for live content fetching from developer servers, bypassing the initial review process. This allowed them to redirect users to a fake Microsoft sign-in page, successfully stealing credentials from approximately 4,000 users. The attacker also operated multiple phishing kits impersonating various financial institutions, and Microsoft has since removed AgreeTo from its marketplace.

Microsoft’s February Patch Tuesday Fixes 6 Zero-Days Under Attack

www.techrepublic.com · 8 months ago

Microsoft has released security updates for 58 vulnerabilities across Windows, Office, and related products. Six of these vulnerabilities are zero-day flaws, meaning they are actively exploited. Several vulnerabilities allow attackers to bypass security features, execute code, or gain elevated privileges. Affected CVEs include CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21533, and CVE-2026-21525. The Cybersecurity and Infrastructure Security Agency has added these vulnerabilities to its Known Exploited Vulnerabilities catalog, setting a March 3 deadline for federal agencies to patch.

Laid-Off Battery Plant Workers Pin Blame on Ford, not Trump, for Lost Jobs

www.nytimes.com · 8 months ago

false

Urgent warnings from UK and US cyber agencies after Polish energy grid attack

www.fortra.com · 8 months ago

NULL

Neue Warn-App für Cybervorfälle gestartet

www.csoonline.com · 8 months ago

A new smartphone application called CYROS is now available to warn users about cyber threats. Developed by the Cyberintelligence Institute, the app compiles security alerts from agencies like the German Federal Office for Information Security and consumer protection organizations. CYROS organizes these alerts by topic, region, and state, providing tailored information and assistance. The application aims to empower users to take action and improve overall cybersecurity in Germany.

Dutch mobile phone giant Odido announces data breach

therecord.media · 8 months ago

Dutch mobile phone provider Odido recently confirmed a cyberattack resulting in the theft of customer data. Approximately 6.2 million people had their personal information stolen, including names, bank account numbers, and identification documents. The attack occurred on February 7th and involved a compromised customer contact system. Odido is contacting affected customers and warning them about potential phishing attempts.

Odido data breach exposes personal info of 6.2 million customers

www.bleepingcomputer.com · 8 months ago

Dutch telecommunications provider Odido has confirmed a cyberattack resulting in a data breach impacting 6.2 million customers. Attackers gained access to a customer contact system, potentially exposing personal information like names, addresses, mobile numbers, customer numbers, email addresses, IBANs, dates of birth, and identification data. Passwords, call logs, billing information, and scans of identification documents were not compromised. Odido has secured the system, notified authorities, and is informing affected customers.

Google Reports State-Backed Hackers Using Gemini AI for Recon and Attack Support

thehackernews.com · 8 months ago

Google has observed the North Korean hacking group UNC2970, linked to Lazarus Group, using the Gemini AI model for reconnaissance, including profiling targets within the cybersecurity and defense sectors. Several other threat actors are also leveraging generative AI tools: UNC6418 for credential gathering, Temp.HEX and APT31 for dossier creation and vulnerability analysis, APT41 for exploit code troubleshooting, UNC795 for web shell development, and APT42 for social engineering and reconnaissance. New malware like HONESTCUE utilizes Gemini’s API to generate malicious code, and campaigns like ClickFix leverage AI sharing features for malware delivery; researchers have also identified attacks aimed at extracting information from AI models. A proof-of-concept demonstrated an 80.1% accuracy rate in replicating a model's behavior using just 1,000 queries, highlighting the risk of model behavior exposure. CVE-2025-8088 is referenced.

Cisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of input received by an affected device. An attacker could exploit this vulnerability by getting the affected device to render crafted text, for example, a crafted meeting invitation. As indicated in the CVSS score, no user interaction is required, such as accepting the meeting invitation. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tce-roomos-dos-9V9jrC2q <br/Security Impact Rating: High <br/CVE: CVE-2026-20119

WordPress plugin with 900k installs vulnerable to critical RCE flaw

www.bleepingcomputer.com · 8 months ago

A critical vulnerability, tracked as CVE-2026-1357, has been identified in the WPvivid Backup & Migration WordPress plugin, affecting over 900,000 websites. This flaw allows for remote code execution by unauthorized individuals through arbitrary file uploads, potentially leading to complete website takeover. The issue stems from improper error handling during RSA decryption and a lack of file sanitization, enabling directory traversal and the uploading of malicious files. A security update, version 0.9.124, has been released to address the vulnerability, and users are strongly advised to update immediately.

A hard truth in Munich: Cyber defense runs through Silicon Valley

therecord.media · 8 months ago

false

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

thehackernews.com · 8 months ago

Cybersecurity researchers have identified a coordinated malicious package campaign, codenamed graphalgo, targeting developers via fake job postings on platforms like LinkedIn, Reddit, and Facebook. The Lazarus Group, linked to North Korea, is believed to be behind the campaign, which involves establishing fake companies and repositories to distribute malicious packages through npm and PyPI. These packages act as a conduit to deploy a remote access trojan capable of stealing data and performing various system actions, protected by a token-based communication mechanism. Additionally, researchers discovered a malicious npm package called "duer-js" that steals sensitive data and a new extortion campaign utilizing the "npm install" command to demand cryptocurrency payments.

FTC push for age verification a ‘major landmark’ for spread of the tool

therecord.media · 8 months ago

false

How to Eliminate the Technical Debt of Insecure AI-Assisted Software Development

www.securityweek.com · 8 months ago

false

California fines Disney $2.75 million for data privacy violations

therecord.media · 8 months ago

California regulators have reached a $2.75 million settlement with Disney regarding alleged violations of the California Consumer Privacy Act. The state attorney general claims Disney’s opt-out processes were inadequate, making it difficult for consumers to prevent data sharing and sales across devices and services. Disney has agreed to implement a comprehensive privacy program and provide regular compliance updates to the state. This is the largest fine ever levied under the CCPA and follows a previous $10 million penalty from the Federal Trade Commission for child privacy violations.

US wants cyber partnerships to send ‘coordinated, strategic message’ to adversaries

therecord.media · 8 months ago

false

Anthropic Donates $20 Million to Super PAC Operation to Counter OpenAI

www.nytimes.com · 8 months ago

false

AMOS infostealer targets macOS through a popular AI app

www.bleepingcomputer.com · 8 months ago

Researchers have identified the AMOS infostealer as a significant threat within the cybercrime landscape, operating as a data collection engine for stolen credentials and sensitive information. Attackers are increasingly exploiting popular AI applications, like OpenClaw, and even leveraging ChatGPT to distribute the malware through compromised skills and malicious installation guides. Distribution methods include fake software installers, SEO poisoning, and social engineering tactics that trick users into executing malware themselves. The AMOS ecosystem functions as a Malware-as-a-Service model, with developers selling the stealer platform to downstream threat actors who then monetize the stolen data.

Im Fokus: Emerging Technologies

de.resources.csoonline.com · 8 months ago

Emerging technologies such as artificial intelligence, quantum computing, extended reality, edge computing and digital twins are driving profound changes in manufacturing by improving efficiency, security and innovation. They are reshaping how companies operate, remain competitive and deliver value in a rapidly evolving digital landscape.

Nation-state hackers ramping up use of Gemini for target reconnaissance, malware coding, Google says

therecord.media · 8 months ago

Nation-state hackers from China, North Korea, and Iran are increasingly using Google’s Gemini AI tool to enhance their cyberattacks. Threat actors are leveraging Gemini for target reconnaissance, malware coding, and automating tasks like creating convincing phishing emails and generating targeted testing plans. A new malware framework called HONESTCUE has been identified, which utilizes Gemini’s API to generate malicious code, blurring the lines between legitimate AI use and malicious activity. Google has disabled assets used by some groups but notes the tool is being used for a wide range of malicious purposes.

ORB Networks Leverages Compromised IoT Devices and SOHO Routers to Mask Cyberattacks

gbhackers.com · 8 months ago

Advanced threat actors are using covert, mesh-based infrastructures called Operational Relay Boxes, or ORBs, to conceal the origins of cyberattacks. These networks are built from compromised IoT devices, SOHO routers, and Virtual Private Servers, enabling attackers to blend malicious traffic with legitimate user activity. Researchers have observed the increasing use of ORBs by China-nexus espionage groups like UNC3886, who exploited a zero-day vulnerability in Singaporean telecommunications networks, resulting in data exfiltration. Singapore is implementing strict router security measures, but a significant number of older devices remain vulnerable and can be incorporated into these anonymizing networks.

Fake AI Chrome extensions with 300K users steal credentials, emails

www.bleepingcomputer.com · 8 months ago

A campaign of 30 malicious Chrome extensions, dubbed AiFrame, has impacted over 300,000 users by impersonating AI assistants. These extensions steal credentials, email content, and browsing data by rendering content from a remote domain and using the Mozilla Readability library to extract data from visited websites. Some extensions specifically target Gmail data, capturing email content and drafts, and may also use voice recognition to transmit information to external servers. Google has not yet responded to the findings.

287 Malicious Chrome Extensions Steal Browsing Data from 37.4 Million Users

gbhackers.com · 8 months ago

Researchers have identified 287 malicious Chrome extensions that have secretly collected and sent browsing data to remote servers, affecting approximately 37.4 million users. The investigation used automated testing to analyze network traffic, revealing extensions sending full URLs or parts of them to third parties. Data collection involved entities like Similarweb, Curly Doggo, and others, and the leaked URLs may contain sensitive information useful for targeted attacks. Users are advised to remove unrecognized extensions, review permissions, and monitor browser activity.

WhatsApp says Russia tried to fully block platform, push users to state app

therecord.media · 8 months ago

Russia has attempted to block the WhatsApp messaging application, impacting over 100 million users, in an effort to encourage adoption of a state-backed messaging platform called Max. This action follows Meta, WhatsApp’s parent company, being designated as an extremist organization and banned in Russia. Authorities removed WhatsApp’s domain records from Russia’s National Domain Name System, hindering connection without a virtual private network. This escalation follows previous restrictions on Telegram and other platforms, and is part of a broader effort by Russia to control online communication.

DragonForce Ransomware Group Targets 363 Companies, Expands Cartel-Like Operations Since 2023

gbhackers.com · 8 months ago

The DragonForce ransomware group has rapidly evolved into a cartel-like operation since late 2023, operating under a Ransomware-as-a-Service model and recruiting affiliates. They have targeted 363 organizations through December 2025, with a peak of 35 victims disclosed in December 2025. DragonForce’s infrastructure includes RansomBay, a service for generating customized payloads, and actively engages in the cybercrime underground through platforms like BreachForums. Technical modifications include changes to file metadata encryption and the addition of extension-based encryption modes for various file types.

SSH Worm Exploit Detected by DShield Sensor Using Credential Stuffing and Multi-Stage Malware

gbhackers.com · 8 months ago

A DShield honeypot sensor recently detected a self-replicating SSH worm exploiting weak passwords to compromise Linux systems. The attack began with a brute-force login using the credentials "pi / raspberryraspberry993311" and quickly escalated to the deployment of a malicious bash script, establishing persistence and command-and-control communication over IRC. The worm then scanned for vulnerable systems using tools like zmap and sshpass, rapidly propagating across the internet and attempting to infect them with the same credential pairs. This incident highlights the continuing threat of default passwords and the vulnerability of devices like Raspberry Pis to botnet recruitment.

Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection

www.csoonline.com · 8 months ago

Researchers have identified a new phishing campaign delivering the XWorm remote access trojan, combining familiar techniques with fileless execution to evade detection. The campaign uses phishing emails with malicious Excel add-ins that exploit CVE-2018-0802, a known vulnerability in Microsoft Office. Attackers leverage HTA and PowerShell to load additional components, ultimately deploying a modular XWorm core with encrypted command-and-control capabilities, including plugin support for actions such as credential theft and data exfiltration. Experts emphasize that robust post-compromise controls are crucial to mitigating the risk, as the entry vector and tools used are readily available.

Feiniu NAS Devices Hit in Massive Netdragon Botnet Attack Exploiting Unpatched Vulnerabilities

gbhackers.com · 8 months ago

Attackers have compromised thousands of Feiniu NAS devices, incorporating them into the Netdragon botnet for distributed denial-of-service attacks. The malware establishes an HTTP backdoor on port 57132, allowing remote command execution. To maintain persistence, the malware removes logs, disables updates, and deploys systemd services and kernel modules. The botnet actively evolves to evade detection and remediation efforts, including deleting critical files like rsaprivatekey.pem.

ApolloMD Data Breach Impacts 626,000 Individuals

www.securityweek.com · 8 months ago

A cyberattack occurred at ApolloMD in May 2025, impacting over 626,000 individuals. Hackers gained access to files containing personal and health information, including names, addresses, dates of birth, and health insurance details, and potentially Social Security numbers. The Qilin ransomware group claimed responsibility for the attack, posting data on a leak site. ApolloMD has notified affected individuals and is offering free credit monitoring services.

$44 Evilmouse Malware Grants Attackers Full Control of Systems Upon Connection

gbhackers.com · 8 months ago

A new threat, called EvilMouse, demonstrates how a standard computer mouse can be weaponized to compromise systems. The device, costing around $44 to build, functions as a keystroke injector, executing pre-programmed commands to gain administrator-level access within seconds. EvilMouse bypasses antivirus software and maintains full mouse functionality to avoid detection, exploiting a lack of security awareness surrounding peripheral devices. Security experts recommend stricter hardware policies, endpoint detection systems, and expanded security training to address this emerging threat.

3D Printer Surveillance

www.schneier.com · 8 months ago

A proposed bill in New York seeks to mandate surveillance technology on 3D printers. The legislation requires printers to include software that scans print files for potential firearm components and blocks any flagged items. This "blocking technology" mirrors previous attempts to restrict computer functionality, similar to Digital Rights Management systems. Critics argue the solution is ineffective and raises privacy concerns.

I kept finding security issues in AI-generated code, so I built a scanner for it

codearmor-ai.vercel.app · 8 months ago

NULL

ThreatsDay Bulletin: AI Prompt RCE, Claude 0-Click, RenEngine Loader, Auto 0-Days & 25+ Stories

thehackernews.com · 8 months ago

Cybersecurity researchers have identified a new malware framework, VoidLink, developed with possible AI assistance to facilitate long-term intrusions into cloud and enterprise environments. The framework utilizes AI for cloud fingerprinting, container exploitation, and kernel-level stealth, observed in campaigns by the threat actor UAT-9921. This development represents a shift towards blending malicious activity with normal operations, requiring improved detection methods. Security professionals are urged to focus on identifying misuse of legitimate access and abnormal behavior.

Microsoft to Enable ‘Windows Baseline Security’ With New Runtime Integrity Safeguards

www.securityweek.com · 8 months ago

Microsoft is introducing Windows Baseline Security Mode to enhance user safety and provide greater transparency. This new mode will restrict the execution of unsigned applications, drivers, and services, preventing unauthorized changes. Users will have the option to override these safeguards when necessary, and developers will gain insight into the conditions under which their applications run. Microsoft is also updating Secure Boot certificates and introducing User Transparency and Consent to notify users about sensitive resource access.

Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Exposing Critical TTPs

gbhackers.com · 8 months ago

Cybercriminals linked to the Muddled Libra group, also known as Scattered Spider, used a rogue virtual machine within a VMware vSphere environment to compromise a victim's network. The attackers created a virtual machine to establish a beachhead, download stolen certificates, and exfiltrate data, including Active Directory information and Snowflake datasets. They leveraged tools like Chisel, ADRecon, and RDP to move laterally and troubleshoot exfiltration paths, even while Microsoft Defender flagged some of their tools. Analysts recommend monitoring VMware, ESXi, and Snowflake activity, alongside implementing identity-centric controls and layered security solutions to detect and prevent similar attacks.

HPE Aruba Flaw Exposes Networking Devices to Privilege Escalation and DoS Attacks

gbhackers.com · 8 months ago

HPE Aruba Networking has released a security advisory addressing vulnerabilities in its Private 5G Core Platform. The flaws, including CVE-2026-23595, CVE-2026-23596, CVE-2026-23597, and CVE-2026-23598, could allow attackers to create administrative accounts, disrupt services, and expose sensitive information. One critical vulnerability allows unauthenticated attackers to bypass authentication and create privileged user accounts. HPE recommends upgrading to version 1.25.1.0 or higher to resolve these issues.

Hacktivists, State Actors, Cybercriminals Target Global Defense Industry, Google Warns

www.securityweek.com · 8 months ago

Google’s Threat Intelligence Group reports a significant increase in cyberattacks targeting the global defense industrial base. State-sponsored actors from China, Russia, Iran, and North Korea, along with hacktivists and cybercriminals, are conducting these operations, often employing ransomware. Attackers are increasingly exploiting vulnerabilities in hiring processes, personal devices, and edge appliances to evade detection, and one Russian group is utilizing large language models for reconnaissance and social engineering. Groups like APT44 and UNC4841 are among those identified in these campaigns.

YAML Merge Tags and More Parser Differentials

blog.darkforge.io · 8 months ago

Researchers have discovered techniques to create YAML files that produce different interpretations when processed by various parsers. This is achieved by exploiting nuances in how parsers handle merge tags, anchors, and key names, allowing for manipulation of the final output value. Specifically, a combination of the regexp merge tag, anchors, and complex key mappings can control parser behavior, even avoiding duplicate key errors in some implementations while triggering them in others. The findings demonstrate vulnerabilities arising from parser differentials and the lack of consistent YAML implementation across different programming languages like Go, Ruby, Node.js, and Python.

The CTEM Divide: Why 84% of Security Programs Are Falling Behind

thehackernews.com · 8 months ago

A new study reveals a significant divide in enterprise security programs, with only 16% implementing Continuous Threat Exposure Management (CTEM). Organizations utilizing CTEM demonstrate substantially improved attack surface visibility, solution adoption, and threat awareness compared to those who don't. Security leaders are largely aware of CTEM's benefits but struggle with implementation due to organizational challenges and competing priorities. The research highlights that attack surface complexity is a key risk multiplier, and traditional security methods are insufficient for managing increasingly complex environments.

TURN Security Threats: A Hacker's View

www.enablesecurity.com · 8 months ago

false

Ford Will Make a Play for a Different Battery Market

www.nytimes.com · 8 months ago

false

These states have the smartest, friendliest people, according to ChatGPT

www.washingtonpost.com · 8 months ago

false

The ephemeral infrastructure paradox: Why short-lived systems need stronger identity governance

www.csoonline.com · 8 months ago

Modern cloud infrastructure is rapidly evolving, but identity governance hasn't kept pace, creating a significant security risk. Organizations often generate far more machine identities, like service accounts and API keys, than human user accounts, frequently exceeding a 10-to-1 ratio. This lack of control over these identities, coupled with relaxed security in test environments, can lead to vulnerabilities like the Microsoft Midnight Blizzard attack, where attackers exploited a legacy test tenant. To address this, organizations should shift towards cryptographic identity, eliminate static credentials by shortening their lifespan, and automate the cleanup of unused permissions to enhance security and velocity.

Chrome Security Update Released to Address Code Execution Vulnerabilities

gbhackers.com · 8 months ago

Google has released Chrome version 145 to address 11 security vulnerabilities across Windows, Mac, and Linux systems. The update resolves several high-severity issues, including a use-after-free vulnerability CVE-2026-2313, a heap buffer overflow CVE-2026-2314, and an inappropriate implementation in WebGPU CVE-2026-2315. Several medium and low-severity vulnerabilities are also fixed, with rewards paid to researchers for their discoveries. Users are urged to update their browsers to version 145.0.7632.45 or 145.0.7632.46 to prevent potential code execution attacks.

Nucleus Raises $20 Million for Exposure Management

www.securityweek.com · 8 months ago

false

WordPress Backup Plugin Vulnerability Exposes 800,000 Sites to Remote Code Execution Attacks

gbhackers.com · 8 months ago

A critical vulnerability, tracked as CVE-2026-1357, affects the WPvivid Backup & Migration plugin, potentially compromising over 800,000 WordPress websites. This flaw allows unauthenticated attackers to upload and execute arbitrary code, leading to remote code execution and potential full site takeover. The vulnerability stems from improper error handling during decryption and inadequate file path sanitization. A patch, version 0.9.124, has been released to address the issue, and users are strongly advised to update immediately.

Senegalese Data Breaches Expose Lack of Security Maturity

www.darkreading.com · 8 months ago

A ransomware group called The Green Blood Group recently breached the Directorate of File Automation in Senegal, exfiltrating biometric data, immigration records, and other sensitive information belonging to nearly 20 million residents. This incident, along with a separate attack on Sénégal Numérique SA, highlights a broader cybersecurity challenge across Africa where digital ambitions have outpaced security maturity. Experts warn the data breach could erode public trust and hinder digital initiatives, and it underscores a need for increased investment in data protection, governance, and cybersecurity infrastructure. The group has also targeted organizations in Colombia and India.

Palo Alto Networks Firewall Vulnerability Lets Attackers Trigger Reboot Loops

gbhackers.com · 8 months ago

A vulnerability has been identified in Palo Alto Networks firewalls, specifically within the Advanced DNS Security feature. The flaw, tracked as CVE-2026-0229, allows unauthenticated attackers to trigger repeated reboots, potentially leading to a maintenance mode state and disrupting network connectivity. The issue affects devices with ADNS enabled and specific security profile configurations, but Cloud NGFW and Prisma Access are not impacted. Palo Alto Networks recommends upgrading to a fixed release to resolve the denial of service condition.