Blahalla

Fake Solidity VSCode extension on Open VSX backdoors developers

www.bleepingcomputer.com · 9 months ago

A remote access trojan named SleepyDuck, disguised as a Solidity extension in the Open VSX registry, backdoors developers by activating on editor startup, when a Solidity file is opened, or when the compile command is run. It was initially benign on submission but received malicious capabilities in an update after tens of thousands of downloads and has been downloaded more than fifty three thousand times. SleepyDuck masquerades as legitimate code, creates a lock file to persist, collects system data including hostname, username, MAC address and timezone, and sets up a command execution sandbox. The malware uses an Ethereum smart contract to store and update its command and control server address for resilient C2, polls for commands, and exfiltrates data via POST requests.
Lawmakers ask FTC to probe Flock Safety’s cybersecurity practices

therecord.media · 9 months ago

Lawmakers led by Senator Ron Wyden and Representative Raja Krishnamoorthi asked the Federal Trade Commission to investigate Flock Safety over reportedly poor cybersecurity practices. Flock does not require multi factor authentication for law enforcement customers and its voluntary authentication does not natively support phishing resistant MFA, and the letter cites data saying at least 35 customer accounts were stolen. Flock operates automated license plate readers in more than 8,000 communities, has received taxpayer funding to build a national surveillance network, and lawmakers warned that weak protections and password sharing can expose the locations of millions of Americans and risk misuse in sensitive investigations.
Cargo theft gets a boost from hackers using remote monitoring tools

therecord.media · 9 months ago

Cybercriminals are targeting trucking and logistics companies by infiltrating load boards and compromising email accounts to advertise fraudulent loads and send malicious links that install legitimate remote monitoring and management tools such as ScreenConnect, PDQ Connect and Fleetdeck. After gaining access, attackers perform system and network reconnaissance and deploy credential harvesting tools, working with organized crime to identify and bid on profitable loads for theft, contributing to a trend that saw cargo theft rise 27 percent in 2024 with industry losses estimated at 35 billion dollars annually. Researchers recommend restricting installation of remote monitoring tools, deploying network detections, avoiding downloading executable files from email, and implementing a coordinated federal and industry response to counter cyber enabled cargo theft.
Data breach costs lead to 90% drop in operating profit at South Korean telecom giant

therecord.media · 9 months ago

There was a 90 percent drop in operating profit at SK Telecom in the third quarter to 48.4 billion won from 493 billion won a year earlier, with sales down 12.2 percent and the company suspending its third quarter dividend. The decline was driven by compensation and recovery costs from a large scale cyberattack disclosed in April that exposed personal data for about 27 million customers; the intrusion dated to 2022 and involved 25 types of malware that went undetected for nearly three years, and stolen data included subscriber identity numbers, authentication keys, network activity logs and SIM stored text messages. Regulators imposed a record 134 billion won fine and ordered a cybersecurity overhaul, while the company offered SIM replacements, suspended new subscriptions, and launched a 500 billion won customer package of discounts and fee waivers that increased churn and further eroded revenue. A separate breach at Lotte Card in August exposed data for three million customers after attackers exploited a server vulnerability that had been unpatched since 2017.
On the Road Again: Hackers Hijack Physical Cargo Freight

www.darkreading.com · 9 months ago

Researchers uncovered a campaign, active since at least June 2025, in which threat actors compromise load board and email accounts to post fake freight listings, phish carriers, install remote monitoring and management tools, bid on real loads, and then intercept and steal shipments. Attackers have used a range of RMM tools including ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve and rely on tactics such as double brokering and delivery to mule controlled warehouses to physically remove goods. The activity increases supply chain risk and recommended mitigations include restricting unapproved RMM installs, implementing network detections, refusing executable downloads from external emails, training staff to identify phishing, and reviewing the National Motor Freight Traffic Association Cargo Crime Reduction Framework.
MSSQL Exploitation - Run Commands Like A Pro

www.reddit.com · 9 months ago

There are multiple MSSQL attack vectors that allow remote command execution and persistence, including abuse of extended stored procedures such as xpcmdshell, xpdirtree, xpfilelist, xpregread, xpregwrite, and spexecutesql, often reached via SQL injection or verbose web application error messages. Attackers can enumerate and exploit linked servers using remote execution syntax to enable xpcmdshell on other instances, use C2 frameworks and binary on the fly techniques to run assemblies and download executables, and force file access routines to capture NTLMv2 hashes for cracking or relaying. Misconfiguration and exposed links between servers frequently permit blind command execution, lateral movement, and durable persistence on database hosts, so organizations should harden MSSQL configurations and monitor for atypical stored procedure usage.
Microsoft: SesameOp malware abuses OpenAI Assistants API in attacks

www.bleepingcomputer.com · 9 months ago

There is a backdoor named SesameOp that Microsoft Detection and Response Team discovered in July 2025 which uses the OpenAI Assistants API as a covert command and control channel and allowed threat actors to maintain persistent access to compromised environments for several months. SesameOp fetches compressed and encrypted commands from the Assistants API and posts encrypted results back through the same channel using layered symmetric and asymmetric encryption, and the infection chain includes a heavily obfuscated Netapi64.dll loader and a.NET backdoor that injects into Microsoft Visual Studio utilities via AppDomainManager injection with internal web shells and strategically placed malicious processes for long term espionage. To mitigate this threat organizations are advised to audit firewall and web server logs enable tamper protection run endpoint detection and response in block mode review perimeter firewall and proxy settings and monitor unauthorized external connections and Microsoft and OpenAI collaborated to identify and disable the account and API key used noting the attack was misuse of API capabilities rather than a platform vulnerability and that the Assistants API is scheduled for deprecation in August 2026.
Malicious VSX Extension "SleepyDuck" Uses Ethereum to Keep Its Command Server Alive

thehackernews.com · 9 months ago

A malicious extension in the Open VSX registry contains a remote access trojan called SleepyDuck and was first published as a benign library on October 31, 2025 before being updated to a malicious release on November 1, 2025 after about 14,000 downloads. The malware triggers when a new code editor window opens or a Solidity file is selected, locates the fastest Ethereum RPC provider, and uses a smart contract on the blockchain to store and update its command and control server so the operator can recover or change the server if it is taken down. It gathers system details including hostname, username, MAC address and timezone, exfiltrates that data, polls for commands every 30 seconds, and can push new configuration or emergency commands to infected hosts. Related malicious extensions were also distributed via the Visual Studio Code marketplace that drop a batch script miner, escalate privileges, and modify Defender exclusions, and users are advised to only install extensions from trusted publishers.
US cybersecurity experts indicted for BlackCat ransomware attacks

www.bleepingcomputer.com · 9 months ago

Three former employees of cybersecurity incident response companies DigitalMint and Sygnia have been indicted for allegedly hacking the networks of five U.S. companies as ALPHV BlackCat ransomware affiliates between May 2023 and November 2023. The defendants are Kevin Tyler Martin of Roanoke Texas, who pleaded not guilty, Ryan Clifford Goldberg of Watkinsville Georgia, who has been in federal custody since September 2023, and an unnamed co conspirator, and they face charges of conspiracy to interfere with interstate commerce by extortion and intentional damage to protected computers with potential prison sentences of up to twenty years for extortion and ten years for damage to computer systems. Prosecutors say the group gained unauthorized access, stole data, deployed encryption malware, and demanded ransoms ranging from three hundred thousand to ten million dollars, with one Tampa medical device company paying one million two hundred seventy thousand dollars after a ten million dollar demand in May 2023. Federal authorities say BlackCat affiliates have been linked to dozens of breaches and at least hundreds of millions of dollars in ransom payments, and agencies including the FBI, CISA and the Department of Health and Human Services previously warned that BlackCat affiliates primarily target United States healthcare organizations.
Sniffing established BLE connections with HackRF One

www.reddit.com · 9 months ago

There are three main challenges to sniffing established, frequency hopping Bluetooth Low Energy connections with a software defined radio such as the HackRF One: transmit power imbalance between endpoints, following channel hopping despite USB latency, and deducing the hopping sequence without observing the CONNECT IND frame. The methodology relies on BLE link layer and Bluetooth 5.0 channel hopping details, focusing on Algorithm 2 where the data channel is computed from the access address, channel map, and connection event counter using a pseudo random number generator and remapping step. Practical techniques include IQ sampling and filtering, timing analysis to recover anchors and counters, and selective tuning to mitigate SDR limitations, which enables security audits and reverse engineering of proprietary protocols while remaining constrained by hardware latency and signal power differences.
PAN-SA-2025-0017 Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION (Severity: INFORMATIONAL)

security.paloaltonetworks.com · 9 months ago

Prisma SD-WAN ION is not impacted by the evaluated open source software vulnerability because devices do not allow the ProxyCommand directive and sshconfig cannot be modified. There is one CVE referenced, CVE-2025-61984, and there are no scenarios identified that would allow an attacker to exploit this issue in Prisma SD-WAN ION and no known malicious exploitation. No software updates are required at this time and the advisory was published November 3, 2025.
SesameOp: Novel backdoor uses OpenAI Assistants API for command and control

www.microsoft.com · 9 months ago

A novel backdoor named SesameOp abuses the OpenAI Assistants API as a covert command and control channel to store and relay encrypted, compressed commands and to return execution results. Microsoft Incident Response investigators discovered SesameOp in July 2025 after finding internal web shells and compromised Microsoft Visual Studio utilities that loaded malicious libraries and enabled.NET AppDomainManager injection. The infection chain uses a loader Netapi64.dll and a heavily obfuscated.NET backdoor OpenAIAgent.Netapi64 protected with Eazfuscator.NET, layered symmetric and asymmetric encryption, compression, and optional proxying to maintain stealth and long term persistence for espionage. Microsoft and OpenAI jointly investigated, disabled the suspected API key and account, and continue collaborating to disrupt misuse of the Assistants API which is scheduled for deprecation in August 2026.
Hackers use RMM tools to breach freighters and steal cargo shipments

www.bleepingcomputer.com · 9 months ago

Threat actors are targeting freight brokers and trucking carriers with malicious links and emails to deploy remote monitoring and management tools such as ScreenConnect, NetSupport, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve, with campaigns traced back to January and nearly two dozen campaigns recorded since August sending up to a thousand messages each. Attackers use compromised load board accounts and hijacked email threads to trick dispatchers into installing RMMs, then perform reconnaissance and credential harvesting with tools like WebBrowserPassView and information stealers including DanaBot, Lumma Stealer, NetSupport and StealC, allowing them to delete booking emails, block notifications, add devices to phone extensions, impersonate carriers, reroute shipments and enable physical theft of goods. Researchers report the activity primarily targets North American companies but has been observed globally, is believed to involve organized crime, and recommended defenses include restricting unapproved RMM installations, monitoring network activity, and blocking EXE and MSI file attachments at the email gateway.
Ukrainian Extradited to US Faces Charges in Jabber Zeus Cybercrime Case

www.securityweek.com · 9 months ago

A Ukrainian national named Yuriy Igorevich Rybtsov, also known as MrICQ, has been extradited from Italy to the United States to face charges alleging he was a developer for the Jabber Zeus cybercrime group. The Jabber Zeus operation used the Zeus banking trojan and Jabber instant messaging alerts to capture bank account credentials and one time passcodes, which the group then used with social engineering to make fraudulent transfers that stole millions and defrauded multiple US banks. Rybtsov is identified in a 2012 indictment as John Doe number three and is accused of handling notifications of newly compromised organizations and laundering illegal proceeds. He lost a final appeal against extradition in April 2025 and is currently in US custody under an FBI arrest warrant.
OpenAIs Aardvark soll Fehler im Code erkennen und beheben

www.csoonline.com · 9 months ago

OpenAI has introduced Aardvark, an autonomous agent built on GPT-5 that scans, understands, and patches code by emulating a human security researcher. Unlike conventional scanners, Aardvark maps repositories, builds contextual threat models, monitors commits, validates potential exploits in a sandbox, and integrates with Codex to propose and re-verify patches, reducing false positives. In benchmark tests it identified 92 percent of known and synthetic vulnerabilities in test repositories, and its use on open source projects uncovered multiple real flaws, ten of which received official CVE identifiers. OpenAI will offer selected noncommercial open source projects free scanning under a coordinated disclosure process to help maintainers fix issues and shift security left by embedding continuous protection into development pipelines.
Japanese retailer Askul confirms data leak after cyberattack claimed by Russia-linked group

therecord.media · 9 months ago

Japanese office and household goods retailer Askul confirmed that customer and supplier data were leaked following a ransomware attack in October, exposing contact information and inquiry details from users of its online stores Askul, Lohaco and Soloel Arena as well as supplier data stored on internal servers. The RansomHouse extortion group claimed responsibility and alleges it stole 1.1 terabytes of data, and the incident disrupted supply chains used by retailers including Ryohin Keikaku and The Loft. Askul said it is investigating the incident and apologized for the inconvenience, while researchers link RansomHouse to Russia aligned threat actors known for threatening public release of exfiltrated information rather than encrypting systems.
Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching

www.bleepingcomputer.com · 9 months ago

An out of band security update that patched an actively exploited Windows Server Update Service vulnerability disabled hotpatching on some Windows Server 2025 devices. The emergency update KB5070881 was released the same day security firms confirmed the critical remote code execution vulnerability CVE 2025 59287 was being exploited and a proof of concept exploit was published. Microsoft removed the update from machines enrolled for hotpatching and said systems that already installed it will not receive hotpatch updates in November and December and will instead get regular monthly updates that require a restart until they rejoin the hotpatch rollout after the planned January 2026 baseline. Administrators who have downloaded but not installed the buggy update are advised to install KB5070893 to patch CVE 2025 59287 without breaking hotpatching so enrolled machines remain eligible for hotpatch updates.
OAuth Device Code Phishing: Azure vs. Google Compared

www.bleepingcomputer.com · 9 months ago

There is a device code phishing technique that abuses the OAuth 2.0 device authorization flow by tricking victims into entering a device code so attackers can poll the provider and retrieve the resulting access and refresh tokens. Azure’s implementation allows attackers to specify client identifier and resource and relies on publicly known families of client identifiers, enabling generation of highly privileged tokens including primary refresh tokens that can be used to access email and files, join rogue devices to a tenant, and create MFA enrollments. Google’s implementation restricts the device code flow to a very small set of narrow scopes, requires creating and verifying OAuth applications for broader permissions, and does not expose public client identifiers, which greatly reduces the attack surface for this technique.
RondoDox v2: When an IoT Botnet Goes Enterprise-Ready

www.reddit.com · 9 months ago

There is a reported 650 percent increase in exploit vectors compared to version one documented by FortiGuard Labs, with more than fifteen exploitation vectors ranging from two CVEs to enterprise grade attacks. Command and control infrastructure is located on compromised residential IP addresses and multiple cloud instances, including AWS EC2. The botnet supports sixteen CPU architectures and uses XOR obfuscation with a byte value of thirty three. Indicators of compromise and detection rules are provided, including YARA signatures and Snort and Suricata rules.
Hackers Actively Scanning TCP Ports 8530/8531 for WSUS CVE-2025-59287

gbhackers.com · 9 months ago

There is a significant spike in suspicious network traffic targeting Windows Server Update Services infrastructure worldwide. The reconnaissance focuses on TCP ports 8530 and 8531, which are the unencrypted and encrypted WSUS communication channels, and specifically targets systems vulnerable to CVE-2025-59287. Security researchers at the SANS Internet Storm Center report the scanning activity is coordinated and widespread.
Let's Get Physical: A New Convergence for Electrical Grid Security

www.darkreading.com · 9 months ago

There are rising combined cyber and physical attacks on the United States power grid, with cyberattacks against utilities increasing sixty nine percent from the first half of 2023 to the first half of 2024 and ransomware against energy and utilities rising eighty percent year over year. Physical attacks have surged as well, with a seventy one percent increase reported in 2022 and four thousand four hundred ninety three incidents logged between 2020 and 2022, including an indictment over a plot to attack multiple substations. Industry surveys show many grid operators either fail to integrate or are uncertain about integrating cyber and physical security, creating dangerous gaps that regulators are addressing through standards such as NERC CIP 003 11 and FERC direction to extend network monitoring to include physical controls. Agencies and funders are investing in unified defenses, including Department of Energy funding for zero trust protections for distributed energy resources, and experts expect these convergence threats to continue into 2026.
Claude AI APIs Can Be Abused for Data Exfiltration

www.securityweek.com · 9 months ago

Attackers can use indirect prompt injection to trick Anthropic Claude into harvesting a user s data and sending it to an attacker by abusing Claude Files APIs when the model has network access. The payload instructs Claude to save harvested information into the Code Interpreter sandbox and then call the Anthropic File API with an attacker supplied API key so the file is uploaded to the attacker s account, allowing exfiltration of up to 30 megabytes per file and multiple files. The technique was disclosed to Anthropic via HackerOne on October 25, 2025, and Anthropic s documentation warns about the risks of network access and provides recommended mitigations.
Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks

thehackernews.com · 9 months ago

There is a wave of attacks targeting trucking and logistics companies that aim to install remote monitoring and management software to enable theft of cargo freight, with food and beverage products among the most targeted. The threat cluster, active since at least June 2025, is working with organized crime and uses compromised email accounts, fraudulent load board listings, and spear phishing to send malicious URLs that lead to booby trapped installers. Attackers deploy legitimate RMM tools including ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N able, and LogMeIn Resolve, then perform reconnaissance and deploy credential harvesters such as WebBrowserPassView to expand access. In observed cases, intruders have deleted bookings, blocked dispatcher notifications, added devices to dispatch systems, booked loads under compromised carrier names, and coordinated transport to steal goods that are likely sold online or shipped overseas.
Hackers are attacking Britain’s drinking water suppliers

therecord.media · 9 months ago

There have been five cyberattacks reported against Britain’s drinking water suppliers since the start of 2024, with the Drinking Water Inspectorate receiving 15 reports between January 1, 2024 and October 20, 2025. None of the attacks affected the safety of the water supply itself, and the five cybersecurity incidents were recorded as related to resilience risks while impacting organizations or out of scope systems rather than essential services. Under current NIS Regulations providers must only formally report incidents that disrupt an essential service, meaning pre-positioning or non-disruptive intrusions may not be legally required to be disclosed, and officials plan to amend this reporting threshold through the Cyber Security and Resilience Bill. Security experts and national agencies warn that commodity ransomware and attacks on programmable logic controllers remain primary threats and advise strict segmentation between IT and operational technology and adoption of new guidance such as the NCSC Cyber Assessments Framework.
⚡ Weekly Recap: Lazarus Hits Web3, Intel/AMD TEEs Cracked, Dark Web Leak Tool & More

thehackernews.com · 9 months ago

A low cost physical side channel attack called TEE.fail breaks confidentiality in Intel SGX, TDX and AMD SEV SNP by eavesdropping on DDR5 memory transactions to extract cryptographic keys and subvert attestation, though it requires physical access and kernel level privileges. A critical Motex Lanscope Endpoint Manager flaw CVE 2025 61932 with a CVSS score of 9.3 has been exploited by a suspected Chinese espionage actor known as Tick to deploy a backdoor named Gokcpdoor. North Korea linked BlueNoroff, associated with Lazarus, has launched GhostCall and GhostHire campaigns targeting Web3 executives and developers via Telegram and LinkedIn social engineering to deliver multi stage malware, while other notable threats this week included the Herodotus Android banking trojan and Qilin ransomware leveraging the Windows Subsystem for Linux. Trending and referenced CVEs include CVE 2025 55315, CVE 2025 10680, CVE 2025 55752, CVE 2025 55754, CVE 2025 52665, CVE 2025 12044, CVE 2025 11621, CVE 2025 43995, CVE 2025 5842, CVE 2025 24893, CVE 2025 62725, CVE 2025 12080, CVE 2025 12450, CVE 2025 11705, CVE 2025 55680, CVE 2025 6325, CVE 2025 6327, CVE 2025 49401, CVE 2025 54603, CVE 2025 10932, CVE 2023 46604, CVE 2025 59054 and CVE 2025 58356.
Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)

unit42.paloaltonetworks.com · 9 months ago

A critical unauthenticated remote code execution vulnerability in Microsoft Windows Server Update Services tracked as CVE-2025-59287 allows remote attackers to execute arbitrary code with system privileges and has been observed exploited in the wild. Microsoft’s initial October patch did not fully remediate the flaw, prompting an out-of-band emergency update on October 23, 2025, and the U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 24, 2025. Attackers have scanned internet-exposed WSUS servers on TCP ports 8530 and 8531, used unsafe deserialization vectors to run PowerShell commands for reconnaissance and data exfiltration, and researchers identified roughly 5,500 exposed WSUS instances. Interim mitigations recommended until emergency patches are applied include disabling the WSUS server role or blocking inbound traffic to TCP ports 8530 and 8531 on host firewalls.
Open VSX Registry Responds to Leaked Tokens and Malicious Extension Incident

gbhackers.com · 9 months ago

There was a security incident involving the Open VSX registry in which developer authentication tokens were accidentally exposed and some of those tokens were used to publish malicious extensions in a campaign tracked as GlassWorm. The Eclipse Foundation and Open VSX contained the situation by revoking and rotating affected tokens, removing flagged extensions, and introducing mitigations such as a token prefix format, shorter token lifetimes, simplified revocation, sandboxed builds, and automated scanning at publication. Investigators determined the exposures were caused by developer mistakes rather than a direct compromise of registry infrastructure and the incident was reported as contained in October 2025. The vulnerability in the automated publishing process is tracked as CVE-2025-6705.
Critical UniFi OS Flaw Enables Remote Code Execution

gbhackers.com · 9 months ago

A severe unauthenticated remote code execution flaw in UniFi OS allows attackers to execute arbitrary code and gain full control of affected UniFi devices without credentials or user interaction. The issue is tracked as CVE-2025-52665 and was reported by Catchify, which received a twenty five thousand dollar bug bounty for the discovery. Ubiquiti has published advisories and patches, and organizations are urged to update affected UniFi components and restrict management network access to mitigate the risk.
Researchers Uncover BankBot-YNRK and DeliveryRAT Android Trojans Stealing Financial Data

thehackernews.com · 9 months ago

Researchers report two Android trojans named BankBot YNRK and DeliveryRAT that are stealing sensitive and financial data from compromised devices. BankBot YNRK performs anti analysis checks for emulated environments and specific device models before activating, impersonates an Indonesian government app, mutes audio to hide alerts, abuses accessibility services to gain elevated privileges on Android 13 and below, uses JobScheduler for persistence, and issues commands to harvest contacts, SMS, clipboard data, screenshots of banking app UIs and other sensitive information. DeliveryRAT is being distributed via a Telegram based malware as a service model that lures Russian users with fake delivery, marketplace, banking and parcel tracking apps, requests notification and battery optimization exemptions, hides its icon, accesses SMS and call logs, and in some variants can be used to launch distributed denial of service attacks. The findings coincide with reports that hundreds of malicious Android apps have been misusing near field communication and host based card emulation to steal payment data and relay it to attackers for near instantaneous fraud.
Rhysida ransomware exploits Microsoft certificate to slip malware past defenses

www.csoonline.com · 9 months ago

There are new malvertising campaigns by the Rhysida ransomware group that use paid search ads to lure victims to fake download pages for legitimate apps such as Microsoft Teams, PuTTY and Zoom. Those campaigns deliver OysterLoader, an initial access tool previously called Broomstick and CleanUpLoader, and also use Latrodectus, with attackers packaging and obfuscating binaries to reduce static detection. The group is abusing Microsoft Trusted Signing certificates, which have a 72 hour validity window, to sign malware at scale so signed binaries bypass allow lists, browser and OS warnings, and antivirus, prompting revocation of over 200 certificates while attackers move to fresh certs. Defenders are urged to stop treating signed files as inherently safe, adopt behavior focused EDR and certificate pinning for critical apps, validate installer origins, and use DNS filtering and threat intelligence to detect and block fake download paths.
Hacktivists increasingly target industrial control systems, Canada Cyber Centre warns

www.csoonline.com · 9 months ago

There is a warning from the Canadian Centre for Cyber Security that hacktivists are increasingly exploiting internet accessible industrial control systems to gain media attention, discredit organizations, and undermine national reputation. Recent incidents include tampering with water utility pressure controls, manipulation of automated tank gauge readings at an oil and gas company that triggered false alarms, and unauthorized changes to temperature and humidity controls in a grain drying silo that could have created unsafe conditions. The guidance urges owners and operators to stop exposing PLCs, RTUs, SCADA systems, HMIs, safety instrumented systems, building management systems, and IIoT devices directly to the internet, to use secure remote management such as VPNs with multi factor authentication, and for governments and asset owners to inventory, document, and protect OT assets especially in sectors with limited regulatory cybersecurity oversight.
'TruffleNet' Attack Wields Stolen Credentials Against AWS

www.darkreading.com · 9 months ago

An emerging campaign called TruffleNet uses stolen AWS credentials and the TruffleHog scanning tool to test keys and probe Amazon Simple Email Service with GetCallerIdentity and GetSendQuota API calls for large scale reconnaissance. Attackers built a Portainer managed infrastructure spanning more than 800 hosts across 57 Class C networks that focused on reconnaissance nodes before abusing SES and DKIM paired with compromised WordPress sites to run business email compromise scams, including a W-9 vendor onboarding invoice requesting 50,000 US dollars to a typosquatted domain. Defenders are advised to implement continuous monitoring, least privilege access, behavioral analytics, and composite alerting to detect anomalous cloud connections, suspicious automation, and offensive tool usage.
Anthropic Claude – Unternehmensdaten gefährdet

www.csoonline.com · 9 months ago

A recently disclosed vulnerability in the Anthropic Claude AI assistant can be exploited via indirect prompt injection and the Code Interpreter to exfiltrate sensitive corporate data such as chat histories and uploaded documents. The exploit causes Claude to save sensitive content to a file in the Code Interpreter sandbox and execute Python that uploads the file to Anthropic's Files API using the attacker's credentials, enabling unlimited file uploads of up to 30 megabytes each while leaving minimal forensic traces. The root cause is Claude's network egress default configuration called Package managers only, which still permits access to Anthropic's API endpoint and other allowed domains that can be abused for data theft. The researcher reported the issue via HackerOne at the end of October 2025, Anthropic classified the findings as out of scope, and mitigations remain limited to disabling network access, manually whitelisting domains, or closely monitoring and stopping suspicious actions.
New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

thehackernews.com · 9 months ago

North Korea linked threat actor Kimsuky distributed a previously undocumented backdoor named HttpTroy via a spear phishing attack that targeted a single victim in South Korea. The phishing email carried a ZIP file masquerading as a VPN invoice which executed a three stage chain comprising a small dropper, a loader called MemLoad that establishes persistence with a scheduled task named AhnlabUpdate to impersonate a Korean security vendor, and the HttpTroy DLL backdoor that enables file upload and download, screenshot capture, elevated command execution, in memory loading of executables, reverse shell, process termination, and trace removal. HttpTroy communicates with its command and control server over HTTP POST and employs multiple layers of obfuscation including custom API hashing, XOR and SIMD string obfuscation, and dynamic runtime reconstruction to hinder analysis and detection.
Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks

www.securityweek.com · 9 months ago

A suspected Chinese state sponsored threat actor tracked as CL-STA-1009 has been using a malware family called Airstalk in supply chain attacks against business process outsourcing companies. PowerShell and.NET variants of Airstalk abuse the AirWatch mobile device management API to establish a covert command and control channel, use a multi threaded communication protocol, and are signed with likely stolen certificates and modified timestamps to evade detection. The PowerShell variant can take screenshots, list user files and Chrome profiles, and harvest Chrome cookies bookmarks and history, while the.NET variant also targets Microsoft Edge and Island Browser, can open URLs in Chrome, and exfiltrates browser data.
New BOF Tool Bypasses Microsoft Teams Cookie Encryption to Steal User Chats

gbhackers.com · 9 months ago

There is a specialized Beacon Object File tool released by Tier Zero Security that can bypass Microsoft Teams cookie encryption to extract and steal user chat messages and other sensitive communications. The weakness stems from differences in how Teams stores and encrypts cookies compared with modern Chromium based browsers, leaving the Teams Cookies database and its master key susceptible to recovery and decryption under local access conditions. The technique enables attackers with local access to obtain the encrypted Cookies file, recover or decrypt the master key protected by the Windows Data Protection API, and reuse session tokens to impersonate users and access chats and cloud services.
Microsoft: Windows Task Manager won’t quit after KB5067036 update

www.bleepingcomputer.com · 9 months ago

There is a known issue after installing the October 28, 2025 optional update KB5067036 that prevents Task Manager from fully terminating, leaving background taskmgr.exe processes running. Multiple lingering Task Manager processes can consume system resources and may cause stuttering, CPU hangs, and noticeable slowdowns when many instances accumulate. Microsoft is investigating and provided a temporary workaround to end processes manually or run the command taskkill.exe /im taskmgr.exe /f from an elevated Command Prompt, and the KB5067036 preview also added an updated Start Menu and an Administrator Protection feature.
Breaking Down 8 Open Source AI Security Tools at Black Hat Europe 2025 Arsenal

www.reddit.com · 9 months ago

There are eight open source AI security tools showcased at Black Hat Europe Arsenal covering AI infrastructure risk assessment, AI driven red teaming, LLM security evaluation, automated vulnerability remediation, cyber ranges, training small security LLMs, prompt injection testing, and protecting LLM database interactions. AI Infra Guard rapidly scans AI infrastructure and performs large model security check ups including jailbreak evaluation and a user interface, while Harbinger leverages AI for automated red team operations, decision support, and report generation. MIPSEval focuses on multi turn conversational security testing of LLMs and SPIKEE provides a modular toolkit for evaluating and exploiting prompt injection vulnerabilities. Patch Wednesday uses a privately deployed LLM to generate patches from CVE descriptions and code context, Red AI Range provides a deployable environment for practicing attacks and defenses against AI and machine learning systems, and SQL Data Guard aims to prevent data leakage in LLM database interactions.
US Appeals Court lowers burden of proof for data breach lawsuits

www.csoonline.com · 9 months ago

An October decision by the United States Fourth Circuit Court of Appeals in Virginia eased plaintiffs' ability to sue after data breaches by ruling that posting stolen information for sale on the dark web can create a concrete risk of fraud sufficient to survive early-stage challenges. The case involved an insurance company breach that exposed nearly three million customers' driver's license information, and the court found that dark-web availability, paywalled or not, suggests actionable public exposure because buyers would not pay for data unless it could complete fraud. The ruling changes the publication versus theft calculus, prompting recommendations that security leaders monitor the dark web, document public exposure with timestamps, hashes and screenshots, reassess financial and litigation risk, and be aware that attackers might use threats of dark-web publication to increase extortion leverage.
Google Pays $100,000 in Rewards for Two Chrome Vulnerabilities

www.securityweek.com · 9 months ago

Chrome 142 was released to the stable channel with patches for 20 vulnerabilities, including seven high, eight medium, and five low severity flaws. Four high severity bugs affect the V8 JavaScript and WebAssembly engine, and Google paid fifty thousand dollars each for CVE-2025-12428, a type confusion issue, and CVE-2025-12429, an inappropriate implementation defect. Google said it paid a total of one hundred thirty thousand dollars for bugs fixed in this release, did not disclose technical details or any in the wild exploitation, and the update is rolling out as version 142.0.7444.59 for Linux, versions 142.0.7444.59 and 142.0.7444.60 for Windows, and version 142.0.7444.60 for macOS.
Quick writeup for what to check when you see Firebase in a pentest

www.reddit.com · 9 months ago

Firebase security differs from traditional web app security because the database can be exposed directly to the client, so access control must be enforced with Security Rules rather than server side code. Exposed Firebase configuration values let attackers or testers connect to the project, discover collections, list documents, and read or overwrite other users data and storage. Tools such as firepwn can automate these actions and reveal issues like permissive list operations and missing ownership checks. Mitigations include writing rules that require authentication and verify that the authenticated user id matches the owner field on documents, and never relying solely on frontend controls.
Conti Ransomware Operator Extradited to the United States

gbhackers.com · 9 months ago

A Ukrainian national named Oleksii Oleksiyovych Lytvynenko was extradited from Ireland to the United States and appeared in federal court in the Middle District of Tennessee after his arrest in July 2023. He is accused of conspiring from about 2020 to June 2022 to deploy Conti ransomware, controlling stolen data and distributing ransom notes in a campaign that affected more than one thousand victims worldwide and resulted in at least one hundred fifty million dollars in ransom payments by January 2022 according to law enforcement estimates. He is charged with computer fraud conspiracy and wire fraud conspiracy, faces up to five years and twenty years in prison respectively if convicted, and authorities said the extradition followed cooperation between U.S. and Irish law enforcement.
That Time Xi Jinping Joked About Espionage

www.nytimes.com · 9 months ago

Chinese President Xi Jinping presented South Korean President Lee Jae Myung with two Xiaomi smartphones during a bilateral exchange on the sidelines of the APEC summit in Gyeongju on November 1, 2025. When Lee asked whether communications were secure, Xi joked that Lee could check whether there was a backdoor, prompting laughter from both leaders. Officials noted the phones use Korean made displays and the exchange also included traditional gifts such as Chinese calligraphy tools and a Go board.
Windows 11 24H2/25H2 Flaw Keeps Task Manager Running After You Close It

gbhackers.com · 9 months ago

Microsoft has acknowledged a persistent bug in Windows 11 versions 24H2 and 25H2 that prevents Task Manager from fully terminating when users close the application. The flaw causes multiple instances of Task Manager to continue running in the background. Over time these accumulating background processes can degrade device performance and remain unnoticed by users.
EDR-Redir V2 Evades Detection on Windows 11 by Faking Program Files

gbhackers.com · 9 months ago

A security researcher named TwoSevenOneT released EDR Redir V2, an evasion tool that exploits Windows bind link functionality added in Windows 11 24H2 to redirect parent directories of EDR installations without requiring kernel privileges. The tool mirrors subfolders from a target parent directory into a controlled folder, creates bidirectional bind links that loop normal applications to the mirrors while isolating the EDR subfolder to an attacker controlled location, and enables DLL hijacking or file drops that can blind endpoint detection and response products. A demonstration against Windows Defender showed Defender viewing the attacker folder as its operational parent and becoming effectively blind to original files, prompting recommendations to monitor bind link usage in critical directories and add integrity checks for EDR paths.
OpenAI Introduces Aardvark, an AI Security Agent Powered by GPT-5

gbhackers.com · 9 months ago

There is an agentic security researcher named Aardvark powered by GPT 5 that is available in private beta and continuously analyzes source code repositories to identify, validate, and propose fixes for vulnerabilities. Its pipeline builds a threat model, scans commits and repository history, attempts to reproduce exploits in an isolated sandbox, and attaches Codex generated patches for human review, and in benchmark testing it identified ninety two percent of known and seeded vulnerabilities. When applied to open source projects it uncovered multiple real flaws, with ten of those findings receiving Common Vulnerabilities and Exposures identifiers, and the service integrates with GitHub and is being offered to select partners and for pro bono scans of some non commercial projects.
Proton Warns of 300 Million Stolen Login Details Circulating on Dark Web

gbhackers.com · 9 months ago

There are more than 300 million stolen login records circulating on the dark web in 2025 according to Proton's Data Breach Observatory, which has verified 794 distinct breach incidents. About half of the exposed records include passwords and around 70 percent of incidents affect small and medium sized businesses, with retail, technology, and media among the top targeted sectors. Proton says the observatory monitors underground forums and uses partners to validate leaks, will notify affected organizations, and recommends using unique passwords, multi factor authentication, and email aliases to reduce risk.
Steal MS Teams app cookies

www.reddit.com · 9 months ago

A Beacon Object File tool can run inside the Microsoft Teams process to locate the SQLite cookie store and recover the encryption key protected by the current user DPAPI, allowing decryption of Teams cookies without requiring SYSTEM privileges. Because Teams embeds Chromium via msedgewebview2 but relies on the user DPAPI master key rather than a COM-based elevation service used by browsers, the tool duplicates handles to webview child processes to read locked cookie files and decrypt their contents. Stolen Teams cookies allow attackers to interact with Teams, Skype, and Microsoft Graph APIs to read and send messages as the victim, and the lightweight Cookie Monster based BOF is intended to execute from the ms-teams.exe context and may be detected by unusual processes opening handles to Teams webview processes.
Penn hacker claims to have stolen 1.2 million donor records in data breach

www.bleepingcomputer.com · 9 months ago

A hacker claimed responsibility for mass fraudulent emails and said they accessed multiple University of Pennsylvania systems, exfiltrating data on about 1.2 million students, alumni, and donors plus internal documents. The attacker reported they gained full access to an employee PennKey single sign on account and used it to reach Penn's VPN, Salesforce, Qlik analytics, SAP business intelligence, SharePoint, and Salesforce Marketing Cloud, then sent offensive messages to roughly 700,000 recipients. The breach was claimed to have occurred on October 30 with downloads completed by October 31, and the threat actor published a 1.7 gigabyte archive of spreadsheets and files while saying the donor database may be released in a month or two. The university is investigating and donors are advised to be vigilant for targeted phishing and social engineering and to verify unexpected donation requests directly with the university.
Alleged Jabber Zeus Coder ‘MrICQ’ in U.S. Custody

krebsonsecurity.com · 9 months ago

A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States. Authorities say Yuriy Igorevich Rybtsov, 41, known online as MrICQ, was a developer for the Jabber Zeus crew who handled incoming notifications of compromised victims, helped launder proceeds, and worked with a custom ZeuS banking trojan that used a component called Leprechaun to intercept one time passcodes and bypass multi factor authentication. Italian courts denied his appeal in April 2025, sources say he arrived in Nebraska on October 9, 2025, and remains held under an FBI arrest warrant while U.S. prosecutors review the 2012 indictment that named him as John Doe number three.