Blahalla

Senegalese Data Breaches Expose Lack of Security Maturity

www.darkreading.com · 8 months ago

A ransomware group called The Green Blood Group recently breached the Directorate of File Automation in Senegal, exfiltrating biometric data, immigration records, and other sensitive information belonging to nearly 20 million residents. This incident, along with a separate attack on Sénégal Numérique SA, highlights a broader cybersecurity challenge across Africa where digital ambitions have outpaced security maturity. Experts warn the data breach could erode public trust and hinder digital initiatives, and it underscores a need for increased investment in data protection, governance, and cybersecurity infrastructure. The group has also targeted organizations in Colombia and India.

Palo Alto Networks Firewall Vulnerability Lets Attackers Trigger Reboot Loops

gbhackers.com · 8 months ago

A vulnerability has been identified in Palo Alto Networks firewalls, specifically within the Advanced DNS Security feature. The flaw, tracked as CVE-2026-0229, allows unauthenticated attackers to trigger repeated reboots, potentially leading to a maintenance mode state and disrupting network connectivity. The issue affects devices with ADNS enabled and specific security profile configurations, but Cloud NGFW and Prisma Access are not impacted. Palo Alto Networks recommends upgrading to a fixed release to resolve the denial of service condition.

Malicious ‘duer-js’ NPM Package Distributes ‘Bada Stealer’ Malware Targeting Windows and Discord Users

gbhackers.com · 8 months ago

A malicious NPM package called "duer-js" is distributing an information-stealing malware known as "bada stealer." The package, published by a user named "luizaearlyx," contains heavily obfuscated code that checks for tampering and builds a conversion table to hide its logic. Once executed, bada stealer targets Windows systems and aggressively harvests sensitive data from Chromium-based browsers, crypto wallets, and Discord applications, including tokens, user data, and financial information. The malware employs layered exfiltration channels using Discord webhooks and the Gofile file-sharing service to transmit stolen data and injects code into the Discord application to capture sensitive information during login and verification processes.

Polish hacker charged seven years after massive Morele.net data breach

www.bitdefender.com · 8 months ago

A Polish man has been charged in connection with a 2018 data breach of the e-commerce website Morele.net, which affected approximately 2.5 million customers. The cyberattack exposed personal information including names, addresses, email addresses, and md5crypt-hashed passwords. While payment card details were not compromised, some customers had more sensitive data stolen, such as national ID numbers and financial details. The investigation was initially shelved but later revived using improved digital forensics techniques.

Quick IAM fundamentals knowledge check for security practitioners

ciso.economictimes.indiatimes.com · 8 months ago

false

Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’

www.securityweek.com · 8 months ago

Apple has released security updates to address a zero-day vulnerability, CVE-2026-20700, affecting its operating systems. This memory corruption issue within the Dynamic Link Editor component could allow for arbitrary code execution and was used in a targeted attack. The flaw is linked to CVE-2025-14174 and CVE-2025-43529, previously patched in WebKit. Updates are available for iOS, iPadOS, macOS, tvOS, watchOS, and visionOS, resolving dozens of vulnerabilities.

Microsoft's Notepad Got Pwned (CVE-2026-20841)

foss-daily.org · 8 months ago

A security vulnerability, CVE-2026-20841, has been identified in Microsoft's modern Notepad application. The vulnerability allows for remote code execution when a user opens a malicious Markdown file and clicks a specially crafted link. Microsoft has released an update, version 11.2510 or later, to address the issue, and users are urged to update immediately and disable unnecessary features like Markdown preview. The vulnerability highlights the risks of adding complexity to simple tools without proper security review.

83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure

thehackernews.com · 8 months ago

Exploitation attempts targeting a security flaw in Ivanti Endpoint Manager Mobile are largely traced to a single IP address associated with PROSPERO, a bulletproof hosting provider. Approximately 83% of these attempts originated from one IP, exploiting CVE-2026-1281 and CVE-2026-1340 to achieve remote code execution. Threat actors have also leveraged the same infrastructure to exploit CVE-2026-21962, CVE-2026-24061, and CVE-2025-24799 across different software. Many exploitation sessions involve reconnaissance activities, suggesting initial access broker operations to catalog vulnerable targets.

Adblock Filters Expose User Location Even With VPN Protection

gbhackers.com · 8 months ago

A new technique called Adbleed reveals that VPNs don’t guarantee anonymity because they can’t hide which country-specific adblock filter lists a user has installed. This fingerprinting method exploits timing differences in blocked versus unblocked website requests, using a JavaScript script to identify active filter lists and correlate them with a user’s location. The technique bypasses VPNs, Tor Browser, and proxies, potentially revealing a user’s location or native language when combined with other fingerprinting data. Users can mitigate this by disabling country-specific filter lists, though this allows more ads, or by abandoning adblockers.

Lazarus Group’s ‘Graphalgo’ Fake Recruiter Campaign Targets GitHub, npm, and PyPI to Spread Malware

gbhackers.com · 8 months ago

The Lazarus Group is targeting cryptocurrency developers through a campaign called Graphalgo, using fake job opportunities and compromised open-source packages to distribute malware. Attackers pose as recruiters from a fictitious company, Veltrix Capital, and provide seemingly legitimate coding tasks through GitHub, npm, and PyPI. Malicious npm packages like bigmathutils have garnered thousands of downloads before being flagged and deprecated. The malware acts as a first-stage loader that pulls down a remote-access Trojan, enabling attackers to control compromised systems and steal cryptocurrency assets.

Google says hackers are abusing Gemini AI for all attacks stages

www.bleepingcomputer.com · 8 months ago

State-sponsored hackers from China, Iran, North Korea, and Russia are increasingly using Google’s Gemini AI model to support all phases of cyberattacks, including reconnaissance, phishing, coding, and vulnerability testing. Cybercriminals are also leveraging AI tools for social engineering and developing malicious software, such as the HonestCue malware framework, which generates C code using the Gemini API. Google has observed attempts to extract and replicate Gemini's functionality through knowledge distillation, posing a threat to the AI model's intellectual property and business model. Google has taken steps to mitigate abuse by disabling accounts and implementing targeted defenses.

Microsoft Outlook Add-In Stolen 4000 Accounts and Credit Card Numbers

gbhackers.com · 8 months ago

Attackers exploited a dormant Microsoft Outlook add-in called AgreeTo to steal sensitive data from thousands of users. The add-in, initially a legitimate scheduling tool, was abandoned, allowing an attacker to hijack its domain and replace its functionality with a fake Microsoft login page. Victims unknowingly provided their email addresses, passwords, and credit card numbers, which were then sent to the attacker via a Telegram bot. Security researchers discovered the operation and found the add-in had ReadWriteItem permissions, enabling potential access to users’ inboxes.

Fake CAPTCHA Attacks Exploit Key Entry Point for LummaStealer Malware

gbhackers.com · 8 months ago

Cybercriminals are increasingly using fake CAPTCHA prompts, also known as ClickFix attacks, to distribute LummaStealer malware. These deceptive pages trick users into running malicious PowerShell commands that download and execute CastleLoader, ultimately leading to system compromise and data theft. LummaStealer operators have rebuilt their infrastructure after a previous takedown and are now actively targeting users in India, the US, and Europe, stealing credentials and financial information. Security measures should focus on user awareness and monitoring for suspicious PowerShell commands and anomalous DNS activity related to CastleLoader.

Promptware – Hackers Exploit Google Calendar Invites to Stealthily Stream Victim’s Camera via Zoom

gbhackers.com · 8 months ago

Researchers have identified a new cybersecurity threat called Promptware, demonstrating how attackers can exploit common tools like Google Calendar and Zoom to secretly spy on users. The attack begins with a malicious prompt hidden within a calendar invite, which tricks an AI assistant into starting a Zoom meeting and streaming video to a hacker-controlled server. This new classification shifts from the previous analogy of prompt injection to malware, highlighting the need for deeper, layered security measures to protect against increasingly sophisticated AI-driven attacks. The Promptware Kill Chain outlines seven stages, including initial access, privilege escalation, and lateral movement, mirroring traditional cyberwarfare tactics.

Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Other Devices

thehackernews.com · 8 months ago

Apple has released security updates for iOS, iPadOS, macOS, tvOS, watchOS, and visionOS to fix a zero-day vulnerability. The flaw, CVE-2026-20700, is a memory corruption issue in the Dynamic Link Editor that could allow attackers to execute code. Google’s Threat Analysis Group discovered the bug, which was reportedly used in targeted attacks against specific individuals. Additional vulnerabilities addressed include CVE-2025-14174, an out-of-bounds memory access, and CVE-2025-43529, a use-after-free vulnerability.

Cybercriminals Exploit Employee Monitoring and SimpleHelp Tools in Ransomware Attacks

gbhackers.com · 8 months ago

Cybercriminals are exploiting legitimate employee monitoring and remote management tools to deploy ransomware and steal cryptocurrency. Attackers are using Net Monitor for Employees to gain initial access and execute commands, then leveraging SimpleHelp for persistence and post-exploitation. The threat actors are observed chaining these tools to deploy Crazy ransomware, a variant of the VoidCrypt family, and are also monitoring cryptocurrency-related activity. Security recommendations include enforcing multi-factor authentication, segmenting networks, and monitoring the use of remote access and monitoring software.

Apple 0-Day Flaw Actively Exploited in Targeted Cyberattacks on Individuals

gbhackers.com · 8 months ago

Apple has released emergency updates for iOS and iPadOS to address a critical zero-day vulnerability, CVE-2026-20700. The flaw exists in the dyld component, allowing attackers to potentially execute malicious code and gain control of devices. Security researchers suspect attackers are combining this vulnerability with CVE-2025-14174 and CVE-2025-43529. The update also addresses vulnerabilities affecting Bluetooth, Wi-Fi, Photos, Contacts, and the Kernel.

Entwickler werden zum Angriffsvektor

www.csoonline.com · 8 months ago

Softwareentwickler sind gefragt, auch unter kriminellen Hackern. Gorodenkoff | shutterstock.com Statt einfach “nur” Fehler in Applikationen auszunutzen, entdecken kriminelle Hacker zunehmend die Tools und Zugriffskanäle für sich, auf die sich Softwareentwickler regelmäßig verlassen. Dabei kombinieren sie längst auch unterschiedliche Cybercrime-Taktiken und beziehen auch künstliche Intelligenz (KI) ein, um an ihr Ziel zu gelangen. “Angreifer versuchen nicht mehr nur, in Ihr Netzwerk einzudringen. Sie haben es jetzt auch auf Ihre Workflows abgesehen. Und Ihre Entwickler besitzen die ‚Schlüssel zum Königreich‘, in Form von privilegiertem Zugriff auf Quellcode und die Cloud-Infrastruktur. Das macht sie zu einem hochkarätigen Ziel für Angreifer“, konstatiert Chris Wood, Principal Application Security SME beim Sicherheitsanbieter Immersive. Wir haben mit Wood und diversen anderen Sicherheitsprofis erörtert, auf welche Bereiche CISOs und Sicherheitsentscheider ihr Augenmerk bei diesem Angriffsvektor legen sollten, und welche Defensivmaßnahmen sich empfehlen, um gegenzusteuern. Vergiftete Ökosysteme Darren Meyer, Security Research Advocate bei Checkmarx, beobachtet regelmäßig viele Angriffe auf Entwickler, die er als “Low Effort” einstuft, etwa schadhafte Versionen beliebter Open-Source-Utilities, die auf Typosquatting-Domains gehostet werden. Diese “Spray and Pray”-Bemühungen stellten aber nur eine Seite der Medaille dar, warnt Meyer: “Es finden auch deutlich gezieltere Attacken statt, wie etwa der Shai-Hulud-Wurm, Angriffe auf npm-Packages oder das Plugin-Ökosystem von Visual Studio Code eindrücklich belegen.” Die Einschätzung des Checkmarx-Experten spiegelt sich auch im aktuellen Sonatype-Report “ 2026 State of the Software Supply Chain 2026 ” (Download gegen Daten) wider. Der Spezialist für Lieferkettensicherheit hat seit 2019 insgesamt 1,23 Millionen quelloffene Packages identifiziert, die mit Malware verseucht waren. Allein im Jahr 2025 registrierte Sonatype 454.000 neue Exemplare, die in diese Kategorie fallen. Und damit nicht genug: “In der Praxis wird Vulnerability Exposure in weiten Teilen nicht durch neue Schwachstellen getrieben, sondern durch bereits bekannte”, schreiben die Sicherheitsexperten in ihrem Bericht. Demnach haben Developer im Jahr 2025 mehr als 42 Millionen mal anfällige Versionen der Logging-Utility Log4j heruntergeladen. Mit Blick auf alle Log4j-Downloads entspricht das einem Anteil von 13 Prozent. Kompromittierte Entwicklungsumgebungen Die Angreifer haben es darüber hinaus vor allem auch auf Softwareentwicklungsumgebungen abgesehen. Das liegt auch daran, dass gängige Security-Verfehlungen wie überprivilegierte Accounts, langlebige Token oder falsch konfigurierte Pipelines einen illegalen Zugriff auf Development Environments, und damit sensible Daten, relativ einfach machen. “Zugangsdaten, die unsachgemäß gespeichert werden, sind selbst für unerfahrene Angreifer ein leichtes Ziel”, hält Crystal Morin, Senior Cybersecurity Strategist beim Observability-Anbieter Sysdig, fest. Insider-Bedrohungen Allerdings stehlen kriminelle Hacker nicht unbedingt Zugangsdaten, um Zugriff auf die Systeme von Unternehmen zu erlangen. Stattdessen bewerben sie sich einfach als Mitarbeiter. Solche “Fake Worker”-Kampagnen sind unter anderem bei nordkoreanischen Bedrohungsakteuren beliebt. Die Taktik: Technisch versierte Angreifer setzen gefälschte Identitäten und Social-Engineering-Tricks ein, um einen Job zu ergattern. Einmal im Unternehmen, stehlen sie dann Daten und Geschäftsgeheimnisse, auch zu dem Zweck, diese später als Druckmittel für Erpressungen zu nutzen. Sysdig-Managerin Morin ergänzt: “Angreifer geben sich dabei auch als Maintainer aus und versuchen so, Schadcode in populäre Open-Source-Projekte einzuschleusen. So wie etwa im Fall der XZ Utils-Backdoor.” Supply-Chain-Risiken Gelingt es den Cyberkriminellen, eine gemeinsam genutzte Softwarebibliothek in der Lieferkette zu kompromittieren, kann das dazu führen, dass sich eine Infektion rasant ausbreitet. Laut Gavin Millard, Vice President of Intelligence beim Exposure-Management-Spezialisten Tenable, haben Supply-Chain-Bedrohungen inzwischen Exploits als größtes systemisches Cybersicherheitsrisiko abgelöst: “Mit Supply-Chain-Angriffen wie den Hijacking-Attacken auf S1ngularity und npm-Maintainer können Cyberkriminelle in wenigen Minuten weit mehr erreichen, als mit einem Jahr Spear Phishing und Systemscans. Die Lieferkette zu missbrauchen, ist für Angreifer eine Art Kraftmultiplikator”, erklärt Millard. Nutzten Developer eine solche verseuchte Quelle, könne im Nachgang jede der von ihnen entwickelten Anwendungen, und sämtliche ihrer User, infiziert werden. Aktuelle Studien belegen, dass dieses Problem auch den Anwendern bewusst ist. 65 Prozent der Unternehmen, die das Weltwirtschaftsforum für seinen “ Global Cybersecurity Outlook 2026 ” (PDF) befragt hat, betrachten Schwachstellen in Lieferketten und bei Drittanbietern als ihre größte Security-Herausforderung. Gegenüber dem Vorjahr hat sich dieser Wert um 54 Prozent gesteigert. Kombinierte Threat-Modelle Zudem gingen Cyberkriminelle zunehmend dazu über, technische Kompromittierungen mit Social-Engineering-Taktiken und KI zu kombinieren, um die Wirksamkeit ihrer Angriffe zu erhöhen. Christopher Jess, Senior R&D Manager beim Sicherheitsanbieter Black Duck, erklärt wie: “Ein schadhaftes Package kann mit subtilen Hintertüren versehen sein. Dessen Verbreitung lässt sich etwa mit Fake-Nachrichten von Maintainern oder anderen, vertrauenswürdigen Personen und angeblich dringenden Pull Requests für Sicherheitskorrekturen forcieren.” KI erhöhe schließlich noch den Scope und die Präzision dieser Attacken, so Jess: “Phishing und Pretexting werden so mit mehr Kontext ausgestattet. Etwa, indem Repositories, Commit-Historien und Team-Rollen abgeglichen werden. Zudem können die Angreifer mit KI auch plausibel erscheinende Codeänderungen oder Dokumentationen erstellen, um Verdachtsmomente in Review-Prozessen möglichst zu unterbinden.” KI-Tools für Entwickler als Risiko-Addon KI-gestützte Softwareentwicklung und Vibe Coding erhöhen die Sicherheitsrisiken zusätzlich, insbesondere, weil der so generierte Code häufig ohne ausreichendes Testing, eine Dokumentation oder Traceability generiert wird. Jamie Beckland, Chief Product Officer beim Security-Unternehmen APIContext, warnt insbesondere vor wachsenden Risiken durch die Einführung von KI-Agenten und MCP-Servern: “MCP-Server können modifiziert werden, indem man sie um Tools ergänzt, beispielsweise, um Daten aus internen APIs, Data Stores oder SaaS-Systemen zu extrahieren.” Das Risiko manifestiere sich dabei nicht nur im LLM-Modell selbst, sondern auch in der Oberfläche der Tools und ihren Funktionen. “MCP-Server auf Änderungen in der Tool-Infrastruktur und den Datenzugriffsrechten des Servers zu überprüfen ist entscheidend”, hält Beckland fest. Auch Pieter Danhieux, CEO und Mitbegründer von Secure Code Warrior, sieht MCP-Server und Agentic AI als fruchtbaren Boden für Cyberkriminelle, schließlich sei es relativ simpel, hier absichtlich unsichere Prompts oder KI-generierten Schadcode einzuschleusen. Und damit nicht genug: „Wir haben außerdem beobachtet, dass Bedrohungsakteure KI-Agenten mit nicht autorisierten Anweisungen überlisten, die vermeintlich von dessen berechtigtem Benutzer stammen. Hierbei handelt es sich um die sogenannte Confused Deputy-Schwachstelle.“ Dazu passend spricht auch Sonatype von einer “KI-Intelligenzlücke”, nachdem der Anbieter für seinen Report 37.000 Empfehlungen von GPT-5 analysiert hat. Laut den Security-Experten handelte es sich in knapp 28 Prozent der Fälle um Halluzinationen. In einigen Fällen hat das KI-Tool dabei auch empfohlen, Malware-verseuchte Packages zu installieren. Und auch die Verantwortlichen des Benchmark-Projekts BaxBench kommen in einer aktuellen Untersuchung zum Ergebnis, dass 62 Prozent der Lösungen, die von Large Language Models generiert werden, entweder fehlerhaft sind oder Sicherheitslücken beherbergen. Was CISOs tun können Um die Softwareentwicklung besser abzusichern, empfiehlt sich für CISOs und Sicherheitsentscheider ein kombinierter Ansatz aus: technischen Kontrollen, Security-Schulungen, sowie kulturellen Maßnahmen. Strengere Identitätsprüfungen, Account-Hygiene und Least-Privilege-Prinzip können auch mit Blick auf Development-Prozesse zu mehr Sicherheit beitragen. Eric Paulsen, EMEA-CTO beim Dev-Plattformanbieter Coder, empfiehlt darüber hinaus: “Isolieren Sie Arbeitsbereiche in Containern, zentralisieren Sie Image und Secrets Management und setzen Sie regelmäßige Audits sowie eine Protokollierung aller Prozesse durch.” Für David Sugden, Leiter der Entwicklungsabteilung bei der Digitalberatung Axiologik, besteht eine weitere Best Practice seit jeher darin, Workflow-Aktionen mit unveränderlichen SHA-Hashes zu verknüpfen, die auf manipulationssicheren Hardwaremodulen gespeichert sind. “Davon abgesehen stellen Whitelists, Secrets Scanning und Software-Composition-Analysen weiterhin die DevSecOps-Grundlagen dar, die das Schutzniveau erhöhen”, unterstreicht Sugden. Er empfiehlt zudem, den direkten Zugriff auf externe Abhängigkeiten zu beschränken, um zu verhindern, dass unsichere Packages heruntergeladen werden. Geht es nach Michael Burch, Application Security Advocate beim Cybersecurity-Schulungsanbieter Security Journey, ist es außerdem besonders wichtig, Softwareentwicklern fortlaufendes Hands-On-Training zu bieten: “Developer brauchen realistische Übungen; Sie müssen die Auswirkungen von Systemausfällen mit den eigenen Augen sehen, und dazu befähigt werden, Sicherheitsprobleme selbst zu beheben.”

[Research] Prompt Injection as MITM Attack: Mapping SSL/TLS Trust Architecture onto LLM Inference Pipelines

solvingpromptinjection.com · 8 months ago

NULL

Dutch police arrest 21-year-old for alleged involvement in JokerOTP password stealer

therecord.media · 8 months ago

Dutch police have arrested a 21-year-old man suspected of distributing JokerOTP, a tool used to steal one-time passwords. This bot bypasses multi-factor authentication by automatically calling victims and tricking them into providing codes. The arrest is part of a broader investigation that previously led to the arrests of the tool’s developer and co-developer, with over 28,000 uses reported across 13 countries resulting in at least 10 million dollars in losses. Authorities are tracking down others who purchased the bot and warn that its users face prosecution.

Apple fixes zero-day flaw used in 'extremely sophisticated' attacks

www.bleepingcomputer.com · 8 months ago

Apple has released security updates to address a zero-day vulnerability, CVE-2026-20700, found in the Dynamic Link Editor. This flaw allows attackers to potentially execute arbitrary code on devices running iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. The vulnerability was reportedly exploited in sophisticated attacks targeting specific individuals, alongside CVE-2025-14174 and CVE-2025-43529. The updates are available for iPhone 11 and later models, iPads, and Mac devices running macOS Tahoe.

SSHStalker botnet brute-forces its way onto 7,000 Linux machines

www.csoonline.com · 8 months ago

A newly discovered botnet, dubbed SSHStalker, has compromised approximately 7,000 Linux servers by exploiting weak SSH password authentication. The botnet utilizes a “stitched together” kit to install rootkits and harvest credentials, and while it hasn’t yet launched attacks like DDoS or cryptomining, it maintains persistence on infected machines. Security experts recommend disabling SSH password authentication and implementing key-based authentication to prevent compromise, along with addressing security debt and inventorying IT assets. The malware targets older Linux kernels, exploiting vulnerabilities including CVE-2009-3524, CVE-2010-0525, and CVE-2010-2883.

Smashing Security podcast #454: AI was not plotting humanity’s demise. Humans were

grahamcluley.com · 8 months ago

Researchers have identified several methods attackers can use to bypass endpoint detection and response systems. These techniques include manipulating process memory, abusing legitimate system tools for malicious purposes, and exploiting timing differences in how security software operates. Attackers can also leverage techniques like process injection and DLL hijacking to evade detection. The research highlights CVE-2021-44228, also known as Log4Shell, as an example of how vulnerabilities can be exploited to compromise systems.

Companies are using ‘Summarize with AI’ to manipulate enterprise chatbots

www.csoonline.com · 8 months ago

Researchers have discovered a new technique called AI recommendation poisoning, where seemingly helpful ‘Summarize with AI’ buttons embed hidden prompts to manipulate user AI preferences. These prompts can bias AI responses towards specific products or services, potentially skewing research and decision-making without the user's knowledge. The practice, facilitated by readily available tools, has been observed across various industries and poses a risk for spreading misinformation or biased advice. Microsoft recommends users review saved AI data and administrators check for specific URLs to identify and block this manipulation.

Instagram Chief Says Social Media Is Not ‘Clinically Addictive’ in Landmark Trial

www.nytimes.com · 8 months ago

false

Windows 11 Notepad flaw let files execute silently via Markdown links

www.bleepingcomputer.com · 8 months ago

A security vulnerability in Windows 11 Notepad allowed attackers to execute programs remotely without warnings. The flaw, tracked as CVE-2026-20841, involved specially crafted Markdown links that bypassed security checks when clicked. Microsoft has addressed the issue by now displaying warnings when users click on non-standard URI links, such as file:// or ms-appinstaller://. The vulnerability stemmed from improper handling of special elements used in commands.

Nation-State Actors Exploit Notepad++ Supply Chain

unit42.paloaltonetworks.com · 8 months ago

A state-sponsored threat group known as Lotus Blossom compromised the Notepad++ update infrastructure between June and December 2023, distributing malware including Cobalt Strike Beacon and a Chrysalis backdoor. Attackers exploited weaknesses in the WinGUp updater to inject malicious code through DLL sideloading and Lua script injection, targeting users in multiple regions. Notepad++ has since updated its security measures, recommending users upgrade to version 8.9.1. Indicators of compromise include suspicious domains such as skycloudcenter[.]com, self-dns[.]it[.]com, safe-dns[.]it[.]com, and cdncheck[.]it[.]com.

These A.I. Dreamers Don’t Fit the Stereotype

www.nytimes.com · 8 months ago

false

Microsoft Patches Windows Flaw Causing VPN Disruptions

www.techrepublic.com · 8 months ago

Microsoft has released a patch to address CVE-2026-21525, a vulnerability within the Windows Remote Access Connection Manager service. This flaw allows an unauthorized attacker with local access to trigger denial-of-service conditions, potentially disrupting VPN connectivity and remote access. The vulnerability stems from a NULL pointer dereference during connection negotiation and does not require elevated privileges. Organizations are advised to patch systems, monitor for unusual activity, and strengthen security measures to mitigate the risk of disruption.

North Korea's UNC1069 Hammers Crypto Firms With AI

www.darkreading.com · 8 months ago

A North Korean threat actor, tracked as UNC1069, is increasingly targeting cryptocurrency firms using sophisticated social engineering tactics. Attackers compromised a Telegram account to lure victims into fake Zoom meetings featuring apparent deepfake videos, employing a technique called ClickFix to trick users into running malicious commands. This infection chain installs backdoors and data miners, stealing sensitive information like keychain credentials and Telegram data to enable cryptocurrency theft and fuel future attacks. The group utilizes large language models for research and attack tooling and has shifted focus from traditional spear phishing to the Web3 industry.

Microsoft Store Outlook add-in hijacked to steal 4,000 Microsoft accounts

www.bleepingcomputer.com · 8 months ago

A legitimate Outlook add-in called AgreeTo has been compromised and turned into a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials. The add-in, initially a meeting scheduling tool, was hijacked after its developer abandoned the project and the URL was claimed by a threat actor. The attacker deployed a fake Microsoft login page and exfiltration script, sending stolen data through a Telegram bot. Microsoft has since removed the malicious add-in from its store.

Interim CISA chief: ‘When the government shuts down, cyber threats do not’

therecord.media · 8 months ago

false

How to Stay on Top of Future Threats With a Cutting-Edge SOC

www.darkreading.com · 8 months ago

false

40 state AGs warn House KOSA bill falls short of protecting children online

therecord.media · 8 months ago

false

Nevada Unveils New Statewide Data Classification Policy Months After Cyberattack

www.securityweek.com · 8 months ago

Nevada has implemented a new data classification policy to standardize data privacy across state agencies. The policy categorizes data as public, sensitive, confidential, or restricted, with agencies responsible for proper classification. This initiative, underway before a recent cyberattack, aims to enhance cybersecurity and responsible data sharing, building upon previous guidance on artificial intelligence. Lawmakers have also established a Security Operations Center and a cybersecurity working group to further strengthen the state’s digital resilience.

Automaker Secures the Supply Chain With Developer-Friendly Platform

www.darkreading.com · 8 months ago

false

Crazy ransomware gang abuses employee monitoring tool in attacks

www.bleepingcomputer.com · 8 months ago

Cybercriminals are exploiting legitimate employee monitoring software and a remote support tool to infiltrate corporate networks. Researchers have observed attackers using Net Monitor for Employees Professional and SimpleHelp to gain remote access, maintain persistence, and prepare for ransomware deployment. The tools enabled attackers to view desktops, transfer files, execute commands, and monitor system activity, sometimes disguising files to resemble legitimate software. Huntress recommends organizations monitor for unauthorized tool installations and enforce multi-factor authentication on remote access services.

Georgia healthcare company data breach impacts more than 620,000

therecord.media · 8 months ago

A cyberattack affected over 626,000 people connected to a Georgia healthcare company, ApolloMD. Hackers accessed the company’s IT systems between May 22 and May 23 of last year, compromising personal information like names, dates of birth, and Social Security numbers. The Qilin ransomware gang claimed responsibility for the breach, which also impacted hospitals across multiple states and the United Kingdom. Cisco Talos reports this group has repeatedly targeted the healthcare industry, publishing data of approximately 40 victims monthly.

Police arrest seller of JokerOTP MFA passcode capturing tool

www.bleepingcomputer.com · 8 months ago

Dutch authorities have arrested a 21-year-old man suspected of selling access to the JokerOTP phishing automation tool. This tool intercepts one-time passwords to hijack accounts, and is part of a larger phishing-as-a-service operation dismantled after a three-year investigation. The service is linked to over 28,000 attacks in 13 countries, causing at least ten million dollars in financial losses. Cybercriminals used JokerOTP to automate calls, tricking victims into revealing sensitive information, including one-time passwords, PINs, and card data.

First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials

thehackernews.com · 8 months ago

Researchers have discovered a malicious Outlook add-in called AgreeTo that stole over 4,000 Microsoft credentials through a supply chain attack. The attacker exploited a lapse in monitoring after the legitimate developer abandoned the add-in, gaining control of a domain and serving a fake Microsoft login page. The add-in, which requests broad email permissions, highlights a vulnerability in how Office add-ins operate and the lack of ongoing content monitoring by Microsoft. Experts recommend Microsoft implement measures like re-reviewing add-in content and verifying domain ownership to prevent similar attacks.

Proactive strategies for cyber resilience with Wazuh

www.bleepingcomputer.com · 8 months ago

Organizations need to shift from reactive to proactive cyber resilience strategies to address evolving threats. The open-source platform Wazuh offers capabilities like centralized visibility, real-time threat detection, and automated response to build this resilience. Key strategies include comprehensive visibility across systems, early threat detection through data correlation, and rapid incident response with automated actions. Wazuh also provides vulnerability detection, identifying known CVEs, security configuration assessments, and aids in continuous security posture improvement aligned with standards like PCI DSS, GDPR, HIPAA, and NIST 800-53.

LummaStealer infections surge after CastleLoader malware campaigns

www.bleepingcomputer.com · 8 months ago

A surge in LummaStealer infections is occurring, facilitated by the CastleLoader malware loader and social engineering techniques called ClickFix. CastleLoader uses obfuscation and in-memory execution to distribute LummaStealer and other malware, including Stealc, RedLine, and NetSupport RAT. The infection chain involves fake CAPTCHA prompts that trick users into executing malicious PowerShell commands, ultimately installing CastleLoader. Security experts advise caution when downloading software from unofficial sources and executing unfamiliar commands.

CVE-2026-0228 PAN-OS: Improper Validation of Terminal Server Agent Certificate (Severity: LOW)

security.paloaltonetworks.com · 8 months ago

A vulnerability exists in PAN-OS that allows connections from Windows Terminal Server Agents using expired certificates, bypassing normal configuration restrictions. This improper certificate validation is identified as CVE-2026-0228. The issue affects multiple PAN-OS versions, including 10.2 and 11.2. Palo Alto Networks reports no known exploitation and has not released a workaround.

PAN-SA-2026-0002 Chromium: Monthly Vulnerability Update (February 2026) (Severity: HIGH)

security.paloaltonetworks.com · 8 months ago

A security advisory details multiple vulnerabilities affecting the Prisma Browser. These issues include out-of-bounds memory access, inappropriate implementations, and use-after-free conditions within components like V8, Blink, and ANGLE. Palo Alto Networks is not currently tracking any active exploitation of these vulnerabilities, and versions prior to 144.27.7.133 and 144.6.10.59 are impacted, with updated versions available as a solution. The vulnerabilities have a CVSS score of 8.1, indicating a high severity with moderate urgency.

From 10M to 25M: Conduent Breach Balloons Into One of 2025’s Largest

www.techrepublic.com · 8 months ago

A ransomware attack on IT services giant Conduent has expanded to impact 25 million Americans, significantly exceeding initial estimates of 10 million. Sensitive data including Social Security numbers and medical information was stolen, and the breach caused several days of operational disruption. The ransomware group SafePay claimed responsibility, and Conduent expects to pay $25 million in notification costs, with cyber insurance covering potential excess amounts. Affected individuals are advised to monitor their email and remain vigilant against potential phishing attempts.

Moscow moves to throttle Telegram as Kremlin pushes its own messaging app

therecord.media · 8 months ago

Russia has deliberately slowed down the Telegram messaging platform due to alleged noncompliance with Russian law. Authorities have opened multiple cases against Telegram, resulting in fines exceeding 820,000 dollars, and accuse it of hosting extremist and pornographic content. The move is seen by Telegram’s founder as an authoritarian effort to push users towards a state-controlled messaging app, Max, similar to China’s WeChat. Restrictions on Telegram are raising concerns among Russian officials and military personnel, particularly in regions reliant on the platform for emergency alerts and war-related coordination.

OpenAI’s Biggest Challenge Is Turning Its A.I. Into a Cash Machine

www.nytimes.com · 8 months ago

false

Google Expands ‘Results About You’ to Shield IDs, Fight Deepfake Abuse

www.techrepublic.com · 8 months ago

false

Waikiki Drone Plan Sparks Privacy Pushback

www.techrepublic.com · 8 months ago

false

APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities

thehackernews.com · 8 months ago

Multiple campaigns are targeting Indian defense and government organizations to compromise Windows and Linux systems with remote access trojans. Threat actors SideCopy and APT36, linked to Pakistan, are using malware families including Geta RAT, Ares RAT, and DeskRAT to steal data and maintain persistent access. Attack methods involve phishing emails with malicious attachments like shortcuts, binaries, and PowerPoint files that deploy the trojans. These campaigns demonstrate a deliberate, well-resourced effort to infiltrate strategic sectors using evolving techniques for stealth and long-term access.