Blahalla

New Enterprise-Ready MCP Specification Brings New Security Challenges

www.securityweek.com · 27 days ago

MCP shifts security burdens from protocol to devs/operators. While stateless, developers must now protect tracking IDs from hijacking and prevent data leaks via HTTP headers carrying API keys or PII.

KuinaExtractor Stealer Targets Browser Data, Crypto Wallets, Roblox, Steam, and Discord

gbhackers.com · 27 days ago

KuinaExtractor evolved into k0to, a Rust infostealer targeting browser/crypto wallet data & Steam. It uses techniques like LSASS impersonation to grab master keys. The malware is continuously refined for better stealth.

WhatsApp Adds Security Warning Before Users Start Chat With Unknown Numbers

gbhackers.com · 27 days ago

WhatsApp released a proactive security feature on Android/iOS. It warns users before chatting with unknown numbers via contextual prompts (e.g., country registration), stopping initial social engineering and improving anti-scam defenses.

Intel’s Chip Business Shows Signs of Life After Years of Struggle

www.nytimes.com · 27 days ago

The article covers Intel's critical role in President Trump’s initiative to increase semiconductor manufacturing in the United States. Sources indicate the company must overcome hurdles before realizing a complete corporate turnaround.

How a Niche Technology Became a Choke Point for A.I.

www.nytimes.com · 27 days ago

Chip packaging greatly boosts computing power for artificial intelligence. This technology dependency increases the United States' reliance on Taiwan’s specialized semiconductor manufacturing sector.

The High School Pipeline to South Korea’s Chip-Making Fortunes

www.nytimes.com · 27 days ago

Huge memory-chip profits from the global A.I. boom have increased interest in semiconductor factory work. But behind the hype are uncertain job prospects.

GDPR at 10: Landmark data protections, increasing business burden

www.csoonline.com · 27 days ago

Ten years after implementation, GDPR raised data protection awareness and generated over €6 billion in fines against tech giants like Meta. However, businesses increasingly criticize the law for creating operational burdens and legal uncertainty. Authorities are now directing focus toward practical compliance issues as data-driven projects confront the challenge of integrating AI requirements.

Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

thehackernews.com · 27 days ago

Google Threat Intelligence Group linked Turla to a previously undocumented.NET backdoor called STOCKSTAY. This Windows backdoor deployed against government and military organizations in Ukraine reflects continued development by the hacking group. Additionally, the backdoor targets entities interested in Italian foreign policy.

Chinese-Speaking Hackers Deploy TinyRCT Backdoor Against Critical Energy Infrastructure

gbhackers.com · 27 days ago

CL-STA-1062 targeted SE Asia's government/energy sectors with.NET backdoor TinyRCT. Attackers used SoftEther VPN, Mimikatz, and ASPX shells for access & lateral movement. The backdoor collects fingerprints via AES-128-CBC HTTP channels.

ChatGPT 5.6 Release Reportedly Delayed Following Trump Administration Security Request

gbhackers.com · 27 days ago

Trump admin concerns cited by U.S. officials caused OpenAI to delay GPT-5.6 release due to AI's cyber risk (e.g., Mythos 5 vulnerability scanning). Rollout is now limited to vetted enterprise partners.

Windows Secure Boot Certificate Expiry Exposes Billions of PCs to Bootkit and Firmware Security Risks

gbhackers.com · 27 days ago

Microsoft must rollover Secure Boot certs from 2011 to 2023 versions. KEK CA 2011 expires June 24, 2026; Win Prod PCA 2011 expires Oct 19, 2026. Failure leaves systems vulnerable to early-boot malware and mitigations.

CISA Adds Actively Exploited Cisco Unified CM Flaws to KEV Catalog

gbhackers.com · 27 days ago

CISA added CVE-2026-20230 for Cisco Unified CM (SSRF) to KEV due to active exploitation. Unauthenticated attackers can write files remotely. Organizations must patch immediately per CISA's federal agency directive by June 28, 2026.

Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets

gbhackers.com · 27 days ago

Malware families Mini Shai-Hulud, Miasma, and Hades poisoned npm packages in LeoPlatform and RStreams ecosystems. The campaign uses registry poisoning via binding.gyp files for install-time execution, enabling arbitrary code and credential harvesting. Attackers steal secrets like AWS, Azure, GCP keys and CI/CD tokens by abusing GitHub Actions and IDE hooks.

Hackers Use Malicious Minecraft Fabric Mods to Deploy LoaderClient and WeedHack Stealer

gbhackers.com · 27 days ago

Malicious Minecraft Fabric mods deploy LoaderClient malware. It steals player UUIDs and OAuth tokens via EtherHiding linked to an Ethereum contract. Credentials are then sent to WeedHack using a fileless chain. Hackers impacted multiple victims.

Philip Martin Joins Uber as Chief Information Security Officer

www.securityweek.com · 27 days ago

Philip Martin joined Uber as Chief Information Security Officer. He previously led security operations at Coinbase while building Incident Response teams for Palantir Technologies. Martin also developed virtual infrastructure for Amazon’s A9 after serving a decade as a U.S. Army counterintelligence agent.

Trump Plans to Name Adam Candeub as Antitrust Chief in Justice Dept.

www.nytimes.com · 27 days ago

President Trump plans to nominate a tech critic and telecommunications lawyer, Adam Candeub, to lead the division.

Anthropic is testing desktop-like Claude Cowork for mobile

www.bleepingcomputer.com · 28 days ago

Anthropic appears to be testing Claude Cowork support on mobile, allowing you to manage long-running Claude tasks from your phone.

Robinhood Cuts Access Approval Time to Support High-Velocity Development

www.darkreading.com · 28 days ago

The fintech company's engineering-first application security team re-engineered the process for granting system access, making it easier and more secure for developers working on their projects. Here are the lessons learned from Robinhood's experience.

Poland busts SIM-swapping gang tied to millions in crypto theft

www.bleepingcomputer.com · 28 days ago

Authorities in Poland have arrested four members of an organized cybercrime group accused of breaching telecommunications partners and hijacking email accounts to carry out SIM-swapping attacks.

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

www.microsoft.com · 28 days ago

Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The campaign uses photo-themed ZIP archives and fake image shortcut files to deliver a persistent Node.js implant and evade detection.

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

unit42.paloaltonetworks.com · 28 days ago

Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor.

In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw

www.darkreading.com · 28 days ago

The flaw enables server-side request forgery (SSRF) and escalates privileges to root, impacting Cisco Unified CM and Unified CM SME deployments.

The New York Times Amends Lawsuit Against OpenAI and Microsoft

www.nytimes.com · 28 days ago

In a new court filing, The Times accused Microsoft of encouraging OpenAI to train its A.I. systems using copyrighted articles.

Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses

www.darkreading.com · 28 days ago

The FSB state-sponsored operation has gotten a lot better at loading its malware and hiding its servers.

EdTech Attackers Shift From Schools to Their Software Suppliers

www.darkreading.com · 28 days ago

Educational institutions, the edtech companies they rely on, and, more concerningly, the challenges they pose for schools are the focus of the latest Reporters' Notebook video series.

OpenAI Leans Toward Holding Up I.P.O. Until Next Year

www.nytimes.com · 28 days ago

The A.I. company’s advisers are pushing its chief executive, Sam Altman, to move slowly after SpaceX’s stock has been volatile and as the start-up grapples with financial challenges.

Order-tracking app Shop abused to push callback phishing attacks

www.bleepingcomputer.com · 28 days ago

Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software.

Local Police Collusion Hampers Crackdown on Asian Scam Centers

www.darkreading.com · 28 days ago

With tens of billions of dollars flowing into regional economies from cybercrime, scam centers continue to flourish, despite international and law-enforcement efforts.

Microsoft quietly extends free Windows 10 ESU support to October 2027

www.bleepingcomputer.com · 28 days ago

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates until October 12, 2027.

AI and Liability

www.schneier.com · 28 days ago

Earlier this month, a German court ruled that Google is liable for its AI search summaries. Rejecting defenses like “users can check for themselves,” and that they generally know “that information generated with AI should not be blindly trusted,” the court held that the AI’s summaries are reflections of the company and “above all an expression of Google’s business activities.

New macOS malware embeds fake errors to confuse AI analysis tools

www.bleepingcomputer.com · 28 days ago

A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.

Denmark Ordered to Pay $12M Over Huawei Equipment Removal

www.techrepublic.com · 28 days ago

A Danish court ordered the state to compensate TDC NET after the removal of Huawei fiber-network equipment, raising questions about telecom security costs.

Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms

www.microsoft.com · 28 days ago

Microsoft named a Leader in the Forrester Wave™: Endpoint Management Platforms, Q2 2026, with the highest scores in the current offering and strategy categories.

PirloTV sports piracy network disrupted as 44 domains seized

www.bleepingcomputer.com · 28 days ago

A major sports piracy ring linked to the illegal PirloTV streaming platform has been disrupted in an action that targeted 44 domains.

Chinese A.I. Models Gain Ground on Anthropic and OpenAI

www.nytimes.com · 28 days ago

Silicon Valley engineers recently flocked to new technology from a Chinese company, Z.ai, that is almost as good as its American competitors but much cheaper.

Agentic AI Pentesting Platforms Comparison

gbhackers.com · 28 days ago

AI transforms penetration testing from periodic consulting into a continuous validation discipline crucial for evolving cloud systems. These platforms simulate attacker behavior to analyze complex attack paths, moving beyond mere vulnerability scanning. Tools like XBOW, Pentera, and Horizon3.ai’s NodeZero facilitate this ongoing security validation in modern environments.

Interpol: Cybercrime Hits 30% of Recorded Crime in Surveyed APAC Countries

www.techrepublic.com · 28 days ago

Interpol’s latest Asia and South Pacific cybercrime assessment shows how phishing, ransomware, DDoS attacks, infostealers, and AI-enabled scams are raising security risks across APAC.

Bluekit phishing kit adopts browser-in-the-middle for login theft

www.bleepingcomputer.com · 28 days ago

The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft.

Apple Raises Prices on Macs and iPads Amid the A.I. Boom

www.nytimes.com · 28 days ago

The tech giant cited the soaring costs of memory and storage chips as it increased prices more than $200 on some devices.

Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

thehackernews.com · 28 days ago

An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code. According to Island, the extension, named Adblock for YouTube (ID: cmedhionkhpnakcndndgjdbohmhepckk), has more than 10 million installs and carries a Featured badge on the Chrome Web Store.

The Four Elevations of Effective Fraud Prevention

www.bleepingcomputer.com · 28 days ago

Fraudsters don't attack just one transaction. They target accounts, platforms, and entire ecosystems. IPQS explains the four elevations of fraud prevention and why broader visibility improves fraud detection.

Europol, Microsoft Hit Malware Network Behind 27M Stolen Logins, 140,000 Infected Computers

www.techrepublic.com · 28 days ago

Europol and Microsoft disrupted malware infrastructure linked to 27 million stolen login credentials and 140,000 infected computers in a global cybercrime network.

Runlayer Raises $30 Million in Series A Funding

www.securityweek.com · 28 days ago

The startup’s platform functions as a secure control layer, aiming to secure AI tools across enterprises.

ThreatsDay Bulletin: Smart TV Proxyware, 24-Year curl Bug, AI Crime Forums + 13 More Stories

thehackernews.com · 28 days ago

It’s dumb out there again. This week has the usual smell of prod on fire and nobody wanting to admit who left the door open, old creds still working, trusted apps doing sketchy crap, browser tricks jumping the fence, and “normal” workflows turning into phishing pipes because apparently email was not enough hell already. The worst part is how cheap some of it feels. Not elite. Not cinematic.

ManageEngine AD360 Integrated Products Hit by Account Takeover Vulnerability

gbhackers.com · 28 days ago

ManageEngine has disclosed a critical account takeover vulnerability, tracked as CVE-2026-11374, affecting various integrated products within its AD360 identity and access management suite. The flaw affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when used with AD360 and via single sign-on (SSO) integration.

LokiBot Malware Uses API Hashing and 3DES-Encrypted C2 to Hide Infostealer Activity

gbhackers.com · 28 days ago

LokiBot, a long-lived infostealer first advertised in May 2015, continues to evolve. Recent samples demonstrate deliberate attempts to evade static detection and frustrate analysis by combining API hashing with 3DES-encrypted command-and-control (C2) configuration stored inside the binary.

Webinar: Why account takeovers remain one of the hardest threats to stop

www.bleepingcomputer.com · 28 days ago

Account takeover attacks continue to challenge security teams because attackers often operate through legitimate accounts and trusted services. This webinar explores how behavioral AI can help organizations identify compromised accounts faster and automate response workflows.

Cal Water Finds No Evidence of OT Activity After Hackers Claimed They Could Disrupt Water Supply

www.securityweek.com · 28 days ago

Mandiant has helped the California water utility investigate the cyberattack launched by Iranian hacker group Handala.

Larry Sanger, a Wikipedia Founder, Is Barred From Editing on the Site

www.nytimes.com · 28 days ago

A vote to bar Larry Sanger indefinitely from the volunteer community of Wikipedia came days after he submitted a proposal on “intellectual diversity.

Interesting Paper Exploring Prompt Injection

www.schneier.com · 28 days ago

This is a fascinating explotation of how LLMs fall for prompt injection attacks. It turns out that they learn to recognize the style of text in different role/instruction blocks, and not just the tags. Their conclusion: Role tags were a formatting trick that became the security architecture and the cognitive scaffolding of modern LLMs.