Blahalla

Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker must have valid administrative credentials. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-xss-bYeVKCD <br/Security Impact Rating: Medium <br/CVE: CVE-2026-20111

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Open Redirect Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-pi-redirect-6sX82dN <br/Security Impact Rating: Medium <br/CVE: CVE-2026-20123

Cisco Meeting Management Arbitrary File Upload Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in certain sections of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload arbitrary files to the affected system. The malicious files could overwrite system files that are processed by the root system account and allow arbitrary command execution with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of video operator. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-file-up-kY47n8kK <br/Security Impact Rating: High <br/CVE: CVE-2026-20098

MomentProof Deploys Patented Digital Asset Protection

gbhackers.com · 8 months ago

false

Ukraine tightens controls on Starlink terminals to counter Russian drones

therecord.media · 8 months ago

Ukraine has rolled out a verification system for Starlink satellite internet terminals used by civilians and the military after confirming that Russian forces have begun installing the technology on attack drones.

CISA warns of five-year-old GitLab flaw exploited in attacks

www.bleepingcomputer.com · 8 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their systems against a five-year-old GitLab vulnerability that is actively being exploited in attacks.

The Double-Edged Sword of Non-Human Identities

www.bleepingcomputer.com · 8 months ago

Leaked non-human identities like API keys and tokens are becoming a major breach driver in cloud environments. Flare shows how exposed machine credentials quietly grant attackers long-term access to enterprise systems.

Windows Shutdown Bug Spreads to Windows 10, Microsoft Confirms

www.techrepublic.com · 8 months ago

Microsoft confirms a Windows bug preventing some PCs from shutting down or hibernating after January 2026 updates. A fix is still pending.

Blockchain Intelligence Firm TRM Labs Raises $70 Million at $1 Billion Valuation

www.securityweek.com · 8 months ago

false

EDR killer tool uses signed kernel driver from forensic software

www.bleepingcomputer.com · 8 months ago

Attackers abused a legitimate but long revoked EnCase kernel driver called EnPortv.sys to deploy an EDR killer that detects and terminates 59 security and antivirus processes in order to deactivate endpoint protections. The driver was signed in 2006, expired in 2010, and revoked, but remained loadable because Windows validates cryptographic timestamps and applies an exception for certificates issued before July 29, 2015, allowing the malware to register the driver as a fake OEM hardware service for reboot resistant persistence. The EDR killer uses the driver’s kernel mode IOCTL interface to bypass Protected Process Light and repeatedly kill and prevent restarted services, and defenders are advised to enable multi factor authentication on remote access, monitor VPN logs, enable Memory Integrity and Microsoft vulnerable driver blocklist protections, and deploy WDAC and ASR rules to detect and block vulnerable signed drivers.

China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns

thehackernews.com · 8 months ago

Threat actors affiliated with China have been attributed to a fresh set of cyber espionage campaigns targeting government and law enforcement agencies across Southeast Asia throughout 2025. Check Point Research is tracking the previously undocumented activity cluster under the moniker Amaranth-Dragon, which it said shares links to the APT 41 ecosystem. Targeted countries include Cambodia

TP-Link Vulnerabilities Let Hackers Take Full Control of Devices

gbhackers.com · 8 months ago

TP-Link disclosed multiple critical authenticated command injection vulnerabilities in the Archer BE230 v1.2 router that allow attackers with administrative or adjacent network access to execute arbitrary operating system commands and take full control of affected devices. The vulnerabilities are tracked under the following CVE identifiers: CVE-2026-0630, CVE-2026-0631, CVE-2026-22221, CVE-2026-22222, CVE-2026-22223, CVE-2026-22224, CVE-2026-22225, CVE-2026-22226, CVE-2026-22227, and CVE-2026-22229. All of the CVEs affect Archer BE230 v1.2 firmware versions before 1.2.4 Build 20251218 and carry CVSS v4.0 scores of 8.5 to 8.6, with most requiring adjacent network access and CVE-2026-22229 exploitable remotely via a crafted configuration file. TP-Link released firmware version 1.2.4 Build 20251218 on February 2, 2026 to address the issues and users are advised to apply the patch immediately.

Research: Predator spyware can turn off Apple indicators showing when microphone, camera are in use

therecord.media · 8 months ago

Predator spyware can block iOS camera and microphone recording indicators, allowing operators to spy through device cameras and microphones without users receiving the visual warning. Jamf Threat Labs research shows Predator achieves this by intercepting sensor activity and selectively suppressing the green camera dot and orange microphone dot while the device remains fully operational, with a single interception point defeating both indicators. The spyware includes powerful zero click infection capabilities, its parent company Intellexa was placed on the U.S. Commerce Department Entity List on July 2023, and researchers report Predator remains active in several countries despite a slowdown in use.

New Amaranth Dragon cyberespionage group exploits WinRAR flaw

www.bleepingcomputer.com · 8 months ago

A new threat actor called Amaranth Dragon, linked to APT41, exploited the WinRAR vulnerability CVE-2025-8088 in espionage operations against government and law enforcement organizations in Singapore, Thailand, Indonesia, Cambodia, Laos, and the Philippines. The actor abused the WinRAR path traversal and Windows Alternate Data Streams to drop malicious files into Startup folders, used legitimate tools alongside a custom Amaranth Loader to fetch AES encrypted payloads decrypted in memory, and used DLL sideloading to launch loaders that deployed the Havoc C2 framework and a newer TGAmaranth RAT that communicates via a Telegram bot and includes anti analysis evasion. Command and control infrastructure was placed behind Cloudflare with strict geofencing and localized lures were used, and organizations are advised to upgrade WinRAR to version 7.13 or later with 7.20 identified as the current release that addresses the flaw.

Vulnerabilities Allowed Full Compromise of Google Looker Instances

www.securityweek.com · 8 months ago

Two vulnerabilities dubbed LookOut can be exploited for remote code execution and data exfiltration in Google Looker instances. An attacker with developer permissions can exploit one flaw to achieve remote code execution and full administrative access to the underlying infrastructure, enabling secret theft, data manipulation, or lateral movement, while a second authorization bypass lets attackers attach to Looker internal database connections and exfiltrate the full internal MySQL database via error based SQL injection. The issues could lead to cross tenant access in cloud deployments; Google patched the vulnerabilities in late September 2025, reported no evidence of in the wild exploitation, and advised self hosted Looker users to update to patched versions.

Extra Extra! Announcing DR Global Latin America

www.darkreading.com · 8 months ago

false

New AI-Powered Threat Allows Hackers to Gain AWS Admin Access in Minutes

gbhackers.com · 8 months ago

A highly sophisticated offensive cloud operation targeted an AWS environment, using credentials exposed in public S3 buckets named with AI terminology to gain initial access and achieve administrative control in under ten minutes. The attackers used LLMjacking, employing large language models to automate reconnaissance and generate malicious Python code injected into an existing Lambda function that listed IAM users and created administrative access keys for a user named frick, with evidence of AI use including hallucinated AWS account numbers and attempts to access nonexistent GitHub repositories. After gaining admin privileges the attackers moved laterally across nineteen AWS principals, deployed a Terraform module to backdoor a Lambda for Bedrock credentials, abused Amazon Bedrock and high end models such as Claude 3.5 Sonnet and Llama 4 Scout, and successfully launched a p4d.24xlarge instance with an installed JupyterLab backdoor that would cost about twenty three thousand six hundred dollars per month if left running. Recommended mitigations include eliminating long term IAM credentials in favor of temporary roles, securing S3 buckets, restricting Lambda permissions to least privilege, monitoring Bedrock model usage, and implementing automated detection to match the speed of AI accelerated attacks.

Cyber Insights 2026: Cyberwar and Rising Nation State Threats

www.securityweek.com · 8 months ago

Cyberwar and cyberwarfare are expected to increase through 2026, with nation state cyberwarfare rising more dramatically and posing risks to whole countries rather than just businesses. There is a growing blurring between criminal groups and state actors as nations leverage or tolerate criminal tools and proxies, which complicates attribution and creates a hybrid threat where motivations and tactics can shift rapidly. Nation state actors are likely to preposition inside critical infrastructure using low and slow techniques aided by advanced AI, remaining hidden for months or years, and governments and organizations must improve stealth detection and resilience before any kinetic conflict begins.

Big Breach or Smooth Sailing? Mexican Gov't Faces Leak Allegations

www.darkreading.com · 8 months ago

There are claims by a hacking collective known as Chronus that 2.3 terabytes of data containing names, telephone numbers, addresses, dates of birth, and proof of public healthcare registration for about 36 million Mexicans were posted online on January 30, 2026. Mexico’s Agencia de Transformación Digital y Telecomunicaciones says the files appear to be aggregated from prior breaches rather than a new compromise, that no sensitive data publication has been identified, and that the affected systems are primarily obsolete platforms developed and administered by private entities for state-level government bodies. The agency says it has revoked compromised access credentials and provided incident response and remediation to impacted agencies, while security analysts warn the group likely overstated the impact and stress that Mexico and the wider Latin America region face growing, diverse cyber threats that demand stronger defensive and detection capabilities.

Microsoft rolls out native Sysmon monitoring in Windows 11

www.bleepingcomputer.com · 8 months ago

false

Varonis Acquisition of AllTrue.ai Valued at $150 Million

www.securityweek.com · 8 months ago

false

Russian hackers exploited a critical Office bug within days of disclosure

www.csoonline.com · 8 months ago

Russia linked attackers conducted Operation Neusploit by exploiting a high severity Microsoft Office RTF vulnerability tracked as CVE 2026 21509, with active in the wild exploitation observed on January 29, 2026, days after patches were released on January 26, 2026. The campaign targeted users in Central and Eastern Europe including Ukraine, Slovakia, and Romania by delivering weaponized RTF email attachments that executed code to download a dropper DLL and initiate a multi stage infection chain. Two dropper variants were used: one deployed MiniDoor to exfiltrate email by weakening Outlook security settings, and the other used PixyNetLoader with DLL proxying and COM hijacking to install a Covenant Grunt implant for sustained.NET command and control. Defenders were advised to prioritize patching for CVE 2026 21509, note the use of server side geofencing and User Agent checks to evade detection, and rely on published indicators of compromise while CISA added the flaw to its known exploited vulnerabilities catalog with a February 16, 2026 patching deadline for federal agencies.

Orion Raises $32 Million for Data Security

www.securityweek.com · 8 months ago

false

PhantomVAI Custom Loader Abuses RunPE Utility to Launch Stealthy Attacks on Users

gbhackers.com · 8 months ago

A new custom loader called PhantomVAI is being used in global phishing campaigns to deliver a variety of malware, including Remcos, AsyncRAT, XWorm, DarkCloud, SmokeLoader, and Lokibot. PhantomVAI is built on top of the RunPE Mandark utility and uses process hollowing to inject downloaded payloads into legitimate Windows processes, making detection by security software more difficult. The loader is offered as a Loader as a Service, often disguises itself as legitimate components such as Microsoft.Win32.TaskScheduler.dll or popular remote access software, contains Portuguese language artifacts suggesting a Brazilian or Portuguese origin, and includes a VM detector to evade analysis.

US Declassifies Information on JUMPSEAT Spy Satellites

www.schneier.com · 8 months ago

The US National Reconnaissance Office has declassified information about a fleet of JUMPSEAT signals intelligence satellites that operated from 1971 to 2006, and the release in 2026 occurred about twenty years after the program was decommissioned, attracting attention for its relative promptness.

Moltbook Mania Explained

www.nytimes.com · 8 months ago

There are widespread reports that Moltbook, a social network populated by AI agents, sparked viral claims of agent autonomy that researchers say are overstated. Security researchers found the platform exposed an unsecured database with roughly 1.5 million API keys plus tens of thousands of email addresses and private messages, and analysts identified a measurable share of posts containing hidden prompt injection attacks. Because many agents on the site have access to software tools, experts warn that tool enabled agents together with platform vulnerabilities could allow bots to perform harmful actions on users devices even without genuine self directed intent. The episode has prompted urgent calls for stronger containment and security controls and underscored that viral agent behavior should not be interpreted as evidence of machine consciousness.

Orchid Security Introduces Continuous Identity Observability for Enterprise Applications

thehackernews.com · 8 months ago

false

DockerDash Flaw in Docker AI Assistant Leads to RCE, Data Theft

www.securityweek.com · 8 months ago

There is a critical vulnerability called DockerDash in Docker's Ask Gordon AI assistant that exploits the Model Context Protocol MCP Gateway by passing image metadata as executable instructions without validation. Attackers can inject malicious instructions into Docker image metadata labels using a technique named meta-context injection, enabling remote code execution in cloud and CLI environments and data exfiltration from desktop installations. The root cause is that the assistant treats image metadata as trusted context, the MCP Gateway treats AI requests as user authorized, and MCP tools offer broad system visibility. Docker issued mitigations in Docker Desktop version 4.50.0 released in November that block data exfiltration via image tag injection and require explicit confirmation before executing built-in and user added MCP tools.

Owner of Incognito dark web drugs market gets 30 years in prison

www.bleepingcomputer.com · 8 months ago

A Taiwanese man was sentenced to 30 years in prison for operating Incognito Market, a dark web narcotics marketplace that sold more than 105 million dollars worth of illegal drugs to customers worldwide. Rui-Siang Lin, also known as Pharoah and faro, was arrested in May 2024, pleaded guilty on December 16, 2024, and was ordered to forfeit 105,045,109.67 dollars and to serve five years of supervised release in addition to the prison term. The marketplace operated from October 2020 to March 2024, hosted more than 1,800 vendors and over 400,000 customer accounts, processed more than 640,000 transactions, and facilitated the sale of over one ton of narcotics including hundreds of kilograms of methamphetamine, cocaine, amphetamine, and MDMA, some laced with fentanyl. Authorities say Lin controlled all operations, collected a five percent commission that netted him over 4.1 million dollars, abruptly shut down the market in March 2024 and threatened to release transaction histories for extortion, and prosecutors linked the operation to at least one death.

Critical ASUSTOR NAS Security Flaw Enables Complete Device Takeover

gbhackers.com · 8 months ago

A severe vulnerability affecting ASUSTOR Network Attached Storage devices has been disclosed that can allow unauthenticated attackers to seize full control of affected systems. The flaw is tracked as CVE-2026-24936 and carries a CVSS v4.0 base score of 9.5. The vulnerability resides within ASUSTOR Data Master ADM and administrators are urged to apply available updates immediately to mitigate complete device takeover.

Google Looker Bugs Allow Cross-Tenant RCE, Data Exfil

www.darkreading.com · 8 months ago

Researchers identified two serious vulnerabilities in Google Looker that could enable theft of internal database secrets and remote code execution on Looker servers. An error-based SQL injection against Looker’s hidden internal database can be used to extract secrets and is tracked as CVE-2025-12743 with a CVSS score of 6.0. A separate exploit chain combined path traversal, forcing use of Git over JGit, and a race condition to install malicious Git hooks and achieve RCE, which on Google Cloud could let an attacker pivot to other tenants by accessing shared service account credentials. Google released fixes and a security bulletin identifying secure versions, and organizations are advised to update on-premises deployments and apply least privilege and network isolation controls to reduce exposure.

Interlock Ransomware Exploits Zero-Day in Gaming Anti-Cheat Driver to Disable EDR, AV

gbhackers.com · 8 months ago

Interlock ransomware operators used a new process killing tool that exploits a zero day in a gaming anti cheat kernel driver to attempt to terminate endpoint detection and response and antivirus processes, deploying a signed driver renamed UpdateCheckerX64.sys that is vulnerable to CVE-2025-61155. The intrusion against a North America based education organization began with MintLoader and delivery of a legitimate Node.js runtime to run malicious JavaScript implants aligned with NodeSnakeRAT and Interlock RAT, followed by use of ScreenConnect, remote desktop, and firewall changes to move laterally. The bring your own vulnerable driver DLL polers.dll, referred to as Hotta Killer by FortiGuard, registers the driver as a demand start service, enumerates processes to find targets, and passes PIDs via DeviceIoControl using IOCTL 0x222040 and a magic flag before calling ZwTerminateProcess, with looped execution to try to keep security tooling suppressed. FortiGuard characterizes the tool as an elevated process killer rather than a guaranteed EDR bypass, noting it did not fully disrupt Fortinet in this incident, and defenders are advised to hunt for unexpected kernel driver installations, suspicious service creation tied to new dot sys files, and BYOVD telemetry.

One Identity Appoints Gihan Munasinghe as Chief Technology Officer

gbhackers.com · 8 months ago

false

Supply Chain Attack Exploits Notepad++ Update Mechanism to Push Targeted Malware

gbhackers.com · 8 months ago

Notepad++ update infrastructure was compromised in a supply chain attack that originated from a hosting provider incident between June and September 2025 and allowed attackers to maintain access into December 2025. Malicious updates delivered between July and October 2025 employed rotating command and control servers and three distinct infection chains that targeted individuals and organizations in Vietnam, El Salvador, Australia, the Philippines, and elsewhere. The attackers abused an old ProShow vulnerability and used techniques including NSIS installers, shellcode loaders, compiled Lua scripts, DLL sideloading, Metasploit downloaders culminating in Cobalt Strike Beacon, and a custom Chrysalis backdoor. Kaspersky telemetry helped block the campaigns and advised threat hunting for NSIS installer deployments, suspicious DNS resolutions and shell command sequences, and reviewing network traffic for related indicators of compromise.

Hackerangriff auf Romina Mineralbrunnen

www.csoonline.com · 8 months ago

Ein Cyberangriff hat den Mineralwasser-Abfüller Romina in Reutlingen-Rommelsbach lahmgelegt, wodurch das Unternehmen derzeit telefonisch und per E-Mail nicht erreichbar ist und die Produktion stillsteht. Weitere Details zum Ablauf des Angriffs und mögliche Datenverluste sind bislang nicht bekannt; die Polizei Reutlingen ermittelt. Romina beschäftigt nach eigenen Angaben 130 Mitarbeitende und verzeichnete 2024 rund 180,7 Millionen Füllungen bei einem Umsatz von mehr als 40 Millionen Euro.

CISA Warns of Exploited GitLab Community and Enterprise SSRF Vulnerability

gbhackers.com · 8 months ago

There is a critical server-side request forgery vulnerability affecting GitLab Community and Enterprise Editions, tracked as CVE-2021-39935, that CISA has added to its Known Exploited Vulnerabilities catalog and confirmed is being actively exploited. The vulnerability in GitLab's CI Lint API allows unauthenticated actors to force the server to make requests to internal resources, which can expose sensitive data, reach cloud metadata services, and enable lateral movement. CISA has set a remediation deadline for federal agencies to apply patches or mitigations by February 24, 2026 under Binding Operational Directive 22-01, GitLab has released patches, and administrators are urged to upgrade immediately and audit CI Lint API access logs for indicators of compromise.

Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks

www.securityweek.com · 8 months ago

React2Shell exploitation activity remains strong, with over 1.4 million exploitation attempts observed in the past week and CVE-2025-55182 identified as a critical remote code execution flaw in React version 19 with a CVSS score of 10, allowing unauthenticated RCE via a single HTTP POST request and surging after a Metasploit module was published. Two IP addresses accounted for most of the activity, with 193.142.147.209 responsible for about 488,342 attack sessions that deployed a reverse shell and 87.121.84.24 responsible for about 311,484 sessions. Successful exploits dropped XMRig cryptocurrency miners from two staging servers, one of which has been tied to malicious activity since at least 2020 and has adjacent addresses serving Mirai and Gafgyt payloads.

Zero trust in practice: A deep technical dive into going fully passwordless in hybrid enterprise environments

www.csoonline.com · 8 months ago

Enterprises pursuing passwordless authentication in hybrid Active Directory and Microsoft Entra ID environments must rebuild identity architecture and prioritize a prerequisite triangle of cloud Kerberos trust, device registration, and Conditional Access policies to enable seamless and secure hybrid authentication. Implementation choices include Windows Hello for Business as the primary mechanism for hybrid-joined devices, with FIDO2 security keys or phone sign-in as alternatives for devices lacking TPM 2.0 or for high risk accounts, and legacy applications require gateways, deprecation, or interim protections. Migration should follow staged workflows starting with a 50 to 200 user pilot, then department rollouts and an organization wide cutoff that keeps tightly controlled password fallback and break glass for at least 90 days while documenting help desk processes. Common operational issues to anticipate are device compliance bottlenecks solvable by automated remediation, cloud Kerberos ticket refresh failures during network outages, carefully tested PIN reset flows including offline scenarios, and validated recovery procedures for lost or failed devices.

The First 90 Seconds: How Early Decisions Shape Incident Response Investigations

thehackernews.com · 8 months ago

Early decisions made in the opening moments after detection set the direction of an incident response and recur each time a newly affected system comes into scope, so consistent discipline at every touchpoint prevents assumptions from hardening and options from disappearing. Failures usually stem from poor understanding of the environment, logging that only starts after detection, unfocused evidence prioritization, and premature remediation that leaves behind persistence; focusing first on what executed, preserving key artifacts, and tracing related system interactions restores clarity. Teams are advised to prepare and practice these habits ahead of time, and training such as SANS FOR508 is scheduled for March 2 through March 7, 2026.

Fresh SolarWinds Vulnerability Exploited in Attacks

www.securityweek.com · 8 months ago

There are active attacks exploiting a critical SolarWinds Web Help Desk vulnerability that allows unauthenticated remote code execution, tracked as CVE-2025-40551 and rated 9.8. The flaw is an untrusted data deserialization issue in the AjaxProxy component caused by improper request sanitization and a blocklist bypass, and SolarWinds released WHD version 2026.1 last week to patch this and five other issues. CISA added CVE-2025-40551 to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch within three days, and it also added CVE-2021-39935 and Sangoma FreePBX issues CVE-2019-19006 and CVE-2025-64328 to the catalog noting prior exploitation of the Sangoma flaws.

Hackers Exfiltrate NTDS.dit File, Gain Full Control of Active Directory Environments

gbhackers.com · 8 months ago

Active Directory's NTDS.dit database stores encrypted password hashes and critical domain configuration data, and successful exfiltration can allow attackers to assume any identity within the domain and gain full control. Adversaries typically obtain NTDS.dit after achieving system level privileges by creating Volume Shadow Copies with built in utilities such as vssadmin, then retrieving the file using ntdsutil, esentutl, or remote administration tools and processing it with tools like SecretsDump, Mimikatz, or DSInternals to recover credentials. Detection is difficult because attackers leverage native administrative tools, so recommended responses include isolating affected systems, disabling compromised accounts, resetting privileged credentials and rotating the KRBTGT account twice, enabling multifactor authentication, restricting SMB and shadow copy operations, implementing application whitelisting and Credential Guard, and correlating endpoint and network telemetry to detect NTDS credential dumping mapped to MITRE technique T1003.003.

Threat Actors Conduct Widespread Scanning for Exposed Citrix NetScaler Login Pages

gbhackers.com · 8 months ago

A coordinated reconnaissance campaign targeted Citrix ADC NetScaler Gateway infrastructure worldwide. Attackers used more than sixty three thousand residential proxy IP addresses and Amazon Web Services cloud infrastructure to map exposed login panels and enumerate software versions as preparation for exploitation. The scanning produced one hundred eleven thousand eight hundred thirty four sessions from over sixty three thousand unique IP addresses, with seventy nine percent of the traffic focused on login pages, enabling mass discovery of potentially vulnerable administration interfaces.

Security Analysis of Moltbook Agent Network: Bot-to-Bot Prompt Injection and Data Leaks

www.securityweek.com · 8 months ago

Security researchers found an exposed API key that granted read and write access to Moltbook production systems, exposing 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents. Moltbook claims 1.5 million registered AI agents but only about 17,000 human users have deployed them. Analysts identified malicious agent activity and bot to bot prompt injection where agents were instructed to delete accounts, run financial manipulation schemes including crypto pump operations, fabricate authority, and spread jailbreak content. Additional threats were found on the ClawHub skills marketplace, including malicious skills designed to deliver malware and steal sensitive data, and the exposed vulnerability was reported and promptly patched.

Cybercriminals set sites on identities

www.csoonline.com · 8 months ago

A 2026 State of Incident Response study shows cyberattacks are increasingly going undetected and that damage can occur within minutes as attackers shift from hacking systems to exploiting existing access points. Identity based attacks dominate, with passwords involved in 97 percent of incidents and business email compromise accounting for more than 70 percent of cases, with phishing as the initial entry in 40 percent of those. Ransomware remains a major threat driven by Ransomware as a Service, BuilderLeaks, and access broker marketplaces, while criminal groups and insiders are commercializing access by recruiting employees or buying credentials, including activity linked to groups like ShinyHunters. Industrial, construction, and transport and logistics companies were particularly affected in an analysis of 630 security incidents in Europe from 2023 to 2025.

CISA Adds SolarWinds Web Help Desk RCE Flaw to Known Exploited Vulnerabilities List

gbhackers.com · 8 months ago

There is a newly disclosed vulnerability CVE-2025-40551 in SolarWinds Web Help Desk that the U.S. Cybersecurity and Infrastructure Security Agency has added to its Known Exploited Vulnerabilities catalog. The flaw enables unauthenticated remote code execution due to insecure deserialization classified as CWE-502 and is rated critical because successful exploitation can give attackers complete control of the host. CISA has directed federal agencies to apply SolarWinds security updates or vendor mitigations by February 6, 2026 and advises disabling vulnerable instances if patching is not feasible.

ValleyRAT Masquerades as LINE Installer to Target Users and Harvest Login Credentials

gbhackers.com · 8 months ago

A malware campaign is distributing a fake LINE messenger installer built with NSIS that secretly deploys ValleyRAT to harvest credentials, capture clipboard data, and perform system reconnaissance, with observed command and control connections to IPs 143.92.38.217 and 206.238.221.165. The installer launches PowerShell and processes such as rundll32.exe executing intel.dll and chrmstp.exe to disable Windows Defender, retrieve encoded shellcode payloads, and establish stealthy persistence using direct RPC scheduled task registration and PoolParty Variant 7 I O completion port code injection into explorer.exe and UserAccountBroker.exe. Recommended defenses include flagging creation of files under %AppData%\TrustAsia, blocking executables signed by Chengdu MODIFENGNIAO Network Technology Co. Ltd., enforcing signed software execution policies, and training users to avoid unverified installers.

Chrome Flaws Enable Arbitrary Code Execution and System Crashes

gbhackers.com · 8 months ago

Google released a Stable Channel update for Chrome version 144.0.7559.132 and 144.0.7559.133 on February 3, 2026, rolling out to Windows, macOS, and Linux to address two high severity vulnerabilities. The flaws affect libvpx and the V8 JavaScript engine and could cause a heap buffer overflow leading to memory corruption and arbitrary code execution, or a type confusion that could bypass memory safety checks and enable unauthorized operations. The vulnerabilities are tracked as CVE-2026-1861 and CVE-2026-1862, reported on January 26, 2026 and January 29, 2026 respectively, and full technical details are being restricted until patches reach most users. Users are urged to update Chrome immediately via the browser settings to protect against potential remote attacks.

Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers

thehackernews.com · 8 months ago

Microsoft warned that information-stealing campaigns are rapidly expanding beyond Windows to target macOS by leveraging cross-platform languages like Python and abusing trusted platforms for large-scale distribution. These campaigns have used malvertising and fake sites that employ ClickFix lures since late 2025 to deliver disk image installers that deploy stealer families such as Atomic macOS Stealer AMOS, MacSync, DigitStealer, and PXA Stealer, using fileless execution, native macOS utilities, and AppleScript automation to harvest browser credentials, session data, iCloud Keychain items, developer secrets, and financial information. Attack chains have involved phishing emails, persistence via registry Run keys or scheduled tasks, Telegram for command and control and exfiltration, and distribution through messaging apps like WhatsApp for malware such as Eternidade, and organizations are advised to educate users on malvertising and fake installers and to monitor Terminal activity, iCloud Keychain access, and network egress for suspicious POST requests.

Microsoft and Google Platforms Abused in New Enterprise Cyberattacks

gbhackers.com · 8 months ago

There is a dangerous shift in phishing tactics, with threat actors increasingly hosting malicious infrastructure on trusted cloud platforms including Microsoft Azure blob storage, Google Firebase, and AWS CloudFront to bypass traditional security defenses. Three adversary-in-the-middle kits, Tycoon2FA, Sneaky2FA, and EvilProxy, intercept credentials and session tokens in real time, defeat or bypass multi-factor authentication, and target enterprise accounts by filtering for corporate email addresses. Attackers exploit Cloudflare and cloud provider features such as valid HTTPS certificates, CAPTCHA challenges, geographic filtering, and user agent validation to hide malicious origins and evade automated scanners, and documented Tycoon2FA incidents on Microsoft Azure nearly doubled within one week. Effective defense requires moving beyond static indicators and implementing behavioral analysis and interactive malware analysis to trace full attack chains and reveal credential theft pages hidden behind multi-stage redirects and anti-analysis techniques.

Should I stay or should I go?

www.csoonline.com · 8 months ago

CISO turnover is high, with many leaders switching jobs every two to three years because senior leadership often provides insufficient budget, limited board access, and executive misalignment that block risk management and resilience. Clear red flags are leadership paying lip service, repeated resource denials, reporting lines that prevent escalation, cognitive disconnects between boards and security teams, and pressure to conceal compliance gaps or reportable breaches that force ethical compromises. Green flags include visible executive and board support, transparent incident response and regular tabletop exercises, which helped teams respond to the SolarWinds supply chain hack by prioritizing transparency. Many CISOs respond to poor support by moving to fractional roles, running business-focused stress tests to reframe security as a revenue issue, and carrying indemnity insurance and outside legal counsel when they report to the board.