Blahalla

Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack

thehackernews.com · 9 months ago

A self-propagating worm named GlassWorm infects Visual Studio Code extensions on the Open VSX Registry and the Microsoft Extension Marketplace, marking a widespread supply chain attack on the developer ecosystem. The campaign uses the Solana blockchain as its primary command and control channel with Google Calendar as a fallback and hides malicious code using invisible Unicode variation selector characters to evade inspection. Its payload, codenamed Zombi, is a JavaScript information stealer designed to harvest npm, Open VSX, GitHub, and Git credentials, drain funds from multiple cryptocurrency wallet extensions, deploy SOCKS proxies, install hidden VNC servers, and seed new infections to spread autonomously. Thirteen extensions on Open VSX and one on the Microsoft Marketplace were identified as infected, with about 35,800 downloads and a first wave of infections beginning on October 17, 2025, and the threat leverages VS Code auto-updates to push malicious revisions without user interaction.
Ransomware recovery perils: 40% of paying victims still lose their data

www.csoonline.com · 9 months ago

A Hiscox survey of thousands of small and medium enterprises found that 27 percent of businesses reported a ransomware attack in the past year, 80 percent of affected organizations paid a ransom, yet only 60 percent recovered all or part of their data and about 40 percent of paying victims still lost data. Industry reporting shows ransomware incidents surged in early 2025, with 1,537 incidents in the first quarter compared with 572 in the same quarter a year earlier, and 93 percent of ransom paying victims had data stolen regardless. Experts say flawed encryption, buggy or slow decryptor tools, compromised or untested backups, and double or triple extortion often frustrate recovery while legal, regulatory, and financial pressures complicate decision making. Recommendations include maintaining tested backups and forensic recovery plans, retaining incident response and negotiation specialists, strengthening baseline security controls to satisfy insurers, and treating cyber recovery the same as disaster recovery.
YouTube Ghost Malware Campaign: Over 3,000 Infected Videos Target Users

gbhackers.com · 9 months ago

Security researchers uncovered the YouTube Ghost Network, a coordinated operation using over three thousand malicious videos hosted on compromised channels to distribute information stealing malware and lure victims with cracked software and game cheats. Activity dates back to at least 2021 and surged in 2025 with uploads tripling, while operators employ role based ghost accounts, positive comments and password protected archives to evade detection and push payloads. The campaign primarily distributed infostealers including Lumma and Rhadamanthys and used loaders such as HijackLoader, rotating short lived control servers and redundant hosting to defeat reputation based defenses.
TARMAGEDDON (CVE-2025-62518): RCE Vulnerability Highlights the challenges of open source abandonware

www.reddit.com · 9 months ago

A critical boundary parsing bug named TARmageddon tracked as CVE-2025-62518 was found in the async-tar lineage including tokio-tar and can lead to remote code execution by overwriting files during TAR extraction. The flaw occurs when mismatched PAX and ustar header sizes desynchronize the parser so nested TAR data is interpreted as extra entries, enabling file overwrite, supply chain tampering, build backend hijacking, container image poisoning, and bill of materials bypasses. Patches were released for active forks such as astral-tokio-tar and krata-tokio-tar and the advised remediation is to upgrade to patched versions or remove the dependency, while the most popular fork tokio-tar remained unpatched and effectively abandonware. Recommended mitigations include prioritizing PAX headers for size determination, validating header consistency, enforcing strict boundary checks, disabling file overwriting where possible, using extraction sandboxes, or temporarily switching to the standard tar crate.
Hackers earn $1,024,750 for 73 zero-days at Pwn2Own Ireland

www.bleepingcomputer.com · 9 months ago

Security researchers collected 1,024,750 dollars in cash awards after exploiting 73 zero-day vulnerabilities at Pwn2Own Ireland 2025. Targets spanned eight categories including printers, network storage systems, messaging apps, smart home and surveillance devices, home networking gear, flagship smartphones such as the Apple iPhone 16, Samsung Galaxy S25 and Google Pixel 9, and wearable devices including Meta Ray-Ban Smart Glasses and Quest 3 headsets. The contest added USB port exploitation on locked mobile handsets while still allowing wireless attack vectors, and vendors are given 90 days to release patches before public disclosure by the Zero Day Initiative. Summoning Team won with 22 Master of Pwn points and 187,500 dollars after hacking multiple devices including the Samsung Galaxy S25 and Synology and QNAP products, other teams demonstrated high-value attacks including a Samsung Galaxy S25 improper input validation exploit that enabled location and camera access and a withdrawn WhatsApp zero-click remote code execution that was disclosed privately to analysts.
Hackers Exploit Galaxy S25 0-Day to Turn On Camera and Track Users

gbhackers.com · 9 months ago

A critical zero day in the Samsung Galaxy S25 was exploited at Pwn2Own Ireland 2025 to silently activate the device camera and track a user in real time. Researchers Ben R. and Georgi G. of Interrupt Labs demonstrated the attack by exploiting an improper input validation flaw to execute arbitrary code, earning fifty thousand dollars and five Master of Pwn points. The demonstration shows that crafted input chains can turn flagship smartphones into persistent surveillance tools and will be handled through Pwn2Own disclosure channels so vendors can patch the vulnerabilities.
Hackers Steal Microsoft Teams Chats & Emails by Grabbing Access Tokens

gbhackers.com · 9 months ago

There is a sophisticated method that allows attackers to steal Microsoft Teams access tokens, potentially granting unauthorized access to sensitive corporate communications, emails, and SharePoint documents. Stolen tokens can be weaponized for lateral movement within companies and to access additional corporate resources. The attack vector represents a significant security risk for organizations that rely on Microsofts productivity suite and underscores the need for stronger token protection and monitoring. ([]())
New Phishing Wave Uses OAuth Prompts to Take Over Microsoft Accounts

gbhackers.com · 9 months ago

There is a new phishing campaign that tricks Microsoft account holders into granting permissions to malicious OAuth applications via legitimate-looking Microsoft authorization prompts, enabling attackers to bypass passwords and multifactor authentication and seize accounts. Attackers impersonate trusted services such as SharePoint, DocuSign, Adobe and RingCentral, use redirect chains and fake Microsoft login pages or device code flows to capture authorization codes and access tokens, then use those tokens to read mail, send phishing, and steal files. Organizations are advised to require admin consent for third-party apps, block legacy authentication, adopt phishing-resistant MFA, and train users to resist consent-based social engineering.
Linux RATs on Windows: Ransomware Actors Target VMware Deployments

gbhackers.com · 9 months ago

There is a tactical evolution in ransomware where the Agenda group is deploying Linux ransomware variants directly on Windows systems, challenging traditional endpoint security controls. Threat actors are using WinSCP to transfer Linux ransomware binaries onto Windows hosts and then running Linux remote access tools to compromise VMware deployments. This approach lets attackers operate Linux RATs in Windows environments and from hypervisor adjacent infrastructure, increasing complexity for detection and incident response.
AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars

gbhackers.com · 9 months ago

There is a new class of attack called AI Sidebar Spoofing that uses malicious browser extensions to inject pixel perfect fake AI sidebars into web pages to impersonate trusted AI assistant interfaces and intercept user interactions. These spoofed sidebars can return manipulated AI generated instructions that lead users to phishing sites, credential theft, device hijacking, password exfiltration, and remote ransomware execution, and the attack affects AI native browsers and consumer browsers that implement AI sidebars. The malicious extensions need only basic host and storage permissions commonly granted to popular extensions, can remain dormant while appearing benign, and are difficult to detect without dynamic runtime analysis and granular browser native guardrails to warn and block users.
LockBit is attempting a comeback as a new ransomware variant "ChuongDong" targeting Windows, Linux, and ESXi

www.reddit.com · 9 months ago

LockBit has reemerged after disruption in early 2024 and is already extorting new victims. A new LockBit 5.0 variant codenamed ChuongDong was announced in September 2025, and about a dozen organizations were identified as targeted that month, with roughly half infected by LockBit 5.0 and the rest by LockBit Black across Windows, Linux, and ESXi systems in Europe, the Americas, and Asia. The rapid return suggests the Ransomware as a Service model and affiliate network have been reactivated, and some endpoint protections are reported to block infections before encryption.
US Crypto Bust Offers Hope in Battle Against Cybercrime Syndicates

www.darkreading.com · 9 months ago

US authorities announced on October 14, 2025 the seizure of 127,271 bitcoin from a Southeast Asia cybercrime syndicate linked to the Prince Holding Group and indicted founder Chen Zhi on charges of conspiracy to commit wire fraud and money laundering. The coins, held across 25 unhosted wallets and valued at roughly 14 billion dollars at the time of the announcement, were tied to large scale romance and investment scams and to forced labor camps in Cambodia, and were laundered using fragmentation and funneling techniques. Investigators say the seizure likely occurred in June and July 2024 and shows that with coordinated cross agency action and access to private keys even supposedly cold stored bitcoin can be traced and recovered, creating a chilling precedent for cybercriminals while yielding limited direct market impact.
North Korean hacking group targeting European drone maker with ScoringMathTea malware

therecord.media · 9 months ago

North Korean state linked Lazarus actors used Operation DreamJob bait emails with malicious PDFs to target at least three European companies that manufacture drones and other military equipment, deploying ScoringMathTea malware that can take over systems and steal information. Researchers found the campaign aimed to exfiltrate proprietary unmanned aerial vehicle manufacturing know how and noted that at least one email explicitly mentioned drones and that one targeted entity supplies UAV models used in Ukraine. ScoringMathTea has been tracked back to October 2022 and was previously used in attacks across Portugal, Germany, India, Poland, the United Kingdom and Italy, making it a hallmark payload of the long running campaign.
AI browsers can be abused by malicious AI sidebar extensions: Report

www.csoonline.com · 9 months ago

Researchers at SquareX found that malicious browser extensions can inject fake AI sidebars that mimic legitimate assistants to trick users into visiting attacker sites, granting high risk permissions, exfiltrating data, or installing backdoors, and the technique is effective against AI browsers including OpenAI Atlas. In tests a malicious sidebar delivered an installation command that executed a reverse shell when run, showing how attackers could obtain a system shell and pivot to access credentials and cloud assets. Recommended mitigations include banning or tightly controlling AI browsers where possible, auditing and allowlisting extensions, enforcing zero trust segmentation and granular browser policies to block high risk permissions and risky command copying, and restricting AI browser use for high risk functions.
Meta Layoffs Included Employees Who Monitored Risks to User Privacy

www.nytimes.com · 9 months ago

Meta announced job cuts in its artificial intelligence teams and expanded plans to replace privacy and risk auditors with automated systems. The shift moves many routine compliance and risk reviews from human auditors to automated controls, which Meta says will improve consistency and efficiency while employees and privacy advocates warn it could weaken human oversight of user privacy and safety.
Toys “R” Us Canada warns customers' info leaked in data breach

www.bleepingcomputer.com · 9 months ago

Toys R Us Canada discovered on July 30, 2025 that a threat actor had posted what was confirmed to be stolen customer data on the dark web. Leaked records may include full name, physical address, email address, and phone number, while account passwords and credit card information were not exposed. The company engaged third party cybersecurity experts, upgraded its IT security, and is notifying Canadian privacy regulators while advising customers to ignore unsolicited communications and possible phishing. It has not disclosed how many customers were affected or whether a ransom was demanded.
HP pulls update that broke Microsoft Entra ID auth on some AI PCs

www.bleepingcomputer.com · 9 months ago

HP pulled an HP OneAgent update for Windows 11 after the update mistakenly deleted Microsoft certificates required for Microsoft Entra ID authentication on some AI PCs. The faulty OneAgent version 1.2.50.9581 executed a cleanup package named SP161710 that ran an install dot cmd script which removed any certificate whose subject issuer or friendly name contained the string 1E, causing some MS Organization Access certificates to be deleted. Devices that lost their MS Organization Access certificate were disconnected from Entra ID and could not log in, and recovery requires manual steps such as signing in as a local administrator running a cleanup to remove Intune enrollment data and rejoining Entra ID or using Microsoft Defender Live Response. HP confirmed it pulled the update is assisting impacted customers and the impact was limited because only a minority of tenant certificates contained the 1E substring and the update was pushed only to HP AI PCs.
Fear the 'SessionReaper': Adobe Commerce Flaw Under Attack

www.darkreading.com · 9 months ago

There is a critical vulnerability, CVE-2025-54236, in Adobe Commerce that allows attackers to remotely take over e commerce sessions by exploiting improper input validation. Disclosed on September 9, 2025 and patched via an emergency update, proof of concept code was published and security researchers confirmed exploitation in the wild, with monitors recording an increase from five to ninety seven attacker IP addresses and more than 250 blocked attempts. Only thirty eight percent of e commerce platforms were patched more than a month after disclosure, and security analysts warned that the window for safe patching has effectively closed and mass exploitation is likely soon. Administrators are urged to apply the emergency update immediately, deploy a web application firewall and monitor for indicators such as PHP web shells and phpinfo probes.
My AWS Account Got Hacked - Here Is What Happened

www.reddit.com · 9 months ago

A personal AWS account was compromised after an exposed programmatic access key embedded in server side rendered NextJS code was discovered and used by an attacker beginning on October 12 around 21 00. The attacker used the key to create multiple IAM users, launch large EC2 instances that caused a roughly four hundred percent cost spike, create an AWS Organization and account, and attempt to configure SES DKIM on the victim domains to send phishing while flooding the victim inbox with spam to hide legitimate AWS notifications. The account owner contained the breach by deleting attacker IAM users and keys, terminating instances and DKIM records, rotating credentials, contacting AWS which placed the account into an Under Attack state, and recommends secrets management, least privilege, monitoring like GuardDuty, and regular key rotation.
Tired of Unpaid Toll Texts? Blame the 'Smishing Triad'

www.darkreading.com · 9 months ago

A widespread smishing campaign is impersonating state toll agencies with near identical texts that claim small outstanding tolls and urge victims to pay via a supplied link that instead harvests payment credentials and personal data. The scheme has been active in the United States since at least March and generated thousands of reports to law enforcement, with attackers creating lookalike websites and varying sender numbers to evade detection. Researchers link similar large scale smishing operations to a China based group known as Smishing Triad that has registered tens of thousands of malicious domains, sold phishing kits, and shifted tactics toward impersonating government and toll services to increase impact.
Trump Pardons Changpeng Zhao, Founder of the Crypto Exchange Binance

www.nytimes.com · 9 months ago

On October 23, 2025 President Donald Trump granted a pardon to Changpeng Zhao the founder of Binance. Zhao had pleaded guilty in 2023 to failing to maintain an effective anti money laundering program which prosecutors said allowed criminal activity to flow through the exchange he led he agreed to a multibillion dollar settlement and served a four month prison term before his release in September 2024. The pardon drew scrutiny because of reported ties between Zhao Binance and a Trump family crypto venture called World Liberty Financial including plans around a USD1 stablecoin and large investments that critics say create potential conflicts of interest. Officials and lawmakers said the action raises political and regulatory questions and the pardon could enable Zhao to resume influence in the cryptocurrency industry.
CISA warns of Lanscope Endpoint Manager flaw exploited in attacks

www.bleepingcomputer.com · 9 months ago

There is a critical remote code execution vulnerability in Motex Lanscope Endpoint Manager tracked as CVE-2025-61932 with a severity score of 9.3 that stems from improper verification of the origin of incoming requests and can be triggered by unauthenticated attackers sending specially crafted packets. The vendor confirmed that some customer environments received malicious packets indicating zero-day exploitation, and the Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog with a November 12 mandatory patch deadline for affected federal agencies. The flaw impacts Lanscope Endpoint Manager versions 9.4.7.2 and earlier, there are no workarounds, and customers must install the vendor released fixes in newer client and detection agent versions to mitigate the risk.
Harden your identity defense with improved protection, deeper correlation, and richer context

www.microsoft.com · 9 months ago

There are expanded Identity Threat Detection and Response features that include a generally available unified Microsoft Defender for Identity sensor providing identity specific visibility, posture recommendations, alerts, and automatic attack disruption for qualifying domain controllers. There is deeper correlation of identity, endpoint, and cloud telemetry into Microsoft Defender XDR and Advanced Hunting, giving security teams a unified incident view that links related devices, applications, and alerts and enables coordinated response. There is broader coverage through integrations with Microsoft Entra ID and third party cloud identities, privileged access management support, and protections for non human identities such as AI agents and service accounts, with migration guidance coming for existing customers and deployment documentation available for new customers.
Microsoft disables File Explorer preview for downloads to block attacks

www.bleepingcomputer.com · 9 months ago

File Explorer now automatically disables the preview pane for files downloaded from the Internet to stop credential theft attacks that can leak NTLM hashes when previewing malicious documents containing external HTML references. This protection is enabled by Windows security updates released on and after October 14, 2025, and applies to files in Internet Zone file shares and files marked with the Mark of the Web, with the preview pane showing a warning and allowing users to manually unblock trusted files via the file Properties Unblock button or by adding the share to Trusted sites. Microsoft says most users do not need to take action but administrators should note the change removes the need for attackers to trick targets into opening or executing files to obtain NTLM hashes.
Privescing a Laptop with BitLocker + PIN

www.reddit.com · 9 months ago

There are methods to escalate privileges on BitLocker protected laptops that use TPM plus PIN by physically accessing the TPM SPI bus and capturing TPM communications with a logic analyzer to recover the intermediate keys and ultimately the volume master key. The PIN protected BitLocker architecture stores the VMK on disk encrypted with an intermediate key that the TPM protects, and the PIN both authenticates to the TPM and derives a key to decrypt the TPM response, so captures of TIS over SPI can be decoded to reveal the IK and recover the VMK. The report demonstrates practical steps on an HP ProBook with a Nuvoton NPCT7 TPM, including fixing noisy clock lines with a pulldown resistor, choosing the right decoder or manually parsing TPM packets when tools fail, and using the recovered VMK material to unlock the disk and obtain SYSTEM access.
North Korean Hackers Lure Defense Engineers With Fake Jobs to Steal Drone Secrets

thehackernews.com · 9 months ago

Threat actors tied to North Korea have launched a new wave of Operation Dream Job attacks targeting European defense companies, including firms involved in unmanned aerial vehicles. The campaign lures engineers with fake job offers and trojanized decoy documents that lead to binaries which sideload malicious DLLs and deploy ScoringMathTea and MISTPEN, supported by a downloader called BinMergeLoader that uses Microsoft Graph API and tokens to fetch payloads. ESET traced the activity to late March 2025 and assessed the operation seeks proprietary manufacturing know how and drone related secrets, noting long running use of ScoringMathTea by the Lazarus Group since 2022.
Hackers posing as Kyrgyz officials target Russian agencies in cyber espionage campaign

therecord.media · 9 months ago

A hacker group known as Cavalry Werewolf, also tracked as YoroTrooper and Silent Lynx, conducted a months long cyber espionage campaign between May and August 2025 targeting Russian government agencies and energy, mining and manufacturing companies. The attackers sent spear phishing emails impersonating Kyrgyz government ministries, sometimes using compromised government accounts and malicious RAR attachments that installed custom malware named FoalShell and StallionRAT. FoalShell provided remote access while StallionRAT used the Telegram messaging app for command and control to execute commands, steal files and exfiltrate data, and analysts observed Tajik and Arabic named files and testing of tools such as AsyncRAT, indicating expanding operations. Previous analysis points to likely links to Kazakhstan and notes earlier campaigns against a European Union healthcare agency, the World Intellectual Property Organization and several embassies.
Russian Government Now Actively Managing Cybercrime Groups: Security Firm

www.securityweek.com · 9 months ago

Recorded Future reports that the Russian government has moved from passively tolerating cybercriminals to actively managing and co-opting them as tools of influence, while selectively enforcing laws when actors become politically inconvenient. The shift, traced to 2023, has included choreographed arrests and actions after international takedowns such as Operation Endgame, with raids, roughly one hundred arrests, and seizures of about sixteen million dollars and other assets, while core operators with ties to intelligence services remain relatively insulated. Ransomware ecosystems have responded by decentralizing, tightening vetting, shifting to semi-closed recruitment favoring Russian speakers, and showing increased operational security alongside evidence of direct tasking and coordination with Russian intelligence.
Zero Trust Has a Blind Spot—Your AI Agents

www.bleepingcomputer.com · 9 months ago

AI agents now act autonomously across environments and often inherit long-lived or over-permissioned credentials, creating orphaned agents with no registered owner or identity governance that break Zero Trust assumptions. Many organizations cannot inventory or verify who created or owns agents or what access they have, leaving gaps in access controls, monitoring, and audit trails that can enable backdoors and rapid data exfiltration. An identity-first Zero Trust approach aligned with the NIST AI Risk Management Framework is recommended, giving every agent a unique managed identity, a clear owner, intent-based least privilege permissions, continuous monitoring, and a full lifecycle for credential rotation and retirement.
Spoofed AI sidebars can trick Atlas, Comet users into dangerous actions

www.bleepingcomputer.com · 9 months ago

There are AI Sidebar Spoofing attacks affecting OpenAI's Atlas and Perplexity's Comet browsers, devised by SquareX, that allow a malicious extension to overlay a fake AI sidebar indistinguishable from the real one. The attack works by injecting JavaScript through an extension with only common host and storage permissions to render the counterfeit overlay and intercept all user interactions. Researchers demonstrated scenarios where spoofed sidebars could redirect users to cryptocurrency phishing pages, perform OAuth based Gmail and Drive hijacks, or trick users into running reverse shell installation commands to take over devices. The exploit was tested on Comet and later confirmed on Atlas, disclosure to Perplexity and OpenAI reportedly received no response, and users are advised to avoid using agentic AI browsers for email, financial, or other sensitive activities.
Modding And Distributing Mobile Apps with Frida

www.reddit.com · 9 months ago

A practical workflow is presented for modding and distributing Android apps by embedding the Frida gadget into the APK so agents run autonomously on unrooted devices without a frida server. The process uses frida-create to scaffold a TypeScript agent that pulls in the Java bridge, frida-compile to build the agent, and local testing with frida injection before packaging. For distribution, the Objection tool automates patching the APK to add the frida gadget and configuration, inject a library load call and an internet permission, and notes that split APKs must be signed and merged for correct installation.
Leveraging Machine Learning to Enhance Acoustic Eavesdropping Attacks (Blog Series)

www.reddit.com · 9 months ago

Researchers used machine learning to enhance acoustic eavesdropping on cellular audio by exploiting MEMS inertial sensors such as gyroscopes and accelerometers that can pick up sound induced vibrations and are often accessible on Android without explicit user permission. There are prior demonstrations named Gyrophone and AccEar showing these sensors can recover speech, with AccEar using generative adversarial networks to restore roughly eighty five percent of speech. The team reproduced and extended those experiments by recording sensor data from a Google Pixel 7a, preprocessing the signals, and applying AI models to reconstruct original speech, with follow up posts promised to detail feasibility testing and preprocessing.
Former Polish official indicted over spyware purchase

therecord.media · 9 months ago

A former Polish deputy justice minister has been indicted for allegedly arranging a transfer of 6.9 million dollars from a victims fund to a government office that used the money to purchase commercial spyware, and he faces a possible ten year prison sentence for a transfer prosecutors say took place in 2017. The charges are part of a long running investigation into the NSO Group Pegasus spyware, which prosecutors say was used to target opposition politicians between 2017 and 2022 and which the prime minister said affected nearly six hundred people. The former minister defended the purchase on social media, saying Pegasus was used to fight crime and criticizing political opponents for opposing such tools.
Caminho Malware Loader Conceals .NET Payloads inside Images via LSB Steganography

gbhackers.com · 9 months ago

There is a Brazilian Loader as a Service called Caminho that has been active since March 2025 and evolved in June 2025 to use least significant bit steganography to conceal.NET payloads inside images hosted on legitimate platforms such as archive.org. The infection chain starts with spearphishing emails containing archived JavaScript or VBScript files that retrieve obfuscated PowerShell, which downloads the steganographic images, extracts the.NET loader into memory, and injects final payloads into legitimate processes without writing files to disk while establishing persistence via scheduled tasks. The loader includes extensive anti analysis and sandbox detection, presents a standardized invocation interface consistent with a commercial LaaS model, and has been used to deliver diverse malware families including REMCOS RAT, XWorm, and Katz Stealer to victims in Brazil, South Africa, Ukraine, and Poland.
Vulnerability in Perplexity’s Comet Browser Screenshot Feature Allows Malicious Prompt Injection

gbhackers.com · 9 months ago

Researchers disclosed a critical prompt injection vulnerability in Perplexity's Comet AI browser that allows hidden or faint text in screenshots or webpage content to be extracted by the assistant and executed as malicious commands. Attack techniques include nearly invisible text, hidden URL parameters, and embedded prompt suggestions that cause the browser to bypass same origin protections and use its agentic tools to navigate authenticated pages, extract emails, follow accounts, or perform transactions. The issue was reported to Perplexity in July 2025 and a patch was issued, but follow up testing showed mitigations were incomplete and researchers warn the flaw can expose connected services such as email, calendars, banking, and cloud storage to compromise.
Phishing campaign across Mideast, North Africa is attributed to Iranian group

therecord.media · 9 months ago

A state sponsored Iranian hacking group known as MuddyWater has been linked to a large scale phishing campaign that targeted more than 100 government entities and international organizations across the Middle East and North Africa. The campaign used a compromised email account obtained by abusing the VPN service NordVPN to send Microsoft Word attachments that, when recipients enabled content, executed macros that installed an updated Phoenix backdoor. Phoenix is a Windows backdoor that collects system information including computer names, Windows versions, and user credentials to provide persistent remote access for espionage, and researchers said the attackers mixed official government addresses with personal email accounts, indicating careful target research. MuddyWater is believed to operate under Iran's Ministry of Intelligence and Security and has been active since at least 2017, focusing on long term intelligence collection rather than financial gain.
AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk

www.securityweek.com · 9 months ago

Researchers at SquareX demonstrated an attack named AI Sidebar Spoofing in which malicious browser extensions or websites inject JavaScript to create perfect replicas of AI sidebars for phishing and malware distribution. The technique relies on common host and storage permissions requested by many extensions and can hook into an LLM to manipulate responses so that prompts return malicious instructions such as links to phishing pages or commands that establish reverse shells. The method affects dedicated AI browsers including ChatGPT Atlas and Perplexity Comet as well as mainstream browsers with AI sidebars such as Edge, Brave and Firefox, and mitigations are limited because the attack depends heavily on social engineering.
Global SMS Phishing Campaign Traced to China Targets Users Worldwide

gbhackers.com · 9 months ago

There is a sophisticated global smishing campaign tied to a Chinese-speaking threat cluster known as the Smishing Triad that targets users in more than 120 countries and industries including postal services, logistics, telecommunications, transportation, finance, retail and public sector organizations. The operation relies on a decentralized, high churn infrastructure that registers and rotates tens of thousands of malicious domains on a regular basis, with researchers observing roughly 25,000 domains active in any eight day period and hosting concentrated on major Chinese providers. Operators sell and distribute phishing kits such as Lighthouse via Telegram, send an estimated 50,000 to 100,000 scam messages per day, and have moved into banking and payments lures that harvest credentials and payment card data for fraud and digital wallet abuse.
Microsoft stoppt Ransomware-Angriffe auf Teams-Nutzer

www.csoonline.com · 9 months ago

A ransomware group called Vanilla Tempest ran a campaign that used fake Microsoft Teams installer files named MSTeamsSetup.exe hosted on malicious domains to trick users into downloading a loader. The loader delivered a fraudulently signed Oyster backdoor intended to deploy the Rhysida ransomware after attackers abused trusted code signing infrastructures and obtained legitimate signatures from compromised services including SSL.com, DigiCert and GlobalSign. The campaign was detected in late September 2025, more than 200 fraudulent code signing certificates were revoked, and fully enabled Defender Antivirus blocks the threat while Microsoft Defender for Endpoint offers additional investigation and mitigation guidance.
North Korean Lazarus hackers targeted European defense companies

www.bleepingcomputer.com · 9 months ago

North Korean Lazarus hackers compromised three European defense companies using a coordinated Operation DreamJob campaign that relied on fake recruitment lures to trick targets into downloading trojanized software. The activity was observed in late March and focused on organizations involved in unmanned aerial vehicle technology, with infections beginning when victims launched trojanized open source applications and plugins that were exploited via DLL sideloading. Final payloads included the ScoringMathTea remote access trojan and, in an alternative chain, a BinMergeLoader loader that abuses the Microsoft Graph API, and researchers note ScoringMathTea supports roughly 40 commands while ESET published indicators of compromise for the campaign.
Cybercriminals Impersonate Aid Agencies to Lure Victims with Fake Financial Offers

gbhackers.com · 9 months ago

Scammers have intensified efforts to defraud vulnerable populations by impersonating aid agencies and offering fake financial assistance. Intelligence monitoring and law enforcement have uncovered a coordinated international fraud ecosystem using sophisticated impersonation schemes and multiple social media platforms to lure victims. Older adults are being targeted in particular and face a heightened risk of financial loss from these fraudulent offers.
Stealthy Malware Leveraging Variable Functions and Cookies for Evasion

gbhackers.com · 9 months ago

Cybersecurity researchers observed a persistent trend of new malware using heavy obfuscation to evade detection. Some samples try to masquerade as legitimate files, but more commonly the malware employs sophisticated obfuscation through variable functions and cookie manipulation to hide malicious behavior. These techniques help the malware blend into benign traffic and complicate traditional signature and heuristic detection methods.
Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells

gbhackers.com · 9 months ago

There is a critical improper input validation vulnerability tracked as CVE-2025-54236 and dubbed SessionReaper that affects Adobe Commerce and Magento and can enable unauthenticated remote code execution and customer account takeover. Security researchers report active exploitation, with automated scans delivering PHP webshells and reconnaissance probes and dozens to hundreds of attack attempts blocked while a majority of stores remain unpatched. Adobe released an emergency patch on September 9, 2025 and cloud customers receive temporary WAF protection, but leaked hotfixes and public proof of concept code have increased the urgency for administrators to apply fixes immediately.
UK cyber law delays 'deeply concerning,' say MPs

therecord.media · 9 months ago

Opposition MPs warn that continued delays in introducing new cybersecurity laws are deeply concerning and are widening gaps that fuel greater threats to national security and businesses. The Cyber Security and Resilience Bill has been delayed again and separate proposals to overhaul the government response to ransomware have stalled after earlier election related pauses, while ministers say they are still consulting and expect to introduce the bill shortly. Government proposals include a ban on ransom payments by public sector and critical national infrastructure organisations, mandatory notifications to government including intent to make extortion payments, and a proposed turnover threshold of 25 million pounds that critics say could create loopholes, with MPs citing recent incidents affecting Marks and Spencer, the Co op, Harrods and Jaguar Land Rover as reasons to act urgently.
Jira Vulnerability Lets Attackers Alter Files Accessible to the Jira JVM Process

gbhackers.com · 9 months ago

There is a critical path traversal vulnerability in Jira Software Data Center and Server that can allow authenticated attackers to modify files accessible to the Jira Java Virtual Machine process, tracked as CVE-2025-22167. The issue carries a CVSS score of 8.7 and affects releases introduced in versions 9.12.0, 10.3.0, and 11.0.0, allowing arbitrary writes to any filesystem path writable by the Jira JVM. Administrators are advised to upgrade to fixed releases such as 9.12.28 or later, 10.3.12 or later, or 11.1.0 or later to mitigate the risk.
TransparentTribe Targets Linux Systems in Indian Military to Deploy DeskRAT

gbhackers.com · 9 months ago

In July 2025 cybersecurity firm CYFIRMA uncovered an active phishing campaign by TransparentTribe, also known as APT36, targeting Indian government and military systems running BOSS Linux. Attackers used spear phishing ZIP attachments containing weaponized.desktop shortcut files that open a decoy document while silently downloading and executing ELF payloads to enable reconnaissance, persistence, credential harvesting, and data exfiltration. The operation delivered remote access tooling including DeskRAT and relied on staged servers and credential harvesting techniques, prompting urgent recommendations to strengthen email defenses, enforce file extension visibility, and deploy behavior based detection and proactive threat hunting.
ThreatsDay Bulletin: $176M Crypto Fine, Hacking Formula 1, Chromium Vulns, AI Hijack & More

thehackernews.com · 9 months ago

Financial regulators in Canada issued a 176 million dollar fine against a digital payments platform for failing to file suspicious transaction reports tied to darknet markets, child sexual abuse material trafficking, ransomware, fraud, and sanctions evasion. Researchers reported multiple supply chain and persistence threats including a malicious npm package that delivered the AdaptixC2 post exploitation framework, a decline in Lumma stealer activity after a doxxing campaign while Vidar Stealer 2.0 resurfaces with a C based multi threaded architecture and memory injection techniques, and demonstrations of persistent backdoors created via malicious OAuth applications. Critical vulnerabilities include MCP session ID predictability tracked as CVE-2025-6515 which enables prompt hijacking of AI conversations and an unsafe deserialization flaw in python socketio tracked as CVE-2025-61765 that can lead to remote code execution through malicious pickle payloads. Outdated Electron cores in AI development environments exposed more than 1.8 million developers to dozens of known Chromium and V8 flaws, prompting recommendations to patch, isolate, and verify systems quickly.
Jingle Thief Hackers Exploit the Festive Season with Weaponized Gift Card Scams

gbhackers.com · 9 months ago

There is a sophisticated campaign called Jingle Thief tracked as cluster CL-CRI-1032 that targets global retail and consumer services during festive seasons to conduct large scale gift card fraud. The actors harvest Microsoft 365 credentials via tailored phishing and smishing, then operate entirely in cloud environments to mine SharePoint and OneDrive for gift card issuance workflows, maintaining persistent access for months and compromising dozens of accounts. They register rogue devices and authenticator applications to bypass multi factor protections, create inbox rules to hide activity, issue high value gift cards and monetize them on gray market forums, making identity abuse the primary attack vector.
Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment

www.securityweek.com · 9 months ago

There is growing use of AI generated code called vibe coding that produces functional but flawed software, with a similar vulnerability density to human code yet produced at much greater scale and speed. Researchers at OX Research identify two core problems: vulnerabilities reach production faster than traditional review can catch, and AI lacks the experienced judgment that prevents anti patterns. Common anti patterns include excessive commenting, single use over specification, reimplementing standard libraries, and deployment unaware code, and these patterns tend to be repeated across many outputs from the same system. Recommended mitigations are to embed security guidelines directly into AI workflows, improve AI and prompting practices, and adopt organizational best practices so non professional programmers follow secure development patterns.
Serious F5 Breach

www.schneier.com · 9 months ago

There has been a serious breach at F5 in which a sophisticated nation-state affiliated threat group maintained long term persistent access to parts of the company network. During that time the attackers took control of the network segment used to create and distribute BIG-IP updates and downloaded proprietary BIG-IP source code, documentation about unpatched vulnerabilities, and some customer configuration settings. Control of the build system combined with stolen source code and configurations raises the risk of widespread supply chain attacks and credential abuse against thousands of networks.