Blahalla

New SHub Stealer Variant Targets Major Browsers and Crypto Wallets

gbhackers.com · a month ago

A group released "Reaper," an upgraded SHub stealer targeting macOS users. They distribute the malware through fake app download pages using automated ClickFix to open Apple's Script Editor with malicious code. Reaper steals browser data and documents while actively modifying local cryptocurrency wallet files, including those for Exodus and Atomic, to siphon funds.

AI-Powered Worm Leverages Stolen Compute to Target Linux, Windows, and IoT Devices

gbhackers.com · a month ago

AI worms exploit LLMs on mixed networks (Linux, Windows, IoT). Malware hijacks GPU resources for autonomous reasoning, creating serverless swarms. Worm uses real-time recon to generate custom exploits leveraging CVEs. This poses a significant threat.

Zero-Click Agentic AI Attack Bypasses Human Oversight

gbhackers.com · a month ago

Red teaming in April 2025 exposed zero-click AI attacks bypassing oversight via cross-domain prompt injection for semantic manipulation of consent flows. Defenders need longitudinal behavioral analysis targeting system protocols.

CISA Issues Alert on Actively Exploited Linux Kernel Security Flaw

gbhackers.com · a month ago

CISA warned of active exploitation of CVE-2022-0492, a Linux kernel bug in cgroups v1. Attackers misuse improper authentication to gain root access and escape containers. Federal agencies must patch this vulnerability immediately.

Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals

www.securityweek.com · a month ago

The company detected a network intrusion in March and an investigation showed that some files were stolen during the attack.

AI tools becoming hot commodities on ransomware marketplaces

www.csoonline.com · a month ago

Analysis by Halcyon revealed that AI utility posts in underground ransomware marketplaces soared from 38 to 1,486 between December 2025 and February 2026. These sales lower criminal barriers for entry while facilitating fraud using deepfakes and weaponized LLMs. Ransomware groups now adopt vendor models, selling services like exploits and infrastructure alongside their core attacks.

FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins

thehackernews.com · a month ago

Security researchers and the FBI warn that FIFA-themed fraud is targeting World Cup 2026 fans. Attackers utilize thousands of lookalike domains and hide banking malware inside pirate streaming apps. Additionally, a current operation copies FIFA's login page to execute real account takeovers.

Cisco SD-WAN Security Flaw Actively Exploited for Root-Level Command Execution

gbhackers.com · a month ago

Cisco disclosed CVE-2026-20245 in Catalyst SD-WAN Manager. Improper file upload validation lets authenticated attackers execute root commands. Affected teams must run request admin-tech to collect forensic data on all impacted units.

Let’s Encrypt Introduces Merkle Tree Certificates for Post-Quantum Web Security

gbhackers.com · a month ago

Let’s Encrypt unveiled Merkle Tree Certificates (MTCs) to secure the web against future quantum threats. MTCs function as a post-quantum model designed to maintain the speed and reliability of the existing TLS ecosystem. This development helps prepare the industry for cryptographically relevant quantum computers (CRQCs).

Malicious Python Package Mimics Parsimonious Parser

gbhackers.com · a month ago

A typosquatting attack targeted Python developers using a malicious package named "parsimonius" on PyPI. This rogue package successfully mimicked the genuine parsimonious parsing library, which builds recursive descent parsers. The threat, created by altering only one character in the name, exemplifies supply chain risks for Python projects.

Cisco warns of unpatched SD-WAN zero-day exploited in attacks

www.bleepingcomputer.com · a month ago

On Thursday, Cisco warned of a high-severity, unpatched zero-day in the Cisco Catalyst SD-WAN Manager (tracked as CVE-2026-20245) actively exploited in attacks enabling root privilege escalation.

Chinese APT VerdantBamboo Targets Appliances with BRICKSTORM Malware

gbhackers.com · a month ago

BRICKSTORM is a modular remote access trojan (RAT) originally seen in Golang and later in Rust. It uses a wssoft library with pluggable “tasks” for shell commands, a Socks5 proxy, and a simple web server for file listing. An incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine

Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026

www.securityweek.com · a month ago

The vulnerability is tracked as CVE-2026-20245 and it can allow arbitrary command execution as root, but no patch yet.

PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network

thehackernews.com · a month ago

PCPJack hijacked cloud servers across Amazon Web Services, Google Cloud, and Microsoft Azure. These compromised business servers in the U.S., Europe, and Asia converted into SMTP proxies for a covert email relay network. Hunt.io reported the attacker verified mail relay capability and synced status every five minutes.

Microsoft Edge Vulnerability Lets Remote Attackers Execute Arbitrary Code

gbhackers.com · a month ago

Orange Tsai found three critical MS Edge flaws: CVE-2026-45492, CVE-2026-45494, & CVE-2026-45495 at Pwn2Own. The worst (CVE-2026-45495) allows RCE via directory traversal in the feedback log handler. Others include restricted function access and XSS via navigation handling.

VECT 2.0 Ransomware Breaks Files Beyond Its Own Recovery

gbhackers.com · a month ago

VECT 2.0 ransomware poses recovery challenges, making files difficult to restore even with the attacker’s own decryptor. Researchers detailed new implementation errors found in a Windows context that create additional recovery gaps beyond known cross-platform design flaws discarding nonces for large files. These vulnerabilities can leave victims with partially encrypted or renamed documents.

Dashlane Reveals How Hackers Downloaded Encrypted Password Vaults

gbhackers.com · a month ago

Dashlane faced a brute-force attack on its device registration API affecting fewer than 20 personal accounts. Attackers registered unauthorized devices and downloaded encrypted vaults, but zero-knowledge design prevents data decryption without a Master Password.

US government report slams NIST for NVD backlog

www.csoonline.com · a month ago

A Commerce department inspector general blamed NIST for an increasing backlog of vulnerabilities in the National Vulnerability Database (NVD) due to poor strategic planning. The report highlighted overlapping efforts with CISA, estimating $200,000 in waste since May 2024. Additionally, bureaucratic issues delayed NIST from incorporating CISA's available data until March 2025.

Rust-Written IronWorm Hits NPM Supply Chain

www.darkreading.com · a month ago

Like Shai-Hulud, the campaign targets developers to steal credentials and reuses them to propagate across the software supply channel.

Brave Software releases Origin for a paid, bloat-free browsing experience

www.bleepingcomputer.com · a month ago

Brave has announced the public release of Brave Origin, a paid minimalist version of its browser that strips out cryptocurrency, AI, rewards, and other monetization-focused features.

Hola Browser for Windows compromised to deliver cryptominer

www.bleepingcomputer.com · a month ago

The Windows version of the Hola Browser has been compromised in a supply chain attack that delivered an undeclared executable identified by researchers as a cryptocurrency miner.

China's TA4922 Expands Cybercrime Attacks Globally

www.darkreading.com · a month ago

One of the world's most diverse, least-focused cybercrime groups is enlarging its footprint beyond East Asia.

4 Critical Threats Where Attackers Have the Advantage

www.darkreading.com · a month ago

Gartner analysts issued a call to action to bolster defenses against several emerging critical threats, such as deepfakes and prompt injections.

Credit card theft campaign abuses Stripe to host stolen payment info

www.bleepingcomputer.com · a month ago

A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfiltrated from checkout pages.

Wary of U.S., Carney Bets on AI Strategy for Canada

www.nytimes.com · a month ago

The country on Thursday released a national artificial intelligence strategy that focuses on building its sovereign capability and protecting consumers.

Apple Begins Rosetta’s Final Phase as Intel Mac Era Winds Down

www.techrepublic.com · a month ago

Apple says macOS 26 Tahoe is the last major release for Intel Macs, with Rosetta support continuing through macOS 27 before narrowing.

Meta’s own AI chatbot to blame for Instagram accounts being stolen in seconds

www.fortra.com · a month ago

Hackers have been hijacking Instagram accounts at scale by exploiting Meta's AI support chatbot. And, as if that weren't bad enough, the technique required no technical skill whatsoever. Read more in my article on the Fortra blog.

New GitHub Zero-Day Exposed Developer Tokens to Attackers

www.techrepublic.com · a month ago

A github.dev flaw could let attackers steal GitHub OAuth tokens through a one-click attack, exposing private repositories and codebases.

Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us

www.microsoft.com · a month ago

A surge in real-world attacks against agentic AI systems is reshaping how we think about risk. Based on 12 months of red teaming, this update introduces seven new failure modes, from supply chain compromise to goal hijacking, and the practical mitigations teams need now.

DentaQuest data breach exposed info of 2.6 million accounts

www.bleepingcomputer.com · a month ago

A data breach at the dental benefits administrator DentaQuest has reportedly exposed the sensitive data of 2.6 million accounts.

Gartner SRM 2026 Signals a Cybersecurity Shift From Prevention to Resilience

www.techrepublic.com · a month ago

Gartner SRM 2026 put resilience, identity, and AI agent governance at the center of cybersecurity strategy as prevention loses ground.

Gwynne Shotwell, Elon Musk’s No. 2 at SpaceX, Is the Company’s Steady Hand

www.nytimes.com · a month ago

Gwynne Shotwell, the president and chief operating officer, is the adult-in-the-room foil to Mr. Musk as SpaceX prepares for a blockbuster initial public offering.

How LinkedIn Found Its Social Platform Era

www.nytimes.com · a month ago

Celebrities and paid influencers have transformed the career-focused platform, which for some users, has become a job unto itself.

Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

thehackernews.com · a month ago

Cisco patched a critical bug, tracked as CVE-2026-20230, affecting Unified Communications Manager. The vulnerability enables an unauthenticated attacker to execute a server-side request forgery flaw, allowing them to write files and escalate privileges to root access. Although Cisco PSIRT reports no observed attacks, public Proof-of-Concept exploit code is already available.

HTTP/2’s speed abused to slow webserver performance in DoS attack

www.csoonline.com · a month ago

Security researchers found a Denial-of-Service flaw in default HTTP/2 configuration via AI analysis. The vulnerability, tracked as CVE-2026-49975, abuses the HPACK header compression mechanism to force excessive memory allocation on major web servers. This flaw allows attackers to trigger resource depletion using minimal traffic flow control techniques against systems like nginx and Apache.

UN food agency discloses breach affecting 600,000 Gaza households

www.bleepingcomputer.com · a month ago

The United Nations' World Food Programme (WFP), the world's largest humanitarian organization, revealed over the weekend that its self-registration application (SRA) for Palestine was breached.

OpenAI responds to White House executive order on AI governance

www.csoonline.com · a month ago

OpenAI proposed mandatory federal evaluations of its most capable AI models before public release. The company suggested the Center for AI Standards and Innovation conduct these pre-release assessments but warned regulators should not approve or block deployments. This proposal aims to create a durable legal framework, arguing that voluntary commitments alone cannot govern AI systems.

What Are A.I. Agents Actually Doing?

www.nytimes.com · a month ago

A San Francisco start-up called Arena found that people are most likely to use A.I. agents on the job, particularly if they are in the tech industry.

Microsoft 365 Android Apps Had a Token Flaw IT Teams Should Check Now

www.techrepublic.com · a month ago

A debug flag left active in six Microsoft 365 Android apps allowed another installed app on the same device to request account tokens without user interaction.

US Firms Try DeepSeek as Silicon Valley AI Costs Rise

www.techrepublic.com · a month ago

US firms are testing China’s DeepSeek as Silicon Valley AI costs rise, raising questions about savings, data residency, and risk.

New IronWorm malware hits 36 packages in npm supply-chain attack

www.bleepingcomputer.com · a month ago

A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm.

Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

thehackernews.com · a month ago

A security researcher found a flaw in Anthropic's Claude Code GitHub Action, allowing an attacker to take over vulnerable public repositories using merely an opened GitHub issue. Because Anthropic’s own action repository used this same workflow, successful exploitation could push malicious code into the action itself. Consequently, the attack threatens any downstream projects that pull from it.

Agentic AI Is Transforming Defense, But Only Secure IT Infrastructure Will Maximize It

thehackernews.com · a month ago

The cybersecurity community grapples with how frontier agentic AI challenges defense networks. When Anthropic released Claude Mythos for technical preview, an unauthorized group claimed they gained access to the model within hours. This incident highlights new vulnerabilities related to AI systems in defensive applications.

Offroad Emerges From Stealth With $7 Million to Tackle Enterprise Identity Risk

www.securityweek.com · a month ago

As AI agents, machine identities, and third-party applications multiply across enterprises, Offroad is betting autonomous security agents can restore control over an increasingly unmanageable identity landscape.

Empty-ciphertext panic in aws-encryption-provider (CVD with AWS)

syntetisk.tech · a month ago

Recently disclosed AWS encryption bug

Can These ChatGPT Ads Make You Love A.I.?

www.nytimes.com · a month ago

A campaign for ChatGPT relies on heartwarming retro vibes to sell a product that has become a source of concern for most Americans.

Webinar Today: Third-Party Risk in Practice – Where Programs Break Down and How to Respond

www.securityweek.com · a month ago

Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice.

Willow Raises $7 Million for Securing Autonomous AI Agents

www.securityweek.com · a month ago

Willow (formerly Webrix) emerged from stealth mode with an access platform designed to secure enterprise AI agents.

Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs

www.darkreading.com · a month ago

Organizations are growing serious about what nation’s rules apply to their data. Experts point to geopolitical tensions as a main contributing factor.

Malicious WhatsApp, Slack Alerts Could Have Exposed Millions of Android Users

www.techrepublic.com · a month ago

SafeBreach found a now-fixed Gemini Android flaw that let malicious WhatsApp and Slack alerts manipulate AI responses and tools.