Blahalla

Who’s Excited for SpaceX’s I.P.O.? Space Nerds.

www.nytimes.com · a month ago

Few are as delighted by the pending market debut as the vibrant community of space enthusiasts who want to push discovery of the final frontier.

Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook

www.bleepingcomputer.com · a month ago

Threat actors are actively teaching newcomers how to find, exploit, and profit from vulnerable systems. Flare explores what a popular underground hacking tutorial reveals about modern attacker workflows.

ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories

thehackernews.com · a month ago

The internet's reliance on outdated plugins and inherent bugs creates systemic vulnerabilities for organizations. Attackers increasingly leverage AI agents to develop complex attack vectors. This escalation challenges modern cybersecurity defenses, necessitating urgent infrastructural improvements.

Enter the WasmForge: Compiling Sliver into WebAssembly

www.praetorian.com · a month ago

WasmForge from Offensive Security forks Wazero to build Go security tooling into binaries. It lets users compile implants like Sliver using WASM, bypassing signature detection on modern endpoints.

Microsoft blames unexpected Windows driver updates on caching issue

www.bleepingcomputer.com · a month ago

On Wednesday, Microsoft fixed an issue that caused some Windows devices to install driver updates without notice despite policies configured to prevent auto-updates.

‘Teachers Are Going to Hate It’: How Social Media Apps Hooked Teens at School

www.nytimes.com · a month ago

Internal documents show how tech giants grabbed children’s attention throughout the day, a strategy that schools say has undermined education.

Fake Ghidra, dnSpy & SpiderFoot Sites Used to Spread Malware

gbhackers.com · a month ago

Hackers established fake download portals mimicking security tools like Ghidra, dnSpy, and SpiderFoot to distribute malware. These sites embed JavaScript layers that intercept a user's initial "Download" click, routing the traffic through a centralized Traffic Distribution System (TDS). The TDS delivers payloads such as RemusStealer, AnimateClipper, and a loader framework named SessionGate.

Supply Chain Attack Hits Dozens of npm Packages via binding.gyp

gbhackers.com · a month ago

A large-scale npm supply chain attack has compromised at least 57 packages across more than 286 malicious versions in a rapid, coordinated campaign that unfolded in under two hours on June 3, 2026. The attack began at approximately 23:30 UTC with the compromise of @vapi-ai/server-sdk, the official Vapi.ai voice AI SDK with over 408,000 monthly

Gemini Voice Assistant Hijacked via Messaging Notifications

www.securityweek.com · a month ago

Attackers could have triggered dangerous actions, including controlling smart home devices via Google Home and starting Zoom video calls.

Malicious Ads Target macOS Users with FlutterShell Backdoor

gbhackers.com · a month ago

Hackers distribute a new macOS backdoor, FlutterShell, using malvertising campaigns dubbed Operation FlutterBridge. Attackers leverage Google Ads infrastructure and compromised advertiser accounts to reach victims globally. This malware disguises itself as legitimate apps, allowing it to execute shell commands and exfiltrate user data through attacker-controlled servers.

Police dismantles fake ID marketplace used by migrant smugglers

www.bleepingcomputer.com · a month ago

French and Spanish authorities took down an online marketplace selling fake identity documents to migrant smuggling rings operating within the European Union.

China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

thehackernews.com · a month ago

China-linked cybercrime group TA4922 expanded its targeting efforts to European nations, including the U.K., Germany, Italy, and South Africa. The group maintains a rapid operational tempo while leveraging an evolving malware arsenal. This toolkit utilizes known families such as ValleyRAT (Winos 4.0) and Atlas RAT (AtlasCross RAT).

Mirasvit Vulnerability Exploited to Execute Code on Magento Servers

www.securityweek.com · a month ago

A flaw in the Full Page Cache Warmer extension can be exploited without authentication via serialized PHP object payloads.

Hugging Face Transformers RCE flaw enables stealthy compromise via AI model configs

www.csoonline.com · a month ago

CVE-2026-4372 in Hugging Face Transformers (v4.56.0+) allows RCE via model configs. Pluto Security found bypass of trustremotecode=false using extra parameters. Update to v5.3.0 or later for the 2.2B+ install library immediately.

Comodo Internet Security 0-Day Flaw Triggers Windows System Crashes

gbhackers.com · a month ago

Security researcher Marcus Hutchins disclosed ComoDoS, a critical zero-day vulnerability in Comodo Internet Security's Inspect.sys kernel driver. The flaw enables remote Denial-of-Service by crashing Windows systems with a single malformed IPv6 packet. Specifically, the bug exploits an integer underflow during IPv6 extension header parsing, allowing attackers to bypass active firewall rules.

Fake Claude Code Installer Spreads Fileless .NET Infostealer

gbhackers.com · a month ago

Howler Cell found SEO poisoning targeting Claude Code via malicious search results. Attackers used a polyglot MP3/HTA payload with MSHTA commands and social engineering to run a fileless.NET infostealer via obfuscated PowerShell.

Chinese Cybercrime Group in Spotlight for Record Campaign Pace

www.securityweek.com · a month ago

Relying on social engineering, the hacking group engages in credential phishing, malware distribution, and fraud activities.

FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads

thehackernews.com · a month ago

Cybersecurity researchers uncovered Operation FlutterBridge, a malvertising campaign targeting macOS that disseminates the FlutterShell backdoor. Palo Alto Networks Unit 42 reports this operation represents the next stage of the previously observed activity cluster dubbed JSCoreRunner in late August 2025. The cybercrime group utilized these chains to infect multiple Mac systems.

Cisco warns of critical Unified CM flaw with PoC exploit code

www.bleepingcomputer.com · a month ago

Cisco has released security updates to patch a critical-severity Unified Communications Manager (Unified CM) flaw that allows attackers to gain root privileges.

Hacking Meta’s AI Chatbot

www.schneier.com · a month ago

Hackers successfully tricked Meta’s AI Support Assistant to hijack target accounts on platforms like Instagram. The attack involved using a VPN to spoof location and prompting the bot to add an email address, allowing password resets. Security experts warned that LLM chatbots present fundamental trustworthiness risks for critical account management functions.

Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown

www.securityweek.com · a month ago

Law enforcement and tech companies disrupted infrastructure linked to scammers operating across Southeast Asia.

IronWorm npm Attack Steals Developer Secrets

gbhackers.com · a month ago

IronWorm is a supply chain attack targeting crypto/Web3 via npm malicious packages. It steals credentials by scanning env vars and CI/CD secrets using preinstall hooks (e.g., weavedb-sdk). The worm spreads by injecting commits into GitHub repos, exfiltrating build secrets via GitHub Actions expressions.

Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

thehackernews.com · a month ago

Cybersecurity researchers flagged an operation impersonating open-source and freeware projects. Attackers use a Traffic Distribution System (TDS) to funnel users through well-designed fake sites mimicking legitimate project portals. This campaign delivers specific malware families, including Remus Stealer, AnimateClipper, and the SessionGate framework.

Stock Exchange Executive’s Outlook Targeted in Credential Theft Attack

gbhackers.com · a month ago

Espionage group stole market intelligence from a stock exchange executive over 5 months using Outlook compromise. Attackers got SYSTEM-level access via masquerading binaries (armsvc.exe) and scheduled tasks, exfiltrating PST/OST files with an Aspose.NET custom tool. The theft targeted one executive's account.

Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months

thehackernews.com · a month ago

Unknown attackers compromised a senior executive’s Outlook mailbox at a major global stock exchange for over five months. The group copied the inbox by routing small data batches through Dropbox and OneDrive to mask traffic as normal cloud activity. Symantec and Carbon Black's Threat Hunter Team reported this campaign, suggesting espionage rather than financial gain.

PoC Exploit Released for Cisco Unified Communications Manager Security Vulnerability

gbhackers.com · a month ago

POC exploit targets CVE-2026-20230 SSRF in Cisco Unified Communications Manager/SME. Unauthenticated attackers can write files and root via WebDialer. Disable WebDialer now; await Cisco patches.

Proofpoint: TA4922 Deploys New RAT and Loader Arsenal

gbhackers.com · a month ago

Chinese-speaking actor TA4922 deployed an arsenal including Atlas RAT, RomulusLoader, and ValleyRAT. This cluster utilizes social engineering lures often themed around HR or payroll to gain remote access across targets in Japan, Europe, and Africa. The malware achieves persistence through methods like DLL sideloading and injecting into processes such as svchost.exe.

The Do’s and Don’ts of Buying Used Tech Gadgets

www.nytimes.com · a month ago

With a shortage of some components driving up costs of consumer electronics, refurbished devices are an attractive alternative to buying new.

The Small-Business Owners Managing Whole Armies of A.I. Employees

www.nytimes.com · a month ago

When you turn A.I. agents loose on your finances, email and customers, what could possibly go wrong?

Inside the Trump-backed push to bring AI doctors into American medicine

www.washingtonpost.com · a month ago

The administration is laying the groundwork for chatbots that can diagnose illness and prescribe medicine, but physicians say AI can introduce more problems.

Cisco Warns of Available PoC for Critical Unified CM Vulnerability

www.securityweek.com · a month ago

The high-severity flaw can be exploited remotely, without authentication, in server-side request forgery (SSRF) attacks.

Phishing Attacks Pivot to Infostealer Malware Over Fake Login Pages

gbhackers.com · a month ago

Cybercriminals are shifting phishing tactics away from traditional fake login pages. They now prioritize infostealer malware designed to quietly harvest sensitive data from infected systems. These methods reduce user interaction while boosting overall data collection efficiency.

Malicious ChatGPT Download Website Tricks Users via Sponsored Search Listings

gbhackers.com · a month ago

Malware spread via paid search ads on lookalike site openewapp. It mimicked ChatGPT installers using malvertising. Payloads for Windows/macOS used compromised code signing and obfuscated JS (winter.js) in an Electron wrapper. The threat remains active.

VS Code Vulnerability Allows One-Click GitHub Token Theft

www.securityweek.com · a month ago

A researcher has disclosed the full details of the vulnerability and released a PoC without notifying Microsoft in advance.

ClawHub, Cisco, and Vercel Skill Detection Tools Evaded by Malicious Uploads

gbhackers.com · a month ago

Trail of Bits demonstrated that AI skill security scanners from ClawHub, Cisco, and Vercel's skills.sh can be bypassed using simple techniques. The researchers successfully uploaded malicious skills designed to exfiltrate data or hijack agents. This finding raises serious concerns regarding agentic AI supply chain defenses.

JINX-0164 Targets Crypto Firms With macOS Malware

gbhackers.com · a month ago

JINX-0164 targets cryptocurrency firms using social engineering lures and custom macOS malware called AUDIOFIX. The group harvests sensitive data, including SSH keys and cloud tokens, from compromised developer endpoints. They escalate attacks by injecting malicious code into CI/CD pipelines, effectively turning development systems into propagation vectors.

Kali365 PhaaS Expands to Okta, MAX Messenger Attacks

gbhackers.com · a month ago

Kali365 phishing now targets Okta SSO & MAX Messenger. Attackers abuse device auth flows, capturing access tokens via tricked MFA completions. This bypasses MFA, compromising accounts on M365, Yandex Disk, and Odnoklassniki.

Beware the ‘son of Mythos,’ security experts warn

www.csoonline.com · a month ago

Security experts at Infosec Europe warned that frontier AI models are expanding rapidly for vulnerability discovery. Anthropic expanded Project Glasswing access to Claude Mythos, while OpenAI provided GPT-5.5 Cyber to nine major UK banks. Organizations must use these tools to harden defenses and prepare against misuse.

Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls

gbhackers.com · a month ago

Payouts King ransomware acts post-BlackBasta, bypassing EDR via obfuscation/system calls. Initial access uses spam bombing, phishing, vishing, forcing remote tools like Quick Assist. It uses RSA/AES hybrid encryption and gains persistence via elevated schtasks commands.

CISA Alerts Users to Actively Exploited Android Framework Security Vulnerability

gbhackers.com · a month ago

CISA issued an urgent alert regarding CVE-2025-48595, an actively exploited integer overflow flaw affecting the Android Framework. Attackers can exploit this vulnerability to achieve local privilege escalation, bypassing security controls and gaining system-level access on affected devices. CISA added it to its KEV catalog, demanding organizations remediate the risk by June 5, 2026.

DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets

thehackernews.com · a month ago

DOJ's "Disruption Week" targeted crypto/cyber fraud against US citizens. It shut down millions of social media/email accounts via govt & private action. Transnational criminal networks were disrupted.

Fake Chrome Web Store Copyright Alerts Used to Steal Google Logins

gbhackers.com · a month ago

Phishers target Chrome extension devs via fake Web Store takedown notices with countdowns. They lure victims to sites grabbing metadata and displaying false violation details. A final fake Google login captures user credentials.

Acer Confirms Patch in Progress for Wave 7 Router 0-Day Flaw

gbhackers.com · a month ago

Acer confirmed developing firmware patches for critical zero-day vulnerabilities affecting its Wave 7 routers. These flaws include broken access control, which exposes plaintext administrative credentials via the web interface (CVSS 10.0). A second issue involves a hardcoded AES key in upload.cgi that enables persistent backdoor injection through modified configuration backups.

Automated Bots Overtake Human Users in Global Internet Traffic for the First Time

gbhackers.com · a month ago

Automated bots have officially overtaken human users in global internet traffic for the first time, marking a major shift in how the web is accessed and used. Recent data from Cloudflare Radar shows that bots now generate 57.5% of all HTTP requests to HTML pages. In comparison, human activity has dropped to 42.5%. The trend

Fake Claude Code Installer on Google Sites Steals Credentials

gbhackers.com · a month ago

A ClickFix-style campaign weaponizes fake Claude Code and Codex installers hosted on Google Sites to steal credentials. The operation guides victims into executing an MSHTA command, which stages a fileless stealer inside PowerShell. This malware harvests browser credentials and cryptocurrency wallet data by running entirely in memory, bypassing traditional EDR rules.

Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More

gbhackers.com · a month ago

Microsoft introduced Scout, an always-on AI agent automating tasks across Microsoft 365 services like Teams and Outlook. This agent shifts AI from reactive prompts to proactive systems that autonomously execute workflows based on user context. For security, Scout enforces compliance by using dedicated Microsoft Entra identities and integrating Purview controls for data loss prevention.

Hackers Exploit Google Gemini Flaw Using Malicious Messages from WhatsApp, Slack, and SMS

gbhackers.com · a month ago

SafeBreach Labs found a Gemini vulnerability via notification-based prompt injection from WhatsApp/Slack. Attackers use this to inject malicious instructions by treating incoming messages as trusted context. Fake Context Alignment bypasses guards through dual conversation views. The system requires immediate patching.

Pakistan Spies on Afghan Finance Ministry With Xeno RAT

www.darkreading.com · a month ago

Despite broadly connected digital infrastructure, standard fare TTPs are enough to cause trouble for Afghanistan's porous cybersecurity.

Hole in GitHub’s browser-based VSCode editor could lead to stolen token

www.csoonline.com · a month ago

Ammar Askar found a GitHub VSCode editor flaw: malicious extensions via Jupyter notebooks exploit this to steal developer tokens. Attackers can gain full access to private repos.

Smashing Security podcast #470: This AI security flaw might be impossible to fix

grahamcluley.com · a month ago

Fake UK visa portal stole personal data from thousands via deception. A Cornell paper suggests prompt injection is hard to solve. Hackers can lock orgs from M365 without passwords or malware. These are significant security risks.