Blahalla

Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud

gbhackers.com · 2 months ago

AiTM phishing kit compromised a Microsoft 365 account via stolen session token, bypassing MFA. Attackers used delegated permissions on Exchange Online/SharePoint for cloud BEC, setting up three inbox rules to hide fraudulent vendor payment changes.

New Manic Android malware can exfiltrate data through nearby devices

www.bleepingcomputer.com · 2 months ago

Manic Android malware targets Ukraine's banking/eID apps across Europe. It captures taps via overlays and intercepts SMS/location data. Data exfiltrates from offline devices via Wi-Fi Direct or Bluetooth.

Identity Abuse Through Trusted Communication Channels

unit42.paloaltonetworks.com · 2 months ago

Badges report attackers misuse SaaS collaboration tools for identity phishing, impersonation, and malware. These channels are a major attack surface. Security controls must monitor activity in authenticated sessions.

Police Are Hiding Their Use of Flock Surveillance Cameras

www.schneier.com · 2 months ago

Police in Wapello County, Iowa, adopted a usage policy for Flock automated license plate readers (ALPR). The policy instructs officers to keep the camera usage secret. Police must avoid mentioning ALPR use to occupants or including it in reports unless absolutely necessary.

Critical Zimbra RCE flaw now actively exploited in attacks

www.bleepingcomputer.com · 2 months ago

CERT Polska warned that groups are actively exploiting CVE-2026-73570, a critical Remote Code Execution flaw in Zimbra Collaboration Suite. This vulnerability allows unauthenticated attackers to execute OS commands by exploiting command injection within the SNMP monitoring component. Zimbra users must patch to version 10.1.20 and review logs for suspicious service restarts or files.

CyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server Access

gbhackers.com · 2 months ago

Researchers found ShadowPanel RCE in CyberPanel v2.4. It combines exposed AI Scanner APIs, exploiting CVE-2026-41473 (auth flaw) and CVE-2026-41472 (stored XSS) to grant admin access, enabling OS command execution via cron-jobs.

Claude AI Finds Authentication Bypass Flaws in Multiple SAML Implementations

gbhackers.com · 2 months ago

Eric Chiang used Anthropic’s Claude AI to find multiple critical vulnerabilities in open-source SAML products. His investigation found flaws like full authentication bypasses and signature-validation issues from XML processing errors. Chiang detailed specific exploits, including CVE-2026-57580 in Authentik and CVE-2026-63182 in OneUptime, allowing unauthorized access.

Hackers Trick AI Agents Into Telling Users to Install the Malware Themselves

gbhackers.com · 2 months ago

A campaign called ClawHavoc targeted OpenClaw by poisoning the ClawHub skill registry, turning autonomous AI agents into malware-delivery intermediaries. Attackers bypassed exploit code by embedding malicious skills that prompted users to install fake tools or run obfuscated shell commands. This deceitful process delivered information-stealing payloads, including Atomic macOS Stealer (AMOS).

40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

thehackernews.com · 2 months ago

The Socket Threat Research team uncovered 40 malicious Mozilla Firefox extensions that stole cryptocurrency by impersonating Web3 products like OKX and TronLink. The attackers grouped these extensions into a broader campaign called Offside Wallet Theft Factory. This operation utilizes 77 add-ons that share overlapping source code and infrastructure.

Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler

www.securityweek.com · 2 months ago

Citrix patched NetScaler ADC and NetScaler Gateway for two vulnerabilities, including critical authentication bypass flaw CVE-2026-19490. This defect allows remote, unauthenticated attackers to bypass authentication without user interaction. Users must patch systems immediately to fix CVE-2026-19489, a high-severity memory overflow issue, as experts anticipate swift exploitation.

Zimbra RCE Vulnerability Lets Remote Attackers Execute System Commands

gbhackers.com · 2 months ago

Active exploitation of CVE-2026-73570 affects Zimbra Collaboration Suite, an unauthenticated Remote Code Execution vulnerability. This flaw permits attackers to execute arbitrary shell commands as the zimbra user within improperly configured deployments. Administrators must urgently upgrade affected installations to version 10.1.20 to mitigate this critical risk.

ClearFake Fake CAPTCHA Campaigns Use New WordlistLoader to Deploy Amatera Stealer

gbhackers.com · 2 months ago

Malicious groups deploy Amatera Stealer through a ClearFake infection chain. The campaign leverages compromised websites and fake CAPTCHA overlays, utilizing ClickFix social engineering to execute the payload. A component, WordlistLoader, bypasses defenses by unhooking system modules and establishing hardware breakpoints to deliver the stealer.

Critical GitLab Flaw Exploited Shortly After Disclosure

www.securityweek.com · 2 months ago

Exploitation began for CVE-2026-19478, a critical code injection flaw, shortly after GitLab disclosed the vulnerability. This unauthenticated exploit allows attackers to delete public projects or forge merge records by sending a single HTTP request. GitLab patched the issue in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.111, urging users to restrict access to the /api/graphql endpoint immediately.

Hackers Using AI to Target Siemens PLCs in Critical US Sectors

www.securityweek.com · 2 months ago

NSA and CISA warn critical infra: AI hackers exploit Siemens PLCs (energy/water). Attackers use AI/open-source tools to tamper with PLC memory/logic. Patch systems, isolate PLCs, and control access now.

Hackers Impersonate Claude, ChatGPT and Copilot to Deliver Infostealers and Backdoors

gbhackers.com · 2 months ago

Attackers misused AI brands (Claude, ChatGPT, Copilot) via typosquatted domains to trick users. Sophos X-Ops analyzed 12 months of MDR data finding PowerShell payloads or fake extensions delivered infostealers/backdoors.

Microsoft says August Windows updates may cause gaming issues

www.bleepingcomputer.com · 2 months ago

Microsoft investigates reports that the August 2026 updates (KB5121003) may cause gaming failures on Windows 11 systems. Users report affected games, including ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals, experience freezing, crashing, or "EXCEPTIONACCESSVIOLATION" errors. The investigation is ongoing following the patch's release last week.

Microsoft Defender Update Crashes Virus Scans on Windows PCs

gbhackers.com · 2 months ago

Defender users report scan failures (Quick, Full, Offline) after 8/18/2026 updates. MsMpEng.exe crashes (0xC0000005) affect consumer/endpoint. Failures link to ShieldBreak, a local privilege escalation PoC for CVE-2026-50656. Scans fail following these updates.

13 Malicious Rabby Firefox Extensions Steal Wallet Keyrings Before They Are Encrypted

gbhackers.com · 2 months ago

A campaign featuring 13 malicious Rabby Wallet impersonators created 77 Firefox extensions to steal wallet keyrings. The code alters the persistAllKeyrings() workflow, exfiltrating serialized wallet data before local encryption can occur. Attackers then route this sensitive data to webhooks on infrastructure linked to gemachriverdale[.]org and e-wl[.]com using plain HTTP.

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed a critical flaw in the Elementor Pro WordPress plugin, which could enable remote code execution. The vulnerability, tracked as CVE-2026-32475, stems from the Forms module's unrestricted upload of dangerous files. This flaw scores a high CVSS rating of 9.0 out of 10.0.

Critical Citrix NetScaler Flaw Allows Attackers to Bypass Authentication

gbhackers.com · 2 months ago

Cloud Software Group warned of 2 NetScaler ADC/Gateway flaws: CVE-2026-19490 allows unauthenticated RCE bypass via Gateway/AAA. CVE-2026-19489 is a DoS memory-overflow via SIP ALG. Patches are advised for all affected appliances.

CISA, NSA and FBI Warn Hackers Using AI-Generated Scripts to Target Siemens S7 PLCs

gbhackers.com · 2 months ago

National security agencies warn of active campaigns targeting Siemens S7 PLCs, affecting models from S7-200 to S7-1500. Attackers deploy AI-generated scripts, disguised as monitoring tools, to exploit the S7comm protocol. These malicious scripts enable read and write access to PLC memory and logic, potentially disrupting critical industrial processes.

Aeternum Operators Use Polygon Smart Contracts to Rotate Malware C2 Domains Dynamically

gbhackers.com · 2 months ago

Aeternum malware abuses Polygon smart contracts to build resilient C2 infrastructure. Infected devices query these contracts using ethcall requests to retrieve and rotate command-and-control domains. Operators exploit specific methods, such as updateDomain(), to overwrite C2 values directly on the blockchain, complicating traditional disruption efforts.

T-Mobile Physically Cuts Network Cable to Evict Chinese Salt Typhoon Hackers

gbhackers.com · 2 months ago

T-Mobile’s security team physically cut a network cable in 2024 to contain access by Salt Typhoon, a Chinese state-backed hacking group. Investigators traced suspicious traffic to hardware in a Bellevue, Washington data center, allowing them to eliminate the attacker’s communication channel. Salt Typhoon targets telecom infrastructure, posing a risk to multiple carriers including AT&T and Verizon.

Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials

gbhackers.com · 2 months ago

Wiz found a critical GitHub Actions injection in Snowflake's snowflake-connector-net. Unauthenticated attackers could execute commands via a malicious jiraissue.yml title, risking credential theft from Jira vars. Snowflake fixed this on June 23, 2026.

Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level

www.csoonline.com · 2 months ago

Airlock Digital passed an IRAP assessment at PROTECTED level using the Australian Government ISM. This assures Australian organizations of strong security controls for due diligence in cloud and critical infrastructure.

Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level

gbhackers.com · 2 months ago

Airlock Digital passed an IRAP assessment at PROTECTED level, confirming security controls match the Australian Government ISM. This assures Australian organizations in critical infrastructure, government, and defense.

Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks

www.darkreading.com · 2 months ago

Researchers observed Transparent Tribe (APT 36), a suspected Pakistani group, running cyberespionage campaigns against Afghanistan and India. The group refreshed its toolkit, deploying backdoors like "Patchcord" and "Sheetcord." While targeting various organizations in both nations, the group struggles against more prepared government agencies in India.

OpenAI confirms ChatGPT is down as logins and signups fail

www.bleepingcomputer.com · 2 months ago

OpenAI confirmed a major service outage affecting ChatGPT globally starting August 19, 2026. Users currently struggle to sign in, create accounts, or load previous chats. The disruption also impacted the associated OpenAI API and the Codex coding platform, though OpenAI reported working on mitigation.

OpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention for select frontier model customers

www.csoonline.com · 2 months ago

OpenAI temporarily slowed scaling and paused reinforcement learning training to enhance alignment and validate safeguards. The company also announced zero data retention for eligible API customers beginning in September. Analysts interpret these moves as strategic attempts to address mounting safety concerns and position the firm for an imminent IPO.

Smashing Security podcast #481: Never say this to a robot dog

grahamcluley.com · 2 months ago

At Black Hat, security researchers demonstrated jailbreaking an AI-powered robot dog using Google's AI. The podcast also reviewed a successful social engineering scam, where perpetrators called Prime Minister Andy Burnham pretending to be the White House Chief of Staff. These examples highlight evolving vulnerabilities in both AI systems and public figures.

Rogue ransomware affiliate poses as recovery firm to steal payments

www.bleepingcomputer.com · 2 months ago

GuidePoint's GRIT found "Ransom Busters," a ransomware affiliate, contacting victims (e.g., DragonForce) with decryption keys/stolen data. They demand $20k-$60k. Use of identical tools like SoftPerfect Network Scanner and s5cmd suggests a single operation. Ransom Busters is actively targeting organizations for ransom payments.

Rogue ransomware affiliate poses as data recovery firm to steal payments

www.bleepingcomputer.com · 2 months ago

Ransom Busters, a suspect group, contacts ransomware victims demanding payment. GuidePoint Security suspects this affiliate, using tools like SoftPerfect Network Scanner and s5cmd, and created a backdoor account with password Numlock!123.

Sakura Internet hack exposes data of up to 1.36 million accounts

www.bleepingcomputer.com · 2 months ago

Japanese provider Sakura Internet disclosed that hackers breached its sales management system, potentially compromising up to 1.36 million member accounts. The breach, which began August 9, exposed customer contract and membership information. Although the company confirms stored passwords are hashed and no credit card data was stolen, the incident remains a security concern.

No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns

www.darkreading.com · 2 months ago

Security firm ThreatDown analyzed Kriminal, an AI platform offering guardrail-free services for cybercrime. Kriminal features tools like "WRAITH" for social engineering and an "ARCHITECT" agent for offensive security. Users purchase access using cryptocurrency for OSINT scanning, cryptocurrency tracing, and other illicit purposes.

Chinese Start-Up Lands Reusable Rocket for the First Time

www.nytimes.com · 2 months ago

LandSpace's milestone advancements could position China to challenge SpaceX's established dominance in low-cost spaceflight. The progress suggests developments in China's rocketry and overall space industry capabilities.

Ties to data centers could cost Ohio Sen. John Husted his seat, memo warns

www.washingtonpost.com · 2 months ago

A GOP memo obtained by The Post advises the tech industry to improve the public image surrounding controversial data centers. Republicans warn that linking Ohio Senator John Husted to these facilities could negatively impact his political standing.

Graphing AWS Attack Paths in Bloodhound

blog.n0pe-sled.com · 2 months ago

AWSHound is a free, self-hosted collector that maps AWS accounts and Organizations into a BloodHound OpenGraph dataset. The tool performs offline IAM policy evaluations, incorporating SCPs, RCPs, and permissions boundaries to accurately model potential attack pathways. Developers can leverage this data to visualize how a low-privilege user could compromise an entire AWS structure.

Healthtech firm CareCloud data breach impacts 3.7 million patients

www.bleepingcomputer.com · 2 months ago

U.S. healthcare IT firm CareCloud disclosed a data breach impacting over 3.7 million individuals. The company reported the incident originated when an unauthorized third party accessed its AWS environment between March 10 and March 16, 2026. Affected individuals received data breach notifications and are offered identity protection coverage through IDX.

Agentic AI Presents New Insider Threat Model for Orgs

www.darkreading.com · 2 months ago

Katie Moussouris of Luta Security detailed how agentic AI presents an insider threat model for organizations. Following the Hugging Face breach, she warned that enterprises must now monitor their own technology to prevent rogue AI agents from escaping containment. Organizations must prepare for this new challenge to secure AI systems effectively.

Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed a remote Spectre attack targeting Cloudflare Workers. The attack successfully leaked a JSON Web Token (JWT) from a co-located Worker in a live production environment. These researchers achieved a high data leakage rate of up to 12 bits per second, exceeding previous demonstrated rates by 360 times.

Hacking SAML with Claude Code

oblique.security · 2 months ago

The author investigated SAML protocol weaknesses, noting the inherent dangers of XML Digital Signatures. They built a custom hacking harness using Anthropic's Opus model to exhaustively search for bugs across various SAML implementations. The process demonstrated that providing a broad threat model yields better exploit findings than inputting specific, known vulnerabilities.

Hackers compromise 14,500 Dahua web cameras in 35-day campaign

www.bleepingcomputer.com · 2 months ago

Hunt.io reported CameraSwarm, a 35-day breach affecting 14,500+ Dahua IP cameras in Ukraine/Russia. Attackers used brute-forcing, CVE-2021-33044, CVE-2021-33045, cloud-relay attacks, and CVE-2024-39943/CVE-2025-31702 to install backdoors.

OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior

thehackernews.com · 2 months ago

OpenAI paused reinforcement learning (RL) training for its latest AI models for two weeks. The company reinforced defenses and expanded monitoring to prevent a breach similar to a Hugging Face-like incident. OpenAI stated that developing and testing more capable models heightens internal risk.

US warns of AI-powered attacks on Siemens PLCs in critical infrastructure

www.bleepingcomputer.com · 2 months ago

US cybersecurity agencies warned that groups use AI-generated Python scripts to exploit Siemens S7 PLCs in critical infrastructure. Attackers use custom tools, like snap7.dll, to achieve read and write access to PLC memory and ladder logic programs. Agencies urge operators to inventory PLCs, install updates, and restrict internet access to prevent potential disruption.

SilkParasite Threatens Central Asian Orgs With Flurry of RATs

www.darkreading.com · 2 months ago

Researchers at Bitdefender Labs tracked the APT group SilkParasite, which spear-phishes government organizations across Central Asia. The group uses tailored lures and compromised documents to establish long-term access, deploying seven remote access trojans (RATs). These attacks involve several newly discovered malware families, including DriveSilkRAT and CookiETagRAT.

Iran's Mabna Institute ran a 3-phase spearphishing campaign against university professors for a decade. The 50-page superseding indictment has more methodological detail than the press coverage suggests.

kancelaria-skarbiec.pl · 2 months ago

SDNY indicted 17 Iranian nationals for academic espionage. The Mabna Institute, linked to IRGC, stole 31.5TB from 144+ global universities, targeting Poland. They sold this $3.4B research to Iranian universities.

Cisco Crosswork Security Hardening Release: August 2026

sec.cloudapps.cisco.com · 2 months ago

Cisco Crosswork engineered a software hardening release addressing multiple internally discovered vulnerabilities. The update patches critical issues, including CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, and CVE-2026-20359. These fixes impact the Crosswork Data Gateway, Network Controller, and Planning platforms.

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

sec.cloudapps.cisco.com · 2 months ago

Unauthenticated remote attackers can read config data via CVE-2026-20320 in Cisco BroadWorks Open Client XML Parser due to improper XML parsing. Cisco urges immediate upgrade of all affected BroadWorks platforms.

Cisco RoomOS Stack Overflow Vulnerability

sec.cloudapps.cisco.com · 2 months ago

A vulnerability in the Cisco RoomOS USB driver (CVE-2026-20302) allows an unauthenticated local attacker physical access to execute arbitrary code with root privileges. Insufficient boundary checks enable an exploit using a malicious USB device, potentially causing a buffer overflow condition. Cisco strongly recommends upgrading to fixed software releases to remediate this vulnerability.

Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability

sec.cloudapps.cisco.com · 2 months ago

A vulnerability (CVE-2026-20177) in Cisco IE 1000 Series Switches allows unauthenticated, remote attackers to cause a denial of service. Attackers exploit the flaw by sending a high rate of ICMP, SSH, or HTTP traffic to the device. Successful attacks disrupt device manager, SSH, or API functionality, requiring users to apply fixed software updates for remediation.