Blahalla

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

thehackernews.com · 2 months ago

Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party.

Hackers arrested over €30M bank fraud exploiting service provider flaw

www.bleepingcomputer.com · 2 months ago

Four cybercriminals were arrested in Brazil, and three others were charged in Europe over allegations that they exploited a vulnerability at a service provider, allowing them to withdraw funds from Commerzbank customers' bank accounts.

Amid AI-Driven Bug Tsunami, NIST Looks to…AI

www.darkreading.com · 2 months ago

Driven by AI-augmented research and scanning, vulnerability volumes continue to surge, driving the National Institute of Standards and Technology to ask whether AI could be the answer.

IAM Compliance Requirements and Best Practices

thehackernews.com · 2 months ago

IAM compliance is the practice of demonstrating that identity and access controls are not only documented but actually enforced across users, applications, infrastructure, and non-human identities.

Our AI pentesting engine talked a production AI agent's prompt-injection guardrail into handing over its entire system prompt on its second attempt.

escape.tech · 2 months ago

For full disclosure I'm part of the security engineering team at Escape but this finding is something I found really interesting and wanted to share to see! Our AI pentesting engine Cascade recently got a production AI agent to return its entire system prompt, just by wrapping the ask in a different pretext - framing it as a documentation request instead of an attack.

VINclarity Publishes Investigation Into Alleged Scam and Fraud Reputation Attack Across Search and AI

gbhackers.com · 2 months ago

Selidan, USA, August 14th, 2026, CyberNewswire New report examines suspicious Reddit activity, coordinated YouTube content and BBB Scam Tracker entries influencing how the vehicle history platform appears across Google and AI systems VINclarity has published a new investigation into what researchers describe as a coordinated online reputation attack targeting the vehicle history platform across Re

Upcoming Speaking Engagements

www.schneier.com · 2 months ago

This is a current list of where and when I am scheduled to speak: I’m speaking, signing books, and participating in panel discussions at LAcon V in Anaheim, California, USA. My full schedule is here. I’m speaking online (via Zoom) at a League of Women Voters event on Tuesday, September 22, 2026, at 5 PM ET. I’m speaking at Elevate Festival in Toronto, Canada.

Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office

www.darkreading.com · 2 months ago

One Caledonian government agency reported a breach, thanks to a third party that may have serviced other agencies as well.

Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

www.bleepingcomputer.com · 2 months ago

The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged.

Amazon and Alphabet’s Profits Reveal Circular Nature of A.I. Boom

www.nytimes.com · 2 months ago

Investment gains at Alphabet and Amazon reveal a new way in which technology companies’ fortunes are increasingly linked.

The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI

www.bleepingcomputer.com · 2 months ago

Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected systems. Material Security explains why organizations need defenses that cover the entire Workspace attack chain.

What Boards Need to Know About Tech Risk

www.darkreading.com · 2 months ago

Why do so many boards underestimate technology risk until it becomes a crisis?

Max severity SAP Commerce Cloud flaw now targeted in attacks

www.bleepingcomputer.com · 2 months ago

A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks, according to threat intelligence company Defused.

Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks

www.csoonline.com · 2 months ago

Records held in Salesforce and ServiceNow systems are under attack leaving user data exposed, according to researchers at Reco. The attack appears similar to those perpetrated by the extortion group ShinyHunters, Reco said. ShinyHunters has been particularly active this year, attacking dating sites in January and Oracle in June, and there are fears that they could have found a new target.

Oracle’s new database security tool is free — for six months

www.csoonline.com · 2 months ago

Oracle has released a security tool intended to provide organizations with a centralized view of security risk across their database environments. Oracle Database Security Central will be available free of charge until the end of February 2027. It arrives at a critical time for Oracle customers, with attackers targeting security flaws to exploit the company’s database products.

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

thehackernews.com · 2 months ago

The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.

Cyera's Oasis Security Buy is All About AI Agent Control

www.darkreading.com · 2 months ago

The $1 billion deal aims to converge data security and identity into a single control plane for agents, with privileged access redefined around business context rather than static roles.

In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities

www.securityweek.com · 2 months ago

Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption.

Shell investigates 'potential incident' after Clop data theft claims

www.bleepingcomputer.com · 2 months ago

Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data.

Agentic AI Models Rebuild Malware and Sustain Real-World Cyber Intrusions, SentinelOne Warns

gbhackers.com · 2 months ago

Four incidents involving OpenAI, Anthropic, Meta and the UK AI Security Institute (AISI) describe AI agents reaching systems belonging to other organizations without their consent. The defining capability is now persistence: models can repeatedly test paths, regenerate disposable tooling, restore communications, and shift techniques until a viable intrusion chain emerges.

Trivy, Not LiteLLM Behind the 2,500 Org Compromise

www.securityweek.com · 2 months ago

Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.

Who’s Tracking You? Use This New Service to Find Out

krebsonsecurity.com · 2 months ago

It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms.

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

thehackernews.com · 2 months ago

Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions.

If the Markets Reject OpenAI and Anthropic, the US Should Nationalize Them

www.schneier.com · 2 months ago

This essay was written with Nathan E. Sanders, and

Zuckerberg’s Anti-Doom Fantasy + Finally an A.I. Detector That Works + A.I. Math

www.nytimes.com · 2 months ago

“The first rule of Mark Zuckerberg is never count out Mark Zuckerberg.

Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal

www.securityweek.com · 2 months ago

Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028.

RingCentral data breach exposed info of 1.6 million accounts

www.bleepingcomputer.com · 2 months ago

The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned.

GeoServer Zero-Day SQL Injection Vulnerability Actively Exploited to Gain RCE

gbhackers.com · 2 months ago

A newly disclosed, unpatched SQL injection vulnerability in GeoServer is currently being actively tested across the internet. Researchers have issued warnings that affected deployments may be vulnerable to remote code execution (RCE) under specific database configurations. At this time, the flaw does not have a CVE identifier or a vendor patch.

Dysphoria Hijacks Routers, Gateways and IP Cameras to Build Massive IoT Botnet

gbhackers.com · 2 months ago

The Dysphoria botnet has expanded into a major Internet of Things threat, with a new Shadowserver Special Report identifying approximately 296,000 compromised devices. The campaign targets exposed routers, gateways, IP cameras and other embedded Linux systems, converting poorly secured equipment into a distributed platform for DDoS attacks and increasingly, residential proxy and relay operations.

1.6 Million Likely Impacted by RingCentral Data Breach

www.securityweek.com · 2 months ago

The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers.

Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

gbhackers.com · 2 months ago

A newly analyzed DarkCrystal RAT (DCRat) campaign shows how threat actors are turning an apparently harmless SVG attachment into a full malware-delivery mechanism.

Over 1,000 Charities Hit by Beacon CRM Data Breach

www.securityweek.com · 2 months ago

The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.

Akira ransomware reboots into Windows Safe Mode to knock EDR offline

www.csoonline.com · 2 months ago

Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system into Safe Mode with Networking enabled. According to Huntress, the technique successfully took both its agent and Microsoft Defender’s real-time protection offline.

Chatbots Are Pushing Us Toward a Post-Human Internet

www.nytimes.com · 2 months ago

In matters of work, school and even romance, we turn to A.I. chatbots. But what happens when the bots begin talking to one another?

The cybersecurity backlog is not a security problem

www.csoonline.com · 2 months ago

Cybersecurity teams should be responsible for risk oversight, rather than for executing every corrective action. Assigning security teams the tasks of finding, prioritizing, assigning, implementing, tracking and validating every remediation does not foster accountability. Instead, it results in an organizational repository for unresolved issues.

Data analyst sent to prison for stealing data, extorting employer

www.bleepingcomputer.com · 2 months ago

A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $2.5 million extortion scheme.

How CSOs can turn cybersecurity into a business growth strategy

www.csoonline.com · 2 months ago

For years, cybersecurity leaders have worked to convince organizations that security deserves a seat at the executive table. Today, that conversation is changing. The challenge is no longer proving that cybersecurity matters; it is demonstrating how security leaders can help organizations innovate, modernize, and grow with confidence.

14,000 Trezor Customers Impacted by Data Breach at ShipMonk

www.securityweek.com · 2 months ago

Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers.

24 Malware Crypter Sellers Turn EDR Evasion and In-Memory Execution Into Paid Services

gbhackers.com · 2 months ago

A growing underground market is turning mature malware-evasion techniques into subscription products. An analysis of 24 active crypting-service vendors shows that customers can now buy payload obfuscation, in-memory execution, anti-analysis controls, process injection, persistence, and rapid “re-crypting” as packaged services rather than develop them internally.

New Bring Your Own EDR Attack Turns SentinelOne Into Trojan Horse to Bypass Windows PPL

gbhackers.com · 2 months ago

Security researchers have introduced a new technique called “Bring Your Own EDR” (BYOEDR) that exploits legitimate SentinelOne components to bypass Windows Protected Process Light (PPL) protections, allowing the execution of unsigned code within highly secured processes.

New DRAM Scrambling Attack Unlocks AMD CPU PSP, SMM and Microcode

gbhackers.com · 2 months ago

Security researcher Christopher Domas has released a proof-of-concept project called “skitter-creek-bath-salts,” which demonstrates a vulnerability in AMD’s DRAM-controller configuration that could compromise hardware-enforced memory isolation.

Apple Warns iPhone Users in 110 Countries of Mercenary Spyware Attacks

gbhackers.com · 2 months ago

Apple has issued a new set of high-confidence Apple Threat Notification alerts, warning selected iPhone users in 110 countries that they may be targets of government-grade mercenary spyware. These notifications are not routine phishing messages or general security advisories.

Hackers Exploiting Unpatched GeoServer Zero-Day

www.securityweek.com · 2 months ago

The security defect is described as an SQL injection that could allow attackers to achieve remote code execution.

PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management

gbhackers.com · 2 months ago

A newly uncovered espionage operation targeting Afghan telecom providers and South Asian critical infrastructure has exposed a layered attacker ecosystem built around custom implants, spoofed delivery portals, cloud-backed command-and-control channels. The campaign began with sector-specific social-engineering lures, including a malicious Inno Setup package named TMSAfghanTelecom.

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

www.securityweek.com · 2 months ago

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.

Hackers Steal One AI Key, Resell the Compute, and Leave Victims With a Million-Dollar Bill

gbhackers.com · 2 months ago

A rapidly expanding financial cybercrime model called AI token jacking, where threat actors steal developer API keys for popular AI platforms, consume the victim’s allocated model capacity, and resell that compute through gray-market proxy services. The term “token” in this context does not refer to a browser session token.

Fortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary Code

gbhackers.com · 2 months ago

Fortinet has released security updates to address high-severity vulnerabilities in FortiWeb and FortiClient for Windows. These vulnerabilities could allow unauthenticated attackers to access appliance administration interfaces or execute arbitrary code.

Aeternum Hides Malware Commands on Polygon Blockchain Where Server Takedowns Can’t Erase Them

gbhackers.com · 2 months ago

A newly analyzed malware operation called Aeternum is turning the public Polygon blockchain into a command-and-control (C2) channel, allowing attackers to distribute botnet instructions without relying on a conventional server or domain.

Trezor Shipping Provider Data Breach Exposes Personal Data of 13,689 Customers

gbhackers.com · 2 months ago

Hardware wallet manufacturer Trezor has recently disclosed a data breach at ShipMonk, a third-party shipping provider. This breach exposed the personal information of 13,689 customers. Importantly, Trezor’s internal systems, hardware wallets, private keys, wallet backups, and cryptocurrency holdings were not compromised.

Beacon CRM Data Breach Exposes Customer Data via Compromised AWS Access Key

gbhackers.com · 2 months ago

Beacon CRM has confirmed that a threat actor likely downloaded a complete copy of its customer database after gaining access to its Amazon Web Services (AWS) environment using a compromised AWS access key.