Blahalla

CISA pushes critical infrastructure operators to prepare to work in isolation

www.csoonline.com · 2 months ago

The US Cybersecurity and Infrastructure Security Agency has launched a national initiative called CI Fortify to help critical infrastructure operators prepare to operate in isolation from the internet and third party dependencies during major cyberattacks. The program emphasizes controlled isolation rather than traditional air gapping and urges operators to map dependencies, build and test local and manual operational capabilities, and restore systems while disconnected, with CISA providing assessments, guidance, exercises, and a pilot phase to scale across sectors. Experts say adoption will be hindered by limited visibility into complex vendor and managed service dependencies, the high cost of redundant infrastructure and standby resources, and the need to redesign remote access for tightly controlled, auditable crisis use.

DigiCert: Misissued code signing certificates

bugzilla.mozilla.org · 2 months ago

A threat actor used a malicious ZIP sent through a customer chat to infect support analyst endpoints in early April 2026 and obtained initialization codes for approved EV code signing orders. Possession of initialization codes plus approved orders allowed the actor to obtain EV Code Signing certificates from multiple CAs, prompting revocation of 60 certificates, 27 of which were explicitly linked to the actor, and some of the compromised certificates were used to sign Zhong Stealer malware. Affected CAs included DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1, DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, and Verokey High Assurance Secure Code EV. Remediations implemented included canceling pending orders, revoking identified certificates within 24 hours with revocation dates set to issuance dates, masking initialization codes in proxied support sessions, tightening multifactor authentication, disabling Okta FastPass for support, and deploying UI and API changes to prevent similar exposure.

Google AppSheet Abuse Helped Phish 30,000 Facebook Accounts

www.techrepublic.com · 2 months ago

Cybercriminals are exploiting Google's AppSheet platform to conduct phishing campaigns targeting Facebook accounts. The attackers, linked to a Vietnam-based group, have compromised approximately 30,000 accounts by impersonating Meta support or recruiters from well-known companies. These phishing emails bypass standard security measures because they appear to originate from Google’s infrastructure and often display verification marks, increasing their legitimacy. Victims are directed to fake websites where their login credentials are stolen and routed through Telegram bots, enabling account takeover and resale.

Google Update: Android Flaw Could Put Billions of Devices at Risk

www.techrepublic.com · 2 months ago

NULL

Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE

thehackernews.com · 2 months ago

A critical vulnerability has been identified in the Apache HTTP Server, specifically affecting version 2.4.66. This flaw, tracked as CVE-2026-23918, involves a double-free issue in the HTTP/2 protocol handling and poses a risk of denial-of-service and potential remote code execution. Researchers discovered the vulnerability, which stems from a stream cleanup error when a client sends specific HTTP/2 frames. Exploitation can be relatively simple for denial of service and requires specific conditions, like the mmap allocator, for remote code execution. Users are urged to update to version 2.4.67 to mitigate the risk.

DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

thehackernews.com · 2 months ago

A supply chain attack has compromised DAEMON Tools software installers, distributing malicious payloads since April 8, 2026. Tampered components include DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe, which activate an implant upon launch to download and execute further malware. The attack, which has impacted individuals and organizations in over 100 countries, delivers a backdoor including the QUIC RAT remote access trojan, indicating a targeted operation. Researchers attribute the activity to a Chinese-speaking adversary and highlight the significance of isolating affected systems.

Major AI Clients Shipping With Broken OAuth Implementations

www.redcaller.com · 2 months ago

The MCP authorization specification mandates OAuth 2.1, ideally with short-lived access tokens and long-lived refresh tokens. However, many MCP clients currently lack refresh token support, hindering secure implementation. SEP-2207 provides guidance for clients to request refresh tokens, with the MCP TypeScript SDK implementing this standard. Several clients, including Claude Code and Cursor, have not implemented refresh token functionality, leading to issues like manual reconnects and tool failures. Solutions include longer access token TTLs and utilizing a workaround bridge like mcp-remote.

Oracle will patch more often to counter AI cybersecurity threat

www.csoonline.com · 2 months ago

Oracle will issue security patches for its ERP, database and other software on a monthly cycle instead of quarterly to respond to faster AI enabled vulnerability discovery. The first monthly Critical Security Patch Update is scheduled for May 28, 2026, and after that Oracle will release CSPUs on the third Tuesday of each month, with upcoming dates on June 16, July 21 and August 18, 2026, while continuing to publish a cumulative quarterly Critical Patch Update. The new rhythm mainly affects customers running Oracle software on premises or in third party hosting environments because Oracle managed cloud customers receive automatic patching. Oracle says it is using artificial intelligence, including access to OpenAI models and Anthropic Claude Mythos Preview, to accelerate vulnerability detection and fixes, and Mythos has so far been tied directly to only one vulnerability report as of mid April 2026.

Microsoft Edge Stores Passwords in Process Memory, Posing Enterprise Risk

www.darkreading.com · 2 months ago

Microsoft Edge stores user passwords in cleartext within process memory, even when the browser is not actively in use. Security researcher Tom Jøran Sønstebyseter Rønning discovered this design flaw and created a proof-of-concept tool to demonstrate the vulnerability. An attacker with administrative privileges can exploit this issue to access saved passwords on Windows environments using tools like Citrix or terminal servers, potentially leading to lateral movement, data theft, and ransomware attacks. Microsoft maintains this behavior is “by design,” but other Chromium-based browsers like Chrome employ security measures, such as app-bound encryption, to mitigate this risk. Organizations are advised to disable password storage in Edge or use dedicated password management solutions.

Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations

www.securityweek.com · 2 months ago

Microsoft has identified a sophisticated phishing campaign targeting organizations, particularly in the United States. Attackers are sending emails disguised as internal compliance notifications, prompting recipients to open malicious PDF attachments. These attachments redirect users through CAPTCHA pages before requesting Microsoft account login credentials, utilizing an adversary-in-the-middle technique to bypass multifactor authentication. Organizations are advised to implement mitigation strategies and threat hunting techniques to combat this campaign.

FTC to ban data broker Kochava from selling Americans’ location data

www.bleepingcomputer.com · 2 months ago

The Federal Trade Commission is taking action against data broker Kochava to prevent the sale of location data without explicit consumer consent. Kochava collected and sold precise geolocation data, enabling clients to track individuals’ movements to sensitive locations. The proposed order prohibits Kochava from selling location data unless consumers directly request a service and provide affirmative consent. The company must also establish programs to ensure compliance and allow consumers to control their data.

China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions

thehackernews.com · 2 months ago

There is a China-nexus advanced persistent threat tracked as UAT-8302 that has targeted government entities in South America since late 2024 and government agencies in southeastern Europe in 2025. Post-exploitation activity includes deployment of custom malware families shared among China-aligned groups, including a.NET backdoor called NetDraft also known as NosyDoor, CloudSorcerer version 3.0, SNOWLIGHT and its Rust variant SNOWRUST, Deed RAT also known as Snappybee, Zingdoor, Draculoader with Crowdoor and HemiGate, and VShell. The adversary is suspected to gain initial access by weaponizing zero-day and N-day web application exploits, then conduct extensive reconnaissance using open source tools such as gogo, perform lateral movement, and install alternate backdoors via proxy and VPN tools like Stowaway and SoftEther VPN. Researchers say the toolset links UAT-8302 to multiple previously disclosed China-aligned threat clusters and illustrates advanced collaboration models such as Premier Pass as a Service that trade initial access among groups.

Hackers Abuse DAEMON Tools Distribution Channel to Deliver Malicious Payloads

gbhackers.com · 2 months ago

A supply-chain attack has compromised DAEMON Tools, distributing malware through its official download channels since April 2026. Attackers injected malicious code into several DAEMON Tools installers, versions 12.5.0.2421 through 12.5.0.2434, using legitimate developer signatures to evade detection. The malware includes an information collector, a minimalistic backdoor, and a more advanced remote-access trojan, QUIC RAT, affecting users in over 100 countries. Compromised files include DTHelper.exe, DTShellHlp.exe, and DiscSoftBusServiceLite.exe, alongside temporary files such as envchk.exe and cdg.exe.

The EOL Blind Spot in Your CVE Feed: What SCA Tools Don't Check.

www.bleepingcomputer.com · 2 months ago

Security teams often focus on the lack of patches for end-of-life (EOL) open-source software, but a larger issue exists: vulnerabilities are often missed in EOL versions due to a lack of investigation. Current vulnerability scanning tools and CVE feeds typically only cover actively supported versions, leaving EOL software unchecked and creating a false sense of security. This issue is exacerbated by the rapid growth of open-source package releases and the use of artificial intelligence to find vulnerabilities, resulting in a significant number of unflagged, exploitable components. CVE-2026-22732 and other Spring vulnerabilities highlight this problem, as EOL versions were affected but not included in official advisories.

The EOL Blind Spot in Your CVE Feed: What SCA Tools Miss

www.bleepingcomputer.com · 2 months ago

Security teams often focus on patch availability when addressing end-of-life open source software, but a significant issue is the lack of vulnerability investigation for those versions. This occurs because maintainers are overwhelmed by the sheer volume of software and cannot investigate every version, leading to false security confidence and missed vulnerabilities. The Spring ecosystem has demonstrated this, with CVE-2026-22732 affecting Spring Security 6.2, a version not included in the initially affected range, and HeroDevs has confirmed it requires patching. Data indicates a widespread problem, with millions of package versions globally considered end-of-life and lacking investigation, highlighting a growing gap that AI-driven vulnerability research may exacerbate.

Hacker Conversations: Joey Melo on Hacking AI

www.securityweek.com · 2 months ago

Security researcher Joey Melo uses a gaming-inspired approach to test and improve artificial intelligence security. He focuses on bypassing AI safety measures and demonstrating how AI models can be manipulated with false data, a process known as data poisoning. This manipulation can degrade performance or produce harmful results, such as inaccurate diagnoses. Melo prioritizes responsible disclosure, helping developers identify and address vulnerabilities to strengthen AI systems.

ScarCruft Targets Gaming Platform With Windows, Android Backdoors

gbhackers.com · 2 months ago

A North Korea-aligned cyber group, known as ScarCruft or APT37, has targeted ethnic Koreans in China through a compromised gaming platform called sqgame[.]net. The attackers distributed trojanized versions of games containing the BirdCall backdoor, a surveillance tool previously only seen on Windows, and a RokRAT backdoor. The attack, ongoing since late 2024, impacts both Windows and Android devices, with the Android variant harvesting data like contacts, SMS messages, and media files. Researchers have identified multiple Android versions of BirdCall, spanning from October 2024 to June 2025, utilizing cloud storage services for command and control.

Vimeo data breach exposes personal information of 119,000 people

www.bleepingcomputer.com · 2 months ago

A data breach at Vimeo has exposed personal information belonging to over 119,000 people. The cybercrime gang ShinyHunters stole the data after gaining access through a vulnerability in Vimeo’s integration with the data anomaly detection company Anodot. While Vimeo maintains that login credentials and financial information were not compromised, the attackers leaked a 106GB archive of stolen documents after failing to extort the company. ShinyHunters has been linked to numerous other recent breaches, including the European Commission, Carnival, and Medtronic.

Ford Says an Affordable Electric Pickup Truck is Still Coming Next Year

www.nytimes.com · 2 months ago

false

Silver Fox Uses Fake Tax Notices to Drop ValleyRAT and ABCDoor Backdoor

gbhackers.com · 2 months ago

A cyber group known as Silver Fox is using a phishing campaign themed around tax notices to target organizations in India, Russia, and Indonesia. The emails impersonate tax authorities and deliver malicious attachments or links leading to a customized RustSL loader, which in turn deploys ValleyRAT and a new Python backdoor called ABCDoor. The attackers use geofencing and a technique called Phantom Persistence to evade detection and maintain persistence, and the ABCDoor backdoor utilizes screen broadcasting and remote input emulation. Analysts recommend heightened vigilance regarding tax-related emails and monitoring for suspicious Python and ffmpeg activity.

Critical Bug Could Expose 300,000 Ollama Deployments to Information Theft

www.securityweek.com · 2 months ago

A critical vulnerability, tracked as CVE-2026-7482, affects approximately 300,000 publicly exposed Ollama deployments, putting sensitive information at risk. The vulnerability, dubbed Bleeding Llama, allows for unauthenticated remote exploitation through a heap out-of-bounds read issue. Attackers can steal data like API keys and environment variables using only three API calls and can exfiltrate the data to a controlled server. Organizations are advised to update to version 0.17.1 or later and implement network restrictions.

Critical Weaver E-cology RCE Exploit Raises Alarm for Enterprise Systems

gbhackers.com · 2 months ago

A critical remote code execution vulnerability, CVE-2026-22679, is actively being exploited in Weaver E-cology enterprise systems. The flaw, affecting versions before 20260312, allows attackers to execute arbitrary code without authentication via a debug endpoint. Threat actors exploited the vulnerability starting in mid-March 2026, using it to deliver payloads and establish persistent access through the Java Virtual Machine. Organizations are urged to apply the vendor patch, audit process trees, and monitor network activity to mitigate the risk.

HN Security - Extending Burp Suite for fun and profit – The Montoya way – Part 10

hnsecurity.it · 2 months ago

false

Cisco Acquisition of Astrix Security Signals to Strengthen on Non-Human Identity Security

gbhackers.com · 2 months ago

false

Cerberus Stalkerware Hits Google Play, Abuses Accessibility and Firebase for Remote Control

gbhackers.com · 2 months ago

The Android application Cerberus Anti-theft, available on Google Play, is operating as stalkerware, providing abusers with extensive remote control capabilities. The app utilizes accessibility services and Google Firebase to silently trigger actions like camera activation, location logging, and screen recording. Cerberus offers 44 distinct remote commands, including device locking, SMS initiation, and data access, and employs a Wi-Fi "radar" for indoor tracking. The app bypasses Android restrictions using the HiddenApiBypass library to evade detection by Google Play’s review process.

Critical Remote Code Execution Vulnerability Patched in Android

www.securityweek.com · 2 months ago

Google has released an Android update to address a critical vulnerability allowing for remote code execution. The flaw, CVE-2026-0073, impacts the Android System component and adbd daemon, potentially enabling attackers to execute code without user interaction or additional privileges. Patches are not yet available for Wear OS, Pixel Watch, Android XR, and Android Automotive. Google recently increased bug bounty payouts, offering up to $1.5 million for certain zero-click exploits.

The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed

thehackernews.com · 2 months ago

Security leaders are increasingly concerned about unmanaged OAuth grants, which present a significant risk as they bypass traditional security controls like multi-factor authentication. The Drift incident, affecting numerous organizations including Cloudflare and PagerDuty, demonstrated how attackers exploited legitimate OAuth integrations by stealing refresh tokens and accessing sensitive data, like AWS access keys and passwords. Current security tools often focus on initial app assessments, but effective protection requires continuous behavioral monitoring of app activity and assessing the potential impact of compromised grants. Organizations need visibility into existing grants, continuous monitoring of behavior, and the capability to respond quickly to mitigate potential threats.

How the Story of a USB Penetration Test Went Viral

www.darkreading.com · 2 months ago

There was a 2006 penetration test in which consultants seeded rigged USB drives around a credit union parking lot and observed a reported 15 out of 20 employees plug the drives into work machines, enabling remote callbacks. The exercise sparked widespread awareness and dozens of copycat social engineering engagements, and modern equivalents now rely on full field systems and on-site devices rather than simple thumb drives while using pretexts such as utility or copier repair to gain entry. Testers report using artificial intelligence to accelerate reconnaissance, leveraging human trust and small gifts to obtain access, doing ransomware incident response and ransom negotiations when needed, and warning that AI simultaneously lowers the effort required for attackers and raises new safety and ethical concerns for defenders.

How the Story of a USB Penetration Test Went Viral

www.darkreading.com · 2 months ago

false

MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks

thehackernews.com · 2 months ago

Threat actors are actively exploiting a critical vulnerability in the MetInfo content management system. This vulnerability, identified as CVE-2026-29014, is a code injection flaw allowing for remote code execution. The flaw exists in versions 7.9, 8.0, and 8.1 of the CMS and requires the "/cache/weixin/" directory to exist on non-Windows servers. Exploitation began on April 25th, with a significant increase in attacks targeting China and Hong Kong on May 1st.

AI finds 20-year-old bugs in PostgreSQL and MariaDB

www.csoonline.com · 2 months ago

Security researchers have identified critical vulnerabilities in PostgreSQL and MariaDB databases, some dating back over 20 years. The vulnerabilities, found using an AI-powered security analysis tool, allow for remote code execution. Specific flaws include a heap-based buffer overflow in PostgreSQL’s “pgcrypto” extension (CVE-2026-2005), a missing validation bug in PostgreSQL (CVE-2026-2006), and a buffer overflow in MariaDB’s JSON schema validation logic (CVE-2026-32710). Patches have been released for all identified vulnerabilities, and users are urged to update their systems immediately.

Google now offers up to $1.5 million for some Android exploits

www.bleepingcomputer.com · 2 months ago

Google is increasing rewards for complex Android and Chrome exploits, with a top bounty of $1.5 million for zero-click Pixel Titan M2 security chip exploits that include persistence. Rewards for Chrome exploits involving memory allocation protection, known as MiraclePtr, now include a $250,000 reward plus an additional $250,128 bonus. Google is also shifting its focus to concise bug reports, due to advances in artificial intelligence. In 2025, Google paid researchers $17.1 million for reported vulnerabilities, a 40 percent increase from the previous year.

Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server

www.securityweek.com · 2 months ago

Apache has released security updates for its HTTP Server and MINA software. The HTTP Server update addresses eleven vulnerabilities, including a double-free bug (CVE-2026-23918) and a heap buffer overflow (CVE-2026-28780), both potentially leading to remote code execution. MINA updates resolve two critical vulnerabilities, CVE-2026-42778 and CVE-2026-42779, which relate to insecure deserialization and allowlist bypass issues. Users are advised to explicitly allow accepted classes after upgrading to a patched release.

Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs

www.csoonline.com · 2 months ago

A new malware campaign is exploiting Microsoft's Phone Link feature to steal SMS one-time passwords and other sensitive data from Windows systems. The threat, first observed in January 2026, involves a remote access trojan called CloudZ and a custom plugin named Pheno, which monitors data mirrored through Phone Link without compromising the mobile device itself. Attackers use CloudZ to deliver Pheno, which then scans for Phone Link activity and potentially intercepts SMS messages and authenticator notifications. The malware chain begins with an unknown initial access vector, employing techniques to evade detection and establish persistence on the system.

Ghosts of Encryption Past – How we Read All Your Emails in Salesforce Marketing Cloud

slcyber.io · 2 months ago

Researchers have identified multiple vulnerabilities within Salesforce Marketing Cloud, posing a risk of data exposure. Exploits involve flaws in the MicrositeURL function and weak encryption methods, allowing access to sensitive email data across multiple tenants. Salesforce has responded by implementing AES-GCM encryption, link expiration, and disabling specific scripting functions. The vulnerabilities have resulted in the assignment of several CVEs.

WhatsApp Security Flaw Enables Malicious URL Execution Through Instagram Reels

gbhackers.com · 2 months ago

WhatsApp has addressed two security vulnerabilities that could have allowed attackers to execute malicious actions. One vulnerability, tracked as CVE-2026-23866, involved Instagram Reels, allowing attackers to trigger URLs on a victim’s device through unvalidated message elements. A second vulnerability, CVE-2026-23863, targeted WhatsApp for Windows, enabling attackers to spoof file attachments and trick users into running malicious files. Both vulnerabilities have been patched and were not actively exploited, but users are advised to update their applications.

Karakurt Ransomware Negotiator Sentenced to Prison

www.securityweek.com · 2 months ago

A Latvian national involved with the Karakurt ransomware gang has been sentenced to 8.5 years in prison in the United States. The group, previously associated with Conti and known by other names, targeted organizations across various industries to steal data and demand ransom. The individual’s role involved negotiating with victims and escalating pressure, including threatening to release patient data when payment wasn't received. He received a portion of the ransom payments in cryptocurrency and was arrested in Georgia before extradition.

Education Sector Hit by Espionage, Phishing, and Supply Chain Attacks

gbhackers.com · 2 months ago

Educational institutions are experiencing a rise in state-sponsored espionage, spear-phishing, and supply chain attacks, shifting from traditional ransomware threats. Activity from China-aligned groups like MISSION2074, Stone Panda, and others is targeting organizations in countries including the United States, United Kingdom, and Japan. Cyberattacks are increasingly focused on email, FTP, and SSHD servers to gain access to research data and communications. Hacktivism and distributed denial-of-service attacks are also increasing, aiming to disrupt online learning platforms.

DarkSword Malware

www.schneier.com · 2 months ago

A sophisticated malware known as DarkSword has been discovered targeting Apple iOS devices. The Google Threat Intelligence Group believes the malware is likely government designed and utilizes multiple zero-day vulnerabilities to fully compromise devices across versions 18.4 through 18.7. Threat actors in Saudi Arabia, Turkey, Malaysia, and Ukraine have been observed using DarkSword in surveillance campaigns, deploying malware families like GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. A version of the exploit chain recently leaked, increasing its potential for broader use.

The Danger of Multi-SSO AWS Cognito User Pools

blog.doyensec.com · 2 months ago

Security vulnerabilities have been identified in AWS Cognito multi-SSO user pool setups, potentially allowing attackers to compromise user authentication. These issues stem from trusting data received from external identity providers, creating risks like ghost identity injection and IdP identifier hijacking. Developers should carefully validate identity provider data and implement secure coding practices, including robust domain policy enforcement and protecting identity provider identifiers. A weaponized identity provider tool and a Terraform lab are available to test and identify vulnerabilities.

We Scanned 1 Million Exposed AI Services. Here's How Bad the Security Actually Is

thehackernews.com · 2 months ago

A recent scan of over 2 million hosts revealed widespread security vulnerabilities in self-hosted AI infrastructure, exceeding the risk levels seen in other software. Many AI services were found deployed without authentication, exposing user data, chatbot conversations, and company tools. Exposed platforms included agent management systems like n8n and Flowise, along with unsecured Ollama APIs, with 31% of queried servers responding without authentication. Researchers observed insecure deployment practices, default configurations, and even hardcoded credentials, highlighting a concerning trend of prioritizing speed over security.

Karakurt extortion gang ‘cold case’ negotiator gets 8.5 years in prison

www.bleepingcomputer.com · 2 months ago

A Latvian national has been sentenced to 8.5 years in prison for his role as a negotiator for the Russian Karakurt ransomware group. The individual, Deniss Zolotarjovs, was involved in extorting dozens of companies, including a government entity whose 911 system was affected. He used stolen personal and health information to pressure victims into paying ransom, and is linked to attacks by groups like Conti, Royal, and Akira. Authorities estimate total losses from the attacks to be in the hundreds of millions of dollars.

CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs

www.bleepingcomputer.com · 2 months ago

A new malicious plugin called Pheno is being used with the CloudZ remote access tool to hijack Microsoft Phone Link connections and steal sensitive information. The threat actor can intercept SMS and one-time passwords from mobile devices without compromising the device itself. Researchers discovered the intrusion began at least in January and involved a fake ScreenConnect update delivering a Rust-based loader, followed by a.NET loader that installs CloudZ. The malware uses techniques to evade detection and rotates user-agent strings to disguise its communication.

Code of Conduct Phish Hits 35,000 Users in Multi-Stage AiTM Attack

gbhackers.com · 2 months ago

A sophisticated phishing campaign, observed between April 14 and April 16, 2026, has targeted over 35,000 users across 13,000 organizations. The attackers used code-of-conduct themed lures and convincing internal communication techniques to bypass security defenses. The multi-stage attack involved CAPTCHA challenges and an adversary-in-the-middle (AiTM) technique to steal session tokens and bypass multifactor authentication. Affected industries include healthcare, financial services, and technology, with the United States experiencing the highest impact.

securelist.com · 2 months ago

A supply chain attack compromised DAEMON Tools software in early 2026, affecting users across more than 100 countries. Malicious code was inserted into installers between versions 12.5.0.2421 and 12.5.0.2434, deploying a backdoor and the QUIC RAT malware. While most systems received basic data collection, a select number of organizations in government, science, manufacturing, and retail were targeted with a more advanced backdoor. Kaspersky is actively detecting and mitigating the threat, which highlights the increasing prevalence of supply chain attacks.

MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs

www.securityweek.com · 2 months ago

Threat actors are actively exploiting critical vulnerabilities in MetInfo and Weaver E-cology, allowing for remote code execution without authentication. The MetInfo vulnerability, CVE-2026-29014, is a PHP code injection issue stemming from insufficient input sanitization, with approximately 2,000 instances currently exposed online. Weaver E-cology's vulnerability, CVE-2026-22679, involves exposed debug functionality enabling command execution. Attackers have been observed using ping callbacks and payloads to compromise vulnerable systems, primarily in China and Singapore.

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

thehackernews.com · 2 months ago

A North Korea-aligned hacking group known as ScarCruft has compromised a video game platform targeting ethnic Koreans in China. The attackers used a supply chain attack to distribute the BirdCall backdoor, a variant of RokRAT, on both Windows and Android devices. BirdCall’s capabilities include screenshot capture, keystroke logging, and data theft, utilizing cloud services for command and control. Compromised Android application packages are available at sqgame.com[.]cn/ybht.apk and sqgame.com[.]cn/sqybhs.apk.

ScarCruft hackers push BirdCall Android malware via game platform

www.bleepingcomputer.com · 2 months ago

A North Korean hacker group, known as APT37 or ScarCruft, has been using a modified Android version of the BirdCall backdoor to spy on users. The malware was distributed through a compromised game platform targeting Korean users in China. This Android variant collects extensive device information, records audio, and exfiltrates files, though it lacks some of the features found in the Windows version. Cybersecurity researchers advise users to only download software from trusted sources to avoid malware infections.

WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities

www.securityweek.com · 2 months ago

WhatsApp has addressed two security vulnerabilities impacting its Windows, iOS, and Android applications. CVE-2026-23863 involves a file spoofing issue where malicious documents could execute upon opening. CVE-2026-23866 relates to incomplete validation of rich response messages, potentially allowing attackers to trigger media content from arbitrary URLs. Researchers responsibly disclosed both vulnerabilities through Meta’s bug bounty program, and there is no indication of exploitation.

CISOs step up to the security workforce challenge

www.csoonline.com · 2 months ago

false