Blahalla

WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities

www.securityweek.com · 2 months ago

WhatsApp has addressed two security vulnerabilities impacting its Windows, iOS, and Android applications. CVE-2026-23863 involves a file spoofing issue where malicious documents could execute upon opening. CVE-2026-23866 relates to incomplete validation of rich response messages, potentially allowing attackers to trigger media content from arbitrary URLs. Researchers responsibly disclosed both vulnerabilities through Meta’s bug bounty program, and there is no indication of exploitation.

CISOs step up to the security workforce challenge

www.csoonline.com · 2 months ago

false

Why most zero-trust architectures fail at the traffic layer

www.csoonline.com · 2 months ago

false

Cuba’s mom influencers share rare view of struggles under U.S. fuel embargo

www.washingtonpost.com · 2 months ago

false

Qualcomm Chipset Vulnerabilities Raise Alarm Over Remote Code Execution Risk

gbhackers.com · 2 months ago

Qualcomm has released a security bulletin addressing numerous vulnerabilities across its chipsets, impacting smartphones, automotive systems, and industrial devices. Several critical flaws, including CVE-2026-25254 and CVE-2026-25293, enable remote code execution. Other vulnerabilities, such as CVE-2026-25262, involve memory corruption and require local access, while CVE-2026-25255 poses a privilege escalation risk. Device manufacturers must promptly deploy patches to mitigate these risks and protect users.

Attackers Exploit Amazon SES to Send Authenticated Phishing Emails

gbhackers.com · 2 months ago

Attackers are increasingly exploiting Amazon’s Simple Email Service, or SES, to send sophisticated phishing emails that bypass standard security measures. These emails often mimic legitimate communications, like notifications from electronic signature services such as DocuSign, and appear technically authentic due to SES’s established reputation and authentication protocols. Threat actors typically gain access to SES accounts through leaked AWS Identity and Access Management, or IAM, credentials. To mitigate this risk, organizations should strengthen AWS security practices, including limiting access privileges and rotating access keys.

New Attribution Framework Links APT Campaigns Across Key Layers

gbhackers.com · 2 months ago

Cybersecurity analysts are adopting a new attribution framework to better understand advanced persistent threat activity. Traditional methods rely on matching tactics, techniques, and procedures, but this is often unreliable due to shared tools and evolving adversary behavior. The new approach focuses on campaign-based analysis, examining discrete operations to identify connections through shared infrastructure, malware, targeting patterns, and timing. This layered model utilizes a Campaign Linkage Graph and assigns confidence levels to attribution based on evidence convergence.

Proton Pass: Second-Password Bypass Through Emergency Access

www.zolder.io · 2 months ago

A vulnerability has been identified in Proton Pass's Emergency Access feature, allowing attackers to bypass the second password protection for password vaults. By compromising a user’s primary Proton account and creating a new, minimally verified account, an attacker can add themselves as an emergency contact with a zero-minute wait time. This grants immediate, unimpeded access to the Proton Pass vault without requiring the second password, effectively nullifying its intended security benefit. Proton acknowledges the issue as a design choice, but immediate action is recommended to mitigate the risk of account compromise.

Critical Android Zero-Click Vulnerability Enables Remote Shell Access

gbhackers.com · 2 months ago

A critical vulnerability has been identified in the Android System component, allowing attackers to gain remote shell access without user interaction. The flaw, tracked as CVE-2026-0073, impacts Android versions 14, 15, 16, and 16-qpr2, and is linked to the Android Debug Bridge Daemon. Attackers must be on the same local network or in close proximity to the device to exploit the vulnerability. Google is addressing the issue through Google Play system updates and advises users to update to the 2026-05-01 security patch level.

Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

thehackernews.com · 2 months ago

A critical vulnerability, CVE-2026-22679, is actively being exploited in Weaver E-cology, an office automation platform. This unauthenticated remote code execution flaw allows attackers to execute arbitrary commands through the debug API endpoint. Exploitation began around March 17, 2026, just days after the release of patches. Threat actors have been observed using deceptive file names and running discovery commands during the intrusion.

Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries

thehackernews.com · 2 months ago

Microsoft has identified a large-scale phishing campaign targeting over 35,000 users across 26 countries, primarily in the U.S., with a focus on healthcare, finance, and technology sectors. The attackers used legitimate email services and sophisticated HTML templates mimicking internal communications to steal credentials and authentication tokens via an adversary-in-the-middle technique. The campaign included code of conduct-themed lures, PDF attachments, and CAPTCHA challenges to evade defenses. The findings highlight a rise in QR code phishing and the abuse of Amazon Simple Email Service to bypass email security protocols.

Fake “Notepad++ for Mac” Site May Pose Malware Risk for Mac Users

gbhackers.com · 2 months ago

A deceptive website is impersonating the Notepad++ text editor and falsely claiming to offer an official version for macOS. The site, notepad-plus-plus-mac[.]org, uses the Notepad++ name, logo, and color scheme to trick users into believing it's a legitimate release. The website's creator has publicly stated the site has no connection to the original Notepad++ project and is using his image and biography without authorization. Downloading software from unofficial sources poses a security risk, as future updates could contain malware. Users are advised to only download Notepad++ from the official website, notepad-plus-plus[.]org, and to remove any previously installed fake versions.

Microsoft Edge Found Storing Saved Passwords in Cleartext Memory at Startup

gbhackers.com · 2 months ago

Microsoft Edge stores all saved passwords in cleartext memory immediately upon launch, a design choice confirmed by Microsoft. This behavior differentiates Edge from browsers like Google Chrome, which decrypt passwords on demand using App-Bound Encryption. The practice poses a significant security risk, especially in shared computing environments where attackers with administrative privileges can easily harvest credentials from memory. Security experts advise against storing sensitive information in Edge and recommend using third-party password managers instead.

Apache HTTP Server Vulnerability Exposes Millions to Remote Code Execution Threats

gbhackers.com · 2 months ago

A critical security vulnerability has been identified in the Apache HTTP Server, tracked as CVE-2026-23918. This “double free” flaw affects servers running version 2.4.66 with HTTP/2 enabled, allowing for potential remote code execution. Researchers privately reported the vulnerability, prompting a swift patch released in version 2.4.67; immediate updates are advised to prevent attacks and potential data theft or system control. Administrators should also monitor server logs and consider temporarily disabling HTTP/2 until patching is complete.

pnpm 11 Enables Default Release-Age Guard to Curb npm Supply Chain Attacks

gbhackers.com · 2 months ago

pnpm 11 has been released with a focus on improving software supply chain security. A new default minimum release age of 24 hours is now in place, delaying the installation of newly published packages to mitigate attacks that rely on quickly spreading malicious versions. The update also restricts dependencies to standard sources and simplifies controls over lifecycle scripts to prevent malicious code execution. These changes respond to recent attacks, like the Mini Shai-Hulud campaign, which targeted developer environments through install hooks.

We probed 6,000 web apps for Stripe webhook signature checks. 1,542 don't bother

securityscanner.dev · 2 months ago

Researchers scanned 6,000 web applications and discovered 1,542, or roughly one in four, were accepting payment webhook events without signature verification. This allows attackers to forge events, potentially upgrading accounts or creating fraudulent bookings. The vulnerability stems from developers skipping signature verification, often due to incomplete code implementations or reliance on code assistants. To mitigate the risk, developers should always verify webhook signatures using the appropriate SDK for their framework.

DigiCert Hacked in Screensaver-Based Attack to Fraudulently Obtain EV Code Signing Certificates

gbhackers.com · 2 months ago

DigiCert, a Certificate Authority, experienced a security breach in April 2026 where attackers fraudulently obtained 60 Extended Validation Code Signing certificates. The attackers used a malicious screensaver file delivered through a customer support chat channel to compromise a support analyst’s computer and access sensitive initialization codes. These stolen certificates were then used to digitally sign the “Zhong Stealer” malware, bypassing security warnings. DigiCert has since revoked all affected certificates and implemented stricter security measures, including hiding initialization codes and enforcing stronger multi-factor authentication.

10 Anzeichen für einen schlechten CSO

www.csoonline.com · 2 months ago

There are ten signs of a poor CSO: lack of a long term strategy, moving from crisis to crisis, words instead of actions, no documentation, poor communication, leaving questions unanswered, avoiding hard decisions, self focused leadership, suppression of talent, and claiming others successes. Weak security leadership increases staff turnover, undermines the organization security posture, and should be changed promptly to reduce risk and restore team effectiveness.

Anthropic and Wall Street Giants Join Forces to Create New A.I. Firm

www.nytimes.com · 2 months ago

false

S.E.C. Settles Lawsuit Against Elon Musk Over His Twitter Disclosures

www.nytimes.com · 2 months ago

false

Anthropic Mythos spurs White House to weigh pre-release reviews for high-risk AI models

www.csoonline.com · 2 months ago

Concerns over the potential for AI-enabled cyberattacks, particularly stemming from Anthropic’s new Mythos model, are prompting the White House to re-evaluate pre-release oversight of high-risk AI systems. The Mythos model has demonstrated the capability to identify software vulnerabilities at a level comparable to skilled human experts. Anthropic is limiting access to Mythos through Project Glasswing and has briefed government agencies on its capabilities. Discussions are underway to potentially reinstate review processes similar to those previously revoked, although no formal proposals or timelines have been established.

White House Considers Vetting A.I. Models Before They Are Released

www.nytimes.com · 2 months ago

false

Elon Musk’s Lawyers Ask OpenAI’s President Why He Is Worth $30 Billion

www.nytimes.com · 2 months ago

false

Elon Musk will pay $1.5 million to settle with SEC over late paperwork

www.washingtonpost.com · 2 months ago

false

Weaver E-cology critical bug exploited in attacks since March

www.bleepingcomputer.com · 2 months ago

Hackers exploited a critical vulnerability, CVE-2026-22679, in Weaver E-cology office automation software beginning in mid-March. The flaw, stemming from an improperly secured debug API, allowed attackers to execute system commands remotely. Initial attempts at deploying malicious software were blocked by endpoint defenses, and attackers ultimately used reconnaissance commands and fileless PowerShell scripts. Users are strongly advised to update to the latest version of the software, which removes the vulnerable debug endpoint.

Physical Cargo Theft Gets a Boost From Cybercriminals

www.darkreading.com · 2 months ago

Cargo theft has shifted from local smash and grab operations to coordinated, transnational cyber enabled schemes that reroute goods and impersonate legitimate brokers. The FBI warns losses in the United States and Canada rose 60 percent to about 725 million dollars in 2025 as criminals use phishing, impersonation, fake online orders, fraudulent bids, compromised broker accounts, remote monitoring and management system access, and GPS spoofing to hijack shipments. About a quarter of cargo theft incidents in the first quarter of 2026 were cyber enabled, with attackers employing synthetic identities, stolen carrier credentials, and even acquiring motor carrier businesses to gain authorized access. Industry guidance calls for stronger carrier vetting, consistent driver identification checks, employee training on cargo security, in transit security controls, and protection of logistics information systems.

Microsoft Defender Bug Triggers False Malware Alerts for DigiCert Certificates

www.techrepublic.com · 2 months ago

A recent Microsoft Defender update mistakenly flagged legitimate DigiCert root certificates as malicious, triggering false positive alerts. This occurred following an update designed to detect Trojan:Win32/Cerdigent.A!dha related to a DigiCert security incident and the revocation of approximately 60 certificates. The error resulted in some systems removing trusted certificates, disrupting trust relationships and leading to unnecessary remediation efforts. Microsoft has since released an update to correct the flawed detection logic.

RMM Tools Fuel Stealthy Phishing Campaign

www.darkreading.com · 2 months ago

A phishing campaign, dubbed VENOMOUSHELPER, has targeted over 80 organizations across multiple industries since April 2025. Attackers are using convincingly crafted phishing emails disguised as messages from the US Social Security Administration to deliver malicious executables that install two legitimate remote monitoring and management tools: SimpleHelp and ScreenConnect. These tools enable persistent control over compromised systems and allow attackers to blend malicious activity with normal IT operations. Security researchers believe this activity is linked to a financially motivated Initial Access Broker.

Researchers report Amazon SES abused in phishing to evade detection

www.bleepingcomputer.com · 2 months ago

Cybersecurity researchers have observed a rise in phishing attacks utilizing Amazon’s Simple Email Service, or SES, to bypass security filters. This abuse is largely attributed to exposed AWS access keys found in public repositories, allowing attackers to send convincing phishing emails that appear legitimate. Attackers are crafting sophisticated phishing campaigns, including business email compromise schemes and fake document notifications, that circumvent authentication checks and IP blocking. Amazon states they respond quickly to reports of abuse and offers security guidance on protecting accounts.

Amazon SES increasingly abused in phishing to evade detection

www.bleepingcomputer.com · 2 months ago

Cybercriminals are increasingly using Amazon's Simple Email Service, or SES, to distribute sophisticated phishing emails, successfully bypassing traditional security measures. The abuse is largely attributed to a rise in exposed Amazon Web Services access keys, often located through automated tools like TruffleHog. These phishing campaigns feature convincing custom HTML templates and techniques like fabricated email threads and fake invoices, imitating legitimate services to trick victims. Security experts advise limiting access permissions, enabling multi-factor authentication, rotating keys, and implementing IP-based restrictions to mitigate this threat.

Exploit Cyber-Frenzy Threatens Millions via Critical cPanel Vulnerability

www.darkreading.com · 2 months ago

A critical authentication bypass vulnerability, CVE-2026-41940, is being actively exploited in cPanel software, impacting millions of websites and thousands of instances. Exploitation began within 24 hours of public disclosure and may have been occurring for up to a month prior. Attackers are deploying ransomware and botnet malware, and the vulnerability's ease of weaponization, combined with a large attack surface, has led to widespread exploitation. Security experts recommend immediate patching, credential rotation, and blocking specific ports for mitigation.

Cisco Moves to Acquire Astrix Security to Tackle Non-Human Identity Risks

www.securityweek.com · 2 months ago

false

The Winter Games effect: When gold meets DDoS

www.csoonline.com · 2 months ago

DDoS attacks against Italy significantly increased during the Milano Cortina 2026 Winter Games, with volumes spiking 181 percent compared to 2025. Attack activity was concentrated in Milan, Cortina, and targeted symbolic locations, escalating before the games and peaking after the closing ceremonies. Threat actors like NoName057(16) claimed responsibility for 47 attacks, leveraging UDP flooding and amplification techniques like DNS and memcached. The DDoSia platform, utilized by NoName057(16), targeted Italian infrastructure, while the Aisuru IoT botnet focused heavily on Milan.

Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools

thehackernews.com · 2 months ago

A phishing campaign, dubbed VENOMOUSHELPER or STAC6405, has targeted over 80 organizations, primarily in the U.S., since April 2025. Attackers use phishing emails impersonating the U.S. Social Security Administration to trick victims into downloading malware that installs SimpleHelp and ScreenConnect Remote Monitoring and Management tools. This creates redundant remote access, allowing continued operation even if one tool is blocked. The malware establishes persistence, enumerates security products, and gains elevated privileges to control compromised systems.

Indirect Prompt Injection Is Now a Real-World AI Security Threat

www.techrepublic.com · 2 months ago

Researchers have recently observed real-world attacks exploiting indirect prompt injection against AI systems, where hidden instructions embedded in content manipulate AI agents to perform actions like data exfiltration and credential theft. These attacks bypass traditional security tools because the AI is acting within its designed function, accessing data through legitimate channels. Current defenses, including system prompts and human review, are proving inadequate, and a shift towards data-layer governance, authenticating, evaluating, and logging AI access to data, is now essential for protecting sensitive information. Organizations must move enforcement away from model-level controls and instead focus on independent data access policies.

Trellix Source Code Repository Breached

www.securityweek.com · 2 months ago

A part of Trellix's source code repository was breached, and the company says it is working with forensic experts and has notified law enforcement. Based on the investigation to date, Trellix reports no evidence that its source code release or distribution process was affected or that its source code has been exploited. The company will provide more details after the probe, while industry observers are speculating about the intrusion window, the perpetrators, which products were exposed, and potential links to a broader supply chain campaign tied to groups associated with recent attacks on other security firms.

Backdoored PyTorch Lightning package drops credential stealer

www.bleepingcomputer.com · 2 months ago

A malicious PyPI release of the PyTorch Lightning package delivered an import-time credential stealer that silently spawns a background process and downloads a JavaScript runtime to execute an obfuscated payload. The compromised release, published April 30 as version 2.6.3, downloads Bun v1.3.13 and runs an 11.4 megabyte obfuscated routerruntime.js that exfiltrates.env files, API keys, GitHub tokens and browser stored data and interacts with AWS Azure and GCP to harvest cloud credentials. Microsoft Defender detects the payload as ShaiWorm and telemetry indicates only a small number of devices were affected, but users who imported the compromised version are advised to rotate all secrets and revert to version 2.6.1 which has been restored on PyPI.

How orphaned applications are quietly fueling your shadow IT problem

www.csoonline.com · 2 months ago

Forgotten applications, known as orphaned applications, are driving shadow IT and creating significant security and operational challenges. These applications often arise from legitimate business needs but are left running and exchanging data when teams or projects move on, consuming resources and creating unmonitored access points. A lack of visibility into these applications can lead to outdated configurations, dormant credentials, and extended attacker dwell time. Organizations can identify and address these issues by utilizing network data to reveal hidden systems and dependencies, providing a more accurate view of their IT environment.

Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass

thehackernews.com · 2 months ago

Progress Software released updates for MOVEit Automation to fix two security flaws, including a critical authentication bypass. The flaws are CVE-2026-4670 with a CVSS score of 9.8 and CVE-2026-5174 with a CVSS score of 7.7, and they could enable authentication bypass and privilege escalation leading to unauthorized access and data exposure. Affected releases include MOVEit Automation up to 2025.1.4, 2025.0.8, and 2024.1.7, with fixes issued in 2025.1.5, 2025.0.9, and 2024.1.8 respectively. The vulnerabilities were reported by Airbus SecLab researchers, there are no known workarounds, and users are urged to apply the updates promptly though Progress has reported no evidence of active exploitation.

Trellix discloses data breach after source code repository hack

www.bleepingcomputer.com · 2 months ago

There was unauthorized access to a portion of Trellix's source code repository, and the company is investigating the incident with outside forensic experts and law enforcement. Investigators have found no evidence to date that the accessed source code was exploited, altered, released, or that Trellix's source code release or distribution process was affected. Trellix provides security services to more than 50,000 business and government customers and protects over 200 million endpoints, and the company says it will share further details as appropriate after the investigation concludes.

A.I. Bots Told Scientists How to Make Biological Weapons

www.nytimes.com · 2 months ago

NULL

Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

www.microsoft.com · 2 months ago

There was a large scale credential theft campaign observed between April 14 and April 16, 2026, that targeted more than 35,000 users across over 13,000 organizations, primarily in the United States. The campaign used code of conduct themed lures sent through legitimate email delivery services, polished PDF attachments, and multi step CAPTCHA gated landing pages to filter defenses and increase credibility. The attack chain culminated in an adversary in the middle authentication proxy that intercepted authentication tokens and bypassed non phishing resistant multifactor authentication. Recommended mitigations include user awareness training, advanced anti phishing protections, Safe Links and Safe Attachments, Zero hour auto purge, network protection with SmartScreen, and deploying passwordless or phishing resistant multifactor authentication.

Silver Fox Springs Tax-Themed Attacks on Orgs in India, Russia

www.darkreading.com · 2 months ago

More than 1,600 socially engineered tax-themed emails targeted organizations in India and Russia between December and early February, using attachments and PDFs that directed recipients to download malicious archives or linked ZIP and RAR files. The campaign delivered a previously undocumented Python backdoor called ABCDoor that persists via Registry Run keys and scheduled tasks, communicates with command servers over HTTPS using asynchronous Socket.IO, runs under pythonw.exe to evade detection, and supports multi-monitor screen streaming, remote mouse and keyboard control, clipboard theft, file operations, limited file encryption, self-updating, and self-removal. Other payloads included the ValleyRAT remote access Trojan and a heavily modified RustSL loader, and defenders are urged to strengthen email filtering, attachment and URL analysis, endpoint detection, least-privilege access, software execution controls, and continuous external attack surface visibility.

⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More

thehackernews.com · 2 months ago

AI-enabled attackers have shifted from one-off breaches to long-term occupation of SaaS sessions and developer pipelines, using AI-powered phishing and vishing campaigns that bypass multi factor authentication and live inside authenticated sessions. Critical vulnerabilities are being actively exploited, including a cPanel and WebHost Manager authentication bypass CVE-2026-41940 that has led to site wipes and Mirai and Sorry ransomware deployments, the Copy Fail Linux kernel local privilege escalation CVE-2026-31431 that enables reliable privilege escalation and container escape, and a GitHub remote code execution flaw CVE-2026-3854 that can be triggered with a single git push. Supply chain compromises by TeamPCP have poisoned npm, PyPI, and Packagist packages including Trivy and KICS to spread malicious builds through legitimate CI pipelines, while VECT 2.0 ransomware has been observed irreversibly wiping large files, prompting urgent patching, rotation of pipeline and cloud credentials, and tighter visibility into builds.

Lateral Movement - Cross-Session Activation

ipurple.team · 2 months ago

There is a Windows lateral movement technique called Cross-Session Activation that abuses COM and DCOM to activate objects in another user's interactive session and execute code when an attacker has elevated privileges. The technique relies on COM classes configured to run as the Interactive User, an active session, and launch and activation rights and has been demonstrated by proof of concepts targeting components such as BitLocker, Speech, and the IHxHelpPaneServer with tools like SessionHop, and it is associated with at least one tracked vulnerability CVE-2024-38100. Defensive recommendations include enumerating and monitoring CLSIDs that meet the criteria, enabling registry and process creation auditing, and creating detections for anomalous HelpPane and slui process activity and registry modifications, specifically watching Windows event IDs 4663 and 4688.

They don’t hack, they borrow: How fraudsters target credit unions

www.bleepingcomputer.com · 2 months ago

There is an organized, process driven loan fraud method targeting small to mid sized credit unions that uses stolen identities, social engineering, and detailed knowledge of onboarding and lending workflows rather than exploiting software vulnerabilities. Attackers gather full identity data and credit history, reconstruct knowledge based authentication answers, assess credit profiles, submit consistent loan applications, and then quickly move approved funds through intermediary accounts to cash out before detection. The method exploits perceived weaknesses in verification and behavioral fraud detection at smaller institutions and blurs the line between legitimate activity and fraud, increasing the difficulty of detection and potential losses.

Cybersecurity M&A Roundup: 33 Deals Announced in April 2026

www.securityweek.com · 2 months ago

There were 33 cybersecurity related merger and acquisition deals announced in April 2026. Major transactions included Airbus agreeing to acquire Quarkslab to bolster sovereign cybersecurity in Europe and protect software and digital assets against AI driven threats and reverse engineering, Cyera acquiring Ryft to add a secure automated data lake platform for AI agents, and Palo Alto Networks announcing intent to acquire Portkey to establish an AI Gateway for securing and governing autonomous AI agents within its Prisma AIRS platform. Other notable deals included Fortra purchasing Zero Point Security to expand offensive security training, Silverfort acquiring Fabrix Security to combine runtime access protection with an AI decisioning engine, Socket buying Secure Annex to expand extension and supply chain protections, and numerous smaller transactions across the sector.

Bluekit Phishing Kit Streamlines Domains, 2FA Lures, and Session Hijacking

gbhackers.com · 2 months ago

A newly discovered phishing kit called Bluekit centralizes multiple attack stages into a single operator panel, automating domain purchase and registration, template deployment, and Telegram based data exfiltration. The platform offers more than 40 prebuilt templates for services including Apple ID, Gmail, Outlook, Yahoo, ProtonMail, GitHub, Twitter, Zoho, and Ledger, and includes built in two factor authentication phishing, spoofing and geolocation emulation, anti bot protections, optional mail sender and voice cloning add ons, and an AI assistant. Bluekit captures session state, browser cookies, and local storage to enable session hijacking and live monitoring of victim activity that can be used to bypass multi factor authentication, and defenders are advised to deploy phishing resistant MFA, session monitoring, and user awareness to mitigate the threat.

DigiCert Revokes Certificates After Support Portal Hack

www.securityweek.com · 2 months ago

On April 2 hackers delivered malware via a customer chat channel disguised as a screenshot, infecting two analyst endpoints that were detected on April 3 and April 14 and enabling later access to the internal support portal. Using a proxy function available to authenticated support analysts, the attackers obtained initialization codes and approved orders and fraudulently obtained EV Code Signing certificates for a set of customer accounts and certificate authorities. By April 17 sixty certificates were revoked, twenty seven were explicitly linked to the threat actor, and eleven were used to sign Zhong Stealer malware. The organization canceled pending orders and tightened controls by enforcing multi factor authentication for administrative workflows, preventing proxied support users from accessing initialization codes, restricting file types in support chat and Salesforce case attachments, and improving logging.

Cisco Launches AI Provenance Tool to Strengthen Security and Compliance

gbhackers.com · 2 months ago

Cisco launched the Model Provenance Kit, an open source tool designed to trace the lineage of AI models to improve transparency, security, and regulatory compliance. The toolkit operates in two stages, first comparing architecture and metadata and then, when needed, analyzing learned weights to extract five complementary signals that form a unique provenance fingerprint. In a 111 pair benchmark that included aggressive distillation and cross organization fine tuning, the system correctly classified 107 pairs, showing perfect recall on standard and cross organization derivatives and perfect specificity on same tokenizer traps. The Python command line toolkit runs on standard CPUs, supports pairwise comparisons and database scans, and is released publicly with an initial fingerprint dataset of 150 base models.