Blahalla

New XCSSET variant targets macOS devs via compromised Xcode projects

www.bleepingcomputer.com · 2 months ago

Unit 42 found XCSSET v40 targets macOS devs via compromised Git repos & Xcode scripts. It steals credentials/data using module infection chains, includes a Chrome hijacker, and deletes apps with a Telegram trojanizer.

Iran Cyberattacks Against Minnesota Water Systems

www.schneier.com · 2 months ago

A preliminary investigation suggests a cyber campaign targeted Minnesota's water systems across at least seven states. Analysts report that while attribution is pending, the incident points toward activity from Iran. Current information indicates that the attack resulted in no discernible real-world damage.

77 Open VSX extensions found harvesting developer info

www.bleepingcomputer.com · 2 months ago

Manifold Security discovered a campaign using 77 "evil twin" extensions on the Open VSX marketplace. These counterfeit packages impersonated legitimate developer tools to collect and transmit system information. The malicious extensions harvested detailed metadata, including hostnames, operating system usernames, and machine identifiers from developers' environments.

Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

www.darkreading.com · 2 months ago

Securonix found SmokeScreen uses ScreenConnect RMM for persistent remote access. Attackers use social engineering via lures like fake Zoom updates on Windows/macOS to gain initial entry. They evade detection by rotating payloads.

In Lawsuit, NJ Accuses Amazon of Suppressing Pay for Delivery Drivers

www.nytimes.com · 2 months ago

The state attorney general said in an antitrust lawsuit filed on Tuesday that the company was abusing its market power to keep its delivery costs low.

Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps

www.microsoft.com · 2 months ago

Microsoft expands its Zero Trust for AI strategy to enhance security for AI and DevSecOps environments with new tools and guidance.

Open Secure AI Alliance Expands at Black Hat: What You Should Know

www.techrepublic.com · 2 months ago

The Open Secure AI Alliance introduced SAFE guidelines and open agent-security tools at Black Hat, giving enterprises a framework for safer AI deployment.

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

www.microsoft.com · 2 months ago

Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread.

The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

hunt.io · 2 months ago

Forensics found groups used EtherRAT implants linking C2 domains to Ethereum smart contracts. Payloads utilized LOLBAS (certutil/msiexec) for MSI fetching, enabling remote arbitrary code execution via Node.js. Attackers added custom headers like X-Bot-Server.

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

thehackernews.com · 2 months ago

The Phishing-as-a-Service toolkit Greatness added device code phishing support, raising cyber threat levels. This capability abuses the legitimate OAuth 2.0 Device Authorization Grant for credential harvesting. Attackers execute these adversary-in-the-middle attacks to bypass Multi-Factor Authentication and seize user accounts.

Man’s Claim That Brakes Failed on Jaguar Was Scam to Avoid Car Payments, Court Rules

www.nytimes.com · 2 months ago

Nathan Owen called the police, saying he was trapped in a runaway car. A judge determined it was a lie and sentenced him to more than four years in prison.

Airlock Digital Unveils Agentic AI Control & Governance to Extend Preventative Endpoint Security

gbhackers.com · 2 months ago

Airlock Digital's new Agentic AI Control & Governance extends endpoint security to manage trusted AI agent behavior via application control. It offers command- and session-level visibility for centralized policy setting on autonomous agents.

Mallory Unifies Threat Intelligence, Exposure Context, and Response Into One Architecture for Security Teams

gbhackers.com · 2 months ago

Las Vegas, United States, August 4th, 2026, CyberNewswire As AI-assisted attackers compress exploitation timelines to hours, Mallory turns live adversary intelligence into prioritized, policy-governed action across the tools security teams already run Mallory, the AI-native Threat and Exposure Management platform, today introduced a unified context and intelligence layer for security teams.

Black Hat USA 2026 – Summary of Vendor Announcements (Part 2)

www.securityweek.com · 2 months ago

Many companies are showcasing their products and services this week at the 2026 edition of the Black Hat conference in Las Vegas.

Airlock Digital Unveils Agentic AI Control & Governance to Extend Preventative Endpoint Security

www.csoonline.com · 2 months ago

Airlock Digital revealed Agentic AI Control at Black Hat USA 2026. The solution enhances endpoint security by giving command- and session-level visibility into trusted AI agent behavior, managing autonomous software risks. It enforces strict policy compliance for AI agents.

Gmail’s New Feature Warns You Before Revealing You Were BCC’d

www.techrepublic.com · 2 months ago

Gmail now warns users who were Blind Carbon Copy recipients before they select Reply All. This feature displays a caution notice, preventing accidental exposure of the user's involvement and email address to all recipients. The alert helps protect privacy in professional settings where discreet communication might be necessary.

Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer

www.securityweek.com · 2 months ago

CASB/DLP fail securing AI as risks appear in prompts/responses, not files. New security needs interaction-aware layers to inspect semantic content exchanged between personnel and AI models.

Massive ChainDrop npm supply-chain attack infects hundreds of packages

www.bleepingcomputer.com · 2 months ago

Malware named ChainDrop compromised over 1,300 packages on the npm registry, impacting utilities like Keyv. The attack began after an actor took over developer GitHub accounts, publishing poisoned releases with valid provenance information. These packages execute a setup.mjs dropper that downloads Bun runtime and runs MathSymbol.js to steal credentials from development systems and CI/CD runners.

Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon's best-selling router

rotcee.github.io · 2 months ago

A researcher analyzed the Mercusys MB115-4G router and found a Pre-Auth Stack Buffer Overflow vulnerability. This flaw earned the designation CVE-2026-12495. The investigation also revealed technical details about the device’s serial interface (ttyS1), useful for subsequent hardware hacking efforts.

Oligo Raises $60 Million for Runtime Security

www.securityweek.com · 2 months ago

Oligo Security raised $60 million in a new funding round to advance its runtime security platform. The Tel Aviv company provides deep visibility and real-time protection covering application code, cloud workloads, and AI systems. This platform blocks exploit attempts and identifies vulnerabilities by monitoring execution at the core application layer.

Samsung Will Ban Smart TV Apps Containing Residential Proxy Software

www.techrepublic.com · 2 months ago

Samsung plans to ban Smart TV apps using residential proxies after Mnemonic found interception risks. Apps using SDKs like Bright Data turned TVs into proxy nodes, allowing unauthorized data routing via user homes and bypassing app reviews.

A SpaceX Rocket Will Soon Crash Into the Moon

www.nytimes.com · 2 months ago

The discarded upper stage of a SpaceX Falcon 9 rocket will collide with the Moon early Wednesday morning. The four-ton object hits the lunar surface near the dividing line at 5,400 miles per hour. This impact should generate enough heat to potentially create a flash of light and visible debris plume.

Chrome to Block Policy-Abusing Extensions on Personal Devices

www.techrepublic.com · 2 months ago

Google develops Chrome protections that block extensions from abusing enterprise policies on personal devices. Previously, attackers exploited management logic to force installations that hijacked a user’s New Tab page or default search settings. This feature detects policy abuse on consumer systems without hindering legitimate IT administration in corporate environments.

CISO Conversation: Russ Kirby – Passion Is the Antidote to Burnout

www.securityweek.com · 2 months ago

CISO Russ Kirby detailed his career path through major cybersecurity roles at Ping Identity, Hewlett Packard, Creditsafe, and ForgeRock. He credits his fascination with technology and a principled nature (Type One Enneagram) for driving his focus on enterprise security. Ultimately, Kirby advises that people must combine opportunity with conviction to create professional success or "luck."

Six Flowise Vulnerabilities Enable Remote Code Execution on AI Workflow Servers

gbhackers.com · 2 months ago

Six Flowise vulnerabilities allow unauthenticated RCE on self-hosted AI servers. Exploits target the CSVAgent node via pandas readpickle, bypassing validators for full server compromise and misuse JS custom functions for data exfiltration. Researchers disclosed these flaws.

Varonis Agent IBAC keeps AI agents within their intended boundaries

www.bleepingcomputer.com · 2 months ago

Varonis introduced Agent Intent-Based Access Control (IBAC) to secure AI agents connecting to enterprise data sources. IBAC compares an agent's instructions against its live actions, detecting dangerous behavior and intent drift in real time. The system can alert or block access immediately when an agent deviates from its intended boundaries.

Weaponized Email AI Assistants Could Help Attackers Hijack Accounts

www.securityweek.com · 2 months ago

Barracuda showed chatbots can weaponize compromised accounts. Attackers used AI for recon, then leveraged the chatbot to send phish emails with links, taking over sessions and bypassing MFA on high-privilege accounts.

DarkSword Server Combines iPhone Exploits With Fake Apple ID Login Page

gbhackers.com · 2 months ago

DarkSword, an iOS exploit chain from Google Threat Intelligence Group, uses one-click Safari exploitation and fake Apple ID pages. It targets millions of iPhone users for device compromise and credential theft across web properties. Researchers track it using SHA-256 body hashes to detect changing infrastructure.

Zenity Raises $125 Million in Series C Funding

www.securityweek.com · 2 months ago

Zenity raised $125 million in Series C funding to accelerate global expansion and product innovation. This AI security company helps organizations secure generative AI adoption by distinguishing legitimate work from compromised agent behavior. Its unified platform covers frameworks like ChatGPT Enterprise and Gemini, while Zenity Labs hunts for zero-click data exfiltration vulnerabilities.

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

thehackernews.com · 2 months ago

A credential-stealing npm worm first appeared in [email protected] and spread on August 4, 2026, into hundreds of packages across various organizations. The worm traversed Keyv and Cacheable namespaces before polluting numerous third-party libraries. SafeDep initially verified 353 poisoned versions across 79 package names, while subsequent monitoring identified at least 868 affected packages.

Fake Xeno Roblox Cheats Deliver Java RAT That Steals Discord and Gaming Accounts

gbhackers.com · 2 months ago

Researchers found attackers weaponizing fake Roblox cheat tools distributing a Java RAT. They target gamers on Discord/forums with malware disguised as Xeno executor cheats. The payload steals browser credentials, aiming to hijack Discord and Roblox accounts.

Why Apple’s Recent Crypto Lawsuit Should Worry Australian IT Leaders

www.techrepublic.com · 2 months ago

Three investors filed a lawsuit against Apple, alleging the App Store failed to block counterfeit crypto wallet apps. The plaintiffs lost an estimated $1.8 million in Bitcoin funds after using the fraudulent Sparrow Wallet listing. This case warns Australian firms that outsourcing software due diligence completely presents security risks.

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

thehackernews.com · 2 months ago

Cybersecurity researchers disclosed an active multi-wave campaign named SMOKESCREEN. This campaign uses social engineering lures themed around Adobe/Zoom updates, document reviews, and system maintenance utilities. Attackers stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect during these waves.

AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls

www.darkreading.com · 2 months ago

Security researcher BobDaHacker exposed a Google Firebase misconfiguration in the AI meeting tool tl;dv. The flaw allows any user to query the "meetings" collection, accessing sensitive data from other users' live calls. Fixing this critical vulnerability requires implementing proper Firestore security rules to ensure tenant isolation for all users.

OpenAI Shuts Down ChatGPT Accounts Powering a Cambodia-Based Scam Factory

gbhackers.com · 2 months ago

OpenAI shut down a coordinated ChatGPT account network operating from Cambodia, which powered fraud and trafficking-linked operations. The scam factory used AI to create fake identities for dating profiles and investment schemes, optimizing outreach via WhatsApp and Telegram. OpenAI shared indicators with industry partners, complicating the attackers' ability to reconstitute their services.

Shai-Hulud Supply Chain Attack Compromises Keyv and Hundreds of npm Packages

gbhackers.com · 2 months ago

Shai-Hulud exploited a Keyv maintainer's GitHub account via npm packages (Keyv, cacheable). Malware used preinstall hooks to download/execute droppers stealing dev creds like npm tokens, AWS keys, and Vault secrets.

Almost Half of Malware Samples Communicate Direct to IP

unit42.paloaltonetworks.com · 2 months ago

Half of C2 malware bypasses DNS via direct IP connections, evading security. This threat impacts victim counts across various infections. Researchers recommend Zero Trust IP (ZT-IP) to stop attacks like those from Phorpiex ransomware. Use ZT-IP for robust network defense.

OWASP Introduces Subtractive Security Top 10 to Eliminate Attack Paths and Reduce Cyber Risk

gbhackers.com · 2 months ago

OWASP Subtractive Security Top 10 shifts focus from layered detection to eliminating architectural attack paths by removing exposures/privileges on AWS, Windows, Linux, and AD. The open-source guide offers hardening advice.

Microsoft Project Perception Enters Public Preview: What Security Teams Should Know

www.techrepublic.com · 2 months ago

Microsoft's Project Perception uses AI agents (Red, Blue, Green teams) for security ops: spotting compromises, analyzing activity, and taking action. It manages enterprise risk but requires strict oversight due to required human control.

CISA Adds Exploited N-able N-central Flaw Enabling Remote Admin Takeover to KEV

gbhackers.com · 2 months ago

CISA added CVE-2026-18577, an actively exploited authentication bypass vulnerability in N-able N-central, to its KEV Catalog. This flaw permits unauthenticated attackers to gain remote administrative access by bypassing standard authentication controls. The security gap arose from patches related to CVE-2026-18556, requiring users to upgrade immediately to version 2026.3.1.7.

Critical Azure Cosmos DB flaw threatened cross-tenant database takeover

www.csoonline.com · 2 months ago

Wiz researchers discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB’s Gremlin query sandbox. The flaw allows attackers to escape the sandbox and execute arbitrary code on shared infrastructure. This compromise provides cross-tenant access that could threaten data stores used by Microsoft Entra ID, Teams, and Copilot.

The top new cybersecurity products at Black Hat USA 2026

www.csoonline.com · 2 months ago

Black Hat 2026 showed AI in autonomous security workflows. ArmorCode's Anya AI agents allow remediation/attack path analysis using real business risk. Cribl launched an AI Observability app, and CommVault integrated Google Threat Intelligence for backup validation. Vendors are deploying advanced AI tools across defense systems.

The top cybersecurity product announcements from Black Hat 2026

www.csoonline.com · 2 months ago

Black Hat 2026: AI security shifts to workflow ops. ArmorCode's Anya agents prioritize attack paths for remediation. Cribl added AI Observability for model tracking. CommVault integrates Google Threat Intelligence for validating recovery points. These tools enhance automated defense capabilities.

Obsidian Security Raises $85 Million at $1.1 Billion Valuation

www.securityweek.com · 2 months ago

Obsidian Security developed a platform that governs AI agents accessing third-party applications like Salesforce and Microsoft Copilot Studio. The system monitors agent activity across enterprise tools, including CRMs and data warehouses. Using a runtime governance layer aligned with OWASP criteria, it identifies and stops privilege escalation or policy violations before they occur.

TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover

www.securityweek.com · 2 months ago

Forescout found 15 flaws in TP-Link Omada's provisioning. Chaining with CVE-2025-7850 and CVE-2025-7851 allows root command execution across networks via key weaknesses, MITM, and race conditions.

Russian Access Broker Sells Network Access to Ransomware Gangs While Spying on Ukraine

gbhackers.com · 2 months ago

Russian broker sells fuel for ransomware/espionage against Ukraine by exploiting edge apps (Fortinet, F5, Citrix) using multiple CVEs. They then achieve AD dominance via NTLM lateral movement and krbtgt compromise.

Google ADK flaws reveal what happens when AI agents trust the wrong message

www.csoonline.com · 2 months ago

Pillar Security found critical flaws in Google Agent Dev Kit for Python. Attackers can trigger privileged automation via malicious PR instructions or prompt injection to steal tokens. CVE numbers are not specified, but the flaws affect public AI agents, potentially impacting many users. Researchers demonstrated two attack vectors; attackers can manipulate reviews or expose credentials.

When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted

thehackernews.com · 2 months ago

The cybersecurity industry previously assumed attacker capability scaled directly with technical expertise. Security teams historically measured risk by ranking attacker sophistication, ranging from nation-state actors to script kiddies. This long-held assumption about the threat landscape is now beginning to break.

China Is Training Military AI With Knowledge Extracted From American Models

gbhackers.com · 2 months ago

Chinese entities used model distillation, via research from CAS and PLA, to extract "chain-of-thought" reasoning from US AI systems. Adversarial techniques mask this knowledge transfer. Concerns rose after Moonshot AI's Kimi K3 matched major US models.

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

thehackernews.com · 2 months ago

Pillar Security found an ADK vulnerability in Google's Agent Development Kit. Prompt injection allowed manipulation of a triage agent using public GitHub issues to trigger privileged code fixing via posts like /adk-issue-fix as adk-bot. Google deleted three vulnerable AI workflows afterward.