Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Gen Threat Report Highlights H1 Global Threat Landscape

The Gen Threat Report is a twice-a-year analysis of the largest cyber threats impacting the digital threat landscape, providing a detailed i...

All the recent news you need to know
Voice Phishing
Corporate Data Theft Cybersecurity Incident Data Breach Levi Strauss Cyberattack Social Engineering Attack UNC6671 Voice Phishing

Levi Strauss & Co. Confirms Hackers Stole Corporate Data in Cyberattack

Levi Strauss & Co. (Levi’s) has announced a cybersecurity incident involving an unauthorized third party who used social engineering to access the company's systems and exfiltrate corporate information from the systems of three employees. The clothing giant disclosed the incident in its filing with the U.S Securities and Exchange Commission (SEC). According to the SEC's investigation, certain corporate information was accessed and exfiltrated during the attack. 

Several employees were targeted by the attackers through social engineering, which gave them access to their systems without their consent. Levi Strauss has not disclosed the precise social engineering technique used by the threat actor, or whether the threat actor made any extortion demands, but this incident specifically affected three company-provided computers. Levi Strauss stated that its security teams responded quickly to contain and terminate the unauthorized access. 

According to Levi Strauss' preliminary investigation, it is not believed that customer information has been stolen. In addition, the company stated that the incident did not disrupt operations for the company. Levi Strauss stated in its SEC filing that, based on preliminary findings from the Company's investigation, it believes that some corporate information has been accessed and exfiltrated as a result of the incident. Levi Strauss expects the incident to have no material impact on the company's financial position or business based on its preliminary findings so far. Levi Strauss will provide additional notifications as additional information becomes available. 

The Levi Strauss & Co. (Levi’s) apparel company, one of the world's most recognizable companies, employs approximately 19,000 people and operates over 3,300 stores. The products are also available through third parties and online platforms. Levi Strauss has not identified the threat actor responsible for the intrusion or revealed whether the company received any extortion demands from the attacker. Unconfirmed reports suggest that the hacker may have been associated with UNC6671, a hacking group that has been associated with recent voice phishing attacks. 

According to Levi Strauss, the attribution has not been confirmed, and it remains unclear what tactics were employed in the attack. There is a general indication that the Levi Strauss incident occurred at the same time as a broader wave of voice phishing and social engineering attacks targeting major organizations. 

According to Google and other internet intelligence sources consulted by Reuters, ransom-seeking attackers were attempting to compromise victims through phone calls in recent weeks by targeting dozens of prominent financial institutions and other organizations in the United States. Levi Strauss was among more than 200 companies targeted with digital traps over the course of five weeks with the same intelligence. Levi Strauss has not confirmed the possible connection, and the attackers, the specific corporate information stolen, and the method of targeting employees are still under investigation. 

Despite the company's assertion that customer information was not compromised, the incident demonstrates the continuing threat posed by social engineering and phishing attacks. Organizations continue to be vulnerable when attackers can manipulate employees into providing access to corporate systems and information. 

In response to the attackers' attempt to gain access to the compromised computers, the company immediately responded and contained them. Levi Strauss has not reported any interruption to its business operations and does not believe the incident has, or is reasonably likely to have, a material impact on its financial or business position at this time. 

Despite the breach, Levi Strauss has not reported any operational impacts and continues to investigate the incident. Levi Strauss' incident illustrates the growing threat of voice-phishing and social engineering attacks against large corporations. Although the company has indicated that the customer data was not compromised, the ongoing investigation emphasizes the need for employee awareness, access controls, and rapid response to targeted cyberattacks to limit their impact.
Read more »
Fake Videos
AI misinformation China floods Cyber Fraud Disaster Rumors Fake Videos

China's New Challenge: Fake AI Videos During Natural Disasters

 

As China grapples with intensified storms and flooding over recent months, authorities face an unexpected secondary crisis: a surge of AI-generated fake videos flooding social media platforms. These manipulated clips, ranging from fabricated rescue operations to false claims of casualties, are causing real-world panic and complicating emergency response efforts. 

The misinformation wave includes highly realistic but entirely synthetic content. Videos have depicted bodies floating in floodwaters, crocodiles escaping into rivers, and collapsed infrastructure in areas untouched by disasters. Some creators edit overseas or historical footage, stripping watermarks and altering subtitles to present old events as current emergencies. Others use generative AI tools to produce convincing scenes of overflowing dams, emergency vehicles, and even fictional witness interviews.

This deluge has tangible consequences. In certain regions, false videos claiming imminent power outages triggered panic buying of emergency supplies. Misleading content about rescue operations has undermined public trust in official responses. The Chinese government has identified specific cases, such as a flood rescue video and footage of "released crocodiles," as examples of AI-generated material deliberately misrepresenting the situation to mislead the public. 

Government crackdown and enforcement 

In response, Chinese authorities launched a nationwide campaign on July 23 to remove illegal and harmful disaster-related online content. The Cyberspace Administration of China and the Ministry of Emergency Management issued a joint notice targeting misleading footage, recycled reports, fabricated data, fake official announcements, and AI-generated material. Police have arrested and penalized numerous individuals, with punishments ranging from detention to fines. Under the "Clean Net 2026" campaign, the Ministry of Public Security's Cybersecurity Bureau detailed 20 cases involving AI tools used to create fake videos, repackaged flood footage from other regions, and fabricated disaster claims to attract online traffic. 

One notable case involved a 45-year-old man from Chengde, Hebei province, who created an AI-generated video claiming heavy rain caused ground collapse in Kuancheng county, sending vehicles into water. Posted on WeChat to gain followers, the video triggered widespread online discussion, caused local panic, and disrupted flood prevention efforts. 

Experts attribute the problem to dramatic advances in generative artificial intelligence. Modern AI systems can now generate highly convincing disaster scenes, imitate news broadcasts, and produce realistic content with minimal technical skill. As Professor Chen Bing noted in an article for the Central Party School's Study Times, the barrier to creating rumors has significantly lowered: content generators need only capture hot topics and use AI tools to rapidly produce text, images, audio, and video, with even "one-sentence commands" yielding deceptive information that fuels mass rumor production. 

Social media platforms face pressure to strengthen content review mechanisms. Authorities urge the public to approach disaster-related information from unknown sources with skepticism and rely on official announcements. Police emphasize trusting accredited sources during emergencies, though identifying AI-generated content remains increasingly difficult. As Typhoon Maysak and other recent weather events continue to affect regions like Guangxi province—where at least four died and 62,000 were evacuated—the battle against misinformation has become as critical as the physical disaster response itself.
Read more »
PINs
ATMs Bank of Baroda CERT-In Dark Web Leak Data Breach Data Regulation NetBanking OTPs PINs

Bank of Baroda Data Breach: What We Know About the Alleged 1TB Dark Web Leak

 



Bank of Baroda has confirmed a cybersecurity incident involving a compromised employee email account after reports emerged that nearly 1TB of data allegedly linked to the state-owned lender had been published on the Dark Web.

The bank said the compromised account resulted in unauthorised access to certain data, but clarified that its core banking systems were not accessed and continue to remain secure. It said the incident was identified promptly, containment measures were implemented, and a comprehensive forensic investigation has been launched in coordination with relevant authorities.

The confirmation followed reports from the X account DailyDarkWeb and cybersecurity researcher Srikanth Lakshmanan, founder of CashlessConsumer, who flagged an alleged large-scale data dump connected to Bank of Baroda.

According to the claims, the dataset contains personal and corporate banking records, including savings and current account information, loan records, NetBanking users, NRI and corporate banking services, customer-support documents, and records linked to branches and ATMs. Reports from researchers also said the material included customer details, identification documents and internal audit records.

Samples and download links were reportedly shared alongside the threat actor's claim of possessing approximately 1TB of data.

However, the size of the alleged dataset has not been independently established by Bank of Baroda. Reuters reported that the Dark Web listing was advertised as a cache exceeding 700GB based on metadata analysis conducted by Lakshmanan. The number of customers whose information may have been exposed also remains unknown.

This distinction is important. The appearance of a large archive online does not, by itself, establish that every file originated from Bank of Baroda or that the entire advertised volume was successfully exfiltrated from the bank.


What allegedly appeared in the data dump?

The initial claims described a wide range of banking information. This reportedly included savings and current account records, loan-related documents, NetBanking information, NRI and corporate banking records, customer-support material, and branch and ATM data.

Other reports said samples contained highly sensitive information such as Aadhaar details, customer names, loan documents and other identity-related records. Some reports citing the claims placed the number of customer application forms potentially involved between 100,000 and 300,000. These figures remain allegations and have not been confirmed by Bank of Baroda.

Lakshmanan also shared screenshots that he said showed the root folder of the alleged data dump and reported that the download link was active. He described the incident as a "cyber disaster" and called for the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) to consider disconnecting the bank's systems while the extent of the compromise was investigated.

At the time of those warnings, the source and method of the alleged data theft were unclear.

Bank of Baroda's subsequent statement has now provided an important piece of that picture.


Employee email account was the confirmed entry point

According to the bank, the confirmed incident involved the compromise of an employee's email account. The account was then used to obtain unauthorised access to certain data.

Bank of Baroda has not disclosed how the email account was compromised, what specific files were accessed, or whether all of the data advertised on the Dark Web originated through that account.

The lender has, however, clearly stated that its core banking systems were not accessed and remain secure.

That distinction matters because compromising an employee's email account is not the same as compromising the systems that process customer transactions.

At the same time, an email account inside a large financial institution can provide access to highly sensitive material. Depending on the employee's role and permissions, an account may contain customer correspondence, loan documents, identity records, internal reports or links to shared resources.

The incident therefore demonstrates how an attacker may be able to obtain valuable financial information without directly breaching the core platform responsible for banking transactions.


Customer risk extends beyond stolen funds

There is currently no public evidence that the alleged incident allowed attackers to directly access customer balances or manipulate transactions. Bank of Baroda has specifically said that its core banking systems were not accessed.

The potential exposure of personal and financial records nevertheless creates a separate risk.

Information such as customer names, identity documents, account-related details and loan records could give criminals material for highly targeted phishing and impersonation attempts. A scammer with genuine information about a customer's banking relationship can make fraudulent calls, emails or messages appear far more credible.

Customers should therefore be particularly cautious of communications claiming to originate from Bank of Baroda and requesting OTPs, passwords, PINs, card information or remote access to devices.

The reported leak should not automatically be interpreted as evidence that customer funds have been compromised. The more immediate concern, if the exposed records are genuine, is the possibility of follow-on fraud using information that customers would normally expect their bank to protect.


Forensic investigation now underway

Bank of Baroda said it has initiated a comprehensive forensic investigation to establish the nature and extent of the incident. The bank also said it is working with relevant authorities in accordance with applicable regulatory requirements.

Several key questions remain unanswered.

Investigators will need to determine how the employee's email account was compromised, what information was accessible through it, how much data was actually accessed or exfiltrated, and whether the Dark Web archive corresponds to the confirmed incident.

The investigation will also need to establish how many customers, if any, were affected.

The incident has already generated financial implications for the lender. The Economic Times reported that Bank of Baroda notified a preliminary cyber-insurance claim under a programme with total coverage of approximately ₹750 crore, with National Insurance Company serving as the lead insurer. The notification is an intimation of loss while the forensic investigation continues and does not represent a confirmed ₹750 crore loss.

The financial consequences of a data breach can extend beyond direct theft. Forensic investigations, remediation, legal costs, regulatory responses, customer support and other incident-response expenses can all contribute to the eventual cost.


Regulatory questions remain

The incident also places renewed attention on cybersecurity controls within India's banking sector.

CERT-In's directions under Section 70B of the Information Technology Act establish requirements for information-security practices, incident response and cyber-incident reporting.

Bank of Baroda has said it is cooperating with relevant authorities, although the public details of its regulatory notifications have not been disclosed.

For now, the most important distinction is between what has been confirmed and what remains alleged.

Bank of Baroda has confirmed that an employee's email account was compromised and that the incident resulted in unauthorised access to certain data. It has also confirmed that its core banking systems were not accessed.

The claim that approximately 1TB of Bank of Baroda information was leaked, the precise contents of the Dark Web archive, and the number of customers potentially affected remain subject to investigation.

What began as an alarming Dark Web claim has therefore evolved into a confirmed security incident with an unresolved scope. The forensic investigation will determine whether the reported hundreds of gigabytes of banking information represent the full extent of the compromise, a smaller subset of genuine Bank of Baroda data, or a mixture of both.

Read more »
Malware attacks
Cyber Security cybersecurity vulnerability Discord Discord security incident Malicious actor Malware attacks

Meccha Chameleon Vulnerability Allowed Malware to Spread Through Steam Workshop Maps

 

A security vulnerability in the game Meccha Chameleon enabled malicious custom maps stored on Steam Workshop to infect users with malware. The vulnerability was patched by the game’s developers, who noted that the issue was related to the custom content feature. The issue was initially uncovered when some players reported that a command prompt window was flashing as Steam was downloading a custom workshop map. 

Security researcher Feint investigated the matter and found that one of the maps entitled Laser Tag Neon had the ability to deploy malware dropper despite having passed the Steam Workshop review process. Feint shared his findings on social media, noting that another map entitled Chroma Grid Arena had replaced the malicious content, which indicated that the threat was still present.

It appears that the vulnerability could enable threat actors to utilize the game’s custom workshop feature to deploy malware onto users’ computers disguised as legitimate content. Meccha Chameleon developer Haganeiro confirmed that the issue had been resolved in version 3.1.0. He noted that the malware had been disabled both prior to the update and following its deployment, thus limiting the potential impact of the vulnerability. 

The vulnerability was part of a larger security incident that involved the game’s Discord server, which housed 90 thousand members. The server was hacked, with the attacker rewriting its permissions and removing the developer team from the server. According to lemorion_1224, the Discord compromise occurred when the system administrator’s computer was infected with malware during the mitigation efforts of the vulnerability. The attacker was able to bypass the two-factor authentication of the server and modify its settings, banning several members of the development team. 

It was revealed that the compromised machine belonged to the backup server, and it was later wiped clean. The developer warned the community against clicking the suspicious links that were distributed via the hacked discord server while mitigation measures were being implemented. It appears that a wide range of potential attack surfaces could be utilized to threaten the community. Gaming platforms have a diverse range of threat surfaces that can be utilized by attackers to compromise users’ computers. 

In addition to the game binaries themselves, the custom content and third-party tools such as Discord can be threatened. Players should ensure they have the latest versions of the software and avoid interacting with suspicious links or content.
Read more »
Thomson Reuters
Credit Card data security ICE Privacy Thomson Reuters

ICE Can Now Buy Your Credit Card Information

Every time you apply for a credit card or update your account details, you may be sharing your data with ICE.

A research by 404 Media said that personal information stored by credit card firms can sail through a network of data brokers and can become accessible to US Immigration and Customs Enforcement (ICE). ICE can then search and investigate your personal data without any warrant. 

“No one signing up for a credit card thinks they’re giving data brokers a thumbs-up to sell their personal information to ICE. Not only is it an outrageous violation of our privacy, [but] it’s impossible for Americans to opt out,” Senator Ron Wyden said to 404 Media in a statement. 

What private information is compromised?

According to 404 media, when someone opens a credit card or updates their personal data, credit card firms share that data with credit bureaus. 

The personal information consists of Social Security numbers, addresses and email addresses, names, and phone numbers. Contrary to credit reports, this data does not have robust legal security. 

Personal information is then sent to credit bureaus, who give the data to Thompson Reuters. From there, the data is incorporated into CLEAR, the firm’s investigative data product. Thomson Reuters sells access to CLEAR to law enforcement authorities, including ICE.

After gaining access to CLEAR, ICE can search through personal information without a warrant. "404 Media has mapped out this supply of data by reviewing U.S. government procurement records and internal documents from companies providing the information." The platform is also combined with a tool that suggests ICE to decide which neighbourhoods to raid. 

"Anytime we update our home addresses on these accounts, credit bureaus get the updates within 24 hours and share it broadly with other data brokers, thanks to legal loopholes that leave our personal information open to misuse and abuse," Just Futures attorney Laura Rivera said to 404 Media.

Thomson Reuters providing personal data to US government

Another report enquired Thompson Reuter’s increasing role in providing personal data to the US Government.

The Department of Homeland Security (DHS) is planning to pay Thomson Reuters $125 million to give access to its databases as part of enquiries into suspected immigration fraud and voter fraud. The agreement will be worth $25 million annually for five years respectively.

Read more »
Webmail Security
AI Email Attacks Authentication Tokens CSS Attacks CSS Vulnerabilities email security Password Theft Vulnerabilities and Exploits Webmail Security

New CSS Attacks Expose Webmail Users to Passord and Token Theft


In new research, CSS-based attacks have been discovered that can bypass security protections in webmail services, allowing attackers to steal passwords, authentication tokens, and other sensitive data. In order to demonstrate the ability of malicious email content to interact with trusted elements within a webmail interface, these techniques demonstrate how their contents can escape their intended boundaries. 

Gareth Heyes, PortSwigger researcher, presented the study at Black Hat USA 2026. The research examined attack chains with Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. There has been no report of proof-of-concept attacks being used in the wild, however researchers have warned that vulnerabilities in the way webmail platforms handle HTML and CSS may pose serious security risks. 

In one of the most significant demonstrations, researchers were able to disguise a select element as a password field by combining HTML elements, CSS manipulation, and browser behavior. Through the use of this technique, a victim could enter a password into what appeared to be a genuine Microsoft login interface and be captured as a result. 

An underlying problem stems from the fact that webmail platforms allow untrusted HTML and CSS to be displayed within an otherwise trusted interface. It was discovered that attackers could either take advantage of CSS features already allowed by webmail services or exploit the gap between what the sanitizer approves and what the browser actually renders by exploiting the sanitizer. There are also instances in which applications can utilize JavaScript to create new DOM elements with CSS properties that weren't included in the original allowlist of the sanitizer, resulting in the malicious email content escaping its intended boundaries.

Researchers discovered that Yahoo Mail and AOL Mail were vulnerable to a different vulnerability involving pasted HTML Researchers showed how CSS remains active for a short period of time before sanitization allows the attacker to extract portions of an email login token. A 12-character token can then be reconstructed and used to access the victim's account. A CSS selector can be used to determine which digits appear in an email when Content Security Policy prevents an email from making conventional external requests. 

Using CSS selectors, an attacker can identify which digits appear in an email as well as how frequently they occur. By carefully positioning the links so that only the matching option is visible, the attacker-controlled server will receive the inferred information with only one click, without the need for JavaScript. During the Gmail attack, users were required to ask Cowork to process their affected emails, after which the malicious instructions embedded within the message influenced the way the AI system handled the account information. 

During the demonstration, prompt injection, along with email content, demonstrated how the legitimate access of an AI assistant can be turned into a path to expose sensitive tokens, particularly when the assistant has the ability to read messages and write email drafts. A similar attack against the Atlas browser of OpenAI was demonstrated with Fastmail.

In CSS techniques, malicious instructions are concealed from the user while being visible to the artificial intelligence system, demonstrating that differences in how web content is interpreted by human and machine are potentially dangerous, leading to new attack opportunities. Moreover, the researchers identified techniques for manipulating trusted interface actions, bypassing certain content restrictions, and revealing information, such as the time an email was viewed or the IP address of the recipient, in one Proton Mail demonstration. 

Researchers also demonstrated the potential for revealing the recipient's IP address using Proton Mail's tracker-protection mechanisms. As a result of Proton Mail's tracker-protection mechanism, email senders are not able to obtain the IP address of a user and the precise time of email open, the demonstrated bypass illustrates yet again the vulnerability of CSS and webmail rendering behavior to undermine privacy. 

Fastmail was reported to have fixed two CSS mutation vulnerabilities at the time of publication, while the Proton Mail proxy bypass demonstrated at the time was not observed during retesting. However, the Outlook label-jacking technique and Gmail's image-set() bypass remain effective as of August 6. Additionally, the research did not establish whether all aspects of the Outlook password capture chain had been resolved. 

According to the researchers, HTML email should be contained within sandboxed iframes, strict CSS allowlists should be applied, dangerous selectors and select menus should be blocked, custom attributes should be examined for CSS-based attack gadgets and attacker-controlled image requests should be prevented. As traditional content-sanitization defenses face increasingly sophisticated CSS-based attacks, webmail security is becoming increasingly complex. 

With the advent of artificial intelligence assistants having access to email inboxes and other connected services, providers should strengthen their isolation and rendering controls in order to prevent malicious email content from becoming an avenue for credential theft as well as data exposure.


Read more »
Subscribe to: Posts (Atom)

Featured