Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Latest News

CastleLoader Widens Its Reach as GrayBravo’s MaaS Infrastructure Fuels Multiple Threat Clusters

  Researchers have now identified four distinct threat activity clusters associated with the malware loader CastleLoader, bolstering previou...

All the recent news you need to know

OpenAI Vendor Breach Exposes API User Data

 

OpenAI revealed a security incident in late- November 2025 that allowed hackers to access data about users via its third-party analytics provider, Mixpanel. The breach, which took place on November 9, 2025, exposed a small amount of personally identifiable information for some OpenAI API users, although OpenAI stressed that its own systems had not been the target of the attack.

Breach details 

The breach occurred completely within Mixpanel’s own infrastructure, when an attacker was able to gain access and exfiltrate a dataset containing customer data. Mixpanel became aware of the compromise on 9 November 2025, and following an investigation, shared the breached dataset with OpenAI on 25 November, allowing the technology firm to understand the extent of potential exposure. 

The breach specifically affected users who accessed OpenAI's API via platform.openai.com, rather than regular ChatGPT users. The compromised data included several categories of user information collected through Mixpanel's analytics platform. Names provided to accounts on platform.openai.com were exposed, along with email addresses linked to API accounts. 

Additionally, coarse approximate location data determined by IP addresses, operating system and browser types, referring websites, and organization and user IDs saved in API accounts were part of the breach. However, OpenAI confirmed that more sensitive information remained secure, including chat content, API requests, API usage data, passwords, credentials, API keys, payment details, and government IDs. 

Following the incident, OpenAI took immediate action by removing Mixpanel from its services while conducting its investigation. The company notified affected users on November 26, 2025, right before Thanksgiving, providing details about the breach and emphasizing that it was not a compromise of OpenAI's own systems. OpenAI has suspended its integration with Mixpanel pending a thorough investigation of the incident.

Recommended measures 

OpenAI also encouraged the affected users to stay on guard for potential second wave attacks using the stolen information. Users need to be especially vigilant for phishing and social engineer attacks that could be facilitated by the leaked information, such as names, e-mail addresses and company information. A class action has also been brought against OpenAI and Mixpanel, claiming the companies did nothing to stop the breach of data that revealed personally identifiable information for thousands of users.

Researchers Find Massive Increase in Hypervisor Ransomware Incidents


Rise in hypervisor ransomware incidents 

Cybersecurity experts from Huntress have noticed a sharp rise in ransomware incidents on hypervisors and have asked users to be safe and have proper back-up. 

The Huntress case data has disclosed a surprising increase in hypervisor ransomware. It was involved in malicious encryption and rose from a mere three percent in the first half to a staggering 25 percent in 2025. 

Akira gang responsible 

Experts think that the Akira ransomware gang is the primary threat actor behind this, other players are also going after hypervisors to escape endpoint and network security controls. According to Huntress threat hunters, players are going after hypervisors as they are not secure and hacking them can allow hackers to trigger virtual machines and manage networks.

Why hypervisors?

“This shift underscores a growing and uncomfortable trend: Attackers are targeting the infrastructure that controls all hosts, and with access to the hypervisor, adversaries dramatically amplify the impact of their intrusion," experts said. The attack tactic follows classic playbook. Researchers have "seen it with attacks on VPN appliances: Threat actors realize that the host operating system is often proprietary or restricted, meaning defenders cannot install critical security controls like EDR [Endpoint Detection and Response]. This creates a significant blind spot.”

Other instances 

The experts have also found various cases where ransomware actors install ransomware payloads directly via hypervisors, escaping endpoint security. In a few cases, threat actors used built-in-tools like OpenSSL to run encryption of the virtual machine volume without having to upload custom ransomware binaries.

Attack tactic 

Huntress researchers have also found attackers disrupting a network to steal login credentials and then attack hypervisors.

“We’ve seen misuse of Hyper-V management utilities to modify VM settings and undermine security features,” they add. “This includes disabling endpoint defenses, tampering with virtual switches, and preparing VMs for ransomware deployment at scale," they said.

Mitigation strategies 

Due to the high level of attacks on hypervisors, experts have suggested admins to revisit infosec basics such as multi-factor authentication and password patch updates. Admins should also adopt hypervisor-specific safety measures like only allow-listed binaries can run on a host.

For decades, the Infosec community has known hypervisors to be an easy target. In a worst-case scenario of a successful VM evasion where an attack on a guest virtual machine allows hijacking of the host and its hypervisor, things can go further south. If this were to happen, the impact could be massive as the entire hyperscale clouds depend on hypervisors to isolate tenants' virtual systems.

Europol’s OTF GRIMM Arrests Nearly 200 in Crackdown on “Violence-as-a-Service” Crime Networks

 

Nearly 200 people — including several minors linked to murder attempts — have been taken into custody over the past six months under Europol’s Operational Taskforce (OTF) GRIMM. The initiative focuses on dismantling what authorities describe as “violence-as-a-service” networks, where criminal groups lure young people online to execute contract killings and other violent attacks.

According to Europol, "These individuals are groomed or coerced into committing a range of violent crimes, from acts of intimidation and torture to murder," the agency said on Monday.

Launched in April, OTF GRIMM brings together specialists from Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden, the UK, and Europol, alongside several online platforms.

In its first half-year, the taskforce reported arresting 63 suspects accused of planning or committing violent offenses, 40 individuals believed to be “enablers” of violence-for-hire operations, 84 recruiters, and six alleged “instigators.” Five of these instigators have been identified by investigators as “high-value targets.” Among those apprehended were three individuals in Sweden and Germany suspected of fatally shooting three victims on March 28 in Oosterhout, the Netherlands.

Authorities also detained two more suspects, aged 26 and 27, in the Netherlands in October for allegedly attempting a murder in Tamm, Germany, on May 12.

On July 1, Spanish police arrested six people — one of them a minor — who were allegedly plotting a murder. Firearms and ammunition were recovered, and investigators believe the operation prevented a “potential tragedy.”

In Denmark, seven individuals aged between 14 and 26 were either arrested or voluntarily surrendered in June. They are accused of using encrypted messaging platforms to recruit teenagers for contract killings.

These cases arise amid what cybersecurity experts describe as a significant rise in Europe-based cybercrime operations that spill into real-world violence. One of the most notable examples occurred in January, when Ledger co-founder David Balland and his wife, Amandine, were kidnapped in Vierzon, France. During the ordeal, their captors severed Balland’s finger while demanding ransom from another Ledger co-founder; the details of the ransom request have not been publicly disclosed.

Many suspects involved in violence-for-hire schemes have been linked to The Com — an informal group of English-speaking hackers, SIM swappers, and extortionists operating across several overlapping criminal networks. The organization’s influence has expanded internationally, prompting the FBI to issue a recent warning.

According to the bureau, a faction known as In Real Life (IRL) Com poses an increasing danger to young people in the U.S. The FBI’s alert highlighted IRL Com groups offering swatting services — incidents in which criminals file fake reports of shootings or bomb threats to provoke armed police responses at victims’ homes.

Crimes Extorting Ransoms by Manipulating Online Photos

 


It is estimated that there are more than 1,000 sophisticated virtual kidnapping scams being perpetrated right now, prompting fresh warnings from the FBI, as criminals are increasingly using facial recognition software to create photos, videos, and sound files designed to fool victims into believing that their loved ones are in immediate danger. 

As a result of increasing difficulty in distinguishing authentic content from digital manipulation, fraudsters are now blending stolen images with hyper-realistic artificial intelligence tools to fabricate convincing evidence of abductions, exploiting the growing difficulty of distinguishing authentic content from digital manipulation in the current era.

It is quite common for victims to be notified via text message that a family member had been kidnapped and that escalating threats demand that an immediate ransom be paid. 

A scammer often delivers what appears to be genuine images of the supposed victim when the victim requests proof, often sent through disappearing messages so that the fake identity cannot be inspected. This evolving approach, according to the FBI, represents a troubling escalation of extortion campaigns, one that takes advantage of panic as well as the blurred line between real and fake identity as it relates to digital identities. 

The FBI has released a public service announcement stating that criminals are increasingly manipulating photos from social media to manufacture convincing "proof-of-life" materials for use in virtual kidnapping schemes based on photos taken from social media and other open sources. As a rule, offenders contact victims by text, claim to have abducted their loved ones, and request an immediate payment while simultaneously using threats of violence as a way to heighten fear. 

It has been reported that scammers often alter photos or generate videos using Artificial Intelligence that appear authentic at first glance, but when compared to verified images of the supposed victim, inconsistencies are revealed—such as missing tattoos, incorrect scars, or distorted facial or body proportions—and thus make the images appear authentic. 

Often, counterfeit materials are sent out through disappearing message features so that careful analysis is limited. As part of the PSA, malicious actors often exploit emotionally charged situations, such as public searches for missing persons, by posing as credible witnesses or supplying fabricated information. Several tips from the FBI have been offered by the FBI to help individuals reduce vulnerability in the event of a cyber incident. 

The FBI advises people to be cautious when posting personal images online, avoid giving sensitive information to strangers, and develop a private verification method - like a family code word - for communication during times of crisis. When faced with ransom demands, the agency advises anyone targeted to do so to remain calm, take a photo or a message of the purported victim, and attempt to contact the purported victim directly before responding to the demand. 

As a result of recent incidents shared by investigators and cybersecurity analysts, it has become increasingly apparent just how convincing it is for criminals to exploit both human emotions and new technological advances to create schemes that blur the line between reality and fiction. 

A Florida woman was defrauded of $15,000 after receiving a phone call from scammers in which the voice of her daughter was cloned by artificial intelligence and asked for help. There was a separate case where parents almost became victims of the same scheme, when they were approached by criminals who impersonated their son and claimed that he was involved in a car accident and needed immediate assistance in order to recover from that situation. 

However, the similarities and differences between these situations reflect a wider pattern: fraud operations are becoming increasingly sophisticated, impersonating the sounds, appearances, and behaviors of loved ones with alarming accuracy, causing families to make hasty decisions under the pressure of fear and confusion, which pushes the victim into making hasty decisions. Experts have stressed that vigilance must go beyond just basic precautions as these tactics evolve. 

There is a recommendation to limit the amount of personal information you share on social media, especially travel plans, identifying information or real-time location updates, and to review your privacy settings to restrict access to trusted contacts. 

In addition, families should be encouraged to establish a private verification word or phrase that will help them verify their identity when in an emergency, and to try to reach out to the alleged victim through a separate device before taking any action at all. There are many ways in which people can minimize our exposure to cybercriminals, including maintaining strong, unique passwords, using reputable password managers, and securing all our devices with reliable security software. 

The authorities emphasize that it is imperative that peopl resist the urgency created by these scams; slowing down, verifying claims, documenting communications and involving law enforcement are crucial steps in preventing financial and emotional harm caused by these scams. 

According to the investigators, even though public awareness of digital threats is on the rise, meaningful security depends on converting that awareness into deliberate, consistent precautions. Despite the fact that it has yet to be widely spread, the investigation notes that the scheme has been around for several years and early reports surfacing in outlets such as The Guardian much before the latest warnings were issued.

Despite the rapid advancement of generative AI tools, experts say that what has changed is that these tactics have become much easier to implement and more convincing, prompting the FBI to re-issue a new alert. As the FBI points out, the fabricated images and videos used in these schemes are rarely flawless, and when one carefully examines them, one can often find evidence that they are manipulated, such as missing tattoos, altered scars, and subtle distortions in the proportions of the body.

A scammer who is aware of these vulnerabilities will often send the material using timed or disappearing message features, so that a victim cannot carefully examine the content before it disappears, making it very difficult for him or her to avoid being duped. 

In this PSA, it is stressed that it is crucial to maintain good digital hygiene to prevent such scams from occurring: limiting personal imagery shared online, being cautious when giving out personal information while traveling, and establishing a private family code word for verifying the identity of a loved one in an emergency. Before considering any financial response, the FBI advises potential targets to take a moment to attempt to speak directly to the supposedly endangered family member. 

In an era when these threats are being constantly tracked by law enforcement and cybersecurity experts, they are cautioning that the responsibility for prevention has increasingly fallen on the public and their proactive habits. 

By strengthening digital literacy—such as learning how to recognize subtle signs of synthetic media, identifying messages that are intended to provoke fear, and maintaining regular communication routines within the family people can provide powerful layers of protection against cybercrime. Moreover, online experts recommend that people diversify their online presence by not using the same profile photograph on every platform they use and by reviewing their social media archives for any old posts that may inadvertently expose personal patterns or personal relationships.

There are many ways in which communities can contribute to cybersafety, including sharing verified information, reporting suspicious events quickly, and encouraging open discussion about online safety among children, parents, and elderly relatives who are often targeted as a result of their trust in technology or lack of familiarity with it. 

Despite the troubling news of the FBI's warning regarding digital extortion, it also suggests that a clear path to reducing the impact and reach of these emotionally exploitative schemes can be found if people remain vigilant, behave thoughtfully online, and keep ourselves aware of our surroundings.

Initial Access Brokers Now Central to Cyberattacks: Report

 

The market for initial access brokers has expanded rapidly over the past two years, creating a system that allows advanced threat actors to outsource the early stages of an intrusion, according to new research from Check Point. The report says this growth has made it easier for both nation-state groups and criminal actors to breach a larger number of targets. 

Check Point notes that the rise of the IAB economy coincides with the growing use of cyberspace by governments as a tool for projecting power. The firm is urging policymakers and businesses to strengthen identity security, secure software supply chains and improve the resilience of operational technology systems. 

“Once considered peripheral players, IABs have become a critical node in the cyber-criminal supply chain, lowering barriers to entry for sophisticated operations and enabling rapid campaign scaling,” Check Point said. 

By paying IABs to handle initial access at scale, threat actors can move faster and avoid the risks associated with the early stages of an attack. According to the report, “state-backed groups and sophisticated criminal actors can reduce operational risk, accelerate execution timelines, and scale their campaigns across dozens of targets simultaneously.” 

This growing reliance on brokers also complicates attribution. When an IAB is involved, IT teams and investigators often struggle to determine whether an attack was carried out by a government-backed group or by a criminal operation. 

For this reason, Check Point says that “IAB activity is no longer a peripheral criminal phenomenon but a force multiplier in the broader offensive ecosystem, one that directly supports espionage, coercive operations, and potential disruption of U.S. government and critical infrastructure networks.” 

The report also highlights a sharp rise in IAB activity targeting essential sectors. Healthcare saw nearly 600 percent more IAB-related attacks in 2024 compared with 2023. Government, education and transportation networks were also significantly affected. 

Check Point says these increases reflect both higher demand from adversaries for access to sensitive environments and the growing professionalisation of the IAB marketplace, where access to critical systems is treated as a commodity. 

The research links this broader trend to rising geopolitical tensions and the changing role of nation-state hacking. “Cyber operations have evolved from opportunistic disruptions and intelligence-gathering into deliberate, coordinated campaigns designed to achieve political, economic, and strategic outcomes,” the report says. 

According to Check Point, the line between geopolitics and cyber activity has largely disappeared. State-aligned groups are using digital operations to shape crises, signal intent and impose costs on rivals, often below the threshold of open conflict. 

The firm notes that spikes in geopolitical risk are closely followed by spikes in targeted cyberattacks against U.S. government systems. “Cybersecurity is no longer just a technical issue; it is a strategic imperative,” Check Point said. The report argues that resilience, deterrence and rapid recovery must now be treated as national security priorities on the same level as traditional defence planning.

New SVG-Based Clickjacking Technique Exposes Cross-Origin Data Through CSS Filters

 

Security researcher Lyra Rebane has developed a new type of clickjacking attack that cleverly exploits Scalable Vector Graphics (SVG) and Cascading Style Sheets (CSS) to bypass traditional web protections.

Rebane first showcased this discovery during BSides Tallinn in October and has since released a technical breakdown of the method. The attack takes advantage of a little-known behavior where SVG filters can inadvertently expose cross-origin information—directly undermining the web’s same-origin policy.

Clickjacking, also known as a user interface redress attack, involves deceiving users into performing unintended actions by visually manipulating interface elements. The concept, introduced in 2008 by security researchers Jeremiah Grossman and Robert Hansen, was originally described as a technique for redirecting mouse clicks to malicious targets such as hidden buttons or form inputs.

Over the years, browsers have implemented numerous defenses to prevent such attacks. OWASP highlights common safeguards such as blocking page rendering within frames via X-Frame-Options or CSP frame-ancestors, limiting cookie access inside frames, and using JavaScript frame-busting scripts. Even with these protections, new variants continue to appear—most recently, last year’s cross-window forgery technique.

Rebane’s discovery began while she was experimenting with recreating Apple’s Liquid Glass distortion effect using SVG filters and CSS. Once she successfully replicated the effect, she noticed that when embedded inside an iframe, her SVG/CSS implementation could detect pixel data from the page beneath it—effectively accessing information from another origin.

She told The Register that previous attempts using SVG for cross-origin attacks exist, citing Paul Stone’s “Perfect Pixel Timing Attacks With HTML” and Ron Masas’s “The Human Side Channel”. But, as Rebane stated, "I don't think anyone else has run logic on cross-origin data the way I have."

Her write-up details how she used SVG filters to construct logic gates capable of processing webpage pixels using arbitrary computation—enabling a clickjacking method that would be extremely difficult to achieve with other tools.

According to Rebane, "By using feBlend and feComposite, we can recreate all logic gates and make SVG filters functionally complete. This means that we can program anything we want, as long as it is not timing-based and doesn't take up too many resources."

To demonstrate the risks, Rebane created a proof-of-concept that extracts text from Google Docs. Her attack overlays a “Generate Document” button on a popup. When clicked, the underlying script identifies the popup and shows a CAPTCHA-style textbox. Once submitted, the attacker-controlled interface secretly feeds a suggested Google Docs file name into a hidden textbox. While typical framing restrictions would prevent this, Google Docs allows itself to be embedded, making the attack viable.

Rebane noted that this is common among services intended for embedding—such as YouTube videos, social widgets, maps, payment systems, comment modules, and advertisements. Some services also unintentionally permit framing by failing to include protective headers, which is frequently seen in API endpoints.

Beyond iframe scenarios, Rebane explained that the technique can also be adapted for sites vulnerable to HTML injection.

She said, "There's a vulnerability class known as XSS which involves injecting HTML on websites through various means to execute malicious JavaScript." With CSP now blocking many forms of unsafe JavaScript, attackers look for alternatives. In such cases, "CSS is the next best thing to use, and it can be used for many kinds of interesting attacks," she added, arguing that CSS itself behaves like a programming language. "SVG clickjacking is one of the many attacks that could be used there."

Although the method does not fundamentally overhaul existing web security principles, it significantly lowers the complexity required to execute advanced attack chains.

Google awarded Rebane a $3,133.70 bug bounty for reporting the flaw. She noted that the issue remains unresolved and may not even be classified as a browser bug, adding that Firefox and other browsers are affected as well.

Rebane also pointed out potential mitigations—highlighting the Intersection Observer v2 API, which can detect when an SVG filter is positioned above an iframe.

Google has yet to comment on the matter. A related Chromium bug originating from earlier timing attacks has been closed with a “won’t fix” status.

Featured