Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

WhatsApp Fixed Two Security Bugs via It's Bug Bounty Program

Meta recently released a security advisory in May revealing two bugs in WhatsApp were found through its bug bounty program. But these bugs w...

All the recent news you need to know
NSW Police cryptocurrency raid
Australia Bitcoin seizure Bitcoin money Cyber Attacks darknet marketplace crackdown NSW Police cryptocurrency raid

Australia Seizes $4.2 Million in Bitcoin in Major Darknet Crackdown

 

Authorities in the Australian state of New South Wales (NSW) have confiscated 52.3 Bitcoin, valued at more than $4.2 million, following search warrants carried out in Ingleburn on May 4. The seizure is being described as one of the country’s most significant cryptocurrency confiscations to date.

The operation was part of Strike Force Andalusia, an investigation launched in September 2024 after the NSW Police Cybercrime Squad identified a cryptocurrency wallet allegedly linked to proceeds generated through darknet marketplace activities.

As part of the wider probe, investigators had previously searched a residence in Surfside, where they recovered electronic devices and approximately 7.2 grams of cocaine. A forensic review of the seized devices later revealed further cryptocurrency assets connected to the investigation.

Police allege that a 39-year-old man from Ingleburn refused to provide investigators with access to his digital devices at the time of his arrest. He now faces additional charges alongside allegations related to money laundering and drug supply.

Detective Superintendent Matt Craft, commander of the NSW State Crime Command’s Cybercrime Squad, said the case highlights the growing capabilities of law enforcement agencies in tracking illegal cryptocurrency activity.

"Criminals operating on the darknet often believe they are beyond the reach of law enforcement, but this investigation shows that is simply not the case," Craft said. "Darknet marketplaces remain a key enabler of serious criminal activity, and our detectives are actively targeting those who use them to trade illicit goods or launder money."

Australian authorities have stepped up efforts to tackle cryptocurrency-related crimes as digital assets increasingly feature in organized criminal operations. The latest seizure reflects the expanding expertise of both NSW cybercrime investigators and the Australian Federal Police in tracing blockchain transactions and recovering illicit funds.

Recent investigations across Australia have also demonstrated that cryptocurrency transactions on darknet platforms are far less anonymous than many offenders assume, with several cases leading to multimillion-dollar digital asset seizures
Read more »
Technology
Bitcoin Security Blockchain Security Cryptographic Risk Digital Asset Security ECDSA Vulnerability Post Quantum Cryptography Quantum Computing Quantum Threat Technology

Quantum Technology Emerges as a Potential Threat to Bitcoin Networks


 

Bitcoin's security architecture has been based on a foundational assumption that modern cryptographic protections will remain computationally impractical to violate at scale for more than a decade. 

Now, with quantum computing transitioning from theoretical research into an emerging engineering reality capable of challenging the mathematical foundations behind digital signatures and blockchain authentication, this assumption is coming under renewed scrutiny. 

With the development of quantum technologies, security researchers and blockchain developers are increasingly evaluating the potential exposure of private keys, compromise of wallet integrity, and weakening of transaction trust in decentralised ecosystems as quantum capabilities continue to mature. 

While the discussion extends beyond the quantum threat itself, it emphasises the enduring importance of private key protection and the operational limitations of hardware wallets, where computational efficiency, power constraints, and algorithm compatibility are critical factors determining the viability of next-generation cryptographic defences. It is against this backdrop that a proposal from Avihu Levy has been widely discussed in regard to Bitcoin's post-quantum transition strategy. 

Quantum Safe Bitcoin (QSB) is a transaction model proposed by Levy that is designed to preserve cryptographic security even in the presence of an advanced quantum system capable of executing Shor's algorithm against conventional public-key cryptography. There is particular interest in the proposal within the Bitcoin ecosystem because it does not require consensus-level changes to the Bitcoin protocol itself, thus avoiding the difficult and political process typically associated with network upgrades.

Due to its ability to layer quantum-resistant protections onto existing infrastructure rather than replacing the protocol foundation entirely, the architecture has been widely regarded as an elegant piece of engineering. The emergence of this technology coincides with a general acceleration in industry readiness for post-quantum risks, as governments, semiconductor firms, and major cloud providers intensify migration planning around potential cryptographic risks in the near future. 

While QSB has gained significant popularity, security researchers note that the proposal addresses a much narrower segment of the quantum problem than public discussion sometimes implies. In light of the broader operational challenges associated with exposing private keys, implementing wallets, and ensuring long-term cryptographic survival across decentralised networks, this proposal offers a broad perspective on the quantum problem. 

Quantum computing is of concern to a larger audience because it could undermine public-key cryptography, which encrypts blockchain ecosystems with public keys, particularly signature schemes like ECDSA, which is used across Bitcoin and Ethereum networks. Using publicly exposed wallet data, an advanced quantum system could theoretically be able to derive private keys, enabling forged transactions and unauthorised transfers of funds. 

While researchers generally agree that quantum hardware is not yet capable of executing such attacks at scale, the debate has intensified due to the inherent slowness and operational sensitivity of blockchain migrations across decentralised communities, and the difficulty in coordinating across them. Bitcoin is often viewed as particularly vulnerable in this context due to its conservative governance structure and historically cautious approach towards protocol-level changes. 

There is current evidence that approximately 6.5 to 6.9 million bitcoins are at risk of quantum exposure due to their public keys being visible on the blockchain, which represents approximately one-third of the total circulating supply of bitcoins. This includes older pay-to-public-key (P2PK) addresses that were widely used during Bitcoin's early years, and are believed to be linked to Satoshi Nakamoto's dormant wallets. 

Blockchain records directly contain the public key of legacy address formats, allowing for the reconstruction of the private key by a future quantum computer using Shor's algorithm, thereby obtaining the funds. As a result of the newer pay-to-public-key-hash (P2PKH) structures, public keys are concealed behind cryptographic hashes until a transaction is initiated, reducing the exposure of public keys. 

Once funds are spent from a P2PKH wallet, the public key becomes permanently visible on the blockchain, creating a long-term attack surface if the address is reused in the future. Researchers are also warning against utilising "harvest now, decrypt later" strategies, which involve adversaries collecting encrypted blockchains and transaction data in advance of quantum capabilities. 

The implementation of cryptographic upgrades more rapidly may be possible on proof-of-stake networks such as Ethereum, although experts caution that if defensive migration timelines fail to keep pace with computational advances, validator infrastructure and signature keys could eventually face quantum-era risk. After Google researchers released updated projections in March that indicated that it could take nearly twenty times fewer physical qubits to compromise Bitcoin's elliptic curve cryptography than estimates prepared a year earlier, concerns regarding the timeline of quantum risk intensified further. 

Despite the fact that practical quantum attacks against Bitcoin are currently outside of operational capability, the revised calculations confirm an industry understanding that the threat is gradually moving from theoretical modelling to engineering inevitability in the long term. As a result, Bitcoin is challenged by an inseparability between the technical challenge and governance. 

A consensus has not been reached on how vulnerable dormant wallets should be handled if quantum-capable systems eventually emerge. The failure to freeze or invalidate those holdings would introduce direct intervention into property ownership within a system designed specifically to resist central control, effectively creating a future race for quantum-enabled theft. There are also equally controversial implications associated with burning inaccessible balances, which force the network to make unprecedented decisions regarding asset legitimacy and protocol authority. 

In spite of all proposed mitigation strategies, the issue of who has the authority to make such decisions for a decentralised monetary system remains fundamentally unresolved. Although Bitcoin Core developers are permitted to propose code changes, they are not allowed to unilaterally modify ownership records or dormant balances without coordinated consent from miners, exchanges, custodians, node operators, and other stakeholders. 

The governance tension represents an aspect of the quantum problem that can not be fully addressed through cryptography alone in proposals such as Quantum Safe Bitcoin. In decentralised infrastructure, the underlying assumption for many years has been that any architectural limitations can eventually be resolved through upgrades and coordination with enough time and consensus. 

Quantum computing is now testing that assumption under an externally imposed technological timeframe driven not by community preference, but by advancements in physics, semiconductor engineering, and computational science. The process of transitioning Bitcoin toward post-quantum resilience will probably take time, money, and political compromise if it is to be successful. 

The network may face the fact that, if coordination fails to keep pace with technological advancement, foundational cryptographic choices made during Bitcoin's earliest design phase will not always remain secure in light of evolving computational power indefinitely. Quantum Safe Bitcoin has received a great deal of attention, but researchers emphasise that it focuses on only one layer of a much wider structural problem. 

By successfully introducing transaction-level quantum resistance, QSB provides a practical defensive mechanism for protecting active holdings against future cryptographic threats by reducing computational overhead. There is much more to the issue than just protecting individual wallets. The central challenge for Bitcoin is determining whether a decentralised network without a governing authority will be able to realistically move hundreds of millions of addresses toward a new cryptographic standard prior to quantum technologies becoming available. 

When considering the dormant wallets and inaccessible coins that cannot voluntarily participate in such a transition, the problem becomes even more complex. In order to execute an extensive migration strategy, developers, miners, exchanges, custodians, infrastructure operators, and long-term holders will need to work together as a consensus-driven governance group with incentives that may not fully align. 

While quantum computing advances are achieved through concentrated research and technological breakthroughs, decentralised coordination is generally characterised by a slow and sometimes prolonged period of ideological disagreement.

Many analysts believe this is the real test for Bitcoin in the quantum era, not in the design of stronger cryptography, but in the ability of a globally distributed financial system to collectively adjust to external technological pressures without compromising its principle of decentralisation. Bitcoin's cryptography is no longer the single focus of the quantum debate, however. Instead, the question is whether decentralised systems are capable of coordinating fast enough to survive the technological transition they cannot control. 

Post-quantum research is accelerating across the government and private sectors, resulting in unprecedented scrutiny of long-term security assumptions, dormant asset exposure, and governance resilience within the cryptocurrency industry. 

As a result of this challenge, Bitcoin's cryptographic architecture may ultimately be examined in terms of its durability, as well as its practical limits under real-world computational pressures related to decentralised consensus.
Read more »
Technology
AI Anthropic AI Claude coding assistants Malicious Activities Technology

Researchers Find Security Gap in Anthropic Skill Scanners




Security researchers have uncovered a gap in the way Anthropic Skill scanning tools inspect third-party AI packages, allowing malicious code hidden inside test files to execute on developer systems even after scanners marked the Skills as safe.

The issue centers on Anthropic Skills, reusable packages designed for AI coding assistants such as Claude Code, Cursor, and Windsurf. These packages often include instructions, scripts, and configuration files that help AI agents perform development tasks inside IDE environments.

Researchers from Gecko Security found that existing Skill scanners focus primarily on files tied directly to agent behavior, particularly SKILL.md, while ignoring bundled test files that can still run locally through standard developer tooling.

In the demonstrated attack chain, a Skill passed all scanner checks because its visible instruction files contained no prompt injection attempts, suspicious shell commands, or malicious instructions. However, the repository also included a hidden .test.ts file stored elsewhere in the directory structure. Although the file was outside the agent execution layer, it still executed through the project’s testing framework with full access to local resources.

According to researcher Jeevan Jutla, the problem begins when developers install a Skill using the npx skills add command. The installer copies nearly the entire repository into the project’s .agents/skills/ directory. Only a few items, including .git, metadata.json, and files prefixed with underscores, are excluded during installation.

Once placed inside the repository, testing frameworks such as Jest and Vitest automatically discover matching test files through recursive glob patterns. Both frameworks reportedly enable the dot:true option, allowing them to search inside hidden directories including .agents/. Mocha follows similar recursive discovery behavior in many default configurations.

A malicious Skill can therefore include a file such as reviewer.test.ts containing a beforeAll function that silently executes before visible tests begin. Researchers said these payloads can access environment variables, .env files, SSH keys, AWS credentials, deployment tokens, and other sensitive information commonly available inside local developer environments and CI pipelines. The data can then be transmitted to external servers without triggering obvious warnings during test execution.

The researchers stressed that the AI agent itself is never involved in the compromise. Instead, the malicious behavior occurs through trusted developer tooling already integrated into the software workflow. Existing scanners inspect the files the AI agent can interpret, but not the files executed separately by testing infrastructure.

The technique resembles older software supply-chain attacks involving malicious npm postinstall scripts and poisoned pytest plugins. However, Gecko Security noted that the Anthropic Skill ecosystem creates an additional propagation problem because installed Skills are often committed into shared repositories so teams can reuse them collaboratively.

GitHub’s default .gitignore templates do not automatically exclude .agents/ directories. Once a malicious test file enters the repository, every teammate cloning the project and every CI pipeline running automated tests may execute the payload across branches, forks, and deployment workflows.

The findings arrived shortly after multiple large-scale security audits examining the broader Anthropic Skills ecosystem. A January academic study named SkillScan analyzed 31,132 Skills collected from two major marketplaces and found that 26.1% contained at least one vulnerability spanning 14 separate patterns. Data exfiltration appeared in 13.3% of examined Skills, while privilege escalation appeared in 11.8%. Researchers also determined that Skills bundling executable scripts were 2.12 times more likely to contain vulnerabilities than instruction-only packages.

Several weeks later, Snyk published its ToxicSkills audit covering 3,984 Skills from ClawHub and skills.sh. The company reported that 13.4% of scanned Skills contained at least one critical-level security issue. Automated analysis combined with human review identified 76 confirmed malicious payloads, while eight malicious Skills reportedly remained publicly accessible on ClawHub when the findings were released.

In April, Cisco introduced an AI Agent Security Scanner integrated into IDE platforms including VS Code, Cursor, and Windsurf. The scanner can detect prompt injection attempts, suspicious shell execution patterns, and data exfiltration behaviors within Skill definitions and agent-referenced scripts. However, Gecko Security said bundled test files remain outside the scanner’s documented detection surface because the tool was designed around agent interaction layers rather than developer execution layers.

Researchers noted that other products, including Snyk Agent Scan and VirusTotal Code Insight, face similar structural limitations. These tools inspect what the agent is instructed to execute but may overlook code paths triggered separately through local development frameworks.

Elia Zaitsev described the broader issue as a distinction between interpreting intent and monitoring actual execution behavior. In this case, the malicious code did not depend on prompt manipulation or AI instructions. It operated as ordinary TypeScript executed through legitimate test runners with full local permissions.

Zaitsev also warned that enterprise AI agents increasingly operate with privileged access to OAuth tokens, API keys, and centralized data sources. If those credentials are accessible through environment variables during automated testing, malicious test payloads can reach sensitive infrastructure without requiring direct agent compromise.

Mike Riemer added that threat actors frequently reverse engineer security patches within 72 hours of release, while many organizations take far longer to deploy fixes. In the case of the Anthropic Skill test-file issue, researchers warned that the exposure window becomes more difficult to manage because the malicious files may execute immediately after installation without triggering scanner alerts.

Security researchers are urging development teams to block test discovery inside .agents/ directories and inspect Skill repositories for files such as *.test.*, *.spec.*, conftest.py, __tests__/, and suspicious configuration scripts before merging code.

The report also recommends pinning Skill installations to verified commit hashes rather than installing the latest repository version. Researchers said this reduces the risk of attackers submitting clean repositories for scanner approval before later inserting malicious files. The approach aligns with guidance published in the OWASP Agentic Skills Top 10 project.

Organizations that already store Skills inside repositories are advised to audit existing .agents/ directories immediately, rotate exposed credentials if suspicious files are discovered, inspect CI logs for unexplained outbound network traffic, and review repository history to identify when potentially malicious files entered development pipelines.

The researchers additionally called on security vendors to provide greater transparency regarding which directories, execution surfaces, and file categories their scanners actually inspect. They argued that security teams evaluating Anthropic Skill scanners should verify whether products analyze bundled test files, build scripts, and CI configurations rather than focusing exclusively on prompt injection and agent instruction analysis.

Read more »
Microsoft security
Credential Security Cyber Phishing Cyber Security Data protection data security Microsoft Microsoft security

Microsoft Warns Users About Rising QR Code Phishing and Quishing Scams

 

Microsoft’s cybersecurity researchers have uncovered a growing wave of phishing scams using QR codes hidden inside emails, PDF files, and fake CAPTCHA pages. Instead of clicking suspicious links, victims scan QR codes that secretly redirect them to fraudulent websites designed to steal login credentials and session data. The attacks spread quickly because they bypass many traditional security filters and often appear harmless at first glance. 

Known as “quishing,” these scams hide malicious links inside QR codes, avoiding the usual warning signs tied to suspicious URLs. Emails often create urgency through fake compliance notices, security alerts, or missed-message warnings, encouraging users to scan the code without carefully checking the sender. According to Microsoft, attackers are impersonating HR teams, IT departments, managers, and office administrators to make messages appear legitimate. 

Once scanned, users are routed through several webpages before landing on counterfeit login portals built to capture usernames, passwords, and even live session tokens capable of bypassing some two-factor authentication protections. Researchers say more than 35,000 users across approximately 13,000 organizations worldwide have already been targeted, with cases continuing to rise. Many people trust QR codes because they are commonly used for menus, payments, and sign-ins, making them less likely to question the risks behind scanning one. 
Cybercriminals are exploiting that familiarity to trick users into exposing sensitive information. A recent case highlighted by Digit.in demonstrated how convincing these scams can be. Employees reportedly received emails appearing to come from an Office 365 administrator claiming several messages were awaiting approval. Instead of links, the email included a QR code directing users elsewhere. Investigators tested the QR code using a freshly wiped mobile device across Android and iOS platforms to minimize potential risks. 

While the QR codes in that case did not install malware or alter device settings, the test showed how easily similar scams could deceive unsuspecting users. Security professionals warn that scanning unfamiliar QR codes on devices containing banking apps, work credentials, personal photos, or confidential files can expose users to serious threats without obvious warning signs. Experts recommend avoiding QR codes sent through unsolicited emails, verifying senders carefully, and checking linked addresses before entering passwords. 

As cybercriminals increasingly rely on social engineering instead of direct hacking, simple actions like scanning a QR code are becoming new entry points for digital attacks.
Read more »
Threat Investigation
AI SOC Alert Overload Cyber Security SOC Security Threat Investigation

SOC Alert Overload: Why More Analysts Won’t Help

 

Security operations centers are facing a problem that hiring alone cannot solve. Alert volumes keep rising, attackers move faster than most human teams can investigate, and many SOCs still rely on workflows built for a much smaller stream of events. The result is a widening gap between the alerts generated by modern systems and the number that can be analyzed with real depth. 

Even when organizations add analysts, the queue often remains crowded because the underlying process still depends on manual triage. That is why security experts argue the issue is not a staffing shortage alone, but an operating-model failure that leaves teams reacting instead of defending. 

Most SOCs have already tried the obvious fixes. They prioritize critical alerts, suppress noisy detections, and tune rules to reduce false positives. Those steps help, but they do not remove the central bottleneck: too many alerts still reach humans for investigation. The article explains that low- and medium-severity events are especially dangerous because attackers often hide inside them, knowing analysts are overwhelmed. When those signals sit in a backlog, the delay becomes a security weakness in itself. 

To test whether a SOC is truly under strain, security experts suggest a quick diagnostic. Leaders should ask how many high-priority alerts were actually investigated, how often detection rules were suppressed without replacement coverage, whether analyst turnover has created a fragile bench, and what task would be sacrificed if alert volume doubled overnight. If the answers reveal gaps, the problem is not effort or discipline. It is capacity, continuity, and architecture. 

The proposed answer is not to push analysts harder, but to change how investigations are handled. AI-based SOC platforms can triage alerts at scale, document reasoning, and free analysts from repetitive work. In the examples cited, teams completed thousands of investigations quickly and recovered large amounts of analyst time. That shift also allowed some organizations to reduce SIEM-related spending by cutting unnecessary ingest and storage. Humans still matter, but their role changes: they focus on insider threats, novel attack patterns, and cases that require business or regulatory judgment. 

The broader lesson is simple. Modern SOCs need a model that matches today’s attack speed and alert volume. If the queue is always full, more people will only slow the pain, not remove it. The stronger answer is to redesign the workflow so that technology handles scale and analysts handle judgment, because that is where security value actually comes from.
Read more »
Hacking Group
Canada Cyber Attacks Cyber Breach Digital Security Challenges education sector Education Sector Cybersecurity Hacker attack Hacking Group

ShinyHunters Cyberattack Disrupts Canvas Platform Across Universities and Schools

 

This week, a significant digital breach affected educational institutions throughout the United States, Canada, and Australia. The incident followed claims by the hacking collective ShinyHunters. Their target: Canvas, a commonly adopted online learning system. Despite its widespread use, the platform proved vulnerable. 

Though details remain partial, reports confirm active exploitation of security gaps. While some schools shifted to offline methods, others delayed classes. Because of the reach of the network, effects spread quickly. Since access was blocked at peak hours, confusion grew early. Not every region reported identical issues - some experienced minor delays instead. Even so, trust in ed-tech infrastructure has taken a hit. 

As investigations continue, officials are reviewing how data was exposed. Midway through the year’s final academic stretch, a cyberattack triggered broad system failures across roughly 9,000 schools globally. Coursework uploads faltered, exam access vanished, lectures disappeared, grading stalled - student work ground to a halt. Though Instructure owns the platform, control slipped when services went down; officials acknowledged the breach soon after. 

Recovery came slowly - Canvas returned for many, yet pockets of disruption lingered on campuses far apart. Midway through tests, alerts flashed unexpectedly - spreading uncertainty among test takers and instructors at multiple campuses. Because of the interference, assessments set for Friday at Mississippi State University got delayed without prior notice. Screens displayed warnings stating “ShinyHunters has breached Instructure (again),” followed by demands for cryptocurrency transfers to prevent data leaks. 

Some learners recalled frozen systems right when submitting answers. Though officials confirmed the incident, details remained limited throughout the afternoon. By evening, investigations had begun while backups were reviewed quietly behind closed doors. After finishing their long exam essays, one student - Aubrey Palmer - noticed the ransom note pop up. When doubts emerged about whether files were actually saved, stress began spreading through the group. 

Some felt upset right away, others grew uneasy only later. Midterms approached fast when campuses started alerting students about sudden changes. Following technical issues, Sydney advised against accessing Canvas until further details arrived from Instructure. With finals looming, the timing of the outage posed serious challenges. Though routine disruptions happen now and then, this one struck during peak assessment periods.  

Among those impacted were Penn State University, Idaho State University, the University of British Columbia, the University of Toronto, UCLA, and the University of Chicago. With IT departments reviewing how far the breach reached, some campuses postponed exams - others called them off entirely. Later on campus, Jacques Abou-Rizk noticed something off after opening an email link - he saw a message that seemed tied to a demand for payment. 

Though the note mimicked one from school staff, officials clarified they were already tracking the event. Despite initial concerns, leaders emphasized no additional platforms showed signs of intrusion. Cybersecurity analysts pointed to screenshots suggesting the attacks might have started several days before the public alerts, as seen in timed demands delivered to targeted organizations. 

While ransom discussions could still be happening behind the scenes, the hacker collective hasn’t revealed its next steps regarding the data it claims to possess. Besides earlier cases, another breach now ties back to ShinyHunters - a group already connected to several prominent corporate intrusions. While details differ, patterns point to similar tactics used before across large-scale data compromises. 

Surprisingly, the widespread outage sparked fresh worries over how ready schools really are when it comes to digital safety. At nearly the same time, officials like Senator Chuck Schumer began pushing for tougher nationwide protection - especially since artificial intelligence-driven attacks and online ransom schemes keep growing across countries.
Read more »
Subscribe to: Posts (Atom)

Featured