Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Mythos 5.2: Anthropic’s AI Gets Better at Finding Vulnerabilities

  Anthropic has released Claude Mythos 5.2, an access-restricted AI model designed for advanced cybersecurity work, alongside the broadly av...

All the recent news you need to know
Employee Personal Information
Data Breach Data Leak data security DHS Digital Personal Data Protection Employee Personal Information

DHS Data Breach Exposes Personal Details of More Than 41,000 US Immigration and Security Personnel

 

Personal and professional details of over 41,000 employees of the United States Department of Homeland Security (DHS) have been leaked online. This includes names, addresses, phone numbers and roles of those working at several federal agencies who are involved in enforcing immigration and national security. 

The data was leaked on October 29, 2026 and shows that over 21,000 people work within Customs and Border Protection (CBP) with almost 6,600 working within Immigration and Customs Enforcement (ICE). Other agencies affected include Homeland Security Investigations, Federal Protective Service and Cybersecurity and Infrastructure Security Agency. The breach was carried out by a group known as the Department of Peace. 

They accessed personal profiles using a single sign-on service known as Okta. The information was then shared by journalist and cybersecurity researcher maia crimew alongside Distributed Denial of Secrets (DDoSecrets). The leaked information also includes the names of secret government operations, people involved and information on the technology used by investigators. Some of the tools include those provided by Cellebrite and Palantir. Emma Best, co-founder of DDoSecrets said the leak was aimed to shine a light on the officials involved in government operations. 

However, the information includes people involved with undercover operations, investigations into government leaks and deportation. The Department of Peace have cited the actions of immigration enforcement officials as the reason for the breach. The DHS have admitted they are aware of the potential breach and are working to resolve this. They have also said employee safety is a priority. Okta have also confirmed they are aware of the claims but have said there is no evidence that their systems or data have been breached. This comes after a number of cybersecurity issues within US government agencies. 

In September 2026 the FBI were targeted by hacking group ShinyHunters. They were able to gain personal information of thousands of agents. The Federal Election Commission also suffered an outage recently after a suspected hacking attack. This breach is particularly worrying as immigration enforcement often carry out operations with their faces covered and minimal identification. This makes having their work details and operations known a potential security risk for employees and their families. 

The breach comes at a time where US immigration enforcement has been under increased scrutiny. Since Donald Trump returned to office in 2025 nearly one million people have been deported from the country. Over 70% of these people had no criminal record.
Read more »
Payment API
AI CERT Cyber Attacks NBFCs Payment API

AI-Powered Cyberattacks Cost Small Indian NBFCs Nearly ₹300 Crore in Two Months; CERT-In Warns of Payment API Exploits


India’s smaller Non-Banking Financial Companies (NBFCs) are facing a growing wave of cyberattacks, with scammers siphoning off an estimated ₹300 crore over the past two months. Nearly 150 complaints and First Information Reports (FIRs) have been registered in connection with the incidents.

According to a report published by The Economic Times, the attacks have primarily targeted smaller NBFCs with annual turnovers of approximately ₹1,000 crore or less. Several financial institutions have experienced repeated attacks, exposing weaknesses in their cybersecurity infrastructure and payment systems.

In one reported incident, a Delhi-based NBFC allegedly lost ₹7.5 crore in an initial cyberattack, followed by another loss of ₹7.25 crore just days later. Investigators believe that inadequate security controls and insufficient monitoring have made smaller lenders attractive targets for cybercriminals.

AI tools making cyberattacks easier

Investigations into some of the incidents have identified a Chinese hacking platform known as CyberStrike. Security experts have also raised concerns about the growing use of artificial intelligence-powered toolkits, including ARTEX and CyberStrike, alongside open-source large language models.

These tools are lowering the technical barriers for cybercriminals by automating reconnaissance, vulnerability identification and other stages of cyberattacks. Attackers can use AI-assisted frameworks to analyse targeted systems and identify weaknesses more efficiently.

According to officials familiar with the investigations, attackers typically spend around 10 to 12 days studying an NBFC's payment infrastructure, including transaction processes, whitelisted identification details and application code, before attempting to steal funds.

Experts have also warned that stolen customer information could be exploited for targeted phishing and social engineering campaigns. Scammers equipped with borrowers' names, loan details and lender information may impersonate financial representatives to deceive customers into sharing sensitive information.

CERT-In flags payment API vulnerabilities

India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), along with CSIRT-Fin, issued a critical advisory on October 9, highlighting cyber threats targeting NBFCs, digital lenders, fintech companies and payment service providers.

The advisory identified vulnerabilities in applications and payment Application Programming Interfaces (APIs) that could allow attackers to steal banking credentials and initiate unauthorised fund transfers through trusted financial infrastructure.

CERT-In also warned that AI-driven attack frameworks have significantly reduced the time between initial system compromise and financial damage, allowing attackers to execute operations within hours rather than days.

Read more »
Zero-Day Exploits
AirPlay Security Apple Security Updates Apple Vulnerabilities and Exploits Bluetooth Security Cybersecurity Patches iMessage Vulnerabilities iOS security Privacy Protection Zero-Day Exploits

New Apple Updates Fix Privacy and Connectivity Flaws Across Its Ecosystem


The Apple operating systems have been updated with a series of security updates to address vulnerabilities affecting iMessage, Bluetooth and AirPlay, as well as a number of other areas. Among the fixes are two flaws in iMessage that could expose private group conversations to unauthorized individuals, as well as several weaknesses in wireless connectivity features that could allow attackers to establish connections or bypass existing security controls. 

There was an authorization weakness, identified as CVE-2026-113961, which enabled remote attackers to join an iMessage group conversation without proper permission and receive messages from that conversation. In light of the vulnerability, Apple improved validation mechanisms to ensure that unauthorized participants do not have access to conversations that are intended only for a limited number of users. As a result, privacy concerns were raised regarding group communications. 

Second, CVE-2026-113960, a vulnerability in iMessage, exposes messages exchanged within groups before a newly added participant joins them. This created an additional privacy risk since it potentially exposed earlier conversations to individuals who were not members when those discussions were originally sent. Apple confirmed that the affected code was removed as part of the security fixes.

There is no indication, however, that either vulnerability was exploited in real-world attacks prior to the patches being made available, according to the company's advisories. Moreover, details regarding the technical requirements for exploiting the flaws, whether unauthorized participants may be viewed by existing group members, and whether all participants must install the updates to secure a conversation remain unknown. Moreover, the updated versions address a vulnerability related to Google's Brotli compression library, identified as CVE-2026-111497. 

The vulnerability could be exploited by specially crafted inputs to corrupt memory, as the library's decoder is vulnerable to an out-of-bounds write. As of October 27, the Known Exploited Vulnerabilities (KEV) catalog indicates that the vulnerability has been reported as exploitable by the US Cybersecurity and Infrastructure Security Agency (CISA). Nevertheless, Apple's advisory does not specify specific attacks against its devices related to this vulnerability. 

Apple released separate security updates for the supported operating systems to cover these vulnerabilities. Despite the fact that iOS 18.7.12 and watchOS 26.6.1 security notes do not list the same fixes as iOS and iPadOS 27.2.1 advisories, they document all three vulnerabilities. Users who cannot immediately install the updates have been advised that alternative mitigation measures are available. However, the company has not made it clear whether devices running those versions are affected. 

Bluetooth and AirPlay Vulnerabilities Add to Security Concerns

The latest security updates of Apple's devices are also addressing several vulnerabilities affecting Bluetooth and AirPlay connectivity across devices, in addition to the messaging flaws. This vulnerability may allow attackers to bypass wireless pairing safeguards, establish unauthorized connections, or alter the memory of the device.

In two cases, a malicious device could establish a connection without the user's involvement due to a vulnerability in the Bluetooth framework. The other two flaws affected pairing-code protections, potentially making it possible for attackers to bypass restrictions on repeated incorrect attempts. Those issues can be exploited by those within Bluetooth range, while those connected to the same network can trigger the other. 

Apple addressed these vulnerabilities by improving security checks and by making changes to memory and connection management to address a memory-management vulnerability that could allow someone within Bluetooth range to corrupt memory. A pairing-rate-limit vulnerability was also found in AirPlay. Within Bluetooth range or on the same network, an attacker could circumvent restrictions on repeated pairing code attempts by exploiting this weakness. 

Bypassing these limitations could make it easier to unauthorized pair-up. Typically, these limits prevent repeated guesses of the PIN and temporarily block further attempts after several incorrect entries. Additionally, the security releases address a vulnerability relating to App Intents authorization, which could lead to sensitive user information being accessed by applications. Several fixes were made by Apple to address the issue, including improved state management, as well as fixes to messaging, wireless connectivity, application permissions, and data processing. 

Apple Expands Security Fixes Across Its Device Ecosystem

Security patches for iOS, iPad OS, macOS, watchOS and visionOS were rolled out on November 9. According to the released release information, iOS 27.2.1 and 26.7.3, iPad OS 27.2.1 and 26.7.3, macOS Golden Gate 27.2.1 and macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1 are included in this security update. 

There are several generations of iPads that have also been updated with relevant security patches, including the iPhone 11 and later. The update depends on the device model and operating-system branch of the device. No active exploits of the iMessage and Bluetooth vulnerabilities have been confirmed by Apple. 

Although these updates are important for individual users and enterprise device administrators because of messaging privacy weaknesses, wireless pairing bypasses and memory corruption risks, they are also extremely important for enterprise device administrators. Organizations managing Apple hardware must verify the installed versions across their fleets and prioritize security patches that are applicable.

To prevent potential attacks and safeguard sensitive information, the latest updates emphasize how important it is to maintain secure communication channels and protect wireless connections among connected devices. Apple users and enterprise administrators are encouraged to prioritize the installation of the appropriate patches.
Read more »
South Korea
Airlines Amadeus Data Breach Data Breach Japan Airlines Data Breach leaked sensitive data South Korea

Japan Airlines Passengers Caught in Amadeus Reservation System Breach

 



Japan Airlines has warned roughly 92,000 customers that hackers accessed their personal information through a third-party reservation platform, in what is turning out to be one of the most critical data security incidents to hit the global aviation industry in recent memory.

The airline said the breach originated at Amadeus IT Group, the Spain-based technology company whose software powers ticketing, check-in, and reservation systems for airlines worldwide. JAL said Amadeus notified it the week before it published its own disclosure notice on October 28, 2026, stating that an unauthorized party had accessed "a portion of customer reservation data" stored within the Amadeus platform.

For the vast majority of affected customers, the exposed information included names, booking reference codes, and flight details. But for approximately 2,000 of those customers, the picture is considerably worse. Hackers also accessed passport numbers, frequent-flyer numbers, email addresses, and phone numbers. No credit card numbers or passwords were compromised, JAL said, because that data was not stored in the same system.

Japan Transocean Air, a JAL affiliate, was swept up in the same incident. The two carriers share infrastructure through the Amadeus platform, which is how the breach spread across both brands without requiring a separate intrusion.

JAL said it would reach out to affected customers individually and urged everyone to stay alert for phishing emails, fraudulent phone calls, and fake JAL websites. The warning carries real weight: when scammers know your name, flight number, and booking code, their messages tend to look far more convincing than a generic blast.

The company said its own internal systems were not touched. That distinction, while technically accurate, offers only limited reassurance. From a customer's perspective, the data was real, the exposure was real, and JAL was the brand they trusted when they handed over their information.

JAL is far from alone in this. The Amadeus breach has since grown into an industry-wide event. Cathay Pacific disclosed that hackers used login credentials assigned to one of its system accounts to access reservation data inside Amadeus, with the intrusion running from August 2023 to September 2026, a window of more than three years. Amadeus reportedly detected the unauthorized access in late September, then reset the compromised credentials, disabled the account, and added monitoring. Airlines were notified between October 20 and October 28.

ANA, another major Japanese carrier, said about 37,800 of its customers were affected, with roughly 1,700 of those having passport details viewed. Cathay Pacific put its figure at approximately 53,000 bookings. Korean Air, Asiana Airlines, Malaysia Airlines, and German leisure carrier Condor have all said they are investigating their exposure. Qantas was still assessing whether its bookings were affected as of early November. Three smaller Japanese regional carriers, Air Do, Solaseed Air, and Starflyer, said they had been notified and were reviewing their records.

No single overall figure covering all airlines has been published, but the numbers keep climbing.

The mechanism behind the breach is straightforward and deeply familiar to anyone who follows enterprise security incidents. At its core, attackers used legitimate credentials to log into a system they were not supposed to access. No elaborate zero-day exploit, no ransomware deployment. Someone had the right username and password, and they used it. Cathay Pacific's disclosure that the credentials were tied to a "system account" suggests the compromised login may not have belonged to a human employee at all, but rather to an automated or service-level account, which tend to receive less routine monitoring than individual user logins.

The timeline raises its own troubling questions. If the unauthorized access began in August 2023 and was not detected until September 2026, attackers had more than three years to move through reservation data at their leisure. It is not yet clear whether that access was continuous or sporadic, or whether the full scope of what was taken is known.

The disclosure lands at a sensitive moment for Japan's cybersecurity posture. The country has seen a string of high-profile incidents over the past two years, and Prime Minister Sanae Takaichi convened a cabinet meeting on the issue, pledging emergency measures, though specifics had not been released at the time of publication.

For passengers, the practical exposure is primarily the risk of targeted fraud. Scammers with access to real booking records can craft fake refund notices or schedule-change alerts that clear most basic suspicion checks. Security researchers consistently advise the same response: access your booking only by typing the airline's official website address directly into your browser, and treat any unsolicited message about your flight as suspicious until verified through official channels.

Amadeus has not issued a detailed public statement about how the breach occurred, its full scope, or what it is doing to prevent a similar incident. As more airlines finish their own assessments, that number is likely to rise.



Read more »
Russian Hackers
Dark Web Data Breach Data Leak Italian Minister Russian Hackers

Italy Minister’s Personal Data Leaked on Dark Web

 

Italy’s Foreign Minister Antonio Tajani has said that cybercriminals circulated his personal data on the dark web, exposing him and his family to threats and intimidation. Prime Minister Giorgia Meloni blamed pro-Russian hackers, although Tajani did not publicly identify the attackers. The episode highlights how digital harassment and data leaks can be used to pressure political leaders. 

Tajani, who is also Italy’s deputy prime minister, announced the breach in a social-media post. He said that for days, cybercriminals had been spreading information about him on the dark web while trying to obtain additional details about him and his relatives. He said the criminals were even prepared to pay for further personal information, creating what he described as new threats and intimidation for his family. 

The foreign minister did not specify exactly what data had been leaked or which group carried out the attack. However, he linked the targeting to Italy’s position on Ukraine, saying that defending a sovereign state’s freedom and supporting democracy and independence had made him a target. He also said the attack appeared to be a reaction to measures Italy had taken to strengthen cybersecurity at its foreign ministry. 

Meloni expressed full solidarity with Tajani and described the alleged sale of confidential information about government officials as a matter of grave concern. She said it must be addressed with the utmost determination, framing the incident as an attack not only on an individual minister but on Italy’s institutions. Her statement came amid wider concern across Europe about cyberattacks, sabotage, drone incidents, and other hybrid threats. 

Tajani rejected the intimidation and vowed to continue his work. “I will not allow myself to be intimidated in any way,” he said, adding that he would keep defending his ministry and Italy while strengthening cooperation with partners to improve collective security. Italy remains a supporter of Ukraine, providing humanitarian and military assistance as the country continues to defend itself against Russia’s invasion. 

The incident follows a series of security disruptions across Europe, including hoax bomb threats that caused flight diversions, threats against broadcasters, attacks on supermarket refrigeration systems, and drone incursions. Authorities have not publicly attributed those threats to a particular group or state, and no evidence has emerged directly linking the hoaxes to a government. Still, the alleged leak of Tajani’s data has intensified concerns that political figures and critical institutions are increasingly vulnerable to online intimidation campaigns.
Read more »
US Treasury
Anti-Money Laundering Crypto Crime Cryptocurrency Regulation Cyber Crime FinCEN Illicit Crypto Transactions MEXC Crypto Exchange Money Laundering Sanctions Evasion US Treasury

MEXC Faces US Restrictions Over Alleged Sanctions Evasion and Cybercrime


US Treasury officials have blocked MEXC Global from the American financial system due to its alleged involvement in sanctions evasion, cybercrime-related payments, and other illicit financial activities. According to findings by the Financial Crimes Enforcement Network (FinCEN), between May 2021 and May 2026, the Seychelles-based exchange facilitates an estimated $16 billion in suspicious transactions. 

Based on Section 9714(a) of the Combating Russian Money Laundering Act, which was issued on November 6, 2026, MEXC was designated as a primary money laundering concern. In the event the order goes into effect, US financial institutions will be prohibited from processing fund transfers, including cryptocurrency transactions, to and from MEXC. Additionally, MEXC's subsidiaries and overseas operations will be restricted. 

A large part of the Treasury Department's Operation Economic Outcast initiative aims to disrupt financial channels used by Iran to circumvent international sanctions, and the actions form part of that initiative. 

While the MEXC order is based on allegations of the exchange's connection to Russian illicit finance, it is also based on FinCEN's finding that the platform processed approximately $1.5 billion in transactions related to Russian sanctions evasion over the past five years. This activity was reported to involve dealings with a sanctioned cryptocurrency exchange Garantex and its successor, Grinex, with transactions continuing until June 2026. 

Moreover, the agency identified approximately $200 million linked to the stablecoin A7A5, which has been associated with Russian sanctions evasion activities. In addition, substantial financial links were discovered involving Iranian entities as part of the investigation. MEXC reported processing over $1 billion in direct transactions with more than 40 Iranian cryptocurrency exchanges, according to FinCEN. Further transactions reportedly included payments related to sanctioned actors, as well as those involving the Iranian central bank and the Islamic Revolutionary Guard Corps. 

Along with to sanctions-related activity, Treasury accused the exchange of processing funds related to ransomware operations, scams online, and darknet marketplaces. As a result of these findings, FinCEN has expressed concerns about the platform's anti-money laundering (AML) procedures and controls on customer identification. 

According to FinCEN, the alleged activity was caused by severe weaknesses in MEXC's compliance systems, which made it possible to conduct transactions involving high-risk entities. It was established in 2018 and operates in over 170 countries, providing access to thousands of cryptocurrencies and tokenized assets. 

As a result of its scale and involvement in illegal financial flows, the enforcement action has been regarded as an important step forward in the US government's efforts to combat cryptocurrency-based sanctions evasion. 

MEXC Says It Is Cooperating With US Regulators

Upon submitting a response to the enforcement action, MEXC confirmed that discussions have begun with US authorities in response to the allegations. On November 10, CEO Vugar Usi announced that the exchange had established a communication channel with FinCEN with the assistance of an international law firm.

According to reports, the regulator acknowledged receipt of MEXC's written request, while MEXC expressed its willingness to cooperate in the ongoing regulatory process. The exchange's services remain operational, and deposits, withdrawals, and cryptocurrency trading have not been disrupted, according to Usi. According to reports, the company has prepared a follow-up plan and intends to provide further updates in the event significant developments arise. 

MEXC had earlier indicated that its legal and compliance teams had begun an independent assessment of its anti-money laundering and sanctions controls, following the November 6 order. According to the exchange, user assets remain secure and the exchange intends to cooperate with FinCEN and other appropriate regulatory authorities as part of its ongoing efforts. 

In order to prevent US financial institutions from processing transfer involving the exchange, this enforcement action does not shut down MEXC's global operations or freeze customer accounts immediately. MEXC is expected to face wider difficulties beyond its direct US financial connections following the publication of the order in the Federal Register. The order is scheduled to take effect 30 days after publication. 

The Blockchain Investigator ZachXBT reported on November 10 that several other offshore centralized exchanges that are either limited or do not have a US presence have started prohibiting MEXC users from transferring assets. However, it was not revealed which exchanges and what the specific scope of these restrictions would be, however it has been suggested that the enforcement action could affect transaction routes outside of the US financial system. 

In addition, this case highlights the increased scrutiny of offshore cryptocurrency platforms that process transactions involving sanctioned entities and cybercriminals. A number of factors may contribute to digital asset exchanges becoming channels for illegal funds to flow across borders, including weak customer verification, inadequate transaction monitoring and limited screening of high-risk counterparties. 

The immediate challenge for MEXC is to address FinCEN compliance concerns while maintaining access to international financial services. It is anticipated that the platform will be able to address the allegations and limit further restrictions based on its engagement with US regulators and independent review of its compliance framework. 

Taking such action marks a significant step forward in efforts of the US government to restrict illicit financial networks operating through cryptocurrency exchange platforms. The extent to which MEXC cooperates with FinCEN and its ability to address the alleged compliance violations will determine the exchange's future access to the US financial market.
Read more »
Subscribe to: Posts (Atom)

Featured