Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation

  A hacktivist group has published internal records identifying more than 41,000 Department of Homeland Security employees and contractors, ...

All the recent news you need to know
Yoba
ChatGPT Claude cryptomining malware Yoba

Fake ChatGPT and Claude Apps Deliver Crypto-Mining Malware

 

Cybersecurity researchers have uncovered a malware campaign, known as Yoba, that uses fake desktop applications for ChatGPT and Claude to trick users into installing cryptocurrency-mining malware. The attackers created convincing GitHub projects and websites for supposed AI tools such as “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus,” then distributed malicious ZIP files that appeared to be legitimate installers. According to Check Point Research, the campaign exploits public interest in AI tools and the trust people place in familiar technology brands. 

The malicious archives contain two key files: a genuine, digitally signed executable from OpenAI or Anthropic, and a harmful Windows DLL named winmm.dll. When a user runs the legitimate-looking Setup.exe, Windows loads the malicious DLL alongside it. This technique, called DLL sideloading, lets attackers abuse trusted signed software to make malicious code appear less suspicious and evade basic security checks. Importantly, the research does not suggest that OpenAI, Anthropic, ChatGPT, or Claude themselves were compromised. 

Once launched, the malicious DLL—called YobaDropper—checks that it is being run through the expected host executable, making it harder for researchers to activate it in a sandbox. It then copies a legitimate Windows media component, wmpdmc.exe, into a new folder and places another malicious DLL beside it. This second component, YobaLoader, establishes persistence through a scheduled task and retrieves further instructions from the attacker. 

YobaLoader uses an unusual command-and-control method to avoid detection. It downloads an image from a Telegram channel, takes the final 50 bytes as a seed, and generates a new domain using a domain-generation algorithm. It then queries Google’s DNS-over-HTTPS service for a hidden command stored in a DNS TXT record, which leads it to download the next-stage payload. By using DoH and common file-hosting services, the attackers make their traffic resemble ordinary internet activity and evade passive DNS monitoring. 

The downloaded payload is injected into Windows’ svchost.exe process, where it launches XMRig, a cryptocurrency miner. Victims may notice slower performance, higher CPU usage, increased electricity consumption, or unexpected system heat. Users should download AI applications only from official vendor websites or verified app stores, avoid installing “desktop versions” from random GitHub repositories, and be cautious of search results promoting unfamiliar AI tools. Organizations should also restrict installations from unknown sources and monitor endpoints for unusual scheduled tasks and mining activity.
Read more »
Government Data Theft
Cyber Attacks data attacks Data Breaches Data protection data security government data Government Data Breach Government Data Theft

Moldova Probes Possible Foreign State Involvement in Major Cyberattack Exposing Government Data

 

The Moldovan authorities are looking into whether the large cyber attack, which caused sensitive personal data to be breached and dozens of state services to be disrupted, could be linked to a larger operation targeting citizen data. Prime Minister Vasile Tofan said on Wednesday.

"We have seen coordinated attacks on a large scale. This shouldn’t be seen as an isolated incident. We’re looking at whether there was any foreign state actors involved," he said. The government has not named any countries or hacking groups. 

In total, hackers targeted vulnerabilities between October 19 and October 23 to gain large amounts of personal data from government services. They made around 11 million requests to access data. Preliminary findings show that information relating to around 750,000 identification numbers was removed but this does not necessarily mean all personal data was compromised. 

This could include personal information such as full names, date and place of birth, family relations, health insurance, social benefits, pensions, disabilities, drivers licences, images and car ownership. Financial information such as bank account numbers, tax liabilities and government payments could also have been accessed. However, authorities said there was no breach of bank cards and no evidence of the attackers attempting to tamper with official government documents. 

Initially the hackers exploited vulnerabilities within services that did not require authentication. This was then used to access more records from the government services that are linked. The government have reviewed 82 digital public services and have disconnected the vulnerable services. Over 30 government information systems and administrative services were also disconnected. Several public services were impacted including applying for building permits, veterinary transport authorisations, importing medicine and food safety registrations. 

Most of the services have now been secured, however they are being gradually reconnected following further security checks. On October 23 the authorities said unauthorised access was stopped. However, they said they identified further attempts on Sunday and Tuesday but these were unsuccessful. The government has warned that criminals could attempt to use the stolen information for fraud and impersonation. They could try to impersonate someone from a bank or public institution to get people to give them passwords or codes or send them money. 

The incident could be part of a larger hybrid attack campaign, government spokesperson Dumitru Ciorici said. Moldova has been constantly targeted by cyber attacks and disinformation since Russia launched a full invasion of Ukraine in 2022. 

Moldovan officials have previously accused Russia of launching disinformation campaigns to destabilise the country and weaken state institutions. They have also undermined confidence in the pro-European government led by President Maia Sandu. The latest incident has raised concerns over the security of Moldova’s digital services.
Read more »
Third-Party Security Risks
airline cybersecurity Amadeus Data Breach Aviation Cybersecurity Customer Information Leak Data protection Japan Airlines Data Breach Japan Cyber Attacks Passenger Data Exposure Third-Party Security Risks

Data Breach at Japan Airlines Adds to Japan's Mounting Cybersecurity Challenges


A data breach has been reported by Japan Airlines (JAL) involving approximately 92,000 customers following unauthorized access to its third-party technology provider, Amadeus IT Group, which exposed passenger reservation information. Due to several recent major cyber incidents reported by Japanese companies, this incident has raised further concerns about the security of customer data handled by external service providers. 

Japanese Airlines and Japan Transocean Air use Amadeus' passenger services systems for flight reservations, ticketing, and check-in operations. According to the airline, Amadeus informed them on October 23, 2026, that unauthorized access to their systems had occurred. This incident involved the breach of customer reservation records stored within the provider's environment. 

Passenger information included names, reservation codes, flight dates, routes, and travel classes of passengers that had been compromised. It is estimated that 90,000 customer information has been exposed. A second 2,000 passengers were also exposed with additional personal information contained in the compromised records, including passports, nationalities, frequent flyer numbers, email addresses, phone numbers, and flight, ticket, and seat numbers. 

According to reports, the unauthorized access occurred from August 10, 2023, to September 23, 2026, suggesting that the affected environment may have been exposed for an extended period of time. Although the method employed by the attackers to gain access has not been publicly disclosed, Japan Airlines has clarified that credit card information and passwords were not compromised in the incident. 

In addition, Amadeus has reportedly implemented security measures to address the issue, as the airline states there is no evidence that the exposed information has been misused and that flight operations have not been disrupted. According to JAL, affected passengers will be contacted individually and provided with necessary assistance. 

Customers were also warned against phishing emails, fraudulent phone calls and suspicious websites impersonating the JAL Group, since exposed travel and contact information might be used in targeted scams. In addition, this incident highlights the risk that third-party technology providers pose in the aviation industry. 

With its digital infrastructure providing airline, airport, hotel, and travel agency customers around the world, Amadeus makes security a critical concern for many organizations. Several airlines have reported possible exposures involving Amadeus systems, extending the impact beyond Japan Airlines. According to Korean Air and Asiana Airlines, unauthorized access to customer information managed by the same technology provider has been reported. 

It is reported that both airlines were notified of the incidents by Amadeus on October 20 and reported them on October 23. Based on their initial findings, it appears that reservation reference numbers belonging to some customers were exposed. Also pointed out was the unauthorized use of credentials related to an Amadeus system account. 

An incident similar to this one has also been reported by All Nippon Airways (ANA), another major Japanese airline. A notification of unauthorized access was received on October 29 by the airline and the provider is currently working to determine the extent of the exposure. As of now, ANA has not released the number of affected passengers or the specific categories of information affected. 

Once additional information has been confirmed, ANA will inform customers. These incidents have raised questions about the security of Amadeus's travel booking infrastructure as a result of their connection. As of October 1, the company disclosed a vulnerability in its travel booking display environment that may be exploited by ransomware actors. 

At that time, Amadeus stated that payment and other financial details had not been exploited by ransomware actors. Following the disclosures by multiple airlines, a closer examination of the earlier security issue has taken place. Amadeus provides technology services to more than 400 airlines, hotels, airport operators, and travel agents. 

In the event of a security vulnerability in a widely utilized platform, information could be exposed to several organizations, although it remains unclear how many airlines and passengers are affected. A person who has access to passenger names, travel schedules, and booking references may use these information to create convincing communications impersonating airlines using the exposed reservation information. This may also lead to opportunities for targeted phishing and identity fraud. 

It may be more credible for such attempts to possess additional information, such as passport numbers, email addresses, and telephone numbers. A broader cyber threat has prompted government intervention in Japan, as Prime Minister Sanae Takaichi called a cabinet meeting on October 26 to discuss the recent attacks and announced plans for emergency measures to strengthen cybersecurity protections for citizens and businesses. Her concern was expressed regarding the potential harm that might result from the misuse of personal information stolen. 

When Shinjiro Koizumi and U.S. Defense Secretary Pete Hegseth met in the Philippines on October 28, cyber security concerns of Japan were also discussed. Both sides agreed to intensify cooperation against malicious cyber activities that could adversely affect citizens, economic operations, and national security. 

Amadeus is still investigating these incidents, with the total number of passengers affected, the method by which the unauthorized access occurred, and the possibility of additional airline victims still being determined. It is evident from this incident that third-party technology providers in the aviation sector pose security risks. There remains an urgent need for stronger safeguards and a greater level of oversight in order to protect passengers' information as investigations continue to span multiple airlines.
Read more »
Ransomware
Data Breach energy company France GDPR Ransomware

French Energy Giant ENGIE Hit by Data Breach, Customer Records Accessed Through Partner Platform

 


ENGIE, one of the world's largest energy companies, has notified customers in France that an unauthorized third party accessed their personal data through a marketing platform used by the company's business partners, the company confirmed this week.

The breach notification letters, dated October 23, went to affected customers after ENGIE said it detected "unusual data access activity" on the partner tool. The company has not stated exactly when the intrusion took place or how long the attacker had access before it was caught.

According to the notifications, the data the intruder obtained includes customers' first and last names, mailing addresses, email addresses, and phone numbers. It also includes two types of energy infrastructure identifiers specific to the French grid: the Delivery Point identifier (PDL) and the Metering and Estimation Point identifier (PCE). Both codes are tied to a customer's physical connection to the gas and electricity supply network. Customer IDs and contract numbers were also taken.

ENGIE said no banking data was involved, and that the breach was confined to the partner-facing marketing platform rather than any of its internal systems. The scope of the incident is currently limited to its French customer base, though the company has not said how many customers received notifications.

"We have cut off the attacker's access to the platform, notified the relevant authorities, and are directly informing each affected customer," the company said in a statement.

Customers were advised to stay alert to unsolicited contact and potential phishing attempts in the wake of the exposure.

No ransomware group or extortion actor had publicly claimed responsibility for the breach at the time of publication.


A Company With a Recurring Target on Its Back

ENGIE operates across 30 countries, employs more than 90,000 people, and posted €71.9 billion in revenue last year. Its scale across utilities, renewables, and energy infrastructure makes it a high-value target for threat actors looking for customer data at volume.

This latest breach is not the first time attackers have made it inside ENGIE's wider corporate ecosystem. Approximately a year ago, the Scattered LAPSUS$ Hunters group claimed it had breached a Salesforce instance belonging to Engie Records, the retail energy subsidiary of ENGIE North America, and leaked records from the intrusion. Engie Records appeared on the group's leak site as the 27th of 39 organizations allegedly hit through the same Salesforce-related campaign, with around 3GB of data listed.

Before that, in August 2023, a separate incident affected roughly 110,000 French ENGIE customers. In that case, a hacker known online as "HommedeLombre" reportedly got into ENGIE's systems through an external contractor's network, a technique also used in the Pôle Emploi breach around the same period. That attacker exposed names, email addresses, and phone numbers, and later said the intrusion was meant to demonstrate that "nothing is ever secure," citing rising gas prices as a grievance. ENGIE filed a complaint with authorities following that incident and said it had brought the affected system under control.

If we look closer to understand the link here, the three incidents point to a recurring problem: ENGIE's data, whether held by internal systems, subsidiaries, or third-party partners, keeps ending up in attackers' hands.


Why Energy Sector Customer Data Is Valuable

The combination of contact information and energy-specific identifiers like PDL and PCE codes makes the stolen data more useful to attackers than a standard contact list. Those codes link a name and address to a specific gas or electricity metering point in the French national grid, which means the data could be used to convincingly impersonate ENGIE in phishing campaigns or to target customers with fraudulent offers around energy billing or contracts.

France's energy market also went through a turbulent period of price volatility in recent years, which means many customers have been actively comparing suppliers and receiving legitimate outreach about tariff changes. That context makes it easier for fraudsters to craft believable messages that reference contract numbers, delivery point details, and billing information, exactly the kind of data now in circulation.

ENGIE said it has notified the relevant authorities, as required under GDPR. French data protection rules mandate that breaches of personal data be reported to the CNIL, the national data protection authority, within 72 hours of detection, and that affected individuals be notified without undue delay when the breach poses a risk to their rights and freedoms.

As of now, ENGIE has not attributed the breach to any specific threat actor, and it is unclear whether the platform through which the data was accessed belonged to an external vendor or an internal partner system. The investigation appears to be ongoing.



Read more »
Healthcare Data
Cyber Networks Cyber Security Cyberattacks cybersecurity in healthcare Data protection data security Data Theft Healthcare Data

Cybersecurity Incident Disrupts New Mexico Hospital Network, Forcing Patient Diversions and Clinic Closures

 

A cybersecurity incident caused ambulance diversions, cancelled appointments and disruptions to medical facilities around the state on Monday October 26, leaving New Mexico with no emergency departments able to treat the most severe traumatic injuries. The University of New Mexico Health System provides the only level 1 trauma centre in the state. 

The health system advised patients not to attend the main hospital in Albuquerque and cancelled appointments at over 30 clinics whilst they tried to resolve the issue. Although officials did not immediately say what exactly had happened, later in the day it was announced that parts of the hospital and clinics were beginning to get back up and running. Presbyterian Healthcare Services and Lovelace Health System are also large healthcare providers in the state and worked with the network to prepare to take in extra patients. 

The University of New Mexico Health System sees around 900,000 outpatients and 100,000 emergency department patients per year (University of New Mexico Health System website), meaning this is a large part of the healthcare system. Multiple staff reported seeing messages on their computers late Monday morning stating that student, staff and patient data had been stolen. A spokesperson for the health system did not want to comment as they said there was an ongoing police investigation. 

An FBI spokesperson confirmed that they were assisting a partner organisation but did not give any further details. Attempts to comment were also sent to the Bernalillo County Sheriff’s Office and Albuquerque Police Department. This incident comes as there has been ongoing concerns about attacks on digital systems within essential services such as healthcare. Ransomware requests and other cyber incidents have been seen with hospitals for around a decade, however it is unusual for messages to be shown on computer systems due to the breach (Josephine Wolff, Professor of Cybersecurity Policy at Tufts University). 

This shows how difficult it can be for organisations to protect their networks. The impact could be seen throughout Albuquerque and surrounding areas. At the main hospital, staff in turquoise uniforms were directing patients away from the waiting area and advising they may have their appointments cancelled. Patients arriving at a medical centre in Rio Rancho were also told by security guards to rearrange their appointments. 

The University of New Mexico’s Health Sciences Centre, the largest academic medical centre in the state, cancelled Monday and Tuesday classes. Staff working in the hospital and medical group will be returning on Tuesday. It has not been confirmed what caused the incident, if data has been extracted or if there was a ransom request. The investigation is ongoing.
Read more »
Warp Breach
Agent Logs AI Security Data Breach Telemetry Exposure Warp Breach

Warp Breach Exposes AI Agent Logs and Telemetry

 

Warp has disclosed a security incident involving a third party infrastructure vendor that exposed AI agent decision logs and user telemetry. Chief executive Zach Lloyd estimated that approximately 1% of users could be affected, while emphasizing that the investigation remains ongoing. The disclosure identifies an exposure of operational records rather than establishing a compromise of every component in Warp’s development environment. The vendor, initial access mechanism, affected infrastructure components, and precise data boundaries have not been publicly identified, limiting independent assessment of the incident. 

Warp combines terminal functionality, a code editor, task orchestration, and agent activity review within an agentic development environment. Developers use its AI agents to generate code, execute tests, and deploy software. Consequently, agent traces and telemetry represent records associated with automated development workflows, although their exact contents vary with implementation. Warp reports at least 800,000 users, but its preliminary estimate of affected users does not establish the number of exposed records, compromised sessions, or affected organizations. Those measurements describe different dimensions of a security incident.

According to Lloyd, Warp detected what it believed was active, narrowly targeted exploitation of an infrastructure vendor on Friday and intervened within hours. The company described an attacker operation involving an “agent swarm,” sophisticated penetration techniques, and privilege escalation. However, the disclosure does not provide enough technical detail to reconstruct the attack chain or verify individual exploitation stages. No publicly identified vulnerability, authentication bypass, compromised identity, or execution mechanism has been specified. Claims about particular exploit classes would therefore exceed the available evidence. 

The exposed data categories were agent traces and telemetry. Warp has not established publicly whether these records included source code, user prompts, credentials, or other sensitive content. This uncertainty prevents a definitive assessment of confidentiality impact or potential secondary compromise. Exposure of operational logs should not automatically be equated with theft of API keys or unauthorized access to customer repositories. Warp notified identified affected users, informed the vendor, engaged CrowdStrike to assist with investigation, and contacted law enforcement. Further findings are needed to establish scope. 

A separate incident involving AI coding platform OpenCode illustrates why data classification matters when comparing breaches. That compromise exposed stored API keys for external providers, affected approximately 1.4% of users, and resulted in unauthorized charges reaching $1,700 for some victims. Equivalent credential exposure or financial abuse has not been established for Warp. The technical questions remain which records were accessible, what sensitive fields they contained, and how vendor access enabled their exposure. Until those details emerge, conclusions about downstream exploitation must remain provisional.
Read more »
Subscribe to: Posts (Atom)

Featured