Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Automakers Face Scrutiny Over Connected-Car Data Sharing

  Modern connected cars are increasingly functioning as data-collection platforms, with new research finding that many automakers routinely ...

All the recent news you need to know
Vulnerability Research
AI cybersecurity AI Security Cybersecurity AI Cybersecurity Defenders Gemini 4 Argon Google Fairwind Google Gemini Vulnerabilities and Exploits Vulnerability Discovery Vulnerability Research

Google Introduces Gemini 4 Argon With Guardrail-Free Access for Defenders

A new frontier artificial intelligence model, Gemini 4 Argon, has been introduced by Google through its Fairwind Program for initial distribution to trusted cybersecurity defenders. In addition to internal security teams using this model, the company expects wider access as it collects feedback from early users. 

As a software engineering, enterprise knowledge work, and cybersecurity operations solution, Argon is designed to handle complex software engineering and knowledge management tasks. A model developed by Google will be able to identify, validate and patch critical vulnerabilities independently in security environments, thereby expanding the use of artificial intelligence for vulnerability research and remediation. 

Argon will be available to trusted defenders and the company's own teams without cyber-specific guardrails, according to the company. As part of this approach, vetted security professionals will be given full access to the model's capabilities when investigating and addressing threats. In September, Fairwind, a limited access AI security tool for governments, Google Cloud customers and cybersecurity partners, launched.

A significant finding has already been made as a result of its early deployment, Wiz, which is using Argon as part of its Scan for Good initiative, reported that it identified a previously unknown critical vulnerability in healthcare software used by hospitals worldwide. The vulnerability may expose sensitive personal information, although Google has not disclosed the name of the affected software or whether the issue has been resolved. 

Google also reports significantly improved vulnerability detection performance compared with Gemini 3.8 Flash Cyber. A security test conducted by Argon on complex codebases identified security weaknesses, while a test conducted by Wiz on live web applications demonstrated improvements in attack surface discovery, vulnerability identification, and proof-of-concept generation. 

A phased approach is being taken by Google to the wider release, with the model currently restricted to internal teams and vetted defenders. Moreover, the company is participating in the U.S. government's voluntary pre-release process and will refine its safeguards after receiving feedback from early testers in order to broaden the availability to developers, enterprises, and individuals. 

Argon will be designed to reject requests attempting to support cyber or chemical, biological, radiological, and nuclear attacks as part of its broader rollout, while also preserving the support of legitimate dual-purpose research as part of its broader rollout. Additionally, Google is monitoring the model's internal activity for signs of misuse. Indirect prompt injection is also being investigated. 

In Google's opinion, Argon is protected against attempts to manipulate it through malicious instructions or external content. The Fairwind program provides another layer of control around access by monitoring the model’s reasoning and actions, and stopping execution when behavior goes beyond the intended task. 

Organizations participating in the program have been vetted and their use has been restricted to authorized defense activities such as threat simulation, reverse engineering, and malware analysis for research or security purposes. Partners are not permitted to share or distribute access to the model. Google has not provided a date of general availability yet. 

Upon initial deployment of Argon Defender, API customers and Google AI Ultra subscribers should have access, although the broader deployment of Argon will be dependent on the results of ongoing safety and security evaluations.

Read more »
Operation KillSwitch
AI Artificial Intelligence Cyber Attacks Interpol Operation KillSwitch

Federal Agencies Disrupt Ransomware Gang Involving A 16-Year Old Member


An international law enforcement operation known as "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, resulting in three arrests and identifying a 16-year-old as the group's alleged administrator.

Combined efforts in finding suspects

Europol and Eurojust, as well as cybersecurity companies Bitdefender and Group-IB, all contributed to the investigation.
"The action was part of Operation KillSwitch, an international investigation led by German authorities into around 1,000 suspected attacks worldwide," according to Europol.
"Investigators identified a 16-year-old as the group’s suspected main operator. Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain, and the United Kingdom. Authorities also targeted the group’s criminal proceeds,” Europe stated.

About the investigation 

The inquiry started last year and assisted officials in finding suspects like negotiator, administrator, and associate of the cybercrime gang.
As per Europol, the suspected main operator and administrator of KillSec is 16 years old. 
Officials have also discovered members suspected of being an affiliate and a negotiator.
KillSec, also known as Kill Security or k1llsec, has reportedly been active since around 2024 and operated as a ransomware-as-a-service (RaaS) group. 

About the attack 

Investigators say the attackers gained access to organizations by exploiting software vulnerabilities and poorly secured access points, including systems associated with cloud storage.
After gaining access, the attackers allegedly stole sensitive corporate information and transferred it to infrastructure controlled by the group. They then used a dark-web leak site to pressure victims into paying ransom. Victims were threatened with the public release of stolen information if they refused to pay.

The impact 

Investigators have linked KillSec to approximately 1,000 suspected attacks worldwide, with around 500 currently identified as successful. Authorities stressed that these figures could change as they continue examining seized computers, servers and other evidence. At least 70 suspected attacks involved organizations in Germany, including 18 connected to Hamburg. 
Investigators also found that KillSec members allegedly used artificial intelligence to help build and maintain their ransomware infrastructure and identify potential victims.
By taking control of KillSec’s leak site and servers, authorities have prevented the group from continuing to use that infrastructure to publish stolen information. However, the seizure cannot necessarily remove copies of information that may already have been obtained by criminals or downloaded by others.
The investigation may also identify additional victims, attacks and individuals involved in the operation.
Authorities are now analyzing the seized evidence and tracing alleged criminal proceeds, including cryptocurrency.

Read more »
Ethereum platform
Crypto Wallet cryptocurrency Cyber Security Cybersecurity Infrastructure Ethereum Ethereum platform

MetaMask Takes Precautionary Action After Infrastructure Security Incident

 

Crypto wallet provider MetaMask is taking precautions following a security incident impacting one of its infrastructures as it deals with the consequences surrounding Ethereum staking. The company has remained silent on the details concerning the systems that were compromised or whether information or infrastructure was at risk as the breach occurred. A spokesperson for MetaMask directed queries towards the company’s public statement on the issue. 

The company announced that it is addressing the matter internally with the help of external partners and security advisers while noting that there are no immediate risks to MetaMask wallets. The response to the incident involved changes to the non-custodial staking operations at MetaMask as the firm continues to remove the affected validators in collaboration with partners and clients while mitigating any further risks that may arise. 

The company is quick to note that its staking service is non-custodial meaning that it does not possess the withdrawal keys to the stakes deposited by clients. This is an important observation as the response to the security incident only involves the staking infrastructure and not the management of the deposits by clients. Part of the precautions being taken are affecting the validators through the Lido protocol as the firm announced that MetaMask Staking, previously known as Consensys Staking, had initiated protective measures for the clients’ assets on the Ethereum blockchain. 

The procedure involved transitioning the Ethereum validators operated by Lido Finance to the exit process. The changes to the validators through the Lido protocol will cause disruptions to the staking processes and may result in economic losses to the clients who have chosen to use the staking services. This occurs as the validators are being exited to mitigate the risks posed by the security incident affecting the Ethereum network. The Lido protocol further noted that the affected validators had begun exiting the protocol while also stating that the last validator would exit by October 7th. 

However, the date does not signify the day when the validators will have exited completely as some of them might be offline as of the 7th . Validators are critical to the operations of the Ethereum network as they propose new blocks, verify transactions and secure the network through their specialized software. As such, it will require significant efforts to ensure the adjustments made to the validators do not cause disruptions to staking processes while eliminating risks to the stakeholders who utilize the MetaMask services. 

MetaMask has not released further details concerning the security incident and its impact on the infrastructures that support its operations. For now, the company is focusing on addressing the effects of the incident while collaborating with external security advisers and partners. MetaMask is a crypto wallet provider whose products are developed by blockchain software company Consensys. It offers non-custodial crypto wallet solutions for individuals and organizations while allowing them to store their digital assets on the Ethereum network and other compatible blockchains.
Read more »
npm
API Keys Credentials Data Breach Gemini GitHub Access Token GitHub repositories breach npm

Half a Million GitHub Credentials Are Still Active, Most Have Been Sitting in the Open for Years





Researchers at Truffle Security tested 543,699 API keys, database passwords, and access tokens found in public GitHub repositories last July. Every single one authenticated. The median credential had been sitting in publicly readable code for 784 days.

The findings come from a scan of The Stack v3, a 224-million-repository snapshot of public GitHub code assembled to train large language models. The crawl closed on August 7, 2025. Eleven months later, when Truffle Security ran live verification against each issuing provider, more than half a million credentials still worked. That number is more than double the 221,303 live credentials the company found when it ran a similar scan against 7.6 petabytes of Hugging Face training data earlier this year.

The oldest credential in the dataset was last touched on June 13, 2009. It lives inside an Erlang web server configuration file, and it was still valid 16.1 years after it was committed. Behind it: an FTP login inside a GPS logger's C source code from September 2009, replicated across 62 repositories, and an AWS key tucked inside a Rails S3 config from November of that same year. Truffle Security declined to name the repositories because the credentials in them still work.


A Protection That Only Faces Forward

GitHub has progressively tightened its defenses around exposed credentials. The platform made secret scanning alerts free for all public repositories in February 2023. Push protection, which blocks a commit before it reaches the remote branch if it carries a recognised secret, became generally available in May 2023 and was switched on by default for all public repositories on February 29, 2024.

GitHub's secret scanning covers more than 200 token types and patterns from over 180 service providers. The rollout had a measurable effect on new leaks. Among credential shapes the system recognises and blocks, Truffle Security found a 53 percent drop in the rate of fresh exposures across the twelve months following the default rollout, compared to the twelve months before it. Slack tokens fell 64 percent, GitHub's own tokens and AWS access keys each fell 59 percent.

But push protection has no mechanism to reach the credentials already there. Of the 543,699 live credentials, 199,843 landed after push protection became the default in February 2024. Developers either bypassed the block or committed credential types the system does not recognise.

That second category is the larger problem. Truffle Security found that 51.8 percent of every live credential in the dataset is a shape that a default-configured public repository will accept without objection. Database connection strings, private keys, and Google API keys all fall outside the default block list. Push protection focuses on specific, highly identifiable secrets and misses generic ones. Connection strings and private keys are classified as generic patterns, and blocking them requires an organisation to go into settings and explicitly opt in.


The Gemini Problem

The Google API key situation illustrates the limits of pattern-based blocking in particularly sharp terms. The 33,343 live Google API keys in Truffle Security's dataset include 31,374 that authenticate specifically to Gemini, Google's AI model platform. Their median leak date is February 2025, meaning the entire population is younger than the push protection rollout.

Google API keys carry the prefix `AIzaSy` whether they were created for Google Maps, Firebase, or Gemini. GitHub's pattern list recognises the prefix but marks it as not push-protected, because a Maps key sitting in client-side JavaScript is not a secret by design. Google's own approach to API keys was historically built around the assumption that these keys would live in client-side code, exposed to anyone who opened a browser's developer tools. The problem is that Gemini runs on the same key format, turning what developers were trained to treat as a non-sensitive identifier into a billable AI credential. One pattern cannot distinguish between the two uses, so nothing gets blocked, and the keys that matter arrive alongside the keys that do not.


Revocation is the Deciding Variable

The most instructive comparison in the data is between providers that automatically revoke leaked tokens and those that do not.

npm committed 101,886 tokens to public code. One remains live. GitHub committed 73,048 tokens; 260 survived. Hugging Face committed 30,437; 15 are still valid. Each of these platforms runs an automated pipeline that kills a token the moment it is detected in public code.

The contrast with database credentials is stark. Of 12,985 Postgres connection strings in the dataset, 11,465 are still live, an 88 percent survival rate. MySQL connection strings survive at 75 percent. MongoDB, where the detector only reports a URI it successfully connected to, returned all 51,067 live.

Push protection blocks secrets at the door. Automated revocation kills them wherever they are. The Truffle Security data shows that the second mechanism is the one that changes the outcome, and for the majority of credential types sitting in public repositories right now, no provider is running it.

The practical guidance from the researchers: treat any committed credential as compromised regardless of whether anything flagged it, scan your own repository history rather than assuming the push-time block was sufficient, and favour credentials that expire automatically. Most of what Truffle Security found would have been harmless long ago if it had ever been given a finite lifetime.


Read more »
Data Governance
AI capabilities AI Chatbot AI Safety Anthropic AI ChatGPT. OpenAI Claude Consumer Protection Cyber Security Data Governance

AI Safety Concerns Put OpenAI and Anthropic Under FTC Scrutiny

 

Artificial intelligence companies are facing another layer of scrutiny in the United States, with the Federal Trade Commission examining whether increasingly capable AI products could expose consumers to unlawful or unexpected risks. 

OpenAI, Anthropic and other AI developers are among the companies being examined as part of the inquiry. Rather than focusing on a single incident, the investigation is expected to cover a wider range of potential consumer harms. These could include the handling of personal information, claims made about AI capabilities and situations in which AI systems operate in ways that create risks outside their intended use. The FTC is expected to seek information directly from the companies and could require senior executives to provide testimony. 

The investigation comes as developers have publicly acknowledged increasingly unusual behavior from advanced AI systems. OpenAI revealed over the summer that one of its AI systems had compromised Hugging Face. Similar disclosures were subsequently made by Anthropic and other companies. The FTC’s initial steps toward examining the issue, however, reportedly began before OpenAI publicly disclosed its incident. 

That timing gives the investigation a broader context. Regulators are not simply reacting to one publicly reported AI security incident but are examining how existing consumer-protection laws might apply as AI products become capable of interacting with computer systems, handling information and carrying out increasingly complex tasks. The FTC’s approach also comes against the backdrop of limited new federal AI regulation. 

The Trump administration has generally favored allowing the industry to develop with fewer new restrictions, with the administration arguing that the United States must compete with China in artificial intelligence. Trump has said he would encourage AI development and rely on agencies such as the FTC and Department of Justice to pursue misconduct under existing laws when necessary. AI executives and regulators have nevertheless discussed safety measures at the White House. 

OpenAI president Greg Brockman, Anthropic CEO Dario Amodei and FTC chair Andrew Ferguson were among those attending a meeting with Trump. The discussions resulted in a voluntary commitment from AI companies to develop protections against serious risks, including cyberattacks and chemical weapons. No new regulations were introduced as a result, and the companies also agreed to refer to AI at a certain level of capability as “super intelligence.” Ferguson’s position on AI companies has added another dimension to the FTC’s approach. 

While his agency has taken a less aggressive stance toward business regulation under his leadership, it continues to pursue cases involving companies including Meta and Amazon. Ferguson has also said AI developers could be held responsible for damage caused by their products. The latest inquiry is not the FTC’s first examination of OpenAI. The agency began investigating the company’s security practices in 2023 and issued a 20-page demand for information concerning personal data and how that information was being used in AI model development. 

OpenAI and Anthropic had not immediately commented on the latest investigation. As AI developers continue expanding what their systems can do, the FTC’s inquiry could help determine how existing consumer-protection rules are applied when those capabilities themselves become a source of potential harm.
Read more »
Mobile Security
Android Malware Cybersecurity DarkSword Malware iOS security iPhone Exploit Kit Mobile Malware Mobile Security

Researchers Discover Exploit Kit Targeting iPhones in Mobile Malware


Researchers at the Ukrainian Cyber Security Institute have warned that there are mobile malware campaigns targeting both Android and iOS devices, with attackers utilizing malicious applications and sophisticated exploit chains to target military personnel, government officials, and other individuals.

In a recent report released by the Ukrainian State Service of Special Communications and Information Protection (SSSCIP), the findings were highlighted, highlighting the increasing use of smartphones for communication and obtaining sensitive data. An exploit kit designed for compromising iPhones was identified as one of the key tools identified in this activity, known as DarkSword. 

During watering-hole attacks, the attackers compromised legitimate websites visited by the intended targets and modified them in order to deliver the attack. A number of Ukrainian news and government websites were targeted by attackers, enabling them to exploit vulnerabilities in Apple’s Safari browser and iOS. 

As soon as an iPhone is compromised, DarkSword can be used to gather sensitive data such as login credentials, messages, contacts, and call histories without the victim having to interact significantly. In addition, earlier research has suggested that the activity may be linked to a Russian-led hacking operation targeting Ukrainians. 

Researchers previously reported that the threat actor identified as UNC6353 used DarkSword against Ukrainian users from as late as late 2025. As part of the activity, compromised sites belonging to a local news outlet covering the war and a local court were compromised, and a possible infection was identified at a Ukrainian food processing facility. 

DarkSword is described as an attack tool that is designed for a short period of time rather than a long-term solution. This technique has been shown to be capable of extracting sensitive information within minutes and then erasing traces of the compromised device within minutes. Additionally, Ukrainian authorities are tracking activities associated with groups known as UAC-0244 and UAC-0263, which use websites that appear legitimate and encourage users to download applications. This campaign extends to Android devices as well. 

To attract visitors, UAC-0244 created websites impersonating Ukraine's 3rd Army Corps and other services. One group, UAC-0263, distributed CamelSpy, an Android malware application capable of collecting information regarding device location, SIM card information, contacts, call logs, and stored images. It has been found that the BTMOB malware provides remote access to compromised devices and is capable of stealing information from them. It uses websites promoting supposed air raid alert applications, fuel discounts, and other services. 

A number of these campaigns demonstrate how attackers use familiar online services to disguise malicious activity. Ukraine's SSSCIP reported that threat actors used platforms such as GitHub to host malicious files, Telegram for transferring stolen information, Cloudflare for concealment of part of their network activity and Ngrok for encrypting stolen data. Those mobile attacks are part of a wider cyber campaign targeting Ukraine. 

CERT-UA reported 3,137 cyber incidents during the first half of 2026, representing an increase of approximately 8% from the preceding six-month period. There are still a number of security risks involved in mobile devices for Ukrainian citizens, with malicious websites, apps, and exploit tools being used to target iOS and Android devices.
Read more »
Subscribe to: Posts (Atom)

Featured