Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

SSH keys
api tokens Linux Backdoor malware OPSSHIELD SSH keys

cPGuard Update Channel Hijacked to Deploy Linux Backdoor and Steal Server Credentials

 




A cyberattack targeting OPSSHIELD's software distribution infrastructure allowed an unidentified attacker to compromise cPGuard updates and deploy a malicious script across customers' Linux servers, harvesting password hashes, SSH keys, database credentials, and other sensitive information.

The incident began on November 2, 2026, when the attacker exploited compromised credentials to access OPSSHIELD's update distribution infrastructure. According to the company's investigation, approximately 2,950 customer servers executed the malicious update, while nearly 7,900 billing portal account records were also exposed.

cPGuard, OPSSHIELD's Linux server security solution, provides malware scanning, firewall management, and attack protection for web hosting environments, including servers running cPanel, DirectAdmin, and Plesk.


Compromised Update Infrastructure Delivered Malicious Script

OPSSHIELD's investigation traced the intrusion to its billing and licensing application. The attacker initially registered a customer account under a false identity on November 1 and requested a free cPGuard trial to examine communications between the software and its licensing infrastructure.

After probing the billing portal and submitting specially crafted requests, the attacker obtained command execution on the company's billing and licensing server. This access enabled the theft of credentials used to distribute software updates.

Between 02:04 and 02:09 UTC on November 2, the attacker uploaded a malicious update using a stolen access key. The compromised versions, ranging from 5.88.12 through 5.88.19, were distributed for approximately 70 minutes and executed with root privileges on servers checking for updates during that period.

OPSSHIELD detected the compromise within 12 hours and subsequently revoked the stolen update key.


Password Hashes and SSH Credentials Targeted

The malicious script collected sensitive system information and transferred it to OPSSHIELD's licensing infrastructure through a compromised account, allowing the attacker to retrieve the uploaded data.

The targeted files included "/etc/shadow" and "/etc/passwd", root's MariaDB/MySQL configuration ("my.cnf"), shell history, and SSH authorization and known-hosts files. The script also accessed root's SSH private keys and cloud storage credentials on some systems.

The "/etc/shadow" file contains password hashes rather than plaintext credentials. However, attackers can attempt offline password cracking against these hashes, particularly when passwords are weak, commonly used, or previously exposed. Database configurations and shell histories may contain credentials and API tokens that are immediately usable without requiring password cracking.

OPSSHIELD initially confirmed that attackers retrieved 32 collected files, each associated with a different customer server. Its subsequent disclosure estimated approximately 2,950 servers executed the malicious update.

The attackers also copied approximately 7,900 billing portal records containing customer names, company information, postal addresses, email addresses, and bcrypt-hashed passwords.


OPSSHIELD Releases Security Updates

The malicious script left several identifiable artifacts, including "cpguard-v58812-i91511.sh", a hidden root shell at "/var/tmp/.cpg91511_sh", and a collection directory at "/var/tmp/.cpg91511", containing the staged archive "loot.tgz".

OPSSHIELD's corrective updates remove the known backdoor and associated malicious files. However, removing these artifacts does not establish that a server was never compromised.

The company initially recommended updating to version 5.88.25 or later. Its subsequent disclosure identified version 5.88.26 as the clean release, which also addresses additional persistence mechanisms.

Administrators should run "cpgcli update --start" and verify the installed version using "cpgcli --version".

For potentially affected systems, OPSSHIELD recommends resetting local account passwords, rotating database credentials, S3 access keys, DigitalOcean tokens, and other exposed secrets. Administrators must also replace root SSH private keys and remove corresponding public keys from systems that previously trusted them.

Customers should additionally reset their OPSSHIELD billing portal passwords and enable two-factor authentication.

OPSSHIELD has also begun revoking its previously deployed support-access keys and rebuilding compromised internal infrastructure. Although the company initially did not recommend routine operating system reinstalls, its updated disclosure confirms that affected customer servers are being rebuilt where necessary.

Read more »
Cyber Security Ransomware Attacks
AI cyberattacks AI cybercrime AI Risks AI technology Cyber Attacks Cyber Researchers Cyber Security Ransomware Attacks

UK School Network Hit by 3AM Ransomware as Researchers Suspect AI-Assisted Intrusion

 

An incident involving ransomware against a UK school network has brought attention to how much of a factor AI is becoming in cybercrime. During the attack, an affiliate running 3AM ransomware utilised an unmanaged host to gain access to nearly half of the machines (encrypting approximately 37). 

This was discovered by Bitdefender. There were multiple indications during the investigation into the attack that AI could have been involved. There were multiple instances where the attacker was running similar commands with slight modifications between each run. These commands had approximately 40-100 second gaps between them. This could be seen as an automated agent, whereby the system would create commands, assess the outcome and adapt the next command. 

Bitdefender cannot confirm there was any involvement from a language model. As the machine the attacker was using could not be looked at by researchers, there is no way to confirm what model was used, or if it was local or remote. This is a purely an observation. The attack occurred between 10th and 19th of September. The initial method of gaining access is unknown. The attacker focused on gaining credentials and expanding their access. They used a modified public PowerShell tool to extract and decrypt credentials from 3 Veeam backup servers. They also extracted a Chrome database containing saved login information. 

Mimikatz and LSASS memory extraction tools were also deployed. The attacker also carried out further reconnaissance. They looked at domain relationships and searched login script folders to find any mention of other schools. They created 2 domain admin accounts called ‘library’ and ‘svc_bkpmon’ to give themselves persistence. Financial data was also extracted from the compromised machines. The attacker then created 2 way trust relationships between 3 previously separate Active Directory domains. 

Finally they attempted to disable endpoint protection. Sophos and Bitdefender were targeted for removal. System state backups were also targeted for removal. The affiliate then deployed the Rust based encryption tool from 3AM, impacting around 37 machines. 3AM first came to light in 2023 after being used by an attacker when LockBit was blocked. It has been linked to Conti and Royal ransomware gangs. 

The affiliates have been linked to Email Bombing and pretending to be IT support via spoofed calls. This group has previously been linked to major data leaks. Kootenai Health revealed an incident in August 2024 where personal data from over 464,000 patients was compromised. This investigation by Bitdefender shows there is concern around ransomware actors experimenting with AI assisted methods. 

Whilst it is unclear exactly how much AI was involved in this incident, this comes at a key time as the National Cyber Security Centre in the UK has released their annual ‘The State of the Cyber Nation’ report. They are urging organisations in critical infrastructure to be prepared for AI driven ransomware threats by 2028.
Read more »
Webshell Attacks
Active Cyberattacks Critical security flaw CVE-2026-58115 IOT Security Linux Bot Malware Node-RED Vulnerability Remote Code Execution Vulnerabilities and Exploits Webshell Attacks

Attackers Leverage Critical Node-RED Flaw to Gain Unauthorized Access


There is an active exploit of a critical security vulnerability in Node-RED by threat actors to install malicious Linux bots and webshells on vulnerable systems. It is believed that the attacks, detected by cybersecurity firm VulnCheck, could result in compromised instances and industrial environments being exposed to remote command execution and unauthorized access. 

Tracked as CVE-2026-58115, the vulnerability has a CVSS severity rating of 10.0. Node-RED HTTP interface does not contain authentication, allowing remote attackers to access programming functions and execute system commands on the underlying server if unauthenticated remote attackers are not authenticated. 

A browser-based editor enables users to build event-driven applications using Node-RED, an open-source, flow-based programming tool. It is widely used in industries including manufacturing, healthcare, home automation, and industrial control systems. A number of Siemens IoT2050 Advanced devices have been integrated with the platform, including Siemens SIMATIC IoT2050 Advanced devices.

Siemens disclosed the vulnerability on August 11, 2026, after identifying the issue with SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. In order to take advantage of this vulnerability, attackers could create malicious programming flows and execute arbitrary code with maximum privileges if it is successfully exploited.

A fix for the vulnerability is available in Siemens SIMATIC IoT2050 Advanced version 4.3.4.1 and later. Although security updates have been available, attackers continue to target vulnerable instances. A malicious request containing a complete exploit was captured by one of VulnCheck's monitoring systems on October 30, when it was detected as successful exploitation. This attack deployed a Node-RED flow, triggered its execution automatically, and downloaded a binary from a server controlled by the attacker. 

A malicious execution flow was initiated using Node-RED components, including the inject and execute nodes, without requiring additional interaction from the attacker. There has been no indication of the exact purpose of the downloaded binary, identified as bot-linux-amd64, which was stored under a hidden filename in a memory-backed location and executed in the background. 

Researchers were unable to retrieve the binary for further examination. During the exploitation campaign conducted between October 30 and November 1, repeated attempts were made from the same IP address. The attack vectors used by VulnCheck are 16 attempts to exploit CVE-2026-58115, with attackers delivering a variety of payloads across multiple requests. 

The address used by the attackers originates from Microsoft's AS8075 network, which is located in Brazil. A researcher cautioned that the use of cloud providers' networks does not necessarily identify threat actors, since such infrastructure may include virtual machines rented or compromised by cloud providers. Other attempts were made to install webshells, which gave attackers access to compromised servers and the ability to execute commands remotely, in addition to deploying Linux bots.

In some instances, additional shell scripts and files appeared to be legitimate Linux kernel processes. As opposed to the originally observed bot, which was stored in memory and could be removed when the system was rebooted, the webshells provided a more persistent method of access. In addition to identifying broader scanning activity from the same IP address, VulnCheck also recorded 125 requests targeted at eight different vulnerabilities affecting Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla. 

A survey of Node-RED installations indicates opportunistic mass scanning rather than activity concentrating exclusively on Node-RED installations Security experts have expressed concerns about the vulnerability of industrial environments through poorly secured Node-RED deployments. 

Industrial controllers are often integrated with databases, messaging systems and cloud services through this platform, allowing the platform to hold credentials for multiple connected systems. Consequently, a compromised instance could give attackers access beyond the initial server and facilitate movement across networks in the areas of information technology and operational technology. It is also important to note that Node-RED deployments are not always managed by dedicated IT security teams, increasing the risk. 

It is common for engineers and operational staff to configure Node-RED installations directly, thus preventing regular asset inventories and security monitoring. Additionally, scheduled maintenance requirements can delay firmware updates in industrial environments, resulting in vulnerable devices remaining exposed even after patches have been released.

CVE-2026-58115 has been added to VulnCheck's Known Exploited Vulnerabilities (KEV) catalog in response to the observed attacks. When reported, this vulnerability was not listed in CISA's KEV catalog. It is recommended that organizations using Node-RED apply security updates, enable authentication via the adminAuth setting, and restrict external network access to the editor. 

The security team should also examine deployed flows for unanticipated executable nodes, unauthorized HTTP endpoints, and suspicious file modifications. It is equally important to examine system logs and outbound network connections for signs of compromise, as installing patches alone may not remove webshells or other malicious components already present on the system.

Node-RED deployments exposed to industrial environments may pose security risks resulting from the active exploitation of CVE-2026-58115. It is recommended that organizations prioritize patching, enforce authentication, limit access to the editor and investigate for signs of compromise. In light of the possibility of existing webshells remaining after updates have been applied, security checks should accompany remediation efforts as well.
Read more »
VasyGrek
Cyber Crime Phishing Phishing Attacks Russia VasyGrek

Russia Takes Down VasyGrek Cybercrime Network After Years of Phishing Attacks


Russian authorities have arrested three suspected members of the cybercrime group VasyGrek, also known as Fluffy Wolf, and dismantled the infrastructure used to carry out its operations. The arrests follow an investigation conducted with assistance from cybersecurity firm Kaspersky.

About VasyGrek

According to Russia's Interior Ministry, the group has been active since at least 2016 and primarily targeted Russian companies through phishing campaigns. The attackers used fraudulent emails to steal login credentials, gain access to corporate networks and deploy malicious software on victims' systems.

Attack tactic

The group operated an extensive network of phishing websites designed to impersonate financial institutions and accounting services. It also relied on servers hosted in foreign countries and purchased remote administration tools through dark web marketplaces. These tools allowed attackers to secretly access compromised computers and control them remotely.

One incident involved a company employee who received a phishing email in September 2025. The message appeared to come from a business partner and contained a malicious attachment disguised as a routine financial document. After the employee opened the attachment, the attackers allegedly gained remote access to the computer and the company's online banking system.

The cybercriminals transferred more than 660,000 rubles, approximately $8,000, from the company's bank account to accounts under their control, according to the Interior Ministry.

Phishing campaign goes beyond Russia

The investigation also revealed that the group's activities had expanded beyond Russia. In research published in November 2026, Kaspersky reported detecting more than 100 attempted attacks attributed to VasyGrek between January and September this year. The attacks targeted organisations in Russia, Belarus and Kazakhstan.

According to Kaspersky, the group primarily focused on metallurgical companies, wholesale suppliers of raw materials and industrial products, and government organisations. Other targeted sectors included healthcare, oil and gas, energy, finance and agriculture.

Kasppersky described VasyGrek as a financially motivated cybercrime operation that relied heavily on targeted phishing emails and malware capable of providing remote access to compromised systems.

About the investigation

After the investigation, Russian police searched the suspects' homes and offices, seizing computers, communication devices and other materials believed to be connected to the group's activities.

The alleged leader of the group has been placed under house arrest, while two other suspects have been released under travel restrictions, according to Interior Ministry spokesperson Irina Volk.

The Russian Interior Ministry said the group's infrastructure had been dismantled. However, it remains unclear whether the arrests will completely stop its operations or prevent other members from continuing similar attacks.

Read more »
Trading Platforms
Cyber Crime Europol Investment Scam Online Fraud Trading Platforms

Europol Dismantles Global Investment Scam, Seizes 100+ Servers

 

A major international operation has disrupted an investment-fraud network that may have targeted victims in at least 50 countries. Coordinated by Europol and Eurojust, the action led to the seizure of more than 100 servers and the arrest of seven suspects. The investigation was led by Germany’s Itzehoe Public Prosecutor’s Office and involved authorities from Albania, Cyprus, Finland, Germany, Israel, Kosovo, and North Macedonia. Investigators estimate that victims lost more than EUR 4 million through fake online trading platforms. 

The scam followed a familiar but highly effective pattern. Fraudsters used misleading advertisements promising fast and substantial returns from cryptocurrency, foreign exchange, and stock trading. Victims were directed to websites that appeared to be legitimate investment platforms, where they were encouraged to make an initial deposit. Once money was transferred, the platform displayed fictitious profits to build trust and persuade victims to invest larger amounts. 

The deception became clear when victims attempted to withdraw their funds. Instead of receiving their money, they faced delays, excuses, and eventually a complete loss of contact from the supposed brokers. The scheme reportedly relied on a “crime-as-a-service” model: a company allegedly based in Cyprus and Israel supplied fraudulent trading websites to criminal groups, which then operated call centres to pressure victims into handing over their savings. 

The latest operation followed more than four years of investigation. It began in 2022 after a German couple reported that they could not withdraw money they had invested through an online trading platform. Early action that year resulted in two arrests and the seizure of evidence, while further interventions in 2025 helped investigators identify the infrastructure provider and suspected call-centre operators in Albania, Kosovo, and North Macedonia. 

During the coordinated action, police searched 17 locations, including a call centre in Kosovo, and seized servers, digital evidence, assets, and other materials. Seven suspects were arrested and are expected to face surrender or extradition proceedings to Germany. The case demonstrates how online investment fraud can operate across borders, combining fake websites, stolen personal data, and call-centre pressure tactics. Authorities’ message is clear: guaranteed high returns, urgent deposit requests, and difficulty withdrawing funds are major warning signs of investment fraud.
Read more »
Vulnerabilities and Exploits
Bitcoin Cerber CVE Ransomware South Korea Synology Vulnerabilities and Exploits

Synology NAS Owners Hit by C3RB3R Ransomware as Old Vulnerability Gets New Life

 



A ransomware strain called C3RB3R is actively hitting Synology network-attached storage devices, locking files and demanding bitcoin payments from victims who, in many cases, were running software patched nearly two years ago.

Synology confirmed the attacks on October 29, pointing to CVE-2024-10441, a critical remote code execution flaw in its DiskStation Manager operating system rated 9.8 out of 10 on the CVSS scale. The vulnerability was found at Pwn2Own 2024 by DEVCORE researchers Pumpkin Chang and Orange Tsai, and Synology patched it by December 2024 under security advisory SA-24:20. The patch has been available ever since. The fact that attackers are still finding success with it tells you something about how many users never applied it.

Once attackers get into a device, C3RB3R goes to work quickly. The ransomware skips 27 system directories and a handful of file types, then recursively encrypts everything else. Each file receives its own 256-bit encryption key generated on the fly, locked with ChaCha8 and then wrapped with RSA-2048, which means there is no way to crack it without the attacker's private key. The malware drops a ransom note called read-me3.txt into every affected folder, containing a six-digit victim ID and a Tor address. Files come out the other side with a .L0CK3D extension. Backups stored on the same NAS are not spared.

The ransom demand starts at 0.036960 bitcoin, which works out to roughly $2,952 at current rates. Victims who miss the five-day deadline see that figure double to 0.073920 BTC, or about $5,904. No free decryptor exists, and Synology has offered none. Affected users who do not have off-site backups are, for practical purposes, out of options.

Reports first surfaced in South Korea around October 28. Victims filed complaints with KISA, the country's internet security agency, but KISA declined to say how many devices were affected, what caused the intrusions, or what it was doing about them. Synology has similarly not disclosed how many users were hit, which device models were targeted, or when it first became aware of the campaign. A Taiwanese NAS research group that compiled damage cases found a common thread: in every instance they reviewed, the device's management interface was reachable directly from the internet, whether through router port forwarding, UPnP, QuickConnect, or a reverse proxy.

The attack timing is not coincidental. On October 25, four days before Synology issued its statement, a public proof-of-concept exploit for CVE-2024-10441 appeared on GitHub. That kind of public PoC typically compresses the window between disclosure and active exploitation to days, sometimes hours. Security researchers at 360 Security Team and Solar Emergency Response Team, who both published analysis on October 29, noted that the campaign appears to have kicked into gear almost immediately after the PoC dropped.

There is, however, a complication in Synology's explanation. The Solar team examined one affected device running DSM 7.4.1-90080 Update 1, a build that does not fit neatly into the SA-24:20 vulnerability timeline. The researchers have not ruled out other entry points, including vulnerable third-party packages, container services, or stolen credentials. No zero-day has been confirmed, but the mismatch has not been fully explained either.

Adding another layer, the 360 Security Team's analysis points to a different set of flaws entirely: CVE-2026-13639 and CVE-2026-13684, both scored 9.8, patched by Synology on September 18, 2026. Under 360's reading, these are "1-day" exploits built on patches that were barely a month old when the attacks began. If 360 is right, devices that only applied the 2024 patch would still be exposed.

Separately, Synology disclosed two more critical vulnerabilities in its PHP infrastructure, CVE-2026-109618 and CVE-2026-109619, affecting packages including Web Station, WordPress, Joomla, and phpMyAdmin. Synology says these flaws are not the C3RB3R entry point, but has advised users to patch them regardless. Security firm Genians found that 96 percent of internal-network devices running PHP were exposed.

Synology's guidance for users is practical if grim for those already affected. The company recommends running a Security Advisor scan, checking Task Scheduler for unfamiliar scripts, and reviewing User and Group settings for administrator accounts that were not created by the device owner. If either check turns up something unexpected, Synology says to contact its support team rather than attempt a manual cleanup. For everyone else, the advice is to update DSM immediately, enable automatic updates, and move backup jobs off-device using Hyper Backup or Snapshot Replication.

The patches for SA-24:20 are in DSM 7.2.1-69057-6, 7.2.2-72806-1, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. Synology PSIRT says it continues to monitor the campaign.



Read more »
VOLTA
AI Data Theft Infostealer malware VOLTA

VOLTA Malware Uses AI to Rank Victims by Value

 

A newly analyzed Windows infostealer called VOLTA-AUTODOXER shows how artificial intelligence is being absorbed into cybercrime—not merely to write phishing messages, but to help criminals decide whom to exploit. According to Cisco Talos, VOLTA is a mature, self-deleting information-stealing implant that adds an optional large language model (LLM) layer after it has already harvested sensitive data. Instead of leaving operators to manually review stolen logs, the malware turns that material into a structured victim profile and asks an AI model to rank the person’s assets by monetization value. 

VOLTA’s initial theft goes far beyond passwords. It can collect browser credentials, cookies, saved payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. It then enriches this haul using the victim’s own authenticated sessions—for example, searching Gmail for delivery or shopping receipts to confirm a home address, pulling Uber Eats or DoorDash history, and valuing Roblox inventory through a public marketplace lookup. The result is an unusually detailed dossier containing location clues, employer information, inferred birth year, card details, work platforms, and potentially valuable digital assets. 

The most concerning feature is the AI triage stage. VOLTA packages the collected evidence into JSON and sends it to OpenRouter with a prompt instructing the model to behave like a “forensic intelligence analyst” preparing a target assessment. The requested output includes a section called “WHAT THEY’RE WORTH,” ranking valuables into low, medium, and high monetization tiers, and another called “THEIR OPSEC,” assessing the victim’s security posture and password hygiene. In effect, the LLM acts as an analyst for the criminal, converting a raw credential dump into a prioritized, evidence-backed dossier. 

Talos also found that the malware anticipates AI safety guardrails. If the primary model refuses the request, VOLTA checks for refusal phrases and moves through a fallback chain of up to three models, using a low temperature setting of 0.2 to encourage consistent output. This design suggests deliberate engineering rather than accidental AI use: the operator expects refusals and has built resilience around them. The malware’s deployment model also points toward a crimeware-as-a-service arrangement, with build-time configuration slots for API keys and Telegram settings, allowing less-skilled buyers to receive AI-generated victim assessments directly. 

For defenders, the report highlights practical countermeasures: restrict unknown processes from launching Chrome in headless mode, alert on suspicious, headless usage, use hardware-backed credential storage, and revoke exposed tokens immediately after a suspected compromise. If a cryptocurrency seed phrase was stored in plaintext, Talos advises treating the wallet as fully compromised and migrating funds using a new seed generated on an air-gapped device. VOLTA’s broader lesson is that AI is shifting malware from broad, indiscriminate theft toward automated victim selection—reducing the human effort criminals need while potentially increasing the precision of their attacks.
Read more »
PetitPotam Attack
Active Directory Certificate Services AD CS Vulnerabilities Certificate Abuse Cyber Attacks ESC1 Exploit ESC8 Exploit Microsoft Teams Attacks NTLM Relay PetitPotam Attack

ESC1 and ESC8 Attacks Expose Active Directory Security Risks

 

Through Microsoft Teams, cybercriminals are impersonating IT support personnel in order to gain access to corporate systems and exploit vulnerabilities in Active Directory Certificate Services (AD CS). 


As the outcome of the social engineering and misconfigured certificate services, attackers obtained authentication certificates for privileged accounts, including domain controllers, through two human-operated intrusions identified by Microsoft Threat Intelligence. In accordance with Microsoft's investigation published on October 30, 2026, both incidents were initiated by attackers posing as internal IT or help desk staff through Teams messages and phone calls. 

By using names related to support and familiar-looking display names associated with external Microsoft tenants, attackers convinced employees to open Quick Assist, a remote assistance application on Windows, and provide the connection code to the attacker. It was through this process that the attackers were able to gain direct control over the targeted workstations. 

After gaining initial access, attackers transferred archive files into the Downloads folder and extracted the contents of the archive files into newly created directories resembling Windows update folders. The extracted files were executed using Python, Bun, or Java runtimes. By using these tools, malicious scripts could be executed from user-accessible locations, while renamed executables retained the metadata associated with legitimate software files. 

In order to conduct reconnaissance on the system and network, the attackers examined Windows versions, network configurations, running processes, and connections to internal domain infrastructures. The team also assessed AD CS configurations to identify potential privilege escalation opportunities. AD CS is a Windows service that is responsible for issuing digital certificates necessary for identifying users and computer accounts.

When certificate templates are not configured securely, attackers can obtain certificates representing privileged identities, which can then be used to authenticate without relying on the original password for authentication. After a password reset or reimage of the initial compromised workstation, these certificates may remain useful unlike conventional credentials. 

According to Microsoft, two certificates have been misused in the investigated incidents: ESC1 and ESC8. The first involved exploiting a misconfigured certificate template, which enabled attackers to obtain certificates for privileged accounts. NTLM relay attacks were carried out against AD CS Web Enrollment using PetitPotam to force a domain controller to authenticate to an attacker-controlled system. 

As demonstrated by these two incidents, even a seemingly routine interaction with IT support can be an entryway into identity-based attacks of greater scope. Neither intrusion exploited a Microsoft Teams vulnerability. By exploiting weaknesses in the certificate infrastructure and employee deception, the attackers were able to move beyond the compromised workstations originally compromised. 

ESC1 Abuse Leaves a Privileged Account Exposed

First, the attackers obtained authentication certificates for privileged accounts by exploiting a certificate template that was vulnerable to ESC1 attacks. As a result of Microsoft Defender's automated attack disruption, three highly privileged identities were affected in the initial wave, resulting in certificates for three highly privileged identities. Active sessions were disconnected, remote logons were blocked, SMB access was blocked, and accounts were restricted. 

A privileged account was, however, excluded from the automated response and continued to be accessible about 90 minutes later. An additional phishing wave targeted 16 users and a second workstation. In addition to blocking more than 1,000 attempts to access SMB files and logons, Defender also blocked certificates for eight more additional privileged accounts obtained by the attackers.

Using one privileged certificate, the attackers have already authenticated with a domain controller and initiated a DCSync operation that replicates password data from Active Directory. In spite of Microsoft's claim that containment limited further activity, it was not disclosed to the public how much credential information was obtained. 

An account excluded from automated containment provided another route to access the network. Attackers accessed a file server and executed a version of Rclone disguised as SearchApp.exe, which copied files from a network share to an external SFTP server. However, Microsoft did not disclose the volume of data that was stolen. 

PetitPotam and ESC8 Target Domain Controller Identity

Because the environment did not contain the ESC1 weakness, the second intrusion followed a different certificate-abuse path. Rather, the attackers used PetitPotam to initiate authentication between a domain controller and the system they were controlling from a domain controller. 

This NTLM authentication was then relayed to an AD CS Web Enrollment endpoint susceptible to ESC8. This enabled the attackers to request a certificate for the domain controller's machine account without knowing its password. As a result of using the issued certificate, the attacker was able to perform Kerberos PKINIT authentication, obtaining a ticket-granting ticket for the domain controller. 

This converted relayed authentication into certificate-based access to a highly privileged machine identity. It was detected that Microsoft Defender generated alerts regarding the ESC8 activity at the customer's site. The customer isolated the compromised workstation, after which Microsoft observed no further progression of the attack. 

Microsoft Recommends Reviewing Certificate Configurations 

This research highlights the importance of examining certificate infrastructure alongside endpoint and identity security. However, there is no specific patch available that addresses the entire attack chain because the intrusions relied on social engineering and configuration vulnerabilities rather than a software vulnerability.

An organization should verify unexpected IT support requests through internal channels, restrict communication from external Teams tenants, and limit access to approved tools for remote support. It is advisable for organizations to review certificate templates to ensure requester-supplied identity settings and unnecessary enrollment permissions are not used. 

It is recommended that Microsoft implement HTTPS and Extended Protection for Authentication (EPA) for AD CS Web Enrollment, while disabling NTLM whenever operationally possible. In addition to enabling certificate auditing and utilizing Defender for identity posture assessments, Microsoft also suggests enabling certificate auditing and identifying exposed templates and secure enrollment endpoints with Defender. 

The revokement of an unauthorized certificate and the publication of updated revocation information should occur when unauthorized certificates are discovered. A separate review of active tickets is necessary since revocation alone does not invalidate Kerberos tickets already issued. 

Windows Server 2025 is configured to enable EPA for AD CS by default, while Windows Servers 2022 and 2019 need to be configured manually by administrators. A manual response must also be assigned to accounts excluded from automated containment. 

Detection Indicators and Investigation:

Microsoft published three SHA-256 hashes associated with the initial-access scripts: 

JavaScript: 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 
Python: f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 
Python: 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 

Among the alerts included in the investigation are Microsoft Defender alerts regarding suspicious Teams activity, portable runtime execution, AD CS enumeration, certificate requests, NTLM relay, and Kerberos PKINIT. Microsoft provided four advanced hunting queries to assist in identifying related activity, though it is noted that each match requires further investigation.

The incidents were not attributed to known threat actors or disclosed by Microsoft when they occurred, nor was the date of the incident disclosed. Nonetheless, these cases demonstrate how help desk impersonation may result in certificate-based privilege escalation and demonstrate that incomplete containment may result in a compromised identity remaining accessible even after a substantial part of the attack has been contained.
Read more »
Hacker attack
AI Attacks AI Risks AI technology AI Vulnerability Detection Critical Infrastructure Cyber Attacks Hacker attack

UK Warns of Unprecedented Rise in Cyberattacks as AI Accelerates Vulnerability Exploitation

 

The United Kingdom could face an unprecedented increase in cyberattacks over the coming months as artificial intelligence enables hackers to identify and exploit security weaknesses at a much greater scale. National Cyber Security Centre (NCSC) Chief Executive Richard Horne is expected to issue the warning while presenting the agency’s annual report on Tuesday. 

Horne will argue that AI has not necessarily created entirely new methods of attacking systems. Instead, it is making long-standing vulnerabilities easier to discover and exploit, exposing weaknesses that organisations have failed to address for years. The warning follows a June alert from the Five Eyes intelligence alliance, which predicted that AI would fundamentally change both offensive and defensive cybersecurity capabilities. 

The alliance cautioned that the transformation could unfold within months rather than years. Growing numbers of vulnerabilities being identified by technology companies suggest that change is already underway. Horne is expected to point out that major technology providers are fixing hundreds of security flaws in individual updates, while the Linux kernel project addressed more than 1,000 vulnerabilities in a single month. 

AI is helping security teams identify and resolve weaknesses faster, but the same capabilities could also benefit attackers. The NCSC considers it highly likely that AI-powered malware will be used in a ransomware attack against British critical infrastructure by 2028. It also expects China and Russia to be routinely incorporating AI into their cyber operations by that time.  

The agency argues that AI is exposing existing security failures rather than creating them. Many organisations continue to rely on outdated systems, delay software updates and leave known vulnerabilities unpatched. Even attacks attributed to state-sponsored groups frequently exploit internet-facing applications with security fixes that were already available. 

Horne is also expected to criticise businesses for prioritising short-term savings over cybersecurity. He will highlight the continued use of end-of-life technology and delayed upgrades, warning that executives could eventually face serious consequences if attacks disrupt essential services, empty store shelves, cut electricity supplies or force businesses to close. The government is considering whether technology companies should be held liable for cyber incidents caused by insecure products, following plans announced in its budget to consult on the issue. 

The NCSC is also looking to use AI to strengthen Britain’s cyber defences. Project DROMOS, initially designed as a four-week pilot, was expanded into live government environments. Testing frontier AI systems reportedly identified hundreds of potential security issues, including critical vulnerabilities. The agency also plans to establish the £70 million National Exposure and Real-Time Vulnerability Centre, known as NERV Centre, to identify security weaknesses across critical infrastructure and the wider economy.

A further £60 million has been allocated to the first phase of Cyber Shield, a national network of AI agents designed to detect and block attacks at machine speed. The NCSC will provide the platform and threat intelligence, while cybersecurity companies and open-source developers will develop agents for use across organisations. 

The agency believes defenders could retain a structural advantage as AI transforms cybersecurity because they control the systems they protect and can monitor and modify their environments. However, maintaining that advantage will require investment, clear leadership and consistent security practices.
Read more »
Supply Chain
Alpine Linux Cyber Security GitLab RCE Supply Chain

Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack


Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure. 

The attacks targeted a maximum-severity vulnerability tracked as CVE-2026-97229, which carries a CVSS score of 10.0. Although Alpine Linux found no evidence that the attackers successfully executed malicious code or modified its software packages, the project said it could not completely rule out a breach.

Alpine Linux is a lightweight, open-source operating system widely used as the foundation for Docker container images. Its GitLab server hosts development repositories, code reviews and continuous integration (CI) jobs, including the build recipes used to produce Alpine software packages. This makes the server an important target for attackers seeking to compromise the software supply chain.

The vulnerability is caused by an integer overflow in Onigmo, the regular expression engine included in Ruby and used by GitLab's CI/CD system. If successful, this could allow the attacker to execute arbitrary code on the vulnerable server.

GitLab disclosed the vulnerability and released security fixes on October 12. However, Alpine Linux initially installed GitLab version 19.3.4 instead of the patched 19.3.5. The project later upgraded to version 19.3.6 on October 22, but the vulnerability remained because the required Ruby security patch was missing from Alpine's custom container image.

Attackers repeatedly crashed GitLab processes

According to Alpine Linux, an attacker created a new account and began submitting specially crafted CI configurations to its GitLab server on October 20-21.

The security team recorded eight worker crashes during the attacks. Four attempts reportedly progressed partway through the exploitation process before failing to complete. 

The attackers also downloaded Alpine Linux's GitLab container image, suggesting they may have been studying the server's configuration and preparing an exploit specifically designed for that environment.

The project later discovered that upgrading GitLab alone was insufficient to address the problem. The security fix required an updated version of Ruby, which was included in GitLab's official packages but was not present in Alpine's custom image.

No evidence of software tampering found

There were doubts about a possible software supply-chain attack. If attackers had successfully compromised the GitLab server, they could potentially have accessed user information, password hashes, two-factor authentication secrets, CI/CD credentials, integration tokens and private project repositories.

GitLab rebuilt from scratch

The project also advised users to change passwords reused on other websites and to pull the updated alpinelinux/gitlab:19.3.6 container image published on October 27. This image includes Ruby 3.3.13, which contains the necessary security fix.

Read more »
Vulnerabilities and Exploits
API CAPTCHA CVE Drupal Vulnerability E Commerce fraudulent activities orders sql injection Vulnerabilities and Exploits

Drupal Commerce Flaw Exposes Online Stores to Fraudulent Order Manipulation

 



Drupal has confirmed active exploitation of a highly critical access bypass vulnerability in its Commerce Core module, warning online retailers that attackers could manipulate orders and circumvent payment processes. The company has urged administrators to install the latest security updates and investigate existing transactions for unauthorized modifications.

Tracked as CVE-2026-118539, the vulnerability affects Drupal Commerce Core, a contributed module that enables websites to sell products and services through shopping carts, checkout systems and payment integrations. It also supports headless commerce architectures, where external applications interact with Drupal through APIs.

According to the original security advisory, certain application routes and entity fields do not have sufficient access restrictions, allowing unauthorized users to bypass established permission checks. This could enable attackers to manipulate commerce-related information, potentially causing direct financial losses for merchants.

Published on October 28 under advisory SA-CONTRIB-2026-254, the vulnerability received a Drupal security risk score of 21 out of 25, placing it in the highly critical category. Its assessment identifies the flaw as exploitable without authentication or special access requirements, regardless of the module's configuration.

Drupal has confirmed that the vulnerability is being actively exploited in the wild. However, its initial advisory did not disclose the attack methodology, affected organizations or the number of compromised websites.


Fraudulent Order Attempts Reported on Live Websites

Additional information published on October 29 by Centarro, the maintainer of Drupal Commerce, provides further insight into the exploitation activity.

According to Centarro, it received two reports from merchants who observed suspicious attempts to place fraudulent orders on their live websites. Following an investigation conducted alongside the Drupal Security Team, the maintainers stated that they had not found evidence of scripted or widespread exploitation beyond the initially reported sites.

The vulnerability affects both traditional, full-stack Drupal Commerce installations and headless deployments, although the potential attack paths differ depending on the website's architecture.

Centarro identified several suspicious transaction patterns that administrators should investigate. These include orders placed without corresponding payments, transactions marked as paid despite having no associated payment records, product prices modified without legitimate promotions, and unauthorized discounts, fees or other adjustments applied to orders.

Some reported attempts involved products listed at unusually low prices, including $0.01, while others used apparently normal prices to make fraudulent transactions less conspicuous.

The maintainers also warned that the vulnerability may have existed in earlier Commerce Core releases for several years. Exploitation was theoretically possible from version 8.x-2.18, released in May 2020, on installations using Drupal's JSON:API module. Other configurations became potentially vulnerable from version 8.x-2.25, released in June 2021.

Consequently, organizations should not restrict their investigation to transactions created shortly before the October security disclosure.


Security Updates and Additional Commerce Vulnerabilities

Drupal has released Commerce Core 3.3.13 and 8.x-2.41 to address CVE-2026-118539. Administrators running the 3.x branch should upgrade to version 3.3.13, while installations using the earlier 8.x-2.x branch should move to 8.x-2.41.

Centarro has also recommended updating the associated Commerce API, Commerce License, Commerce Shipping and Commerce Stripe modules, which received separate security releases. Websites that do not require write operations through JSON:API should consider restricting the interface to read-only access.

The October 28 security releases addressed several additional vulnerabilities across Drupal's contributed projects.

Among them, CVE-2026-118558 affects Commerce Stripe through a cross-site request forgery (CSRF) vulnerability. The module does not include a CSRF token in the return URI used during Stripe Connect authorization. An attacker could exploit this weakness by tricking an administrator into following a malicious link, potentially causing an order to be marked as paid without an actual payment.

Another issue, CVE-2026-118582, affects the CAPTCHA module. The vulnerability results from inadequate invalidation of previously solved CAPTCHA sessions, allowing an already-submitted protected form to be submitted again without completing another challenge. This could weaken protections against automated registrations, comment spam and login brute-force attempts. Drupal's advisory indicates that exploit code exists, although it does not confirm active exploitation.

Drupal also disclosed information disclosure vulnerabilities in Commerce Core and Media Alias Display. The former can expose information about unpublished product variations under certain JSON:API configurations, while the latter involves improperly configured caching that could expose files containing information intended to remain inaccessible.


Earlier Critical Drupal Vulnerabilities

The October disclosures follow another security release on October 14, when Drupal addressed two critical remote code execution vulnerabilities.

CVE-2026-108097 affects the Field UI module in Drupal Core, while CVE-2026-108099 impacts the contributed Entity List module. Although neither component independently exposes the vulnerabilities through its default functionality, certain contributed modules and custom implementations can introduce exploitable pathways. Drupal identified at least one potential attack path that does not require authentication.

Another vulnerability, CVE-2026-9082, involved SQL injection in Drupal Core's database abstraction API, affecting websites using PostgreSQL databases. The flaw could allow unauthenticated attackers to execute specially crafted database queries, potentially resulting in information disclosure, privilege escalation or remote code execution. The vulnerability was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog in May 2026 following confirmed exploitation.

With CVE-2026-118539 now confirmed under active exploitation, administrators should prioritize security updates, examine historical order records and verify that payment confirmations correspond to actual transactions before fulfilling orders. Centarro has also recommended comparing suspicious transactions against website access logs to establish whether they originated through legitimate checkout processes.

Read more »
Ukraine
Cyber Attacks Emergency alerts Russia Ukraine

Cyber-Attacks Target Ukraine and Russia Emergency Alert Apps

 

Ukraine and Russia have both reported cyber-attacks on their emergency warning applications, sending false alerts that briefly raised fears of nuclear, chemical, and street-fighting threats. In Ukraine, residents began receiving fake red-level air-raid notifications at around 22:47 local time on Sunday, followed by warnings of radiation, a chemical attack, and fighting in Kyiv. The alerts were cancelled within an hour, and Ukraine’s air force said there was no radiation threat, blaming Russian interference. Hours later, Russia said its own emergency ministry app had also been hit by a “massive cyber-attack,” although it insisted the country’s wider public alert system remained operational. 

The false messages caused understandable alarm, particularly in Kyiv, where residents are already accustomed to repeated warnings of drone and missile attacks. One resident, Olena, told the BBC that her first reaction was fear because she had prepared for blackouts and disruptions to heating and water, but not for a nuclear attack. She said later alerts written in Russian made her realise the application had been compromised, since official notifications normally arrive in Ukrainian. Ukraine’s emergency service urged citizens to rely on loudspeaker announcements and avoid clicking links from unknown sources. 

A possible tit-for-tat attack

The nature of the messages has led cyber experts to suspect hacktivist involvement rather than a highly disciplined state operation. Some alerts were informal and provocative, while a newly created Telegram channel linked to one message quickly attracted more than 15,000 subscribers and spread anti-Ukrainian propaganda. The BBC’s cyber correspondent reported that dozens of hacktivist groups have emerged on both sides since Russia’s full-scale invasion, often using attention-grabbing hacks for political messaging. However, no group has officially claimed responsibility, and it remains unclear whether the two incidents were directly connected.

The near-simultaneous attacks have also raised questions about retaliation. Reports suggest Ukraine’s Trivoha app was compromised first, followed shortly by Russia’s emergency app, prompting speculation of a tit-for-tat cyber exchange. A Ukrainian parliamentarian said he could neither confirm nor deny Ukrainian involvement in the attack on Russia, while arguing that Russia was likely behind the intrusion into Ukraine’s system. Russian officials, including President Vladimir Putin’s press secretary Dmitry Peskov, said government digital resources face constant cyber-threats, though they did not directly attribute the emergency app incident. 

The episode highlights how digital infrastructure has become a central battlefield in the Russia-Ukraine war. Beyond physical strikes, attacks on communications and warning systems can undermine public trust, create confusion during emergencies, and weaken civilians’ sense of security. UK Defence Secretary Wes Streeting said the identity of the attacker was not yet known but that Britain was monitoring the situation closely, while EU foreign policy chief Kaja Kallas described cyber-attacks as part of Russia’s broader warfare against Ukraine. As both countries continue exchanging strikes on energy and military targets, the hacking of emergency alert apps shows that the conflict is increasingly fought through screens as well as on the ground.
Read more »
Network Security
Botnet Attacks Cloudflare Threat Report Cyber Attacks Cybersecurity Threats DDOS Attacks DDoS Protection Distributed Denial Of Service DNS Amplification Mirai Botnet Network Security

Cloudflare Report Highlights Changing DDoS Attack Trends in Q3 2026

 

DDoS attack patterns have undergone a significant shift as a result of the latest Cloudflare DDoS threat report, with cybercriminals increasingly focusing on frequent, short-duration attacks in place of concentrated traffic floods. According to the company, 18.2 million network-layer DDoS attacks were mitigated during the third quarter of 2026, an increase of 208% from the previous period. 

It was published on October 29, analyzing attack activity between July and September. Cloudflare's threat intelligence team, Cloudforce One, also reported mitigating 14.4 trillion HTTP DDoS requests during the quarter. There were approximately 8,226 network-layer attacks per hour, which equates to one attack every 0.44 seconds. These findings provide an indication that attackers are altering their operational approaches. 

In Q3, Cloudflare recorded 251 attacks exceeding 1 terabit per second (Tbps), compared with 805 in Q3. This represents approximately a 69% decrease in attacks exceeding 1 Tbps. There was a significant increase in smaller, short-lived attacks as one of the most notable findings. According to Cloudflare, 96% of network-layer DDoS incidents lasted less than 10 minutes, while 98% generated traffic below one gigabyte per second. 

Even though these attacks have relatively low bandwidth, they can cause disruptions to websites, servers, and online services, particularly when infrastructures lack network capacity or are inadequately protected. Security teams that rely on manual investigation and response may have difficulty identifying and resolving these attacks due to their short duration, since attacks may end before analysts can identify and address Cloudflare's incident associated with DDoS-for-hire, commonly referred to as booters or stressers. 

The use of such services allows attackers to flood targeted websites without requiring sophisticated attack infrastructure. These campaigns targeted software development, gambling and gaming businesses, as well as information technology companies. As a consequence of law enforcement operations in 2026 that disrupted four major Internet of Things botnets: Aisuru, KimWolf, JackSkid, and Mossad, hyper-volumetric attacks decreased earlier in 2026. 

The reduction in compromised connected device threats has not been eliminated, however. Cloudflare has continued to observe emerging IoT botnet variants, including Dysphoria and Evooo1Bot, which indicates the ecosystem continues to operate despite disruption efforts. Additionally, Mirai-classified traffic remained substantial in August, reaching 57.23 petabytes in mitigation. 

Organizations should also monitor exposed network services as attack methods change. DNS resolvers and directory services accessible from the public internet can be abused to perform reflection and amplifier attacks. To prevent attackers from exploiting these systems to generate malicious traffic, security teams must ensure that these systems are properly configured and restricted. It is also evident that Cloudflare's findings point to a broader distribution of DDoS targets.

Although Media, Production & Publishing was the most attacked industry in Q3, the share dropped by approximately a quarter compared to its previous quarter. There was substantial activity in information technology, computer software, telecommunications, as well as internet infrastructure in Q3. The top ten also included Consumer Services and Adult Entertainment, ranking eighth and ninth respectively. Geographic targeting indicated similar changes. 

The United States regained its position as the most attacked country, followed by China, while Indonesia became third with 2.93% of recorded attacks. Among the sharpest increases occurred in Canada, which moved from 16th to sixth place after attacks targeted retailers, telecommunications companies, service providers, and marketing firms. Furthermore, Israel jumped seven places to reach tenth place after sustained DDoS activity occurred during September. 

Cloudflare attributed the increase to heightened tensions in the region and domestic political developments in September. With the increasing frequency of short-duration attacks, organizations relying on manual incident response face a particular challenge. In the event of a network-layer attack ending within ten minutes, security teams may not have time to investigate alerts and implement countermeasures before the attack ends. 

The repeated disruption of online transactions, customer-facing platforms and other internet-based services, regardless of whether or not they cause prolonged outages, can also adversely affect them. A significant component of modern DDoS protection is automated detection and mitigation, according to Cloudflare. With a global network of more than 330 cities and a reported capacity of 500 Tbps, Cloudflare provides protection across more than 330 cities. 

The company provides a free DDoS Botnet Threat Feed that assists hosting providers, cloud platforms and internet service providers in detecting malicious IP addresses and accounts related to botnet activity. Over 800 networks worldwide have enrolled in this service. DDoS protection must be capable of addressing both high volumes of attacks as well as repeated smaller disruptions, according to Q3 findings. 

The presence of new variants and changing traffic techniques continues to pose risks to internet-facing infrastructure, even as law enforcement operations reduce the frequency of some large-scale botnet attacks.
Read more »
Northflank
AI API Data Breach data security Northflank

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage


Cloud application hosting platform Northflank has warned customers to rotate their stored credentials and API keys following a security breach that resulted in unauthorized use of customers' artificial intelligence (AI) API keys.

Northflank provides a cloud-based platform that allows developers to deploy and manage applications, containers, databases and AI applications without having to manage the underlying infrastructure. 

About the incident

After the warning, Northflank advised customers to immediately change their environment variables and API keys stored on the platform. The company later issued a stronger warning, asking users to assume that all environment variables had been decrypted and that the sensitive information stored inside them had been stolen.

Environment variables are commonly used by applications to store sensitive information, including database passwords, cloud service credentials, authentication tokens and API keys. If attackers gain access to these details, they can use them to compromise other services, steal data or misuse accounts to generate unauthorized charges.

Northflank later confirmed that several customers had reported unauthorized use of AI API keys stored on its platform.

"Users have reported unauthorised use of AI API keys supplied to the Northflank platform," the company said in an update. It urged customers who had not yet changed their stored secrets to do so immediately.

The company also advised users to examine their AI service providers' usage and billing records for unusual activity. Any suspicious usage should be reported to Northflank and the relevant AI service provider.

According to the company's incident timeline, Wiz notified Northflank about the security breach at 11:43 UTC on October 30. Its engineering team began investigating the alert one minute later. Northflank initially introduced a network policy patch and deployed additional security updates at 12:50 UTC and 13:05 UTC. The company also requested assistance from Wiz's incident response team.

As part of its response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis databases. It also introduced audit logs for all customers, including users on free accounts, to help them identify suspicious activities.

According to Wiz, attackers are increasingly targeting environment variables that contain AI service credentials. Stolen API keys can be used in a practice known as LLMJacking, in which attackers exploit another organization's AI accounts to access expensive AI models without permission. They may also resell access to these services to other users.

In two cases investigated by Wiz, attackers used compromised enterprise credentials to make approximately 2.5 million requests to Amazon Bedrock, resulting in nearly $100,000 in AI usage charges.

Read more »
fake websites
AI Risks AI Scams AI Voice Scam Consumer Protection Cyber Security cybercriminals deepfake scams Digital Security fake websites

AI Scams: How Criminals Use Deepfakes, Fake Websites and Voice Cloning to Target Consumers

 

As criminals use Artificial Intelligence (AI) to help produce realistic scams such as fake online shopping sites, cloned voices and realistic fake videos, consumer protection authorities in the UK are urging shoppers to take extra care. 

National Trading Standards has published its first list of AI scams to help raise awareness of new methods being used by criminals. Fake online retailers are becoming an increasing problem. These look genuine by appearing to be family run and local in the UK. They may even appear professional with their website design and pictures of UK high streets and union jacks. 

However, when ordering from these businesses you could end up with cheap, mass produced items from countries like China. There are many other ways criminals are targeting consumers. It is easy to create a professional looking website with criminals using AI to clone real businesses. Romance scams are also a common method criminals are using. This allows them to keep track of personal details and have realistic conversations with victims for long periods of time. 

Criminals are using voice cloning and deepfake videos to pose as family members or close friends. They may pose as someone you know and ask for immediate financial help. AI can also be used to create highly personalised phishing emails, texts and social media posts, making it hard to tell if they are a scam. Classic signs of scams may no longer be reliable. 

As AI creates highly professional and realistic content, mistakes with spelling and grammar which used to be common in messages from scammers are no longer useful (Which?). National Trading Standards advises not to send money, gift cards or personal/financial details to people you haven’t met in person. 

Always confirm businesses are genuine before purchasing. This can include checking the address of a retailer is genuine. You can check if a company is authorised to give you financial advice using the Financial Conduct Authority’s Firm Checker. You can also contact employers directly. 

Do not assume people are genuine just because you recognise their voice. AI can create realistic audio and video. The main piece of advice is to stop and think before sending any money, giving out any information or rushing to help with an urgent request. Criminals often try to put pressure on you to get you to act quickly.
Read more »
wifi network
2FA AI Cloud Security Data Theft firmware Privacy Robots Technology vacuums wifi network

The Robot Vacuum in Your Living Room May Know More About You Than You Think

 





The device quietly navigating your living room floor might be doing more than picking up crumbs. Robot vacuums, now a fixture in millions of homes, collect data that goes far beyond what most buyers realize when they pull one off the shelf. Depending on the model, a connected vacuum can generate detailed floor maps, record cleaning histories, capture ambient audio through built-in microphones, and stream live video to an app on your phone. Some models let you monitor progress remotely, routing that footage and data through the manufacturer's servers. And while the machine charts a path between your couch and your coffee table, it may be quietly building a picture of how you live.

iRobot, maker of the popular Roomba line, spells out its data practices in its privacy policy. Connected models can send room names, floor types, detected objects, robot movements, and Wi-Fi network details back to the company. That is not a hidden clause buried in fine print, but it is something most consumers never read before buying. For businesses, this kind of information carries real commercial value: consumer behavior data, household layouts, and everyday habits are precisely the intelligence that advertisers and smart home companies have long sought.


The Flaw That Opened 7,000 Homes

In February 2026, a software engineer named Sammy Azdoufal set out to do something benign: control his DJI Romo vacuum with a PlayStation 5 controller. What he found was a flaw that handed him access to roughly 7,000 other people's vacuums across more than 20 countries.

Azdoufal, an AI strategy specialist, reverse-engineered how the Romo communicated with DJI's servers. The backend authentication system accepted his device token as valid for thousands of other users' devices. From that position, he could view live camera feeds, hear microphone audio, see floor plans and room layouts, and check battery levels and cleaning status. He reportedly watched a journalist's vacuum operating in that person's living room in real time.

"Devices promising convenience can invite unseen observers into private spaces." [Dallas Express, February 2026]

Azdoufal notified DJI immediately. The company closed the vulnerability by late February and attributed the problem to a permission issue in its MQTT communication system, deploying automatic updates that required no action from users. The Romo model was removed from DJI's online store two days later. DJI said no widespread misuse had been detected. Critically, Azdoufal did not bypass encryption or use any sophisticated hacking technique. The problem sat on DJI's server, where device data was stored in plain text and access controls were loose enough that a legitimate customer's token opened thousands of doors.

This was not an isolated episode. In 2024, hackers took over Ecovacs Deebot X2 robot vacuums in several American cities, steering the machines remotely and playing racial slurs through their speakers. Minnesota lawyer Daniel Swenson, one of the affected users, described the intruder: "I got the impression it was a kid, maybe a teenager."


What the Vacuum Actually Knows About You

The data a robot vacuum collects is more revealing than it first appears. Floor maps trace the layout of your home, including where you sleep, where you store valuables, and the shape of your living spaces. Object detection features identify furniture, shoes, and personal items. Layer microphone access on top of that and the device starts resembling something other than a cleaning appliance. A privacy policy describes what a company intends to do with your data. It does not guarantee the product is free of security vulnerabilities. An attacker who reaches a manufacturer's servers could access whatever has already been collected, regardless of what any policy says.


Buying a Vacuum That Collects Less

Not every connected vacuum poses the same degree of risk. Buyers wanting to limit their exposure should look for models that process navigation data locally rather than routing it through manufacturer servers. Matic, a smaller company, builds its vacuum around that principle: maps stay on the home Wi-Fi network and all processing happens on the robot itself. Remote app access is available, but only through encrypted cloud infrastructure with explicit user consent.

One distinction worth keeping straight: a camera-free model still generates maps and sends account data to the manufacturer. "No camera" and "no data collection" are not the same thing. Mandatory cloud features, with no option to use the device offline, are a signal worth weighing as a dealbreaker before purchase.


Steps for People Who Already Own One

For the millions of households already running a connected vacuum, a few changes lower the risk without requiring a new purchase. Set a strong, unique password and enable two-factor authentication on any linked account. Keep the vacuum's firmware updated. Disable remote viewing and other cloud-connected features unless you actually use them. The fewer connections left open, the smaller the surface available to anyone looking for a way in.



Read more »
Vulnerabilities and Exploits
ChatGPT OpenAI Share-Link Flaw User Security Vulnerabilities and Exploits

ChatGPT Share-Link Flaw Could Expose Private Chats and Hijack Sessions

 

A recently disclosed vulnerability in ChatGPT demonstrated how a maliciously crafted shared conversation link could execute attacker-controlled code within a victim’s logged-in session. The issue was identified by security researchers at Parameter, who demonstrated that the flaw could expose private conversations and allow actions to be performed using the victim’s authenticated account. The vulnerability was reported to OpenAI through its bug bounty program on October 18 and was remediated eight days later. OpenAI classified the issue as P1, its highest severity rating. 

The attack required no software installation, workspace membership, or separate login through the attacker. A victim could receive the malicious ChatGPT share link through email, a messaging platform, a support ticket, or social media. In the most reliable version of the attack, the victim opened the link and clicked the Preview button once. In a later variant, Preview opened automatically, meaning that merely opening the link was sufficient to trigger the attack. 

Once triggered, the malicious code executed within the victim’s ChatGPT session and could interact with ChatGPT’s signed-in APIs. The researchers showed that it could list recent conversations, access a private chat that had never been shared, and transmit part of its contents to an external server under their control. Because the code operated within an authenticated session, it had the potential to perform actions on behalf of the affected user. 

The vulnerability resulted from a combination of weaknesses in ChatGPT’s web architecture. ChatGPT’s Preview feature renders shared HTML in a sandboxed frame on a separate domain, intended to isolate it from the main ChatGPT application. However, an interactive graph in the shared conversation loaded the MathLive mathematics library into the main ChatGPT page. This library retained a message listener that accepted keyboard-related messages from any sender without verifying their origin. The researchers exploited this behavior to send raw HTML from the isolated Preview frame into the trusted main ChatGPT page. 

OpenAI reproduced both the code-execution and private-chat proof-of-concept demonstrations and implemented fixes across two versions of its web frontend. By October 26, both versions rejected the messages on which the attack depended. Parameter published its technical analysis on October 28 after the remediation, and OpenAI awarded a total of $5,000 through its bug bounty program. The researchers also noted that the issue reflected broader weaknesses in message-origin validation, HTML handling, and sandboxing, rather than a problem that could be resolved simply by blocking third-party scripts such as YouTube.
Read more »
Subscribe to: Posts (Atom)