Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

data theft attack
Clop Gang Clop Ransomware Gang Cyberattacks Data Breach Data Leak data security Data Theft data theft attack

Clop-Linked Web Shell Targets PTC Windchill Servers in Data Theft Attacks

 

A custom Java web shell, associated with the Clop ransomware group, was created to target the PTC Windchill and FlexPLM servers by decrypting their credentials, enumerating file repositories, and stealing data. Researchers at cybersecurity firm ReliaQuest discovered the web shell after analyzing the recent data-theft campaign that abused the critical remote code execution vulnerability, CVE-2026-12569, affecting PTC Windchill. 

According to the researchers, the attackers did not use a traditional web shell to gain persistent access to the targeted servers. Instead, they used a custom component that demonstrated an in-depth understanding of the target application’s internal API, database schema, keystore, and file-vault structure. ReliaQuest notes that the discovered resource is an application-specific variation of the Clop ransomware group’s known mass exploitation framework. The web shell was linked to the Clop ransomware group because of extortion e-mails sent by the threat actors using the e-mail addresses associated with the data-leakage web site operated by Clop. 

In addition, the researchers identified X-windchill-req headers used by the web shell, which were also used by the Clop ransomware group in the past, as well as similar tactics, techniques, and procedures (TTPs). Earlier this year, Clop ransomware group’s infrastructure was found to target enterprise business software solutions such as Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. This campaign, which affected the MOVEit Transfer application, compromised more than 2,770 organizations worldwide. 

The web shell is implemented as JavaServer Pages (JSP), which directly imports the PTC Windchill-specific classes such as MethodContext, WTConnection, and WTKeyStoreUtil, giving the threat actors’ access to PTC Windchill’s native functions, including the database, encrypted credentials decryption, and locating files stored in the application’s vaults. The web shell’s command execution capability was established using the custom protocol that utilizes the HTTP X-windchill-req header. 

Overall, the custom component allowed the attackers to achieve multiple malicious objectives, including Windchill secrets and configuration data theft, file vault discovery and enumeration, directory listing, file retrieval and deletion, executing additional Java classes, and identifying the server’s operating system. Besides that, ReliaQuest reports that the web shell’s implementation contains the Windchill vault enumeration code that queries multiple Windchill database tables, namely ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. 

The PTC released a set of security updates to address CVE-2026-12569 on June 17. Additionally, the vulnerability was included in the CISA’s Known Exploited Vulnerabilities catalog earlier this week after the PTC reported active exploitation attempts in the wild. Ransom-ISAC confirmed that ransomware group Clop was behind the attacks by sending extortion emails to the employees of the targeted organizations. ReliaQuest recommends that all the JSP files found in the PTC Windchill directories should be investigated for any suspicious content and that the researchers should look for the X-windchill-req string. 

Moreover, the organizations that determined that their Windchill servers were compromised by the ransomware group should change the LDAP manager’s password and other user credentials because they are considered insecure and may have been leaked.
Read more »
Vatican Prayer App
API Vulnerability Click To Pray Data Breach IDOR vulnerability Privacy User Data Exposure Vatican Cybersecurity Vatican Prayer App

Vatican’s Official Prayer App Exposed Data of Over 700,000 Users


There was a security flaw in the Vatican's official Click to Pray application that exposed personal information linked to more than 700,000 registered users, but the vulnerability remained unknown until it was detected by an independent security researcher earlier this year. 

A worldwide prayer network developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer Network, Click to Pray was launched in 2019 with the endorsement of Pope Francis. Through this service, three daily prayers are delivered as well as papal content on Android, iOS and the web as part of a digital prayer platform. 

Independent researcher BobDaHacker discovered in January that API endpoints could provide information about users beyond the accounts associated with their requests. The underlying user IDs were sequentially assigned, making accessing records belonging to other registered accounts possible. 

Researchers identified 719,517 registered user IDs within the affected system, which indicates how much information is contained within that system. The vulnerability was addressed by the application developers earlier this year. There was a separate vulnerability in the Click to Pray API that also affected the verification process of email addresses. 

The vulnerability is not limited to user details. This API provided the validation hash that was used to verify an account's email address, which enabled attackers to potentially verify an account's email address without accessing the inbox itself. As a result of these weaknesses, multiple points of vulnerability were identified within the application's account system, in addition to the IDOR vulnerability. 

Researchers reported the vulnerability to the Pope's Worldwide Prayer Network and Click to Pray on January 3, 2026; however, no response has been received. Multiple attempts to contact relevant contacts have been made, but no response has been received. Over six months later, the issue was finally addressed after the researcher contacted a journalist, who brought the matter to the attention of the Vatican. 

A number of security issues have also occurred regarding Vatican-related applications in the past. According to reports, a vulnerability in the Vatican’s Bluetooth eRosary application has exposed account verification PINs in web responses, creating a potential route for account theft. In the latest incident, insufficient access controls highlight the risks associated with applications handling personal information. 

Although the Click to Pray vulnerability was reported to have been addressed, the episode raises broader concerns regarding security testing, vulnerability reporting processes and the protection of personal data within religious and public-facing digital services. The user information exposed to the exposure was not limited to this.

Click to Pray API also suffered a separate weakness, which affected the email verification process. A vulnerability in this API allowed attackers to potentially verify an account's email address without access to the actual inbox, resulting in multiple points of vulnerability within the application's account system. 

Combined with the IDOR flaw, the vulnerabilities created multiple points of vulnerability. Researchers indicated that the vulnerability was first reported to Click to Pray and the Pope's Worldwide Prayer Network on January 3, 2026. Multiple attempts were made to contact relevant contacts, however none were received. More than six months later, the researcher contacted a journalist, who raised the issue with the Vatican. This incident is the latest in a long-standing history of security issues involving Vatican-linked applications.

 A vulnerability in an application associated with the Vatican's Bluetooth eRosary app in 2019 led to the leaking of account verification PINs into web responses, resulting in the possibility of account hijacking. The latest incident illustrates the risks associated with applications handling personal information that lack adequate access controls.

 Despite the fact that the Click to Pray vulnerability has reportedly been rectified, the incident raises additional concerns regarding the security testing process, vulnerability reporting processes, as well as data security within religious and public-facing digital services.
Read more »
Privacy
Browser Browser VPN Security Chrome Data Cookies DNS Google HTTP Incognito mode ISP Privacy

Google’s Incognito Mode Does Not Make Users Invisible. Here’s What It Actually Protects

 



Google’s Chrome Incognito mode can keep browsing history off a device, but it was never designed to make users anonymous online. A class-action lawsuit over the feature exposed how far that distinction could be misunderstood, with Google agreeing to delete or remediate billions of private-browsing records and change how it explains Incognito to users.

The lawsuit, Brown v. Google, was filed in 2020 and alleged that Google continued collecting information about users while they browsed through Chrome’s Incognito mode and other browsers’ private-browsing modes.

The plaintiffs initially sought billions of dollars in damages, with their claims eventually putting at least $5 billion at stake. However, Google did not ultimately agree to pay $5 billion. Under the settlement, there was no class-wide monetary payout. Instead, Google agreed to data deletion and remediation measures, changes to its privacy disclosures, and additional restrictions on data collection. Plaintiffs’ lawyers valued the settlement’s non-monetary relief at more than $5 billion, with estimates reaching $7.8 billion.

The case nevertheless exposed a fundamental problem with private browsing: preventing a browser from retaining a user's history is not the same thing as preventing websites, network operators or online services from observing that user's activity.


Google employees raised concerns about Incognito

The legal dispute became particularly notable after internal Google communications surfaced during litigation.

In one email, Google Chief Marketing Officer Lorraine Twohill told CEO Sundar Pichai that the company should make Incognito "truly private." She also warned that Google could not market the feature too strongly because it was "not truly private," requiring what she described as "fuzzy, hedging language."

Other internal communications were even more critical of the feature. According to material cited in the litigation, Google employees described Incognito as "misleading" and "effectively a lie," while another employee argued that Google should stop using the Incognito name and its spy-themed icon because users could misunderstand the protection it provided. Another recommendation suggested replacing the messaging with a warning that users were not protected from Google.

These discussions mattered because the lawsuit was not simply about whether Incognito stored browsing history locally. It questioned whether users were being given a sufficiently accurate understanding of what happened to their data after it left the browser.

Google disputed the allegations and maintained that the limitations of Incognito had been communicated to users. A Google spokesperson said the company believed the lawsuit was without merit and argued that Incognito was intended to provide a private browsing experience, rather than prevent websites and services from collecting information.


What Incognito actually does

Chrome's Incognito mode does provide a real privacy function, but that function is primarily local.

When a user opens an Incognito window, Chrome starts a separate browsing session. Once all Incognito windows are closed, Chrome does not retain the browsing history, cookies and site data, or information entered into forms from that session in the normal browser profile. Third-party cookies are also blocked by default in current versions of Chrome, although users can temporarily allow them for particular sites.

This makes Incognito useful in situations where the concern is another person accessing the same device.

Someone using a shared computer, for example, can browse for a gift without leaving the visited pages in Chrome's ordinary history. It can also provide a separate browsing session when a user does not want existing cookies and account sessions to carry over.

But there is an important limitation.

Incognito does not erase everything created during a session. Downloads remain on the device, and bookmarks saved during the session remain available after Incognito is closed. Signing into a website can also allow that service to associate activity with the account being used.

The key distinction is therefore simple: Incognito primarily limits what Chrome stores locally. It does not turn the internet connection into a private tunnel.


Your ISP and network administrator can still see activity

Opening an Incognito window does not prevent an internet service provider from observing network activity.

Google's own documentation states that organizations managing a network, including schools, employers and internet service providers, may be able to observe activity while a user is browsing in Incognito. Incognito also does not hide activity or location from the websites being visited.

This is an important distinction from encryption.

Chrome's HTTPS protections can encrypt traffic between a browser and an HTTPS-enabled website, helping prevent someone monitoring the connection from reading the contents of that traffic. Chrome also warns users when they are about to load sites without HTTPS, while Secure DNS can encrypt DNS lookups in supported configurations.

But HTTPS does not make the user anonymous.

The network still has visibility into connection metadata, while the destination website receives the request and can process information available to it.

In other words, Incognito and HTTPS solve different problems. Incognito reduces local traces. HTTPS protects communications in transit. Neither one, by itself, is an anonymity system.


Websites can still identify and track users

The privacy boundary becomes even clearer once a user reaches a website.

Google's current Chrome documentation explicitly states that Incognito does not change how websites collect data or how the services those websites use collect information. Sites can continue gathering information even when a user is not signed in.

Websites can also use first-party technologies and other mechanisms to understand activity within a session. Third-party cookies are only one part of the tracking ecosystem. Google itself notes that websites can use different mechanisms to personalize content and advertising and learn about activity across sites.

This is also where the distinction between an IP address and browser history matters.

Incognito can prevent a local Chrome profile from retaining the list of pages a user visited. It does not automatically conceal the network address from the websites receiving the connections.

And if a person voluntarily signs into a service while using Incognito, the service has an obvious account-level identifier with which to associate the activity. Google's own documentation warns that signing into a Google service or another website during an Incognito session can allow that site to remember the activity.


The lawsuit forced changes to Incognito

The settlement went further than simply changing a warning message.

According to the court filing, Google agreed to delete or remediate billions of records reflecting class members' private browsing activities. The company also agreed to continue blocking third-party cookies in Incognito for five years.

The filing provides an unusually detailed picture of why the cookie change mattered.

Google had historically collected its own third-party cookies when users visited non-Google websites. After the lawsuit was filed, Google implemented third-party-cookie blocking for Incognito users. Under the settlement, that protection had to remain in place for five years. The plaintiffs' filing said blocking data associated with Google's third-party cookies in Incognito could reduce Google's global annual revenue by nearly $500 million.

Google also agreed to remove four identified private-browsing detection signals. According to the plaintiffs' filing, those signals could reveal that a user had chosen private browsing and were then used to label the resulting data as private. The settlement required Google to delete those signals and agree not to use such detection mechanisms to identify or track private browsing.

The class covered an estimated 136 million users, according to court-related filings.


Google eventually changed the warning

The dispute also changed the language presented to Chrome users.

Chrome's current Incognito documentation now makes the limitation explicit. It says that Incognito does not change how data is collected by websites users visit and the services those websites use, including Google. Google also says that websites, network administrators and ISPs may still be able to observe activity during an Incognito session.

That clarification is arguably more important than the Incognito icon itself.

The familiar private-browsing interface can create an intuitive association between the words "Incognito" and anonymity. Technically, however, the feature is much narrower. Chromium describes Incognito as a window-level mode in which pages are not persisted to browsing history and a temporary cookie store is used for the session.

That is a local privacy mechanism, not an invisibility cloak.


So, is Incognito worth using?

Yes, if the objective is local privacy.

If you share a computer with other people, do not want a particular browsing session stored in your ordinary history, or want a temporary browser session separated from your normal cookies, Incognito remains useful.

It is also useful for testing how a website behaves without the cookies and account state associated with a normal session.

But users should not treat the Incognito icon as a guarantee that their online activity is hidden.

It does not prevent an ISP or network administrator from observing activity. It does not stop websites from collecting information. It does not automatically hide an IP address. It does not prevent a user from being identified after signing into an account. And it does not protect files downloaded to the device after the session ends.

Users seeking stronger privacy need to think in layers rather than relying on a single browser setting.

A privacy-focused browser can reduce tracking at the browser level. Tracker and content blockers can limit third-party collection. A properly configured VPN can conceal the user's IP address from the websites they visit and hide destination traffic from the ISP, although the VPN provider itself becomes part of the trust model. Keeping the browser, operating system and extensions updated remains essential because privacy controls cannot compensate for an unpatched security vulnerability.

Chrome itself should also not be treated as static. Google continues to modify its privacy and security architecture. Third-party-cookie protections in Incognito are already part of the browser's privacy model, while Google has also explored additional protections for IP addresses in Incognito.

The larger lesson from the Incognito lawsuit is therefore not that private browsing is useless.

It is that privacy has layers, and the word "private" can mean very different things depending on where the data is stored, who controls the network and which services receive the user's requests.

Incognito can hide your browsing history from someone checking the same device.

It cannot make you disappear from the internet.

Read more »
EU
AI Act AI Threat Brussels Team Cyber Security EU

EU Launches New Brussels Team to Enforce AI Act Against Deepfakes and Hacking

 

The European Union rolled out a new enforcement team on Friday to rein in artificial intelligence companies worldwide, marking one of the most aggressive regulatory pushes the high-tech sector has faced. Brussels aims to track AI model use for violations of the bloc's new regulations, including sexually explicit material, fake photos, fake videos, and cyber threats to public infrastructure. The move comes as fears mount globally over the risks rapidly advancing technology poses to people, politics, and prosperity. 

With the EU's landmark AI Act coming into force on Sunday, AI companies must make clear to consumers, through labels or digital watermarks, that chatbots or imagery are generated using artificial intelligence. The European Commission stated that the regulations also address "systemic risks" posed by AI, including chemical, biological, radiological and nuclear incidents, loss of control, cyber offence, and threats to fundamental rights. "As enforcement begins, we are taking an important step towards AI that people and businesses can trust," said Henna Virkkunen, the EU tech sovereignty chief. 

The new team, operating within the EU AI Office in Brussels, will add 38 personnel to monitor AI companies, covering both emerging firms and major American and Chinese technology giants, including OpenAI and DeepSeek. The companies must document certain information, and the European Commission can interview AI company staff during investigations. The Commission has also launched a Whistleblower Tool for tech workers and a Compliance Tool for tech users, allowing people to confidentially alert authorities to illegal conduct. 

The rollout follows alarming AI safety failures that have rattled the nascent industry. Anthropic revealed on Friday that its artificial intelligence models hacked into three other organisations during testing, just days after ChatGPT maker OpenAI disclosed that its rogue models had hacked another company. If AI models break the EU's regulations, Brussels can fine the firms or cut off their access to the EU market. Recent antitrust fines on US technology companies have already irritated US President Donald Trump. 

The enforcement team is the latest move in the 27-nation EU's broader "tech sovereignty" strategy, combining landmark digital regulations with economic ambition. The EU sees systemic vulnerability in its deep reliance on American software giants like Amazon, Google, and Microsoft, alongside imports of Chinese industrial goods and critical minerals. While seeking protections from AI, the bloc is keen to catch up in the AI arms race, where it remains a distant third behind the United States and China. The EU is pursuing greater independence from Washington and Beijing by reinvigorating domestic industries and forging new trade deals.
Read more »
fake websites
Advertising Scams Amazon Cyber Fraud. Cyberscams Cybersecurity Delivery Scam fake websites

Amazon Handbook Warns About Online Shopping and Delivery Box Scams

 

Online shopping has become the new norm with millions of people shopping through online platforms like Amazon and Flipkart. Unfortunately, online shopping comes with its own set of risks as frauds and scammers always look for ways to take advantage of people who shop online. Fake websites, false delivery packages, payment frauds and ‘too-good-to-be-true’ deals are some of the methods used by fraudsters. 

Amazon’s new consumer handbook created by Safer Internet India aims to provide online shoppers with information that can help protect them against online frauds and scams. The book highlights some of the key online shopping scams that are currently affecting shoppers. It provides a vital reminder that shopping online involves many risks and consumers need to be wary of the various online scams that they might stumble upon.  

According to the article, one of the scams highlighted in the book is the Delivery Box scam. When customers shop on e-commerce sites like Amazon or Flipkart, the products they purchase usually come in a box with delivery information. According to the new book, the delivery box usually has the customer’s personal information including their names, email address, telephone number and sometimes the item that has been delivered. After removing the item from the box, many customers usually throw away the box without removing the personal information on the delivery label.

According to the report, fraudsters usually collect discarded delivery boxes with personal information and use the information to contact the customers. The fraudster pretends to be a delivery executive and informs the customer that they need their feedback on the product they purchased. The fraudster further explains that the customer stands to receive a discount of 10% or more if they click on a link provided to give feedback. According to the article, the link provided by the scammer contains malware which infiltrates the customer’s device and gathers private information including banking credentials. 

The article informs consumers that they should consider using a sharp object like a knife to scratch off personal information on delivery packaging before throwing the box away. Alternatively, they could use a permanent marker to mask vital information on the delivery box. The Identity Protection Roller Stamp ID could also be considered to protect personal information. 

Moreover, consumers should be wary of random discount offers and avoid clicking on links provided by unknown individuals or entities. The consumer handbook and warning on Delivery Box scams can help shoppers identify online frauds and protect themselves from falling victim to online scams.
Read more »
Google security
AI generated Deepfake AI image generation AI misinformation AI-generated misinformation Cyber Security Google AI model Google security

Google Pauses AI Tool That Created Fake Images in Google Earth

 

Google has disabled a newly introduced AI feature in Google Earth that allowed users to overlay computer-generated scenes on top of satellite, aerial and 3D images, after reportedly discovering the capability has been used to create misleading content. 

The feature, which used Google’s Nano Banana 2 image generation model, was rolled out on Thursday and disabled nearly 48 hours later, after the company became aware of screenshots of generated images that appeared to depict locations altered in ways that violated Google’s policies. While the company does not specify what prompted its intervention, it notes users “have a strong expectation of Google Earth as a source of authoritative information about the world.” 

Following the removal of the feature, BBC Verify was able to recreate several examples of altered scenes using the tool, including the Eiffel Tower lying in ruins, a sinkhole engulfing the Great Pyramids of Egypt and Russian tanks poised to enter Kyiv. AI and misinformation expert Henk van Ess was also able to demonstrate the ability to create misleading images of real world locations, including a fake nuclear power plant in Iran, a refugee camp along the US and Mexico border and a hospital in Gaza with a crater. “Not only do the images have questionable value as evidence, but the very act of associating them with real-world locations and Google’s own satellite imagery adds an element of credibility to the deception,” said Van Ess. 

Google stated that images generated by its AI model contain invisible watermarks and directed users to Gemini and Google Lens to analyze images and detect authenticity. However, BBC Verify was able to uncover ways to bypass these measures, as well as manipulate the prompt to avoid detection. Meanwhile, researchers found some AI detection tools were unable to identify images generated by the Google Earth tool. 

Henry Ajder, an AI detection researcher, noted that images of populated places and battlespaces could cause “incredible damage to populations if they were to appear as credible evidence of events on the ground.” “The danger comes when the situation on the ground is unclear or time-sensitive, and people are looking for reliable information,” he added. Geospatial analyst Bill Greer added that imagery of the Earth has long been considered a “trusted source” of information by both governments and the public, meaning its misuse could undermine confidence in the technology and its ability to provide truthful insight. 

The episode underlines the challenge facing both creators and users of AI imagery, as the ability to generate increasingly realistic images threatens to erode the value of other trustworthy sources of information.
Read more »
Third Party Leak
Amgen Cloud Breach Data Breach Patient Data Third Party Leak

Amgen Data Breach Exposes Patient Health and Proprietary Cloud Data

 

Amgen has disclosed a serious cloud-related data breach that exposed patient health information and proprietary company data, highlighting how third-party cloud services can become a weak point even for large biopharmaceutical firms. The company said it detected unauthorized activity in July 2026 and immediately activated its cybersecurity response plan, contained the incident, and brought in independent forensic experts to investigate. 

According to Amgen’s filing, attackers exfiltrated data from cloud environments operated by third-party service providers. The stolen information reportedly included proprietary data, protected health information, and other records, while the company continues to determine whether confidential business information, intellectual property, research and development data, or additional patient data was also accessed. 

Amgen has not identified which cloud providers were involved, how the compromise happened, or whether a known threat actor was responsible. It has also not disclosed how many people may be affected, but said the incident was considered material on July 29 after reviewing the volume of impacted files and the possibility that sensitive information was among them. 

The company said it does not currently believe the breach is likely to materially affect its financial condition or operating results, and it has not seen an impact on products, manufacturing, financial reporting systems, or its ability to meet patient needs. Even so, the exposure of protected health information creates long-term privacy and compliance concerns, especially if personal medical or insurance details were included in the stolen files. 

Amgen is still working with third-party cybersecurity experts and reviewing legal and regulatory notification requirements, including obligations under health privacy rules. The case is another reminder that cloud security is only as strong as the controls, monitoring, and vendor oversight behind it, and that incidents involving patient data can carry consequences long after the initial breach is contained.
Read more »
Technology
Counterfeit SSDs CPU Credential Theft Cyber Attacks GPU processors ransomware Technology

How Computers Can Leak Secrets Without Being Hacked

 



When people think about a cyberattack, they usually picture stolen passwords, malware, ransomware or someone exploiting a vulnerability to break into a system.

Side-channel attacks work differently. Instead of directly stealing a secret, an attacker studies the traces a computer produces while carrying out normal operations. Tiny differences in processing time, electricity consumption, electromagnetic signals, sounds or hardware activity can reveal clues about what is happening inside the machine.

Think of a locked safe. A thief may not know its combination or be able to break the lock, but if turning the dial produces different clicks or pauses, listening closely could reveal information about the combination. The safe is not deliberately revealing anything. Its physical behavior is simply giving away clues.

Computers can do much the same thing.


A problem that is decades old

Side-channel attacks are not a new phenomenon.

In 1985, Dutch researcher Wim van Eck demonstrated that electromagnetic emissions from video display units could be captured and decoded, potentially revealing what was being displayed. The screen was not intentionally broadcasting its contents, but its normal operation produced signals that could be observed externally.

The technique became particularly important in cryptography during the 1990s. In 1996, researcher Paul Kocher showed that measuring tiny differences in the time taken by cryptographic operations could reveal information about private keys. In 1999, Kocher, Joshua Jaffe and Benjamin Jun demonstrated that measuring power consumption could similarly expose information from cryptographic devices.

Researchers later showed that sound could become another source of leakage. Experiments demonstrated that acoustic emissions from laptops performing cryptographic operations could be analyzed to recover a 4,096-bit RSA key under controlled conditions.

These discoveries changed the way security engineers evaluated systems. A cryptographic algorithm could be mathematically secure while its implementation still leaked information through timing, power, sound or electromagnetic radiation.


When processor performance became a security problem

The rise of modern CPUs created another class of side channels.

Processors use speculative execution to predict which instructions a program will need and execute them ahead of time, improving performance. In 2018, researchers disclosed Meltdown and Spectre, demonstrating that traces left by speculative execution could allow malicious code to infer information that should have remained protected.

The attacks challenged an important assumption in computing: that programs running on the same machine can be reliably isolated from one another. They also demonstrated that security problems could originate from performance features built deep inside the processor rather than from conventional software bugs.

Researchers have continued finding similar problems in newer hardware.

In 2022, Hertzbleed showed that dynamic voltage and frequency scaling, a feature used to manage processor power and performance, could become a timing side channel. Because processor frequency can vary with the computation being performed, an attacker could potentially infer information remotely without directly measuring power consumption. The researchers demonstrated implications for cryptographic key extraction on modern Intel and AMD processors.

In 2023, Downfall exposed another weakness in certain Intel processors through the Gather instruction, while Zenbleed affected AMD's Zen 2 architecture and could expose information from another execution context under particular conditions.

The pattern is becoming difficult to ignore: features designed to make computers faster or more efficient can also create unexpected paths for information leakage.


Side channels are spreading beyond CPUs

Researchers are now finding these channels in other parts of the computing stack.

GPU.zip demonstrated how hardware-based graphics compression could create a side channel capable of exposing visual information processed by graphics processors. The research showed that the problem could extend beyond the CPU and into the way GPUs handle graphical data.

In 2024, GoFetch exposed another hardware-level problem in Apple processors. The attack targeted a feature called a data memory-dependent prefetcher, which predicts future memory requirements to improve performance. Researchers demonstrated that this behavior could undermine protections in cryptographic software and help extract secret keys.

These attacks illustrate why simply securing software is not always enough. Hardware underneath the software can produce information that applications never intended to expose.


The SSD can become a side channel too

The latest research pushes the idea even further.

In 2026, researchers at Graz University of Technology introduced FROST, short for "Fingerprinting Remotely using OPFS-based SSD Timing." The attack targets the browser's Origin Private File System, or OPFS, a feature that allows websites to store and access files within their own sandboxed storage area.

FROST does not give a malicious website direct access to another application's files.

Instead, it measures delays caused when multiple programs compete for the same SSD.

The concept is similar to traffic on a shared road. A driver does not need to see another vehicle to know that it is there. If traffic suddenly makes the journey slower, the delay itself provides information.

FROST applies the same principle to storage. A malicious webpage can repeatedly perform storage operations through OPFS and measure tiny changes in how long they take. Those changes can reveal patterns in other activity occurring on the same computer.

The researchers found that the technique could be used to fingerprint websites and applications. In their evaluation, FROST achieved an F1 score of 88.95% for website fingerprinting and 95.83% for application fingerprinting on tested systems. It can also operate remotely through JavaScript without requiring native code execution.

That does not mean websites can simply read a user's files or see everything happening on a computer. FROST is an inference attack. It identifies activity from the timing patterns produced by shared hardware resources.


A specialised threat, but an important warning

Side-channel attacks are not currently the everyday attack method most users are likely to encounter. Cybercriminals generally have easier options, including phishing, credential theft, malware, ransomware and exploiting vulnerable software.

But their importance extends beyond how frequently criminals use them.

Side-channel research repeatedly reveals that security boundaries can be weaker than they appear. A processor, GPU, browser or storage device may never intentionally disclose sensitive information, yet its normal operation can leave behind measurable clues.

From electromagnetic emissions and cryptographic timing to speculative execution, processor frequency, GPU compression and SSD activity, the side channel keeps changing as computing technology evolves.

Computers do not always need to be hacked for them to leak secrets.

Sometimes, all an attacker needs is to listen to what the machine reveals while it is doing its job.

Read more »
Social Engineering Attack
Credential Phishing Cybersecurity Data Breach Data Exposure RingCentral Data Breach ShinyHunters Social Engineering Attack

RingCentral Breach Exposes Personal Data of 1.6 Million Accounts


 

An attack on RingCentral, which was targeted at social engineering, has led to a data breach that could have exposed personal information of around 1.6 million individuals. In July, RingCentral detected the unauthorized activity during a campaign. The company said it immediately responded to the incident and launched an investigation with the assistance of an external forensic firm in order to contain the unauthorized activity. 

In light of the remediation measures implemented, RingCentral has not detected any further unauthorized activity. In addition, RingCentral clarified that only a limited number of its customers were affected by the incident and that those who were potentially affected were contacted directly. Furthermore, the company clarified that its services remain operational, and that its core platform was unharmed. 

Despite the lack of identification of the threat actor by the company, the ShinyHunters extortion group reportedly listed RingCentral on its Tor-based leak site in late July. As a result of the group's claim that they obtained over 623GB of data, there is further concern about the size of the attack. After investigating the leaked data, Have I Been Pwned confirmed that the dataset contains information associated with approximately 1.6 million accounts, including names, email addresses, telephone numbers, and physical addresses. 

The disclosure supports ShinyHunters' claims, even though RingCentral has not publicly attributed the incident to the group or provided details concerning how the attackers gained access to their system. A broader pattern of data theft attacks has been claimed by ShinyHunters against customers of major cloud and SaaS providers, including Salesforce and Snowflake, as well as the incident described above. This group has targeted third-party platforms and integrations increasingly, using stolen corporate data to extort companies. 

A recent lawsuit against Oracle PeopleSoft underscores the extent and persistence of the data theft operations of the organization. It has been possible for independent researchers to assess the scope of the exposure after publishing the 280GB archive. Has I Been Pwned reported approximately 1.6 million unique email addresses in the leaked data, along with names, telephone numbers, and physical addresses. 

A RingCentral representative has not independently verified the attacker's claims or disclosed the number of people affected. The incident also illustrates the effectiveness of voice-based social engineering, a strategy increasingly associated with ShinyHunters. Threat actors conduct these attacks by impersonating IT personnel and leading employees to a convincing login page with the intent of capturing passwords and authentication codes. It is possible that conventional one-time-password MFA will not be sufficient to prevent account compromise due to the attack's reliance on manipulating the employee rather than breaking the underlying security technology. 

As a result, security experts are increasingly recommending phishing-resistant methods, such as FIDO2 passkeys. These passkeys bind authentication to a legitimate website, preventing credentials from being regenerated through a fraudulent website. 

The details of the authentication method used by the compromised account have not been disclosed, nor have any controls been implemented to prevent phishing attacks. It is imperative to note that exposing names, phone numbers and physical addresses poses a risk beyond the initial compromise. These disclosures can provide attackers with sufficient context to carry out further impersonations and phishing attempts in a convincing manner. 

ShinyHunters has continued to focus on data theft and extortion rather than traditional ransomware, as demonstrated by the RingCentral incident, which illustrates how a single successful social engineering attack can lead to a much larger privacy and security issue as it progresses. 

The RingCentral incident has raised several questions, primarily regarding the extent of the exposure and the means by which the accounts were compromised. Have I Been Pwned has identified approximately 1.6 million email addresses in the leaked dataset, whereas RingCentral has described the customer base as limited. 

To determine the full impact of this incident, it is critical to reconcile those figures, along with more information about the compromised accounts, in order to determine the full extent. In organizations using RingCentral or similar cloud communication platforms, it is critical to establish strong defenses against social engineering at the earliest opportunity. During security awareness training, attention should be paid to suspicious calls, credential-harvesting websites, and requests for authentication codes. 

Organizations handling sensitive or regulated information should assess notification and compliance requirements for phishing attacks, multiple factor authentication, credential resets for potentially compromised accounts, and monitoring for follow-up phishing attacks and business email compromises. A wider question is raised by the incident about security at the intersection of technology and individuals. 

Even organizations with well-established security controls can be exposed if an attacker convinces an employee to bypass these controls. The breach thus serves as a reminder to RingCentral customers that safeguarding communication systems requires not only strong technical controls, but also preparation for social engineering tactics that are becoming increasingly convincing in order to target employees.
Read more »
malware
Atlassian DDOS Attacks Evooo1Bot FortiGuard Lab HTTP Linux botnet malware

Evooo1Bot Hijacks Linux Routers for Proxying, Credential Theft and DDoS Attacks



A new Linux botnet named Evooo1Bot is turning internet-facing routers and other gateway devices into SOCKS5 traffic relay nodes, giving attackers a way to route malicious connections through compromised systems while retaining the ability to steal credentials, brute-force SSH accounts, exploit vulnerable devices and launch DDoS attacks.

FortiGuard Labs said it has been tracking the Mirai-based malware since at least July 2026, with activity observed against devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across multiple regions. Rather than relying on a single attack function, Evooo1Bot combines several capabilities within a modular Linux malware framework.

The malware retains the DDoS engine from the publicly leaked Mirai source code, but expands on the older botnet's approach with encrypted command-and-control communications, an SSH brute-force scanner, a SOCKS5 relay, a credential sniffer and an exploitation module targeting known vulnerabilities.

Mirai's original success was closely tied to internet-connected devices such as routers, cameras and DVRs, many of which were exposed with weak or default credentials. Fortinet previously documented how Mirai could scan for vulnerable systems, brute-force credentials and recruit them into a remotely controlled botnet.

Evooo1Bot takes that model further by adding more ways to use a compromised device after the initial infection.

Its exploit arsenal covers a wide range of internet-facing technologies. Newer builds have been found with modules targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx and vulnerable PHP-CGI installations. FortiGuard noted, however, that some of the embedded exploits are incorrectly implemented and fail to compromise their intended targets.

When exploitation succeeds, the malware downloads a build suited to the victim's CPU architecture. FortiGuard identified 12 available builds, allowing the operators to target different Linux-based hardware rather than relying on a single binary.

The malware then attempts to make the compromise harder to trace. It clears Bash history and establishes persistence through mechanisms including systemd, SysV init, shell profiles and "rc.local". A cron job also attempts to download the payload again every five minutes, providing another way to restore the malware if it is removed.

Evooo1Bot also checks its surroundings before fully activating. It searches for debuggers, security software, sandboxes, virtual machines, containers and honeypots, indicating that the operators are attempting to distinguish ordinary victims from environments where the malware could be analyzed.

Its encrypted C2 communications operate over port 443, while an interactive shell gives operators direct control over infected systems. The malware also supports file uploads and downloads and uses a 28-command interface for remote operations.

The SOCKS5 component is where Evooo1Bot moves beyond the conventional DDoS-botnet model.

A SOCKS5 proxy can relay network connections through another system. In this case, the infected router becomes the intermediary, allowing attackers to send traffic through the victim's connection. Evooo1Bot supports both direct-listening and reverse-relay modes, which could help operators conceal the origin of malicious traffic, bypass geographic restrictions or reach networks accessible through compromised devices.

Multiple proxy sessions can operate independently, raising another possibility if the botnet expands: monetizing compromised residential connections as proxy infrastructure.

The malware also monitors "/proc/net/tcp" for network activity and attempts to capture HTTP Basic Authentication and Cookie headers. Alongside its shell and file-transfer functions, this gives operators additional opportunities to obtain information from systems positioned behind the compromised gateway.

SSH provides another route into vulnerable systems. Evooo1Bot uses 150 username and password combinations aimed at enterprise-oriented accounts and performs checks after successful authentication to identify possible honeypots.

DDoS remains part of the malware's toolkit, with 16 flood methods inherited from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP and customizable HTTP floods.

The result is a botnet in which a compromised router can serve several purposes at once: it can participate in DDoS attacks, relay traffic, collect authentication material, provide remote shell access and help operators compromise additional vulnerable systems.

For users and organizations, securing these devices starts with applying firmware and security updates, replacing default administrator credentials and disabling unnecessary remote-access interfaces. Unsupported equipment that no longer receives security updates should also be replaced.

Network defenders should additionally watch for unexpected outbound connections, unusual proxy traffic and unauthorized changes to cron jobs, startup services or shell profiles.

Evooo1Bot shows why internet-facing routers and gateways cannot be treated simply as passive networking equipment. Once compromised, they can become operational infrastructure for an attacker, extending the intrusion far beyond the device itself.

Read more »
Vulnerabilities and Exploits
Arbitrary code execution Commerce Cloud SAP Flaw Vulnerabilities and Exploits

SAP Commerce Cloud Vulnerability Targeted After Patch

 

A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched. 

The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments. 

Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities. 

SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise. 

If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.
Read more »
Vulnerability Discovery
Agentic Security AI Security AI Vulnerability Testing Claude Mythos Payment Network Security Visa Cybersecurity Vulnerabilities and Exploits Vulnerability Discovery

Visa Deploys Mythos to Uncover Vulnerabilities in Its Payment Network

During Anthropic’s Project Glasswing initiative, Visa evaluated Claude Mythos Preview against its global payment processing network. Operating across 200 countries and processing transactions across 160 currencies, Visa’s network connects 5 billion payment identifiers with more than 175 million merchant locations. 

Initial findings across participating critical infrastructure entities surfaced over 10,000 high- or critical-severity vulnerabilities within the initiative's first month. Beyond simple static scans, static flaw detection, the Mythos framework demonstrated the capacity to connect separate, minor flaws into across distinct network sectors into complex, composite attack chains. 

In response, Visa’s zero-trust architecture, network segmentation, and defense-in-depth controls successfully contained these hidden attack paths" or "potential entry points , keeping attackers from reaching them from the outside. After the Glasswing evaluation, Visa open-sourced its internal framework, the Visa Vulnerability Agentic Harness (VVAH). This system is meant to connect automated checks with reviews. 

VVAH has an 11-step process divided into four parts.

Contextual Threat Modeling
Using wide-ranging scans VVAH uses STRIDE/OWASP methods, in Phase 1 (Discovery & Modeling) to map the active attack surface before scanning. 

Noise Reduction & Consensus

Results are checked using paths where agents vote, which helps filter out false positives before alerting security teams. 

Model Agnosticism & Remediation Limits

Built on a vendor-neutral architecture VVAH works with Anthropic Claude and OpenAI-compatible tools during the checking steps. However full automatic code changes (Stage 10) and testing against attacks (Stage 11) still need models that can edit files directly. 

Visa’s adoption of these agentic security tools is part of a larger trend in enterprise measurement evolving past Mean Time to Detect (MTTD) and towards Mean Time to Adapt (MTTA), or how quickly an enterprise can validate, patch, and verify an exposure in their systems. To secure its software supply chain, Visa has required continuous software composition analysis and SBOM validation throughout their vendors. Visa is also involved with Project Lightwell, a collaboration between IBM, Red Hat, and Visa to help secure open-source components through AI-powered validation and patching processes. 

Visa ran Mythos against itself to prove that as offensive technologies become more automated in their reasoning, defensive systems need to be just as quick and sophisticated. “We open sourced VVAH to provide the community with a governed reference implementation and shift cybersecurity, so teams can patch flaws as fast as automated tools find them,” said Visa.
Read more »
macOS Security
Apple Critical Vulnerability cryptocurrency cryptocurrency mining CVSS Cyber Security iOS macOS flaw macOS macOS Security

Apple macOS Flaw Exploited in the Wild to Install Monero Cryptominers

 

A critical vulnerability in the recently updated Apple macOS has been weaponized by threat actors to mine Monero cryptocurrency, according to the Netherlands National Cyber Security Centre (NCSC-NL). The security flaw under identifier CVE-2026-65400 with a CVSS score of 9.8/10 impacts the macOS Screen Sharing component and is described as allowing ‘remote code execution via crafted network packets’. Apple released emergency security updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 this month to address the flaw. 

The tech giant explained the changes were related to an authentication issue, ‘fixing state management to ensure credentials are properly validated.’ The vulnerability was discovered by security researcher Alfredo Pesoli of Bynario. According to the NCSC-NL, there are currently reports of bad actors actively using this exploit. ‘Multiple systems with port 5900 open to the internet,’ the Netherlands-based watchdog stated in a report this week, ‘were compromised using this vulnerability.’ 

In all cases of exploitation detected so far, the attackers gained root access to the targeted systems and deployed a Monero cryptocurrency miner. It remains unclear how long the threat landscape had been targeting macOS Screen Sharing, how many systems had been impacted, and whether the mining activity was the sole motive behind the attacks. Several other flaws impacting the macOS Screen Sharing component have also been detected. 

They include CVE-2026-43760 which can lead to the disclosure of sensitive information, arbitrary file creation, and remote code execution under specific conditions; CVE-2026-43777, which may result in a denial-of-service scenario; and CVE-2026-43779 with a logic flaw that can cause applications to hijack connections from other processes. According to Pesoli’s research, there are additional privilege escalation possibilities in an older authentication method used by Screen Sharing, including VNC passwords. 

A threat actor with the VNC password could potentially access protected files or create new files with root permissions, resulting in remote code execution. The researcher also highlighted a pre-authentication vulnerability in the Screen Sharing daemon which, if successfully exploited, would allow an attacker to compromise a Mac with Screen Sharing enabled and without requiring a VNC password. ‘All the attacker needed was a target IP address,’ he added. 

His findings suggest that tens of thousands of Screen Sharing services were exposed to the internet, putting residential users, educational institutions, and corporations at risk. Researchers advise that Screen Sharing should not be exposed to the internet and recommend that such services be placed behind an IPsec or other secure access gateway. It is unclear how many macOS users had their systems compromised via the Screen Sharing flaw. 

However, cybersecurity analysts warn that AI-powered tools are facilitating faster threat modeling and detection, enabling attackers to exploit vulnerabilities almost immediately after they become publicly known. ‘We had an AI agent that helped us develop working exploits for two of the Screen Sharing vulnerabilities within hours of their disclosure,’ Calif, a security company, noted in a report. macOS users must install the latest software updates released by Apple to ensure their systems are protected against the newly discovered flaws. 

Customers who cannot immediately install the critical security patches should disable Screen Sharing in their Mac’s Sharing preferences until the updates are deployed.
Read more »
Trezor
Cryptocurrency Wallet Security customer data breach Data Breach Metabase vulnerability ShipMonk cyberattack Trezor

Trezor Data Breach Exposes Personal Information of Nearly 14,000 Customers

 

Hardware cryptocurrency wallet maker Trezor has disclosed a data breach involving the personal information of nearly 14,000 customers, after an unauthorized party gained access to data held by its third-party fulfillment provider, ShipMonk.

Trezor said its own infrastructure was not compromised and that the incident was discovered after the company was informed of the attack on August 10. The affected customers are located in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal and placed orders between May 10 and August 8.

According to Trezor, the breach exposed the names, phone numbers, email addresses and shipping addresses of 11,742 customers. Information belonging to another 1,947 customers included their names, cities and email addresses. The data had been provided to ShipMonk solely to facilitate order fulfillment and delivery.

“We’re extremely sorry to inform our community that customer personal information, including full names, phone numbers, email addresses, and shipping addresses, has been accessed by an unauthorized actor during this breach,” Trezor said in its security notice.

The company attributed the limited scope of the exposure to its 90-day data retention policy, which it said is also followed by its fulfillment partners. However, Trezor warned that older orders may have been accessible for some of the customers whose information was partially exposed.

Trezor stressed that the incident did not affect its internal systems or the security of its hardware wallets. “To be clear, our systems were not compromised, and your Trezor device is secure, but the affected customers might be targeted by more sophisticated phishing attempts,” the company said.

All customers believed to be affected have been contacted directly by email. Trezor urged them to remain cautious of unexpected messages, particularly those asking for personal details, cryptocurrency information or immediate action.

The company is working with ShipMonk to establish when the compromise occurred and determine the complete extent of the incident.

Reports indicate that ShipMonk informed customers that the attackers gained access to its systems by exploiting a vulnerability in Metabase, a data analytics platform. The incident may be connected to a recently patched SQL injection zero-day affecting Metabase.

The cybercrime group ShinyHunters has also claimed responsibility for an attack on Metabase and subsequently published data it alleged was stolen from the analytics provider. However, the connection between that incident and the ShipMonk breach has not been independently established.

ShipMonk has not publicly confirmed the breach. It also remains unclear whether other organizations or individuals were affected, how much information may have been accessed, and who was ultimately responsible for the attack.

Read more »
US Department of Justice
Cyber Security GrapheneOS GrapheneOS Foundation mobile privacy Sam Tunick US Department of Justice

GrapheneOS Foundation Defends Privacy Features Amid US Case Involving User

 The US Department of Justice’s recent case against GrapheneOS user Sam Tunick has renewed discussions about mobile privacy, digital security and the limits of law enforcement access to personal devices. The GrapheneOS Foundation has responded by defending its open-source operating system and clarifying how its security mechanisms handle deleted information.

The Toronto-based non-profit organization said GrapheneOS is a lawful operating system and rejected any suggestion that the software itself is connected to illegal activity. The foundation emphasized that it has no responsibility to weaken features intended to protect users and their data.

Based on Android and currently designed for Google Pixel devices, GrapheneOS incorporates several security and privacy protections. The foundation argues that developing, distributing or using the operating system is protected under US constitutional principles and that legislation specifically targeting its security capabilities could face constitutional challenges.

One of the features at the centre of the case is GrapheneOS’s "duress password." Tunick reportedly provided the password to a US Customs and Border Protection officer. The feature is designed to trigger an immediate wipe of a device when a specific password or PIN is entered under coercion.

When activated, the process removes the phone’s stored information, including eSIM data. According to the foundation, the wipe occurs immediately, cannot be interrupted and cannot subsequently be reversed. As a result, data erased through the feature cannot be recovered from the device.

Despite the attention surrounding the duress password, the GrapheneOS Foundation has stressed that it represents only one small component of the operating system’s broader security architecture. The organization also cautioned that using such a feature could potentially have physical or legal consequences, meaning users need to consider the risks before relying on it during encounters with authorities or other coercive situations.

The legal dispute is also focused on Tunick’s treatment during the encounter. His attorney has alleged that the border officer did not provide Miranda warnings and disregarded Tunick’s requests to consult a lawyer.

Tunick’s legal team is seeking the exclusion of evidence obtained during the incident. The attorney has argued that the evidence should be dismissed because the authorities allegedly violated Tunick’s constitutional rights.

The case has consequently raised broader questions about the balance between individual privacy, device security and government authority, while putting renewed attention on how privacy-focused operating systems handle data deletion and compelled device access.

Read more »
Zero-Day
DNS Attack Drift OAuth token hack email security exchange Laundry Bear microsoft OWA Zero-Day

Russian Hackers Use Exchange Zero-Day in Email Attacks

 



Russia-aligned cyberespionage group Laundry Bear, also tracked as Void Blizzard and TA488, is exploiting a Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a browser-based backdoor capable of maintaining access to victims' mailboxes even after credentials are changed or systems are reimaged.

Email security firm Proofpoint said it observed the campaign targeting government organizations in the US and Europe, as well as telecommunications, financial, hospitality and aerospace organizations. The activity uses OWAReaper, a sophisticated backdoor delivered through malicious emails exploiting CVE-2026-42897.

CVE-2026-42897 is a cross-site scripting vulnerability caused by inadequate HTML sanitization in OWA. A specially crafted email can contain malicious JavaScript that executes when the recipient opens the message in OWA. Proofpoint calls the technique a "half-click" exploit because opening the email can be enough to trigger the attack, without requiring the victim to click a link or open an attachment. Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation.

Proofpoint found that infrastructure associated with the campaign had been established as early as March, nearly two months before Microsoft's disclosure, suggesting TA488 may have exploited the vulnerability as a zero-day. The group used ordinary-looking subjects concerning supply chains, research updates, tourism, gas markets and other industry-related information, making the messages less likely to be treated as malicious.

The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons. Once triggered, the code assembled and executed the OWAReaper payload.

OWAReaper operates entirely within the OWA reading pane. It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.

The backdoor's most concerning capability is its persistence. It searches for Outlook add-ins with "ReadWriteMailbox" permissions and can use the "GetClientAccessToken" operation to obtain OAuth tokens. It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.

Because these permissions are stored server-side, changing the victim's password or reinstalling the compromised computer does not necessarily remove the attacker's access. OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.

The malware uses multiple channels for command and control. It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.

For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services. It also has a direct-server fallback and a DNS-based exfiltration mechanism that encrypts and Base32-encodes stolen data before transmitting it through DNS queries.

Proofpoint linked OWAReaper to TA488 based on behavioral similarities with ZimReaper, malware previously used by the group against Zimbra email servers. In that campaign, TA488 exploited another XSS flaw, CVE-2025-66376, to steal emails, passwords, application passcodes and two-factor authentication codes.

The latest campaign therefore represents an evolution of the group's "half-click" approach, shifting from compromising individual webmail sessions toward establishing persistent access within the victim's mailbox environment.

Microsoft has since released security updates addressing CVE-2026-42897. The July 2026 Exchange Server update states that the code fix is available, while organizations that previously applied Microsoft's mitigation must follow Microsoft's guidance to remove it after installing the update. The vulnerability affects on-premises Exchange Server deployments, while Exchange Online is not affected.

Proofpoint has published indicators of compromise for the campaign, including malicious domains and the HTML message body containing the exploit and OWAReaper payload. Organizations using affected on-premises Exchange deployments should therefore investigate not only compromised endpoints, but also mailbox permissions, OAuth tokens and OWA browser storage when responding to suspected exploitation.

Read more »
Iranian cyber group
Cyber Attacks cybercrime group Cybersecurity Agencies Hacking Attack Hacking Group Iranian cyber group

Iran-Linked Hackers Suspected in Cyberattacks Targeting Minnesota Water Systems

 

Several water systems in Minnesota were under attack from cyber intruders over the weekend. Investigators believe the attacks were launched from an Iranian hacking group called CyberAv3ngers. The attacks targeted approximately 30 water systems in Minnesota on Sunday and Monday and caused a brief interruption in the water supply for one community. 

The most significant attack was in the small town of Braham, located in the Minneapolis area, which was without water for two hours due to a cyberattack. The water supply was cut off, but it was quickly restored. Cybersecurity firm Tenable indicated that the attack methods used were similar to those previously used by the Iranian hacking group. US authorities are investigating whether Iran was behind the cyberattack on the water systems in Minnesota. 

However, officials do not believe that the attacks in Minnesota were carried out by Iran or that the attacks were orchestrated by the group CyberAv3ngers. The attacks in Minnesota occurred shortly after the US Cybersecurity and Infrastructure Security Agency issued an alert about attacks launched by Iran’s proxies on internet-connected systems controlled by infrastructure operators. This warning highlighted the potential for such groups to target critical infrastructure. Water utilities may be particularly vulnerable to such attacks since they use internet-connected machines to control and monitor operations. 

A relatively small amount of protection of these machines can allow hackers to intervene in the functioning of critical infrastructure, even if they cannot access the main corporate IT system. CyberAv3ngers has been accused of targeting industrial control systems by various companies, including water utilities, in the past. This hacking group has attracted increased attention from US authorities due to its suspected Iranian origin and potential access to critical infrastructure. The attack on Minnesota water utilities is part of a wave of cyberattacks launched against the US and its allies. 

Another hacking group, Handala, claimed to have attacked the medical equipment company Stryker and the payment processing company Verifone. Stryker confirmed that it was a victim of a cyberattack, while Verifone rejected the accusations. The group Handala claimed that it carried out these attacks in retaliation for the US-Israeli military operation against Iran. The attack by Handala was reportedly in response to the assassination of an Iranian military commander and the bombing of a school in Iran, which resulted in the death of more than 150 people. 

The US military investigation concluded that the attack on the school in Minab was due to the “inadvertent engagement” of the school by US aircraft, which was targeting a military installation. The attacks on the water utilities in Minnesota illustrate the potential for geopolitical tensions to spill over into attacks on critical infrastructure. Even though it is unclear whether the attacks in Minnesota were launched by Iran, the fact that they were able to occur highlights the need for increased protection of internet-connected infrastructure equipment, as well as monitoring and rapid response systems.
Read more »
Technology
Apple iPhone Mac Supply Chain Technology

Apple Warns of Supply Crunch as Demand Surges

 

Apple’s issue is a supply crunch: strong demand for iPhones and Macs is outpacing the company’s ability to secure key components, especially advanced chips and memory. The BBC report says Apple warned this could hit revenue in the coming months and that supply constraints are already limiting flexibility in the chain. 

What is happening 

Apple said the core problem is not weak demand but the opposite — sales are running hotter than expected, particularly for iPhone and Mac products. The company described the supply situation as “very significant,” with little room to quickly fix it. That means Apple can sell more devices than it can comfortably produce, which creates delays, pressure on inventory, and a risk of missed sales. 

The shortage affects some of Apple’s most important products, so even a strong quarter can come with a weaker outlook. Apple’s shares fell after the warning because investors tend to react sharply when a company says future growth may slow. The BBC also noted that Apple has already raised prices on some products, showing how supply costs are beginning to affect customers.

A major part of the problem is the cost and availability of memory chips, which have surged in price due to broader industry demand, including AI-related hardware needs. Reuters reported that Apple is also dealing with bottlenecks in advanced chipmaking technology used in its Apple silicon chips. In practical terms, this means Apple may have to pay more for parts, accept tighter margins, or pass costs on to buyers. 

Financial impact 

Despite the warning, Apple’s recent results were still strong, with iPhone and Mac sales rising sharply. But the company signaled that the next quarter may not keep pace if component shortages persist. That is why the story is less about a current collapse and more about a future squeeze on growth. 

Apple’s problem reflects a bigger technology trend: demand for chips is rising across consumer devices and AI infrastructure at the same time. When a company as large as Apple struggles to source parts, it often signals pressure across the wider electronics supply chain. In this case, the issue is a mix of extraordinary demand, limited supply flexibility, and rising component prices.
Read more »
Subscribe to: Posts (Atom)