Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Google security
AI generated Deepfake AI image generation AI misinformation AI-generated misinformation Cyber Security Google AI model Google security

Google Pauses AI Tool That Created Fake Images in Google Earth

 

Google has disabled a newly introduced AI feature in Google Earth that allowed users to overlay computer-generated scenes on top of satellite, aerial and 3D images, after reportedly discovering the capability has been used to create misleading content. 

The feature, which used Google’s Nano Banana 2 image generation model, was rolled out on Thursday and disabled nearly 48 hours later, after the company became aware of screenshots of generated images that appeared to depict locations altered in ways that violated Google’s policies. While the company does not specify what prompted its intervention, it notes users “have a strong expectation of Google Earth as a source of authoritative information about the world.” 

Following the removal of the feature, BBC Verify was able to recreate several examples of altered scenes using the tool, including the Eiffel Tower lying in ruins, a sinkhole engulfing the Great Pyramids of Egypt and Russian tanks poised to enter Kyiv. AI and misinformation expert Henk van Ess was also able to demonstrate the ability to create misleading images of real world locations, including a fake nuclear power plant in Iran, a refugee camp along the US and Mexico border and a hospital in Gaza with a crater. “Not only do the images have questionable value as evidence, but the very act of associating them with real-world locations and Google’s own satellite imagery adds an element of credibility to the deception,” said Van Ess. 

Google stated that images generated by its AI model contain invisible watermarks and directed users to Gemini and Google Lens to analyze images and detect authenticity. However, BBC Verify was able to uncover ways to bypass these measures, as well as manipulate the prompt to avoid detection. Meanwhile, researchers found some AI detection tools were unable to identify images generated by the Google Earth tool. 

Henry Ajder, an AI detection researcher, noted that images of populated places and battlespaces could cause “incredible damage to populations if they were to appear as credible evidence of events on the ground.” “The danger comes when the situation on the ground is unclear or time-sensitive, and people are looking for reliable information,” he added. Geospatial analyst Bill Greer added that imagery of the Earth has long been considered a “trusted source” of information by both governments and the public, meaning its misuse could undermine confidence in the technology and its ability to provide truthful insight. 

The episode underlines the challenge facing both creators and users of AI imagery, as the ability to generate increasingly realistic images threatens to erode the value of other trustworthy sources of information.
Read more »
Third Party Leak
Amgen Cloud Breach Data Breach Patient Data Third Party Leak

Amgen Data Breach Exposes Patient Health and Proprietary Cloud Data

 

Amgen has disclosed a serious cloud-related data breach that exposed patient health information and proprietary company data, highlighting how third-party cloud services can become a weak point even for large biopharmaceutical firms. The company said it detected unauthorized activity in July 2026 and immediately activated its cybersecurity response plan, contained the incident, and brought in independent forensic experts to investigate. 

According to Amgen’s filing, attackers exfiltrated data from cloud environments operated by third-party service providers. The stolen information reportedly included proprietary data, protected health information, and other records, while the company continues to determine whether confidential business information, intellectual property, research and development data, or additional patient data was also accessed. 

Amgen has not identified which cloud providers were involved, how the compromise happened, or whether a known threat actor was responsible. It has also not disclosed how many people may be affected, but said the incident was considered material on July 29 after reviewing the volume of impacted files and the possibility that sensitive information was among them. 

The company said it does not currently believe the breach is likely to materially affect its financial condition or operating results, and it has not seen an impact on products, manufacturing, financial reporting systems, or its ability to meet patient needs. Even so, the exposure of protected health information creates long-term privacy and compliance concerns, especially if personal medical or insurance details were included in the stolen files. 

Amgen is still working with third-party cybersecurity experts and reviewing legal and regulatory notification requirements, including obligations under health privacy rules. The case is another reminder that cloud security is only as strong as the controls, monitoring, and vendor oversight behind it, and that incidents involving patient data can carry consequences long after the initial breach is contained.
Read more »
Technology
Counterfeit SSDs CPU Credential Theft Cyber Attacks GPU processors ransomware Technology

How Computers Can Leak Secrets Without Being Hacked

 



When people think about a cyberattack, they usually picture stolen passwords, malware, ransomware or someone exploiting a vulnerability to break into a system.

Side-channel attacks work differently. Instead of directly stealing a secret, an attacker studies the traces a computer produces while carrying out normal operations. Tiny differences in processing time, electricity consumption, electromagnetic signals, sounds or hardware activity can reveal clues about what is happening inside the machine.

Think of a locked safe. A thief may not know its combination or be able to break the lock, but if turning the dial produces different clicks or pauses, listening closely could reveal information about the combination. The safe is not deliberately revealing anything. Its physical behavior is simply giving away clues.

Computers can do much the same thing.


A problem that is decades old

Side-channel attacks are not a new phenomenon.

In 1985, Dutch researcher Wim van Eck demonstrated that electromagnetic emissions from video display units could be captured and decoded, potentially revealing what was being displayed. The screen was not intentionally broadcasting its contents, but its normal operation produced signals that could be observed externally.

The technique became particularly important in cryptography during the 1990s. In 1996, researcher Paul Kocher showed that measuring tiny differences in the time taken by cryptographic operations could reveal information about private keys. In 1999, Kocher, Joshua Jaffe and Benjamin Jun demonstrated that measuring power consumption could similarly expose information from cryptographic devices.

Researchers later showed that sound could become another source of leakage. Experiments demonstrated that acoustic emissions from laptops performing cryptographic operations could be analyzed to recover a 4,096-bit RSA key under controlled conditions.

These discoveries changed the way security engineers evaluated systems. A cryptographic algorithm could be mathematically secure while its implementation still leaked information through timing, power, sound or electromagnetic radiation.


When processor performance became a security problem

The rise of modern CPUs created another class of side channels.

Processors use speculative execution to predict which instructions a program will need and execute them ahead of time, improving performance. In 2018, researchers disclosed Meltdown and Spectre, demonstrating that traces left by speculative execution could allow malicious code to infer information that should have remained protected.

The attacks challenged an important assumption in computing: that programs running on the same machine can be reliably isolated from one another. They also demonstrated that security problems could originate from performance features built deep inside the processor rather than from conventional software bugs.

Researchers have continued finding similar problems in newer hardware.

In 2022, Hertzbleed showed that dynamic voltage and frequency scaling, a feature used to manage processor power and performance, could become a timing side channel. Because processor frequency can vary with the computation being performed, an attacker could potentially infer information remotely without directly measuring power consumption. The researchers demonstrated implications for cryptographic key extraction on modern Intel and AMD processors.

In 2023, Downfall exposed another weakness in certain Intel processors through the Gather instruction, while Zenbleed affected AMD's Zen 2 architecture and could expose information from another execution context under particular conditions.

The pattern is becoming difficult to ignore: features designed to make computers faster or more efficient can also create unexpected paths for information leakage.


Side channels are spreading beyond CPUs

Researchers are now finding these channels in other parts of the computing stack.

GPU.zip demonstrated how hardware-based graphics compression could create a side channel capable of exposing visual information processed by graphics processors. The research showed that the problem could extend beyond the CPU and into the way GPUs handle graphical data.

In 2024, GoFetch exposed another hardware-level problem in Apple processors. The attack targeted a feature called a data memory-dependent prefetcher, which predicts future memory requirements to improve performance. Researchers demonstrated that this behavior could undermine protections in cryptographic software and help extract secret keys.

These attacks illustrate why simply securing software is not always enough. Hardware underneath the software can produce information that applications never intended to expose.


The SSD can become a side channel too

The latest research pushes the idea even further.

In 2026, researchers at Graz University of Technology introduced FROST, short for "Fingerprinting Remotely using OPFS-based SSD Timing." The attack targets the browser's Origin Private File System, or OPFS, a feature that allows websites to store and access files within their own sandboxed storage area.

FROST does not give a malicious website direct access to another application's files.

Instead, it measures delays caused when multiple programs compete for the same SSD.

The concept is similar to traffic on a shared road. A driver does not need to see another vehicle to know that it is there. If traffic suddenly makes the journey slower, the delay itself provides information.

FROST applies the same principle to storage. A malicious webpage can repeatedly perform storage operations through OPFS and measure tiny changes in how long they take. Those changes can reveal patterns in other activity occurring on the same computer.

The researchers found that the technique could be used to fingerprint websites and applications. In their evaluation, FROST achieved an F1 score of 88.95% for website fingerprinting and 95.83% for application fingerprinting on tested systems. It can also operate remotely through JavaScript without requiring native code execution.

That does not mean websites can simply read a user's files or see everything happening on a computer. FROST is an inference attack. It identifies activity from the timing patterns produced by shared hardware resources.


A specialised threat, but an important warning

Side-channel attacks are not currently the everyday attack method most users are likely to encounter. Cybercriminals generally have easier options, including phishing, credential theft, malware, ransomware and exploiting vulnerable software.

But their importance extends beyond how frequently criminals use them.

Side-channel research repeatedly reveals that security boundaries can be weaker than they appear. A processor, GPU, browser or storage device may never intentionally disclose sensitive information, yet its normal operation can leave behind measurable clues.

From electromagnetic emissions and cryptographic timing to speculative execution, processor frequency, GPU compression and SSD activity, the side channel keeps changing as computing technology evolves.

Computers do not always need to be hacked for them to leak secrets.

Sometimes, all an attacker needs is to listen to what the machine reveals while it is doing its job.

Read more »
Social Engineering Attack
Credential Phishing Cybersecurity Data Breach Data Exposure RingCentral Data Breach ShinyHunters Social Engineering Attack

RingCentral Breach Exposes Personal Data of 1.6 Million Accounts


 

An attack on RingCentral, which was targeted at social engineering, has led to a data breach that could have exposed personal information of around 1.6 million individuals. In July, RingCentral detected the unauthorized activity during a campaign. The company said it immediately responded to the incident and launched an investigation with the assistance of an external forensic firm in order to contain the unauthorized activity. 

In light of the remediation measures implemented, RingCentral has not detected any further unauthorized activity. In addition, RingCentral clarified that only a limited number of its customers were affected by the incident and that those who were potentially affected were contacted directly. Furthermore, the company clarified that its services remain operational, and that its core platform was unharmed. 

Despite the lack of identification of the threat actor by the company, the ShinyHunters extortion group reportedly listed RingCentral on its Tor-based leak site in late July. As a result of the group's claim that they obtained over 623GB of data, there is further concern about the size of the attack. After investigating the leaked data, Have I Been Pwned confirmed that the dataset contains information associated with approximately 1.6 million accounts, including names, email addresses, telephone numbers, and physical addresses. 

The disclosure supports ShinyHunters' claims, even though RingCentral has not publicly attributed the incident to the group or provided details concerning how the attackers gained access to their system. A broader pattern of data theft attacks has been claimed by ShinyHunters against customers of major cloud and SaaS providers, including Salesforce and Snowflake, as well as the incident described above. This group has targeted third-party platforms and integrations increasingly, using stolen corporate data to extort companies. 

A recent lawsuit against Oracle PeopleSoft underscores the extent and persistence of the data theft operations of the organization. It has been possible for independent researchers to assess the scope of the exposure after publishing the 280GB archive. Has I Been Pwned reported approximately 1.6 million unique email addresses in the leaked data, along with names, telephone numbers, and physical addresses. 

A RingCentral representative has not independently verified the attacker's claims or disclosed the number of people affected. The incident also illustrates the effectiveness of voice-based social engineering, a strategy increasingly associated with ShinyHunters. Threat actors conduct these attacks by impersonating IT personnel and leading employees to a convincing login page with the intent of capturing passwords and authentication codes. It is possible that conventional one-time-password MFA will not be sufficient to prevent account compromise due to the attack's reliance on manipulating the employee rather than breaking the underlying security technology. 

As a result, security experts are increasingly recommending phishing-resistant methods, such as FIDO2 passkeys. These passkeys bind authentication to a legitimate website, preventing credentials from being regenerated through a fraudulent website. 

The details of the authentication method used by the compromised account have not been disclosed, nor have any controls been implemented to prevent phishing attacks. It is imperative to note that exposing names, phone numbers and physical addresses poses a risk beyond the initial compromise. These disclosures can provide attackers with sufficient context to carry out further impersonations and phishing attempts in a convincing manner. 

ShinyHunters has continued to focus on data theft and extortion rather than traditional ransomware, as demonstrated by the RingCentral incident, which illustrates how a single successful social engineering attack can lead to a much larger privacy and security issue as it progresses. 

The RingCentral incident has raised several questions, primarily regarding the extent of the exposure and the means by which the accounts were compromised. Have I Been Pwned has identified approximately 1.6 million email addresses in the leaked dataset, whereas RingCentral has described the customer base as limited. 

To determine the full impact of this incident, it is critical to reconcile those figures, along with more information about the compromised accounts, in order to determine the full extent. In organizations using RingCentral or similar cloud communication platforms, it is critical to establish strong defenses against social engineering at the earliest opportunity. During security awareness training, attention should be paid to suspicious calls, credential-harvesting websites, and requests for authentication codes. 

Organizations handling sensitive or regulated information should assess notification and compliance requirements for phishing attacks, multiple factor authentication, credential resets for potentially compromised accounts, and monitoring for follow-up phishing attacks and business email compromises. A wider question is raised by the incident about security at the intersection of technology and individuals. 

Even organizations with well-established security controls can be exposed if an attacker convinces an employee to bypass these controls. The breach thus serves as a reminder to RingCentral customers that safeguarding communication systems requires not only strong technical controls, but also preparation for social engineering tactics that are becoming increasingly convincing in order to target employees.
Read more »
malware
Atlassian DDOS Attacks Evooo1Bot FortiGuard Lab HTTP Linux botnet malware

Evooo1Bot Hijacks Linux Routers for Proxying, Credential Theft and DDoS Attacks



A new Linux botnet named Evooo1Bot is turning internet-facing routers and other gateway devices into SOCKS5 traffic relay nodes, giving attackers a way to route malicious connections through compromised systems while retaining the ability to steal credentials, brute-force SSH accounts, exploit vulnerable devices and launch DDoS attacks.

FortiGuard Labs said it has been tracking the Mirai-based malware since at least July 2026, with activity observed against devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across multiple regions. Rather than relying on a single attack function, Evooo1Bot combines several capabilities within a modular Linux malware framework.

The malware retains the DDoS engine from the publicly leaked Mirai source code, but expands on the older botnet's approach with encrypted command-and-control communications, an SSH brute-force scanner, a SOCKS5 relay, a credential sniffer and an exploitation module targeting known vulnerabilities.

Mirai's original success was closely tied to internet-connected devices such as routers, cameras and DVRs, many of which were exposed with weak or default credentials. Fortinet previously documented how Mirai could scan for vulnerable systems, brute-force credentials and recruit them into a remotely controlled botnet.

Evooo1Bot takes that model further by adding more ways to use a compromised device after the initial infection.

Its exploit arsenal covers a wide range of internet-facing technologies. Newer builds have been found with modules targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx and vulnerable PHP-CGI installations. FortiGuard noted, however, that some of the embedded exploits are incorrectly implemented and fail to compromise their intended targets.

When exploitation succeeds, the malware downloads a build suited to the victim's CPU architecture. FortiGuard identified 12 available builds, allowing the operators to target different Linux-based hardware rather than relying on a single binary.

The malware then attempts to make the compromise harder to trace. It clears Bash history and establishes persistence through mechanisms including systemd, SysV init, shell profiles and "rc.local". A cron job also attempts to download the payload again every five minutes, providing another way to restore the malware if it is removed.

Evooo1Bot also checks its surroundings before fully activating. It searches for debuggers, security software, sandboxes, virtual machines, containers and honeypots, indicating that the operators are attempting to distinguish ordinary victims from environments where the malware could be analyzed.

Its encrypted C2 communications operate over port 443, while an interactive shell gives operators direct control over infected systems. The malware also supports file uploads and downloads and uses a 28-command interface for remote operations.

The SOCKS5 component is where Evooo1Bot moves beyond the conventional DDoS-botnet model.

A SOCKS5 proxy can relay network connections through another system. In this case, the infected router becomes the intermediary, allowing attackers to send traffic through the victim's connection. Evooo1Bot supports both direct-listening and reverse-relay modes, which could help operators conceal the origin of malicious traffic, bypass geographic restrictions or reach networks accessible through compromised devices.

Multiple proxy sessions can operate independently, raising another possibility if the botnet expands: monetizing compromised residential connections as proxy infrastructure.

The malware also monitors "/proc/net/tcp" for network activity and attempts to capture HTTP Basic Authentication and Cookie headers. Alongside its shell and file-transfer functions, this gives operators additional opportunities to obtain information from systems positioned behind the compromised gateway.

SSH provides another route into vulnerable systems. Evooo1Bot uses 150 username and password combinations aimed at enterprise-oriented accounts and performs checks after successful authentication to identify possible honeypots.

DDoS remains part of the malware's toolkit, with 16 flood methods inherited from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP and customizable HTTP floods.

The result is a botnet in which a compromised router can serve several purposes at once: it can participate in DDoS attacks, relay traffic, collect authentication material, provide remote shell access and help operators compromise additional vulnerable systems.

For users and organizations, securing these devices starts with applying firmware and security updates, replacing default administrator credentials and disabling unnecessary remote-access interfaces. Unsupported equipment that no longer receives security updates should also be replaced.

Network defenders should additionally watch for unexpected outbound connections, unusual proxy traffic and unauthorized changes to cron jobs, startup services or shell profiles.

Evooo1Bot shows why internet-facing routers and gateways cannot be treated simply as passive networking equipment. Once compromised, they can become operational infrastructure for an attacker, extending the intrusion far beyond the device itself.

Read more »
Vulnerabilities and Exploits
Arbitrary code execution Commerce Cloud SAP Flaw Vulnerabilities and Exploits

SAP Commerce Cloud Vulnerability Targeted After Patch

 

A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched. 

The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments. 

Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities. 

SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise. 

If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.
Read more »
Vulnerability Discovery
Agentic Security AI Security AI Vulnerability Testing Claude Mythos Payment Network Security Visa Cybersecurity Vulnerabilities and Exploits Vulnerability Discovery

Visa Deploys Mythos to Uncover Vulnerabilities in Its Payment Network

During Anthropic’s Project Glasswing initiative, Visa evaluated Claude Mythos Preview against its global payment processing network. Operating across 200 countries and processing transactions across 160 currencies, Visa’s network connects 5 billion payment identifiers with more than 175 million merchant locations. 

Initial findings across participating critical infrastructure entities surfaced over 10,000 high- or critical-severity vulnerabilities within the initiative's first month. Beyond simple static scans, static flaw detection, the Mythos framework demonstrated the capacity to connect separate, minor flaws into across distinct network sectors into complex, composite attack chains. 

In response, Visa’s zero-trust architecture, network segmentation, and defense-in-depth controls successfully contained these hidden attack paths" or "potential entry points , keeping attackers from reaching them from the outside. After the Glasswing evaluation, Visa open-sourced its internal framework, the Visa Vulnerability Agentic Harness (VVAH). This system is meant to connect automated checks with reviews. 

VVAH has an 11-step process divided into four parts.

Contextual Threat Modeling
Using wide-ranging scans VVAH uses STRIDE/OWASP methods, in Phase 1 (Discovery & Modeling) to map the active attack surface before scanning. 

Noise Reduction & Consensus

Results are checked using paths where agents vote, which helps filter out false positives before alerting security teams. 

Model Agnosticism & Remediation Limits

Built on a vendor-neutral architecture VVAH works with Anthropic Claude and OpenAI-compatible tools during the checking steps. However full automatic code changes (Stage 10) and testing against attacks (Stage 11) still need models that can edit files directly. 

Visa’s adoption of these agentic security tools is part of a larger trend in enterprise measurement evolving past Mean Time to Detect (MTTD) and towards Mean Time to Adapt (MTTA), or how quickly an enterprise can validate, patch, and verify an exposure in their systems. To secure its software supply chain, Visa has required continuous software composition analysis and SBOM validation throughout their vendors. Visa is also involved with Project Lightwell, a collaboration between IBM, Red Hat, and Visa to help secure open-source components through AI-powered validation and patching processes. 

Visa ran Mythos against itself to prove that as offensive technologies become more automated in their reasoning, defensive systems need to be just as quick and sophisticated. “We open sourced VVAH to provide the community with a governed reference implementation and shift cybersecurity, so teams can patch flaws as fast as automated tools find them,” said Visa.
Read more »
macOS Security
Apple Critical Vulnerability cryptocurrency cryptocurrency mining CVSS Cyber Security iOS macOS flaw macOS macOS Security

Apple macOS Flaw Exploited in the Wild to Install Monero Cryptominers

 

A critical vulnerability in the recently updated Apple macOS has been weaponized by threat actors to mine Monero cryptocurrency, according to the Netherlands National Cyber Security Centre (NCSC-NL). The security flaw under identifier CVE-2026-65400 with a CVSS score of 9.8/10 impacts the macOS Screen Sharing component and is described as allowing ‘remote code execution via crafted network packets’. Apple released emergency security updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 this month to address the flaw. 

The tech giant explained the changes were related to an authentication issue, ‘fixing state management to ensure credentials are properly validated.’ The vulnerability was discovered by security researcher Alfredo Pesoli of Bynario. According to the NCSC-NL, there are currently reports of bad actors actively using this exploit. ‘Multiple systems with port 5900 open to the internet,’ the Netherlands-based watchdog stated in a report this week, ‘were compromised using this vulnerability.’ 

In all cases of exploitation detected so far, the attackers gained root access to the targeted systems and deployed a Monero cryptocurrency miner. It remains unclear how long the threat landscape had been targeting macOS Screen Sharing, how many systems had been impacted, and whether the mining activity was the sole motive behind the attacks. Several other flaws impacting the macOS Screen Sharing component have also been detected. 

They include CVE-2026-43760 which can lead to the disclosure of sensitive information, arbitrary file creation, and remote code execution under specific conditions; CVE-2026-43777, which may result in a denial-of-service scenario; and CVE-2026-43779 with a logic flaw that can cause applications to hijack connections from other processes. According to Pesoli’s research, there are additional privilege escalation possibilities in an older authentication method used by Screen Sharing, including VNC passwords. 

A threat actor with the VNC password could potentially access protected files or create new files with root permissions, resulting in remote code execution. The researcher also highlighted a pre-authentication vulnerability in the Screen Sharing daemon which, if successfully exploited, would allow an attacker to compromise a Mac with Screen Sharing enabled and without requiring a VNC password. ‘All the attacker needed was a target IP address,’ he added. 

His findings suggest that tens of thousands of Screen Sharing services were exposed to the internet, putting residential users, educational institutions, and corporations at risk. Researchers advise that Screen Sharing should not be exposed to the internet and recommend that such services be placed behind an IPsec or other secure access gateway. It is unclear how many macOS users had their systems compromised via the Screen Sharing flaw. 

However, cybersecurity analysts warn that AI-powered tools are facilitating faster threat modeling and detection, enabling attackers to exploit vulnerabilities almost immediately after they become publicly known. ‘We had an AI agent that helped us develop working exploits for two of the Screen Sharing vulnerabilities within hours of their disclosure,’ Calif, a security company, noted in a report. macOS users must install the latest software updates released by Apple to ensure their systems are protected against the newly discovered flaws. 

Customers who cannot immediately install the critical security patches should disable Screen Sharing in their Mac’s Sharing preferences until the updates are deployed.
Read more »
Trezor
Cryptocurrency Wallet Security customer data breach Data Breach Metabase vulnerability ShipMonk cyberattack Trezor

Trezor Data Breach Exposes Personal Information of Nearly 14,000 Customers

 

Hardware cryptocurrency wallet maker Trezor has disclosed a data breach involving the personal information of nearly 14,000 customers, after an unauthorized party gained access to data held by its third-party fulfillment provider, ShipMonk.

Trezor said its own infrastructure was not compromised and that the incident was discovered after the company was informed of the attack on August 10. The affected customers are located in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal and placed orders between May 10 and August 8.

According to Trezor, the breach exposed the names, phone numbers, email addresses and shipping addresses of 11,742 customers. Information belonging to another 1,947 customers included their names, cities and email addresses. The data had been provided to ShipMonk solely to facilitate order fulfillment and delivery.

“We’re extremely sorry to inform our community that customer personal information, including full names, phone numbers, email addresses, and shipping addresses, has been accessed by an unauthorized actor during this breach,” Trezor said in its security notice.

The company attributed the limited scope of the exposure to its 90-day data retention policy, which it said is also followed by its fulfillment partners. However, Trezor warned that older orders may have been accessible for some of the customers whose information was partially exposed.

Trezor stressed that the incident did not affect its internal systems or the security of its hardware wallets. “To be clear, our systems were not compromised, and your Trezor device is secure, but the affected customers might be targeted by more sophisticated phishing attempts,” the company said.

All customers believed to be affected have been contacted directly by email. Trezor urged them to remain cautious of unexpected messages, particularly those asking for personal details, cryptocurrency information or immediate action.

The company is working with ShipMonk to establish when the compromise occurred and determine the complete extent of the incident.

Reports indicate that ShipMonk informed customers that the attackers gained access to its systems by exploiting a vulnerability in Metabase, a data analytics platform. The incident may be connected to a recently patched SQL injection zero-day affecting Metabase.

The cybercrime group ShinyHunters has also claimed responsibility for an attack on Metabase and subsequently published data it alleged was stolen from the analytics provider. However, the connection between that incident and the ShipMonk breach has not been independently established.

ShipMonk has not publicly confirmed the breach. It also remains unclear whether other organizations or individuals were affected, how much information may have been accessed, and who was ultimately responsible for the attack.

Read more »
US Department of Justice
Cyber Security GrapheneOS GrapheneOS Foundation mobile privacy Sam Tunick US Department of Justice

GrapheneOS Foundation Defends Privacy Features Amid US Case Involving User

 The US Department of Justice’s recent case against GrapheneOS user Sam Tunick has renewed discussions about mobile privacy, digital security and the limits of law enforcement access to personal devices. The GrapheneOS Foundation has responded by defending its open-source operating system and clarifying how its security mechanisms handle deleted information.

The Toronto-based non-profit organization said GrapheneOS is a lawful operating system and rejected any suggestion that the software itself is connected to illegal activity. The foundation emphasized that it has no responsibility to weaken features intended to protect users and their data.

Based on Android and currently designed for Google Pixel devices, GrapheneOS incorporates several security and privacy protections. The foundation argues that developing, distributing or using the operating system is protected under US constitutional principles and that legislation specifically targeting its security capabilities could face constitutional challenges.

One of the features at the centre of the case is GrapheneOS’s "duress password." Tunick reportedly provided the password to a US Customs and Border Protection officer. The feature is designed to trigger an immediate wipe of a device when a specific password or PIN is entered under coercion.

When activated, the process removes the phone’s stored information, including eSIM data. According to the foundation, the wipe occurs immediately, cannot be interrupted and cannot subsequently be reversed. As a result, data erased through the feature cannot be recovered from the device.

Despite the attention surrounding the duress password, the GrapheneOS Foundation has stressed that it represents only one small component of the operating system’s broader security architecture. The organization also cautioned that using such a feature could potentially have physical or legal consequences, meaning users need to consider the risks before relying on it during encounters with authorities or other coercive situations.

The legal dispute is also focused on Tunick’s treatment during the encounter. His attorney has alleged that the border officer did not provide Miranda warnings and disregarded Tunick’s requests to consult a lawyer.

Tunick’s legal team is seeking the exclusion of evidence obtained during the incident. The attorney has argued that the evidence should be dismissed because the authorities allegedly violated Tunick’s constitutional rights.

The case has consequently raised broader questions about the balance between individual privacy, device security and government authority, while putting renewed attention on how privacy-focused operating systems handle data deletion and compelled device access.

Read more »
Zero-Day
DNS Attack Drift OAuth token hack email security exchange Laundry Bear microsoft OWA Zero-Day

Russian Hackers Use Exchange Zero-Day in Email Attacks

 



Russia-aligned cyberespionage group Laundry Bear, also tracked as Void Blizzard and TA488, is exploiting a Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a browser-based backdoor capable of maintaining access to victims' mailboxes even after credentials are changed or systems are reimaged.

Email security firm Proofpoint said it observed the campaign targeting government organizations in the US and Europe, as well as telecommunications, financial, hospitality and aerospace organizations. The activity uses OWAReaper, a sophisticated backdoor delivered through malicious emails exploiting CVE-2026-42897.

CVE-2026-42897 is a cross-site scripting vulnerability caused by inadequate HTML sanitization in OWA. A specially crafted email can contain malicious JavaScript that executes when the recipient opens the message in OWA. Proofpoint calls the technique a "half-click" exploit because opening the email can be enough to trigger the attack, without requiring the victim to click a link or open an attachment. Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation.

Proofpoint found that infrastructure associated with the campaign had been established as early as March, nearly two months before Microsoft's disclosure, suggesting TA488 may have exploited the vulnerability as a zero-day. The group used ordinary-looking subjects concerning supply chains, research updates, tourism, gas markets and other industry-related information, making the messages less likely to be treated as malicious.

The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons. Once triggered, the code assembled and executed the OWAReaper payload.

OWAReaper operates entirely within the OWA reading pane. It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.

The backdoor's most concerning capability is its persistence. It searches for Outlook add-ins with "ReadWriteMailbox" permissions and can use the "GetClientAccessToken" operation to obtain OAuth tokens. It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.

Because these permissions are stored server-side, changing the victim's password or reinstalling the compromised computer does not necessarily remove the attacker's access. OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.

The malware uses multiple channels for command and control. It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.

For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services. It also has a direct-server fallback and a DNS-based exfiltration mechanism that encrypts and Base32-encodes stolen data before transmitting it through DNS queries.

Proofpoint linked OWAReaper to TA488 based on behavioral similarities with ZimReaper, malware previously used by the group against Zimbra email servers. In that campaign, TA488 exploited another XSS flaw, CVE-2025-66376, to steal emails, passwords, application passcodes and two-factor authentication codes.

The latest campaign therefore represents an evolution of the group's "half-click" approach, shifting from compromising individual webmail sessions toward establishing persistent access within the victim's mailbox environment.

Microsoft has since released security updates addressing CVE-2026-42897. The July 2026 Exchange Server update states that the code fix is available, while organizations that previously applied Microsoft's mitigation must follow Microsoft's guidance to remove it after installing the update. The vulnerability affects on-premises Exchange Server deployments, while Exchange Online is not affected.

Proofpoint has published indicators of compromise for the campaign, including malicious domains and the HTML message body containing the exploit and OWAReaper payload. Organizations using affected on-premises Exchange deployments should therefore investigate not only compromised endpoints, but also mailbox permissions, OAuth tokens and OWA browser storage when responding to suspected exploitation.

Read more »
Iranian cyber group
Cyber Attacks cybercrime group Cybersecurity Agencies Hacking Attack Hacking Group Iranian cyber group

Iran-Linked Hackers Suspected in Cyberattacks Targeting Minnesota Water Systems

 

Several water systems in Minnesota were under attack from cyber intruders over the weekend. Investigators believe the attacks were launched from an Iranian hacking group called CyberAv3ngers. The attacks targeted approximately 30 water systems in Minnesota on Sunday and Monday and caused a brief interruption in the water supply for one community. 

The most significant attack was in the small town of Braham, located in the Minneapolis area, which was without water for two hours due to a cyberattack. The water supply was cut off, but it was quickly restored. Cybersecurity firm Tenable indicated that the attack methods used were similar to those previously used by the Iranian hacking group. US authorities are investigating whether Iran was behind the cyberattack on the water systems in Minnesota. 

However, officials do not believe that the attacks in Minnesota were carried out by Iran or that the attacks were orchestrated by the group CyberAv3ngers. The attacks in Minnesota occurred shortly after the US Cybersecurity and Infrastructure Security Agency issued an alert about attacks launched by Iran’s proxies on internet-connected systems controlled by infrastructure operators. This warning highlighted the potential for such groups to target critical infrastructure. Water utilities may be particularly vulnerable to such attacks since they use internet-connected machines to control and monitor operations. 

A relatively small amount of protection of these machines can allow hackers to intervene in the functioning of critical infrastructure, even if they cannot access the main corporate IT system. CyberAv3ngers has been accused of targeting industrial control systems by various companies, including water utilities, in the past. This hacking group has attracted increased attention from US authorities due to its suspected Iranian origin and potential access to critical infrastructure. The attack on Minnesota water utilities is part of a wave of cyberattacks launched against the US and its allies. 

Another hacking group, Handala, claimed to have attacked the medical equipment company Stryker and the payment processing company Verifone. Stryker confirmed that it was a victim of a cyberattack, while Verifone rejected the accusations. The group Handala claimed that it carried out these attacks in retaliation for the US-Israeli military operation against Iran. The attack by Handala was reportedly in response to the assassination of an Iranian military commander and the bombing of a school in Iran, which resulted in the death of more than 150 people. 

The US military investigation concluded that the attack on the school in Minab was due to the “inadvertent engagement” of the school by US aircraft, which was targeting a military installation. The attacks on the water utilities in Minnesota illustrate the potential for geopolitical tensions to spill over into attacks on critical infrastructure. Even though it is unclear whether the attacks in Minnesota were launched by Iran, the fact that they were able to occur highlights the need for increased protection of internet-connected infrastructure equipment, as well as monitoring and rapid response systems.
Read more »
Technology
Apple iPhone Mac Supply Chain Technology

Apple Warns of Supply Crunch as Demand Surges

 

Apple’s issue is a supply crunch: strong demand for iPhones and Macs is outpacing the company’s ability to secure key components, especially advanced chips and memory. The BBC report says Apple warned this could hit revenue in the coming months and that supply constraints are already limiting flexibility in the chain. 

What is happening 

Apple said the core problem is not weak demand but the opposite — sales are running hotter than expected, particularly for iPhone and Mac products. The company described the supply situation as “very significant,” with little room to quickly fix it. That means Apple can sell more devices than it can comfortably produce, which creates delays, pressure on inventory, and a risk of missed sales. 

The shortage affects some of Apple’s most important products, so even a strong quarter can come with a weaker outlook. Apple’s shares fell after the warning because investors tend to react sharply when a company says future growth may slow. The BBC also noted that Apple has already raised prices on some products, showing how supply costs are beginning to affect customers.

A major part of the problem is the cost and availability of memory chips, which have surged in price due to broader industry demand, including AI-related hardware needs. Reuters reported that Apple is also dealing with bottlenecks in advanced chipmaking technology used in its Apple silicon chips. In practical terms, this means Apple may have to pay more for parts, accept tighter margins, or pass costs on to buyers. 

Financial impact 

Despite the warning, Apple’s recent results were still strong, with iPhone and Mac sales rising sharply. But the company signaled that the next quarter may not keep pace if component shortages persist. That is why the story is less about a current collapse and more about a future squeeze on growth. 

Apple’s problem reflects a bigger technology trend: demand for chips is rising across consumer devices and AI infrastructure at the same time. When a company as large as Apple struggles to source parts, it often signals pressure across the wider electronics supply chain. In this case, the issue is a mix of extraordinary demand, limited supply flexibility, and rising component prices.
Read more »
U.S. Cybersecurity
Cyber Attacks cyber operations Cyber Threats Offensive Cybersecurity Private Sector Cybersecurity Transnational Cybercrime Trump Cyber Policy U.S. Cybersecurity

Trump Memo Signals New U.S. Push to Disrupt Foreign Cybercrime Groups


The memo from the White House signed by President Donald Trump will increase the role of cybersecurity companies in fighting foreign criminal organizations that operate across borders. The National Coordination Center will be responsible for developing a program that allows government-approved cyber activities against these groups. 


According to the plan authorized American companies could carry out approved cyber monitoring and cyber impact missions against targets linked to these criminal groups while being watched by the government. 

Information systems and infrastructure might be affected during these activities, including the loss of data. With this effort the government wants to improve how it deals with cybercrime, fraud and other illegal acts that affect American people. Working with the Department of Justice the Department of Homeland Security will set up and run the program through the National Cyber Security Council. 

Companies involved in the program must have an escrow or a bond of least one million dollars and must operate with the required government permissions. The plan encourages sharing information, between businesses and government agencies at every level, including federal, state, local, tribal and territorial authorities to spot possible cyber threats and develop ways to deal with them. The issue of companies being involved in offensive cyber activities is a big deal. This has caused people to worry about things getting out of hand someone getting hurt by mistake and the government and private companies having trouble working together. 

The program is only going after foreign cyber crime groups that want to hurt the United States government, American people or American interests long as these groups do not work for a foreign government. A company has to stop what it is doing if it does something it is not supposed to do, like going after people or systems. 

The company also has to tell the NCC about this so they can send it to the Justice Department. This is part of a program started by the White House in March to deal with criminal groups from other countries that are involved in ransomware, malware, phishing, financial fraud, sextortion, impersonation and pig butchering schemes. 

The White House said that American people have lost a total of $20.8 billion because of cyber crimes. If a company wants to be part of this it has to follow some strict rules. The private sector participation in cyber activities has to be done carefully. Private sector participation, in cyber activities is a serious matter. 

Along with sharing information about threats with businesses and government groups companies that take part might also suggest actions that need permission from the federal government. This policy has started conversations about how much the business world should be involved in taking offensive actions in the cyber world. Someone who supports the program sees it as a chance to use skills from the private sector to fight more powerful criminal groups.

Someone who is against it warns that having more businesses take part in offensive actions could lead to legal problems more chances of things getting worse and results that were not expected. Cyber crime is a problem that affects governments everywhere. 

German intelligence groups have also taken steps to make their own groups stronger so they can stop the cyber networks of enemies. This shows that governments are becoming more ready to use ways to protect themselves and take action. A memo from the time of the Trump administration shows a change in what private cybersecurity companies will do, in the future. 

If the framework can really stop criminal networks without going against the law or making new security problems then how it is watched over and approved will be very important to how well it works. The United States is showing a change in how it deals with cybercrime by doing this. It is clear that the government and private cybersecurity companies need to work to stop cyber threats. 

Several things will decide if this works, such as making sure someone is watching over it following the law and taking steps to avoid things going wrong. The framework needs to be good at stopping criminal networks. The framework will be important to the United States and its plan to deal with cybercrime. The framework and its oversight and authorization processes will be crucial, to its success.
Read more »
Zero Day
CVE GeoServer RCE Vulnerabilities and Exploits Zero Day

GeoServer Zero Day Being Probed While No Patch Available


A newly found GeoServer zero-day is already receiving active exploitation efforts, while there is no patch ready yet. Firms using the open-source geospatial platform should keep an eye out for their exposure. 

A cybersecurity expert with the handle q1uf3ng found the vulnerability which has not been given any CVE identifier yet.

Zero-day with no patch

The vulnerability exists in the jsonArrayContains functionality and permits illegal SQL injection. In few configurations, particularly where the flaw can reach a privileged database account, that path may result in remote code execution. The vulnerability has not been given any CVE identifier yet. 

The flaw was publicly revealed on 12 August 2026. Soon after, watchTowr said it started noticing exploitation attempts, with hundreds of attempts coming from a few IP addresses. According to WatchTowr’s Jake Knott, “Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain.”

The timing is crucial here. When enough technical information or proof of concept is public, threat actors don’t have to wait for a well planned exploit. They can compare responses, scan broadly, trigger errors, and make a list of devices to visit later. It is spying with an error message as a compass.

Cyber criminals are probing the flawed GeoServer systems, but no confirmed exploit has been found yet. But experts have warned that exploitation could soon happen. 

According to Knott, “However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix.”

Threat actors are triggering errors to find vulnerable targets before active exploitation, and probing GeoServer systems for unpatched zero-day.

About GeoServer

A well-liked framework for exchanging and publishing geographic data via web services is called GeoServer. Public sector portals, environmental platforms, mapping initiatives, utilities, transportation systems, academic institutions, and internal corporate applications are some of the places where it can be found. Because of this, a remotely reachable instance becomes more than just a technical detail; it may provide credentials, backend services, geographic data, or a path to a larger network.

Read more »
United Kingdom
Advanced Social Engineering Data Breach Department for Education Education Sector Cybersecurity sensitive data United Kingdom

Hackers Steal 607,000 Records in Cyber-Attack on UK Department for Education

 



Hackers have stolen around 607,000 records from England's Department for Education (DfE) after compromising systems used to handle enquiries and administer international education funding.

The department confirmed the cyber incident after attackers accessed data held through the DfE's online help desk and the portal supporting the Turing Scheme. The compromised information includes telephone numbers and email addresses associated with individuals and organisations that had interacted with the department.

Reports have also identified names and job titles among the exposed information, including details belonging to school leaders, university staff and government officials. However, the DfE said the affected information was limited to customer-service contact details and that bank details and other sensitive information were not accessed.

The department has stressed that the figure of 607,000 refers to records rather than the number of individuals affected. A single person or organisation may therefore account for multiple records across the affected systems.


Social Engineering Reportedly Used Against DfE Helpdesk

The breach reportedly involved a social-engineering attack against an external-facing DfE helpdesk used by education-sector organisations and local authorities.

Computer Weekly reported that the attackers targeted the department's helpdesk and obtained more than 600,000 records containing personally identifiable information, while the affected systems were taken offline as the department investigated the incident. The Times also reported that it had verified the authenticity of some of the leaked information.

The incident illustrates why customer-facing systems can represent an attractive target. Helpdesks routinely process legitimate requests from large numbers of users and may contain historical enquiries and account-linked information. If an attacker can manipulate a support process or gain access to an account with sufficient privileges, information held outside an organisation's core systems can become exposed.

The DfE has not publicly disclosed a complete technical account of how the attackers gained access or which specific vulnerability was exploited. It would therefore be premature to attribute the breach to a particular software flaw or compromised credential without further evidence.

A group calling itself ExfilSquad has claimed responsibility for the attack and has reportedly published or advertised stolen information online. The group's claims should be treated as claims by the alleged attackers, although multiple reports have examined samples of the data and reported that some information was authentic.


DfE Moves to Contain the Incident

The DfE said it acted quickly after identifying the incident and has been working with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) to establish what happened and assess the impact.

The department has also referred itself to the Information Commissioner's Office (ICO), the UK's data protection regulator.

A DfE spokesperson said the department had "robust processes" to protect information and had taken swift action to contain the incident. The department maintained that the information involved was restricted to customer-service contact details and that no other data had been accessed.

The NCA separately confirmed that it was aware of the incident and was working with partners to understand the circumstances and its impact.

The DfE has also temporarily affected the operation of the services involved while remediation work is carried out. Reports said the department switched to telephone support while the affected systems were being addressed, with normal operation expected to resume after the disruption.

The department has assessed the data-protection risk to affected individuals as low. However, the exposure of professional contact information can still create opportunities for follow-on attacks, particularly phishing and impersonation campaigns that use legitimate names, job titles, organisations or previous interactions to make fraudulent communications appear credible.


Education Sector Continues Being Prime Target

The DfE breach comes as education organisations across the UK continue to report high levels of cyber incidents.

The latest UK government's Cyber Security Breaches Survey 2025/26 found that 49% of primary schools, 73% of secondary schools, 88% of further-education colleges and 98% of higher-education institutions had identified a breach or cyber attack during the previous 12 months. The comparable figure for UK businesses was 43%.

The frequency of attacks was also high among colleges and universities. Around 24% of further-education colleges and 29% of higher-education institutions reported experiencing a breach or attack at least weekly. The survey found that 14% of primary schools and 20% of secondary schools experienced attacks at least weekly.

Phishing remained the dominant threat. Among institutions that had identified a breach or attack, 90% of primary schools and 96% of secondary schools reported phishing incidents. The same figure was 96% for further- and higher-education institutions combined.

The government survey also identified higher levels of other attack types across further and higher education. These included impersonation, reported by 79% of affected further- and higher-education institutions, viruses, spyware or malware at 51%, and denial-of-service attacks at 49%. Unauthorised access to files or networks by staff was reported by 29%, while 23% reported unauthorised access by students.

The consequences extend beyond the initial compromise. Almost half, or 49%, of further- and higher-education institutions that identified a breach or attack reported at least one negative outcome for their systems. Compromised accounts or systems being used for illicit purposes accounted for 23%, while 16% reported websites, applications or online services being slowed or taken down and 14% reported losing access to files or networks.


Contact Data Can Become a Launchpad for Further Attacks

Although the DfE maintains that highly sensitive information was not accessed, the exposed records still have security implications.

Names, job titles, work email addresses and telephone numbers can provide attackers with the information required to make subsequent phishing or impersonation attempts appear legitimate. A message addressed to a known employee, referencing their role or organisation, can be considerably more convincing than an unsolicited generic email.

This risk is particularly relevant in education, where senior school leaders, university staff and government officials may have access to wider organisational systems or sensitive information.

The latest government survey indicates that impersonation is already a recurring problem in the sector. Among further- and higher-education institutions that identified breaches or attacks, 79% reported attempts involving people impersonating their organisation or staff.

The DfE incident therefore demonstrates that the consequences of a data breach do not necessarily end when the initial intrusion is contained. Exposed contact information can potentially become useful in later social-engineering campaigns, while disruption to public-facing services can continue during investigation and recovery.

For organisations handling large volumes of education-sector data, securing customer support infrastructure is therefore part of protecting the wider attack surface. Access controls, strong identity verification, monitoring and rapid incident response can limit how far an attacker can move after compromising an externally accessible service.

The DfE investigation remains ongoing, with the department working alongside the NCSC and NCA and having notified the ICO. The full circumstances of the intrusion, including how the attackers gained access and the precise extent of the exposed information, are expected to become clearer as the investigation progresses.

Read more »
SSO
Business Security Credential Attack Cyber Security MFA SSO

Here's How to Secure Your SSO Against Credential Attacks

 

Single sign-on (SSO) has transformed how employees access business applications by allowing one account to authenticate users across multiple services. However, this convenience also creates a concentrated security risk: if attackers compromise the central login, they may gain access to email, VPNs, customer-management platforms, file storage, and other sensitive systems. The 2025 University of Pennsylvania breach demonstrated how a compromised PennKey SSO account could provide access to several internal services and expose information belonging to 1.2 million individuals. SSO is not inherently insecure, but it must be treated as a critical security control rather than a simple convenience feature. 

Strong password policies remain an important foundation for protecting SSO accounts. Current NIST guidance recommends passwords of at least 15 characters when they are used without additional authentication, while passwords used with multi-factor authentication (MFA) may be at least eight characters. Organizations should permit passwords of up to 64 characters and compare new passwords against lists of commonly used or previously compromised credentials. At the same time, businesses should reconsider frequent mandatory resets and rigid complexity rules, which can encourage predictable habits such as adding a number to an old password. 

 MFA should be enforced consistently for every user, application, and access scenario—not only for administrators or accounts considered high risk. SMS codes and basic one-time passwords provide more protection than passwords alone, but phishing-resistant technologies offer stronger defenses against modern credential theft. FIDO2 security keys, WebAuthn, and passkeys can help prevent attackers from capturing authentication data through phishing pages or infostealer malware. These methods are particularly valuable for privileged accounts and systems containing sensitive information. 

Organizations must also protect the infrastructure supporting their SSO environment. Identity-provider administrator accounts should use separate privileged identities, phishing-resistant MFA, just-in-time access, and continuous monitoring. SAML certificates, token-signing keys, OAuth secrets, application credentials, and refresh tokens should be stored securely, rotated regularly, and restricted to authorized personnel. Security teams should review application registrations, delegated permissions, and user-consent grants to remove stale or excessive access that attackers could exploit for persistence. 

When properly implemented, SSO can improve security by reducing password reuse, limiting password exposure across applications, centralizing access policies, and simplifying account deactivation when employees leave. It can also reduce help-desk requests caused by forgotten passwords and make compliance reporting easier. Nevertheless, SSO is not secure by default. Organizations should combine strong password screening, universal phishing-resistant MFA, hardened administrator accounts, controlled recovery procedures, careful application permissions, and regular monitoring to ensure that one compromised credential does not become a gateway to the entire enterprise.
Read more »
Windows
cyber espionage lazarus malware North Korea Social Engineering Windows

Lazarus Abuses Zero-Day Exploit to Install a New Backdoor


Lazarus does a zero-day exploitt

The North Korean hacking group called Lazarus has been linked to the zero-day compromise of a recently patched vulnerability affecting Windows to deploy a new backdoor attacking aerospace and defense organizations throughout India, France, Brazil, and Germany. 

Fake job postings to lure victims

According to Check Point Research, the attack is part of Operation Dream Job, a social engineering and cyber espionage campaign run by Pyongyang-backed threat actors to target job seekers globally with fake but promising job opportunities at organizations like Enveil and Lockheed Martin to steal important information and deploy malware by reaching out to professionals on forums such as LinkedIn, mimicking to be job recruiters to gain trust. 

The attacks have been discovered to take use of CVE-2026-68820 (CVSS score: 7.0), a privilege escalation vulnerability that affects the Windows Ancillary Function Driver for WinSock ("AFD.sys"), which Microsoft fixed as part of their August 2026 Patch Tuesday upgrades.

As found in earlier campaigns, targets are trapped via fake recruiter messages and lured into opening an infected PDF or deploying a malicious PDF viewer, which then deploys a new backdoor known as Troy that allows remote access to the infected system. The main aim of these hacks is to take complete command of compromised computers and escape security mechanisms.

Since 2022, Lazarus, along with Dream Job,  has been using the tried-and-tested trojanized PDF viewer technique to lure victims.

Experts found two separate parallel compromise sequence:

Trojanized ‘SecurityPDF’ PDF viewer

Here, targets are asked to download SecurityPDF from a site mimicking Enveil. When the PDF is installed, it looks for any PDF document opened via it for a particular marker. If it is present, the app decodes an embedded payload that loads a backdoor called Troy straight into memory. 

DLL side-loading

Here, targets are asked to download an encoded archive that launches a DLL side-loading chain. The infected DLL is used to demonstrate a fake job posting trap, while it secretly downloads and runs in memory in a lightweight downloader called MISTPEN. The downloaders work with hacker controlled infrastructure via Microsoft Graph API and OneDrive to extract and run espionage and persistence modules and run the “AFD.sys” driver exploit, before installing ForestTiger, also called ScoringMathTea, which offers remote access to hosts.

Since 2022, the Lazarus group has been using the updated version of the known-kernel-mode rootkit in its attempt to hide the presence of malicious components from security softwares deployed on the host. 

Read more »
Ethical Governance
American Schools Cyber Security Data Privacy Concerns Education Sector Cybersecurity Education Sector Security Ethical Governance

New York School District Pauses AI Robot Teacher Plan After Privacy and Safety Concerns

 

A rural school district in upstate New York decided to cancel the plan to bring in a robot after teachers, state officials, and community members raised their concerns about the robot’s involvement in the classroom, student privacy, and the company’s ties to the adult robotics industry. Salamanca City Central School District decided to use nearly $60,000 from their budget to buy a stationary humanoid robot from Realbotix. 

The robot, which they affectionately named “Sally,” was meant to aid students in high school programs involving robotics, artificial intelligence, and other advanced technologies. It would also assist these students with programming, maintenance, updates, and troubleshooting. The plan to bring in the robot drew criticism from community members who knew about the connection between Realbotix and another company that makes adult sex robots. 

New York State United Teachers President Melinda Person argued that a robot from a company tied to the adult robotics industry has no place in the classroom. Other teachers also raised concerns about whether creating an AI-powered robot would lead to replacing human teachers with robots. Many others were concerned about student privacy. New York Education Commissioner Betty Rosa voiced her concerns about how the robot would function and what information it would collect from students. 

Even though the robot would not be able to teach lessons on its own, the robot was presented to the school board as a tutoring tool. The district has halted the implementation of the robot, and it is currently working with state officials to develop stronger student data privacy rules while also addressing community members’ concerns. Superintendent Mark Beehler has argued that the technology was always supposed to serve as an ancillary tool, and he stressed the importance of human interaction in education. 

The district stated that Sally will never be able to access a student’s microphone or camera or collect any personal information or data and send it to Realbotix. It will also not be able to access the internet or other unauthorized generative AI programs. According to the district, any information would be held on local devices while authenticating students’ identities. Realbotix also denied the accusation that the robot was modified from one of their existing sex robots. They argued that the robot was created specifically for the school district and was not modified in any way. 

They insisted that it used different hardware that was not repurposed from a sex robot. The company also clarified that it has no direct connection to Intima LLC, which owns RealDoll, a company that produces sex dolls and other adult-oriented robots. Realbotix stated that Intima LLC and Realbotix are different entities with different executives, workers, facilities, products, and strategies. Beeler strongly advocated for the technology and said it would give students in remote areas access to innovative opportunities without having to travel to urban centers to interact with new technologies. 

The district hopes that the robot, which will be called “Sally,” would inspire students to pursue robotics, AI, and other STEAM industries. However, many community members want the robot to be removed from the school because they believe students would benefit from increased human interaction rather than decreased human interaction. This debate over whether to bring in the robot has opened up a much larger conversation about student data privacy, ethics, and technology in the classroom.
Read more »
Subscribe to: Posts (Atom)