Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

macOS Security
Cyber Security cybersecurity vulnerability Intel Intel Security Linux Mac security updates macOS macOS Security

Homebrew 7.0.0 Ships With Fixes for Eight Security Advisories

 

Homebrew, a popular package manager for installing command-line tools and desktop apps on macOS and Linux, released version 7.0.0 on Sunday, with eight security advisories closed in the process. The most severe of the 18 reported issues is an unsigned removal metadata vulnerability for a cask, a formula in Homebrew's format for prebuilt app installs, allowing arbitrary sudo commands.

Homebrew removed the vulnerable recovery code and associated API accessors. Seven of the advisories were addressed in earlier 6.0.x releases, which means auto-updating machines already carry those fixes. The eighth is new and would let a malicious cask execute code outside the sandbox of a macOS via LaunchServices. Homebrew classified the issues as one High, two Moderate, and five Low. The High severity sudo path issue was fixed in 6.0.12, where a Moderate was also addressed for preventing the installer from reading Git config owned by the Homebrew prefix, which could run programs as root. 

The second Moderate is the LaunchServices escape mentioned earlier, which is fixed in 7.0.0 by restricting launching of applications, Mach services, and Unix socket connection. The five Low-level issues were fixed earlier and involved redirects and file paths pointing to unintended locations, including headers leaks, tap-restriction bypasses, and files being written outside of staged source trees. The new 7.0.0 brings a built-in scanner (`brew vulns`) that checks for known vulnerabilities in installed formulae, with flags such as `--severity=high` and `--fix-available` to narrow the results, against a database of known vulnerabilities in formulae versions that have been shipped. 

It includes backported fixes for some issues and minimizes false positives, with Homebrew's data on vulnerabilities being in the OSV format with a CC0 license and published through the Homebrew API. Provenance checks are now performed for third-party tap bottles, in addition to the Homebrew core tap, with new taps publishing these by default. Homebrew notes that tap trust remains the primary defense against malicious casks, with sandboxing not making "untrusted software safe to run" due to apps running with the user's privilege and a vendor's installer not running inside the sandbox. 

Nonetheless, 7.0.0 provides sandboxing of formula and cask operations, provides setup instructions as signed data instead of arbitrary Ruby code, and deprecates old post-install blocks in favor of declaring steps. On Linux, Bubblewrap sandboxing is replaced with Landlock, a new kernel feature that requires no additional dependencies. Intel Macs are moved to Tier 3 status following the end of reliable build infrastructure and cessation of routine Intel bottles, with support continuing until September 1, 2027, and MacPorts suggested as an alternative. macOS 10.15 is dropped with the release, while Sonoma 14 is moved to Tier 3.
Read more »
vulnerabilities and exploits
AMD Cloud Computing DDRop Google Hardware designs Intel TDX security researchers software vulnerabilities and exploits

A $159 Circuit Board Just Broke Cloud Computing's Strongest Security Guarantee

 




Security researchers have found a way to defeat the memory protections that Intel and AMD sell to cloud customers as their last line of defense against an untrusted host. The tool required costs less than a decent pair of headphones.

A team from KU Leuven, ETH Zurich, Durham University, and Google published details Sunday of an attack called DDRop, which exploits a fundamental design flaw in the memory encryption hardware powering confidential computing services at Amazon, Microsoft, and Google. It breaks protections in Intel Trust Domain Extensions (TDX), Intel Scalable SGX, and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP), the three technologies that allow cloud customers to run workloads that even the cloud provider cannot read.

The method does not require a software exploit. It requires a small custom-built circuit board, a brief window of physical access to the server, and knowledge of how DDR5 memory commands work. The researchers built their device for $159 in parts.


The Gap Nobody Patched

Confidential computing encrypts a server's working memory at all times. Even a cloud provider's own administrator sees only scrambled data. The problem DDRop exposes is that encryption is not the same thing as freshness. The processor can confirm that data in memory is encrypted. It cannot confirm that data is current. Stale data, so long as it was encrypted legitimately at some point in the past, will still decrypt correctly and raise no alarm.

DDRop turns that gap into an attack. A small interposer board sits between the processor and a DDR5 memory module. When the attacker wants to cancel a specific memory write, the interposer forces a parity error on the command bus. The memory module silently discards the write. The interposer then cuts the wire used to report that error, so the processor is never notified. Old data stays in memory. The system has no way to know the latest update never arrived.

This is the first active interposer attack to run on DDR5 at full bus speed. Earlier DDR5 research required slowing the memory bus down and could only listen passively. Previous active attacks that altered memory contents only worked on older DDR4 hardware, DDR5's redesigned command format blocked them. DDRop routes around that entirely by dropping writes rather than redirecting them.


What the Researchers Pulled Off

On an Intel TDX server, the team demonstrated four outcomes. By dropping writes to page tables during setup, they mapped an attacker's virtual machine onto any physical memory address, then read a victim machine's private memory in full. They also flipped a victim machine into debug mode, copied its memory in plaintext, and restored everything afterward with no trace of tampering.

The most consequential result was attestation forgery. Attestation is the mechanism a hospital or bank uses to verify that the virtual machine handling their data is the one they approved and has not been altered. With DDRop, an attacker's machine can pass that check as though it were a trusted one. A customer could be convinced they are talking to a secure, verified environment when they are not.

On AMD SEV-SNP, results were narrower the researchers copied the contents of one victim memory page into another but the underlying exposure is the same. Neither platform checks whether memory is fresh.


No Patch, No Timeline

Both Intel and AMD acknowledged DDRop through coordinated disclosure before publication and issued security advisories on September 14. Neither offered a mitigation timeline. Both drew the same line: because the attack requires physical access, it falls outside their published threat model for confidential computing. Intel said it will not assign a CVE.

The researchers are direct about why a software fix cannot solve this. The freshness check was deliberately left out. Scalable memory encryption trades freshness for the ability to protect the large amounts of memory that cloud servers require. A lasting fix would need new memory-encryption hardware capable of providing both integrity and freshness at scale. Intel has discussed a future proposal called cache-line versioning, but has not committed to a timeline and researchers say it is unclear whether it would stop DDRop anyway.

Short-term software measures restricting the memory management interfaces DDRop abuses, checking that critical writes completed, scanning for interposers at boot, can raise the bar without removing the root cause.


The researchers have no evidence DDRop has been used outside a lab. But the significance is what it proves is possible. Confidential computing is the technical promise that certain workloads stay private regardless of who owns the physical hardware. DDRop shows that promise has a physical boundary that can be crossed with $159 in components, a few minutes of access, and knowledge that a rogue data center employee, supply chain tamperer, or government compulsion order could all plausibly provide.

The full paper is scheduled for presentation at ACM CCS 2026 in November. Hardware designs, firmware, and proof-of-concept code are already on GitHub.

Read more »
Russia-Ukraine War
Gorilla RAT Hacking Cat malware Monkey Ransomware Russia-Ukraine War

Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets

 

A pro-Ukraine hacktivist group known as Hacking Cat has significantly escalated its cyber operations against Russian targets by deploying newly developed malware, marking a strategic shift from simple website defacements to sophisticated data destruction campaigns. Researchers at Kaspersky uncovered two previously undocumented malware families—Gorilla RAT and Monkey Ransomware—being used in coordinated attacks that exploit server vulnerabilities and encrypt critical files across compromised networks. This evolution demonstrates how hacktivist groups are becoming increasingly capable of mounting technically advanced and sustained campaigns in the ongoing cyberwar between Ukraine and Russia. 

Hacking Cat first emerged around February 2024, initially focusing on low-impact operations such as defacing Russian websites and leaking stolen documents to embarrass adversaries and spread pro-Ukraine messaging. However, by summer 2025, the group began executing more destructive campaigns designed to encrypt and permanently destroy data on targeted systems rather than merely exposing information. This tactical evolution reflects a broader trend among Ukraine-aligned hacktivists, who are increasingly collaborating and sharing custom-built tools to maximize disruption against Russian infrastructure, state-linked organizations, and entities supporting Moscow's war efforts. 

The newly identified Gorilla RAT serves as a remote-access trojan that can tunnel network traffic, enabling attackers to move laterally within victim networks after exploiting vulnerabilities in Microsoft Exchange servers. Monkey Ransomware, which appends a ".monkey" extension to encrypted files, has appeared in multiple variants written in different programming languages since its debut in late 2025. Kaspersky researchers noted that the unusually rapid iteration of the ransomware could suggest the use of generative AI tools to accelerate malware development, though the hackers may also be experimenting with different coding approaches to evade detection and improve effectiveness against diverse targets. 

Joint operations and shared toolkits

Hacking Cat frequently coordinates with other pro-Ukraine groups, including the Cyber Anarchy Squad and the Ukrainian Cyber Alliance, to execute high-impact attacks that cause maximum disruption. In March 2026, the group claimed responsibility for breaching a contractor working for Rosatom, Russia's state nuclear energy corporation, demonstrating its ability to penetrate sensitive industrial networks. Later, in June, it participated in a destructive operation against Donbassteploenergo, a heating provider in Russian-occupied Donetsk, using Nemo Wiper—a tool designed specifically to erase data and disrupt critical infrastructure rather than collect ransom payments from victims. 

The sharing of malware among hacktivist collectives has complicated efforts to attribute specific attacks to individual groups, as multiple organizations now use identical multi-stage infection chains and custom-developed tools. Kaspersky's report linked several tools to Hacking Cat, but the group pushed back in a Telegram statement, acknowledging ownership of "a couple of the tools" while denying responsibility for the ransomware variants. Hacking Cat accused the cybersecurity firm of incorrectly associating unrelated malware with its operations and criticized the quality of its reverse-engineering analysis, highlighting the challenges researchers face in tracking decentralized hacktivist ecosystems. 

Despite these attribution disputes, the overlap in toolkits underscores a maturing cyberwar ecosystem in which Ukraine-aligned hackers are pooling resources, expertise, and custom malware to sustain pressure on Russian targets. The deployment of AI-assisted development tools, coordinated joint operations, and increasingly destructive capabilities signal that hacktivist groups are no longer peripheral actors but integral components of Ukraine's broader resistance strategy. As the conflict continues, cybersecurity experts warn that similar collaborations could emerge elsewhere, reshaping how non-state actors participate in modern warfare through digital means.
Read more »
VPN Vulnerability
Data Breach Government Data Breach Government Network Security Japan Cyber attack Japan Digital Agency Phishing Risk VPN Security VPN Vulnerability

Japan Digital Agency Data Breach Linked to VPN Vulnerability


Government Solution Service (GSS) of Japan's Digital Agency was compromised by a vulnerability in a VPN device, resulting in unauthorized access to the shared government platform through an exploit of a vulnerability in the VPN device. In this incident, 246,000 records containing information regarding employees, public officials, contractors, and other individuals connected to organizations using the service may have been exposed. 

Upon discovering unusually large-scale access to files on a server through an account belonging to a maintenance and operations staff member on June 25, the agency first detected the breach. Following an investigation, the agency determined that the account activity was linked to an unauthorized access to a network-connected VPN device. 

By July 9, the agency determined that an external party had accessed the system by exploiting a vulnerability in the VPN equipment. Immediately after the incident, the maintenance account was suspended, and communication between the equipment and external networks was restricted to prevent further access. 

The investigation, conducted with the assistance of an external security company, revealed that some files that contained personal information could have been transferred outside the system. The VPN product used and the specific vulnerability that was exploited have not been disclosed by the agency. Through shared IT infrastructure, 23 Japanese ministries and government agencies are served by the affected GSS environment, which can have a greater impact on the incident. 

The exposed information consists of approximately 236,000 names, 231,000 e-mail addresses, 94,000 telephone numbers, and 1,000 physical addresses. The records relate to personnel and officials who work with GSS user organizations, as well as businesses and individuals who support those organizations. 

Data containing information belonging to the general public was not included in the affected data, according to the agency. Additionally, the compromised dataset is lacking My Number identification numbers, bank account information, or pension number information. Despite the fact that no confirmed cases of misuse have been identified, the exposed contact information could still be used for impersonation, phishing, or other forms of social engineering. 

VPN exposures were categorized as medium severity and were not zero-day vulnerabilities; however, the agency has failed to provide details regarding when the vulnerability was fixed or why the device was still exposed at the time of the intrusion. 

Known VPN Flaw Left Unpatched

Due to the fact that the Digital Agency was already aware of a VPN flaw when the breach occurred, but had not applied the required patch, the incident raises concerns about vulnerability management. According to the agency, the vulnerability has a medium severity and has been confirmed as not a zero-day, indicating that attackers exploited a known vulnerability rather than a newly discovered vulnerability. 

The information accessed is approximately 246,000 records. Over 189,000 of these people are government employees, public officials, or other personnel working for GSS-related organizations, while approximately 57,000 are private companies and individuals involved in government-related activities. 

A total of 236,000 names, 231,000 emails, 94,000 telephone numbers, and 1,000 physical addresses were included in the data. In addition, duplicate entries may be present in the data. More sensitive identifiers are not included in the dataset, such as My Number information, bank account details, and pension information.

Investigation Finds No Confirmed Misuse

The Digital Agency has not received any confirmations of misuse of the exposed information, however, the combination of names and contact information could facilitate targeted phishing or impersonation attempts against affected employees. Messages or phone calls from individuals pretending to represent the government have been warned by the agency, and official personnel will not contact affected parties via email or telephone for passwords or payment information. 

Japan's Personal Information Protection Commission was made aware of this incident on July 15. During the investigation, the agency determined that potentially affected information was likely to be identified and the individuals and organizations involved required a considerable amount of time, which contributed to the delay in public disclosure. 

Digital Agency officials indicated the impact was limited to the affected GSS environment with no evidence of other government systems being compromised or disrupted. As part of its effort to strengthen vulnerability management and review how external connections to the system are handled, the agency is also expected to provide direct notifications to the affected individuals. 

To prevent unauthorized access to sensitive government information and limit unauthorized access, VPN patches should be implemented on time, strict access controls should be implemented, continuous monitoring should occur, and rapid isolation should be instituted.
Read more »
Scams
Banking Crypto Cyber Crime Cyber Fraud Scams

$13 Billion in Losses Since 2023, Treasury Asks Banks to File Cyber Scam Reports


The federal government has asked financial organizations to be more careful in detecting and reporting scams done by overseas scammers. 

The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) launched and alert to the financial industry besides a detailed study of over 33,000 cyber fraud cases reported between September 2023 and December 2025. According to the report, around $12.7 billion was stolen in a cryptocurrency investment scam from American victims in the US.

As per Treasury Department official Gene Lange, “The transnational criminal organizations behind these scams exploit both emerging technologies and human vulnerabilities, resulting in devastating financial losses for innocent American victims.”

The report is prepared on the basis of reports given by around 1,300 financial organizations and is linked to a 2023 alert from the Treasury about pig butchering scams. FinCen discovered that the rate of scam operations is rising as the schemes go beyond centers in Laos, Myanmar, and Cambodia. 

Scammers use distinct profiles, from financial adviser to romantic partner, and force people into sending money, either via cryptocurrency or with traditional bank transfers.

Significant reports were received from cryptocurrency firms, which found around $5.5 billion in suspicious scam activity. 

Traditional banks reported around $6.4 billion in possible friends, saying they “often detected schemes when a victim sent funds to an [financial institution] in the digital asset sector to purchase digital assets, or when a customer sent a wire transfer to a scam-affiliated beneficiary, frequently referencing digital asset investments.”

The report finds that few victims sent applications for second mortgages and loans as part of their involvement in a scam.

More financial institutions note thousands of incidents where targets liquidated their investment accounts to try wiring transfers or fund digital assess to scammer-related accounts. According to the report, “[A financial institution] involved in the digital assets sector reported an older adult victim transferred nearly $640,000 from her retirement fund to send to a suspected scammer in connection with an apparent digital asset investment scheme.”

“The victim stated she met an individual over social media who instructed her to invest in an apparently fictitious digital asset-related company.”

Another victim took out around $150,000 from his retirement account, withdrew credit on his home, and withdrew a personal loan to send the money to a scammer who pretended to be his digital romantic partner, and wanted to invest the money in a venture.

The filings noted the use of coins like USD Coin (USDC), Ethereum, and Tether (USDT), but 18 more coins were found in the reports.

Read more »
tech industry
Credential Theft cybersecurity research financial services Phishing Pistachio tech industry

Your Company's Phishing Tests Are Measuring the Wrong Thing

 



When a phishing simulation returns a low click rate, security teams tend to relax. Leadership checks a compliance box. The program gets renewed. But a major new study suggests that sense of relief may be completely misplaced.

Oslo-based cybersecurity firm Pistachio released its Phishing Behaviour Report 2026 this week, built from 2.47 million simulated phishing attacks sent to more than 123,000 employees across 1,200-plus organizations between June 2025 and May 2026. The finding that runs through all of it: the click rate, which most phishing programs live and die by, is the wrong thing to measure.

"A low click rate can create a false sense of security," said Joe Jones, CEO and co-founder of Pistachio. "What matters more is what happens next: does the employee hand over credentials, recognize the attack and stop, or report it so the wider business can act?"

A click alone does nothing. Credentials do.

Clicking a phishing link causes no damage on its own. The actual risk begins when an employee submits a password or other sensitive information into a fake login page after clicking. That is the moment a simulated test becomes a real-world breach scenario, and it is largely what most phishing programs do not track.

On their very first simulated phishing exercise, more employees in the Pistachio study reported the suspicious email than clicked it. That sounds like good news. The problem is that 1.57% handed over their credentials anyway. In a company with 500 employees, that works out to roughly eight people who will submit login details to a convincing enough lure with zero prior exposure. Click rate metrics would not flag any of them.


Tech workers are not the safe bet they are assumed to be

One of the more uncomfortable findings in the report concerns employees who are expected to know better. Tech development workers clicked at least one simulated phishing attempt at a rate of 30.27%. IT workers were not far behind at 28.53%.

The assumption that technical employees carry lower phishing risk because they understand how attacks work does not hold up against the data. Understanding how phishing operates and catching a convincing one under inbox pressure are two different things.

Construction carries the most risk. Financial services carry the least.

The gap between industries was wider than most organization-wide risk scores would suggest. Construction workers showed the highest click rate of any department at 41.31% and the highest credential leak rate at 16.47%. Design workers, by contrast, clicked at just 26.35%.

Financial services employees topped every resilience category in the study, which carries some irony. Financial services accounted for 27.7% of all observed phishing attempts in 2025, making it one of the most targeted sectors on the internet. That sustained pressure, combined with strict regulatory requirements and mandatory security training, appears to have produced genuinely more vigilant employees at the individual level.

Health workers showed the lowest reporting rate of any department at 13.17%, despite a relatively low click rate. Logistics workers combined an above-average click rate with a below-average reporting rate of 17.11%. In both cases, the click rate alone would present a more reassuring picture than the full data supports.


Things get worse before they get better

Organizations running 12-month programs saw click rates and credential submission rates both rise through the first six months before declining. That initial rise reflects harder and more frequent testing rather than employees regressing. At the six-month mark, employees were receiving an average of 3.5 simulations per person, with 50.4% classified as hard difficulty.

From that six-month peak to the 12-month stage, clicks declined by 27% and credential leaks by 41%. The report-to-click ratio increased from 1.3 at three months to 1.8 at 12 months, indicating that suspicious messages were reported nearly twice as often as they were clicked by the end of the program. 

Organizations that run a single phishing simulation and judge the program from that result are drawing conclusions from the noisiest and least reliable moment in the entire training cycle.


What to track instead

The report does not argue that click rates should be dropped entirely. It argues they should sit alongside credential submission rates and reporting rates, which together give a far more accurate picture of actual resilience. Making it easy for employees to report suspicious emails, through one-click tools and fast confirmation, converts the workforce into an active detection channel rather than a passive one.

NIST research found that 72% of organizations use phishing simulation click rates to gauge training effectiveness. By that measure, nearly three quarters of corporate security awareness programs are optimizing for an incomplete signal, in a threat environment where AI-driven phishing has pushed click rates among untrained employees to a record high of 54% in 2026. 

The click rate was never the whole story. At this point, relying on it alone is a liability.

Read more »
User Privacy
IMEI Blocking Lost Phone Security Mobile Security Network Flaws User Privacy

Lost Phone Reporting Flaws Could Let Hackers Block Any Mobile Device for $4


A new security investigation has revealed serious weaknesses in the systems used by mobile carriers to block lost or stolen phones. Researchers found that an attacker could exploit these flaws to disconnect another person’s smartphone—or even a cellular-connected home alarm—from mobile networks for as little as $2.50 to $4. The attack reportedly took between 20 and 80 seconds, raising concerns about the reliability of a process designed to protect phone owners. 

When a customer reports a phone as lost or stolen, the carrier records the handset’s unique International Mobile Equipment Identity (IMEI) number in an Equipment Identity Register, or EIR. Mobile networks then use this database to reject the device and prevent it from registering for calls, messages and data services. The system is also designed to discourage theft because a blacklisted phone may become unusable, even if someone replaces its SIM card. However, researchers discovered that the process contains weaknesses across multiple layers. 

The study identified six flaws affecting devices, carrier reporting systems and the infrastructure used by telecom companies to exchange blocked-device lists. These weaknesses could allow criminals to submit fraudulent reports or manipulate information without proving that they own the targeted handset. In addition to smartphones, the problem may affect connected security systems and other Internet of Things devices that rely on cellular networks. A malicious actor could potentially disrupt a home alarm, surveillance system or other connected equipment by falsely reporting its IMEI as stolen. 

The findings highlight the risks of trusting a single identifier as proof of ownership. Although IMEI-based blocking can be useful, carriers may need stronger verification, better monitoring and faster recovery procedures for legitimate customers. Providers could require additional account checks, detect unusual reporting patterns and notify owners before permanently adding a device to a blacklist. They should also make it easier for customers to challenge fraudulent blocks and restore service quickly. 

For phone owners, the investigation is a reminder to secure accounts and keep evidence of ownership. If a device disappears, users should immediately activate Android’s Find My Device or Apple’s Find My service, remotely lock the handset and contact their carrier to suspend the SIM or eSIM. They should change important passwords, monitor banking accounts and report suspected theft to the police. Customers who discover that their device has been wrongly blocked should contact the carrier, request an investigation and provide purchase records, account details and the handset’s IMEI number.
Read more »
Enterprise AI Security
Ai Data AI technology AI tools Cyber Security cybersecurity research data security enterprise AI Enterprise AI Security

Study Warns Enterprise AI Rollouts Are Outpacing Data Security Checks

 

Companies are adopting AI tools faster than they are testing whether their underlying data is appropriately secure, a new report from governance firm Syskit suggests. Based on a survey of 327 IT and security decision-makers at U.S. and U.K. organizations with at least 500 workers, Syskit's State of Microsoft 365 Governance Report, published Sept. 10, found that 76% of the companies surveyed had deployed or tested enterprise AI tools such as Copilot in their Microsoft 365 environments, but less than half (43%) had conducted a thorough review of file permissions and potential oversharing risks prior to deployment, and the rest skipped the review process or reviewed only partially.  

There was a similar gap for oversight over AI agents. While 91% of respondents said they were confident about their knowledge of what AI agents were and had access to, in practice, barely one in five companies (22%) had a formal policy outlining permitted agents' access, and roughly one in 10 (9%) had an agent that had inherited all the permissions of the person who had deployed it. "If you look at tools such as Copilot, you can see the value it can bring," said Syskit CEO Toni Frankola, noting that some content could be exposed purely based on permissions that had been set years ago and then simply forgotten about, and that AI had removed the friction that had previously prevented accidental exposure. 

"Permission audits may be the most critical and least desirable step in preparing a safe and secure AI deployment." The report also highlighted areas of weakness in Microsoft 365 environments overall. Roughly 41% of organizations had SharePoint sites that were publicly available with no access restrictions, 35% had visible files for past employees, and a third had files shared publicly with "Everyone." Ownerless content was the biggest concern, with 47% of organizations citing orphaned teams, groups and sites, which had no one accountable for reviewing or securing them, despite being accessible to an AI just as readily as any other content.  

"There seems to be a disconnect between confidence and reality with regard to the management and control of data and information," said Frankola. "While eight in 10 (83%) organizations feel confident that they know exactly who can access specific sensitive information, only 4% could provide a complete access report for an auditor within an hour if asked ... and more than half would need at least a day to prepare one." Perhaps most concerningly, 90% of organizations said they had suffered or suspected a security incident related to incorrectly configured permissions or excessive access in the last two years, and 39% confirmed that a security incident had definitely occurred.
Read more »
Secure Credential Transfer
1Password Android Password Manager Android Security Bitwarden Google Password Manager Mobile Security Passkey Transfer Password Migration Secure Credential Transfer

Android Simplifies Secure Migration of Saved Logins


With the advent of Android's new credential transfer feature, passwords and passkeys can be transferred directly between supported password managers without the creation of an unencrypted file. This feature resolves a problem longstanding with migration. 

In the past, it was often necessary to export stored credentials into a text or CSV file that was unencrypted, so that a temporary copy could remain visible on the device while the password was transferred. Previously, users were not able to transfer passwords between password managers, requiring them to recreate them if they changed providers. 

The new transfer process is handled by Android itself. Migrations begin with the password manager receiving the credentials, and an import or transfer option is offered to initiate the migration. Upon identifying supported password managers installed on the device, Android passes control to the existing manager, allowing them to review and authorize credentials that have been selected for transfer. 

The new system facilitates the transfer of passwords and passkeys, eliminating the need to create plaintext credentials as part of the migration process. This approach aims to reduce the exposure of sensitive authentication data during the switch of password managers. 

With Android's new credential transfer feature, users can move passwords and passkeys directly between password management applications without having to create an unencrypted file in the process. This feature addresses the long-standing issue of migration between password management applications. 

Passwords were traditionally exported into an unencrypted text or CSV file when transferring stored credentials, creating a temporary copy that could remain exposed on the device while the passwords were being transferred. Passkeys, however, cannot be transferred between password managers, so users must recreate them when switching providers. New transfer procedures are managed by Android itself. 

When a password manager receives credentials, it will offer the option of importing or transferring credentials, which will initiate the migration process. Android identifies supported password managers on the device and passes control to those managers in order for the stored credentials to be reviewed and authorized for transfer. 

Passwords and passkeys can be transferred with this new system, removing the requirement to prepare a plaintext credential file during migration. This approach is intended to minimize the potential for exposing sensitive authentication information. 

Support Remains Limited

Four password managers are currently supported by the feature: Google Password Manager, 1Password, Bitwarden, and Dashlane Google has indicated that additional providers are planned, although no specific deadline has been announced. It will still be necessary to use conventional export and import methods when using password managers outside the supported group. This system utilizes a standardized credential exchange approach so that participating password managers can communicate through Android devices. 

Additionally, migration support for passkeys is now available, removing the barrier that previously existed when changing password management services. This feature is accessible on Android 8 or later devices, allowing older supported devices to benefit from this capability, rather than being restricted to recent releases. 

The change is part of a larger effort by Google to improve the security of account information and device migration. The Android platform also includes requirements that are intended to improve the way applications restore the state of their sign-ins when users switch devices. During device migration, eligible applications will use Android's Restore Credentials API to restore authentication under the Zero-Tap Sign-In standard. 

With the introduction of this system, supported applications will be able to recognize existing sign-in states on new devices without requiring additional login steps. Google plans to begin enforcing the Zero-Tap Sign-In requirement by April 2027 while that initiative focuses on application authentication during device upgrades, the password-manager feature allows credentials to be transferred between different password management services. 

There are currently limited provider support options, however, wider adoption could facilitate easier transitions between password managers while reducing the security risks associated with manually handling exported credentials.
Read more »
South Korea
AI Data Breach data security Encryption South Korea

South Korean Startup Suffers Breach Due to Encryption Management Failure


Modu-ui, a South Korean government backed startup support platform, suffered a data breach in July. The breach later disclosed a critical encoding key management compromise, showing how encoded information can still become vulnerable when enterprises can’t protect encoding keys properly. 

About Modu-ui

Modu-ui stores participants’ personal details such as email addresses, names, and startup ideas, and the platform also supports a nationwide startup audition overseen by SMEs and Startups (MSS) of the South Korean Ministry.

Suspicions were already raised a month prior to the reported data breach that applicants’ personal data could be structured and exposed via API responses inside the platform. The government said it had taken prompt action but did not reveal if it had upgraded Modu-ui’s security infrastructure.

Startup details leaked

In June, the Ministry of SMEs and Startups disclosed that summaries of startup ideas and personal details had been exposed. Later, it started a detailed enquiry along with National Police Agency, National Intelligence Service, and the Cyber Security Center.

In July, the agencies confirmed that the leak of encoding keys via an API was the reason for the startup idea and personal data leak.

About the breach

The exposed data had already been encoded but the encoded data needs an encoding key decoding.

In this case, the encoding key was leaked along with the API data, causing in the leak of evaluation comments, startup idea summaries and email addresses related to 5000 successful applicants. 

According to the Ministry, the encoding key had been included inside the API and a third party retrieved API data via methods like web crawling, causing the exposure of the key.

Private email addresses were not shown on the public-facing interface but officials believed they could be retrieved via AI-based web crawling. 

Impact on organizations

The incidents also demonstrate the dangers of hard-coding encoding keys as fixed values inside databases, application code, similar environments, or databases.

When businesses follow this method, the keys can become vulnerable in addition to the data or systems they are meant to protect. The main reason for this incident can be viewed as security infrastructure failure in incorporating  robust encoding key management.

Officials found 39 IP addresses related to the access of the exposed data coming from South Korea. Authorities also said that investigations led to more details such as potential connections to AI solution providers.

Read more »
Ransomware Gang
Conti Ransomware CyberCrime Data Theft malware Ransomware Attack Ransomware Developer Ransomware Gang

Conti Ransomware Ties Lead to Four-Year Prison Sentence


Ukrainian nationals have been sentenced to four years in U.S. prison for participating in the Conti ransomware operation. Between 2020 and 2022, the company was carrying out attacks against organizations throughout the United States and other countries. 

In addition to serving as a hacker and developer, Oleksii Oleksiyovych Lytvynenko, 44, was also an integral part of the operation. According to prosecutors, he personally targeted at least 12 companies, handled stolen information obtained from victims, and helped develop tools used during Conti's ransomware attacks. 

Lytvynenko pleaded guilty in June 2026 to conspiracy to commit wire fraud. She was responsible for controlling the theft of data from eight U.S. victims and four foreign victims. A ransom demand was also sent by him during Conti's double-extortion attacks, during which stolen information was used in conjunction with file encryption to pressure victims into paying.

According to the investigation, Lytvynenko also played a role in creating the malware loader for the group. This tool allows attackers to launch or load other malicious software onto compromised systems, providing attackers with another means of executing ransomware operations. 

Conti's Global Ransomware Campaign

In the course of its operation, Conti attacked companies across 47 U.S. states, Washington, D.C., Puerto Rico, and 31 other countries, making it one of the most active ransomware operations of its time. As reported by the FBI, ransom payments associated with Conti exceeded $150 million by January 2022. 

The group targeted hospitals, government agencies, and business entities among its target groups. According to its operations, Lytvynenko stole sensitive information and encrypted systems before demanding cryptocurrency payments from victims. Following a U.S. request, Lytvynenko was arrested in July 2023 at his Cork, Ireland, residence. 

After contesting extradition, he was ultimately transferred to the United States and held in Irish custody for a short period of time. The court's decision adds to the law enforcement response against the Conti ransomware network, which successfully shut down in 2022 in response to mounting pressure and the release of its internal communications. 

Evidence Linked Lytvynenko to Continued Ransomware Activity

It was discovered that Lytvynenko's online accounts contained much more than stolen victim information. Prosecutors alleged that the accounts contained Conti malware and ransom notes, as well as material relating to malware and hacking. As evidenced by his accounts, he searched for potential targets, indicating a deeper involvement than the development side of the operation. Court records also indicated his involvement in cryptocurrency transactions.

A transfer of about $25,042 worth of Bitcoin, involving 0.4 bitcoin, was traced to a victim associated with Lytvynenko's Conti activities. The court imposed a forfeiture of the same amount. Evidence recovered from Lytvynenko's computer after the arrest in 2023 also raised concerns regarding his continued involvement in cybercriminalism.

Investigators discovered Cobalt Strike running on the device and a Rocket.Chat session connected through Tor. Prosecutors said the forensic evidence indicated that Lytvynenko continued to participate in ransomware attacks after Conti ceased to operate. 

Conti's Collapse Did Not End Its Criminal Network

Following the release of internal chats and source code, Conti disbanded in 2022, which revealed details regarding the ransomware group and its members. As a result of the group's public support of Russia after the invasion of Ukraine, investigators were able to gain additional insight into its structure and activities by investigating the leak. 

While the shutdown was initiated, prosecutions did not immediately cease. Four additional Conti members were charged in separate indictments in 2023, and in 2024 Ukrainian authorities arrested another suspected Conti member in Kyiv. Lytvynenko's case contributes to the ongoing legal action against those involved in the ransomware operation by adding another conviction.
Read more »
Data Stolen
Credential Credential stealing Credential Theft Data Breach Data Leak data security Data Stolen

Florida Says Motor Vehicle Data Breach Tied to Credentials Stolen From Officer's Personal Device

 

Officials in Florida confirmed Thursday that the state Department of Motor Vehicles suffered a data breach after credentials were stolen from a police officer who had stored login information on a personal device. The ShinyHunters cybercriminal organization claimed on Monday that it had obtained access to data from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). 

The department did not respond to repeated requests for comment throughout the week but publicly confirmed the breach's legitimacy on Thursday night. Officials said they first learned of the breach on September 4 and initially attributed it to an unnamed "international cybercriminal organization." 

According to the department, an investigation determined that a criminal actor exploited a single Plant City Police Department user's credentials, which had been improperly stored on the employee's personal electronic device. Plant City is a small suburb outside Tampa. FLHSMV has since notified other Florida government offices and is partnering with the Florida Digital Service to investigate the incident. 

As proof of access, ShinyHunters shared alleged photos of a DMV record tied to American financier and convicted child sex offender Jeffrey Epstein. When claims of the breach first surfaced, some cybersecurity experts speculated it might be connected to the recently confirmed breach involving 153 million driver's licenses leaked by identity verification firm IDScan. ShinyHunters had previously attempted to purchase the ID database from the hackers behind the IDScan breach.

The group has recently claimed responsibility for attacks on bank IT provider Jack Henry, as well as pharmaceutical and healthcare technology company McKesson, which told regulators that data from its oncology and surgical business units had been stolen. ShinyHunters also caused widespread disruption across the U.S. in May with an attack on a widely used educational software suite and stole the information of more than four million people after targeting the world's largest medical device company in April. 

Other victims linked to the group include Carnival Cruises, Ticketmaster, AT&T, McGraw Hill, ADT, and gaming company Rockstar. In a related development, artificial intelligence company Anthropic released a report Thursday stating that suspected affiliates of ShinyHunters used AI to scan for credentials, map unfamiliar systems, and steal data from victims for extortion purposes. 

The report noted that in one case, an operator escalated from a stolen developer token to full administrative access over a victim's cloud environment in approximately three hours. Incident responders at Google also confirmed last week that members of the group are using Anthropic's AI tools at various stages of their attacks. 

The Florida breach adds to a growing list of incidents tied to ShinyHunters, underscoring the group's persistent targeting of both government systems and major corporations, as well as its evolving use of AI tools to accelerate and scale its intrusions.
Read more »
watchTowr
API CISA Code Injection Vulnerability CVSS GitLab patches Vulnerabilities and Exploits watchTowr

GitLab's Worst-Rated Vulnerability Is Already Being Exploited

 



GitLab on September 10 shipped emergency patches for a maximum-severity vulnerability that lets unauthenticated attackers read arbitrary files off a server and by the following morning, attackers were already hunting for unpatched instances.

The flaw, tracked as CVE-2026-85706, carries a CVSS score of 10.0, the highest rating a vulnerability can receive. It sits inside GitLab's repository commits API, where improper path confinement combined with missing authentication enforcement allows an outside attacker to break out of the intended directory structure and pull files from elsewhere on the server. According to watchTowr, the firm that first flagged in-the-wild activity, those files include log entries and GitLab-specific configuration files that may contain credentials, secrets, and sensitive system details.

The requirement for exploitation is notably low. A GitLab instance needs at least one public project for the attack to work and no credentials are required at all.

"watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab path traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request," the firm said on September 11, noting that scanning activity had begun as early as 06:00 UTC that morning, within hours of GitLab's patch publication the day before.

Jake Knott, head of threat intelligence at watchTowr, told this publication: "The appeal to attackers of GitLab is obvious, as unauthorized access allows an attacker to gain access to source code, CI/CD secrets, credentials, and the ability to inject code into build pipelines, gaining access or poisoning anything downstream of it, which as we've seen throughout this year has been a favorite of attackers."


What Gets Exposed

GitLab sits at the center of most software delivery pipelines. A server running GitLab may hold proprietary source code, container build definitions, infrastructure-as-code configurations, API keys baked into CI/CD scripts, deployment credentials, and runner access tokens. A vulnerability that lets an outside party read files off the server without logging in is effectively a master key to an organization's software supply chain.

CISA, which added the vulnerability to its Known Exploited Vulnerabilities catalog on September 11, noted that arbitrary file disclosure can help attackers identify credentials, configuration details, and other information useful for follow-on intrusion activity. The agency also flagged the vulnerability under Binding Operational Directive 26-04, requiring forensic triage because some affected instances may have been accessed before patches were even available. 

Knott warned that full-scale exploitation is not far off: "Based on the history, the transition of this vulnerability to indiscriminate mass exploitation is likely not far away, and defenders have limited time to act."


Two More Critical Bugs in the Same Release

The patch bundle that addressed CVE-2026-85706 also closed two additional high-severity vulnerabilities, making this one of GitLab's more consequential security updates in recent memory.

The second issue, CVE-2026-87719, carries a CVSS score of 9.9. It is an insecure deserialization flaw inside the GraphQL subscription serializer that affects only GitLab Enterprise Edition. An attacker who already holds an authenticated account with Duo Chat access can submit a specially crafted GraphQL subscription argument to bypass serialization controls and trigger server-side object lookup, potentially exposing Advanced Search instance configurations and sensitive credentials. Unlike the path traversal issue, this one requires an existing foothold — but an insider, a compromised account, or an attacker who has already gained limited access could use it to escalate what they can see. 

A third vulnerability, CVE-2026-88765, is a buffer overflow in GitLab EE's Unicode conversion wrapper with a CVSS score of 8.5 that could allow an authenticated attacker to achieve remote code execution by importing a specially crafted Git project export. The overflow occurs during Advanced Search indexing, which means any instance that accepts project imports is in scope.

All three vulnerabilities are fixed in GitLab versions 19.3.2, 19.2.6, and 19.1.8, released September 10. GitLab.com and GitLab Dedicated customers do not need to take action the fixes were applied on their behalf.


A Pattern That Is Getting Harder to Ignore

CVE-2026-85706 is not an isolated incident. It is the second critical GitLab vulnerability to come under active exploitation within days of disclosure in roughly six weeks.

In August, GitLab released an emergency security update outside its normal twice-monthly schedule to address CVE-2026-19478, a code injection vulnerability in its GraphQL API carrying a CVSS score of 9.4. That flaw allowed unauthenticated attackers to modify or delete publicly accessible projects and user data through a GraphQL directive, requiring no credentials and no user interaction. 

WatchTowr warned at the time that it was able to reproduce that vulnerability within minutes of disclosure, armed only with GitLab's advisory details and the patch itself. Exploitation followed within roughly 48 hours. 

Knott made the connection explicit: "This is the second instance of a critical-severity GitLab vulnerability in recent weeks, following the previous GraphQL code injection (CVE-2026-19478) that was almost immediately actively exploited."

Internet-wide scanning data puts the number of self-managed GitLab instances reachable on standard web ports at more than 20,000, based on Shodan and Censys lookups, with a meaningful share still running versions inside the vulnerable range days after patches ship. That pool of exposed servers gives attackers a large, persistent target and the repeated pattern of fast exploitation suggests that, at minimum, automated scanning tools are picking up GitLab advisories and moving on them within hours. 


What Defenders Need to Do Now

CISA has given Federal Civilian Executive Branch agencies until September 14 to apply the fix. Private sector organizations running self-managed GitLab do not have a regulatory deadline, but the window between disclosure and mass exploitation has been narrowing with each successive GitLab vulnerability this year.

Any internet-facing instance should be treated as potentially compromised until confirmed otherwise if it was exposed before September 10, because active in-the-wild probes began at 06:00 UTC on September 11, meaning any unpatched server was under active attack within hours of the patch release.

Knott recommended a specific log-hunting approach for teams that cannot patch immediately: review HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.Path parameters. Any hits in those logs before the patch was applied are worth investigating as potential exploitation attempts.

Because successful exploitation can expose sensitive server-side files, organizations with vulnerable internet-accessible instances should also evaluate whether credentials or secrets accessible to the GitLab process require rotation. 

Single-node GitLab instances will experience downtime during the upgrade because database migrations must complete before GitLab can start, while multi-node instances can apply the patch without downtime by following proper zero-downtime upgrade procedures. Version 19.3.2 also includes post-deploy migrations that run after the upgrade completes.

The vulnerability was discovered by a researcher using the handle 's3ntago' and reported through GitLab's HackerOne bug bounty program. No attribution for CVE-2026-87719 or CVE-2026-88765 has been publicly confirmed at this time.

Read more »
Websites
Cloud Domain Internet malware Scams Websites

Attackers Use Expired Websites for Malware Scams


Dead websites may seem harmless once they are abandoned by their owners, but their old internet reputation can make them important tools for threat actors. A new research by Infoblox Threat Intel has revealed that threat actors are spending millions of dollars buying expired domain names and misusing them for online gambling, malware, scams, and illegal streaming.

Infoblox discovered that around 65,000 earlier previously registered domains are re-registered everyday, showing around one in five newly found domains,

What makes dead domains valuable

When a domain is dead, the history does not vanish immediately. The domain may still consist of traffic, backlinks, search-engine visibility, and an image built when it was in legitimate use previously.

Attackers can buy these domains and exploit the existing digital footprint. This can make a malicious infrastructure less dangerous than an entirely new domain. 

The tactic is usually called “dropcatchin”. Instead of making new sites from scratch, threat actors buy domains that have already created some level of visibility and trust.

Sable Squirrel behind the campaign

One of the largest campaigns detected by Infoblox is an attacker called Sable Squirrel. According to experts, the group has control over 10,000 domains and believe that it has invested over $7 million buying expired domains. 

“This actor has spent years turning other people’s domain history into its own criminal infrastructure, then using that infrastructure to run illegal sports streaming, online gambling promotion, and malware command-and-control (C2) side by side,” Infoblox said. 

Majority of the domains support a large gambling operation and sports streaming aimed mostly at Asian users, But experts found that some of the same infrastructure was utilised for command and control (C2) operations. 

Infoblox found over 31000 malware samples interacting with Sable Squirrel infrastructure such as njRAT, Remcos, NanoCore, DCRat, AsnycRAT, and Quasar RAT additionally with samples linked to HiddenTear ransomware. Experts confirmed 405 domains being exploited as malware command-and-control infrastructure. 

A larger cybercrime picture

Sable Squirrel was not the only group using dead domains, Infoblox also detected groups such as Swiping Squirrel, Shady Squirrel and Stuffy Squirrel. Some groups buy domains previously associated with malicious activity and exploit the existing traffic to redirect targets towards malware, advertising fraud, or scams.

Sable Squirrel’s main business is gambling, but it masks it as a streaming operation, while also doubling as an acquisition channel for the same.

“In Sable Squirrel’s hands, the domain becomes more than an address. It is the unit of trust, the traffic source, the brand surface, the routing layer, and, in some cases, the control channel,” said Infoblox.

Read more »
Mobile Security
Android Security Early Access Deceptive apps Google Play Mobile Security

Google Play Early Access Exploited for Fake Reward Apps

 

Cybersecurity firm Bitdefender has unearthed a large-scale exploit of Google Play’s Early Access program, where attackers are distributing thousands of deceptive Android apps that promise rewards, casino winnings, and premium content—but deliver relentless ads and data harvesting instead. By exploiting a key limitation of Early Access—disabled public ratings and reviews—malicious developers can avoid community warnings and scrutiny while aggressively promoting their apps through social media.

Modus operandi 

Google designed Early Access to help developers gather feedback on unfinished apps before full release, intentionally disabling public star ratings and user reviews to protect beta testers’ input from skewing an app’s reputation. However, Bitdefender’s investigation shows that bad actors are weaponizing this blind spot: without visible reviews, users cannot see red flags such as non-paying “reward” apps, fake casino games, or utilities requesting excessive permissions. The result is an ecosystem where deceptive apps can accumulate significant downloads before any public accountability kicks in. 

Researchers analysis of apps installed by its users identified thousands of suspicious Early Access listings across multiple categories, including fake casino and slot games, “earn money” and reward apps, PDF readers, QR scanners, phone trackers, and utility tools. Many of these apps are promoted via TikTok, Facebook, and other platforms using misleading ads, some featuring AI-generated deepfakes of celebrities to lend false credibility. 

After installation, users typically never receive promised payouts; instead, the apps serve persistent ad after ad, turning victims into a revenue stream for the operators through fraudulent ad impressions. Some apps also request unusual permissions or exhibit behavior that could pose serious security risks on corporate or personal devices. 

Beyond ad fraud, the researchers found Early Access listings that appear to infringe third-party trademarks, including imitation titles capitalizing on popular games and brands. The Early Access status also lets operators sidestep stricter rules that apply to real-money gambling apps, such as licensing requirements, geofencing, and age verification, by presenting themselves as unfinished or non-gambling products. This combination of weak oversight, hidden reviews, and external promotion creates a high-reward, low-risk channel for deceptive developers. 

Safety recommendations 

For users, the safest approach is to treat Early Access apps with extra caution, especially those promising cash, crypto, gift cards, or jackpots, and to avoid installing apps pushed via sensational social media ads. Organizations should consider blocking or flagging Early Access apps on managed Android devices, given the elevated risk of ad fraud, data harvesting, and permission abuse. On the platform side, Bitdefender’s findings highlight the need for Google to introduce stronger signals—such as limited or moderated user feedback, clearer labeling, and tighter review of high-risk categories—even within Early Access, to prevent the program from becoming a safe haven for deceptive apps.
Read more »
switch
Cyber Security Data Theft Nintendo qr code switch

Nintendo Switch Security Flaw Lets Nearby Attackers Exploit QR Codes Used to Share Screenshots

 



Nintendo has issued an urgent security advisory for owners of the original Switch console, warning of a flaw that could allow an attacker in close physical proximity to run unauthorized code on the device or pull data stored on it, simply by scanning a QR code displayed on the screen.

The vulnerability, catalogued as CVE-2026-82079, sits inside the console's local wireless networking stack and is classified as a stack-based buffer overflow, a type of memory corruption flaw in which a program writes more data into a fixed-length block of memory than it can hold. According to the technical record logged on OpenCVE, an attacker within wireless range can send specially crafted network packets that overflow this buffer and hijack the execution path of the device using a technique called return-oriented programming, which chains together fragments of existing code to carry out malicious instructions.

The bug affects all Nintendo Switch consoles running firmware earlier than version 23.0.0. The Switch 2 is not affected.


Where the QR code comes in

The attack is not theoretical in isolation, but it does require a specific scenario to work. The vulnerability surfaces when the console generates a QR code as part of its "Send to Smartphone" feature inside the Album application, which players use to transfer screenshots and video clips to a mobile device. It also appears when the local wireless function is active during a session of Mario Kart Live: Home Circuit, a game that pairs a real-world physical kart with the console.

In both cases, a QR code is briefly displayed on the Switch screen or the connected TV. Nintendo's advisory states that an attacker would need to physically scan that code while it is visible. If they manage to do so, the console becomes vulnerable to arbitrary code execution or information disclosure.

Nintendo said it has no evidence the flaw has been exploited in the wild as of September 10. The company also did not say that the vulnerability could be used to steal Nintendo account credentials, though it acknowledged that more serious exploits could theoretically be built on top of it.


Update now, or take these precautions

The fix is straightforward: install system update 23.0.0. Consoles connected to the internet will pull the update automatically, but players should verify the installation has completed in the console's System Settings under System and then System Update.

For players who cannot update immediately, Nintendo recommends keeping QR codes out of sight during photo and video sharing sessions. The company also advises against using another person's smartphone when transferring media, and against letting anyone else use their kart during a Mario Kart Live: Home Circuit session, since either scenario could create an opportunity for an attacker to scan the code.


How exposed is the player base

The scope of this issue is substantial purely because of how many original Switch units are in circulation. The original Switch has shipped over 155.92 million lifetime units as of March 31, 2026, making it one of the best-selling consoles ever made. Even with the Switch 2 now in the market, tens of millions of households around the world are still running the original hardware day to day. 

Nintendo said the flaw was discovered and reported by external security researchers, though it did not name them in its advisory, which was published on September 10.

The practical risk of this exploit being triggered in a real-world attack is relatively narrow. An attacker would need to be physically close to the device, see the QR code on screen, and scan it within the brief window it is displayed. That is a more demanding set of conditions than most software vulnerabilities require. But the potential consequence, unauthorized code execution on the console, is serious enough that Nintendo moved quickly to patch it, and players should move just as quickly to install that patch.

Read more »
Hacker attack
Backdoor Attacks backdoor vulnerability China Hackers Cyber Attacks cybersecurity research Gen Digital Hacker attack

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

 

China-linked hackers took advantage of a vulnerability within Sogou Input Method, a widely used typing utility for Chinese characters on Windows, and managed to implant a backdoor onto their victims' computers, security company Gen Digital stated in research published Thursday. 

An initial crafted link would kick off the chain of events, giving the attackers end-to-end access to perform anything the logged in user would have access to. Tencent, which both owns and is developing Sogou, has alreadypatched the vulnerability in April 2026. The vulnerability was uncovered by Gen as they tracked a live ongoing breach by a group known as UNC3569, a China based hacker-for-hire. The group has been tracked since 2021 by Google Threat Intelligence to government, academic, technology, and financial targets, predominantly in Eastern and Southeast Asia. 

The planted backdoor (GRAYRABBIT), is a small program the group has been using for many years. As the first stage of gaining access to a machine, it is used to create a command shell remotely from the attacker, allowing for the uploading and downloading of files. More modules from the attacker's server could also be added into a system at any point via this command-line interface. Research produced in 2023 by Citizen Lab suggests that Sogou Input Method boasts over 455,000,000 monthly users on Windows, Android, and iOS respectively, and has captured approximately 70% of the Chinese input-method market. 

On Windows, this application functions by having several components send messages between one another utilizing its own custom link type, sgbiz:. Gen discovered that the program intended to process these links had an error. It failed to correctly screen command-line arguments from the user, meaning attackers can order Sogou's settings program to instead launch its skin store functionality, but directing it towards the attacker controlled website instead- the only functioning part of the application that opens the browsing window without checking which site you are visiting. 

This browser is already outdated; embedded within the Sogou package is version 80 of Chromium from March 2020. Neither the sandbox protection, nor the same-origin policy in this Chromium build were disabled in the codebase. This allowed a vulnerability released within the Java Script Engine in October 2021 (CVE-2021-38003, fixed in Chrome 95 October that year) to be taken advantage of once more by Chinese hackers. The exploit sends a downloader which can then fetch a few files from an Alibaba Cloud server situated in Hong Kong. 

One file was a DLL designed to spoof and hide inside a pirated copy of 7-Zip. Running processes would be scrutinized for analysis methods in a sandboxed environment prior to deployment of the GRAYRABBIT, which sends out requests for and receives information from a command server, encrypted by RC4 over port 443. Gen alerted Tencent on April 9 th 2026 (the vulnerability has been noted under the designation CVE-2026-51990), and Tencent provided a fix within twelve days in version 16.3.0.3498 (released April 21 st). 

It should be noted that the vulnerability present with the old Chromium build and compromised securities does not appear to have been amended. Users are instructed to update their version of Sogou Input Method without delay, and maintain an eye on the indicators of compromise on publication, which includes the malicious DLL, backdoor files, and applicable command and control websites.
Read more »
User Privacy
Android Trojan Data Theft malware MantaxOtax User Privacy

MantaxOtax Android Malware Merges Ransomware and Spyware in New Indonesian Campaign

 

MantaxOtax is a newly identified Android malware that merges ransomware-style file encryption with aggressive spyware capabilities, enabling attackers to both lock users out of their devices and harvest sensitive personal data. Discovered by Zimperium's zLabs team and detailed in a September 9 technical write-up, the threat appears linked to Indonesian actors and spreads primarily via sideloaded APKs hosted on third-party file-sharing platforms. This dual-function design marks a significant escalation in mobile threats, combining financial extortion with deep surveillance to maximize victim impact. 

Once installed, MantaxOtax requests device administrator privileges, followed by permissions for SMS, contacts, audio, images, and Android Accessibility services, which grant it deep control over user interactions. It dynamically resolves its command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the malware code. 

On Android 9 and earlier, it recursively scans external storage, encrypts files using AES with unique per-device keys fetched from C2, deletes originals, and leaves behind .enc files; on Android 10+, Scoped Storage limits encryption to the app's own directory. The malware also overwrites victims' images with ransom notes and opens a Firebase-based chat interface for extortion negotiations, which researchers found partially exposed due to a server misconfiguration. 

Beyond encryption, MantaxOtax operates as a full-featured spyware, collecting app inventories, hardware specs, location, browser history, notifications, contacts, call logs, and SMS—including one-time passwords (OTPs). It exfiltrates gallery content, linked Google accounts, WhatsApp profiles and messages (via Accessibility), and Telegram credentials and chat histories. By abusing Android's MediaProjection API, it captures screenshots, records MP4 screen videos, and streams near-real-time footage to attackers, storing media on the Catbox file host. It can also silently activate front or rear cameras to take photos without user knowledge, turning infected devices into always-on surveillance tools. 

Researchers observed multiple variants employing psychological pressure tactics: persistent screen locks, application blocking, and transparent overlays that hijack all touch input. Some versions bombard victims with repeating alert dialogs, full-screen video overlays, and image popups appearing every 600 milliseconds, while others use text-to-speech to audibly deliver attacker messages. A second iteration adopted WebSocket communications for more resilient C2 channels and added features like continuous screen locking and app blacklisting, making remediation harder for average users. These harassment techniques are designed to overwhelm victims into compliance, increasing the likelihood of ransom payment or credential surrender. 

Evidence including language markers and recovered victim files suggests MantaxOtax primarily targets Indonesian users. The misconfigured server also leaked what appears to be the operators' control panel, offering rare insight into their infrastructure. This campaign follows closely after the discovery of THost9, another Android trojan that clones banking apps into isolated work profiles to evade detection. Together, these threats underscore a growing trend of multi-stage mobile malware combining financial fraud, surveillance, and ransomware—highlighting the critical need for users to avoid sideloading apps, keep devices updated with the latest security patches, and use reputable mobile security solutions to detect and block such sophisticated threats before they cause harm.
Read more »
Subscribe to: Posts (Atom)