Hack

OpenAI dice que la prueba del modelo estuvo detrás del hack de Hugging Face

Un ciberataque que envenenó el flujo de datos de una importante plataforma de código de IA se llevó a cabo utilizando ChatGPT de OpenAI, dijo la compañía el martes.

La semana pasada, Hugging Face, una plataforma para compartir y trabajar en código de IA, revelado que un atacante externo había comprometido su proceso de procesamiento de datos. Según una publicación de blog del 21 de julio, el atacante envenenó un conjunto de datos para ejecutar código en un trabajador de procesamiento, obteniendo finalmente acceso a nivel de nodo y robando credenciales de la nube.

El ataque es notable, decía el blog, porque parece haber sido llevado a cabo por un sistema autónomo de IA, que ejecutó “muchos miles de acciones individuales a través de un enjambre de entornos limitados de corta duración, con comando y control automigratorio escenificado en servicios públicos”.

En ese momento, Hugging Face dijo que no estaba claro qué LLM se utilizó en el ataque, pero señaló que sus propios intentos de recrear partes del ataque utilizando un modelo comercial interno fracasaron debido a las restricciones de la barandilla.

El incidente y su impacto final aún se están investigando, y Hugging Face dijo que informó el incidente a las autoridades y está colaborando con especialistas forenses en ciberseguridad externos para obtener más información.

«Esta experiencia apunta a una brecha que vale la pena planificar», escribió la empresa. «No sabemos qué modelo impulsó a los agentes del atacante, si un modelo alojado con jailbreak o uno de peso abierto sin restricciones; de cualquier manera, el atacante estaba sujeto a una política de no uso, mientras que nuestro propio trabajo forense fue bloqueado por las barreras de seguridad de los modelos alojados que probamos por primera vez».

Ahora OpenAI confirma que uno de sus modelos fue utilizado en el ataque.

«Después de investigar, ahora sabemos que este incidente en particular fue impulsado por una combinación de modelos OpenAI, incluido GPT-5.6 Sol y un modelo de prelanzamiento aún más capaz, todos con rechazos cibernéticos reducidos para fines de evaluación, mientras se probaba internamente en un punto de referencia de capacidades cibernéticas», escribió la compañía en un blog publicar el martes.

OpenAI calificó el incidente como “sin precedentes”, pero también predijo que tales ataques se volverían cada vez más comunes a medida que la adopción de la IA continúe creciendo.

Según la empresa, el incidente ocurrió durante una evaluación interna, donde la empresa incita deliberadamente a los modelos a «buscar una explotación avanzada utilizando rutas de ataque complejas» para que la empresa estudie y mida las capacidades de ciberseguridad del modelo.

Para evaluar todo el potencial del modelo, el equipo desactivó los clasificadores de producción que normalmente impiden que los modelos OpenAI lleven a cabo actividades cibernéticas de alto riesgo. Sin estas salvaguardas, los modelos pudieron instalar paquetes de software a través de registros como Hugging Face.

El modelo recopiló y encadenó vulnerabilidades de los sistemas de OpenAI, así como de la infraestructura de producción de Hugging Face.

OpenAI explicó además que la actividad surgió de modelos que intentaban resolver un desafío específico planteado por ExploitGym, un sistema de evaluación comparativa para agentes de IA. Si bien estas pruebas normalmente se ejecutan en entornos aislados, en este caso, el modelo gastó una cantidad «sustancial» de recursos informáticos para descubrir cómo acceder a Internet abierto. Lo hizo utilizando una vulnerabilidad de día cero en el sistema de un proveedor externo utilizado por OpenAI (la compañía dijo que reveló la falla al proveedor).

«Después de obtener acceso a Internet, los modelos dedujeron que Hugging Face potencialmente alojaba modelos, conjuntos de datos y soluciones para ExploitGym», escribió OpenAI. «Sabiendo esto, el modelo buscó y encontró con éxito formas de obtener acceso a información secreta que podría utilizar para engañar la evaluación».

En un caso, el modelo encadenó múltiples credenciales robadas y vulnerabilidades de día cero para encontrar una ruta de ejecución remota de código en los servidores de Hugging Face.

OpenAI dijo que estaba implementando nuevos controles para la configuración de la infraestructura, algo que se produciría «a costa de la velocidad de la investigación mientras se reparan las vulnerabilidades».

Hugging Face también se agregó al programa Trusted Access for Cyber de OpenAI, que les dará acceso a modelos más avanzados como Daybreak para buscar en sus sistemas otras vulnerabilidades descubiertas por la IA.

admin Noticias, Trending años cada CYBERDEFENSA.MX dispersos dos Hack Hackers millones obtienen por Spider TfL uno

Dos hackers Spider dispersos obtienen 5,5 años cada uno por un hack TfL de £ 29 millones – CYBERDEFENSA.MX

flores owen18, y Thalha Jubairde 20 años, fueron condenados cada uno a cinco años y medio en el Tribunal de la Corona de Woolwich el jueves 16 de julio de 2026 por el hackeo de 2024 a Transport for London.

El ataque dejó inoperables 148 sistemas TfL y obligó a los 27.000 empleados de la autoridad de transporte a ir a una oficina para restablecer sus contraseñas en persona. Tanto la NCA como la CPS cifran las pérdidas y los costes de recuperación de TfL en 29 millones de libras esterlinas.

Ambos se declaró culpable el 22 de junio de 2026el día en que debía comenzar su juicio. El cargo era el artículo 3ZA de la Ley de uso indebido de computadoras de 1990, el más grave de la ley, y lo admitieron basándose en que fueron imprudentes en cuanto a si causaron o crearon un riesgo significativo de daño grave al bienestar humano.

El CPS dice que se cree que Flowers y Jubair son los primeros piratas informáticos procesados con éxito en virtud de la Sección 3ZA. El ANC cuenta el caso como sólo el segundo procesamiento de este tipo. Las dos lecturas pueden ir juntas, una contando los procesamientos iniciados bajo la sección y la otra contando aquellos que terminaron en condena, pero ninguna agencia explica la brecha.

La NCA lo considera el mayor procesamiento por delitos cibernéticos que jamás hayan visto los tribunales del Reino Unido.

La intrusión se produjo del 31 de agosto al 3 de septiembre de 2024. TfL supervisa una media de 9 millones de viajes al día. Dial-a-Ride, el servicio de reservas que lleva a los londinenses vulnerables a recorrer la ciudad, cayó, junto con el canal de pagos digitales y la emisión de tarjetas de viaje en condiciones favorables.

Se cerraron las solicitudes para las tarjetas fotográficas Oyster, las tarjetas de tarifa reducida para niños y jóvenes de Londres. La extensión de la venta de boletos sin contacto disminuyó y los reembolsos aumentaron.

TfL dijo a los clientes que se había accedido a nombres y direcciones de correo electrónico, junto con las direcciones particulares donde los guardaba. Es posible que los datos de reembolso de Oyster también hayan desaparecido, incluidos los números de cuentas bancarias y los códigos de clasificación de unas 5.000 personas.

Sólo ellos dos sabían lo que querían hacer con el acceso, dice el CPS, aunque sus conversaciones sugirieron que borrarían el acceso al salir. De ahí proviene la mayor cifra del caso: la NCA dice que un cierre exitoso de la red podría haber costado a la economía del Reino Unido hasta £56 mil millones, y el CPS sitúa la misma hipótesis en miles de millones. Se mantuvo hipotético, dice el CPS, porque TfL desmanteló su propia red para contenerlos.

flores era Fue arrestado en su casa el 6 de septiembre de 2024, tres días después de que terminara la intrusión de TfL, y la NCA dice que los agentes lo encontraron en medio de un ataque a dos organizaciones de atención médica estadounidenses, SSM Health Care Corporation y Sutter Health.

Los investigadores confiscaron computadoras portátiles, computadoras de torre, discos duros y memorias USB. Una computadora portátil contenía una captura de pantalla de la conectividad de red a la infraestructura de TfL, además de videos que Flowers había grabado de Jubair moviéndose a través de los sistemas de TfL durante el ataque. La pareja estaba enviando mensajes en Telegram mientras sucedía y compartiendo un espacio de trabajo en línea.

Los fiscales demostraron que Flowers había estado conectado al servidor remoto utilizado para lanzar las tres intrusiones, y sus propios dispositivos lo vincularon a las tres. La información que vincula a Jubair con TfL fue descubierta en el extranjero y obtenida con la ayuda de los fiscales allí.

Flowers admitió dos cargos más sobre ataques a la atención médica, una conspiración contra SSM Health y un atentado contra Sutter Health. El CPS dice que amenazó con bloquear esos sistemas y reconoció en los chats que «Podría matar a una persona de 90 años con soporte vital». El arresto es lo que lo detuvo.

La NCA describe a ambos hombres como miembros destacados de Scattered Spider, el equipo de extorsión también rastreado como Octo Tempest, UNC3944 y 0ktapus. El CPS es más cuidadoso y dice que los acusados afirmaron en varios momentos ser miembros de un grupo que, según los fiscales, llevó a cabo cientos de ataques entre 2022 y 2025.

El FBI, citado en el anuncio de la NCA, vincula al grupo con extorsión de datos, intercambio de SIM e ingeniería social.

El otro caso de Jubair sigue abierto

una queja abierto en Nueva Jersey en septiembre de 2025 acusa a Jubair de fraude informático, fraude electrónico y conspiraciones de lavado de dinero. La denuncia sitúa el plan en aproximadamente 120 intrusiones en la red y al menos 47 víctimas en Estados Unidos entre mayo de 2022 y septiembre de 2025, con más de 115 millones de dólares pagados en rescates.

Los fiscales también lo ubican en intrusiones en una empresa de infraestructura crítica de EE. UU. y en los tribunales de EE. UU., y alegan que sacó alrededor de $ 8,4 millones en criptomonedas de una billetera de servidor mientras los agentes las confiscaban. Esas son acusaciones que no han sido probadas en los tribunales. El máximo en todos los aspectos es 95 años. Ni el anuncio del Departamento de Justicia ni los comunicados del jueves en el Reino Unido abordan la extradición.

¿Está terminada la Araña Dispersa?

La NCA dice que su acción contra los dos hombres detuvo efectivamente al grupo y cita la evaluación de Microsoft de que los arrestos degradaron materialmente la capacidad del grupo para operar. Al mismo tiempo, permite que otros delincuentes puedan seguir usando la marca.

Scattered Spider no es la única marca a la que le queda vida. En enero, Mandiant siguió una expansión de extorsión de la marca ShinyHunters que ejecuta el mismo tipo de ingeniería social: llamadas vishing a los empleados, páginas de recolección de credenciales de la marca de la víctima para capturar inicios de sesión SSO y códigos MFA, luego el propio dispositivo del atacante se inscribe en MFA.

Ni los comunicados escritos de la NCA ni del CPS establecen cómo Flowers y Jubair llegaron por primera vez a TfL. de google guía de endurecimiento de la misma investigación coloca la solución en un solo lugar: verificar la identidad en el restablecimiento de contraseñas, el registro de dispositivos y los cambios de MFA, los flujos de trabajo manuales a los que estos equipos llaman y siguen.

Paul Foster, que dirige la Unidad Nacional de Delitos Cibernéticos de la NCA, quiere una cosa de todos los demás: llamar a las autoridades lo antes posible. Dice que estas condenas probablemente no se habrían producido si TfL no lo hubiera hecho.

La policía de la ciudad de Londres utilizó la sentencia para ejercer presión en favor de un poder que no tiene. Las Órdenes de Riesgo de Delitos Cibernéticos permitirían a un tribunal restringir los dispositivos, servicios en línea y tecnologías de un individuo en proporción al riesgo que representan.

El comandante Ollie Shaw los presentó como «prisión digital» para los delincuentes. Así que el conjunto de herramientas es lo que era: una pena de prisión, esta vez entregada a dos personas que tenían 17 y 18 años cuando lo hicieron.

admin Noticias, Trending 290M Abuse CYBERDEFENSA.MX DeFi Farms Hack LotL macOS ProxySmart SIM Stories

$290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories – CYBERDEFENSA.MX

You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.

The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work, giving attackers easy access.

AI tools are also part of the problem now. They trust bad input and take real actions, which makes the damage bigger. Then there are quieter issues. Apps take data they should not. Devices behave in strange ways. Attackers keep testing what they can get away with. No noise. Just ongoing damage.

Here is the list for this week’s ThreatsDay Bulletin.

State-backed crypto heist

Inter-blockchain communication protocol LayerZero has revealed that North Korean threat actors tracked TraderTraitor may have been behind the recent hack of decentralized finance (DeFi) project KelpDAO, resulting in the theft of $290 million. «The attack was specifically engineered to manipulate or poison downstream RPC infrastructure by compromising a quorum of the RPCs the LayerZero Labs DVN relied upon to verify transactions,» LayerZero said. KelpDAO, in a post on X, said, «Two RPC nodes hosted by LayerZero were compromised. A simultaneous DDoS attack was launched against the third RPC node. This was an attack on LayerZero’s infrastructure. Kelp’s own systems were not involved in building or operating that infrastructure.» Meanwhile, the Arbitrum Security Council has temporarily frozen the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. It’s worth noting that TraderTraiter was attributed to the mega Bybit hack in early 2025 that led to the theft of $1.5 billion in digital assets. Recently, Lazarus Group was also linked to the $285 million theft from the Drift Protocol.
Active RCE exploits

Separately, VulnCheck has warned of attacks attempting to exploit two flaws in MajorDoMo, a smart home automation platform. While CVE-2026-27175 is a critical command injection vulnerability that started seeing exploitation on April 13, CVE-2026-27174 allows unauthenticated remote code execution via the PHP console in the admin panel and was first detected on April 18. «CVE-2026-27175 was exploited to drop a PHP webshell that delivers persistent backdoor access,» VulnCheck said. «CVE-2026-27174 saw exploitation that ended in a Metasploit php/meterpreter/reverse_tcp staged payload.» Other vulnerabilities that have witnessed exploitation efforts include CVE-2025-22952, an SSRF in Elestio Memos, and CVE-2024-57046, an authentication bypass in NETGEAR DGN2200 routers.
Supply chain malware surge

A number of malicious packages have been discovered in the npm registry: ixpresso-core, forge-jsx, @genoma-ui/components, @needl-ai/common, rrweb-v1, cjs-biginteger, sjs-biginteger, bjs-biginteger, @fairwords/websocket, @fairwords/loopback-connector-es, @fairwords/encryption, js-logger-pack, and @kindo/selfbot. These packages come with features to steal sensitive data from compromised hosts, perform system reconnaissance, andimplant an SSH backdoor by injecting the attacker’s public key into ~/.ssh/authorized_keys, deliver an information stealer, and spread the XWorm remote access trojan (RAT). The packages published under the «@fairwords» scope have also been found to self-propagate to all npm packages using the victim’s token and attempt cross-ecosystem propagation to PyPI via .pth file injection. New versions of js-logger-pack have since been found to leverage the Hugging Face repository to poll for updates and use it as a data-theft destination. Also detected was the compromise of @velora-dex/sdk (version 9.4.1) to decode and execute a Base64 payload that fetches a shell script from a remote server that, in turn, downloads and persists a Go-based remote access trojan called minirat on macOS systems. Another legitimate package to be compromised was mgc (versions 1.2.1 through 1.2.4), which was injected with a dropper that detects the operating system and fetches a platform-specific RAT from a GitHub Gist to exfiltrate valuable data.
AI prompt injection surge

Forcepoint has detected 10 new indirect prompt injection (IPI) payloads targeting artificial intelligence (AI) agents with malicious instructions designed to achieve financial fraud, data destruction, API key theft, and AI denial-of-service attacks. «Regardless of the specific payload technique or attacker intent, every case follows the same fundamental sequence: the attacker poisons web content, hides the payload from human view, waits for an AI agent to ingest the page, exploits the LLM’s inability to distinguish trusted instructions from attacker-controlled content, and triggers a real-world action with a covert exfiltration return channel back to the attacker,» the company said.
Covert browser data access

The Claude desktop app has been found granting itself permission to access web browser data, even if some browsers haven’t even been installed on a user’s computer, web privacy expert Alexander Hanff said. The app has been spotted placing configuration files in preset locations for Chromium-based browsers like Brave, Google Chrome, Microsoft Edge, and Vivaldi. The Native Messaging manifest files pre-authorize Claude to interact with the browser even before the user installs it. The issue has been described as a case of dark pattern that violates privacy laws in the E.U.
Hardware display protection

The U.K. National Cyber Security Centre (NCSC) has unveiled a new technology called SilentGlass that’s designed to protect video connections from cyber attacks. «SilentGlass, a plug-and-play device, actively blocks anything unexpected or malicious between HDMI and Display Port connections and screens,» NCSC said. «Already successfully deployed on Government estates, SilentGlass is now available for anyone to buy and use. It has been approved for use in the most high-threat environments.»
Passkeys replace passwords

In a related development, the NCSC also endorsed passkeys as the default authentication standard and the «first choice of login» for access to all digital services. «Passkeys are a newer method for logging into online accounts, which do much of the heavy lifting for users, only requiring user approval rather than needing to input a password,» NCSC said. «This makes passkeys quicker and easier to use and harder for cyber attackers to compromise.» It also said the majority of cyber harms to individuals begin with criminals stealing or compromising login details, which makes passkey adoption a «huge leap» in boosting resilience to phishing attacks. More than 50% of active Google services users in the U.K. are said to be already using passkeys.
Backdoor sabotage claims

Reports from Iranian media have claimed that hardware made by Cisco, Juniper, Fortinet, and MikroTik either rebooted or disconnected during recent attacks on Iran, despite the country being cut off from the global internet. «The most striking and suspicious aspect of this incident is its precise timing and the lack of access to the international internet at that moment,» Iranian news website Entekhab said. «This disruption occurred at a time when international gateways were effectively blocked or inaccessible; therefore, attributing this chain collapse to ‘a simple cyber attack from beyond the borders’ is not only unconvincing but also reveals the traces of deep-seated sabotage embedded within the equipment.» The report hypothesizes the presence of hidden firmware backdoors or rogue implants within compromised devices, creating a dormant botnet that’s activated when a certain event occurs without the need for internet access. The other possibility is a supply chain compromise. «If the chips or installation files of Cisco and Juniper products are compromised before entering the country, even replacing the operating system will not solve the problem, because the root of the problem is embedded in the hardware and read-only memory (ROM),» the report said. These arguments have found purchase in China, whose state media agency Xinhua called U.S.-made equipment the «real trojan horse.» The disclosure comes as DomainTools revealed that the various hacktivist personas adopted by Iran, such as Homeland Justice, Karma, and Handala, «constitute a coordinated, MOIS-aligned cyber influence ecosystem operating under multiple branded identities that serve distinct but complementary operational roles.»
Ransomware infighting escalates

The Krybit ransomware group has hacked the website of rival ransom group 0APT after the latter threatened to dox Krybit’s members. According to security firm Barricade, 0APT leaked the complete database of the Krybit ransomware operation, including victim records, plaintext credentials, Bitcoin wallets, encryption tokens, and a 56MB exfiltration file inventory. In return, Krybit has hit back by compromising 0APT’s server within 48 hours, defacing their data leak site, and publishing source code, bash history, Nginx logs, and system files. To rub salt into the wound, the group listed 0APT as victim #1 on their own leak site.
Stealth malware-as-a-service

There is a new cryptor-as-a-service platform called FUD Crypt (fudcrypt[.]net). «For $800 to $2,000 per month, subscribers upload an arbitrary Windows executable and receive a multi-stage deployment package that attempts automatic DLL sideloading, in-memory AMSI and ETW interference, silent UAC elevation via CMSTPLUA, and Windows Defender tamper via Group Policy on Enterprise builds,» Ctrl-Alt-Intel said.
Formbook phishing surge

Two different phishing campaigns targeting Greek, Spanish, Slovenian, Bosnian, Latin, and Central American companies are using different techniques to deliver Formbook malware. «FormBook is a data-stealing malware that targets Windows systems, primarily distributed through phishing emails with malicious attachments,» WatchGuard said. “It collects sensitive information like login credentials, browser data, and screenshots, using advanced evasion techniques to avoid detection.”
Stealth .NET execution abuse

A highly sophisticated, multi-stage post-exploitation framework has been observed targeting organizations in the Middle East and EMEA financial sectors. «The threat actor leverages a legitimate, digitally signed Intel utility (IAStorHelp.exe) by abusing the .NET AppDomainManager mechanism, effectively turning a trusted binary into a stealthy execution container,» CYFIRMA said. «This approach allows malicious code to be executed within a trusted environment. It bypasses conventional security controls without modifying the original signed binary.» Because AppDomainManager hijacking enables stealth execution within a trusted signed binary, it allows malicious code to run without modifying the original executable, effectively bypassing code-signing trust controls. The attack begins with a phishing email containing a ZIP archive, which contains an LNK file masquerading as a PDF document to execute «IAStorHelp.exe.» It’s currently not known who is behind the campaign, but the level of sophistication, modular design, and operational discipline suggest capabilities consistent with advanced threat actors.
RAT plus adware bundle

A new malware campaign is spreading both a remote access trojan and adware together, allowing attackers to establish persistent access and make financial profits. The attack has been found to leverage a loader to deliver Gh0st RAT trojan and CloverPlus adware, an unwanted software designed to install advertising components and change browser behavior, such as startup pages and pop-up ads, per Splunk.
macOS stealth execution abuse

In a new analysis, Cisco Talos revealed that bad actors can bypass security controls in Apple macOS by repurposing native features like Remote Application Scripting (RAS) for remote execution and abusing Spotlight metadata (Finder comments) to stage payloads in a way that evades static file analysis. «Because Finder is scriptable over RAE, the comment of a file on a remote machine can be set via the “eppc://” protocol. By Base64 encoding a payload locally, a multi-line script can be stored within this single string field. The make new file command handles the creation of the target file, ensuring that no pre-existing file is required,» Talos said. «The payload resides entirely within the Spotlight metadata, a location that remains largely unexamined by standard endpoint detection and response (EDR) solutions. This creates a stealthy staging area where malicious code can persist on the disk without triggering alerts associated with suspicious file contents.» In addition, attackers can move toolkits and establish persistence using built-in protocols such as SMB, Netcat, Git, TFTP, and SNMP operating entirely outside the visibility of standard SSH-based telemetry. In some cases, adversaries can also bypass built-in restrictions by using Terminal as a proxy for execution, encoding payloads in Base64 and deploying them in stages.
LLM agent testing framework

A group of academics has released a hackable, modular, and configurable open-source framework called Terrarium for studying and evaluating decentralized LLM-based multi-agent systems (MAS). «As the capabilities of agents progress (e.g., tool calling) and their state space expands (e.g., the internet), multi-agent systems will naturally arise in unique and unexpected scenarios,» the researchers said, adding it acts as «an isolated playground for studying agent behavior, vulnerabilities, and safety. It enables full customization of the communication protocol, communication proxy, environment, tool usage, and agents.»
AI data privacy purge

According to Reuters, AI company Clarifai said it has deleted 3 million profile photos taken from dating site OkCupid in 2014. It follows a settlement reached last month between the U.S. Federal Trade Commission (FTC) and Match Group, OkCupid’s owner. Clarifai is said to have certified the data deletion to the FTC on April 7, 2026, and deleted any models that trained on the data. The company also emphasized that it hadn’t shared the data with third parties. The FTC opened the investigation in 2019, after The New York Times reported that Clarifai had built a training database using OkCupid dating profile photos. The behavior was a direct violation of OkCupid’s privacy policy, although Clarifai was not accused of wrongdoing.
Zero-credential RCE chain

VulnCheck said it’s seeing active exploitation of the Apache ActiveMQ Jolokia remote code execution chain that strings together CVE-2026-34197 and CVE-2024-32114. «CVE-2024-32114 removes authentication from the Jolokia endpoint entirely on ActiveMQ versions 6.0.0 through 6.1.1,» VulnCheck’s Jacob Baines said. «Combined with CVE-2026-34197, that is zero-credential RCE.»
Stealth phishing lure

There has been a surge in phishing emails utilizing empty subject lines as a way to lure users to actually click and open the email without the usual warning cues. Known as silent subject or null subject phishing, the technique is designed to exploit blind spots in email defenses, as it allows such emails to bypass security filters that rely on analyzing the subject lines for specific keywords that may indicate potential phishing or scam. «Emails with empty subject lines evade user suspicion by exploiting human curiosity,» CyberProof said. «The primary objective of a silent subject campaign is to gain initial access through social engineering, leading to credential compromise, unauthorized access, and potential lateral movement within targeted environments, especially focusing on high-value or VIP users.»
Industrial-scale SIM farms

A Belarus-based turnkey solution is assisting SIM farm operators in supporting cybercrime on an industrial scale. Infrawatch said that it identified 87 instances of ProxySmart control panels in 17 countries that are linked to at least 24 commercial proxy providers and 35 cellular providers. The footprint spans 94 phone farm locations, distributed across 19 U.S. states, as well as countries in Europe and South America. ProxySmart provides an end-to-end platform for operating and monetizing mobile proxy infrastructure, including farm management, device control, customer provisioning, retail proxy sales, and payment handling. It’s accessible via a web-based control panel that’s self-hosted by the farm operator. Devices in the farms are either physical Android phones or USB 4G/5G modems. The phones are enrolled via an unsigned Android APK package downloaded from the ProxySmart website, with SMS send and receive capability included. Modems are managed through ModemManager, an open-source USB dongle management tool. The ProxySmart service is written in Python and obfuscated using PyArmour. «ProxySmart is publicly associated with a Belarus-based vendor footprint and offers an end-to-end stack for operating and monetizing a physical farm, including device management, automated IP rotation, customer provisioning, plan enforcement, and anti-bot countermeasures,» the company said. «Technical analysis indicates operator capabilities consistent with large-scale evasion enablement, including automated IP rotation, remote device control, and network fingerprint spoofing.» SIM farms enable a range of cybercrime activity such as smishing, premium-rate number fraud, bot sign-ups, and one-time password interception. In response to the findings, ProxySmart disputed its characterization as a SIM farm, stating it’s a «data-path proxy management platform» and that its mobile proxy infrastructure «underpins a wide range of legitimate commercial and research activity» including advertising verification, brand protection, price monitoring, and anti-fraud model training, among others.
Telegram under CSAM probe

Ofcom, the U.K.’s independent communications regulator, has launched an investigation into Telegram under the country’s Online Safety Act to examine whether the platform is being used to share child sexual abuse material (CSAM) and is doing enough to combat the threat. «We received evidence from the Canadian Centre for Child Protection regarding the alleged presence and sharing of child sexual abuse material on Telegram, and carried out our own assessment of the platform,» Ofcom said. «In light of this, we have decided to open an investigation to examine whether Telegram has failed, or is failing, to comply with its duties in relation to illegal content.» In a statement shared with The Record, Telegram said it «categorically denies Ofcom’s accusations,» adding it has «virtually eliminated the public spread of CSAM on its platform through world-class detection algorithms and cooperation with NGOs.» Earlier this year, Ofcom also commenced a probe into X to determine whether the service is taking necessary steps to take down illegal content, including non-consensual intimate images and CSAM.
EU cracks disinfo ops

The European Union imposed sanctions on two pro-Russian organizations accused of spreading disinformation and supporting the Kremlin’s hybrid influence operations against Europe and Ukraine. The measures target Euromore and the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad (Pravfond). The move is part of the E.U.’s broader effort to counter Russian information and influence operations targeting Europe since the start of Moscow’s full-scale invasion of Ukraine in 2022. The E.U. has imposed sanctions on 69 individuals and 19 entities linked to Russian hybrid warfare.
Bot farm dismantled

Ukrainian authorities have dismantled a bot farm that’s alleged to have supplied thousands of fake social media accounts to Russian intelligence services for use in disinformation campaigns against Ukraine. The suspected organizer of the network has been detained in the northern city of Zhytomyr, and nearly 20,000 fraudulent online profiles that were used in information operations have been blocked. The suspect is believed to have sold more than 3,000 fake Telegram accounts each month to Russian clients. The accounts were created using Ukrainian mobile phone numbers and then advertised on online platforms used by pro-Russian actors. If convicted, the suspect faces up to six years in prison.
Malicious extensions surge

More than 130,000 users have downloaded and installed malicious Chrome and Edge extensions that, while offering the promised functionality, also implement covert tracking, remote configuration capabilities, and data collection mechanisms.The 12 extensions posed as tools to download TikTok videos and were available through the official Chrome and Edge stores. The activity has been codenamed StealTok. The extensions have been found to use remote configuration to bypass store review. «Beyond privacy concerns, the use of remote configuration endpoints introduces a significant security risk, enabling post-installation behavior changes that bypass marketplace review mechanisms,» LayerX said.
Joomla SEO spam backdoor

In a new campaign spotted by Sucuri, threat actors are planting a new PHP-based backdoor on Joomla sites to inject SEO spam. The injected script acts as a remote loader to send information about the infected website and awaits further instructions from an attacker-controlled server. «Attackers inject malicious code that silently serves spam content to visitors and search engines, all without the site owner knowing,» Sucuri said. «The goal is simple: abuse the site’s reputation to push traffic towards products the attacker wants to promote.»
Post-exfiltration data trade

A new service called Leak Bazaar has been promoted on the Russian-speaking TierOne forum that claims to process data stolen from extortion and ransomware attacks and turn it into «something more legible, more selective and precise, and making it marketable for the general population to ingest.» It’s advertised by a user named Snow, who joined the forum on March 3, 2026. «What Leak Bazaar is really offering is not a DLS or Data or Dedicated Leak Site in the conventional sense, but a post-exfiltration service layer,» Flare said. «It is trying to reassure both suppliers and buyers that the platform can solve the most frustrating part of data theft, which is that a large percentage of exfiltrated material is too noisy, too unstructured, or too cumbersome to use without additional labor.»
RDP scanning concentration

GreyNoise has disclosed that a small cluster of 21 IP addresses is now responsible for generating nearly half of all the RDP scanning traffic on the public internet. The addresses are registered to ColocaTel (AS213438), a company based in the Seychelles. According to the threat intelligence firm, mass internet scanning activity is now preceding vendor vulnerability disclosures more frequently than before, with 49% of surges arriving within 10 days of disclosure and 78% within 21 days.In a related development, security researcher Morgan Robertson revealed that almost three-quarters of Perforce P4 source code management servers connected to the internet are misconfigured and leaking source code and sensitive files. «The default Perforce settings allow unauthenticated users to create accounts, list existing users, access passwordless accounts, and, until version 2025.1, allowed syncing repositories remotely; potentially exposing intellectual property across more than a dozen sectors, including gaming, healthcare, automotive, finance, and government,» Robertson said. «Action is recommended for all Perforce administrators to ensure security hardening, including setting stronger authentication requirements, disabling automatic account creation, and raising security levels.»

None of this is new. That is the problem. Old paths still open, basic checks still skipped, and trust still given where it should not be. Attackers are not doing anything magical, they are just faster and less careful because they do not need to be.

The fixes are known but ignored. Patch early, check what you install, limit access, and stop trusting inputs by default. Most of the damage comes from things that were easy to prevent. Same story next week.

admin Noticias, Trending Abused Android CYBERDEFENSA.MX emerge Fraud Hack Push QEMU RATs Vercel

Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More – CYBERDEFENSA.MX

Monday’s recap shows the same pattern in different places. A third-party tool becomes a way in, then leads to internal access. A trusted download path is briefly swapped to deliver malware. Browser extensions act normally while pulling data and running code. Even update channels are used to push payloads. It’s not breaking systems—it’s bending trust.

There’s also a shift in how attacks run. Slower check-ins, multi-stage payloads, andmore code kept in memory. Attackers lean on real tools and normal workflows instead of custom builds. Some cases hint at supply-chain spread, where one weak link reaches further than expected.

Go through the whole recap. The pattern across access, execution, and control only shows up when you see it all together.

⚡ Threat of the Week

Vercel Discloses Data Breach—Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to «certain» internal Vercel systems. The incident originated from the compromise of Context.ai, a third-party artificial intelligence (AI) tool, which was used by an employee at the company, it added. «The attacker used that access to take over the employee’s Vercel Google Workspace account, which enabled them to gain access to some Vercel environments and environment variables that were not marked as ‘sensitive,’» the company said. It’s currently not known who is behind the incident, but a threat actor using the ShinyHunters persona has claimed responsibility for the hack. Context.ai also disclosed a March 2026 incident involving unauthorized access to its AWS environment. However, it has since emerged that the attacker also likely compromised OAuth tokens for some of its consumer users. Furthermore, Hudson Rock uncovered that a Context.ai employee was compromised with Lumma Stealer in February 2026, raising the possibility that the infection may have triggered the «supply chain escalation.»

🔔 Top News

Law Enforcement Operation Brings Down DDoS-for-Hire Operation—Law enforcement agencies across Europe, the U.S., and other partner nations cracked down on the commercial DDoS-for-hire ecosystem, targeting both operators and customers of services used to target websites and knock them offline. As part of the effort, authorities took down 53 domains, arrested four people, and sent warning notifications to thousands of criminal users. The U.S. Justice Department said court-authorized actions were undertaken to disrupt Vac Stresser and Mythical Stress. The actions are a persistent cat-and-mouse game, as booted services often reappear under new names and domains despite repeated takedowns. While these disruptions tend to have short-term results, the resilience of the criminal activity indicates that arrests need to be combined with infrastructure seizures, financial disruption, and user deterrence for lasting impact.
Newly Discovered PowMix Botnet Hits Czech Workers—An active malicious campaign is targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. «PowMix employs randomized command-and-control (C2) beaconing intervals, rather than persistent connection to the C2 server, to evade the network signature detections,» Cisco Talos said. The never-before-seen botnet is designed to facilitate remote access, reconnaissance, and remote code execution, while establishing persistence by means of a scheduled task. At the same time, it verifies the process tree to ensure that another instance of the same malware is not running on the compromised host.
AI-Driven Pushpaganda Exploits Google Discover to for Ad Fraud—A novel ad fraud scheme has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news stories into Google’s Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial scams. The Pushpaganda campaign has been found to target the personalized content feeds of Android and Chrome users. «This operation, named for push notifications central to the scheme, generates invalid organic traffic from real mobile devices by tricking users into subscribing to enabling notifications that presented alarming messages,» HUMAN Security said. Google has since rolled out fixes and algorithmic updates to address the issue.
Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT—A social engineering campaign has abused Obsidian, a cross-platform note-taking application, as an initial access vector to distribute a previously undocumented Windows remote access trojan called PHANTOMPULSE in attacks targeting individuals in the financial and cryptocurrency sectors. Elastic Security Labs is tracking the activity under the name REF6598. It employs elaborate social engineering tactics through LinkedIn and Telegram to breach both Windows and macOS systems by tricking victims into opening a cloud-hosted vault in Obsidian. PHANTOMPULSE is an artificial intelligence (AI)-generated backdoor that uses the Ethereum blockchain for resolving its C2 server. On macOS, the attack is used to deliver an unspecified payload.
CPUID Downloads Hijacked to Serve STX RAT—Unknown threat actors hijacked the official CPUID download page to serve trojanized installers that ultimately led to the deployment of STX RAT, a remote access trojan with infostealer capabilities. The attack did not compromise CPUID’s original signed binaries, the threat actors served their own trojanized packages via redirect. «The threat actor compromised the official CPUID download page to serve a trojanized package, employing DLL sideloading as the initial execution vector followed by a layered, five-stage in-memory unpacking chain designed to evade detection,» Cyderes said. «The use of a timestomped compilation timestamp, reflective PE loading, and exclusively in-memory payload execution demonstrates a deliberate effort to hinder forensic analysis and bypass traditional security controls.»
108 Malicious Chrome Extensions Steal Google and Telegram Data—A cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited. The extensions provide the expected functionality to avoid raising red flags, but malicious code running in the background connects to the threat actor’s C2 server to perform the nefarious activities. At the center of the campaign is a backend hosted on a Contabo virtual private server (VPS), with multiple subdomains handling session hijacking, identity collection, command execution, and monetization operations. There is evidence indicating a Russian malware-as-a-service (MaaS) operation, based on the presence of a payment and monetization portal in its C2 infrastructure.
OpenAI Launches GPT-5.4-Cyber—OpenAI announced a new model, GPT-5.4-Cyber, specifically designed for use by digital defenders. Artificial intelligence (AI) companies have repeatedly warned that more capable AI models could create an opening for bad actors to exploit vulnerabilities and security gaps in software with new speed and intensity. Unlike Anthropic, which said its new Claude Mythos model is only being privately released to a small number of trusted organizations due to concerns that it could be exploited by adversaries, OpenAI said «the class of safeguards in use today sufficiently reduce cyber risk enough to support broad deployment of current models,» but hinted at the need for more advanced protections in the long term. Defending critical software has long depended on the ability to find and fix vulnerabilities faster than attackers can exploit them. GPT-5.4-Cyber has a lower refusal boundary for legitimate cybersecurity work than standard GPT-5.4. It adds capabilities aimed at advanced defensive workflows, including binary reverse engineering. «We don’t think it’s practical or appropriate to centrally decide who gets to defend themselves,» OpenAI stated. «Instead, we aim to enable as many legitimate defenders as possible, with access grounded in verification, trust signals, and accountability.» The use of AI for vulnerability discovery and analysis means that the barrier to entry for attackers is collapsing. Bad actors could ask an AI model to analyze differences between two versions of a binary and generate an exploit at a faster rate. Rob T. Lee, chief of research at the SANS Institute, said the debut of Mythos and GPT-5.4-Cyber is «nothing more than one vendor trying to one-up another,» adding, «We need to start benchmarking how one AI model is able to find code vulnerabilities over another and how quickly they are doing it. There are real risks at stake here.» At the same time, researchers from AISLE and Xint found that it’s possible to replicate Mythos’s results with smaller, cheaper models. «The critical variable in AI vulnerability discovery is not the model alone,» Xint said. «It is the structured system that decides where to look, validates that findings are real and exploitable, eliminates false positives, and delivers actionable remediation.»

🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-20184 (Cisco Webex Services), CVE-2026-20147 (Cisco Identity Services Engine and ISE Passive Identity Connector), CVE-2026-20180, CVE-2026-20186 (Cisco Identity Services Engine), CVE-2026-33032 (nginx-ui), CVE-2026-32201 (Microsoft SharePoint Server), CVE-2026-27304 (Adobe ColdFusion), CVE-2026-39813, CVE-2026-39808 (Fortinet FortiSandbox), CVE-2026-40176, CVE-2026-40261 (Composer), CVE-2025-0520 (ShowDoc), CVE-2026-22039 (Kyverno), CVE-2026-27681 (SAP Business Planning and Consolidation and Business Warehouse),CVE-2026-34486, CVE-2026-29146 (Apache Tomcat), CVE-2026-40175 (Axios), CVE-2026-32196 (Microsoft Windows Admin Center), CVE-2026-20204 (Splunk Enterprise), CVE-2026-20205 (Splunk MCP Server) CVE-2026-6296, CVE-2026-6297, CVE-2026-6298, CVE-2026-6299, CVE-2026-6358, CVE-2026-5873 (Google Chrome), CVE-2026-34078 (Tails), CVE-2026-34622 (Adobe Acrobat Reader), CVE-2026-33413 (etcd), CVE-2026-1492 (User Registration & Membership plugin), CVE-2026-23818 (HPE Aruba Networking Private 5G Core On-Prem), CVE-2025-54236 (Magento), CVE-2026-26980 (Ghost CMS), CVE-2026-40478 (Thymeleaf), CVE-2026-41242 (protobufjs), CVE-2026-40871 (Mailcow), CVE-2026-5747 (AWS Firecracker), and CVE-2025-50892 (eudskacs.sys).

🎥 Cybersecurity Webinars

The Force Awakens in AppSec: Rethinking Mythos & Organizational Defenses at AI Speed → This webinar explores how AI-powered hacking is making traditional security patching too slow to be effective. It focuses on the «patch gap»— the dangerous time between a bug being found and fixed—and offers a new way to prioritize vulnerabilities based on real-world risk. The session provides practical strategies for security leaders to defend against automated, high-speed attacks.
The Rise of the Agent: Moving to Autonomous Exposure Validation → This webinar explores how «agentic» AI is changing security testing by using autonomous AI agents to simulate real-world attacks. Unlike traditional scanners, these tools continuously find and validate which security gaps are actually reachable by hackers. The session focuses on moving from slow, manual checks to automated exposure validation to stay ahead of AI-driven threats.

📰 Around the Cyber World

Vect Partners with BreachForums and TeamPCP —Dataminr revealed that the Vect ransomware group has formalized partnerships with the BreachForums cybercrime marketplace and TeamPCP hacking group. The partnership will allow BreachForums members to deploy ransomware and will use the victims of TeamPCP’s supply chain attacks to attack organizations that are in a vulnerable state. «Between the two partnerships, Vect will lower the barrier to entry for ransomware actors, incentivize group members to carry out attacks, and exploit pre-existing breaches to broaden impact,» the company said. «The convergence of large-scale supply chain credential theft, a maturing RaaS operation, and mass dark web forum mobilization represents an unprecedented model of industrialized ransomware deployment.»
MuddyWater Targets Global Organizations via Microsoft Teams —The Iranian hacking group known as MuddyWater has been observed using targeted social engineering to approach targets via Microsoft Teams by masquerading as IT support staff to trick them into running a botnet malware called Tsundere (aka Dindoor). «A notable aspect of this intrusion was the abuse of Deno, a legitimate JavaScript and TypeScript runtime typically used for backend application development,» CyberProof said. «The attacker leveraged deno.exe to execute a highly obfuscated, Base64‑encoded payload — tracked as DINODANCE — directly in memory, minimizing on-disk artifacts and complicating detection.» Once decoded, the malware establishes C2 communications with a remote server, exfiltrating basic host metadata such as username, hostname, and operating system details.
Multi-Stage Intrusion Drops Direct-Sys Loader and CGrabber Stealer —An attack chain involving ZIP archives distributed through GitHub user attachment URLs is abusing DLL side-loading to deliver a malware loader called Direct-Sys Loader, which performs anti-analysis checks and then drops CGrabber. The malware, for its part, avoids infecting machines running in the Commonwealth of Independent States (CIS) countries and collects browser credentials, crypto wallet data, password manager data, and a broad range of application artifacts. «By skipping execution on machines in those regions, they reduce the risk of attracting attention from local law enforcement and avoid targeting their own infrastructure or allies,» Cyderes said. «The Direct-Sys Loader and CGrabber Stealer represent a cohesive, multi-stage, stealth-focused malware ecosystem engineered with advanced detection-evasion capabilities.»
Russian Hackers Target Ukrainian Agencies —Threat actors linked to Russia broke into more than 170 email accounts belonging to prosecutors and investigators across Ukraine in recent months,» Reuters reported, citing data from Ctrl-Alt-Intel. The espionage activity also targeted officials in Romania, Greece, Bulgaria, and Serbia. Speaking to The Record, Ukraine’s State Service of Special Communications and Information Protection (SSSCIP) confirmed that local government agencies were targeted in a long-running hacking campaign that it has been tracking since 2023, with the attacks weaponizing flaws in Roundcube webmail software to run malicious code as soon as a specially crafted message is opened. The campaign is believed to be the work of APT28 (aka Fancy Bear).
Infostealer Lookup Services are Changing Cybercrime —Hudson Rock revealed that infostealer lookup services, some accessible via a simple search on Google, are rapidly fueling a new era of initial access, shifting how cyber attacks begin and transforming a complex hacking process into a simple, automated transaction. «These platforms have effectively turned billions of compromised credentials and active session cookies into a highly searchable, low-cost commodity available to the masses,» it said. «Because this data is so easily accessible, organizations can no longer afford to be reactive.»
AdaptixC2 Detailed —Kaspersky has detailed the inner workings of an open-source command-and-control (C2) framework known as AdaptixC2, which has seen increased adoption by bad actors over the past year. Written in Go and C++, AdaptixC2 is designed for post-exploitation and stealthy interaction with its malicious agents deployed on compromised systems. It also employs diverse network communication and post-exploitation techniques to get around traffic monitoring tools and minimize its footprint. «Unlike many general-purpose C2 platforms, AdaptixC2 focuses on advanced agent-to-C2 communication and specific evasion techniques designed to bypass modern security tools, including EDR and NDR solutions,» the company said. «The framework provides the flexibility to develop custom agents while also including standard agent implementations in Go and C++ for Windows, macOS, and Linux. Additionally, it supports a modular approach to extending its functionality.»
Adware Update Delivers EDR Killer —In an unusual attack, a browser-hijacking adware family rolled out a multi-phase update that attempted to disable security software on infected hosts. The adware is signed by Dragon Boss Solutions LLC, a U.A.E.-based company that claims to conduct search monetization research and has promoted modified versions of the Chrome browser (e.g., Chromstera, Chromnius, and Artificius). «The signed software silently fetches and executes payloads capable of killing antivirus products, all while running with SYSTEM privileges,» Huntress said. The antivirus killing capability was observed starting in late March 2025, although the loader and updater components date back to late 2024. «The operation uses an off-the-shelf software update mechanism to deploy these MSI and PowerShell-based payloads. Establishing WMI persistence disables security applications and blocks reinstallation of protective software,» it added. The MSI installer, downloaded from a fallback update server, performs reconnaissance, queries for installed security products, and runs a PowerShell script («ClockRemoval.ps1») to terminate running processes, disable antivirus services by tampering with the Windows Registry, delete installation directories, and force deletion when uninstallers fail. What’s significant is that the update mechanism can be modified to deploy any payload. To make matters worse, the primary update domain baked into the operation to retrieve the MSI installer – chromsterabrowser[.]com – was left unregistered, meaning any threat actor could have registered the domain for as little as $10 and push malicious updates, turning an adware infection into a potential supply chain compromise. The domain has since been sinkholed. That said, 23,565 unique IP addresses connected to the sinkhole during a 24-hour monitoring period. The infections are concentrated around the U.S., France, Canada, the U.K., and Germany. These included universities, OT networks, government entities, primary and secondary educational institutions, healthcare organizations, and multiple Fortune 500 companies.
India Will Not Require Smartphone Makers to Preload Aadhaar App —The Indian government will no longer require smartphone makers like Apple and Samsung to preload devices with a state-owned biometric identification app, Reuters reported. India’s IT ministry reviewed the proposal and «is not in favour of mandating the pre-installation of the Aadhaar App on smartphones,» UIDAI said in a statement. The Aadhaar request was the sixth time in two years the government has sought pre-installation of state apps on phones, according to industry communications. Smartphone makers flagged concerns about device security and compatibility when they received the Aadhaar preload proposal, and also flagged higher production costs as they ‌would have ⁠been required to run separate manufacturing lines for India and export markets.
SQL Injection Campaign Targets Payment Services —An active SQL injection campaign is operating through attacker infrastructure located in Canada. The campaign has targeted 35 websites, with confirmed successful SQL injection exploitation and data exfiltration affecting three organizations operating in the payment, real estate, and developer service sectors. Attacker-side artifacts indicate coordinated and deliberate exploitation rather than opportunistic scanning.
QEMU Abused for Defense Evasion —Threat actors are abusing QEMU, an open-source machine emulator and virtualizer, to hide malicious activity within virtualized environments. «Attackers are drawn to QEMU and more common hypervisor-based virtualization tools like Hyper-V, VirtualBox, and VMware because malicious activity within a virtual machine (VM) is essentially invisible to endpoint security controls and leaves little forensic evidence on the host itself,» Sophos said. Two clusters of activity have been detected: STAC4713, which has used QEMU as a covert reverse SSH backdoor to deliver tooling and harvest domain credentials with the end goal of likely deploying Payouts King ransomware (likely tied to former BlackBasta affiliates) after obtaining initial access via exploitation of known security flaws in SolarWinds Web Help Desk, and STAC3725, which exploits Citrix Bleed 2 (aka CVE-2025-5777) for obtaining a foothold and installs ScreenConnect for persistent remote access. The threat actors then deploy a QEMU VM to install additional tools for conducting enumeration and credential theft. «Follow-on activity differed across intrusions, suggesting that initial access brokers originally compromised the victims’ environments and then sold the access to other threat actors,» Sophos said.
Fake Adobe Reader Site Drops ScreenConnect —Threat actors are using fake Adobe Acrobat Reader website lures to lure victims into installing ConnectWise’s ScreenConnect. The attack chain was detected in February 2026. «The attack uses .NET reflection to keep payloads in memory only, which helps it evade signature-based defenses and hinder forensic examination,» Zscaler ThreatLabz said. «A VBScript loader dynamically reconstructs strings and objects at runtime to defeat static analysis and sandboxing. Auto-elevated Component Object Model (COM) objects are abused to bypass User Account Control (UAC) and run with elevated privileges without user prompts.» The attack employs an in-memory .NET loader that’s responsible for launching ScreenConnect.
Nearly 6M Hosts Use FTP —Censys said it observed about 5,949,954 hosts running at least one internet-facing FTP service, down from over 10.1 million in 2024, which amounts to a decline of 40% in two years. Of these, nearly 2.45 million hosts had no evidence of encryption. «Over 150,000 IIS FTP services return a 534 response, indicating TLS was never set up,» Censys said. «For most use cases, FTP can be replaced without significant disruption. If FTP must remain, enabling Explicit TLS is a configuration change, not a protocol upgrade, and both Pure-FTPd and vsftpd support it natively.»
Malformed APKs Bypass Detections as New Android RATs Emerge —Threat actors are increasingly using malformed APKs, which refer to Android packages that can be installed and run on Android but are intentionally broken by using unsupported compression methods, header manipulation, or false password protection, to bypass static analysis tools and delay detection. Cleafy has released an open-source tool called Malfixer to detect and fix malformed APKs. The development comes as Zimperium flagged four new Android malware families, RecruitRat, SaferRat, Astrinox (aka Mirax), and Massiv, that are capable of harvesting sensitive information and facilitating unauthorized financial transactions. In all, campaigns distributing these malware families target over 800 applications across the banking, cryptocurrency, and social media sectors. RecruitRat leverages recruitment-related social engineering and fraudulent job-seeking platforms for initial access. SaferRat is distributed through fake websites that claim to offer free access to premium streaming platforms and legitimate video streaming software. All four banking trojans abuse the native Session Installation API to bypass Android’s sideloading restrictions and request accessibility services permissions to carry out their malicious activities.
Over 200 PrestaShop Stores Expose Installer —More than 200 PrestaShop online stores have left their installation folder exposed online, allowing attackers to abuse the behavior to overwrite database configuration, gain admin access, and execute arbitrary code on the server. According to Sansec, the affected stores span 27 countries, including France, Italy, Poland, and the Czech Republic. Another set of 15 stores has been found to expose the Symfony Profiler, which is enabled when PrestaShop runs in debug mode.
How to Contain a Domain Compromise via Predictive Shielding —Microsoft detailed an attack chain in which a threat actor targeted a public sector organization in June 2025, methodically progressing from one state of the attack lifecycle to the next, starting with dropping a web shell following the exploitation of a file-upload flaw in an internet-facing Internet Information Services (IIS) server. The attacker then performed reconnaissance, escalated their privileges, leveraged the compromised IIS service account to reset the passwords of high-impact identities, and deployed Mimikatz to harvest credentials. Then, the threat actor abused privileged accounts and remotely created a scheduled task on a domain controller to capture NTDS snapshots. The attacker also planted a Godzilla web shell on the Exchange Server and leveraged their privileged context to alter mailbox permissions, allowing them to read and manipulate all mailbox contents. The threat actor subsequently used Impacket to enumerate the role assignments and other activities that were flagged and blocked by Microsoft Defender. «The threat actor then launched a broad password spray from the initially compromised IIS server, unlocking access to at least 14 servers through password reuse,» Microsoft said. «They also attempted remote credential dumping against a couple of domain controllers and an additional IIS server using multiple domain and service principals.» After Microsoft Defender’s predictive shielding was enabled in late July 2025, the attacker’s attempts to sign in to Microsoft Entra Connect servers were blocked. The campaign stopped on July 28, 2025.
Cargo Theft Malware Actor Conducts Remote Access Campaigns —In November 2025, Proofpoint detailed a threat actor that used compromised load boards to gain access to trucking companies with the end goal of freight diversion and cargo theft. New research from the enterprise security company has revealed that the attacker abused multiple remote access tools like ScreenConnect, Pulseway, and SimpleHelp to establish persistence to a controlled decoy environment, with attempts made to identify financial access, payment platforms, and cryptocurrency assets to conduct freight fraud and broader financial theft. The actor maintained access for more than a month. At least one ScreenConnect instance is said to have leveraged a third‑party signing‑as‑a‑service provider to re-sign the installer with a valid but fraudulent code‑signing certificate. «This reconnaissance focused on identifying financial access – such as banking, accounting, tax software, and money transfer services – as well as transportation‑related entities, including fuel card services, fleet payment platforms, and load board operators,» the company said. «The latter activity was likely designed to support crimes against the transportation industry, including cargo theft and related financial fraud.»
British National Pleads Guilty to Scattered Spider Campaign —Tyler Robert Buchanan, who was extradited from Spain to the U.S. last April following his arrest in the European nation in June 2024, pleaded guilty to hacking a dozen companies and stealing at least $8 million in digital assets. He pleaded guilty to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. «From September 2021 to April 2023, Buchanan and other individuals conspired to conduct cyber intrusions and virtual currency thefts,» the U.S. Justice Department said. «The victims and intended victims included interactive entertainment companies, telecommunications companies, technology companies, business process outsourcing (BPO) and information technology (IT) suppliers, cloud communications providers, virtual currency companies, and individuals.» Buchanan and his co-conspirators conducted SMS phishing attacks targeting a victim company’s employees, tricking them into clicking on bogus links that exfiltrated their credentials via a phishing kit to an online Telegram channel under their control. The stolen data was then used to access the accounts, gather confidential company information, and siphon millions of dollars’ worth of virtual currency after conducting SIM swapping attacks.

🔧 Cybersecurity Tools

Cirro → It is an open-source tool designed to help security experts find hidden risks in cloud environments. It works by collecting data about people, their permissions, and the digital resources they use, then turning that information into a visual map. By showing how these different pieces are connected, the tool makes it easier to spot «attack paths»—the step-by-step routes a hacker could take to move through a system and reach sensitive data. While it is currently focused on Azure, it is built to be flexible so users can add other platforms over time.
Janus → It is an open-source tool designed to help security teams track technical failures during operations. It automatically pulls logs from command-and-control (C2) platforms like Mythic and Cobalt Strike to identify where tools failed or commands were blocked. By organizing these «friction points» into reports, Janus helps teams see exactly where their workflow slows down and what tasks need to be improved or automated.

Disclaimer: This is strictly for research and learning. It hasn’t been through a formal security audit, so don’t just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law.

Conclusion

That wraps this week’s recap. Most of it isn’t loud, but it shows how easy it is for trusted paths to turn into entry points and for normal activity to hide real access.

Keep an eye on the basics. Check what you trust, watch how things run, and don’t ignore the small changes.

admin Noticias, Trending afirmaciones bolsa cierra CYBERDEFENSA.MX dólares Grinex Hack inteligencia millones sancionada tras

Un hack de 13,74 millones de dólares cierra la bolsa Grinex sancionada tras afirmaciones de inteligencia – CYBERDEFENSA.MX

Grinex, un intercambio de criptomonedas incorporado en Kirguistán y sancionado por el Reino Unido y Estados Unidos el año pasado, dijo que suspenderá sus operaciones después de culpar a las agencias de inteligencia occidentales por un hackeo de 13,74 millones de dólares.

El intercambio dijo que fue víctima de lo que describió como un ciberataque a gran escala que tenía características de participación de una agencia de inteligencia extranjera. Este ataque provocó el robo de más de mil millones de rublos en fondos de usuarios.

«La evidencia forense digital y la naturaleza del ataque apuntan a un nivel sin precedentes de recursos y sofisticación tecnológica, capacidades típicamente disponibles exclusivamente para las agencias de estados hostiles», dijo la compañía. dicho en un comunicado publicado en su sitio web. «Los hallazgos preliminares sugieren que el ataque fue coordinado con el objetivo específico de infligir daño directo a la soberanía financiera de Rusia».

Un portavoz de la compañía continuó afirmando que la infraestructura de la bolsa había estado bajo ataque desde el comienzo de sus operaciones, y que el último acontecimiento representa un nuevo nivel de escalada destinado a desestabilizar el sector financiero nacional.

Se cree que Grinex es un cambio de marca de Garantex, un intercambio de criptomonedas que fue sancionado por el Departamento del Tesoro de EE. UU. en abril de 2022 por lavar fondos vinculados a ransomware y mercados de la red oscura como Conti e Hydra. El Tesoro renovó las sanciones contra Garantex en agosto de 2025 por procesar más de 100 millones de dólares en transacciones ilícitas y permitir el lavado de dinero.

Según el Tesoro y los detalles compartidos por las empresas de inteligencia blockchain Elliptic y TRM Labs, se dice que Garantex trasladó su base de clientes a Grinex en respuesta a las sanciones y permaneció operativo utilizando una moneda estable respaldada por rublos llamada A7A5.

En un informe publicado a principios de febrero, Elliptic también revelado que Rapira, una bolsa constituida en Georgia con una oficina en Moscú, ha participado en transacciones directas de criptoactivos hacia y desde Grinex por un total de más de 72 millones de dólares, lo que pone de relieve cómo las bolsas con vínculos con Rusia siguen permitiendo la evasión de sanciones.

La firma británica de análisis blockchain dicho El robo de activos de Grinex ocurrió el 15 de abril de 2026, alrededor de las 12:00 UTC, y los fondos robados se enviaron posteriormente a otras cuentas en las cadenas de bloques TRON o Ethereum. «Este USDT luego se convirtió en otro activo, ya sea TRX o ETH. Al hacerlo, el ladrón evitó el riesgo de que Tether congelara el USDT robado», agregó.

Laboratorios TRM tiene identificado alrededor de 70 direcciones relacionadas con el incidente, señalando que TokenSpot, un intercambio con sede en Kirguistán que probablemente opera como fachada para Grinex, se vio afectado simultáneamente.

El mismo día que Grinex sufrió la infracción, TokenSpot al corriente en su canal Telegram que la plataforma estaría temporalmente indisponible debido a mantenimiento técnico. El 16 de abril, anunciado que se habían reanudado todas las operaciones. Se estima que el atacante robó menos de 5.000 dólares de TokenSpot. Los fondos se enrutaron a través de dos direcciones de TokenSpot a la misma dirección de consolidación utilizada por las billeteras vinculadas a Grinex.

Chainalysis, en su propio desglose del incidente, dijo que los fondos de las monedas estables se cambiaron rápidamente por un token no congelable y que este «intercambio frenético» de monedas estables a tokens más descentralizados es una táctica adoptada por los malos actores para lavar sus ganancias ilícitas antes de que los activos puedan congelarse.

«Dado el estatus fuertemente sancionado del intercambio, su ecosistema restringido y el uso en cadena de las técnicas de ofuscación preferidas de Garantex, vale la pena considerar si este incidente podría ser un ataque de bandera falsa», dicho. «Ya sea que este evento represente un exploit legítimo por parte de ciberdelincuentes o una operación de bandera falsa orquestada por personas internas vinculadas a Rusia, la interrupción de Grinex asesta un golpe significativo a la infraestructura que apoya la evasión de las sanciones rusas».

admin Latest actualización aplicaciones Axios gracias Hack las Mac necesitan OpenAI para una

Las aplicaciones de OpenAI para Mac necesitan una actualización gracias al hack de Axios

OpenAI actualizó sus certificados de seguridad y exige que todos los usuarios de macOS actualicen a las últimas versiones después de determinar que sus productos, junto con muchos otros, eran afectado por una cadena de suministro generalizada ataque que infectó brevemente una popular biblioteca de código abierto a finales de marzo, dijo la compañía en una publicación de blog el viernes.

El proveedor de inteligencia artificial dijo que «no encontró evidencia de que se haya accedido a los datos de los usuarios de OpenAI, de que nuestros sistemas o propiedad intelectual hayan estado comprometidos, o de que nuestro software haya sido alterado».

Sin embargo, debido a que un flujo de trabajo de GitHub que la empresa utiliza para firmar certificados para aplicaciones macOS descargó y ejecutó una versión maliciosa de Axios, la empresa está tratando el certificado que pronto desaparecerá como comprometido.

Un grupo de hackers norcoreano inyectó malware en dos versiones de Axios después de que comprometió la computadora del mantenedor principal a través de ingeniería social y se hizo cargo de sus cuentas de npm y GitHub. Jason Saayman, el principal responsable de mantenimiento de Axios, dijo que las versiones maliciosas del software estuvieron activas durante unas tres horas antes de eliminarlas.

Google Threat Intelligence Group, que rastrea el grupo de amenazas como UNC1069, dijo que el impacto del ataque fue amplio con efectos dominó potencialmente exponiendo otros paquetes populares. Las bibliotecas de JavaScript fluyen hacia el software dependiente a través de más de 100 millones y 83 millones de descargas semanales.

El ataque se descubrió pocas semanas después de que UNC6780, también conocido como TeamPCP, comprometiera una serie de otras herramientas de código abierto, incluido Trivy, lo que resultó en agresivos intentos de extorsión.

OpenAI insiste en que el malware que infectó a Axios no afectó directamente a su certificado, que está diseñado para ayudar a los clientes a confirmar que están descargando software legítimo.

«El certificado de firma presente en este flujo de trabajo probablemente no fue filtrado con éxito por la carga útil maliciosa debido al momento de ejecución de la carga útil, la inyección del certificado en el trabajo, la secuenciación del trabajo en sí y otros factores atenuantes», dijo la compañía en la publicación del blog. «Sin embargo, por precaución, estamos tratando el certificado como comprometido y lo estamos revocando y rotando».

Las versiones anteriores de las aplicaciones macOS de OpenAI pueden perder funcionalidad y ya no serán compatibles cuando el certificado se revoque por completo el 8 de mayo, dijo la compañía.

OpenAI, que contrató a una empresa externa de análisis forense digital y respuesta a incidentes para ayudar en su investigación y respuesta, identificó la causa principal del problema de seguridad en una mala configuración en su flujo de trabajo de GitHub. La compañía dijo que corrigió ese error y trabajó con Apple para garantizar que las aplicaciones fraudulentas que se hacen pasar por OpenAI no puedan usar el certificado afectado.

La ventana de 30 días está diseñada para minimizar las interrupciones para los usuarios, pero OpenAI dijo que acelerará el plazo de revocación si identifica alguna actividad maliciosa. La compañía no respondió de inmediato a una solicitud de comentarios.

admin Noticias, Trending 0Day Axios Chrome CYBERDEFENSA.MX exploits Fortinet Hack Paragon Spyware

Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More – CYBERDEFENSA.MX

This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there.

One weak spot now spreads wider than before. What starts small can reach a lot of systems fast. New bugs, faster use, less time to react.

That’s this week. Read through it.

⚡ Threat of the Week

Axios npm Package Compromised by N. Korean Hackers—Threat actors with ties to North Korea seized control of the npm account belonging to the lead maintainer of Axios, a popular npm package with nearly 100 million weekly downloads, to push malicious versions containing a cross-platform malware dubbed WAVESHAPER.V2. The activity has been attributed to a financially motivated threat actor known as UNC1069. The incident demonstrates how quickly the compromise of a popular npm package can have ripple effects through the ecosystem. The malware’s self-deleting anti-forensic cleanup points to a deliberate, planned operation. «The build pipeline is becoming the new front line. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale,» Avital Harel, Security Researcher at Upwind, said. «That’s what makes these attacks so dangerous — they’re not just targeting one application, they’re targeting the process behind many of them. Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that’s increasingly where attackers are placing their bets.» Ismael Valenzuela, vice president of Labs, Threat Research, and Intelligence at Arctic Wolf, said the Axios npm compromise reflects a broader trend where attackers infiltrate trusted, widely used software components to obtain access to downstream customers at scale. «Even though the malicious versions were available for only a few hours, Axios is so deeply embedded across enterprise applications that organizations may have unknowingly pulled the compromised code into their environments through build pipelines or downstream dependencies,» Valenzuela added. «That downstream exposure is what makes these incidents particularly difficult to spot and contain, especially for teams that never directly chose to install Axios themselves. This incident reinforces that security teams need to treat build‑time tools and dependencies as part of the attack surface and not just trust tools by default.»

🔔 Top News

Google Patches Actively Exploited Chrome 0-Day—Google released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard. Users are advised to update their Chrome browser to versions 146.0.7680.177/178 for Windows and Apple macOS, and 146.0.7680.177 for Linux. Google did not reveal how the vulnerability is being exploited and who is behind the exploitation effort.
TrueConf 0-Day Exploited in Attacks Targeting Government Entities in Southeast Asia—Chinese hackers have exploited a zero-day vulnerability in the TrueConf video conferencing software in attacks against government entities in Southeast Asia. The exploited flaw, tracked as CVE-2026-3502 (CVSS score of 7.8), exists because of a lack of integrity checks when fetching application update code, allowing an attacker to distribute a tampered update. «The compromised TrueConf on-premises server was operated by the governmental IT department and served as a video conferencing platform for dozens of government entities across the country, which were all supplied with the same malicious update,» Check Point said. The activity, which began in January 2026, involved the deployment of the Havoc framework. Most infections likely began with a link sent to the victims. TrueConf is used widely across organizations in Asia, Europe, and the Americas, serving about 100,000 organizations globally.
Fortinet FortiClient EMS Flaw Under Attack—Fortinet released out-of-band patches for a critical security flaw impacting FortiClient EMS (CVE-2026-35616) that it said has been exploited in the wild. The vulnerability has been described as a pre-authentication API access bypass leading to privilege escalation. Exploitation efforts against CVE-2026-35616 were first recorded against its honeypots on March 31, 2026, per watchTowr. The development comes days after another recently patched, critical vulnerability in FortiClient EMS (CVE-2026-21643) came under active exploitation.
Apple Backports DarkSword Fixes to More Devices—Apple expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk posed by a recently disclosed exploit kit known as DarkSword. The update targets customers whose devices are capable of upgrading to the newest operating system (iOS 26), but have chosen to remain on iOS 18. Apple has taken the unprecedented step to counter risks posed by an exploit kit called DarkSword. The broader availability of the patches underscores the level of threat that malware like DarkSword poses. The fact that a large number of users were still using iOS 18, combined with the leak of a new version of DarkSword on GitHub, has pushed Apple towards releasing the fix so that they can stay protected without the need for updating to iOS 26. The leak is significant as it puts it within reach of less technically savvy cybercriminals out there.
ClickFix Attack Leads to DeepLoad Malware—The ClickFix technique is being used to deliver a stealthy malware named DeepLoad that’s capable of stealing credentials and intercepting browser interactions. The malware first emerged on a dark web cybercrime forum in early February 2026, when a threat actor, using the alias «MysteryHack,» advertised it as a «centralized panel for multiple types of malware.» According to ZeroFox, «DeepLoad’s design is explicitly focused on actively facilitating real-time cryptocurrency theft, which almost certainly makes it an attractive malware suite in the cybercrime-as-a-service (CaaS) environment.» The malware has since been distributed to Windows systems through ClickFix under the guise of resolving fake browser error messages. Besides stealing credentials, the malware drops a rogue browser extension to intercept sensitive data and spreads via removable USB drives. DeepLoad’s actual attack logic is buried under layers of obfuscation, raising the possibility that some parts of the malware were developed using an artificial intelligence (AI) model.
Claude Code Source Code Leaks—Anthropic acknowledged that internal code for its popular artificial intelligence (AI) coding assistant, Claude Code, had been inadvertently released due to a human error. Essentially, what happened was this: When Anthropic pushed out version 2.1.88 of its Claude Code npm package, it accidentally included a map file that exposed nearly 2,000 source code files and more than 512,000 lines of code. The source code leak has since revealed various features the company appears to be working on or that are built into the service, including an Undercover mode to hide AI authorship from contributions to public code repositories, a persistent background agent called KAIROS, combat distillation attacks, and active monitoring of words and phrases that show signs of user frustration. The leak also quickly escalated into a cybersecurity threat, as attackers pounced on the surge in interest to lure developers into downloading stealer malware.

🔥 Trending CVEs

New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week’s most critical — high-severity, widely used software, or already drawing attention from the security community.

Check these first, patch what applies, and don’t wait on the ones marked urgent — CVE-2026-35616 (Fortinet FortiClient EMS), CVE-2026-20093 (Cisco Integrated Management Controller), CVE-2026-20160 (Cisco Smart Software Manager On-Prem), CVE-2026-5281 (Google Chrome), CVE-2026-3502 (TrueConf), CVE-2026-27876, CVE-2026-27880 (Grafana), CVE-2026-4789 (Kyverno), CVE-2026-2275, CVE-2026-2285, CVE-2026-2286, CVE-2026-2287 (CrewAI), CVE-2025-14819 (Notepad++), CVE-2026-34714, CVE-2026-34982 (Vim), CVE-2026-33660, CVE-2026-33696 (n8n), CVE-2026-25639 (Axios), CVE-2026-25075 (strongSwan), CVE-2026-34156 (NocoBase), CVE-2026-3308 (Artifex MuPDF), CVE-2026-1579 (PX4 Autopilot), CVE-2026-3991 (Symantec Data Loss Prevention Agent for Windows), CVE-2026-33026 (nginx-ui), CVE-2026-33416, CVE-2026-33636 (libpng), CVE-2026-3775, CVE-2026-3779 (Foxit PDF Editor), CVE-2026-34980, CVE-2026-34990 (CUPS), and CVE-2026-34121 (TP-Link).

🎥 Cybersecurity Webinars

Learn How to Close Identity Gaps Using Insights from IT Leaders → Identity programs face rising risk from disconnected apps, manual credentials, and expanding AI access. Based on 2026 insights from 600+ IT and security leaders, this session shows what to measure, fix, and do now to close identity gaps and regain control.
Learn How to Build Secure AI Agents Using Identity, Visibility, and Control → AI agents are already being used, but most teams don’t know how to secure them properly. This session shows a clear, practical way to do it using three key ideas: identity, visibility, and control.You will see what real deployment looks like, how to track what agents do, and how to manage their behavior safely.It also explains how to secure AI systems today without waiting for standards to settle.

📰 Around the Cyber World

Device Code Phishing Attacks Surge —Device code phishing attacks, which abuse the OAuth device authorization grant flow to hijack accounts, have surged more than 37.5x this year. Push Security said it detected a 15x increase in device code phishing pages at the start of March 2026, indicating that the technique has finally entered mainstream adoption. «The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly),» the company said. «Any app that supports device code logins can be a target. Popular examples include Microsoft, Google, Salesforce, GitHub, and AWS. That said, Microsoft is, as always, much more heavily targeted at scale now than any other app.» This has been fueled by the emergence of EvilTokens (aka ANTIBOT), the first reported criminal PhaaS (Phishing-as-a-Service) toolkit that supports device code pushing. EvilTokens features a Cloudflare Workers frontend and a Railway backend for authentication. Early iterations of the PhaaS kit emerged in January 2026. Another closed-source PhaaS kit called Venom offers device code phishing capabilities similar to EvilTokens. Some of the other PhaaS kits that have incorporated this technique include SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, and DOLCE.
LinkedIn Comes Under Scanner for BrowserGate —A newly published report called BrowserGate alleged that Microsoft’s LinkedIn is using hidden JavaScript scripts on its website to scan visitors’ browsers for thousands of installed Google Chrome extensions and collect device data without users’ consent. «LinkedIn scans for over 200 products that directly compete with its own sales tools, including Apollo, Lusha, and ZoomInfo,» the report said. «Because LinkedIn knows each user’s employer, it can map which companies use which competitor products. It is extracting the customer lists of thousands of software companies from their users’ browsers without anyone’s knowledge. Then it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets.» The report also claimed LinkedIn loads an invisible tracking pixel from HUMAN Security, along with a separate fingerprinting script that runs from LinkedIn’s servers and a third script from Google that runs silently on every page load. In response to the findings, LinkedIn told Bleeping Computer it scans for certain extensions that scrape data without members’ consent in violation of its terms of service. The company also claimed the report is from an individual who is «subject to an account restriction for scraping and other violations of LinkedIn’s Terms of Service.»
ICE Confirms Use of Paragon Spyware —The U.S. Immigration and Customs Enforcement (ICE) confirmed it uses spyware developed by Paragon to «identify, disrupt, and dismantle Foreign Terrorist Organizations, addressing the escalating fentanyl epidemic and safeguarding national security.» Paragon’s Graphite spyware has been found on the phones of journalists. WhatsApp last year said it disrupted a campaign that deployed the spyware against its users. The governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are suspected to be customers of the Israeli company.
Ex-Engineer Pleads Guilty to Extortion Campaign —Daniel Rhyne, 59, of Kansas City, Missouri, pleaded guilty to a failed data extortion campaign that targeted his former employer. Rhyne was arrested in September 2024. According to court documents, Rhyne worked as a core infrastructure engineer at a U.S.-based industrial company headquartered in New Jersey. In November 2023, the defendant executed a ransomware attack against the company and sent an extortion email to its employees, threatening to continue shutting down the firm’s servers unless he was paid about 20 Bitcoin, which was valued at $750,000 at the time. Last month, the U.S. Justice Department (DoJ) announced the conviction of Cameron Curry (aka Loot), a 27-year-old from Charlotte, North Carolina, for carrying out a cyber extortion scheme against a D.C.-based international technology company called Brightly Software. «Trial evidence established that Curry misused his position to access the victim company’s personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company,» the DoJ said. Between December 11, 2023, and January 24, 2024, Curry sent more than 60 emails to company executives and employees, stating he would disclose sensitive information unless he was paid $2.5 million in cryptocurrency. Brightly ended up paying $7,540 in Bitcoin.
Residential Proxies Bypass Reputation Systems —Threat intelligence firm GreyNoise’s analysis of 4 billion sessions targeting the edge over a 90-day period from November 29, 2025, to February 27, 2026, found that 39% of unique IP addresses targeting the edge originated from home internet connections, and that 78% vanish before any reputation system can flag them. «78% of residential IPs appear in only 1–2 sessions and are never observed again,» it said. «IP reputation is structurally broken against residential proxies. The rotation rate exceeds the update cycle of any feed-based defense.» This behavior also makes source IPs indistinguishable from a legitimate user’s connection. The data also showed that 0.1% of residential sessions carry exploitation payloads, in contrast to 1.0% from hosting infrastructure, indicating that they are primarily used for network scanning and reconnaissance. The residential proxy traffic is generated by IoT botnets and infected computers, with the networks also resilient against takedown efforts. «After IPIDEA lost 40% of its nodes, operators backfilled within weeks,» GreyNoise said. «Every major takedown produces the same result — temporary disruption, then regeneration.» The company also recommended that «Detection must shift from ‘where is the traffic from?’ to ‘what is the traffic doing?» Device fingerprinting provides more durable detection because fingerprints survive IP rotation.»
Suspected N. Korea Campaign Targets Cryptocurrency Companies Using React2Shell —A new campaign has been observed systematically compromising cryptocurrency organizations by exploiting web application vulnerabilities such as React2Shell (CVE-2025-55182), pillaging AWS tenants with valid credentials, and exfiltrating proprietary exchange software containing hardcoded secrets. «Their targeting spans the crypto supply chain, from staking platforms, to exchange software providers, to the exchanges themselves,» Ctrl-Alt-Intel said. The threat intelligence firm has assessed the activity with moderate confidence to be aligned with North Korean cryptocurrency theft operations.
India Extends SIM-Binding Mandate —The Indian government has extended its SIM-binding mandate through December 31, 2026, while shelving plans to require messaging apps to forcibly log out web-based sessions like WhatsApp Web every six hours. The decision comes after the Broadband India Forum, which represents Meta and Google, warned the Department of Telecommunications (DoT) that the directions were unconstitutional. Under the framework announced in November 2025, a messaging app account would be tied exclusively to the physical SIM card during registration. This meant that the users could access the messages and other content only when that SIM is present in the device. Companies were given 90 days (i.e., until the end of February 2026) to comply. While SIM binding has been proposed as a way to combat spammers and conduct cross‑border fraud, the move has raised feasibility and user experience concerns. According to Moneycontrol, WhatsApp is said to be beta testing SIM binding on Android.
Russian Threat Actors Looking to Regain Access Through Compromised Infrastructure —Russian threat actors like APT28 and Void Blizzard are attempting to regain access to computer systems they previously compromised to check if access is still available and whether the obtained credentials remain valid, CERT-UA has warned. «Unfortunately, these attempts sometimes succeed if the root cause of the initial incident has not been completely eliminated,» the agency said.
OkCupid Settles with FTC for Privacy Violations —OkCupid and its owner, Match Group, reached a settlement with the U.S. Federal Trade Commission over allegations that it did not inform its customers that nearly three million user photos were shared with Clarifai, a company that develops AI systems to identify and analyze images and videos. The complaint also accused the dating site of sharing users’ location information and other details without their consent. As part of the settlement, OkCupid and Match did not admit or deny the allegations but agreed to a permanent prohibition that prevents them from misrepresenting how they use and share personal data.
New Android Malware Mirax Advertised —A sophisticated new Android banking trojan named Mirax is being advertised as a private malware-as-a-service (MaaS) offering for up to $2,500 per month. The malware enables customers to gain remote control over devices and includes specialized overlays for more than 700 different financial applications to steal credentials and other sensitive information. It can also capture keystrokes, intercept SMS messages, record lock screen patterns, and use the infected device as a SOCKS5 proxy.
Venom Stealer Spreads via ClickFix —A new malware-as-a-service (MaaS) platform dubbed Venom Stealer is being sold on cybercrime forums as a subscription ($250/month to $1,800 for lifetime access). It’s marketed as «the Apex Predator of Wallet Extraction.» Unlike other stealers, it automates credential theft and enables continuous data exfiltration. «It builds ClickFix social engineering directly into the operator panel, automates every step after initial access, and creates a continuous exfiltration pipeline that does not end when the initial payload finishes running,» BlackFog said. The development coincides with a new ClickFix variant that replaces PowerShell with a «rundll32.exe» command to download a DLL from an attacker-controlled WebDAV resource. The attack leads to the execution of a secondary loader called SkimokKeep, which then downloads additional payloads, while incorporating anti-sandboxing and anti-debugging mechanisms. In the meantime, recent ClickFix campaigns have also leveraged searches for installation tutorials for OpenClaw, Claude, and other AI tools, as well as for common macOS issues to push stealer malware like MacSync.
More Information Stealers Spotted —Speaking of stealers, recent campaigns have also been observed using procurement-themed email lures and fake Homebrew install guides served via sponsored search results to deliver Phantom Stealer and SHub Stealer. Some other newly discovered infostealer malware families include Storm, MioLab, and Torg Grabber. In a related development, CyberProof said it observed a surge in PXA Stealer activity targeting global financial institutions during Q1 2026. Another malware that has gained notoriety is BlankGrabber, which is distributed through social engineering and phishing campaigns. Data gathered by Flare shows that a single stealer log can be devastating, with individual logs containing up to 1,381 pieces of personally identifiable information. In an analysis published by Whiteintel last month, the company found that a single careless download of cracked software by one employee can hand criminal groups direct access to an entire corporate network in under two days. «An employee downloads cracked software on Tuesday afternoon,» it said. «By Thursday morning, their credentials are listed on the Russian Market for $15. Corporate VPN access, AWS credentials, session tokens that bypass MFA – all packaged and ready for purchase.»
Phishing Campaign Targets Philippine Banking Users —An ongoing phishing campaign targeting major banks in the Philippines is using email phishing via compromised accounts as the initial vector to harvest online banking credentials and one-time passwords (OTPs) for financial fraud. According to Group-IB, the campaign began in early 2024, distributing over 900 malicious links as part of the coordinated scheme. Clicking on the link embedded in the email message triggers a redirection chain that uses trusted services like Google Business, AMP CDN, Cloudflare Workers, and URL shorteners before taking the victims to the final landing page. «The campaign enables real-time financial fraud by bypassing MFA mechanisms through the theft of valid One-Time Passwords (OTP), allowing attackers to perform unauthorized fund transfers,» the company said. «Telegram bots were used as exfiltration channels, enabling threat actors to automatically collect victims’ login information in real time.» The activity has been attributed to a threat group called PHISLES.
Chrome Extensions Harvests ChatGPT Conversations —A malicious Chrome extension, named «ChatGPT Ad Blocker» (ID: ipmmidjikiklckbngllogmggoofbhjikgb), found on the Chrome Web Store masquerades as an ad-blocking tool for the AI chatbot, but contains functionality to «steal the user’s ChatGPT conversations data by systematically copying the HTML page and sending to it to a webhook on a private Discord channel,» DomainTools said.
Iran Conflict Triggers Espionage Activity in Middle East —In the aftermath of the U.S.-Israel-Iran conflict, Proofpoint said it has recorded an increase in campaigns from state-sponsored threat actors likely affiliated with China (UNK_InnerAmbush, which uses phishing emails to deliver Cobalt Strike payload), Belarus (TA473, which has used HTML attachments in emails for reconnaissance), Pakistan (UNK_RobotDreams, which has sent spear-phishing emails to India-based offices of Middle East government entities to deliver a Rust backdoor), and Hamas (TA402, which has used compromised Iraq government email addresses to conduct Microsoft account credential harvesting) targeting Middle East government organizations. The enterprise security company said it also identified the Charming Kitten actor targeting a think tank in the U.S. to trick recipients into entering their Microsoft account credentials. One activity cluster that remains unattributed is UNK_NightOwl. The email messages include a domain that spoofed Microsoft OneDrive, leading the victim to a credential harvesting page. If the user enters credentials and clicks the sign-in button, the target is redirected to «hxxps://iran.liveuamap[.]com/,» a legitimate open-source platform called Liveuamap with news updates on the Middle East conflict.
U.K. Warns of Messaging App Targeting —The U.K. National Cyber Security Centre (NCSC) became the latest cybersecurity agency to warn of malicious activity from messaging apps like WhatsApp, Messenger, and Signal, where threat actors could trick high-risk individuals into sharing their login or account recovery codes, or linking an attacker-controlled device under their accounts.

🔧 Cybersecurity Tools

Dev Machine Guard → It is an open-source script that scans a developer machine to list installed tools and detect security risks across IDEs, AI agents, extensions, and configurations, without accessing source code or secrets, helping expose gaps traditional tools miss in developer environments.
Pius → It is an open-source tool that maps a company’s external attack surface by discovering and cataloging internet-facing assets, helping security teams identify exposure and reconnaissance risks that could be targeted by attackers.

Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws.

Conclusion

The lesson is simple. Small things matter. Most issues now start from normal parts of the system, not big, obvious gaps.

Don’t trust anything just because it looks routine. Updates, tools, and background systems can all be used in the wrong way. If it seems low risk, check it again. That’s where the problems are starting now.

admin Noticias, Trending CYBERDEFENSA.MX deriva dólares Hack ingeniería meses millones operación por remonta RPDC seis social una valor

Hack de deriva por valor de 285 millones de dólares se remonta a una operación de ingeniería social de seis meses en la RPDC – CYBERDEFENSA.MX

La deriva tiene reveló que el ataque del 1 de abril de 2026 que condujo al robo de 285 millones de dólares fue la culminación de una operación de ingeniería social selectiva y meticulosamente planificada de meses de duración emprendida por la República Popular Democrática de Corea (RPDC) que comenzó en el otoño de 2025.

El intercambio descentralizado con sede en Solana lo describió como «un ataque que lleva seis meses en desarrollo», y lo atribuyó con confianza media a un grupo de piratería patrocinado por el estado de Corea del Norte llamado UNC4736que también se rastrea bajo los ciptónimos AppleJeus, Citrine Sleet, Golden Chollima y Gleaming Pisces.

El actor de amenazas tiene un historial de atacar el sector de las criptomonedas por robo financiero desde al menos 2018. Es más conocido por la violación de la cadena de suministro de X_TRADER/3CX en 2023 y el hackeo de 53 millones de dólares de la plataforma de finanzas descentralizadas (DeFi). Capital Radiante en octubre de 2024.

«La base de esta conexión es tanto en cadena (los flujos de fondos utilizados para organizar y probar esta operación se remontan a los atacantes de Radiant) como operativa (las personas desplegadas en esta campaña tienen superposiciones identificables con actividades conocidas vinculadas a la RPDC)», dijo Drift en un análisis del domingo.

En una evaluación publicada a finales de enero de 2026, la empresa de ciberseguridad CrowdStrike describió a Golden Chollima como una rama de Labyrinth Chollima que está orientada principalmente al robo de criptomonedas y apunta a pequeñas empresas de tecnología financiera en EE. UU., Canadá, Corea del Sur, India y Europa occidental.

«El adversario normalmente lleva a cabo robos de menor valor a un ritmo operativo más consistente, lo que sugiere la responsabilidad de garantizar la generación de ingresos básicos para el régimen de la RPDC», dijo CrowdStrike. «A pesar de mejorar las relaciones comerciales con Rusia, la RPDC necesita ingresos adicionales para financiar ambiciosos planes militares que incluyen la construcción de nuevos destructores, la construcción de submarinos de propulsión nuclear y el lanzamiento de satélites de reconocimiento adicionales».

En al menos un incidente observado a finales de 2024, UNC4736 entregó paquetes Python maliciosos mediante un plan de contratación fraudulento a una empresa europea de tecnología financiera. Al obtener acceso, el actor de amenazas se movió lateralmente al entorno de nube de la víctima para acceder a las configuraciones de IAM y los recursos de nube asociados y, en última instancia, desvió los activos de criptomonedas a billeteras controladas por el adversario.

Cómo probablemente se desarrolló el ataque a la deriva

Drift, que está trabajando con las fuerzas del orden y socios forenses para reconstruir la secuencia de eventos que llevaron al ataque, dijo que era el objetivo de una «operación de inteligencia estructurada» que requirió meses de planificación.

A partir del otoño de 2025 o alrededor de esa fecha, personas que se hacían pasar por una empresa comercial cuantitativa se acercaron a los contribuyentes de Drift en una importante conferencia sobre criptomonedas y conferencias internacionales sobre criptomonedas con el pretexto de integrar el protocolo. Desde entonces, se supo que se trataba de un enfoque deliberado, en el que los miembros de este grupo comercial se acercaron y establecieron una buena relación con contribuyentes específicos de Drift en varias conferencias importantes de la industria que tuvieron lugar en varios países durante un período de seis meses.

«Los individuos que aparecieron en persona no eran ciudadanos norcoreanos», explicó Drift. «Se sabe que los actores de amenazas de la RPDC que operan a este nivel utilizan intermediarios externos para construir relaciones cara a cara».

«Eran técnicamente fluidos, tenían antecedentes profesionales verificables y estaban familiarizados con cómo operaba Drift. Se estableció un grupo de Telegram en la primera reunión, y lo que siguió fueron meses de conversaciones sustanciales sobre estrategias comerciales y posibles integraciones de bóvedas. Estas interacciones son típicas de cómo las empresas comerciales interactúan y se incorporan a Drift».

Luego, en algún momento entre diciembre de 2025 y enero de 2026, el grupo incorporó un Ecosystem Vault en Drift, un paso que requirió completar un formulario con detalles de la estrategia. Como parte de este proceso, se dice que las personas se comunicaron con múltiples contribuyentes, les hicieron «preguntas detalladas e informadas sobre el producto», mientras depositaban más de $ 1 millón de sus propios fondos.

Esto, dijo Drift, fue un movimiento calculado diseñado para construir una presencia operativa funcional dentro del ecosistema Drift, con conversaciones de integración que continuaron con los contribuyentes hasta febrero y marzo de 2026. Esto incluyó compartir enlaces para proyectos, herramientas y aplicaciones que la compañía afirmó estar desarrollando.

La posibilidad de que estas interacciones con el grupo comercial hayan actuado como la vía de infección inicial adquirió importancia tras el ataque del 1 de abril. Pero como reveló Drift, sus chats de Telegram y el software malicioso se eliminaron justo en el momento en que ocurrió el ataque.

Se sospecha que puede haber dos vectores de ataque principales:

Es posible que un colaborador se haya visto comprometido después de clonar un repositorio de código compartido por el grupo como parte de los esfuerzos para implementar una interfaz para su bóveda.
Se convenció a un segundo colaborador para que descargara un producto de billetera a través de TestFlight de Apple para realizar una prueba beta de la aplicación.

Se considera que el vector de intrusión basado en repositorio involucró un proyecto malicioso de Microsoft Visual Studio Code (VS Code) que utiliza el archivo «tasks.json» como arma para desencadenar automáticamente la ejecución de código malicioso en el proyecto en el IDE mediante el uso de la opción «runOn:folderOpen».

Vale la pena señalar que esta técnica ha sido adoptado por los actores de amenazas norcoreanos asociados con la campaña Contagious Interview desde diciembre de 2025, lo que llevó a Microsoft a introducir nuevos controles de seguridad en las versiones 1.109 y 1.110 de VS Code para evitar la ejecución involuntaria de tareas al abrir un espacio de trabajo.

«La investigación ha demostrado hasta ahora que los perfiles utilizados en esta operación dirigida por terceros tenían identidades completamente construidas, incluidos historiales laborales, credenciales públicas y redes profesionales», dijo Drift. «Las personas que los colaboradores de Drift conocieron en persona parecían haber pasado meses creando perfiles, tanto personales como profesionales, que pudieran resistir el escrutinio durante una relación comercial o de contraparte».

El ecosistema de malware fragmentado de Corea del Norte

La divulgación se produce cuando DomainTools Investigations (DTI) reveló que el aparato cibernético de la RPDC ha evolucionado hasta convertirse en un ecosistema de malware «deliberadamente fragmentado» que está impulsado por una misión, operativamente resiliente y resistente a los esfuerzos de atribución. Se cree que este cambio es una respuesta a las acciones policiales y a las revelaciones de inteligencia sobre las campañas de piratería informática de Corea del Norte.

«El desarrollo y las operaciones de malware están cada vez más compartimentados, tanto técnica como organizativamente, lo que garantiza que la exposición en un área de la misión no se extienda a todo el programa», dijo DTI. dicho. «Lo más importante es que este modelo también maximiza la ambigüedad. Al separar las herramientas, la infraestructura y los patrones operativos según las líneas de la misión, la RPDC complica la atribución y ralentiza la toma de decisiones de los defensores».

Con ese fin, DomainTools señaló que el malware orientado al espionaje de la RPDC está asociado principalmente con Kimsuky, mientras que Lazarus Group encabeza los esfuerzos para generar ingresos ilícitos para el régimen, transformándose en un «pilar central» para la evasión de sanciones. La tercera vía gira en torno a la implementación de ransomware y malware de limpieza con fines de señalización estratégica y llamar la atención sobre sus capacidades. Esta rama disruptiva está asociada a Andariel.

La ingeniería social detrás de las entrevistas contagiosas y el fraude de los trabajadores de TI

La ingeniería social y el engaño siguen siendo los principales catalizadores de muchas de las intrusiones que se han atribuido a los actores amenazadores de la RPDC. Esto incluye el reciente compromiso de la cadena de suministro del enormemente popular paquete npm, Axios, así como campañas en curso como Contagious Interview y fraude a los trabajadores de TI.

Entrevista contagiosa es el apodo asignado a una amenaza de larga duración en la que el adversario se acerca a posibles objetivos y los engaña para que ejecuten código malicioso desde un repositorio falso como parte de una evaluación. Algunos de estos esfuerzos han utilizado proyectos Node.js armados alojados en GitHub para desplegar una puerta trasera de JavaScript llamada DEV#POPPER RAT y un ladrón de información conocido como OmniStealer.

Por otro lado, Fraude de trabajadores de TI de la RPDC se refiere a esfuerzos coordinados por agentes norcoreanos para Consiga puestos remotos independientes y de tiempo completo en empresas occidentales que utilizan identidades robadas, Personas generadas por IAy credenciales falsificadas. Una vez contratados, generan ingresos constantes y aprovechan el acceso para introducir malware y desviar información confidencial y de propiedad exclusiva. En algunos casos, los datos robados se utilizan para extorsionar a las empresas.

El programa patrocinado por el estado despliega miles de trabajadores técnicamente capacitados en países como China y Rusia, que se conectan a computadoras portátiles proporcionadas por la empresa alojadas en granjas de computadoras portátiles en los EE. UU. y otros lugares. El plan también se basa en una red de facilitadores para recibir computadoras portátiles de trabajo, administrar la nómina y manejar la logística. Estos facilitadores son contratados a través de empresas fantasma.

El proceso comienza con los reclutadores que identifican y seleccionan candidatos potenciales. Una vez aceptados, los trabajadores de TI ingresan a una fase de incorporación, donde los facilitadores asignan identidades y perfiles, y los guían a través de actualizaciones de currículum, preparación de entrevistas y solicitudes iniciales de empleo. Los actores de amenazas también trabajan con colaboradores para completar los requisitos de contratación para oportunidades de tiempo completo donde se aplican estrictas políticas de verificación de identidad.

Como señaló Chainalysis, las criptomonedas juega un papel central en canalizar la mayoría de los salarios generados por estos esquemas de trabajadores de TI de regreso a Corea del Norte mientras evaden las sanciones internacionales.

«El ciclo es constante e interminable. Los trabajadores de TI de Corea del Norte entienden que, tarde o temprano, renunciarán o serán despedidos de cualquier puesto determinado», dijeron Flare e IBM X-Force en un informe el mes pasado. «Como resultado, cambian continuamente entre trabajos, identidades y cuentas, sin permanecer nunca en un puesto ni utilizar una sola persona durante mucho tiempo».

Desde entonces, nuevas pruebas descubiertas por Flare han revelado los esfuerzos de la campaña para reclutar activamente a personas de Irán, Siria, Líbano y Arabia Saudita, y al menos dos iraníes recibieron cartas de oferta formales de empleadores estadounidenses. Ha habido más de 10 casos de ciudadanos iraníes que han sido reclutados por el régimen.

También se ha descubierto que los facilitadores utilizan LinkedIn para contratar a personas distintas de Irán, Irlanda e India, a quienes luego se les capacita para conseguir los puestos de trabajo. Estos individuos, llamados llamadores o entrevistadores, hablan por teléfono con gerentes de contratación estadounidenses, pasan entrevistas técnicas y se hacen pasar por personas occidentales reales o falsas seleccionadas por ellos. Cuando una persona que llama no pasa una entrevista, el facilitador revisa la grabación y proporciona comentarios.

«Los norcoreanos están apuntando deliberadamente a contratistas de defensa, intercambios de criptomonedas e instituciones financieras estadounidenses», Flare dicho. «Si bien las motivaciones principales parecen ser financieras, el ataque deliberado evidenciado en sus documentos indica que también puede haber otros objetivos en juego».

«La RPDC no está simplemente desplegando a sus propios ciudadanos bajo identidades falsas. Está construyendo un canal de reclutamiento multinacional, atrayendo a desarrolladores capacitados de Irán, Siria, Líbano y Arabia Saudita a una infraestructura diseñada para infiltrarse en contratistas de defensa, intercambios de criptomonedas, instituciones financieras y empresas de todos los tamaños de los EE. UU. Los reclutas son verdaderos ingenieros de software, pagados en criptomonedas, entrenados a través de entrevistas y ubicados en personajes occidentales fabricados».

admin Noticias, Trending CYBERDEFENSA.MX difunde Docker Hack Infostealer Kubernetes través Triggers Trivy Wiper Worm

Trivy Hack difunde Infostealer a través de Docker, Triggers Worm y Kubernetes Wiper – CYBERDEFENSA.MX

Los investigadores de ciberseguridad han descubierto artefactos maliciosos distribuidos a través de Docker Hub luego del ataque a la cadena de suministro de Trivy, destacando el creciente radio de explosión en los entornos de desarrolladores.

La última liberación limpia conocida de trivia en Docker Hub es 0.69.3. Desde entonces, las versiones maliciosas 0.69.4, 0.69.5 y 0.69.6 se eliminaron de la biblioteca de imágenes del contenedor.

«Las nuevas etiquetas de imagen 0.69.5 y 0.69.6 se publicaron el 22 de marzo sin las correspondientes versiones o etiquetas de GitHub. Ambas imágenes contienen indicadores de compromiso asociados con el mismo ladrón de información de TeamPCP observado en etapas anteriores de esta campaña», dijo el investigador de seguridad de Socket, Philipp Burckhardt. dicho.

El desarrollo se produce a raíz de un compromiso de la cadena de suministro de Trivy, un popular escáner de vulnerabilidades de código abierto mantenido por Aqua Security, que permite a los actores de amenazas aprovechar una credencial comprometida para impulsar a un ladrón de credenciales dentro de versiones troyanizadas de la herramienta y dos acciones de GitHub relacionadas «aquasecurity/trivy-action» y «aquasecurity/setup-trivy».

El ataque ha tenido impactos posteriores, ya que los atacantes aprovecharon los datos robados para comprometer docenas de paquetes npm y distribuir un gusano autopropagante conocido como CanisterWorm. Se cree que el incidente es obra de un actor de amenazas rastreado como TeamPCP.

Según el equipo de OpenSourceMalware, los atacantes han desfigurado los 44 repositorios internos asociados con Aqua Security.aquasec-com» organización GitHub cambiando el nombre de cada uno de ellos con el prefijo «tpcp-docs-«, estableciendo todas las descripciones en «TeamPCP posee Aqua Security» y exponiéndolas públicamente.

Se dice que todos los repositorios se modificaron en una ráfaga programada de 2 minutos entre las 20:31:07 UTC y las 20:32:26 UTC del 22 de marzo de 2026. Se ha evaluado con alta confianza que el actor de amenazas aprovechó una cuenta de servicio «Argon-DevOps-Mgt» comprometida para este propósito.

«Nuestro análisis forense de la API de GitHub Events apunta a un token de cuenta de servicio comprometido, probablemente robado durante el compromiso anterior de Trivy GitHub Actions de TeamPCP, como vector de ataque», dijo el investigador de seguridad Paul McCarty. dicho. «Esta es una cuenta de servicio/bot (ID de GitHub 139343333, creada el 12 de julio de 2023) con una propiedad crítica: une ambas organizaciones de GitHub».

«Un token comprometido para esta cuenta le da al atacante acceso de escritura/administración a ambas organizaciones», agregó McCarty.

El desarrollo es la última escalada de un actor de amenazas que se ha ganado una reputación por apuntar a infraestructuras de nube, mientras construye progresivamente capacidades para exponer sistemáticamente las API de Docker, los clústeres de Kubernetes, los paneles de Ray y los servidores Redis para robar datos, implementar ransomware, realizar extorsión y extraer criptomonedas.

Su creciente sofisticación se ejemplifica mejor con la aparición de un nuevo malware de limpieza que se propaga a través de SSH a través de claves robadas y explota las API de Docker expuestas en el puerto 2375 en toda la subred local.

Se ha descubierto que una nueva carga útil atribuida a TeamPCP va más allá del robo de credenciales y borra clústeres completos de Kubernetes (K8) ubicados en Irán. El script de shell utiliza el mismo recipiente ICP vinculado a CanisterWorm y luego ejecuta comprobaciones para identificar los sistemas iraníes.

«En Kubernetes: implementa DaemonSets privilegiados en cada nodo, incluido el plano de control», investigador de seguridad de Aikido, Charlie Eriksen. dicho. «Los nodos iraníes se borran y se reinician a la fuerza a través de un contenedor llamado ‘kamikaze’. Los nodos no iraníes instalan la puerta trasera CanisterWorm como un servicio systemd. Los hosts iraníes que no son K8 obtienen ‘rm -rf / –no-preserve-root’».

Dada la naturaleza continua del ataque, es imperativo que las organizaciones revisen su uso de Trivy en las canalizaciones de CI/CD, eviten el uso de versiones afectadas y traten cualquier ejecución reciente como potencialmente comprometida.

«Este compromiso demuestra la larga cola de ataques a la cadena de suministro», dijo OpenSourceMalware. «Una credencial obtenida durante el compromiso de Trivy GitHub Actions hace meses fue utilizada como arma hoy para desfigurar toda una organización interna de GitHub. La cuenta de servicio Argon-DevOps-Mgt, una única cuenta de bot que une dos organizaciones con un PAT de larga duración, era el eslabón débil».

«Desde la explotación de la nube hasta los gusanos de la cadena de suministro y los limpiadores de Kubernetes, están creando capacidades y apuntando al propio ecosistema de proveedores de seguridad. La ironía de que una empresa de seguridad en la nube se vea comprometida por un actor de amenazas nativo de la nube no debe pasar desapercibida para la industria.

admin Noticias, Trending CYBERDEFENSA.MX EDR Hack Killer OAuth Phishing Platform Signal Trap ZIP Zombie

OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More – CYBERDEFENSA.MX

Another Thursday, another pile of weird security stuff that somehow happened in just seven days. Some of it is clever. Some of it is lazy. A few bits fall into that uncomfortable category of “yeah… this is probably going to show up in real incidents sooner than we’d like.”

The pattern this week feels familiar in a slightly annoying way. Old tricks are getting polished. New research shows how flimsy certain assumptions really are. A couple of things that make you stop mid-scroll and think, “wait… people are actually pulling this off?”

There’s also the usual mix of strange corners of the ecosystem doing strange things — infrastructure behaving a little too professionally for comfort, tools showing up where they absolutely shouldn’t, and a few cases where the weakest link is still just… people clicking stuff they probably shouldn’t.

Anyway. If you’ve got five minutes and a mild curiosity about what attackers, researchers, and the broader internet gremlins were up to lately, this week’s ThreatsDay Bulletin on The Hacker News has the quick hits. Scroll on.

OAuth consent abuse

Cloud security firm Wiz has warned of the dangers posed by malicious OAuth applications, highlighting how «consent fatigue» could open the door for attackers to gain access to a victim’s sensitive data by giving their malicious apps a legitimate-looking name. By accepting the permissions requested by a rogue OAuth application, the user is «adding» the attacker’s app into their company’s tenant. «Once ‘Accept’ is clicked, the sign-in process is complete,» Wiz said. «But instead of going to a normal landing page, the access token is sent to the attacker’s Redirect URL. With that token, the attacker now has access to the user’s files or emails without ever needing to know their password.» The Google-owned company also said it detected a large-scale campaign active in early 2025 that involved 19 distinct OAuth applications impersonating well-known brands such as Adobe, DocuSign, and OneDrive, and targeted multiple organizations. Details of the activity were documented by Proofpoint in August 2025.
Messaging account takeover

Russian-linked hackers are trying to break into the Signal and WhatsApp accounts of government officials, journalists, and military personnel globally with an aim to get unauthorized access – not by breaking encryption, but by simply tricking people into handing over the security verification codes or PINs. «The most frequently observed method used by the Russian hackers is to masquerade as a Signal Support chatbot in order to induce their targets to divulge their codes,» the Netherlands Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) said. «The hackers can then use these codes to take over the user’s account. Another method used by the Russian actors takes advantage of the ‘linked devices’ function within Signal and WhatsApp.» It’s worth noting that a similar warning was issued by Germany last month. «These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts,» Signal said. Google warned last year that Signal’s widespread use among Ukrainian soldiers, politicians, and journalists had made it a frequent target for Russian espionage operations.
Cloud breach via software flaws

Google has revealed that threat actors are increasingly exploiting vulnerabilities in third-party software to breach cloud environments. «The window between vulnerability disclosure and mass exploitation collapsed by an order of magnitude, from weeks to days,» the tech giant’s cloud division said. «While software-based exploits increased, initial access by threat actors using misconfiguration, which accounted for 29.4% of incidents in the first half of 2025, dropped to 21% in H2 2025. Similarly, exposed sensitive UI or APIs continued a downward trend, falling from 11.8% in H1 to 4.9% in H2. This decline suggests that automated guardrails are making identity and configuration errors harder to exploit and that threat actors are being driven toward more sophisticated and costly vectors that specifically target software vulnerabilities to gain a foothold.» In most attacks investigated by Google, the actor’s objective was silent exfiltration of high volumes of data without immediate extortion and long-term persistence.
Microcontroller debug bypass

New research from Quarkslab has found that it’s possible to bypass the 16-byte password protection required for debug access on several variants of the RH850 microcontroller family using voltage fault injection in under one minute. «Voltage glitching technique is performed by underpowering or overpowering the chip for a controlled amount of time to alter its behavior,» the security company said. «The crowbar attack is a specific type of voltage glitch where the power supply is shorted to the ground instead of injecting a specific voltage, using a MOSFET, for example.»
Solar Spider suspects arrested

Two Nigerian nationals have been arrested by authorities in the Indian state of Uttar Pradesh for their alleged involvement in an e-crime operation known as Solar Spider. The suspects are believed to have been planning to siphon large amounts of money by leveraging security flaws in Indian cooperative banking systems. According to a report from The420.in, the individuals have been identified as Okechukwu Imeka and Chinedu Okafor. The duo is suspected to be part of an international fraud syndicate involved in targeting financial institutions. Solar Spider has a history of targeting banking systems across India and the Middle East, often through spear-phishing campaigns. In a report published in July 2025, Tata Communications revealed that threat actors leverage their initial access to steal credentials, tamper with NEFT/RTGS transactions, and focus on Structured Financial Messaging System (SFMS) and Host-to-Host (H2H) infrastructures. The group is also known for deploying a sophisticated attack framework dubbed JSOutProx since at least 2019.
PlugX malware campaign

Check Point has disclosed targeted campaigns against entities in Qatar using conflict-related content as lures to deliver malware families like PlugX and Cobalt Strike. The attack chain uses Windows shortcut (LNK) files contained within ZIP archives, which, when opened, cause it to download a next-stage payload from a compromised server. The payload then displays the decoy document while using DLL side-loading to deploy PlugX. The activity, detected on March 1, 2026, has been attributed to Mustang Panda (aka Camaro Dragon). A second attack has been observed using a password-protected archive to execute a previously undocumented Rust loader that’s responsible for deploying Cobalt Strike using DLL side-loading. «This loader exploits DLL hijacking of nvdaHelperRemote.dll, a component of the open-source screen reader NVDA. Abuse of this component has previously been observed in only a limited number of Chinese-nexus campaigns, including China-aligned activity associated with a campaign delivering Voldemort backdoor, as well as a wave of attacks targeting the Philippines and Myanmar back in 2025,» Check Point said. While this attack is assessed as China-aligned, it has not been attributed to a specific threat actor. «The attackers leveraged the ongoing war in the Middle East to make their lures more credible and engaging, demonstrating the ability to rapidly adapt to major developments and breaking news,» the company said.
Teen DDoS kit sellers

Polish police have referred seven suspected minor cybercriminals to family court over an alleged scheme to sell distributed denial-of-service (DDoS) kits online. The suspects, aged between 12 and 16 at the time of the alleged offenses, face charges related to selling DDoS tools as part of a profit-driven scheme designed to target popular websites, including auction and sales portals, IT domains, hosting services, and accommodation booking sites. «Using the tools they administer, popular websites such as auction and sales portals, IT domains, hosting services, and accommodation booking services were attacked,» Poland’s Central Bureau for Combating Cybercrime (CBZC) said.
Phishing-resistant Windows login

Microsoft is rolling out passkey support for Microsoft Entra on Windows devices, adding phishing-resistant passwordless authentication via Windows Hello. «We’re introducing Microsoft Entra passkeys on Windows to enable phishing-resistant sign-in to Entra-protected resources. This update allows users to create device-bound passkeys stored in the Windows Hello container and authenticate using Windows Hello methods (face, fingerprint, or PIN),» Microsoft said. «It also expands passwordless authentication to Windows devices that aren’t Entra-joined or registered, helping organizations strengthen security and reduce reliance on passwords.»
Sysmon built into Windows

Microsoft has natively integrated System Monitor (Sysmon) functionality directly into Windows 11 and Windows Server 2025 as an optional built-in feature as of Windows 11’s March feature update (KB5079473). It’s disabled by default. The company announced the integration in November 2025. «You no longer need to package it dynamically; you can simply enable it programmatically via PowerShell,» Nick Carroll, cyber incident response manager at Nightwing, said. «Coupled with Microsoft’s simultaneous announcement that Windows Intune will enable ‘hotpatching’ by default in May 2026, this drastically lowers the barrier to entry for deep endpoint visibility and represents a massive operational win for network defenders.»
Canada phishing campaign

An active phishing campaign is targeting Canadian residents (and possibly present in other countries) using fraudulent domains impersonating trusted institutions, including the Government of British Columbia and Hydro-Québec, with the goal of collecting personal information and credit card details, Flare said. The hosting infrastructure behind this campaign is linked to RouterHosting LLC (aka Cloudzy), a provider that was publicly accused in 2023 of supplying services to at least 17 state-sponsored hacking groups from countries including Iran, China, Russia, and North Korea.
Private link safety in chats

Meta has detailed the workings of Advanced Browsing Protection (ABP) in Messenger, which protects the privacy of the links clicked on within chats while still warning people about malicious links. «In its standard setting, Safe Browsing uses on-device models to analyze malicious links shared in chats,» the company said. «But we’ve extended this further with an advanced setting called Advanced Browsing Protection (ABP) that leverages a continually updated watchlist of millions more potentially malicious websites.» ABP leverages an approach called private information retrieval (PIR) to implement a privacy-preserving «URL-matching» scheme between the client’s query and the server hosting the database, along with Oblivious HTTP, AMD SEV-SNP, and Path ORAM for added privacy guarantees.
BlackSanta EDR killer

A sophisticated attack campaign targeting HR departments and job recruiters has combined social engineering with advanced evasion techniques to stealthily compromise systems by avoiding analysis environments and leveraging a specialized module designed to kill antivirus and endpoint detection software. The attack begins with a resume-themed ISO file delivered likely through spam or phishing emails, which then drops next-stage payloads, including a DLL that’s launched via DLL side-loading to gather basic system information, initiate communication with a remote server, run sandbox checks, employ geographic filtering to avoid running in restricted regions, and drop additional payloads, such as BlackSanta EDR that employs legitimate but vulnerable kernel drivers to impair system defenses, a known tactic referred to as Bring Your Own Vulnerable Driver (BYOVD). «Rather than functioning as a simple auxiliary payload, BlackSanta acts as a dedicated defense-neutralization module that programmatically identifies and interferes with protection and monitoring processes prior to the deployment of follow-on stages,» Aryaka said. «By targeting endpoint security engines alongside telemetry and logging agents, it directly reduces alert generation, limits behavioral logging, and weakens investigative visibility on compromised hosts.» It’s currently not known what the follow-on payloads are or how widespread the campaign is. Phishing campaigns don’t just target HR teams, but also impersonate them in attacks. «Impersonating HR provides many benefits to threat actors. Tasks from HR are typically mandatory, so HR emails carry authority,» Cofense said. «Legitimate HR tasks can also have strict deadlines, which a threat actor can use to impose urgency. Finally, regular HR tasks are expected by employees.»
ZIP evasion technique

A new technique dubbed Zombie ZIP allows attackers to conceal payloads in specially crafted compressed files that can bypass security tools. «Malformed ZIP headers can cause antivirus and endpoint detection and response software (EDR) to produce false negatives,» the CERT Coordination Center (CERT/CC) said. «Despite the presence of malformed headers, some extraction software is still able to decompress the ZIP archive, allowing potentially malicious payloads to run upon file decompression.» The vulnerability, tracked as CVE-2026-0866, has been codenamed Zombie Zip by researcher Christopher Aziz, who discovered it. The technique was demonstrated by Bombadil Systems security researcher Chris Aziz.
AI agent breaches platform

Researchers at autonomous offensive security startup CodeWall said their AI agent hacked McKinsey’s internal AI platform Lili and gained full read and write access to the chatbot platform in just two hours. This enabled access to the entire production database, including 46.5 million chat messages about strategy, mergers and acquisitions, and client engagements, all in plaintext, along with 728,000 files containing confidential client data, 57,800 user accounts, and 95 system prompts controlling the AI’s behavior. The development is an indicator that agentic AI tools are becoming more effective for conducting cyber attacks. The agent said it found over 200 endpoints that were totally exposed, out of which 22 were unprotected. One of these endpoints, which wrote user search queries to the database, suffered from an SQL injection that could have made it possible to access sensitive data and rewrite the system prompts silently. McKinsey has since addressed the problem. There is no evidence that the issue was exploited in the wild.
Teams social engineering malware

Hackers have contacted employees at financial and healthcare organizations over Microsoft Teams to trick them into granting remote access through Quick Assist and deploy a new piece of malware called A0Backdoor. The modus operandi, which aligns with the playbook of Storm-1811 (aka STAC5777 or Blitz Brigantine), employs social engineering to gain the employee’s trust by first flooding their inbox with spam and then contacting them over Teams, pretending to be the company’s IT staff and offering assistance with the problem. To obtain access to the target machine, the threat actor instructs the user to start a Quick Assist remote session, which is used to deploy a malicious toolset that includes digitally signed MSI packages, some of which were hosted on Microsoft cloud storage tied to personal accounts. The installers serve as a conduit for launching a DLL that, in turn, decrypts and runs shellcode responsible for running anti-analysis checks and dropping A0Backdoor, which establishes contact to a remote server using DNS tunnelling to receive commands. The activity has been active since at least August 2025 through late February 2026.
Industrialized disinformation network

The Russian influence operation known as Doppelgänger has been described as industrialized and prioritizing infrastructure resilience, scalability, and operational continuity over short-term visibility. «Rather than functioning as a loose collection of spoofed websites or transient propaganda outlets, the network exhibits the hallmarks of a coordinated, professionally managed influence apparatus,» DomainTools said. «At its core, the ecosystem relies on systematic media brand impersonation executed at scale.» Campaigns mounted as part of the operation exhibit deliberate geographic micro-targeting across European Union member states and the U.S.
Pentagon AI dispute

Anthropic has filed a lawsuit to block the Pentagon from placing it on a national security blocklist, stating the supply chain risk designation was unlawful and violated its free speech and due process rights. The development comes after the Pentagon formally branded the artificial intelligence (AI) company a supply chain risk after it refused to remove guardrails against using its technology for autonomous weapons or domestic surveillance. In its own statement, Anthropic said «we had been having productive conversations with the Department of War over the last several days, both about ways we could serve the Department that adhere to our two narrow exceptions, and ways for us to ensure a smooth transition if that is not possible.» However, the Pentagon said there is no active negotiation happening with Anthropic. It also reiterated that the department «does not do and will not do domestic mass surveillance.» The development follows OpenAI’s own deal with the U.S. Department of Defense, with CEO Sam Altman stating the defense contract would include protections against the same red lines that Anthropic had insisted on. The company has since amended its contract to ensure «the AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals.» Anthropic’s CEO Dario Amodei has called OpenAI’s messaging «safety theater» and «straight up lies.»
GitHub SEO malware

A new information stealer campaign distributing BoryptGrab is leveraging a network of more than 100 public GitHub repositories that claim to offer software tools for free, using search engine optimization (SEO) keywords to lure victims. The multi-stage infection chain begins when a ZIP file is downloaded from a fake GitHub download page. BoryptGrab can harvest browser data, cryptocurrency wallet information, and system information. It’s also capable of capturing screenshots, collecting common files, and extracting Telegram information, Discord tokens, and passwords. Also delivered as part of the attack is a backdoor called TunnesshClient that establishes a reverse SSH tunnel to communicate with the attacker and acts as a SOCKS5 proxy. The earliest ZIP file dates back to late 2025. Certain iterations of the campaign have been found to deliver Vidar Stealer or a Golang downloader dubbed HeaconLoad, which then downloads and runs additional payloads.
RAT campaign against India

The Pakistan-aligned threat actor known as Transparent Tribe has been attributed to a fresh set of attacks targeting Indian government entities to infect systems with a RAT that enables remote command execution, process monitoring and termination, remote program execution, file upload/download, file enumeration, screenshot capture, and live screen monitoring capabilities. «The campaign primarily relies on social engineering techniques, distributing a malicious ZIP archive disguised as examination-related documents to persuade recipients to interact with the files,» CYFIRMA said. «Upon extraction, the archive delivers deceptive shortcut files along with a macro-enabled PowerPoint add-in, which collectively initiate the infection chain. The threat actors employ multiple layers of obfuscation and redundant execution mechanisms to enhance the probability of successful compromise while reducing the likelihood of user suspicion.»
Signed phishing malware

Microsoft is warning of multiple phishing campaigns using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The activity, observed in February 2026, has not been attributed to a specific threat actor or group. «Phishing emails directed users to download malicious executables masquerading as legitimate software,» the company said. «The files were digitally signed using an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD. Once executed, the applications installed remote monitoring and management (RMM) tools that enabled the attacker to establish persistent access on compromised systems.» Some of the deployed RMM tools include ScreenConnect, Tactical RMM, and MeshAgent. The use of the TrustConnect branding was disclosed by Proofpoint last week. Furthermore, the deployment of multiple RMM frameworks within a single intrusion indicates a deliberate strategy to ensure continuous access and ensure operational resilience even if one access mechanism is detected or removed. «These campaigns demonstrate how familiar branding and trusted digital signatures can be abused to bypass user suspicion and gain an initial foothold in enterprise environments,» Microsoft added.
TikTok allowed in Canada

Following a national security review of TikTok, Canada’s Minister of Industry, Mélanie Joly, said the company can keep its business operational. «TikTok will implement enhanced protection for Canadians’ personal information, including new security gateways and privacy-enhancing technologies to control access to Canadian user data in order to reduce the risk of unauthorized or prohibited access,» the government said. «TikTok will implement enhanced protections for minors.» The development marks a complete 180 from a 2024 decision, when it was ordered to shut down its operations, citing unspecified «national security risks.» However, that order was paused in early 2025.
Vulnerabilities rise 12%

Flashpoint said it catalogued 44,509 vulnerability disclosures in 2025, a 12% increase year-over-year (YoY). Of those, 466 were confirmed as exploited in the wild. Nearly 33%, or 14,593 vulnerabilities, had publicly available exploit code. Ransomware attacks also increased 53% YoY in 2025, with 8,835 total attacks recorded. The top RaaS groups by attack volume in 2025 were Qilin at 1,213 attacks, Akira at 1,044, Cl0p at 529, Safepay at 452, and Play at 395. Manufacturing was the most targeted industry with 1,564 attacks, followed by technology at 987 and healthcare at 905. The U.S. accounted for approximately 53% of named victim organizations.
Botnet exploiting 174 flaws

The RondoDox DDoS botnet has been found to implement 174 different exploits between May 25, 2025, and February 16, 2026, peaking at 15,000 exploitation attempts in a single day between December 2025 and January 2026. It’s believed that the threat actors are using compromised residential IP addresses as hosting infrastructure. «The operators of RondoDox have been using a shotgun approach, where they send multiple exploits to the same endpoint, hoping for one to work,» Bitsight said. Of the 174 different vulnerabilities, 15 have a public proof-of-concept (PoC), but no CVE, and 11 do not have PoC code at all. RondoDox is notable for its fast addition of recently disclosed vulnerabilities, in some cases incorporating the PoC even before the CVE was published (e.g., CVE-2025-62593).
Memory-only keylogger attack

Phishing emails bearing purchase order lures are being used to distribute an executable within RAR archives. Once launched, the binary extracts and runs VIP Keylogger in memory without touching the disk. «This keylogger captures either browser cookies, logins, credit card details, autofills, visited URLs, downloads, or top sites from the appropriate files in each of the application’s designated folders,» K7 Labs said. It’s also capable of targeting a wide range of web browsers, stealing the email accounts from Outlook, Foxmail, Thunderbird, and Postbox, and collecting Discord tokens.
Cloudflare-shielded phishing

A new Microsoft 365 credential harvesting campaign has been observed abusing Cloudflare’s services to delay detection and risk profiling. The gatekeeping is designed to ensure the visitor is a real target and not a security scanner or bot. «The campaign implemented multiple anti-detection techniques, including the use of CloudFlare human verification, hardcoded IP block lists, user agent checks, and multiple sites and redirects,» DomainTools said.

Some of the stuff in this week’s list feels a little too practical. Not big flashy hacks — just simple tricks used in the right place at the right time. The kind of things that make defenders sigh because… yeah, that’ll probably work.

There’s also a bit of the usual theme: tools and features doing exactly what they were designed to do… just not for the people who built them. Add some creative thinking, and suddenly normal workflows start looking like attack paths.

Anyway — quick reads, strange ideas, and a few reminders that security problems rarely disappear… they just change shape. Scroll on.

What It Does to Your SOC – CYBERDEFENSA.MX

Noticias, Trending

Breaking News

OpenAI dice que la prueba del modelo estuvo detrás del hack de Hugging Face

Dos hackers Spider dispersos obtienen 5,5 años cada uno por un hack TfL de £ 29 millones – CYBERDEFENSA.MX

El otro caso de Jubair sigue abierto

¿Está terminada la Araña Dispersa?

$290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories – CYBERDEFENSA.MX

Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More – CYBERDEFENSA.MX

⚡ Threat of the Week

🔔 Top News

🔥 Trending CVEs

🎥 Cybersecurity Webinars

📰 Around the Cyber World

🔧 Cybersecurity Tools

Conclusion

Un hack de 13,74 millones de dólares cierra la bolsa Grinex sancionada tras afirmaciones de inteligencia – CYBERDEFENSA.MX

Las aplicaciones de OpenAI para Mac necesitan una actualización gracias al hack de Axios

Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More – CYBERDEFENSA.MX

⚡ Threat of the Week

🔔 Top News

🔥 Trending CVEs

🎥 Cybersecurity Webinars

📰 Around the Cyber World

🔧 Cybersecurity Tools

Conclusion

Hack de deriva por valor de 285 millones de dólares se remonta a una operación de ingeniería social de seis meses en la RPDC – CYBERDEFENSA.MX

Cómo probablemente se desarrolló el ataque a la deriva

El ecosistema de malware fragmentado de Corea del Norte

La ingeniería social detrás de las entrevistas contagiosas y el fraude de los trabajadores de TI

Trivy Hack difunde Infostealer a través de Docker, Triggers Worm y Kubernetes Wiper – CYBERDEFENSA.MX

OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More – CYBERDEFENSA.MX

What It Does to Your SOC – CYBERDEFENSA.MX

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims – CYBERDEFENSA.MX

200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories – CYBERDEFENSA.MX

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores – CYBERDEFENSA.MX

CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories – CYBERDEFENSA.MX

From Adoption to Incident Readiness – CYBERDEFENSA.MX

Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones – CYBERDEFENSA.MX

Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More – CYBERDEFENSA.MX

AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More – CYBERDEFENSA.MX

Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More – CYBERDEFENSA.MX

Or Check Our Popuplar Categories...

Tag Archives: Hack

El otro caso de Jubair sigue abierto

¿Está terminada la Araña Dispersa?

⚡ Threat of the Week

🔔 Top News

🔥 Trending CVEs

🎥 Cybersecurity Webinars

📰 Around the Cyber World

🔧 Cybersecurity Tools

Conclusion

⚡ Threat of the Week

🔔 Top News

🔥 Trending CVEs

🎥 Cybersecurity Webinars

📰 Around the Cyber World

🔧 Cybersecurity Tools

Conclusion

Cómo probablemente se desarrolló el ataque a la deriva

El ecosistema de malware fragmentado de Corea del Norte

La ingeniería social detrás de las entrevistas contagiosas y el fraude de los trabajadores de TI