1010.cx

  • Data Leak Exposes Chinese State-Sponsored Cyber Arsenal and Target Database

    ·

    In early November 2025, a massive data breach at Knownsec, a prominent Chinese cybersecurity firm with government ties, sent shockwaves through the international security community. The incident, reported on November 2, resulted in the theft of over 12,000 classified documents exposing sophisticated state-sponsored cyber weapons, internal hacking tools, and a comprehensive global target list spanning […]

    The post Data Leak Exposes Chinese State-Sponsored Cyber Arsenal and Target Database appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Whisper-Based Attack Reveals User Prompts Hidden Inside Encrypted AI Traffic

    ·

    , ,

    Microsoft researchers have unveiled a sophisticated side-channel attack targeting remote language models that could allow adversaries to infer conversation topics from encrypted network traffic. Despite end-to-end encryption via Transport Layer Security (TLS), the attack exploits patterns in packet sizes and timing to classify the subject matter of user prompts sent to AI chatbots. The research […]

    The post New Whisper-Based Attack Reveals User Prompts Hidden Inside Encrypted AI Traffic appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Monsta FTP Remote Code Execution Flaw Being Exploited in the Wild

    ·

    , , ,

    Security researchers have discovered an actively exploited remote code execution vulnerability in Monsta FTP, a web-based FTP client used by financial institutions, enterprises, and individual users worldwide. The flaw, now tracked as CVE-2025-34299, affects versions up to 2.11.2 and allows attackers to execute arbitrary code on vulnerable servers without authentication. CVE ID Vulnerability Type Affected […]

    The post Monsta FTP Remote Code Execution Flaw Being Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • HackGPT: AI-Powered Penetration Testing Platform Includes GPT-4 and Other AI Engine’s

    ·

    , ,

    HackGPT Enterprise is a new tool made for security teams focuses on being scalable and compliant, meeting the growing need for effective vulnerability assessments.

    The platform supports multi-model AI, including OpenAI’s GPT-4 and local LLMs like Ollama, enabling pattern recognition, anomaly detection, and zero-day vulnerability discovery.

    Developed by Yashab Alam, this cloud-native platform integrates advanced AI and machine learning to automate professional-grade penetration testing.

    Its machine learning capabilities correlate threats, score risks using CVSS standards, and prioritize exploits, streamlining what was once a labor-intensive process.​

    CategoryKey FeaturesDescription
    Advanced AI EngineMulti-Model Support, Machine Learning, Zero-Day Detection, Risk Intelligence, Automated ReportingSupports OpenAI GPT-4, local LLMs like Ollama, TensorFlow, and PyTorch for pattern recognition, anomaly detection, behavioral analysis, ML-powered vulnerability discovery, CVSS scoring, impact assessment, exploit prioritization, and AI-generated executive summaries with compliance mapping.
    Enterprise Security & ComplianceAuthentication, Authorization, Compliance, Audit Logging, Data ProtectionIncludes RBAC with LDAP/Active Directory integration, role-based permissions for Admin, Lead, Senior, Pentester, and Analyst roles, support for OWASP, NIST, ISO27001, SOC2, and PCI-DSS frameworks, comprehensive activity tracking, and AES-256-GCM encryption with JWT tokens and secure sessions.
    Cloud-Native ArchitectureMicroservices, Service Discovery, Load Balancing, Multi-Cloud, High AvailabilityUtilizes Docker containers orchestrated by Kubernetes, Consul-based service registry, Nginx reverse proxy with auto-scaling, deployment support for AWS, Azure, and GCP, and features like circuit breakers, health checks, and failover for reliability.
    Performance & ScalabilityParallel Processing, Multi-Layer Caching, Database, Real-Time, Auto-ScalingEmploys Celery for distributed tasks, Redis with memory caching and TTL management, PostgreSQL with connection pooling and replication, WebSocket for live dashboard updates, and adaptive worker pools to handle workload demands.
    Enterprise Reporting & AnalyticsDynamic Reports, Real-Time Dashboards, Log Analytics, Executive Summaries, Compliance ReportsOffers exports in HTML, PDF, JSON, XML, and CSV formats; Prometheus + Grafana for monitoring; ELK stack (Elasticsearch + Kibana) for logs; AI-generated business impact assessments; and framework-specific compliance documentation.

    At its core, HackGPT follows an enhanced six-phase penetration testing methodology. Phase one automates OSINT reconnaissance with tools like theHarvester and Shodan, aggregating data from multi-cloud environments such as AWS and Azure.

    Scanning in phase two employs parallel processing with Nmap and Nuclei for service fingerprinting and vulnerability correlation.

    Subsequent phases handle assessment, safe exploitation via Metasploit, reporting, and retesting, all with built-in compliance mapping to OWASP, NIST, and PCI-DSS frameworks.

    Enterprise security features include RBAC with LDAP integration, AES-256 encryption, and audit logging to ensure robust data protection.​

    HackGPT’s microservices architecture, built on Docker and Kubernetes, supports high availability and multi-cloud deployments across AWS, Azure, and GCP.

    Performance is optimized with Celery for task distribution, Redis caching, and PostgreSQL databases, allowing real-time dashboards via WebSockets and analytics through Prometheus and Grafana.

    Deployment is straightforward: clone the GitHub repo, run the installer, and choose modes like standalone, API server, or full stack with docker-compose.

    Interfaces range from CLI for interactive assessments to a web dashboard for monitoring and voice commands for quick operations.​

    For enterprises, HackGPT reduces manual effort, enhances accuracy in threat detection, and generates dynamic reports in HTML, PDF, or JSON formats. It integrates with SIEM systems and supports custom AI models, making it adaptable for advanced users.

    Recent recognitions place it among the top AI cybersecurity tools of 2025, highlighting its role in proactive defense.​ HackGPT can be cloned from GitHub.

    Looking ahead, the roadmap includes version 2.1 in Q3 2025 with threat hunting and SIEM integrations, progressing to fully autonomous assessments in version 3.0 by Q1 2026.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post HackGPT: AI-Powered Penetration Testing Platform Includes GPT-4 and Other AI Engine’s appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • As drones proliferate, Army pilots worry about their future. Will a new approach to flight school help?

    ·

    “We’re cooked,” one Army aviator said recently, describing the reactions of fellow students at the service’s helicopter flight school to Sikorsky’s new uncrewed Black Hawk. “Why are we even doing this, for real?”

    As the Army races to realize the promise of unmanned aircraft—more platforms, more flexibility, less risk to aircrew—it is shrinking the units that fly and maintain the helicopters that have long been central to the service’s way of war. Some pilots worry that their careers and expertise will be lost in the transition, even as some express optimism that the Army’s new contractor-run training approach will make tomorrow’s smaller aviation community better than ever.

    The Army has said it will will cut 6,500 of its 30,000 active-duty aviation-community soldiers over the next two years, mostly by removing one aerial cavalry squadron from each active-duty combat aviation brigade, as part of the effort to build “a leaner, more lethal force by infusing technology, cutting obsolete systems,” as Secretary Dan Driscoll and the service’s top uniformed leader Gen. Randy George put it in a May 1 letter.

    Panels are already scrutinizing the skills of pilots and other aircrew, some of whom may choose to leave their jobs, Maj. Gen. Clair Gil, who leads the service’s flight school, told reporters at the Association of the United States Army’s annual conference in Washington, D.C., last month.

    At the same time, Sikorsky isn’t slowing down. The defense company announced last week it taught an enlisted soldier, not a pilot, how to fly one of its autonomous helicopters. The sergeant oversaw the software-flown helicopter’s more than 70-nautical-mile cargo mission from a tablet. It took him less than an hour to learn the program.

    Current Army aviators are trying their best to stay optimistic, but fear that decades-worth of experience will be lost in the culling.

    “I’d like to believe the future won’t include completely offloading aerial resupply and air assault missions to unmanned aircraft, but maybe that’s my bias,” the aviator said in a message. “I think the bigger challenge is integrating technology (inevitable) to reduce risk to soldiers without losing the generational knowledge required to fly these complex systems.”

    But the Army doesn’t just want fewer pilots, it wants better-qualified ones; and it's looking to the defense industry for a solution. The service plans to turn its longtime entry-level helicopter education into a new contractor-owned and -operated model called Flight School Next. Officials and contractors said the new model will offer a simplified approach to training, develop better aviator skills, and save money by taking helicopters, instructors, and maintenance out of the service’s hands.

    While some current and former pilots are skeptical about the Army’s broader aviation strategy, they viewed a flight-school revamp as a much-needed opportunity for the military to reinvest in its future aviators and make training more efficient and competitive.

    “When you have our current experience to compare it to, you have to imagine that there's a better way,” the aviator said. “The Army has a reputation for saying ‘Hey, if we need 1,000 pilots, sure as shit, you're going to give me 1,000 pilots.’ But are those all pilots that we want to be walking across the graduation stage with? I can tell you, on a personal level, that I don't feel that right now.”

    Keeping it simple

    The deadly Jan. 29 collision of an Army UH-60 Black Hawk and a commercial airliner outside Washington, D.C., further increased scrutiny on pilots amid rising mishap rates.  

    There were 17 class-A mishaps, the term for the service’s deadliest and costliest incidents, in fiscal year 2024 alone—the most the service has seen since 2007. Army leaders have repeatedly said declining aviator skills has been a factor.

    “One of the things that we've noticed over the last couple years is our accident trends are moving in the wrong direction,” Gil said, saying senior leaders identified shortcomings among some aviators and told him, “‘We have a very talented population that's coming out. They're inexperienced, they're very good at systems operations. They're not very good at flying fundamentals.’”

    He said that’s partly because the helicopter used to train new Army pilots since 2015—the twin-engine Airbus UH-72 Lakota—doesn’t allow aviators to practice certain techniques. 

    “We're looking at single-engine trainers. Those are aircraft that we've flown in flight school for years before we went to the current UH-72. Where we trained maneuvers like auto-rotations and things we call stuck-pedal or anti-torque maneuvers—things that we don't train in a dual-engine aircraft. This is going to give us an opportunity to go back to that,” Gil said at AUSA. 

    And, he added: “A single-engine, two-bladed aircraft is going to be fundamentally cheaper to operate than a twin-engine, four-bladed aircraft.”

    Defense companies have been eager to pitch their ideas for Flight School Next. Leonardo and Boeing are teaming up to offer a “turnkey, innovative approach” using Leonardo’s AW119T training helicopter and Boeing’s experience with the AH-64 Apache.

    Defense contractor Bell has pitched its single-engine 505 helicopter and the expert instructors at its Bell Training Academy in Fort Worth, Texas, as a possible solution.

    “Not only do we believe we have the right aircraft for this program…but also Bell has been training pilots, including Army pilots, for a long, long time. We trained the first Army pilots in 1946,” Matthew Dorram, capture lead for Flight School Next for Bell, said in an interview on the sidelines of AUSA.

    Several contractors are reportedly vying for the contract with single-engine training helicopters, including MD Helicopters, Enstrom, and at least two teams, including Boeing and Leonardo and Robinson and M1 Support Systems. Airbus, who is also making an offer for the new contract, has defended its UH-72 Lakota helicopters from the Army’s criticisms, saying its stability and autopilot features can be easily toggled off for a more rigorous training experience.

    “With its unmatched safety record, superior training versatility, the UH-72A Lakota remains the premier platform for preparing America’s next generation of Army aviators,” the company said in a July statement.

    Lowering costs, raising morale

    Problems with the Army’s training system are perhaps exemplified by the recent news that maintenance woes will extend new aviators’ required decade of service to 12 years or even more.

    In July, Army officials announced that flight school at Fort Rucker, Alabama, was moving slowly, “largely due to maintenance challenges with the AH-64 Apache helicopter.” Flight school students from the 2023 group were still waiting to finish their courses while the Army Aviation Center of Excellence was waiting to receive the class of 2026. Instead of starting the 10-year service clock after graduating flight school, officials announced they were moving it forward to begin after completion of Initial Entry Rotary Wing training.

    “This means it may be over two years before some students graduate flight school, so their 10-year ADSO grows to 12 or 12 and a half years, at no fault of the soldier,” said Kenneth Hawley, the center’s organization and personnel force development director, in the news release.

    It’s hard to keep spirits high when training pilots are grounded, the Army aviator said. 

    “The sentiment broadly among current flight school students right now is that flight school is dealing with a multitude of maintenance, timing, and aircraft issues,” the aviator said. “Morale, specifically in the Apache course, is rock-bottom.”

    Older veterans, like Dan McClinton, have also seen concerning trends in Army flight school. The retired Apache pilot and 1987 flight school attendee said the Army made poor choices with helicopter training in the past, speculating the service was prioritizing costs, not quality.

    “There's always a desire to do more with less, because it's a money game,” McClinton said, but added he seemed less worried about the cost-savings angle of Flight School Next. 

    “It's not like they're doing that solely for the reason to save money, it just happens to save money,” McClinton said. “Because if the Army had to buy all those helicopters, obviously the cost would be a lot more. So, they're putting that on the contractor.”

    While both McClinton and the Army aviator in flight school remained optimistic about changes to flight school, they expressed some skepticism about the Army’s inevitable pivot to unmanned systems.

    “I understand, you know, technology is changing and I'm fully on board with trying to take advantage of technology when you can, but I am concerned that they may be going too far, too fast,” McClinton said. 

    At AUSA, Boeing announced it was designing a tiltrotor drone wingman concept to support the Army’s helicopter fleet, with company officials saying it comes as service leaders evolve the Apache’s role in battle.

    Unmanned technology will evolve. But until they’re fully replaced, Army aviators say they’re focusing on becoming the best pilots the service still, hopefully, needs.

    “It’s a really interesting time,” the aviator said. “We will look back at this year for Army aviation and think of it as a really pivotal time in the future of this transformation that we're in the midst of. Because, at the same time that we are focusing on those unmanned systems and we recognize the value they’re playing in the modern battlefield, we're still trying to provide good, extensive training for the pilots that we have.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity News Weekly Newsletter – Android and Cisco 0-Day, Teams Flaws, HackedGPT, and Whisper Leak

    ·

    , ,

    Welcome to this week’s edition of the Cybersecurity News Weekly Newsletter, where we dissect the latest threats shaking the digital landscape. As cyber risks evolve faster than ever, staying ahead means understanding the exploits that could target your devices, networks, and data.

    This roundup spotlights zero-day vulnerabilities in Android and Cisco systems, critical flaws in Microsoft Teams, the rise of HackedGPT as a weaponized AI tool, and a major leak from OpenAI’s Whisper transcription service. These stories underscore the urgent need for proactive defenses in an era of sophisticated attacks.

    Kicking off with mobile security, a newly disclosed zero-day in Android’s kernel has left millions of devices exposed to remote code execution. Google has rushed a patch, but unupdated devices remain at high risk especially in enterprise environments relying on BYOD policies. Exploited in the wild by state-sponsored actors, this vulnerability has prompted emergency advisories, reminding us why timely firmware updates are non-negotiable for infrastructure security.

    Shifting to collaboration tools, Microsoft Teams harbors multiple high-severity vulnerabilities, including a privilege escalation bug that lets authenticated users access sensitive admin functions. These flaws, detailed in Microsoft’s October Patch Tuesday, could facilitate lateral movement in hybrid work setups, where Teams serves as a gateway to corporate resources. Organizations should prioritize patching to mitigate phishing and insider threats amplified by these weaknesses.

    In the AI realm, HackedGPT emerges as a chilling development: a modified version of ChatGPT fine-tuned for malicious purposes, capable of generating phishing emails, malware code, and even social engineering scripts.

    Researchers warn that this “jailbroken” AI democratizes cybercrime, lowering barriers for novice attackers. Complementing this, a massive data leak from OpenAI’s Whisper API has exposed over 1.5 million audio files, including sensitive conversations from healthcare and finance sectors.

    The breach, attributed to misconfigured cloud storage, highlights the privacy pitfalls of AI-driven transcription tools and the cascading risks when voice data falls into the wrong hands.

    These incidents reveal a common thread: the intersection of legacy systems, rapid tech adoption, and human oversight fueling exploits. As we dive deeper into each story with expert analysis, patch recommendations, and threat mitigation strategies, remember that vigilance starts with awareness. Stay secure, and let’s unpack the details ahead.

    Threats

    Hackers Deliver SSH-Tor Backdoor Via Weaponized Military Documents

    In October 2025, Cyble researchers uncovered a state-sponsored cyber espionage campaign using weaponized Belarusian military documents to deploy an advanced SSH-Tor backdoor aimed at defense sector personnel, particularly those in unmanned aerial vehicle operations. The malware combines OpenSSH for Windows with a customized Tor hidden service using obfs4 obfuscation, enabling anonymous access to SSH, RDP, SFTP, and SMB protocols on infected systems. The multi-stage infection involves nested ZIP archives and LNK files with anti-analysis checks, such as verifying LNK file counts and process numbers, to evade sandboxes while establishing persistence via scheduled tasks. Attribution points to moderate confidence in UAC-0125/Sandworm (APT44), a Russian-linked group, with tactics echoing the December 2024 Army+ campaign.​ Read more

    Conti Ransomware Member Extradited to the US

    Oleksii Oleksiyovych Lytvynenko, a 43-year-old Ukrainian national, was extradited from Ireland to the US to face charges for his role in the Conti ransomware conspiracy between 2020 and June 2022. The operation hacked networks, encrypted data, and demanded cryptocurrency ransoms, affecting over 1,000 victims across 47 US states and 31 countries, generating at least $150 million by January 2022. Conti was the top ransomware variant targeting critical infrastructure in 2021, with Lytvynenko allegedly managing stolen data and ransom notes, including extorting over $500,000 in Tennessee. Arrested in July 2023 by Irish police at US request, he faces up to 25 years if convicted for conspiracy to commit computer and wire fraud. This case reflects ongoing US efforts to dismantle global ransomware networks, with over 180 convictions since 2020.​ Read more

    Phishing Attack That Abuses Cloudflare Services

    A Russian-speaking threat actor is abusing Cloudflare’s Pages and Workers services to host phishing pages disguised as DMCA takedown notices, tricking victims into downloading malicious files. The campaign directs users to malicious .lnk files via the “search-ms” protocol, which execute PowerShell scripts downloading ZIP archives containing Python-based payloads connected to Pyramid C2 servers for remote control. Over 20 domains have been identified, many reusing file names but altering contents, hosted on networks like Railnet LLC with exposed directories facilitating payload staging. This technique leverages legitimate Cloudflare domains like pages.dev and workers.dev for credibility, enabling widespread distribution through social engineering.​ Read more

    New TruffleNet BEC Campaign Leverages AWS SES

    FortiGuard Labs identified the TruffleNet campaign abusing stolen AWS credentials to exploit Simple Email Service (SES) for large-scale Business Email Compromise (BEC) attacks, primarily targeting the oil and gas sector. The infrastructure spans over 800 hosts across 57 networks, using TruffleHog for credential validation and Portainer for management, with initial API calls like GetCallerIdentity and GetSendQuota to confirm access. Attackers create email identities with stolen DKIM keys from compromised WordPress sites, impersonating vendors like ZoomInfo to send fraudulent $50,000 ACH invoices to typosquatted domains.[From fetch content] The tiered setup includes US-based providers like WS Telecom and Hivelocity, with open ports repurposed for operations, and FortiCNAPP detected anomalies through behavioral indicators. Read more

    Threat Actors Leverage RMM Tools for Attacks

    Threat actors are increasingly using legitimate Remote Monitoring and Management (RMM) tools as first-stage payloads in email campaigns for data collection, financial theft, lateral movement, and ransomware deployment. This trend aligns with a decline in traditional loaders and botnets, as RMMs provide robust remote features with inherent legitimacy, evading detection in enterprise environments. Examples include Hunters International using AnyDesk and ScreenConnect for persistent access in a UK manufacturing attack, maintaining tools for over a month before ransomware execution. Multiple commercial and open-source RMMs have been exploited for initial access and exfiltration, blurring the lines between admin activity and malicious intent.​ Read more

    RondoDox Botnet Updates Arsenal with Expanded Exploits

    The RondoDox botnet has evolved to v2, expanding from two exploits targeting DVRs to over 75 vectors across IoT and enterprise devices, a 650% increase first noted in September 2024. Detected on October 30, 2025, via honeypots from IP 124.198.131.83, it exploits CVEs like Shellshock (CVE-2014-6271), Dasan GPON (CVE-2018-10561), and recent ones in TBK DVRs (CVE-2024-3721). This shift bridges IoT opportunism to enterprise targeting, analyzed by Beelzebub’s AI deception platform capturing the full attack chain. FortiGuard Labs and Trend Micro have tracked its growth, emphasizing vulnerabilities spanning a decade of CVEs in routers and applications.​ Read more

    XLoader Malware Analyzed Using ChatGPT

    Researchers used ChatGPT to accelerate reverse engineering of XLoader, a FormBook successor evolving since 2020, decrypting over 100 functions and breaking modified RC4 schemes in hours rather than days. The AI workflow exported IDA Pro data for static analysis, extracting runtime values like encryption keys and C2 data via live debuggers, deobfuscating API calls hidden by custom hashing. XLoader employs runtime decryption and multi-layer encryption with hidden keys, regularly updating to counter analysis, making AI-assisted dissection a game-changer for malware teams.​ Read more

    Threat Actors May Abuse VS Code Extensions

    North Korean-linked actors are uploading rogue Visual Studio Code (VS Code) extensions to Microsoft’s marketplace, impersonating popular tools like Prettier to enable supply chain attacks on developers. Extensions run with full user privileges without sandboxing, allowing arbitrary code execution, file manipulation, and data theft once installed. Attackers exploit the marketplace’s lack of unique name enforcement and bypass verification badges, with a PoC fake Prettier extension installed over 1,000 times before removal. Users should verify sources, reviews, and download counts to mitigate risks from this developer-targeted vector.​ Read more

    Cyberattack

    WSUS Port Scanning Surge

    Cybersecurity researchers have observed a sharp increase in scans targeting TCP ports 8530 and 8531 associated with Windows Server Update Services (WSUS) infrastructure. This activity links to CVE-2025-59287, a critical vulnerability enabling remote code execution without authentication, allowing attackers to run arbitrary scripts on vulnerable servers. Threat actors follow a reconnaissance-to-exploitation pattern, and experts recommend auditing exposed WSUS instances for compromise, applying patches, and segmenting networks to mitigate risks.​ The flaw affects multiple WSUS versions with a CVSS score of 9.8, urging immediate isolation and forensic analysis for internet-facing systems.​ Read more

    Malvertising with PuTTY and Teams

    A persistent malvertising campaign is distributing OysterLoader malware via fake ads for legitimate tools like PuTTY and Microsoft Teams on Bing search results. Linked to the Rhysida ransomware group, this operation uses code-signing certificates and obfuscation to evade detection, with over 40 certificates burned since June 2025. Attackers impersonate popular software to deliver initial access payloads, enabling ransomware deployment in corporate networks.​

    Rhysida’s tactics have escalated, including exploitation of Microsoft’s Trusted Signing service, prompting revocations of more than 200 certificates while operations continue.​ Read more

    XWiki Eval Injection Flaw

    The XWiki Platform suffers from CVE-2025-24893, a critical eval injection vulnerability in its SolrSearch feature that allows unauthenticated remote code execution. Added to CISA’s Known Exploited Vulnerabilities catalog on October 30, 2025, the flaw enables attackers to craft requests for arbitrary code runs, compromising wiki installations used in education, government, and corporate settings. Impacts include data theft, malware deployment, and network pivoting, with affected versions below 15.10.11, 16.4.1, and 16.5.0RC1.​

    Mitigations involve patching to fixed releases or modifying the SolrSearchMacros file to enforce secure content types; CISA mandates immediate action per BOD 22-01.​ Read more

    Curly COMrades Attack Innovations

    The Curly COMrades threat actor group employs novel techniques using legitimate Windows tools for persistent access and evasion in targeted operations. This advanced persistent threat leverages system-native components to create backdoors and maintain footholds, posing risks to enterprise environments. Their methodology focuses on COM object manipulation for stealthy persistence, highlighting the dangers of living-off-the-land tactics.​ Organizations should monitor for anomalous Windows API calls and implement behavioral detection to counter such evasive behaviors.​ Read more

    PROMPTFLUX AI-Enhanced Malware

    Google Threat Intelligence has disclosed PROMPTFLUX, an experimental VBScript-based malware family that integrates Google’s Gemini API for real-time code obfuscation and evasion. Acting as a dropper disguised as installers, it queries the “gemini-1.5-flash-latest” model to generate antivirus-bypassing scripts, marking the first “just-in-time” AI use in malware. Advanced features include hourly self-mutation and lateral movement to drives, though currently in testing phases.​ Google disabled related API keys, and defenses emphasize monitoring for unusual API traffic and restricting model access in enterprise settings.​ Read more

    NGate NFC Relay Attacks

    NGate malware targets Android users in Poland via phishing, enabling unauthorized ATM cash withdrawals through NFC data relay without physical card theft. Distributed as fake banking apps, it captures card details and PINs during “verification” taps, relaying them to attacker devices at ATMs via a C2 server. The infection uses encrypted configurations and Host Card Emulation to mimic legitimate payment services, evading standard security checks.​ Users should verify apps from official sources and contact banks directly for suspicious calls; technical analysis reveals cleartext TCP exfiltration of sensitive data.​ Read more

    Vulnerabilities

    Cisco ASA/FTD RCE Exploitation

    Cisco reports active exploitation of CVE-2025-20333, a critical buffer overflow in Secure Firewall ASA and FTD software’s VPN web server, allowing authenticated attackers root-level code execution. Disclosed September 25, 2025, with CVSS 9.9, it affects configurations enabling AnyConnect IKEv2 or SSL VPN, leading to data exfiltration or DoS via device reloads. No workarounds exist, requiring upgrades to patched versions like ASA 9.18.4.19.​ Administrators must audit VPN setups and enable multi-factor authentication to limit exposure in perimeter defenses.​ Read more

    Windows Graphics RCE Vulnerabilities

    Multiple vulnerabilities in Microsoft’s Graphics Device Interface (GDI) allow remote attackers to execute arbitrary code or steal data through malformed Enhanced Metafile (EMF) formats. Discovered via fuzzing by Check Point, these issues affect Windows 10/11 and Office apps, with exploits possible via rigged documents or images without user interaction. Patched in 2025 updates like KB5058411, they highlight risks in legacy graphics processing, rated up to Critical (CVSS 9.8).​ Read more

    WSUS Patch Breaks Hotpatching

    Microsoft’s October 2025 update for CVE-2025-59287, a critical WSUS RCE flaw, disrupted hotpatching on some Windows Server 2025 systems by pushing to enrolled devices prematurely. Affected servers now require reboots for updates until a January 2026 baseline realigns them, while untouched systems receive layered fixes without interruption. This incident stresses challenges in zero-downtime patching for enterprise environments reliant on WSUS.​ Read more

    Apple Patches Critical iOS Flaws

    Apple’s iOS 26.1 and iPadOS 26.1 updates fix over 50 vulnerabilities across WebKit, Kernel, and Accessibility, preventing privacy breaches, app crashes, and sandbox escapes on iPhone 11+ and compatible iPads. Key fixes include permissions issues allowing app detection (CVE-2025-43442) and malicious screenshotting (CVE-2025-43455), plus WebKit use-after-free bugs enabling code execution. Reported by researchers from ByteDance and Google, these patches enhance defenses against targeted malware and web exploits. Read more

    Android Zero-Click RCE Bug

    Google’s November 2025 bulletin discloses CVE-2025-48593, a critical zero-click RCE in Android’s System component, allowing remote code execution via network packets or malicious apps on AOSP versions 13-16. No user interaction is needed, risking full device compromise including data theft or botnet inclusion. A companion high-severity EoP flaw (CVE-2025-48581) further elevates risks; users should apply the 2025-11-01 patch level immediately.​ Read more

    Microsoft Teams Feature Exposes Risks

    Microsoft Teams’ “Chat with Anyone” feature, allowing external email chats without validation, enlarges phishing vectors by enabling spoofed communications from attackers posing as contacts. This update, rolled out in late 2025, bypasses traditional safeguards, potentially leading to credential theft or malware delivery in hybrid work settings. With over 320 million users, organizations must enforce strict external chat policies and monitor for anomalous invites to mitigate social engineering threats.​ Read more

    CWP OS Command Injection Exploited

    CISA warns of CVE-2025-48703, an unauthenticated OS command injection in Control Web Panel’s file manager, allowing arbitrary command execution with just a valid non-root username. Added to KEV catalog on November 4, 2025, it’s actively exploited via shell metacharacters in the t_total parameter, classified as CWE-78. Federal agencies must patch by November 25 or discontinue use; admins should audit logs for suspicious requests.​ Read more

    HackedGPT Vulnerabilities in ChatGPT

    Tenable uncovered seven flaws in GPT-4o and GPT-5, including zero-click prompt injections via SearchGPT that enable data exfiltration from user memories without interaction. Attacks hide malicious instructions in websites or markdown, bypassing safety mechanisms like url_safe for persistent leaks across sessions. OpenAI patched some via TRAs, but inherent LLM risks persist; users should limit sensitive data sharing in AI tools.​ Read more

    Chrome Emergency Update

    Google’s Chrome 142 update patches five flaws, including high-severity out-of-bounds writes in WebGPU (CVE-2025-12725) and V8 implementation issues enabling RCE via malicious web content. Affecting Windows, macOS, and Linux, these could compromise systems during routine browsing; Omnibox bugs aid phishing. Apply via “About Chrome” immediately, as details are restricted to curb exploits.​ Read more

    Windows

    New BOF Tool Targets Microsoft Teams Cookies

    A specialized Beacon Object File (BOF) from Tier Zero Security exploits Microsoft Teams’ cookie encryption to extract authentication tokens without alerting users. The tool injects into the ms-teams.exe process, duplicates file handles to the locked Cookies SQLite database, and decrypts values using the user’s DPAPI master key, enabling attackers to impersonate users and access chats, emails, and Microsoft Graph API data. This stealthy approach adapts browser exploitation techniques, bypassing file-locking mechanisms and highlighting gaps in Teams’ security compared to hardened Chromium browsers. Organizations should monitor for process injections and enforce least-privilege execution to counter this threat.​

    Read more: https://cybersecuritynews.com/bof-tool-exploits-microsoft-teams/cybersecuritynews​

    Windows 11 Update Causes Task Manager Glitch

    Microsoft’s KB5067036 optional update for Windows 11 versions 24H2 and 25H2 results in Task Manager remaining active in the background after closure, consuming unnecessary resources. This known issue affects the utility’s termination behavior and includes improvements to AI features like Copilot Plus, alongside a non-removable servicing stack update KB5067035. Users can remove the cumulative update via DISM, but Microsoft advises waiting for a fix in future releases. The problem underscores the importance of testing optional updates before deployment in enterprise environments.​

    Read more: https://cybersecuritynews.com/windows-11-update-task-manager/cybersecuritynews​

    BitLocker Recovery Prompt After Windows Updates

    Microsoft warns that security updates from October 14, 2025, may trigger BitLocker recovery screens on Intel-based Windows 11 (25H2/24H2) and Windows 10 (22H2) systems supporting Connected Standby. The glitch requires a one-time recovery key entry upon restart but does not compromise data integrity. Affected versions include KB5066835 for Windows 11 and KB5066791 for Windows 10, with no impact on server editions. Mitigation involves applying Known Issue Rollbacks via Microsoft Support or ensuring recovery keys are accessible.​

    Read more: https://cybersecuritynews.com/windows-systems-bitlocker-recovery/cybersecuritynews​

    Cloud Files Driver Vulnerability Enables Escalation

    CVE-2025-55680 in the Windows Cloud Files Mini Filter Driver (cldsync.sys) allows local privilege escalation through a TOCTOU race condition in file path validation. Attackers exploit this by modifying kernel memory paths to create symbolic links, injecting malicious DLLs into system processes like rasman for full SYSTEM access. The flaw, rated 7.8 CVSS, affects placeholder file operations and builds on prior Microsoft patches. Immediate patching is recommended, as any authenticated user can achieve kernel-level compromise.​

    Read more: https://cybersecuritynews.com/windows-cloud-files-vulnerability-exploited/cybersecuritynews​

    Teams “Chat with Anyone” Feature Risks Phishing

    Microsoft Teams’ new feature, rolling out in November 2025, lets users start chats with external email addresses without requiring a Teams account, enabling guest joins. This default setting expands phishing opportunities by allowing spoofed invites to deliver malware or harvest credentials within the platform. Risks include data leaks and compliance issues under GDPR, as interactions bypass email filters. Admins can disable it via PowerShell by setting UseB2BInvitesToAddExternalUsers to false and enforcing MFA.

    Read more: https://cybersecuritynews.com/microsoft-teams-chat-with-anyone-feature/

    Active Directory Sites for Privilege Escalation

    Attackers with write permissions on Active Directory sites can link malicious Group Policy Objects (GPOs) to escalate privileges across domains, including forest roots. Permissions like GenericAll or WriteGPLink allow injecting commands that add attacker accounts to admin groups on connected systems. This technique bypasses SID filtering via forest-wide replication, enabling rapid lateral movement. Organizations should audit site permissions and monitor GPO changes to prevent domain compromise.

    Read more: https://cybersecuritynews.com/active-directory-sites-escalate-privileges/

    Other News

    Dark Web Credential Exposures

    Proton launched the Data Breach Observatory initiative, revealing over 300 million stolen credentials circulating on dark web cybercrime markets, posing significant risks to businesses and individuals. Small businesses face particular threats, with four out of five experiencing recent breaches that can cost over one million dollars per incident, often going unreported due to delays in detection. The observatory monitors underground forums in real time, identifying ten major 2025 breaches across industries, including Qantas Airways (11.8 million records with names, birth dates, addresses, phone numbers, and emails) and Free in France (19 million records including IBANs). Other notable incidents involve Allianz Life in Germany (1 million records with social security numbers), SkilloVilla in India (33 million records of contact information), and several U.S. and European firms exposing passwords, usernames, and banking details.​ Read more​

    Microsoft Entra Credential Security

    Microsoft will enhance security in its Authenticator app by automatically detecting and deleting Microsoft Entra credentials on jailbroken iOS devices and rooted Android devices starting February 2026. This measure addresses vulnerabilities where modified devices bypass security controls, enabling credential theft and unauthorized access to organizational resources. The feature deploys automatically without IT configuration, applying only to enterprise credentials while sparing personal or third-party accounts. Organizations are advised to notify users in advance, recommending device upgrades or removal of modifications to avoid authentication disruptions.​ Read more​

    HydraPWK Penetration Testing OS Update

    The HydraPWK project’s Apes-T1 snapshot updates its Debian-based penetration testing Linux distribution by replacing Elasticsearch with open-source OpenSearch to resolve licensing issues and improve industrial security tools. This semi-rolling release enhances network forensics via Arkime and adds OpenSearch Dashboards for observability, alongside UI fixes like improved terminal colorschemes for better error visibility. Compared to Kali Linux, HydraPWK offers a lightweight, low-latency alternative with PREEMPT_RT kernel support for hardware like UAVs and ECUs, emphasizing plug-and-play efficiency for targeted ethical hacking without Kali’s broader overhead.​ Read more​

    OneDrive DLL Sideloading Attack

    Threat actors exploit OneDrive.exe via DLL sideloading by placing a malicious version.dll in the application’s directory, tricking it into loading harmful code instead of the legitimate library during startup. The technique uses DLL proxying to forward calls to the real system library while executing payloads stealthily, maintaining normal app functionality to evade detection. Advanced hooking via Vectored Exception Handling and PAGE_GUARD flags intercepts API calls like CreateWindowExW without inline modifications, allowing persistent control and spawning of hidden processes. Defenses include application whitelisting, DLL loading monitoring, and signature validation to counter these attacks on trusted Microsoft processes.​ Read more​

    The post Cybersecurity News Weekly Newsletter – Android and Cisco 0-Day, Teams Flaws, HackedGPT, and Whisper Leak appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Whisper Leak Toolkit Exposes User Prompts to Popular AI Agents within Encrypted Traffic

    ·

    , ,

    A sophisticated side-channel attack that exposes the topics of conversations with AI chatbots, even when traffic is protected by end-to-end encryption.

    Dubbed “Whisper Leak,” this vulnerability allows eavesdroppers such as nation-state actors, ISPs, or Wi-Fi snoopers to infer sensitive prompt details from network packet sizes and timings. The discovery highlights growing privacy risks as AI tools integrate deeper into daily life, from healthcare queries to legal advice.

    Researchers at Microsoft detailed the attack in a recent blog post, emphasizing its implications for user trust in AI systems. By analyzing streaming responses from large language models (LLMs), attackers can classify prompts on specific topics without decrypting the data.

    This is particularly alarming in regions with oppressive regimes, where discussions on protests, elections, or banned content could lead to targeting.

    Whisper Leak Toolkit

    AI chatbots like those from OpenAI or Microsoft generate replies token by token, streaming output for quick feedback. This autoregressive process, combined with TLS encryption via protocols like HTTPS, typically shields content.

    However, Whisper Leak targets the metadata: variations in packet sizes (tied to token lengths) and inter-arrival times reveal patterns unique to topics.

    The methodology involved training classifiers on encrypted traffic. For a proof-of-concept, researchers focused on “legality of money laundering,” generating 100 prompt variants and contrasting them against 11,716 unrelated Quora questions.

    Using tools like tcpdump for data capture, they tested models including LightGBM, Bi-LSTM, and BERT-based classifiers. Results were stark: many achieved over 98% accuracy on the Area Under the Precision-Recall Curve (AUPRC), distinguishing target topics from noise.

    In simulated real-world scenarios, attackers monitoring 10,000 conversations could flag sensitive ones with 100% precision and 5-50% recall, meaning few false alarms and reliable hits on illicit queries.

    The attack builds on prior research, like token-length inference by Weiss et al. and timing exploits by Carlini and Nasr, but extends to topic classification.

    Mitigations

    Microsoft collaborated with vendors including OpenAI, Mistral, xAI, and its own Azure platform to deploy fixes. OpenAI added an “obfuscation” field with random text chunks to mask token lengths, slashing attack viability.

    Mistral introduced a “p” parameter for similar randomization, while Azure mirrored these changes. These updates reduce risks to negligible levels, per testing.

    For users, experts recommend avoiding sensitive topics on public networks, using VPNs, opting for non-streaming modes, and choosing mitigated providers. The open-source Whisper Leak repository on GitHub includes code for awareness and further study.

    This incident underscores the need for robust AI privacy as adoption surges. While mitigations address the immediate threat, evolving attacks could demand ongoing vigilance from the industry.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New Whisper Leak Toolkit Exposes User Prompts to Popular AI Agents within Encrypted Traffic appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Uncovers ‘Whisper Leak’ Attack That Identifies AI Chat Topics in Encrypted Traffic

    ·

    Microsoft has disclosed details of a novel side-channel attack targeting remote language models that could enable a passive adversary with capabilities to observe network traffic to glean details about model conversation topics despite encryption protections under certain circumstances. This leakage of data exchanged between humans and streaming-mode language models could pose serious risks to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Seven QNAP Zero-Day Vulnerabilities Exploited at Pwn2Own 2025 Now Patched

    ·

    , , ,

    QNAP has addressed seven critical zero-day vulnerabilities in its network-attached storage (NAS) operating systems, following their successful exploitation by security researchers at Pwn2Own Ireland 2025.

    These flaws, identified as CVE-2025-62847, CVE-2025-62848, CVE-2025-62849, and associated ZDI canonical entries ZDI-CAN-28353, ZDI-CAN-28435, ZDI-CAN-28436, enable remote code execution (RCE) and privilege escalation attacks against QTS 5.2.x, QuTS hero h5.2.x, and QuTS hero h5.3.x versions.

    The exploits, demonstrated in a controlled environment, highlight kernel-level weaknesses and web interface flaws that could allow unauthenticated attackers to compromise device integrity and exfiltrate stored data.​

    QNAP Zero-Day Vulnerabilities Exploited

    At Pwn2Own Ireland 2025, held in Cork from October 20-22, teams including Summoning Team, DEVCORE, Team DDOS, and a CyCraft intern chained these zero-days to bypass authentication and achieve full system takeover on QNAP NAS devices.

    The core operating system vulnerabilities involve improper input validation leading to buffer overflows and use-after-free errors in CGI handlers, facilitating arbitrary command injection without user privileges.

    For instance, attackers exploited stack-based overflows in the quick.cgi component to execute shell commands on uninitialized devices, extending to initialized systems via chained privilege escalations.

    These techniques mirror historical QNAP issues, such as heap overflows in cgi.cgi, but escalate to zero-click RCE in modern firmware. Event organizers from the Zero Day Initiative (ZDI) awarded bounties exceeding $150,000 for the NAS category, contributing to a total of $792,750 across 56 unique hacks.​

    QNAP resolved these issues in firmware updates released on October 24, 2025, targeting the affected OS branches with mitigations for memory corruption and authentication bypass vectors.

    Specifically, QTS 5.2.x users must upgrade to version 5.2.7.3297 build 20251024 or later, which includes hardened input sanitization and kernel patches to prevent overflow exploits.

    QuTS hero h5.2.x follows the same build, while h5.3.x requires 5.3.1.3292 build 20251024 or later, addressing ZFS-specific integration flaws that amplified RCE risks in hybrid storage setups.

    Although CVSS scores remain pending for some entries, the zero-day status and Pwn2Own context classify them as critical, with potential for denial-of-service (DoS) as a precursor to data compromise.

    Administrators can deploy updates via the Control Panel > System > Firmware Update interface, enabling Live Update for automatic detection and installation. Manual downloads from QNAP’s Download Center support offline environments, ensuring compatibility checks against the product’s EOL status page.​

    Mitigations

    To counter residual risks, QNAP advises immediate password rotation and segmentation of NAS traffic using VLANs to limit lateral movement post-exploit.

    The vulnerabilities extend beyond the core OS to integrated apps like HBS 3 Hybrid Backup Sync (CVE-2025-62840, CVE-2025-62842), where path traversal allows unauthorized backup access, and Malware Remover (CVE-2025-11837), which is ironically vulnerable to command injection in its scanning engine.

    In enterprise deployments, these flaws could enable supply-chain attacks, as NAS devices often serve as centralized repositories for sensitive files.

    Security teams should audit logs for anomalous CGI requests and integrate tools like intrusion detection systems (IDS) for ongoing monitoring.

    This Pwn2Own outcome underscores the efficacy of bug bounties in preempting wild exploits, urging all QNAP users to prioritize firmware hygiene amid rising NAS-targeted threats.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Seven QNAP Zero-Day Vulnerabilities Exploited at Pwn2Own 2025 Now Patched appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Maps Adds Feature for Businesses to Report Ransom Demands for Removing Bad Reviews

    ·

    , ,

    Scammers are targeting businesses with a new extortion scheme, and Google Maps is fighting back with a dedicated reporting tool.

    Google has introduced a feature that allows business owners to report ransom demands directly to malicious actors who threaten them with fake negative reviews.

    Cybercriminals have developed a sophisticated plan to extort money from businesses through Google Maps reviews.

    The scheme begins with “review-bombing,” where bad actors flood a business profile with fake one-star reviews designed to bypass Google’s moderation systems.

    Once the attack launches, scammers contact business owners through third-party messaging apps and demand payment.

    The threat is simple but effective: pay the fee, or the negative reviews stay and potentially escalate, damaging the business’s reputation and online rating.

    This type of extortion exploits the importance of online reviews for modern businesses.

    A sudden drop in ratings can significantly erode customer trust and revenue, leaving some business owners feeling pressured to pay rather than risk further damage.

    Google’s Response to the Threat

    Google Maps has implemented clear policies prohibiting fake engagement, harassment, extortion, and harmful content.

    The platform actively monitors for violations and removes content that breaks these rules.

    However, the new reporting feature represents a more direct response to the growing extortion problem.

    The company is currently rolling out an official merchant extortion report form that allows business owners to alert Google to ransom demands quickly.

    This streamlined reporting process enables the company to take swift action against malicious actors attempting to manipulate the review system for financial gain.

    Security experts recommend that business owners never engage with extortionists or pay ransom demands, as doing so only encourages further attacks.

    Instead, businesses should immediately report malicious activity using Google’s official merchant extortion report form.

    Business owners should preserve all evidence of extortion attempts, including screenshots, emails, and chat logs.

    These records can support law enforcement investigations and help Google identify patterns of abuse across multiple targets.

    The review extortion scheme highlights how scammers continue to find new ways to exploit online platforms.

    Google’s proactive approach to the reporting feature demonstrates the ongoing battle between platform providers and cybercriminals to protect businesses and consumers from digital fraud.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Google Maps Adds Feature for Businesses to Report Ransom Demands for Removing Bad Reviews appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶