1010.cx

  • New TEE.fail Exploit Steals Secrets from Intel & AMD DDR5 Trusted Environments

    ·

    , ,

    Researchers have unveiled a groundbreaking attack dubbed “TEE.fail” that fundamentally compromises the security guarantees of Trusted Execution Environments (TEEs) from Intel and AMD by exploiting DDR5 memory architecture. The attack demonstrates how even the most advanced hardware-backed security features can be defeated using surprisingly accessible electronic equipment, raising critical questions about the future of confidential […]

    The post New TEE.fail Exploit Steals Secrets from Intel & AMD DDR5 Trusted Environments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Windows Accessibility Flaw Allows Stealthy Persistence and Lateral Movement via Narrator DLL Hijack

    ·

    A persistent vulnerability related to DLL hijacking has been identified in the Narrator accessibility tool, which has been a significant concern over time.

    This flaw allows malicious actors to exploit the tool, potentially compromising the security of systems that rely on it for accessibility features.

    Noted initially in reports dating back to 2013 by expert Hexacorn, the flaw persists in modern Windows 10 and 11 versions, allowing attackers with local administrator privileges to achieve stealthy code execution, system persistence, and even remote lateral movement.

    TrustedSec discovery, inspired by mining tactics from VX-Underground repositories, highlights how everyday accessibility features can be weaponized for malicious ends.

    The technique exploits Narrator.exe’s loading of the MSTTSLocOneCoreEnUS.dll from the path %windir%\system32\speech_onecore\engines\tts.

    By replacing this DLL with a malicious version, attackers can execute arbitrary code upon Narrator launch, without requiring any exports.

    The DLL’s DllMain attach function triggers the payload, but researchers refined it to suspend Narrator’s main thread, silencing the tool’s voice output and preventing visual cues that could alert users.

    A proof-of-concept on GitHub demonstrates this evasion, freezing Narrator while running custom code undetected.

    User-Level Persistence via Registry Tweaks

    Attackers can embed this hijack to automatically execute at logon by modifying the registry.

    Under HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility, creating a REG_SZ value named “configuration” set to “Narrator” triggers the DLL on user login.

    TrustedSec tests confirmed seamless persistence post-logoff, with the malicious DLL loading silently. This method requires no elevated privileges beyond initial access, making it ideal for maintaining footholds in user contexts.

    For broader impact, the technique extends to SYSTEM-level persistence by applying the same registry change under HKLM, launching Narrator at the login screen with elevated privileges.

    Lateral movement adds another layer: attackers with remote registry access via tools like Impacket can deploy the DLL and alter HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\SecurityLayer to 0.

    RDP connection to the target then allows triggering Narrator via Ctrl+Win+Enter at login, executing the payload as SYSTEM before the session closes, forcing quick process migration for sustained access.

    Researchers also demonstrated “Bring Your Own Accessibility,” crafting custom accessibility tools (ATs) via registry exports and imports, pointing to arbitrary executables, even UNC network paths for remote payload delivery.

    Triggering via ATBroker.exe /start further enhances flexibility. While no CVE has been assigned yet, this underscores the risks of unpatched legacy behaviors in accessibility features, urging organizations to monitor registry changes and DLL paths rigorously.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Windows Accessibility Flaw Allows Stealthy Persistence and Lateral Movement via Narrator DLL Hijack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Discover Practical AI Tactics for GRC — Join the Free Expert Webinar

    ·

    Artificial Intelligence (AI) is rapidly transforming Governance, Risk, and Compliance (GRC). It’s no longer a future concept—it’s here, and it’s already reshaping how teams operate. AI’s capabilities are profound: it’s speeding up audits, flagging critical risks faster, and drastically cutting down on time-consuming manual work. This leads to greater efficiency, higher accuracy, and a more

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Docker Compose Flaw Lets Attackers Overwrite Arbitrary Files

    ·

    , , ,

    A path traversal vulnerability discovered in Docker Compose allows attackers to write arbitrary files to host systems through specially crafted OCI artifacts. Tracked as CVE-2025-62725, the flaw was discovered in early October 2025 and carries a high severity rating of 8.9 CVSS. CVE ID CVE-2025-62725 Component Docker Compose OCI Artifacts Vulnerability Type Path Traversal / […]

    The post Docker Compose Flaw Lets Attackers Overwrite Arbitrary Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Massive Tata Motors Data Leak Exposes 70+ TB of Sensitive Information

    ·

    , , ,

    Tata Motors, India’s largest automaker and a major player in the global automotive industry, suffered a catastrophic data exposure that revealed over 70 terabytes of sensitive information through multiple security failures. The breaches, discovered in 2023, involved exposed AWS credentials on public-facing websites, encrypted keys that were easily decrypted, a Tableau backdoor with zero authentication […]

    The post Massive Tata Motors Data Leak Exposes 70+ TB of Sensitive Information appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Dassault Systèmes Vulnerabilities Actively Exploited in Attacks

    ·

    , , ,

    CISA has added two critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting these security flaws in real-world attacks.

    The alert, issued on October 28, 2025, requires federal agencies to implement mitigations by November 18, 2025, while urging all organizations using the affected software to take immediate action.

    DELMIA Apriso, a widely deployed manufacturing operations management platform used by enterprises worldwide, has become the target of sophisticated cyberattacks exploiting two distinct vulnerabilities.

    Active Exploitation of Manufacturing Software

    The first flaw, tracked as CVE-2025-6204, is a code injection vulnerability (CWE-94) that enables attackers to execute arbitrary code on vulnerable systems.

    This type of weakness allows malicious actors to inject and run unauthorized commands, potentially leading to complete system compromise.

    The second vulnerability, CVE-2025-6205, involves missing authorization controls categorized as CWE-862.

    CVE IDProductVulnerability Type
    CVE-2025-6204Dassault Systèmes DELMIA AprisoCode Injection
    CVE-2025-6205Dassault Systèmes DELMIA AprisoMissing Authorization

    This security gap permits attackers to bypass authentication mechanisms and gain elevated privileges within the application without proper credentials.

    When combined, these vulnerabilities create a dangerous attack surface that could allow threat actors to infiltrate manufacturing environments, manipulate production data, or deploy ransomware across industrial networks.

    CISA’s inclusion of these vulnerabilities in the KEV catalog signals confirmed exploitation in active attack campaigns, though details about specific incidents remain undisclosed.

    The agency has mandated that federal civilian executive branch agencies apply vendor-supplied patches or mitigations within three weeks.

    For organizations using cloud-based deployments, CISA recommends following Binding Operational Directive 22-01 guidance, which addresses security requirements for cloud services.

    Organizations unable to apply patches are advised to discontinue use of the affected product until secure configurations can be implemented.

    The 21-day remediation window reflects the serious nature of these actively exploited vulnerabilities and the elevated risk they pose to manufacturing operations and supply chain security.

    Security teams should prioritize patching DELMIA Apriso installations, particularly those accessible from internet-facing networks or connected to critical manufacturing processes.

    Organizations should also review access logs for suspicious activity, implement network segmentation to isolate manufacturing systems, and monitor for unauthorized code execution or privilege escalation attempts.

    Given the active exploitation status, defenders must assume threat actors are scanning for vulnerable instances and act swiftly to close these security gaps before attackers can establish persistent access to industrial control environments.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Warns of Dassault Systèmes Vulnerabilities Actively Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Issues Alert on Active Exploitation of Dassault Systèmes Security Flaws

    ·

    , , , ,

    The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding two severe vulnerabilities discovered in Dassault Systèmes DELMIA Apriso, a widely used manufacturing execution system. The agency has added these flaws to its official list of vulnerabilities that pose immediate risks to organisations and require urgent mitigation action. CVE ID Product […]

    The post CISA Issues Alert on Active Exploitation of Dassault Systèmes Security Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Allegedly Claim Breach Of HSBC USA Customers’ Records Including Financial Details

    ·

    , ,

    A threat actor has claimed responsibility for breaching HSBC USA, alleging possession of a vast database containing sensitive customer personal identifiable information (PII) and financial details.

    The hacker posted screenshots and data samples on a dark web leak forum, asserting the breach involved coordinated efforts to extract records from the bank’s systems.

    This incident, reported on October 28, 2025, has raised alarms in the cybersecurity community amid HSBC’s ongoing challenges in the U.S. market.

    The alleged stolen database contains full names, addresses, Social Security numbers (SSNs), dates of birth, phone numbers, email addresses, transaction histories, stock orders, and bank account numbers.

    HSBC USA Customers Records
    HSBC USA Customers Records

    Researchers analyzed a provided sample and found indications of legitimacy, with the data appearing recent, potentially from just weeks prior, and possibly targeting corporate or institutional clients rather than retail ones.

    HSBC USA has largely exited the U.S. mass retail banking sector, which could explain its focus on business accounts.

    The attached screenshot of the forum post corroborates the claim, showing an “Exclusive HSBC USA DB” with promises of validation and no free distribution.

    HSBC’s Response and Implications

    HSBC has acknowledged a recent denial-of-service (DoS) attack but has firmly denied any customer data compromise in its official statements.

    The bank is investigating claims through third-party vendor access points and has strengthened defenses with enhanced authentication and monitoring.

    No confirmed financial losses have occurred, but experts warn of risks such as identity theft, spear-phishing, and social engineering attacks exploiting the exposed details.

    Regulatory bodies, including the U.S. Department of the Treasury, are monitoring the situation closely. This breach highlights vulnerabilities in financial third-party ecosystems, potentially damaging HSBC’s reputation and prompting client attrition.

    Customers are urged to monitor accounts, enable two-factor authentication, and change passwords immediately to mitigate potential fallout.

    As investigations continue, the full scope remains unclear, but the event underscores the persistent threats facing global banks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Allegedly Claim Breach Of HSBC USA Customers’ Records Including Financial Details appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 10 NPM Packages That Automatically Run on Install and Steal Credentials

    ·

    , ,

    A sophisticated supply chain attack involving ten malicious npm packages that execute automatically upon installation and deploy a comprehensive credential theft operation. The malware uses advanced obfuscation techniques, social engineering tactics, and cross-platform functionality to harvest sensitive authentication data from developers’ systems across Windows, Linux, and macOS environments. Socket’s Threat Research Team has uncovered a […]

    The post 10 NPM Packages That Automatically Run on Install and Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Wear OS Message App Vulnerability Let Any Installed App To Send SMS Behalf Of User

    ·

    , , ,

    A vulnerability in Google Messages on Wear OS devices allows any installed app to silently send SMS, MMS, or RCS messages on behalf of the user.

    Dubbed CVE-2025-12080, the issue stems from improper handling of ACTION_SENDTO intents using URI schemes like sms:, smsto:, mms:, and mmsto:.

    This misconfiguration bypasses user confirmation and permission checks, enabling attackers to dispatch messages to arbitrary recipients without detection.

    Google Messages, the default messaging app on most Wear OS smartwatches, exacerbates the risk. With limited alternatives available, the flaw likely affects the majority of devices running the platform.

    Disclosed earlier this year, the vulnerability highlights ongoing challenges in securing wearable ecosystems, where compact interfaces and implicit trust in system apps can amplify threats.

    Security firm io-no reported the issue through Google’s Mobile Vulnerability Reward Program, earning a $2,250 bounty before a fix rolled out in May 2025.

    Wear OS Message App Vulnerability

    At its core, the problem lies in Android’s intent system, a fundamental mechanism for app-to-app communication. Intents allow components to request actions, such as opening a dialer or sending a message, by specifying an action and a data URI.

    Explicit intents target a specific app component, while implicit ones let the system route to matching intent filters declared by apps. In theory, sensitive operations like sending messages should trigger a confirmation prompt in the receiving app to ensure user consent.

    This prevents the “confused deputy” pattern, where a privileged app unwittingly executes actions for an untrusted caller. On standard Android, Google Messages adheres to this by prompting before dispatch.

    However, on Wear OS, the app’s intent filters for messaging schemes fail to enforce verification. As a result, any app can fire an ACTION_SENDTO intent without needing SEND_SMS permissions, and Google Messages will process it automatically.

    The vulnerability doesn’t require malicious code in the exploiting app; a simple, legitimate-looking application suffices. For instance, a benign fitness tracker or wallpaper app could embed the intent trigger, activating on launch or button press.

    Researchers note that Wear OS features like Tiles or complications, which also launch intents, could extend the attack surface, though these vectors remain unexplored.

    The implications are severe for privacy and finances. An attacker could distribute a trojanized app via sideloading or third-party stores, then exfiltrate data through premium-rate SMS or harass contacts impersonating the victim.

    Exploitation is stealthy: no pop-ups, no permission requests, and no visible traces beyond the sent message log.

    A proof-of-concept, available on GitHub at io-no/CVE-Reports, demonstrates the flaw using Kotlin code to invoke the intent with a sample message body and recipient URI.

    Tested on a Pixel Watch 3 with Wear OS (Android 15, build BP1A.250305.019.w3) and Google Messages version 2025_0225_RC03, the PoC sends messages without interaction, though it omits real numbers for ethical reasons.

    Google acknowledged the report on March 13, 2025, praised the discovery, and deployed patches by May. Users should update their devices promptly and scrutinize app installations.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Google Wear OS Message App Vulnerability Let Any Installed App To Send SMS Behalf Of User appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶