-
A team of academics has devised a novel attack that can be used to downgrade a 5G connection to a lower generation without relying on a rogue base station (gNB). The attack, per the ASSET (Automated Systems SEcuriTy) Research Group at the Singapore University of Technology and Design (SUTD), relies on a new open-source software toolkit named Sni5Gect (short for “Sniffing 5G Inject”) that’s
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new ransomware has been identified, which is believed to be the first-ever ransomware strain that leverages a local AI model to generate its malicious components.
Dubbed “PromptLock” by the ESET Research team that discovered it, the malware uses OpenAI’s
gpt-oss:20bmodel via the Ollama API to create custom, cross-platform Lua scripts for its attack chain.While the malware appears to be a proof-of-concept (PoC) and not yet deployed in active campaigns, its novel architecture represents a significant and worrying evolution in malware design, demonstrating how threat actors are beginning to integrate local large language models (LLMs) to create more dynamic and evasive threats.
On-the-Fly Code Generation
PromptLock is written in Golang and has been identified in both Windows and Linux variants on the VirusTotal repository.
Its core functionality deviates from traditional ransomware, which typically contains pre-compiled malicious logic. Instead, PromptLock carries hard-coded prompts that it feeds to a locally running
gpt-oss:20bmodel.Analysis of the malware’s network traffic reveals
POSTrequests to a local Ollama API endpoint (172.42.0[.]253:8443). These requests contain prompts instructing the AI model to act as a “Lua code generator.”
An example of Lua code generation request for malware PromptLock The prompts task the model with creating scripts for specific malicious activities, including:
- System Enumeration: Generating Lua code to gather system parameters like OS type, username, hostname, and current working directory. The prompts specifically demand cross-platform compatibility for Windows, Linux, and macOS.
- File System Inspection: Creating scripts to scan the local filesystem, identify target files, and analyze their contents, with instructions to look for PII or sensitive information.
- Data Exfiltration & Encryption: Once target files are identified, the AI-generated scripts are executed to handle data exfiltration and subsequent encryption.
The use of Lua is a strategic choice, as its lightweight and embeddable nature allows the generated scripts to run seamlessly across multiple operating systems, maximizing the malware’s potential target base.
For its encryption payload, PromptLock utilizes the SPECK 128-bit block cipher, a lightweight algorithm suitable for this flexible attack model.
ESET researchers emphasize that multiple indicators suggest PromptLock is still in a developmental stage. For instance, a function intended for data destruction appears to be defined but not yet implemented.
Further intrigue is added by an unusual artifact found within one of the prompts: a Bitcoin address that seemingly belongs to Satoshi Nakamoto, the pseudonymous creator of Bitcoin. While this is likely a placeholder or a misdirection, it adds a peculiar signature to this early-stage malware.
Despite its PoC status, ESET made the decision to disclose its findings publicly. “We believe it is our responsibility to inform the cybersecurity community about such developments,” the researchers stated, highlighting the need for proactive defense against this emerging threat vector.
As local LLMs become more powerful and accessible, security teams must prepare for a future where malware is no longer static but generated dynamically on victim machines.
Indicators of Compromise (IoCs)
Malware Family: Filecoder.PromptLock.A
SHA1 Hashes:
24BF7B72F54AA5B93C6681B4F69E579A47D7C102AD223FE2BB4563446AEE5227357BBFDC8ADA3797BB8FB75285BCD151132A3287F2786D4D91DA58B8F3F4C40C344695388E10CBF29DDB18EF3B61F7EF639DBC9B365096D6347142FCAE64725BD9F73270161CDCDB46FB8A348AEC609A86FF5823752065D2
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
The post First AI Ransomware ‘PromptLock’ Uses OpenAI gpt-oss-20b Model for Encryption appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated credential harvesting campaign has emerged targeting ScreenConnect cloud administrators with spear phishing attacks designed to steal super administrator credentials.
The ongoing operation, designated MCTO3030, has maintained consistent tactics since 2022 while operating largely undetected through low-volume distribution strategies that send up to 1,000 emails per campaign run.
The campaign specifically targets senior IT professionals including directors, managers, and security personnel who possess elevated privileges in ScreenConnect environments.
.webp)
Login alert (Source – Mimecast) Attackers leverage Amazon Simple Email Service accounts to deliver convincing phishing emails that claim suspicious login activity from unusual IP addresses or geographic locations, creating urgency to prompt immediate action from victims.
Mimecast analysts identified this persistent threat as particularly concerning due to its apparent connection to ransomware operations, with research indicating similar targeting patterns by Qilin ransomware affiliates.
The harvested super admin credentials serve as initial access vectors for subsequent ransomware deployment, enabling attackers to push malicious ScreenConnect clients to multiple endpoints simultaneously.
The campaign employs country code top-level domains with ScreenConnect-themed naming conventions, including domains like connectwise.com.ar, connectwise.com.be, and connectwise.com.cm to create convincing impersonations of legitimate ConnectWise portals.
.webp)
Phishing pages (Source – Mimecast) Once victims click the “Review Security” button in phishing emails, they are redirected to sophisticated fake login pages that closely mimic authentic ScreenConnect interfaces.
Advanced Adversary-in-the-Middle Techniques
The technical sophistication of this campaign centers on its implementation of adversary-in-the-middle phishing using the EvilGinx framework, an open-source tool specifically designed for intercepting both credentials and multi-factor authentication codes in real-time.
This capability allows attackers to bypass modern authentication protections that many organizations rely upon for security.
The EvilGinx framework operates by positioning itself between the victim and the legitimate authentication service, capturing login credentials while simultaneously forwarding authentication requests to the real ScreenConnect portal.
This technique enables the harvesting of time-sensitive MFA tokens, allowing attackers to maintain persistent access to compromised accounts even when multi-factor authentication is enabled.
The consistent use of Amazon SES infrastructure provides high deliverability rates while bypassing traditional email security controls through trusted cloud services, demonstrating the campaign’s operational sophistication and long-term strategic planning.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.The post New Attack Targeting ScreenConnect Cloud Administrators to Steal Login Credentials appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Zimperium’s zLabs research team has identified a sophisticated new variant of the Hook Android banking trojan, marking a significant escalation in mobile threat sophistication. This iteration incorporates ransomware-style overlays that display extortion messages, demanding payments via dynamically fetched wallet addresses from the command-and-control (C2) server. Activated by the “ransome” command, these full-screen overlays embed HTML […]
The post New Hook Android Banking Malware Emerges with Advanced Features and 107 Remote Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Navy is waiting for Pentagon leaders to pick a company to build the service’s sixth-generation F/A-XX fighter jet, now that Congress moved to restore funding, according to the service’s air boss.
“It's going to be a very exciting aircraft. I'm looking forward to the downselect. I'll leave it to the professional acquisition folks…but I'm looking forward to that because that sixth-generation means air superiority in that timeframe in the future, which means sea control. And as long as you have air superiority, you have sea control around the globe,” Vice Adm. Daniel Cheever, commander of Naval Air Forces, said today during a CSIS event.
In March, the Navy was reportedly close to picking a company to build F/A-XX, but an announcement never came, and the service ended up gutting funding for the aircraft in its 2026 budget request, throwing the program into limbo.
But Congress is on track to reverse those cuts: Senate appropriators added $1.4 billion to F/A-XX in their draft defense spending bill and House appropriators added $972 million to their version. Cheever’s comments today appear to confirm that F/A-XX is in fact moving ahead.
Northrop Grumman and Boeing are in the running to build the sixth-gen fighter; Lockheed dropped out in March. Boeing was selected earlier this year to build the Air Force's sixth-gen F-47 fighter, and Pentagon leaders have expressed concern that U.S. defense companies can’t handle building two sixth-gen jets at once—a claim industry executives have refuted.
F/A-XX will operate from aircraft carriers and replace both the F/A-18 Super Hornet and EA-18 Growler. Service officials have previously indicated that they want the jet to have 25% more range than today’s jets.
Fielding a sixth-gen platform with collaborative combat aircraft alongside it will "ensure" that the Navy maintains control in the future, Cheever said.
“I'm sure that fourth, fifth, sixth generation is that mix, and then unmanned teaming is the thing that gets us there,” he said.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Google has announced that all Android apps installed on approved devices will soon need to be able to be traced back to a verified developer identity in an effort to combat the growing wave of financial fraud operations and mobile viruses. The policy, scheduled to roll out in select high-risk regions in 2025 before global […]
The post Google Introduces Enhanced Developer Verification for Play Store App Distribution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cloud Software Group has disclosed multiple high-severity vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that can lead to remote code execution (RCE) and denial of service (DoS).
Exploitation of CVE-2025-7775 has been observed in the wild against unmitigated appliances, and customers are urged to upgrade immediately.
Affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-47.48 and 13.1 before 13.1-59.22, plus NetScaler ADC 13.1-FIPS/NDcPP before 13.1-37.241 and 12.1-FIPS/NDcPP before 12.1-55.330.
Secure Private Access on-prem and SPA Hybrid deployments that use NetScaler instances are also affected and require the same NetScaler upgrades. Note that NetScaler ADC/Gateway 12.1 and 13.0 mainstream branches are End of Life and no longer supported; customers should move to supported builds that remediate these flaws.
CVE-2025-7775 Under Active Attack
Three CVEs were published with CVSS v4.0 base scores between 8.7 and 9.2. CVE-2025-7775 (CVSS 9.2) is a memory overflow that can enable RCE and/or DoS.
It is triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, or when load balancing virtual servers of type HTTP/SSL/HTTP_QUIC are bound to IPv6 services/service groups (including DNS-based service resolution to IPv6), or when a content routing (CR) virtual server is configured with type HDX.
CVE-2025-7776 (CVSS 8.8) is another memory overflow that can cause unpredictable behavior and DoS when a Gateway (VPN vserver) has a PCoIP profile bound.
CVE-2025-8424 (CVSS 8.7) is an improper access control issue on the management interface; exploitation requires access to NSIP, Cluster Management IP, local GSLB Site IP, or a SNIP with management access, and is scored with an adjacent network attack vector.
There are no workarounds. Cloud Software Group strongly advises upgrading to fixed releases: NetScaler ADC and Gateway 14.1-47.48 or later; 13.1-59.22 or later; NetScaler ADC 13.1-FIPS/13.1-NDcPP 13.1-37.241 or later; and 12.1-FIPS/12.1-NDcPP 12.1-55.330 or later.
SPA customers should upgrade all NetScaler instances underpinning on-prem or hybrid deployments. Where possible, also restrict management plane exposure to dedicated admin networks and ensure access controls on NSIP/CLIP/SNIP/GSLB IPs are tightly enforced.
Customers can quickly determine exposure by reviewing ns.conf and running configuration for telltale entries:
- For CVE-2025-7775: presence of AAA or Gateway vservers (e.g., “add authentication vserver …”, “add vpn vserver …”); LB vservers of type HTTP/SSL/HTTP_QUIC bound to IPv6 services or IPv6 servers (including DNS AAAA resolution); CR vservers of type HDX.
- For CVE-2025-7776: Gateway (VPN vserver) with a PCoIP profile bound (e.g., “-pcoipVserverProfileName …”).
Given active exploitation of CVE-2025-7775, organizations should prioritize patching internet-exposed Gateways and any appliances with IPv6-enabled LB vservers. Monitor for crashes, unexpected restarts, and anomalous management-plane access, and review logs for suspicious activity around affected virtual servers.
Cloud Software Group credited Jimi Sebree (Horizon3.ai), Jonathan Hetzer (Schramm & Partner), and François Hämmerli for responsible disclosure.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
The post Citrix NetScaler ADC and Gateway 0-Day RCE Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
President Trump just vastly expanded the role of the military in U.S. law enforcement across the country. On Monday, he signed an executive order creating a “quick reaction force” of National Guard troops tasked with “quelling civil disturbances” and “ensuring the public safety and order.”The order calls upon Defense Secretary Pete Hegseth to ensure troops in the National Guard of every state “are resourced, trained, organized, and available to assist Federal, State, and local law enforcement in quelling civil disturbances and ensuring the public safety” and directs the secretary to establish “a standing National Guard quick reaction force” for “nationwide deployment.” Hegseth will also work with adjutant generals to decide a number of each state’s Guard “to be reasonably available for rapid mobilization for such purposes,” the order says.
Notable: State National Guard units are generally controlled by the state’s governor, except in emergencies, Jacob Fischler writes for States Newsroom.
Also: “It is unusual…for National Guard troops to just live on standby waiting for the president to decide he wants to target crime in a city of his choosing,” the New York Times reports. “Guard troops train part time, often one weekend a month and two weeks a year, to respond to emergencies. They do not sit around waiting for the president to deploy them as a law enforcement arm.”
After threatening to send troops to Chicago on Friday, Trump took several swipes at Illinois Democratic Gov. J.B. Pritzker on Monday, calling him a “slob” and describing the city of Chicago as a “disaster” and a “killing field.”
“A lot of people are saying maybe we like a dictator,” Trump said Monday. “I don't like a dictator. I'm not a dictator. I'm a man with great common sense and a smart person. And when I see what's happening to our cities, and then you send in troops instead of being praised, they're saying you're trying to take over the Republic. These people are sick.”
“Donald Trump has been planning for quite a while now to deploy armed military personnel to the streets of Chicago,” Gov. Pritzker told reporters at a press conference Monday in Chicago, alluding to weekend reporting from the Washington Post on Pentagon plans that have been weeks in the making. “This is exactly the type of overreach that our country's founders warned against. And it’s the reason that they established a federal system with a separation of powers built on checks and balances. What President Trump is doing is unprecedented and unwarranted. It is illegal, it is unconstitutional. It is un-American.”
“This is not about fighting crime,” Pritzker said. “This is about Donald Trump searching for any justification to deploy the military in a blue city in a blue state to try and intimidate his political rivals,” he said. “This is about the president of the United States and his complicit lackey Stephen Miller searching for ways to lay the groundwork to circumvent our democracy, militarize our cities, and end elections. There is no emergency in Chicago that calls for armed military intervention. There is no insurrection.”
Pritzker also noted the rate of violent crime is higher in Republican-dominated states than in those run by Democrats. “Thirteen of the top twenty cities in homicide rates have Republican governors,” he said. “None of these cities is Chicago. Eight of the top ten states with the highest homicide rates are led by Republicans. None of those states is Illinois.”
Regarding National Guard troops, Pritzker said: “It is insulting to their integrity and to the extraordinary sacrifices that they make to serve in the guard, to use them as a political prop, where they could be put in situations where they will be at odds with their local communities, the ones that they seek to serve.” He also warned troops against protesting such deployments, noting “they can be court martialed, and their lives ruined, if they resist deployment.”
“The state of Illinois is ready to stand against this military deployment with every peaceful tool we have,” the Illinois governor said. “We will see the Trump administration in court. We will use every lever in our disposal to protect the people of Illinois and their rights.”
Legal-expert reax: “Trump is trying to normalize the militarization of our country. This is where it starts, not where it will end,” said Joyce Vance, former U.S. Attorney for the Northern District of Alabama. “Trump is dropping the pretense of abiding by the rule of law,” she warned. “A national emergency here, an invasion there. No matter what the truth is, he makes it up as he goes along, shamelessly lying about crime going up, when it’s in fact going down, and accusing agencies that release the statistics that contradict him of fraud when he’s called on the lies.”
“This isn’t just about Trump’s ‘crime emergency in the District of Columbia.’ It’s about the entire country,” Vance said Monday. “Force and intimidation are not strategies we associate with American presidents. Those are not constitutional prerogatives the Founding Fathers assigned to the president. That is how dictators operate. That is how Trump operates.”
Developing: Trump to nationalize defense firms? After shaking down Intel for a 10% equity stake in the company on Friday, Trump’s commerce secretary said there’s a “monstrous discussion” in the administration about partially nationalizing U.S. defense firms like Lockheed Martin. “Lockheed Martin makes 97% of their revenue from the U.S. government,” Howard Lutnick told CNBC on Tuesday. “They are basically an arm of the U.S. government,” he said. “But I tell you what, there’s a lot of talking that needs to be had about ‘how do we finance our munitions acquisitions?’” And those discussions are ongoing, he said.
“Trump accused Kamala Harris of being a socialist, but the Biden Administration never nationalized companies,” the Wall Street Journal’s editorial board warned Monday. “Why aren’t Republicans pushing back on Mr. Trump’s Intel deal?” they asked. “Not long ago it would have been hard to imagine a Republican President demanding government ownership in a private company, but here we are.”
Second opinion: “Hard to convince younger generations, but for decades, Republicans went on and on about how two of the worst things imaginable were (1) state intervention in the market and (2) DC using federal troops against US states; both so bad the people should be ready for armed rebellion in case it happens,” said University of Illinois international relations professor Nicholas Grossman.
But are chips different? Ben Thompson, a tech-industry analyst based in Taiwan, writes in his Stratechery column that “chips generally, and foundries specifically, really are a unique case.” With the world’s most advanced chips made by TSMC on an island less than 100 miles off the Chinese coast, Thompson argues, U.S. national security demands extraordinary measures to onshore chipmaking. Read that, here.
Ominous signs: “Something is materially different in our country this week than last,” writes historian and author Garrett Graff. “The president’s military occupation of the capital has escalated in recent days into something not seen since British troops marched the streets of colonial Boston—even though precisely nothing has happened to warrant it.”
“Saying that our country has tipped over an invisible edge into an authoritarian state plainly is important—and easier than most in the media and pundit class will pretend it is,” he warns. “American fascism looks like the president using armed military units from governors loyal to his regime to seize cities run by opposition political figures and it looks like the president using federal law enforcement to target regime opponents,” Graff says, and emphasizes, “American fascism looks like the would-be self-proclaimed king deploying the military on US soil not only not in response to requests by local or state officials but over—and almost specifically to spite—their vociferous objections.”
“Armed soldiers patrol the streets of the nation’s capital, with more cities apparently to come,” media watchdog Dan Froomkin wrote Monday in a piece he titled, “We have become an authoritarian state, and our top newsrooms are in denial.” He elaborated: “Immigrants who have done nobody any harm are abducted and disappeared by masked agents. The state is seizing stakes of national companies. Election integrity is under attack. Political opponents are targeted with criminal probes. Federal judges’ orders are ignored. Educational institutions are extorted into obedience. Key functions of the government are politicized and degraded. Expertise and science are devalued.”
“Every outrage is just one more thing Trump has done, rather than the ever-mounting evidence of a corrupt dictatorship,” Froomkin warns. “And our dominant media institutions won’t call him out. Rather, they obscure reality under a haze of incremental stories, each one presented as if what is going on is fairly normal. As if it’s just politics…The coverage is a play-by-play as the burners click upward, rather than a check to see if the frog is still alive, which it is not.”
Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1920, the 19th amendment to the U.S. Constitution was certified, giving women the right to vote.
Around the Defense Department
New: The Pentagon’s DIU director Doug Beck has resigned, Reuters reported Monday. According to the wire service, three sources said “officials at the Department of Defense had previously raised concerns about political donations made by Beck to Democrats.” Beck had been in the Defense Innovation Unit position since 2023.
Background: “The DIU was launched in 2015 to speed up the U.S. military's adoption of technology coming out of Silicon Valley. The unit, which last year received close to $1 billion from the National Defense Authorization Act, primarily grants contracts to smaller startup companies with less-proven track records with the goal of transitioning them to larger contracts across the Pentagon.” More, here.
New CNO vows new “engine of naval dominance.” It’s “the foundry”: the Navy’s shipyards, training centers, shore facilities, weapons production lines, and logistics networks, Adm. Daryl Caudle said as he assumed command of the service at a Washington Navy Yard ceremony on Monday morning. “For too long, we’ve treated this interconnected network of force generation as background noise. No longer…From reducing maintenance delays to ensuring spare parts and ordnance flow on time, the foundry will become the engine of naval dominance.” Defense One’s Lauren C. Williams has more, here.
The 34th CNO fills a job left vacant for six months by Hegseth, who fired Adm. Lisa Franchetti without explanation in February.
Navy to consolidate several acquisition offices into a Rapid Capabilities Office. “The NRCO will serve as the single accountable organization spanning all naval warfare domains, responsible for the rapid assessment, execution, fielding and transition of urgent solutions within a three-year timeframe to ensure U.S. maritime supremacy,” SecNav John Phelan ordered in an Aug. 19 memo obtained by Breaking Defense. Read on, here.
Speaking of acquisition shakeups: RIP, JCIDS. Pete Newell, former leader of the Army’s Rapid Equipping Force, applauds Hegseth’s Aug. 20 memo in which he orders the Pentagon to “commence the disestablishment of JCIDS and direct the Joint Requirements Oversight Council (JROC) to cease validating Component level requirement documents to the maximum extent permitted by law.”
JCIDS 101: The Joint Capabilities Integration and Development System, for those who don’t speak Pentagon, was established in 2003 and most recently updated four years ago to centralize the development of requirements and metrics for the military’s acquisition efforts.
Good riddance, Newell says: “We can continue a process that produces beautifully documented requirements for technology that is often out-of-date before it even reaches the hands of a soldier, or we can embrace a new methodology. The fundamental shift must be this: stop obsessing over requirements and start solving problems.” Read his thoughts at Defense One, here.
Developing: Trump wants a “War Department” instead of a Defense Department, and he said Monday he wants to officially change the name “over the next week or so,” he told reporters Monday at the White House during a meeting with South Korean President Lee Jae Myung.
“We're just going to do it,” Trump said when asked if he has considered lawmakers’ opinions on the matter. “I'm sure Congress will go along if we need that. I don't think we even need that,” he said. CBS News has a bit more on the history of the U.S. military’s name changes, which have been established by Congress.
Russia’s Ukraine invasion, cont.
The Pentagon has blocked Ukraine from attacking Russia with U.S.-provided long-range missiles, the Wall Street Journal reported Saturday. That includes all ATACMS, or Army Tactical Missile Systems, in a ban that’s been in place since the spring, U.S. officials said. As with many of the Trump administration’s decisions regarding Ukraine, the Pentagon’s #2 civilian Elbridge Colby is said to be behind the ban, which officials called a “review mechanism.”
“The review gives Defense Secretary Pete Hegseth final say over whether Ukraine can employ the [ATACMS], which have a range of nearly 190 miles, to strike Russia,” the Journal writes.
Ukraine has stepped up attacks on Russian oil refineries, knocking an estimated 13% of Russia’s fuel production offline, the Journal reported separately on Monday. “As a result, several regions, including Russian-occupied Crimea and parts of Siberia, have implemented rationing at gas stations,” Yaroslav Trofimov and Georgi Kantchev write.
“These strikes don’t have a direct impact on the military activity, but they do impact the Russian economy,” former Ukrainian foreign minister Pavlo Klimkin said. “And the Russian economy already has problems, so even a small push can create bottlenecks and multiply problems inside that system.”
Latest: “Ukrainian drones on Sunday set ablaze the strategic Ust-Luga facility on the Baltic Sea, a few days after the Druzhba pipeline that supplies Russian crude oil to Belarus, Hungary and Slovakia was disabled. More than a dozen Russian refineries have been hit over the past month, some several hundred miles from the border, as Ukrainian drones became more potent and more numerous.” More, here.
Commentary: What Western security guarantees for Ukraine might look like. After President Trump’s high-level meeting at the White House last week with President Zelenskyy and several European leaders, attention has turned to what security guarantees for Ukraine might look like if a peace deal is reached, Luke Coffey of the Hudson Institute writes for Defense One.
The most effective way to guarantee Ukraine’s long-term security is NATO membership, he writes. “But in the short term, President Trump has repeatedly stated that he does not support this idea, nor will he agree to U.S. troops on Ukrainian soil. With this political reality in mind, policymakers should consider a layered approach to guaranteeing Ukraine’s security,” Coffey advises. “No single measure is sufficient, but together they would provide the most robust protection currently possible.”
Step 1: Establish a civilian monitoring mission that can patrol both sides of a line of occupation, should a peace agreement leave Russian troops on Ukrainian soil.
Step 2: Formalize an ensemble of European governments willing to send troops to Ukraine to serve as a deterrent and as a visible demonstration of their commitment to its sovereignty. Several countries, including the UK, France, Canada, and Türkiye, have suggested they could contribute forces.
And “The third layer involves America,” Coffey writes. Exactly how? Read on, here.
Here’s Trump on security guarantees: “We haven’t even discussed the specifics,” he told reporters Monday. The president was asked, “You rule out boots on the ground in Ukraine, but how would air support as part of a security guarantee be any different?” He replied, “Well, you don't know what security guarantee is because we haven't even discussed the specifics of it, and we'll see. Number one, Europe is going to give them significant security guarantees and they should because they're right there, but we'll be involved. From the standpoint of backup, we're going to help them. And I think if we get a deal and I think we will, but if we get a deal, you're not going to—I don't believe you're going to have much of a problem.”
Additional reading:
- “Ukraine Will Receive First Of Thousands Of New U.S. Made Standoff Missiles In The Coming Weeks,” the War Zone reported Monday;
- “US and Russian officials discussed energy deals alongside latest Ukraine peace talks,” Reuters reported Tuesday from London;
- And “A Peace Deal for Ukraine Could Test German Reluctance to Deploy Troops,” the New York Times reported Tuesday from Berlin.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
CYFIRMA researchers have uncovered a campaign they have codenamed “OneFlip”, an operation that demonstrates how a single-bit modification inside a seemingly benign file can be enough to re-pivot a neural-network-driven security workflow and open a backdoor on the underlying host. Transparent Tribe (APT36) is leveraging the trick against India’s Government networks that rely on the […]
The post OneFlip Attack Backdoors AI Systems by Flipping a Single Bit in Neural Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Online PDF editors have become common tools for quick document manipulation, providing convenient alternatives to desktop software. However, their cloud-based nature brings significant security vulnerabilities that both organizations and individuals must carefully consider.
Recent cybersecurity research reveals that these platforms present multiple attack vectors, including data interception, malware injection, and compliance violations that can expose sensitive information to unauthorized parties.

PDF Editor Security Workflow. How Online PDF Editors Work
Online PDF editors operate through web-based architectures that fundamentally differ from traditional desktop applications. When users upload documents, the files traverse multiple network layers before reaching cloud-based processing servers.
The typical workflow involves client-side JavaScript handling initial file validation, HTTPS transmission to backend servers, server-side PDF parsing and manipulation, temporary storage in cloud infrastructure, and finally, processed document delivery back to the client.
The technical architecture relies heavily on server-side PDF libraries such as PDFtk, Ghostscript, or proprietary parsing engines that decompose PDF structures into manipulable components.
These systems extract text, images, and metadata while maintaining document formatting integrity. However, this process requires complete document access on remote servers, creating inherent security exposure points.
Modern online PDF editors implement REST API architectures where frontend interfaces communicate with backend microservices through standardized endpoints.
File uploads typically utilize multipart/form-data encoding, with documents temporarily stored in cloud storage systems like Amazon S3 or Google Cloud Storage. Processing occurs in containerized environments, though isolation effectiveness varies significantly between providers.
Man-in-the-Middle Attacks and Data Interception
Man-in-the-Middle (MitM) attacks represent critical threats to online PDF editor security, particularly when users connect through unsecured networks.
Attackers positioned between clients and PDF editing services can intercept document transmissions, even when HTTPS encryption is implemented.
Certificate pinning bypasses and DNS spoofing techniques enable sophisticated adversaries to establish fraudulent SSL connections that appear legitimate to end users.

Man-in-the-Middle Attack Vector. Real-world attack scenarios include coffee shop Wi-Fi exploitation, where attackers deploy rogue access points mimicking legitimate hotspots.
When users upload sensitive PDFs containing financial records, legal documents, or personal information, attackers can capture complete document contents through packet analysis tools like Wireshark or custom interception frameworks.
The 2023 incident involving a major European financial institution highlighted these vulnerabilities when employees uploading confidential merger documents through public networks had their communications intercepted.
Attackers utilized SSL stripping techniques combined with social engineering to downgrade connections from HTTPS to HTTP, exposing document contents in plaintext.
Technical mitigation requires implementing certificate transparency monitoring, HTTP Strict Transport Security (HSTS) policies, and client-side certificate validation.
However, many online PDF editors lack robust certificate pinning implementations, leaving users vulnerable to sophisticated MitM campaigns targeting document intelligence gathering.
Malware and Phishing Threats
Malware injection through PDF editors represents an evolving attack vector where malicious actors embed harmful code within seemingly benign documents.
PDF files support JavaScript execution, embedded objects, and external resource linking, creating multiple exploitation opportunities. Attackers can upload PDFs containing malicious JavaScript payloads that execute during server-side processing, potentially compromising backend infrastructure.
The CVE-2021-28550 vulnerability in Adobe Acrobat demonstrated how PDF parsing engines can be exploited through crafted documents containing buffer overflow triggers.
Online PDF editors utilizing vulnerable parsing libraries become conduits for remote code execution attacks where malicious documents trigger system-level compromises.
Phishing campaigns increasingly leverage online PDF editors as social engineering platforms. Attackers create legitimate-appearing PDF modification services that harvest user credentials, document contents, and system information.
The 2024 “PDFSpoof” campaign targeted corporate users by mimicking popular PDF editing interfaces, collecting over 15,000 business documents containing intellectual property and financial data.
Malware persistence mechanisms within PDFs include embedded executables, macro-enabled content, and external resource triggers that activate during document viewing or editing.
Server-side PDF processing without proper sandboxing enables malware propagation to cloud infrastructure, potentially affecting multiple users and creating widespread security incidents.
Data Misuse and Breaches
Data misuse by PDF editing platforms occurs through various mechanisms, including indefinite document retention, unauthorized data mining, and third-party sharing arrangements.
Many services retain uploaded documents far beyond stated retention periods, creating persistent privacy violations and increasing breach impact surfaces.
Analysis of major PDF editor privacy policies reveals significant gaps in data handling transparency and user control mechanisms.
The 2023 data breach affecting “ConvertPDF” exposed over 2.4 million user documents stored without encryption on publicly accessible cloud storage buckets.
Exposed materials included tax returns, legal contracts, medical records, and corporate financial statements, demonstrating the severe consequences of inadequate data protection practices.
Metadata extraction and analysis represent another significant privacy concern. PDF documents contain extensive metadata, including author information, creation timestamps, editing history, and embedded comments.
Online editors often extract and retain this metadata for analytics purposes, creating detailed user behavior profiles without explicit consent.
Server-side logging practices frequently capture document content fragments, user IP addresses, and session identifiers that persist in system logs indefinitely.
Combined with inadequate access controls and monitoring, these practices create substantial data exposure risks that violate privacy expectations and regulatory requirements.
Compliance and Legal Implications
Regulatory compliance violations through online PDF editor usage create significant legal and financial risks for organizations. GDPR Article 28 requires data processors to implement appropriate technical and organizational measures, yet many PDF editing services lack adequate data protection impact assessments and controller-processor agreements.
HIPAA compliance presents particular challenges when healthcare organizations utilize online PDF editors for medical document processing.
The Business Associate Agreement (BAA) requirement under HIPAA mandates specific security controls that most general-purpose PDF editors cannot satisfy. Unauthorized PHI transmission to non-compliant services creates potential violations carrying penalties up to $1.5 million per incident.
Regulation Requirements PDF Editor Risks GDPR Data minimization, consent, right to erasure Indefinite data retention, lack of consent HIPAA PHI protection, audit trails, access controls Unsecured PHI transmission and storage SOX Document integrity, retention policies Document tampering, inadequate audit logs PCI DSS Cardholder data protection, secure transmission Credit card data in PDFs, insecure processing CCPA Consumer data rights, deletion requests No deletion mechanisms, data sharing Financial services regulations, including SOX and PCI DSS, impose strict document integrity and audit requirements that online PDF editors often compromise.
The Sarbanes-Oxley Act requires maintaining audit trails for financial document modifications, yet cloud-based editors frequently lack adequate logging and chain-of-custody mechanisms.
Cross-border data transfers through international PDF editing services trigger GDPR Article 44 adequacy requirements, creating complex compliance obligations for EU-based organizations.
Many popular PDF editors operate servers in jurisdictions lacking adequate data protection frameworks, potentially violating transfer restrictions and creating enforcement liability.
Online PDF editors present multifaceted security challenges that require comprehensive risk assessment and mitigation strategies. Organizations must evaluate data sensitivity, regulatory requirements, and technical security controls before adopting cloud-based document editing solutions.
Defense-in-depth approaches, including network security, endpoint protection, and data loss prevention, provide essential safeguards against the documented threat vectors.
The evolving landscape of PDF-based attacks and regulatory enforcement necessitates continuous security monitoring and policy updates.
As cybercriminals increasingly target document processing workflows, the security implications of online PDF editor usage will continue to expand, necessitating proactive defensive measures and informed decision-making regarding cloud document processing adoption.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
The post Online PDF Editors Safe to Use? Detailed Analysis of Security Risks Associated With It appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶


