• Zimperium’s zLabs research team has identified a sophisticated new variant of the Hook Android banking trojan, marking a significant escalation in mobile threat sophistication. This iteration incorporates ransomware-style overlays that display extortion messages, demanding payments via dynamically fetched wallet addresses from the command-and-control (C2) server. Activated by the “ransome” command, these full-screen overlays embed HTML […]

    The post New Hook Android Banking Malware Emerges with Advanced Features and 107 Remote Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Navy is waiting for Pentagon leaders to pick a company to build the service’s sixth-generation F/A-XX fighter jet, now that Congress moved to restore funding, according to the service’s air boss.

    “It's going to be a very exciting aircraft. I'm looking forward to the downselect. I'll leave it to the professional acquisition folks…but I'm looking forward to that because that sixth-generation means air superiority in that timeframe in the future, which means sea control. And as long as you have air superiority, you have sea control around the globe,” Vice Adm. Daniel Cheever, commander of Naval Air Forces, said today during a CSIS event.

    In March, the Navy was reportedly close to picking a company to build F/A-XX, but an announcement never came, and the service ended up gutting funding for the aircraft in its 2026 budget request, throwing the program into limbo. 

    But Congress is on track to reverse those cuts: Senate appropriators added $1.4 billion to F/A-XX in their draft defense spending bill and House appropriators added $972 million to their version. Cheever’s comments today appear to confirm that F/A-XX is in fact moving ahead.

    Northrop Grumman and Boeing are in the running to build the sixth-gen fighter; Lockheed dropped out in March. Boeing was selected earlier this year to build the Air Force's sixth-gen F-47 fighter, and Pentagon leaders have expressed concern that U.S. defense companies can’t handle building two sixth-gen jets at once—a claim industry executives have refuted

    F/A-XX will operate from aircraft carriers and replace both the F/A-18 Super Hornet and EA-18 Growler. Service officials have previously indicated that they want the jet to have 25% more range than today’s jets.  

    Fielding a sixth-gen platform with collaborative combat aircraft alongside it will "ensure" that the Navy maintains control in the future, Cheever said.

    “I'm sure that fourth, fifth, sixth generation is that mix, and then unmanned teaming is the thing that gets us there,” he said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has announced that all Android apps installed on approved devices will soon need to be able to be traced back to a verified developer identity in an effort to combat the growing wave of financial fraud operations and mobile viruses. The policy, scheduled to roll out in select high-risk regions in 2025 before global […]

    The post Google Introduces Enhanced Developer Verification for Play Store App Distribution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cloud Software Group has disclosed multiple high-severity vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that can lead to remote code execution (RCE) and denial of service (DoS).

    Exploitation of CVE-2025-7775 has been observed in the wild against unmitigated appliances, and customers are urged to upgrade immediately.

    Affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-47.48 and 13.1 before 13.1-59.22, plus NetScaler ADC 13.1-FIPS/NDcPP before 13.1-37.241 and 12.1-FIPS/NDcPP before 12.1-55.330.

    Secure Private Access on-prem and SPA Hybrid deployments that use NetScaler instances are also affected and require the same NetScaler upgrades. Note that NetScaler ADC/Gateway 12.1 and 13.0 mainstream branches are End of Life and no longer supported; customers should move to supported builds that remediate these flaws.

    CVE-2025-7775 Under Active Attack

    Three CVEs were published with CVSS v4.0 base scores between 8.7 and 9.2. CVE-2025-7775 (CVSS 9.2) is a memory overflow that can enable RCE and/or DoS.

    It is triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, or when load balancing virtual servers of type HTTP/SSL/HTTP_QUIC are bound to IPv6 services/service groups (including DNS-based service resolution to IPv6), or when a content routing (CR) virtual server is configured with type HDX.

    CVE-2025-7776 (CVSS 8.8) is another memory overflow that can cause unpredictable behavior and DoS when a Gateway (VPN vserver) has a PCoIP profile bound.

    CVE-2025-8424 (CVSS 8.7) is an improper access control issue on the management interface; exploitation requires access to NSIP, Cluster Management IP, local GSLB Site IP, or a SNIP with management access, and is scored with an adjacent network attack vector.

    There are no workarounds. Cloud Software Group strongly advises upgrading to fixed releases: NetScaler ADC and Gateway 14.1-47.48 or later; 13.1-59.22 or later; NetScaler ADC 13.1-FIPS/13.1-NDcPP 13.1-37.241 or later; and 12.1-FIPS/12.1-NDcPP 12.1-55.330 or later.

    SPA customers should upgrade all NetScaler instances underpinning on-prem or hybrid deployments. Where possible, also restrict management plane exposure to dedicated admin networks and ensure access controls on NSIP/CLIP/SNIP/GSLB IPs are tightly enforced.

    Customers can quickly determine exposure by reviewing ns.conf and running configuration for telltale entries:

    • For CVE-2025-7775: presence of AAA or Gateway vservers (e.g., “add authentication vserver …”, “add vpn vserver …”); LB vservers of type HTTP/SSL/HTTP_QUIC bound to IPv6 services or IPv6 servers (including DNS AAAA resolution); CR vservers of type HDX.
    • For CVE-2025-7776: Gateway (VPN vserver) with a PCoIP profile bound (e.g., “-pcoipVserverProfileName …”).

    Given active exploitation of CVE-2025-7775, organizations should prioritize patching internet-exposed Gateways and any appliances with IPv6-enabled LB vservers. Monitor for crashes, unexpected restarts, and anomalous management-plane access, and review logs for suspicious activity around affected virtual servers.

    Cloud Software Group credited Jimi Sebree (Horizon3.ai), Jonathan Hetzer (Schramm & Partner), and François Hämmerli for responsible disclosure.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Citrix NetScaler ADC and Gateway 0-Day RCE Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • President Trump just vastly expanded the role of the military in U.S. law enforcement across the country. On Monday, he signed an executive order creating a “quick reaction force” of National Guard troops tasked with “quelling civil disturbances” and “ensuring the public safety and order.”

    The order calls upon Defense Secretary Pete Hegseth to ensure troops in the National Guard of every state “are resourced, trained, organized, and available to assist Federal, State, and local law enforcement in quelling civil disturbances and ensuring the public safety” and directs the secretary to establish “a standing National Guard quick reaction force” for “nationwide deployment.” Hegseth will also work with adjutant generals to decide a number of each state’s Guard “to be reasonably available for rapid mobilization for such purposes,” the order says.

    Notable: State National Guard units are generally controlled by the state’s governor, except in emergencies, Jacob Fischler writes for States Newsroom

    Also: “It is unusual…for National Guard troops to just live on standby waiting for the president to decide he wants to target crime in a city of his choosing,” the New York Times reports. “Guard troops train part time, often one weekend a month and two weeks a year, to respond to emergencies. They do not sit around waiting for the president to deploy them as a law enforcement arm.”

    After threatening to send troops to Chicago on Friday, Trump took several swipes at Illinois Democratic Gov. J.B. Pritzker on Monday, calling him a “slob” and describing the city of Chicago as a “disaster” and a “killing field.” 

    “A lot of people are saying maybe we like a dictator,” Trump said Monday. “I don't like a dictator. I'm not a dictator. I'm a man with great common sense and a smart person. And when I see what's happening to our cities, and then you send in troops instead of being praised, they're saying you're trying to take over the Republic. These people are sick.” 

    “Donald Trump has been planning for quite a while now to deploy armed military personnel to the streets of Chicago,” Gov. Pritzker told reporters at a press conference Monday in Chicago, alluding to weekend reporting from the Washington Post on Pentagon plans that have been weeks in the making. “This is exactly the type of overreach that our country's founders warned against. And it’s the reason that they established a federal system with a separation of powers built on checks and balances. What President Trump is doing is unprecedented and unwarranted. It is illegal, it is unconstitutional. It is un-American.”

    “This is not about fighting crime,” Pritzker said. “This is about Donald Trump searching for any justification to deploy the military in a blue city in a blue state to try and intimidate his political rivals,” he said. “This is about the president of the United States and his complicit lackey Stephen Miller searching for ways to lay the groundwork to circumvent our democracy, militarize our cities, and end elections. There is no emergency in Chicago that calls for armed military intervention. There is no insurrection.”

    Pritzker also noted the rate of violent crime is higher in Republican-dominated states than in those run by Democrats. “Thirteen of the top twenty cities in homicide rates have Republican governors,” he said. “None of these cities is Chicago. Eight of the top ten states with the highest homicide rates are led by Republicans. None of those states is Illinois.”

    Regarding National Guard troops, Pritzker said: “It is insulting to their integrity and to the extraordinary sacrifices that they make to serve in the guard, to use them as a political prop, where they could be put in situations where they will be at odds with their local communities, the ones that they seek to serve.” He also warned troops against protesting such deployments, noting “they can be court martialed, and their lives ruined, if they resist deployment.”

    “The state of Illinois is ready to stand against this military deployment with every peaceful tool we have,” the Illinois governor said. “We will see the Trump administration in court. We will use every lever in our disposal to protect the people of Illinois and their rights.”

    Legal-expert reax: “Trump is trying to normalize the militarization of our country. This is where it starts, not where it will end,” said Joyce Vance, former U.S. Attorney for the Northern District of Alabama. “Trump is dropping the pretense of abiding by the rule of law,” she warned. “A national emergency here, an invasion there. No matter what the truth is, he makes it up as he goes along, shamelessly lying about crime going up, when it’s in fact going down, and accusing agencies that release the statistics that contradict him of fraud when he’s called on the lies.” 

    “This isn’t just about Trump’s ‘crime emergency in the District of Columbia.’ It’s about the entire country,” Vance said Monday. “Force and intimidation are not strategies we associate with American presidents. Those are not constitutional prerogatives the Founding Fathers assigned to the president. That is how dictators operate. That is how Trump operates.”

    Developing: Trump to nationalize defense firms? After shaking down Intel for a 10% equity stake in the company on Friday, Trump’s commerce secretary said there’s a “monstrous discussion” in the administration about partially nationalizing U.S. defense firms like Lockheed Martin. “Lockheed Martin makes 97% of their revenue from the U.S. government,” Howard Lutnick told CNBC on Tuesday. “They are basically an arm of the U.S. government,” he said. “But I tell you what, there’s a lot of talking that needs to be had about ‘how do we finance our munitions acquisitions?’” And those discussions are ongoing, he said. 

    “Trump accused Kamala Harris of being a socialist, but the Biden Administration never nationalized companies,” the Wall Street Journal’s editorial board warned Monday. “Why aren’t Republicans pushing back on Mr. Trump’s Intel deal?” they asked. “Not long ago it would have been hard to imagine a Republican President demanding government ownership in a private company, but here we are.”

    Second opinion: “Hard to convince younger generations, but for decades, Republicans went on and on about how two of the worst things imaginable were (1) state intervention in the market and (2) DC using federal troops against US states; both so bad the people should be ready for armed rebellion in case it happens,” said University of Illinois international relations professor Nicholas Grossman. 

    But are chips different? Ben Thompson, a tech-industry analyst based in Taiwan, writes in his Stratechery column that “chips generally, and foundries specifically, really are a unique case.” With the world’s most advanced chips made by TSMC on an island less than 100 miles off the Chinese coast, Thompson argues, U.S. national security demands extraordinary measures to onshore chipmaking. Read that, here.

    Ominous signs: “Something is materially different in our country this week than last,” writes historian and author Garrett Graff. “The president’s military occupation of the capital has escalated in recent days into something not seen since British troops marched the streets of colonial Boston—even though precisely nothing has happened to warrant it.” 

    “Saying that our country has tipped over an invisible edge into an authoritarian state plainly is important—and easier than most in the media and pundit class will pretend it is,” he warns. “American fascism looks like the president using armed military units from governors loyal to his regime to seize cities run by opposition political figures and it looks like the president using federal law enforcement to target regime opponents,” Graff says, and emphasizes, “American fascism looks like the would-be self-proclaimed king deploying the military on US soil not only not in response to requests by local or state officials but over—and almost specifically to spite—their vociferous objections.”

    “Armed soldiers patrol the streets of the nation’s capital, with more cities apparently to come,” media watchdog Dan Froomkin wrote Monday in a piece he titled, “We have become an authoritarian state, and our top newsrooms are in denial.” He elaborated: “Immigrants who have done nobody any harm are abducted and disappeared by masked agents. The state is seizing stakes of national companies. Election integrity is under attack. Political opponents are targeted with criminal probes. Federal judges’ orders are ignored. Educational institutions are extorted into obedience. Key functions of the government are politicized and degraded. Expertise and science are devalued.”

    “Every outrage is just one more thing Trump has done, rather than the ever-mounting evidence of a corrupt dictatorship,” Froomkin warns. “And our dominant media institutions won’t call him out. Rather, they obscure reality under a haze of incremental stories, each one presented as if what is going on is fairly normal. As if it’s just politics…The coverage is a play-by-play as the burners click upward, rather than a check to see if the frog is still alive, which it is not.” 


    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1920, the 19th amendment to the U.S. Constitution was certified, giving women the right to vote.

    Around the Defense Department

    New: The Pentagon’s DIU director Doug Beck has resigned, Reuters reported Monday. According to the wire service, three sources said “officials at the Department of Defense had previously raised concerns about political donations made by Beck to Democrats.” Beck had been in the Defense Innovation Unit position since 2023. 

    Background: “The DIU was launched in 2015 to speed up the U.S. military's adoption of technology coming out of Silicon Valley. The unit, which last year received close to $1 billion from the National Defense Authorization Act, primarily grants contracts to smaller startup companies with less-proven track records with the goal of transitioning them to larger contracts across the Pentagon.” More, here

    New CNO vows new “engine of naval dominance.” It’s “the foundry”: the Navy’s shipyards, training centers, shore facilities, weapons production lines, and logistics networks, Adm. Daryl Caudle said as he assumed command of the service at a Washington Navy Yard ceremony on Monday morning. “For too long, we’ve treated this interconnected network of force generation as background noise. No longer…From reducing maintenance delays to ensuring spare parts and ordnance flow on time, the foundry will become the engine of naval dominance.” Defense One’s Lauren C. Williams has more, here.

    The 34th CNO fills a job left vacant for six months by Hegseth, who fired Adm. Lisa Franchetti without explanation in February. 

    Navy to consolidate several acquisition offices into a Rapid Capabilities Office. “The NRCO will serve as the single accountable organization spanning all naval warfare domains, responsible for the rapid assessment, execution, fielding and transition of urgent solutions within a three-year timeframe to ensure U.S. maritime supremacy,” SecNav John Phelan ordered in an Aug. 19 memo obtained by Breaking Defense. Read on, here.

    Speaking of acquisition shakeups: RIP, JCIDS. Pete Newell, former leader of the Army’s Rapid Equipping Force, applauds Hegseth’s Aug. 20 memo in which he orders the Pentagon to “commence the disestablishment of JCIDS and direct the Joint Requirements Oversight Council (JROC) to cease validating Component level requirement documents to the maximum extent permitted by law.”

    JCIDS 101: The Joint Capabilities Integration and Development System, for those who don’t speak Pentagon, was established in 2003 and most recently updated four years ago to centralize the development of requirements and metrics for the military’s acquisition efforts.

    Good riddance, Newell says: “We can continue a process that produces beautifully documented requirements for technology that is often out-of-date before it even reaches the hands of a soldier, or we can embrace a new methodology. The fundamental shift must be this: stop obsessing over requirements and start solving problems.” Read his thoughts at Defense One, here.

    Developing: Trump wants a “War Department” instead of a Defense Department, and he said Monday he wants to officially change the name “over the next week or so,” he told reporters Monday at the White House during a meeting with South Korean President Lee Jae Myung.

    “We're just going to do it,” Trump said when asked if he has considered lawmakers’ opinions on the matter. “I'm sure Congress will go along if we need that. I don't think we even need that,” he said. CBS News has a bit more on the history of the U.S. military’s name changes, which have been established by Congress.

    Russia’s Ukraine invasion, cont.

    The Pentagon has blocked Ukraine from attacking Russia with U.S.-provided long-range missiles, the Wall Street Journal reported Saturday. That includes all ATACMS, or Army Tactical Missile Systems, in a ban that’s been in place since the spring, U.S. officials said. As with many of the Trump administration’s decisions regarding Ukraine, the Pentagon’s #2 civilian Elbridge Colby is said to be behind the ban, which officials called a “review mechanism.” 

    “The review gives Defense Secretary Pete Hegseth final say over whether Ukraine can employ the [ATACMS], which have a range of nearly 190 miles, to strike Russia,” the Journal writes.  

    Ukraine has stepped up attacks on Russian oil refineries, knocking an estimated 13% of Russia’s fuel production offline, the Journal reported separately on Monday. “As a result, several regions, including Russian-occupied Crimea and parts of Siberia, have implemented rationing at gas stations,” Yaroslav Trofimov and Georgi Kantchev write. 

    “These strikes don’t have a direct impact on the military activity, but they do impact the Russian economy,” former Ukrainian foreign minister Pavlo Klimkin said. “And the Russian economy already has problems, so even a small push can create bottlenecks and multiply problems inside that system.”

    Latest: “Ukrainian drones on Sunday set ablaze the strategic Ust-Luga facility on the Baltic Sea, a few days after the Druzhba pipeline that supplies Russian crude oil to Belarus, Hungary and Slovakia was disabled. More than a dozen Russian refineries have been hit over the past month, some several hundred miles from the border, as Ukrainian drones became more potent and more numerous.” More, here

    Commentary: What Western security guarantees for Ukraine might look like. After President Trump’s high-level meeting at the White House last week with President Zelenskyy and several European leaders, attention has turned to what security guarantees for Ukraine might look like if a peace deal is reached, Luke Coffey of the Hudson Institute writes for Defense One

    The most effective way to guarantee Ukraine’s long-term security is NATO membership, he writes. “But in the short term, President Trump has repeatedly stated that he does not support this idea, nor will he agree to U.S. troops on Ukrainian soil. With this political reality in mind, policymakers should consider a layered approach to guaranteeing Ukraine’s security,” Coffey advises. “No single measure is sufficient, but together they would provide the most robust protection currently possible.”

    Step 1: Establish a civilian monitoring mission that can patrol both sides of a line of occupation, should a peace agreement leave Russian troops on Ukrainian soil.

    Step 2: Formalize an ensemble of European governments willing to send troops to Ukraine to serve as a deterrent and as a visible demonstration of their commitment to its sovereignty. Several countries, including the UK, France, Canada, and Türkiye, have suggested they could contribute forces.

    And “The third layer involves America,” Coffey writes. Exactly how? Read on, here

    Here’s Trump on security guarantees: “We haven’t even discussed the specifics,” he told reporters Monday. The president was asked, “You rule out boots on the ground in Ukraine, but how would air support as part of a security guarantee be any different?” He replied, “Well, you don't know what security guarantee is because we haven't even discussed the specifics of it, and we'll see. Number one, Europe is going to give them significant security guarantees and they should because they're right there, but we'll be involved. From the standpoint of backup, we're going to help them. And I think if we get a deal and I think we will, but if we get a deal, you're not going to—I don't believe you're going to have much of a problem.” 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CYFIRMA researchers have uncovered a campaign they have codenamed “OneFlip”, an operation that demonstrates how a single-bit modification inside a seemingly benign file can be enough to re-pivot a neural-network-driven security workflow and open a backdoor on the underlying host. Transparent Tribe (APT36) is leveraging the trick against India’s Government networks that rely on the […]

    The post OneFlip Attack Backdoors AI Systems by Flipping a Single Bit in Neural Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Online PDF editors have become common tools for quick document manipulation, providing convenient alternatives to desktop software. However, their cloud-based nature brings significant security vulnerabilities that both organizations and individuals must carefully consider.

    Recent cybersecurity research reveals that these platforms present multiple attack vectors, including data interception, malware injection, and compliance violations that can expose sensitive information to unauthorized parties.

    PDF Editor Security Workflow.
    PDF Editor Security Workflow.

    How Online PDF Editors Work

    Online PDF editors operate through web-based architectures that fundamentally differ from traditional desktop applications. When users upload documents, the files traverse multiple network layers before reaching cloud-based processing servers.

    The typical workflow involves client-side JavaScript handling initial file validation, HTTPS transmission to backend servers, server-side PDF parsing and manipulation, temporary storage in cloud infrastructure, and finally, processed document delivery back to the client.

    The technical architecture relies heavily on server-side PDF libraries such as PDFtk, Ghostscript, or proprietary parsing engines that decompose PDF structures into manipulable components.

    These systems extract text, images, and metadata while maintaining document formatting integrity. However, this process requires complete document access on remote servers, creating inherent security exposure points.

    Modern online PDF editors implement REST API architectures where frontend interfaces communicate with backend microservices through standardized endpoints.

    File uploads typically utilize multipart/form-data encoding, with documents temporarily stored in cloud storage systems like Amazon S3 or Google Cloud Storage. Processing occurs in containerized environments, though isolation effectiveness varies significantly between providers.

    Man-in-the-Middle Attacks and Data Interception

    Man-in-the-Middle (MitM) attacks represent critical threats to online PDF editor security, particularly when users connect through unsecured networks.

    Attackers positioned between clients and PDF editing services can intercept document transmissions, even when HTTPS encryption is implemented.

    Certificate pinning bypasses and DNS spoofing techniques enable sophisticated adversaries to establish fraudulent SSL connections that appear legitimate to end users.

    Man-in-the-Middle Attack Vector.
    Man-in-the-Middle Attack Vector.

    Real-world attack scenarios include coffee shop Wi-Fi exploitation, where attackers deploy rogue access points mimicking legitimate hotspots.

    When users upload sensitive PDFs containing financial records, legal documents, or personal information, attackers can capture complete document contents through packet analysis tools like Wireshark or custom interception frameworks.

    The 2023 incident involving a major European financial institution highlighted these vulnerabilities when employees uploading confidential merger documents through public networks had their communications intercepted.

    Attackers utilized SSL stripping techniques combined with social engineering to downgrade connections from HTTPS to HTTP, exposing document contents in plaintext.

    Technical mitigation requires implementing certificate transparency monitoring, HTTP Strict Transport Security (HSTS) policies, and client-side certificate validation.

    However, many online PDF editors lack robust certificate pinning implementations, leaving users vulnerable to sophisticated MitM campaigns targeting document intelligence gathering.

    Malware and Phishing Threats

    Malware injection through PDF editors represents an evolving attack vector where malicious actors embed harmful code within seemingly benign documents.

    PDF files support JavaScript execution, embedded objects, and external resource linking, creating multiple exploitation opportunities. Attackers can upload PDFs containing malicious JavaScript payloads that execute during server-side processing, potentially compromising backend infrastructure.

    The CVE-2021-28550 vulnerability in Adobe Acrobat demonstrated how PDF parsing engines can be exploited through crafted documents containing buffer overflow triggers.

    Online PDF editors utilizing vulnerable parsing libraries become conduits for remote code execution attacks where malicious documents trigger system-level compromises.

    Phishing campaigns increasingly leverage online PDF editors as social engineering platforms. Attackers create legitimate-appearing PDF modification services that harvest user credentials, document contents, and system information.

    The 2024 “PDFSpoof” campaign targeted corporate users by mimicking popular PDF editing interfaces, collecting over 15,000 business documents containing intellectual property and financial data.

    Malware persistence mechanisms within PDFs include embedded executables, macro-enabled content, and external resource triggers that activate during document viewing or editing.

    Server-side PDF processing without proper sandboxing enables malware propagation to cloud infrastructure, potentially affecting multiple users and creating widespread security incidents.

    Data Misuse and Breaches

    Data misuse by PDF editing platforms occurs through various mechanisms, including indefinite document retention, unauthorized data mining, and third-party sharing arrangements.

    Many services retain uploaded documents far beyond stated retention periods, creating persistent privacy violations and increasing breach impact surfaces.

    Analysis of major PDF editor privacy policies reveals significant gaps in data handling transparency and user control mechanisms.

    The 2023 data breach affecting “ConvertPDF” exposed over 2.4 million user documents stored without encryption on publicly accessible cloud storage buckets.

    Exposed materials included tax returns, legal contracts, medical records, and corporate financial statements, demonstrating the severe consequences of inadequate data protection practices.

    Metadata extraction and analysis represent another significant privacy concern. PDF documents contain extensive metadata, including author information, creation timestamps, editing history, and embedded comments.

    Online editors often extract and retain this metadata for analytics purposes, creating detailed user behavior profiles without explicit consent.

    Server-side logging practices frequently capture document content fragments, user IP addresses, and session identifiers that persist in system logs indefinitely.

    Combined with inadequate access controls and monitoring, these practices create substantial data exposure risks that violate privacy expectations and regulatory requirements.

    Regulatory compliance violations through online PDF editor usage create significant legal and financial risks for organizations. GDPR Article 28 requires data processors to implement appropriate technical and organizational measures, yet many PDF editing services lack adequate data protection impact assessments and controller-processor agreements.

    HIPAA compliance presents particular challenges when healthcare organizations utilize online PDF editors for medical document processing.

    The Business Associate Agreement (BAA) requirement under HIPAA mandates specific security controls that most general-purpose PDF editors cannot satisfy. Unauthorized PHI transmission to non-compliant services creates potential violations carrying penalties up to $1.5 million per incident.

    RegulationRequirementsPDF Editor Risks
    GDPRData minimization, consent, right to erasureIndefinite data retention, lack of consent
    HIPAAPHI protection, audit trails, access controlsUnsecured PHI transmission and storage
    SOXDocument integrity, retention policiesDocument tampering, inadequate audit logs
    PCI DSSCardholder data protection, secure transmissionCredit card data in PDFs, insecure processing
    CCPAConsumer data rights, deletion requestsNo deletion mechanisms, data sharing

    Financial services regulations, including SOX and PCI DSS, impose strict document integrity and audit requirements that online PDF editors often compromise.

    The Sarbanes-Oxley Act requires maintaining audit trails for financial document modifications, yet cloud-based editors frequently lack adequate logging and chain-of-custody mechanisms.

    Cross-border data transfers through international PDF editing services trigger GDPR Article 44 adequacy requirements, creating complex compliance obligations for EU-based organizations.

    Many popular PDF editors operate servers in jurisdictions lacking adequate data protection frameworks, potentially violating transfer restrictions and creating enforcement liability.

    Online PDF editors present multifaceted security challenges that require comprehensive risk assessment and mitigation strategies. Organizations must evaluate data sensitivity, regulatory requirements, and technical security controls before adopting cloud-based document editing solutions. 

    Defense-in-depth approaches, including network security, endpoint protection, and data loss prevention, provide essential safeguards against the documented threat vectors.

    The evolving landscape of PDF-based attacks and regulatory enforcement necessitates continuous security monitoring and policy updates.

    As cybercriminals increasingly target document processing workflows, the security implications of online PDF editor usage will continue to expand, necessitating proactive defensive measures and informed decision-making regarding cloud document processing adoption.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Online PDF Editors Safe to Use? Detailed Analysis of Security Risks Associated With It appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has released a new VM Conversion extension for Windows Admin Center, designed to streamline the migration of VMware virtual machines from vCenter to Hyper-V environments. 

    The preview tool, announced on August 20, 2025, provides enterprises with a cost-free solution for bulk VM migrations while maintaining minimal downtime and preserving critical configurations.

    Key Takeaways
    1. Migrate 10 VMs to Hyper-V with minimal downtime.
    2. Preserves IP, Secure Boot/UEFI; supports clusters.
    3. Requires WAC V2, PowerCLI, VDDK; no vSAN/Azure Local.

    Enhanced Migration Capabilities 

    The VM Conversion extension introduces bulk migration support for up to 10 virtual machines simultaneously, enabling administrators to orchestrate migrations based on application dependencies, cluster requirements, and business boundaries. 

    The tool supports migration from ESXi hosts to Windows Server Failover clusters, providing enterprise-grade scalability for complex virtualization environments.

    Key technical features include static IP configuration persistence, ensuring network continuity by maintaining IP settings from source VMware environments to destination Hyper-V hosts. 

    The extension automatically handles Secure Boot and UEFI template configurations with integrated osType detection, dynamically configuring security settings based on Windows or Linux operating systems while implementing robust error handling for unsupported OS types.

    The migration workflow utilizes Change Block Tracking (CBT) technology for efficient data synchronization and supports multi-disk configurations for virtual machines running complex workloads. 

    The tool requires VMware Virtual Disk Development Kit (VDDK) version 8.0.3 and PowerCLI module installation via PowerShell command: Install-Module -Name VMware.PowerCLI.

    VM Conversion (Preview)
    Microsoft Windows Admin Center interface showcasing the VM Conversion (Preview) extension for seamless VM migration.

    System Requirements

    The extension supports vCenter versions 6.x and 7.x and requires Windows Admin Center Gateway V2 version 2410 build 2.4.12.10. 

    Supported guest operating systems include Windows Server 2025, 2022, 2019, 2016, and 2012 R2, plus various Linux distributions, including Ubuntu 20.04/24.04, Debian 11/12, and Red Hat Linux 9.0.

    For Linux virtual machines, Hyper-V drivers must be pre-installed before migration initiation, specifically requiring Linux Integration Services v4.3 to ensure successful post-migration boot operations.

    Migrate VM window
    Migrate VM window

    The VDDK package must be extracted to C:\Program Files\WindowsAdminCenter\Service\VDDK on the Windows Admin Center Gateway machine.

    The migration process implements comprehensive prechecks to validate environment readiness, including verifying no active snapshots exist, confirming sufficient memory and disk space on destination hosts, and validating target disk paths, Microsoft said.

    Post-migration, administrators can convert dynamic VHDX files to fixed-size using PowerShell: Convert-VHD -Path “C:\VMs\MyDisk.vhdx” -DestinationPath “C:\VMs\MyDisk_Fixed.vhdx” -VHDType Fixed.

    Current limitations include manual VMware Tools removal post-migration and the requirement for active browser sessions during migration processes. 

    The tool currently does not support vSAN environments or migration to Azure Local, positioning it specifically for on-premises Hyper-V deployments.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Microsoft Unveils New Tool to Migrate VMware Virtual Machines From vCenter to Hyper-V appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Aembit, the workload identity and access management (IAM) company, today announced new capabilities for GitLab designed to reduce the security risks of long-lived personal access tokens (PATs) and other secrets needed to automate software delivery, while making it easier to deploy and manage pipelines.

    With the introduction of Credential Lifecycle Management and the availability of Aembit Edge as a native GitLab integration, Aembit replaces static credentials with short-lived, policy-controlled access that is created only when required and revoked automatically. This reduces the risk of misuse while giving development teams a simpler, more reliable way to work inside GitLab.

    GitLab is one of the most widely used platforms for building and deploying software, enabling the automation that moves code from development into production.

    Its popularity has also made it a frequent target: long-lived credentials and unmanaged service accounts have been exposed in several high-profile breaches, including incidents at Pearson and the Internet Archive, leading to stolen data and costly downtime.

    Aembit Credential Lifecycle Management addresses these risks directly. Instead of PATs that linger for months or years, Aembit issues short-lived credentials only when a pipeline job requires them, then automatically expires them.

    Access is tied to cryptographically verifiable workload identity and multifactor authentication (MFA) checks and controlled by a policy enforced at runtime, giving organizations both stronger protection and clear audit records of which workloads accessed which resources and when. Meanwhile, related service accounts are created and removed on demand, ensuring that no unused accounts remain active.

    Aembit is now listed in the GitLab CI/CD Component Catalog. This makes Aembit directly available inside GitLab, allowing teams to add it to their pipelines without extra configuration or manual setup.

    This native integration simplifies the process of connecting pipelines to databases, APIs, and cloud services, reducing reliance on embedded secrets and manual credential handling.

    “Developers want to move quickly without worrying about where a credential is stored or whether it needs to be rotated,” said Kevin Sapp, co-founder and CTO of Aembit.

    “Security teams, on the other hand, want assurance that nothing is left exposed. What we’ve built for GitLab satisfies both needs at once: developers get seamless access in their pipelines, and security leaders get the confidence that access is temporary, accountable, and safe.”

    Organizations, such as Snowflake, that have adopted the Aembit Workload IAM Platform report meaningful reductions in the time spent managing credentials and fewer disruptions following security incidents.

    Security teams value the ability to enforce least privilege automatically, while developers appreciate that tokens are provisioned and revoked transparently without additional coding or manual steps.

    By embedding these controls into GitLab, Aembit allows enterprises to strengthen security while maintaining the speed and consistency expected of modern software pipelines.

    The scale of the issue is significant. Non-human identities already outnumber human ones by at least 45 to 1, and credential abuse remains a leading attack vector according to the 2025 Verizon Data Breach Investigations Report.

    The rise of agentic AI is adding even more autonomous workloads, increasing the demand for secure, short-term access controls. At the same time, engineering teams lose hours each week to manual credential rotation, a process that cannot keep pace with sprawling pipelines and multicloud environments.

    Both GitLab Credential Lifecycle Management and the Aembit Edge component are available immediately. Customers can begin with the Aembit Starter Tier and expand into enterprise-grade policy enforcement, conditional access, and reporting as requirements mature.

    About Aembit

    Aembit is the leading provider of workload identity and access management solutions, designed to secure non-human identities like AI agents, applications, and service accounts across on-premises, SaaS, cloud, and partner environments. Aembit’s no-code platform enables organizations to enforce access policies in real time, ensuring the security and integrity of critical infrastructure. Users can visit aembit.io and follow the company on LinkedIn.

    Contact

    CMO
    Apurva Dave
    Aembit
    info@aembit.io

    The post Aembit Extends Secretless CI/CD with Credential Lifecycle Management for GitLab appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity incidents increasingly exploit human vulnerabilities, including those of privileged users, as demonstrated in recent compromises involving trojanized versions of the PuTTY SSH client distributed through malvertising on Microsoft’s Bing search engine. LevelBlue’s Managed Detection and Response (MDR) Security Operations Center (SOC) recently investigated multiple cases where attackers masqueraded malicious PuTTY executables as legitimate downloads, […]

    The post Weaponized PuTTY Delivered via Malicious Bing Ads Targets Kerberos and Active Directory Services appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶