A global smishing campaign of unprecedented scale has been uncovered by Palo Alto Networks, revealing the vast operations of a Chinese-speaking threat actor known as the Smishing Triad. Since January 2024, the group has deployed more than 194,000 malicious domains, impersonating legitimate organizations ranging from toll and postal services to banks, cryptocurrency exchanges, and delivery companies. This campaign, active across the U.S., Europe, Asia, and the Middle East, leverages personalized SMS messages designed to trick recipients into divulging sensitive personal or financial information.
Palo Alto Networks’ threat intelligence analysis describes the Smishing Triad as operating under a Phishing-as-a-Service (PhaaS) model—a decentralized criminal ecosystem in which specialized actors handle everything from domain registration and hosting to SMS distribution and phishing kit development. The infrastructure churns through thousands of new domains weekly, with most lasting less than two weeks, making detection and takedown efforts nearly impossible to sustain.
Impersonating legitimate entities such as the U.S. Postal Service, India Post, and major financial institutions, the attackers craft highly convincing lures that exploit urgency and trust. Victims are redirected to counterfeit login portals where they unknowingly hand over credentials, Social Security numbers, or banking information. According to Palo Alto Networks, this high-volume, low-lifespan domain model allows the Smishing Triad to evade signature-based defenses and continuously scale their attacks.
Beyond its scale, what distinguishes this campaign is its professionalization—an industrialized cybercrime model where phishing capabilities are outsourced and sold as services. As a result, even novice criminals can launch large-scale smishing attacks with minimal technical skill. The report warns that this trend marks a dangerous evolution of the cybercrime economy, merging automation, deception, and distributed infrastructure to sustain a global fraud operation.
Palo Alto Networks recommends heightened vigilance, staff awareness training, and strict verification protocols for unsolicited messages, particularly those claiming to be from official entities demanding immediate action. As the Smishing Triad continues to evolve, it stands as a clear reminder that the boundaries between state-linked actors and organized cybercriminal enterprises are increasingly blurred—and that mobile-based phishing remains one of the fastest-growing global threats to individual and enterprise security alike.
#SmishingTriad #PaloAltoNetworks #Smishing #PhishingAsAService #Cybercrime #MobileSecurity #SMSPhishing #PhishingCampaign #OpenSourceIntelligence #ThreatIntelligence #Cybersecurity #InformationSecurity #GlobalThreats #PhishingAttack #Infosec #PhaaS #CyberDefense #DarkWeb
A newly uncovered cyber-espionage operation known as Operation ForumTroll has revealed the resurgence of commercial spyware in state-sponsored surveillance campaigns. According to new research from Kaspersky, the campaign exploited a Google Chrome zero-day vulnerability (CVE-2025-2783) and targeted Russian and Belarusian organizations in government, research, and media sectors. The attacks were traced to tools developed by Memento Labs, the Italian surveillance vendor formerly known as the Hacking Team, whose legacy spyware once sparked global controversy for being sold to authoritarian regimes.
The operation began with highly tailored phishing emails disguised as invitations to the “Primakov Readings” — a major international policy forum — luring recipients into visiting short-lived malicious links. Once clicked, victims were redirected to a drive-by exploit that leveraged the Chrome sandbox escape vulnerability, allowing attackers to execute code on the underlying operating system. Kaspersky’s researchers later identified a similar flaw in Firefox (CVE-2025-2857), broadening the attack surface for the same threat actors.
Once inside, the attackers deployed a dual-implant structure: a custom spyware loader named LeetAgent, and a far more advanced commercial implant called Dante, developed by Memento Labs. Both tools shared identical persistence mechanisms, specifically COM hijacking, a telltale indicator linking the two. While LeetAgent operated as a modular espionage platform capable of keylogging, code injection, and document theft, the Dante implant exhibited industrial-grade sophistication. Protected by VMProtect obfuscation, Dante was found to contain a central orchestrator module that decrypts and loads AES-encrypted payloads, all bound cryptographically to a specific victim machine—ensuring the spyware could not run elsewhere.
Forensic analysis uncovered unmistakable evidence connecting Dante to Hacking Team’s legacy Remote Control Systems (RCS) spyware. Once researchers removed the VMProtect layer, the name “Dante” appeared directly in the code, confirming its lineage. This finding completes a technological chain linking Memento Labs’ “rebooted” surveillance suite to the same underlying codebase once used by Hacking Team—a company whose previous exposure in 2015 caused international uproar.
The technical core of Operation ForumTroll rested on CVE-2025-2783, a flaw in Chrome’s Inter-Process Communication (IPC) framework that mishandled Windows pseudo-handles. This allowed attackers to exploit a logic error and execute arbitrary code outside the browser’s sandbox, achieving full system compromise. Before triggering the exploit, the attackers ran an intricate validation process using WebGPU-based hardware checks and ECDH encryption to ensure the victim was a genuine human target, not a researcher or sandbox system—a sophisticated evasion method rarely seen in commercial spyware delivery.
Kaspersky’s attribution of Operation ForumTroll to Memento Labs represents one of the clearest connections yet between a commercial surveillance vendor and a state-backed cyber operation. The exposure carries significant implications for the spyware industry, signaling that tools developed under the guise of “lawful interception” continue to reappear in covert geopolitical campaigns. Analysts believe this revelation may force Memento Labs to re-engineer its flagship Dante suite, much as it did when rebranding from Hacking Team years earlier.
This operation serves as a powerful reminder of the blurred boundaries between private surveillance companies and state cyber operations—and how vulnerabilities in everyday software can be weaponized through the global spyware market. A full list of Indicators of Compromise (IoCs) from the campaign has been released by Kaspersky to help defenders detect and mitigate related threats.
#OperationForumTroll #MementoLabs #HackingTeam #DanteSpyware #LeetAgent #CVE20252783 #ChromeZeroDay #CyberEspionage #Kaspersky #CommercialSpyware #CVE20252857 #Cybersecurity #SpywareMarket #ThreatIntelligence #ZeroDayExploit #APT #SurveillanceTechnology #CyberDefense #Infosec
The global ransomware economy is collapsing under growing resistance from its targets. According to new data from cybersecurity firm Coveware, the third quarter of 2025 saw ransomware payments drop to a historic low, with just 23% of victims paying attackers—a continuation of a six-year downward trend. Even when ransoms were paid, the average payment plunged by 66%, marking one of the most dramatic contractions in cyber extortion profitability to date.
This shift is not coincidental. Companies have learned that paying the ransom rarely prevents data leaks, and law enforcement guidance increasingly supports a strict no-payment stance. Privacy attorneys are also advising organizations to refuse payment, particularly in cases of data exfiltration-only attacks, where victims gain little to nothing by complying. As a result, the ransomware “business model” is faltering, with fewer payouts starving the criminal ecosystem that depends on steady Bitcoin inflows.
Facing these headwinds, threat groups like Akira and Qilin have pivoted to a high-volume, low-demand strategy. Rather than chasing multi-million-dollar payouts from major enterprises, these gangs are now flooding mid-sized companies with smaller ransom demands—an approach that exploits limited budgets and weaker security postures. The data shows that the median victim size rose to 362 employees, suggesting that attackers are deliberately targeting organizations large enough to pay something, but small enough to lack enterprise-level defenses.
Despite these strategic shifts, attackers continue to rely on basic entry points rather than sophisticated exploits. Over half of all ransomware incidents still begin with compromised remote access services, weak passwords, and misconfigured systems. Meanwhile, phishing campaigns and unpatched software vulnerabilities—most of them years old—remain the easiest paths for compromise. This underscores that ransomware operations thrive on poor hygiene, not innovation.
Experts view this decline in ransom payments as an encouraging milestone. With fewer victims paying, the economics of ransomware are becoming unsustainable, forcing groups to fragment or lower their demands to stay operational. The Coveware report concludes that this trend represents meaningful progress: the more organizations refuse to pay, the less incentive attackers have to continue. However, the industry must remain vigilant—especially mid-sized companies, which now face a rising tide of smaller but more frequent attacks.
As the ransomware economy contracts, the message is clear: resilience and refusal work. By focusing on foundational defenses—multi-factor authentication, strict patching, and secure remote access—organizations can help starve the cyber extortion ecosystem and push ransomware further toward collapse.
#Ransomware #Coveware #CyberExtortion #AkiraRansomware #QilinRansomware #Cybersecurity #ThreatIntelligence #RansomwarePayments #Phishing #RemoteAccessSecurity #VulnerabilityManagement #InfoSec #DataBreach #CyberCrime #NoRansomPolicy #CyberDefense #IncidentResponse #Q32025 #CyberThreatReport
Mozilla is taking a decisive step toward transparency and user control by requiring all Firefox extensions to disclose how they collect and handle personal data. The new mandate introduces a dedicated key—browser_specific_settings.gecko.data_collection_permissions—that every extension must include in its manifest file. Whether or not an extension collects data, developers must explicitly declare their practices, ensuring there is no room for ambiguity.
This policy introduces what many are calling a “privacy nutrition label” for browser add-ons, allowing users to see data collection details before installation. The information will be prominently displayed both on the addons.mozilla.org extension listing pages and within Firefox’s about:addons management interface. By placing this information front and center, Mozilla is giving users the ability to make more informed decisions about which extensions they trust with their data.
For developers, compliance isn’t optional. Any extension that fails to properly declare its data collection policies will be rejected during the signing process, blocking it from distribution through Mozilla’s add-on store. Even extensions that support older Firefox versions must still offer an immediate, built-in method for users to control data collection after installation. This ensures that all users, regardless of which version they run, retain meaningful privacy controls.
Mozilla’s phased rollout begins immediately for new extension submissions and will expand to include all existing extensions by next year. The initiative represents one of the most significant shifts in browser extension policy since Mozilla first opened its add-on ecosystem. By enforcing these clear, structured disclosures, Firefox is setting a new precedent in digital transparency—one that could pressure other browser vendors to follow suit.
As privacy concerns continue to grow across the web, this move underscores Mozilla’s longstanding commitment to open, user-first design. For everyday users, it means fewer hidden data practices. For developers, it establishes a clear framework for ethical software distribution. And for the broader tech landscape, it signals a new era where trust and transparency are not optional, but expected.
#Mozilla #Firefox #PrivacyUpdate #BrowserExtensions #DataTransparency #UserPrivacy #ManifestV3 #FirefoxAddons #Cybersecurity #OnlinePrivacy #ExtensionPolicy #DataCollection #AppTransparency #TechNews
Chainguard, the Kirkland, Washington-based cybersecurity company, has announced a landmark $280 million growth funding round led by General Catalyst’s Customer Value Fund (CVF), pushing its total capital raised to nearly $900 million and valuing the firm at $3.5 billion. This new round marks a pivotal phase for Chainguard as it shifts from product-focused development to large-scale go-to-market execution, all while maintaining an ironclad focus on product innovation and security.
Founded on the mission to secure the open source software supply chain, Chainguard provides over 1,700 secure-by-default container images, curated language libraries, and purpose-built VM images designed to eliminate known vulnerabilities before they reach production environments. The company’s “secure-by-default” approach has become its defining market differentiator, drastically reducing security and compliance risks for developers and enterprises worldwide.
According to CFO Eyal Bar, the funding model is designed to “scale go-to-market investment without diluting ownership or slowing innovation.” This strategic partnership with General Catalyst’s CVF enables Chainguard’s commercial operations to fund their own growth, while preserving capital for research, product engineering, and the next wave of secure software infrastructure development.
The infusion of capital also reflects unprecedented investor confidence in Chainguard’s disciplined financial model, rapid scaling capabilities, and unique position within the cybersecurity ecosystem. As enterprise dependence on open source continues to expand, Chainguard’s mission to secure foundational components of modern software development is more critical than ever. With a strong capital structure, a mature go-to-market plan, and a product suite trusted by developers globally, Chainguard is now poised to cement its leadership in the secure software supply chain sector.
#Chainguard #OpenSourceSecurity #SoftwareSupplyChain #Cybersecurity #GrowthFunding #GeneralCatalyst #SecureByDefault #DevSecOps #VulnerabilityManagement #InvestmentNews #CloudSecurity #SoftwareEngineering #TechFunding #ContainerSecurity
The Pwn2Own Ireland 2025 hacking competition was set to feature one of its most anticipated moments — a $1 million zero-click remote code execution exploit against WhatsApp — but the demonstration never happened. Scheduled to be showcased by researcher Eugene of Team Z3, the exploit’s abrupt withdrawal stunned attendees and quickly became the most controversial event of the competition. Organized by Trend Micro’s Zero Day Initiative (ZDI), Pwn2Own had validated the exploit’s entry, fueling expectations that WhatsApp would face a serious zero-day challenge in front of a live audience. Yet when the researcher pulled out hours before the demo, official explanations shifted, and a clash of narratives began to unfold between ZDI, the researcher, and WhatsApp’s parent company, Meta.
ZDI initially cited travel issues as the reason for the cancellation, later updating its statement to say the exploit was “not sufficiently prepared for public demonstration.” By evening, ZDI announced that Team Z3 had agreed to a private disclosure, promising to share details confidentially with Meta. Researcher Eugene confirmed the arrangement the following day, explaining that a signed non-disclosure agreement (NDA) prevented him from revealing more and that he wished to maintain anonymity. That silence created a vacuum—one that Meta quickly filled.
In a pointed public statement, WhatsApp claimed the researcher’s submission was not viable, describing it instead as two “low-risk bugs” and expressing disappointment that the team withdrew. The language was notably firm, designed to reassure users and minimize perception of risk. Yet, to many in the cybersecurity community, this reframing directly contradicted the exploit’s prior $1 million valuation and ZDI’s validation, raising doubts about whether the exploit had been downplayed for public-relations reasons.
Analysts observed that ZDI’s evolving messaging — from travel delays to incomplete preparation — suggested an effort to contain reputational fallout while preserving its credibility as an impartial coordinator. Meanwhile, Meta’s decisive tone allowed it to reclaim control of the narrative, portraying its platform as secure and the withdrawn exploit as exaggerated. For researchers, however, the episode highlighted the power imbalance between independent security experts and major tech vendors, where NDAs and corporate messaging can quickly shape public understanding of an exploit’s true impact.
This controversy underscores the fragile relationship between vendors, event organizers, and security researchers. WhatsApp’s choice to publicly downplay the exploit may have protected its image in the short term but risks alienating researchers wary of being discredited after disclosure. The incident serves as a cautionary tale for both sides: that in today’s vulnerability economy, the battle for truth is often fought not in code, but in public communication.
#Pwn2Own #WhatsApp #ZeroDay #ZDI #Meta #ExploitWithdrawal #BugBounty #SecurityResearch #CyberSecurity #RCE #Eugene #TeamZ3 #TrendMicro #VulnerabilityDisclosure #HackerCommunity #WhiteHat #InfoSec #Pwn2OwnIreland2025 #NDAs #CyberEvent
A serious vulnerability has been discovered in the OpenAI Atlas omnibox, a hybrid interface designed to handle both URLs and user prompts. Researchers at NeuralTrust revealed that attackers can disguise malicious instructions as URLs to jailbreak the omnibox, taking advantage of how Atlas interprets malformed input. Unlike traditional browsers, Atlas sometimes misclassifies malformed URLs as trusted instructions after a failed inspection, leading the system to execute the embedded commands with elevated trust and fewer safety checks. This parsing flaw allows attackers to effectively hijack the agent’s behavior, transforming a simple navigation request into an opportunity for exploitation.
Through this vulnerability, threat actors can use a so-called copy-link trap — embedding the malicious string behind a “Copy Link” button or message. When a user pastes the disguised input into the omnibox, Atlas treats it as a legitimate prompt rather than a web address, potentially directing the user to a phishing site or executing commands within their authenticated session. The exploit could even be used to instruct the AI to delete files from connected cloud accounts, leveraging the user’s session tokens and bypassing normal confirmation checks.
The underlying issue is not just a coding oversight but a logical failure in trust boundaries — a design-level problem where the system cannot reliably distinguish between a URL to visit and a command to obey. The result is a dangerous breakdown in user control, allowing a malicious prompt to override user intent, perform cross-domain actions, and sidestep the very safety layers meant to protect against prompt injection.
Experts warn that this flaw represents a new class of process-based exploit for agentic AI systems. Because it abuses the underlying methodology of how the omnibox interprets input, the vulnerability could be adapted for countless malicious purposes beyond phishing or file deletion. Defending against it will require architectural changes, including stricter input validation, stronger provenance tracking, and clearer separation of trusted and untrusted instructions. The Atlas omnibox jailbreak shows that as AI interfaces evolve, attackers are learning to weaponize ambiguity — turning text meant to navigate into text that commands, and exploiting the blurred line between user input and system execution.
#OpenAI #Atlas #OmniboxJailbreak #NeuralTrust #AIJailbreak #CyberSecurity #PromptInjection #URLExploit #CrossDomainAttack #AgentSecurity #Phishing #ClipboardAttack #AITrust #SafetyByDesign #InfoSec #AIThreats #InputValidation #OmniboxVulnerability #AtlasExploit #AIIntegrity
A critical remote code execution (RCE) flaw, tracked as CVE-2025-59287, has put thousands of enterprise networks at risk by exposing the Windows Server Update Service (WSUS) to active exploitation. The vulnerability, rooted in unsafe object deserialization, allows unauthenticated remote attackers to execute arbitrary code with System-level privileges — effectively granting full administrative control over targeted Windows servers. Because WSUS manages how updates are distributed across enterprise networks, a compromised instance can give attackers the ability to manipulate software updates, deploy malware, or hijack patch pipelines at scale.
Following the discovery of in-the-wild attacks, Microsoft released out-of-band security updates, emphasizing the urgency of immediate patch deployment. Despite this, researchers from Eye Security and the Dutch National Cyber Security Centre (NCSC) have confirmed active exploitation shortly after a Proof-of-Concept (PoC) exploit was made public. The vulnerability impacts multiple Windows Server versions — including 2012, 2016, 2019, 2022, and 2025 — and requires only that the WSUS Server Role be enabled for successful compromise.
Security firm HawkTrace was the first to publish detailed technical analysis and a working PoC, demonstrating how attackers can trigger the deserialization flaw by sending a crafted event to a vulnerable WSUS instance. Within hours of these details going public, threat actors began leveraging the exploit in real-world attacks, highlighting the alarming speed of vulnerability weaponization in modern threat landscapes.
As of Eye Security’s latest findings, more than 2,500 WSUS servers worldwide remain exposed and unpatched. Microsoft’s official guidance urges immediate installation of both the initial and follow-up out-of-band patches, while administrators unable to patch immediately are advised to disable the WSUS Server Role as a temporary mitigation to close the attack vector.
This incident underscores the critical importance of rapid patch management, proactive monitoring, and layered defenses for infrastructure components that underpin enterprise security ecosystems. The exploitation of CVE-2025-59287 is a stark reminder that attackers move faster than ever — and that every hour between disclosure and patching can mean the difference between defense and disaster.
#Microsoft #CVE202559287 #WSUS #WindowsServer #RemoteCodeExecution #PatchNow #CyberSecurity #RCE #Exploit #Vulnerability #HawkTrace #EyeSecurity #DutchNCSC #ZeroDay #MicrosoftPatch #CriticalFlaw #InfoSec #EnterpriseSecurity #SystemPrivileges #WindowsExploit
The launch of Perplexity’s Comet AI browser — a major step forward in AI-assisted browsing — was almost immediately hijacked by cybercriminals. Within weeks of its July debut, threat intelligence firm BforeAI uncovered a coordinated impersonation campaign designed to exploit public interest in the new product. The campaign involved a web of fraudulent domains, fake mobile apps, and malicious advertisements, all working together to trick users into downloading counterfeit versions of Comet.
Attackers registered more than 40 fake domains using typosquatting and brand impersonation, targeting search terms like “Comet,” “AI,” “browser,” and “Perplexity.” These sites often mimicked the official download pages to capture traffic from curious users. Beyond the web, the campaign spread to mobile ecosystems — with fake Comet AI applications appearing on both Google Play and the Apple App Store. One app, “Comet AI Atlas App Info,” impersonated the legitimate product so convincingly that Perplexity’s CEO Aravind Srinivas publicly warned users, confirming the iOS version as “fake and spam.”
The malicious operation also leveraged Google Ads and social media promotions to push these fraudulent downloads, reflecting a high degree of coordination and resource management. Analysts believe this was no random phishing spree but a deliberate, financially motivated campaign orchestrated by experienced cybercriminals. Their use of international domain registrars, privacy protection services, and strategically parked domains suggests a sophisticated infrastructure optimized for deception and monetization.
The incident underscores a critical truth for the modern tech landscape: every major product launch has become a potential target for brand hijacking and impersonation attacks. As threat actors evolve to exploit hype cycles and emerging technologies, proactive brand monitoring, pre-launch threat modeling, and digital risk protection are now essential defensive measures. The Comet AI case serves as a warning to every technology innovator — cybercriminals are watching every launch, ready to strike before the first user even downloads the real product.
#Perplexity #CometAI #BrowserSecurity #CyberAttack #Typosquatting #FakeApps #AppStoreFraud #GooglePlayMalware #SocialEngineering #BrandImpersonation #CyberThreat #AI #DigitalRisk #CyberCrime #ThreatIntelligence #BforeAI #AravindSrinivas #OnlineSafety #Phishing #ScamAlert
A new wave of cyber-espionage attacks reveals North Korea’s deepening effort to steal critical defense technologies from Europe. In a sophisticated campaign dubbed Operation Dream Job, the Lazarus Group — also known as Diamond Sleet and Hidden Cobra — has launched targeted attacks on European defense contractors and UAV (unmanned aerial vehicle) developers. Beginning in March 2025, the hackers posed as recruiters offering lucrative positions to engineers and software developers, luring victims into opening trojanized PDF files. Once opened, these files secretly deployed the ScoringMathTea remote access trojan, giving the attackers full system control and long-term persistence.
Forensic evidence reveals the campaign’s deliberate targeting of companies involved in drone component manufacturing and UAV software development. Analysts believe the goal is to steal intellectual property and manufacturing blueprints to accelerate North Korea’s domestic drone production, which closely mirrors U.S. and European UAV designs. The operation also likely serves broader military intelligence goals, including gathering insights into weapon systems deployed in Ukraine.
This campaign highlights how cyber-espionage remains central to Pyongyang’s asymmetric warfare strategy, blending digital infiltration with geopolitical opportunism. With evidence showing Lazarus’s malware referencing “drone” keywords within its code, the link between these attacks and North Korea’s UAV ambitions is unmistakable. As global tensions rise, European defense firms face mounting pressure to defend against this persistent, state-backed threat that fuses social engineering, espionage, and military modernization into a single, calculated operation.
#LazarusGroup #OperationDreamJob #NorthKorea #CyberEspionage #UAV #DroneTechnology #DefenseIndustry #ScoringMathTea #CyberSecurity #Europe #APT #HiddenCobra #DiamondSleet #CyberThreat #MilitaryEspionage #DroneWarfare
Toys “R” Us Canada has confirmed a customer data breach after records from its database appeared on the dark web on July 30, 2025, prompting a full-scale cybersecurity investigation and disclosure to privacy regulators. The company’s internal review, conducted in partnership with third-party experts, verified that an unauthorized party accessed and copied portions of the customer database, exfiltrating personal information including names, mailing addresses, email addresses, and phone numbers.
Crucially, the company stated that no financial or highly sensitive data—such as account passwords or credit card details—was compromised. The incident began when security researchers discovered a threat actor posting alleged customer data online, forcing Toys “R” Us Canada to act swiftly to validate the claims, contain the threat, and upgrade its IT security infrastructure.
Following the confirmation of the breach, the retailer implemented enhanced security measures, improved access controls, and began notifying affected customers and Canadian privacy regulators, as required by national data protection laws. In its communication to customers, Toys “R” Us Canada advised vigilance against phishing and impersonation scams, warning that attackers often exploit such incidents by sending fraudulent emails or calls that appear to come from legitimate sources.
While the compromised data is limited to personal contact details, cybersecurity experts note that this type of exposure still carries significant social engineering and identity theft risk, especially if combined with data from other breaches. The incident underscores the growing trend of retail sector data thefts, where customer information is monetized through dark web marketplaces or used to facilitate targeted phishing campaigns.
As the investigation continues, Toys “R” Us Canada’s response highlights the importance of rapid incident detection, transparent communication, and proactive customer protection in managing post-breach fallout. The company maintains that it has taken all necessary steps to strengthen its defenses and restore trust following the exposure.
#ToysRUsCanada #DataBreach #CyberAttack #DarkWebLeak #CustomerData #PrivacyBreach #CyberSecurity #RetailBreach #Phishing #InformationSecurity #IncidentResponse #CanadaPrivacy #DataProtection #BreachNotification #PersonalDataExposure #CyberThreat
A dangerous zero-day vulnerability in Kyocera Communications subsidiary Motex’s Lanscope Endpoint Manager has triggered a global cybersecurity alert after being actively exploited in real-world attacks. Tracked as CVE-2025-61932, this flaw carries a CVSS severity score of 9.8, allowing remote, unauthenticated attackers to execute arbitrary code simply by sending specially crafted packets to a vulnerable system. In effect, it grants full control over enterprise endpoints, turning a trusted management tool into a weapon against its own network.
The flaw, caused by improper verification of communication sources, has already been exploited in attacks primarily targeting organizations in Asia — especially Japan, where Lanscope’s adoption is widespread. Japan’s JPCERT/CC confirmed observing potential compromise attempts, and Motex has urged all customers running affected on-premises versions (9.4.7.1 or earlier) to apply emergency patches immediately.
As the situation escalated, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) took decisive action by adding CVE-2025-61932 to its Known Exploited Vulnerabilities (KEV) list, citing it as a frequent and dangerous attack vector. Under Binding Operational Directive (BOD) 22-01, CISA has mandated all federal agencies patch their systems within three weeks — a clear signal of the vulnerability’s severity. Though the directive is mandatory only for U.S. federal entities, CISA is strongly advising all organizations worldwide to review the KEV list and prioritize patching.
The potential consequences of exploitation are devastating. A successful compromise of Lanscope’s management layer could allow attackers to deploy ransomware across thousands of endpoints, steal sensitive corporate data, and maintain long-term access for espionage or persistence. With confirmed exploitation already underway, time is a critical factor.
Cybersecurity analysts stress that this incident underscores the growing trend of supply-chain and endpoint management exploits, where centralized administrative systems become high-value targets. Organizations using Lanscope must act immediately — conducting full asset discovery, validating deployments, and applying Motex’s latest patches without delay.
#Lanscope #CVE202561932 #Motex #KyoceraCommunications #CISA #KEVList #ZeroDay #ActiveExploitation #EndpointSecurity #RemoteCodeExecution #CyberAttack #PatchNow #JapanCybersecurity #BOD2201 #CVEAlert #Vulnerability #CISAMandate #NetworkSecurity #JPCERT #CyberThreat
The Internet Systems Consortium (ISC) has released a series of critical BIND 9 updates to fix multiple high-severity vulnerabilities affecting DNS resolver systems worldwide. The flaws—tracked as CVE-2025-40780, CVE-2025-40778, and CVE-2025-8677—pose serious threats ranging from cache poisoning to denial-of-service (DoS) attacks. These vulnerabilities collectively endanger one of the internet’s most foundational components: the Domain Name System (DNS).
The two most severe issues, both scoring 8.6 on the CVSS scale, expose BIND resolvers to cache poisoning. One of them, CVE-2025-40780, originates from a weakness in the Pseudo Random Number Generator (PRNG) used for DNS queries, allowing attackers to predict critical identifiers like source ports and query IDs. The second, CVE-2025-40778, involves overly lenient acceptance of DNS records, which can enable attackers to inject forged or spoofed entries into the cache. Once poisoned, the resolver could redirect users to malicious domains, enabling phishing, credential theft, and data interception across entire organizations.
The third flaw, CVE-2025-8677, rated 7.5 (High), introduces a DoS risk that allows adversaries to overwhelm DNS resolvers by sending specially crafted malformed DNSKEY records, consuming CPU resources until DNS services become unavailable. Because nearly all internet-dependent systems rely on DNS resolution, such attacks can lead to massive service disruptions, cutting off critical applications, communications, and business operations.
The ISC emphasizes that no workarounds exist for these vulnerabilities — patching is the only mitigation. Updated versions, including BIND 9.18.41, 9.20.15, and 9.21.14, are now available and must be deployed immediately. Though the consortium reports no confirmed in-the-wild exploitation so far, the public disclosure of technical details drastically increases the likelihood of attackers developing weaponized exploits in the near term.
For enterprises, this serves as an urgent reminder that DNS security is infrastructure security. Any delay in applying the ISC’s patches exposes networks to redirection attacks, service outages, and data breaches. Immediate updates are critical to maintaining service integrity, preventing manipulation of DNS traffic, and ensuring business continuity.
#BIND9 #DNS #ISCSecurity #CVE202540780 #CVE202540778 #CVE20258677 #CachePoisoning #DNSAttack #PRNGFlaw #DenialOfService #CyberSecurity #Vulnerability #PatchNow #DNSResolver #InternetSecurity #ISCVulnerability #SystemAdmin
A critical new vulnerability is wreaking havoc across the global e-commerce ecosystem. Tracked as CVE-2025-54236 and dubbed SessionReaper, this flaw affects Adobe Commerce and Magento Open Source platforms, allowing attackers to bypass security features and seize control of customer accounts through the Commerce REST API. Despite Adobe releasing emergency hotfixes on September 9, an alarming 62% of Magento sites remain unpatched, leaving tens of thousands of online stores exposed to active exploitation.
Security firm Sansec first observed a spike in real-world attacks involving PHP webshell payloads and phpinfo probes used for reconnaissance and persistence. The attacks began almost immediately after the vulnerability was disclosed, accelerated by a premature leak of Adobe’s patch that gave adversaries a head start in developing exploits. Now that exploit code is public, experts warn of an impending surge in automated attacks targeting unpatched systems.
Adobe has officially confirmed that the SessionReaper vulnerability is being exploited in the wild, transforming a technical flaw into a full-blown operational crisis for online retailers. Threat actors are using the exploit to hijack customer sessions, manipulate transactions, and exfiltrate sensitive data — threatening both consumer trust and brand integrity.
According to Sansec’s telemetry, more than half of all Magento sites remain vulnerable, creating a massive attack surface for opportunistic cybercriminals. The exploit’s simplicity, combined with the widespread use of outdated Commerce installations, means mass compromise events are likely imminent.
Cybersecurity professionals emphasize that immediate mitigation is non-negotiable. Administrators must apply Adobe’s September 9 hotfix for all affected versions (2.4.4 through 2.4.7) and monitor for unauthorized API activity or unexpected PHP file uploads. With SessionReaper already tearing through unpatched systems, time is the most critical defense.
#AdobeCommerce #Magento #SessionReaper #CVE202554236 #AdobeVulnerability #EcommerceSecurity #Sansec #CyberAttack #Webshell #AccountTakeover #ExploitInTheWild #CVEAlert #PatchNow #RESTAPI #AdobeHotfix #CyberThreats #MagentoSecurity
Cybersecurity firm SquareX has unveiled a new and alarming threat to users of AI-enabled browsers — a technique called AI Sidebar Spoofing. This sophisticated attack uses malicious browser extensions to create visually identical replicas of legitimate AI sidebars, tricking users into believing they are interacting with trusted AI assistants like ChatGPT Atlas, Perplexity’s Comet, or integrated browser agents such as Copilot in Edge and Gemini in Chrome. Once installed, these extensions inject JavaScript that seamlessly imitates the real AI interface, intercepting and altering prompts and responses.
The result? A user unknowingly follows manipulated AI instructions that can lead to phishing scams, credential theft, or the execution of malicious commands directly on their own device. This form of attack weaponizes trust—exploiting not software vulnerabilities, but human behavior. SquareX’s analysis shows that these spoofed sidebars can guide users to install malware, grant remote access, or visit fraudulent websites, all while maintaining the illusion of legitimate AI guidance.
The systemic flaw lies in how browsers permit extensions to inject and manipulate on-page content, making this threat platform-agnostic and dangerously widespread. Even though providers like OpenAI enforce strict sandboxing in ChatGPT’s Atlas browser, these safeguards do not protect users from themselves—particularly when deception is this seamless.
Cybersecurity experts now warn that AI Sidebar Spoofing represents the next evolution in social engineering attacks, combining psychological manipulation with technical precision. To defend against it, organizations must enforce strict extension controls, retrain users to question AI-provided instructions, and recognize that as AI becomes a daily tool, the human trust layer is the new battlefield in cybersecurity.
#AISidebarSpoofing #SquareX #ChatGPTAtlas #PerplexityComet #BrowserSecurity #SocialEngineering #Malware #CyberThreat #AITrust #ExtensionExploits #Cybersecurity #OpenAI #Phishing #AIinSecurity
Oregon-based Jewett-Cameron Company, a manufacturer of fencing, kennels, and specialty wood products, has confirmed that it was the victim of a double-extortion ransomware attack on October 15, 2025, in an incident that disrupted operations and exposed sensitive corporate data. The attackers infiltrated the company’s IT network, deploying encryption and monitoring software, which temporarily halted key business functions and prevented access to core systems.
According to an internal memorandum from company leadership, the attackers not only encrypted systems but also stole sensitive data, including financial information intended for an upcoming SEC filing and even images captured from internal video meetings. The stolen material is now being leveraged in a classic double-extortion scheme, with the attackers demanding a ransom to prevent public release of the data.
While Jewett-Cameron reports that its cybersecurity insurance is expected to cover the costs of incident response and system recovery, the company acknowledges that the attack has caused significant operational disruptions that could have a material impact on business performance and regulatory timelines. Specifically, the company warns that the downtime could delay its Form 10-K filing and affect investor confidence if sensitive financial data is leaked prematurely.
The company’s initial investigation indicates that while the breach affected corporate IT systems, no personal information belonging to employees, customers, or suppliers appears to have been compromised. This limits the potential exposure of third-party data but does not diminish the strategic and reputational risks of the event.
Jewett-Cameron has engaged external cybersecurity counsel and forensic specialists to contain the breach, investigate the attack, and restore operations. The company has since contained the intrusion and is working to rebuild systems while evaluating whether to comply with the ransom demand — a complex decision balancing reputational risk, investor relations, and the ethical implications of paying threat actors.
The ransomware group behind the attack remains unidentified publicly, but their tactics — combining data encryption with exfiltration and public pressure — align with the growing trend of double-extortion operations that target small and mid-sized manufacturing and supply chain organizations.
This incident underscores the escalating risks facing manufacturers and public companies that handle sensitive financial disclosures. The attack on Jewett-Cameron highlights the intersection of operational technology (OT) and corporate IT vulnerabilities, and the increasing tendency for threat actors to weaponize stolen financial data to pressure organizations into ransom payments.
As of now, Jewett-Cameron maintains that the intrusion is contained, and system restoration is underway. However, the company warns that even with insurance coverage, the broader consequences — including market volatility, regulatory scrutiny, and reputational damage — could be felt long after the systems come back online.
#JewettCameron #Ransomware #Cyberattack #DoubleExtortion #DataBreach #Oregon #ManufacturingSecurity #CyberExtortion #IncidentResponse #CISO #CyberInsurance #OperationalDisruption #DataExfiltration #SEC #Form10K #CyberThreat #BusinessRisk #CyberForensics #EncryptionAttack #SupplyChainSecurity #InformationSecurity #RansomDemand #CyberResilience
The Russian state-sponsored hacking group Star Blizzard — also tracked as ColdRiver, Seaborgium, and UNC4057 — has undergone a major transformation in its operations following public exposure earlier this year. After researchers at Google detailed its LostKeys malware and PowerShell-based infection chain in June 2025, the group swiftly abandoned those tools, pivoting to a completely rebuilt attack framework that emphasizes simplicity, flexibility, and stealth.
Between May and September 2025, Star Blizzard replaced its previous malware suite with a streamlined infection chain built around three new components: NoRobot, YesRobot, and MaybeRobot. This tactical shift underscores the group’s ability to adapt rapidly under pressure — a defining hallmark of nation-state APTs.
The evolution began with the introduction of NoRobot (also called BaitSwitch), a malicious DLL loader that initiates the infection chain via a technique known as ClickFix — malicious lure pages that trick victims into executing harmful commands. Once established, NoRobot retrieves a second-stage payload from attacker-controlled servers. Initially, this payload was YesRobot, a Python-based backdoor with limited functionality. But within weeks, Star Blizzard replaced it with MaybeRobot (aka SimpleFix), a far more agile operator-controlled backdoor capable of executing arbitrary files, shell commands, and PowerShell code directly from the attacker’s console.
Unlike traditional automated implants, MaybeRobot favors hands-on-keyboard operations, giving human operators granular control for post-exploitation activities. This move marks a deliberate shift toward manual precision attacks, allowing Star Blizzard to minimize detection risk while maintaining strategic flexibility.
The group’s technical evolution also extends to its evasion tactics. Star Blizzard has begun rotating its command-and-control infrastructure, altering file paths and DLL export names, and frequently rebranding binaries — all to undermine defenders’ reliance on static indicators of compromise (IOCs). These measures highlight a growing emphasis on anti-signature resilience, making behavioral and heuristic detection the only effective defense strategy.
This transformation reveals a disciplined, reactive adversary capable of rebuilding its toolset within months of public disclosure. The operation’s new structure reflects a broader trend among state-backed actors: fewer automated frameworks, more adaptable operator-driven campaigns, and simplified yet hardened delivery mechanisms.
For defenders, the implications are clear — signature-based detection is no longer enough. Monitoring behavioral patterns such as rundll32 misuse, command execution anomalies, and short-lived infrastructure is now essential to identifying and mitigating Star Blizzard’s evolving campaigns.
#StarBlizzard #ColdRiver #Seaborgium #APT #Russia #CyberEspionage #NoRobot #MaybeRobot #LostKeys #BaitSwitch #ClickFix #MalwareEvolution #ThreatIntelligence #APTUNC4057 #CyberThreat #NationStateHacking #Cybersecurity #MalwareAnalysis #ThreatDetection #Rundll32 #HandsOnKeyboard #EvasionTactics #Infosec #APTActivity #GoogleThreatAnalysis #AdvancedPersistentThreat
San Francisco-based Keycard has officially emerged from stealth mode, announcing $38 million in funding across seed and Series A rounds to build what may become one of the most critical infrastructure layers of the AI era — identity and access management (IAM) for AI agents. Founded in 2025 by former senior executives from Snyk and Okta, Keycard is taking on the monumental task of securing how autonomous AI systems authenticate, access data, and execute tasks across production environments.
The company’s founding thesis is clear: as enterprises move beyond AI experimentation and begin deploying autonomous agents into real-world applications, they face a major security gap. These agents often require direct access to internal systems, APIs, and sensitive data — yet existing IAM systems were designed for humans, not autonomous entities. Keycard’s platform fills this void by introducing a cryptographically verifiable identity layer for non-human actors, enabling organizations to deploy agents safely and confidently.
At the heart of Keycard’s approach is a set of groundbreaking architectural features:
Keycard’s $38 million raise includes a $30 million Series A led by Acrew Capital and an $8 million seed round co-led by Andreessen Horowitz (a16z) and Boldstart Ventures, with additional participation from Essence Ventures, Exceptional Capital, Mantis VC, Modern Technical Fund, Tapestry Ventures, and Vermillion Cliffs Ventures. This investor mix underscores broad confidence that Keycard is addressing a foundational problem for the emerging agent economy—the security and governance of autonomous AI systems.
According to CEO Ian Livingstone, Keycard’s mission is to unlock the enterprise potential of AI agents by ensuring they operate with the same trust, control, and accountability as human users:
“You can’t run AI agents in production until you can trust them — and trust starts with identity and access.”Keycard’s founding team brings together the developer-centric security expertise of Snyk with the identity and governance experience of Okta, creating a unique advantage in building security infrastructure that developers can easily adopt and enterprises can trust at scale. The company plans to use its funding to expand its research and development team, advance its IAM platform, and strengthen its integration with enterprise ecosystems.
As the world transitions toward an AI-driven operational model, Keycard is emerging as a pioneer in defining identity for machines. Its platform offers the missing trust layer needed for enterprises to deploy autonomous systems responsibly — combining cryptography, adaptive security, and enterprise-scale architecture to secure the next generation of digital actors.
#Keycard #AIIdentity #IAM #AIInfrastructure #AgentSecurity #AIAgents #Cybersecurity #AndreessenHorowitz #AcrewCapital #BoldstartVentures #AITrust #TaskScopedTokens #CryptographicIdentity #Snyk #Okta #AgentEconomy #AIAuthentication #MachineIdentity #AccessControl #AIinEnterprise #AIInnovation #StealthStartup #TechFunding #IdentitySecurity #AICompliance #AIgovernance
Security researchers are urging immediate action after TP-Link disclosed multiple critical vulnerabilities in its Omada gateway line, affecting a wide range of ER, G, and FR series devices. The flaws—now patched by TP-Link—expose organizations to remote code execution, privilege escalation, and full network compromise, making them among the most severe threats to network infrastructure this year.
The most dangerous vulnerability, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote, unauthenticated attackers to execute arbitrary operating system commands. In simple terms, it gives hackers the ability to take full control of affected gateways without needing any credentials. Once exploited, this flaw can be used to manipulate traffic, install malware, or pivot into internal systems, effectively neutralizing perimeter defenses and exposing entire networks.
Another critical flaw, CVE-2025-7850, is a command injection vulnerability that requires an attacker to already have administrative access to the web management portal. Although it’s an authenticated exploit, it becomes extremely dangerous in scenarios involving compromised credentials, insider threats, or password reuse—turning a single admin account into a complete network breach vector.
Two additional high-severity issues, CVE-2025-7851 and CVE-2025-6541, further elevate the risk. One allows an attacker to gain root access, while the other enables OS command execution by an authenticated user. Together, these vulnerabilities create a chainable attack path—where even limited access can rapidly escalate to total control over the gateway and, by extension, the entire network.
The consequences of leaving these devices unpatched are severe:
TP-Link has released firmware updates to address these flaws and strongly advises all users to apply the patches immediately. Administrators are also urged to change all device passwords after patching to ensure that any previously compromised credentials cannot be reused.
These vulnerabilities are part of a growing pattern of attacks against network gateway devices, which have become high-value targets for threat actors seeking to bypass traditional perimeter defenses. Because gateways sit at the heart of enterprise and SMB networks, their compromise often results in total network visibility and control for the attacker.
For organizations relying on TP-Link Omada gateways, the message is clear: patch now or risk full compromise. The combination of unauthenticated remote code execution and privilege escalation flaws makes these vulnerabilities critical priority items for immediate remediation.
#TPLINK #Omada #CVE20256542 #CVE20257850 #CVE20257851 #CVE20256541 #RemoteCodeExecution #RCE #CommandInjection #NetworkSecurity #FirmwareUpdate #Cybersecurity #RouterVulnerability #GatewayExploit #IoTSecurity #CriticalVulnerabilities #SupplyChainRisk #PatchNow #SecurityAdvisory #CyberThreat #NetworkCompromise #PrivilegeEscalation #DataExfiltration #PerimeterSecurity #CVE #VulnerabilityDisclosure
A critical new vulnerability known as TARmageddon (CVE-2025-62518) has sent shockwaves through the Rust developer community and the broader cybersecurity world. This high-severity desynchronization flaw, discovered in the Async-tar and Tokio-tar libraries, exposes millions of downstream applications to the risk of remote code execution and supply chain compromise. The flaw arises when these TAR parsers process nested archives with mismatched PAX and ustar headers, allowing attackers to smuggle unauthorized file entries that can overwrite critical files on a target system.
The discovery was made by Edera, a security research firm, which issued an urgent advisory after identifying that both Async-tar and its popular fork, Tokio-tar, had been abandoned and left unmaintained. With no maintainers to coordinate a fix, Edera initiated a decentralized disclosure process—a rare move in vulnerability response—encouraging downstream developers to patch or migrate independently. This decentralized approach led to quick action by some projects, such as Astral-tokio-tar (patched in version 0.5.6) and Krata-tokio-tar, but others, including Testcontainers and Liboxen, remain exposed pending updates.
At its core, TARmageddon’s exploitability comes from how the vulnerable parsers misinterpret archive structure. When encountering a nested TAR file where the ustar header incorrectly specifies a zero-byte file, the parser skips over critical content and begins interpreting the nested TAR’s internal headers as legitimate entries in the parent archive. This allows attackers to inject arbitrary files—a technique that can lead to arbitrary file overwrites and remote code execution. In real-world attacks, this could be leveraged to replace binaries, modify authentication keys, or compromise build pipelines, making it a potent weapon for software supply chain attacks.
The incident reveals deeper truths about the modern open-source ecosystem. Despite Rust’s reputation for memory safety, TARmageddon shows that logic flaws—not memory errors—can still produce catastrophic results. Moreover, the widespread use of abandoned dependencies like Async-tar highlights a systemic challenge: critical libraries often go unmaintained while remaining deeply embedded in production systems. This “vulnerable lineage” problem—where one unpatched project infects countless forks and derivatives—poses a significant and growing risk to software supply chains.
Edera’s report calls for urgent remediation steps:
With a CVSS score of 8.1, TARmageddon is more than just another open-source vulnerability—it’s a cautionary tale about the fragility of dependency-driven software ecosystems. It underscores that memory-safe languages do not guarantee security, and that maintaining supply chain visibility is as important as patching the code itself.
#TARmageddon #CVE202562518 #Rust #AsyncTar #TokioTar #SupplyChainSecurity #OpenSourceVulnerability #RemoteCodeExecution #Desynchronization #PAXHeaders #Ustar #RustSecurity #DependencyRisk #EderaSecurity #SoftwareSupplyChain #CyberRisk #CVE #AppSec #VulnerabilityDisclosure #AstralTokioTar #KrataTokioTar #PatchNow #SecurityAlert #MemorySafe #SoftwareSecurity
