HeadFlash Security PL

Złośliwe wtyczki JetBrains wykradły klucze AI 70 tys. programistów; Europol zamroził 47 mln USD; nowa luka w macOS; fałszywe pendrive'y w armii Japonii; autonomiczny robak AI.

Źródła:

• 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers | Halting Problems
• '27 million stolen login credentials have been recovered': Global coordinated takedown hits SocGholish, Amadey, and StealC malware networks where it hurt
• macOS security flaw lets hackers disable Mac protection tools without a password
• Fake USB Sticks Spread China-Linked Virus in Japan's Army
• 'You can't patch your way out of it': Cheap AI worm can spread between devices without human guidance — but how did scientists create it?

📰 Przeczytaj całe wydanie na stronie

Rusztowy backdoor Gaslight, krytyczne luki w Ubiquiti, globalna operacja przeciw cyberprzestępczości, amator z AI i gigantyczne przejęcie Accenture w OT security.

Źródła:

• macOS Gaslight Backdoor Weaponizes Prompt Injection Against Security Analysts - Decipher
• CISA warns of max severity Ubiquiti flaws exploited in attacks
• One-two punch delivered in global operation disrupts cybercrime "assembly line"
• Amateur Hacker Used Claude And OpenAI Agents To Hack 14 Companies
• Accenture snaps up majority stake in Dragos, acquires runZero and NetRise in critical infrastructure security push

📰 Przeczytaj całe wydanie na stronie

LastPass i Tata Electronics na celowniku, AI wykrywa luki w rządowych systemach, nowe zagrożenia CI/CD i macOS.

Źródła:

• LastPass Breached via Klue Supply-Chain Attack:… | DeafNews
• Tata Electronics Breach: 200,000 Files Leaked,… | DeafNews
• Anthropic’s Mythos model found vulnerabilities in classified US government systems, official says
• 'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows
• New macOS ClickFix attack silently mounts DMGs to push infostealer

📰 Przeczytaj całe wydanie na stronie

Rumuńskie szpitale wracają do papieru, dokumenty Apple wyciekają, luka w Defenderze, nowe ransomware i masowe łamanie haseł Fortinet.

Źródła:

• How 100 Romanian hospitals switched to pen and paper to defeat a national cyber-attack
• Apple, Tesla documents exposed after hackers hit Tata: report
• Microsoft scrambles to patch a Defender security flaw called RoguePlanet
• Prinz Eugen Ransomware Hits Recent Files First and Skips Ransom Notes - TechRepublic
• Supercomputing on a Credit Card From The AI Rush Enabled The Massive FortiBleed Campaign | InfoStealers

📰 Przeczytaj całe wydanie na stronie

Chiński komputer kwantowy testuje PQC, Indie blokują Telegram, Rada Europy traci dane 10 tys. pracowników – przegląd najważniejszych wydarzeń.

Źródła:

• Post-Quantum Cryptography Meets China's Quantum Computer: What the Shield Leaves Exposed
• Chicago Experts Warn AI Chatbots Could Leak Data
• Alleged China ties at SK Telecom alarmed US officials and triggered Anthropic crisis
• Google Deepmind treats its own AI agents like rogue employees with office keys
• Europol is going rogue – so Brussels is doubling its budget??
• Singaporean brothers use unsolvable maths equations to build modern, unbreakable encryption
• India's Telegram Ban Upheld by Court, Putting 150 Million Users and Every Encrypted App at Risk
• Council of Europe Data Breach: ShinyHunters Makes 10,000 Employees' Records Permanent
• Failed Cyber Test: Alabama Defense Contractor Settles For $500K Over Missing Navy Safeguards
• It looks like an old PC, but this bleeding-edge 'server' may well save us from hackers causing chaos in a post-quantum computing world — 4.1Gb/s 'rackable' quantum random number generator brings entropy to the data center
• Popular free VPN, streaming apps bombard business networks with 'laundered' traffic used by criminals to 'blend into normal consumer noise' — here's how to keep safe

📰 Przeczytaj całe wydanie na stronie

75 tys. firewalli Fortinet zhakowanych, socgholish usunięty z 15 tys. stron, Francja żegna niekwantową kryptografię.

Źródła:

• Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp
• PSA: Steam's most popular PC background app was reportedly infected with malware via Wallpaper Engine's workshop
• Researchers say sweeping hack campaign against Fortinet devices compromised prominent organisations
• Meet Kali365 — the 'Amazon of cybercrime' where hackers use AI to completely circumvent multi-factor authentication
• France to Phase Out Non-Quantum Encryption as Bitcoin Security Concerns Grow

📰 Przeczytaj całe wydanie na stronie

FulcrumSec grozi sprzedażą danych Novo Nordisk, nowy trojan Rokarolla celuje w 217 aplikacji, a Google zaostrza sideloading.

Źródła:

• Hacking group claims major hack of Novo Nordisk, seeks $25M ransom
• A new Android trojan called Rokarolla targets 217 banking apps and can steal your PIN, SMS codes, and crypto wallet funds
• Conti Ransomware Loader Developer Pleads Guilty in $150M Operation Riptide Case
• Hackers Just Published Knicks and Madison Square Garden Data
• Attackers hijacked over 1,500 Arch Linux packages to steal developers' secrets, no hacking required
• SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
• Google's big Android sideloading crackdown has a 24-hour catch - how the new limits work
• Windows and Linux users: The deadline to update Secure Boot keys is near
• A 76-year-old was about to lose his entire $3 million retirement to a scam. TIAA's AI caught it—but a human prevented disaster
• Malicious apps got into the Arch User Repository - how to protect yourself
• Hacking group claims it breached Novo Nordisk and demanded $25m

📰 Przeczytaj całe wydanie na stronie

DragonForce chowa się w Teams, SRG poluje na kancelarie, AMD wyłącza szyfrowanie RAM w konsumenckich Ryzenach.

Źródła:

• Ransomware gang abuses Microsoft Teams relays to hide malicious traffic
• FBI Warns Cyber Extortion Group Is Targeting Law Firms
• Nintendo Hit by Alleged 860 MB Data Theft
• Google Lawsuit: China-Based Scammers Used Gemini to Scale Phishing
• Your Ryzen CPU used to encrypt your RAM. A firmware update silently turned that off.

📰 Przeczytaj całe wydanie na stronie

FBI i Google niszczą chińską platformę phishingową AI, hakerzy kradną dane medyczne z REDCap, Ukrainiec przyznaje się do winy w sprawie Conti i inne ważne historie.

Źródła:

• FBI disrupts massive AI-powered phishing service using a million URLs
• Chinese hackers breach REDCap servers, steal medical research
• Ukrainian man pleads guilty in US to Conti ransomware charges
• AI is fueling a surge of new ransomware threats: Travelers
• Ransomware Preparedness Must Be a Boardroom Priority: NCSC Chief
• FBI dismantles Chinese phishing service that coached buyers to generate scam sites using AI —$88 cybercrime product linked to $1.9 billion in losses, 3.87 million stolen cards

📰 Przeczytaj całe wydanie na stronie

Krytyczna luka w Chrome, pranie kryptowalut za 380 mln USD, ataki na PeopleSoft i AI wykorzystywane przez cyberprzestępców.

Źródła:

• Critical Google Chrome 0-Day Exploited in the Wild, Plus Microsoft and ServiceNow Under Fire
• Authorities dismantle 'AudiA6' ransomware crypto-laundering service
• Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks
• Google says Chinese cybercrime group used its AI in scams
• The FBI secretly built an entire fake town just to practice cyberattacks
• Hacking Google with A.I. for $500,000 · Brutecat
• Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks

📰 Przeczytaj całe wydanie na stronie