https://ransomfeed.it/news.php Cybersecurity and Ransomware global news en-us https://ransomfeed.it/news.php?id_news=nid&nid=402 69cb3ea317a32c4e6143e665fdb20b14 402 Mon, 13 Jul 2026 15:09:31 RansomFeed Researchers identified a Windows DLL backdoor dubbed SolidPDFCreator and attributed it to the China-linked threat group Mustang Panda, describing the malware as a stage-1 backdoor used in a campaign targeting entities in India. The sample was tied to "Target India – Campaign 3" and documented as an early-access implant intended to establish an initial foothold on compromised systems.

Available reporting describes the malware as a DLL-based payload and provides core triage details including file type, size, hashes, compiler characteristics, and binary section information. The publication of these indicators gives defenders material to hunt for related activity and assess whether Mustang Panda infrastructure or tooling associated with SolidPDFCreator is present in their Windows environments..

Fonte: https://mallory.ai/stories/019f5b97-b731-757f-9232-4d37594e27e2]]> https://ransomfeed.it/news.php?id_news=nid&nid=401 816b112c6105b3ebd537828a39af4818 401 Mon, 13 Jul 2026 15:08:25 RansomFeed Proofpoint reported that attackers are increasingly abusing OAuth client ID spoofing against Microsoft Entra ID to enumerate accounts and validate credentials without registering a legitimate OAuth application. The activity relies on Resource Owner Password Credentials (ROPC) authentication requests that use spoofed or random clientid values, allowing attackers to distinguish invalid usernames, valid usernames with incorrect passwords, and in some cases valid username-password pairs based on Microsoft Entra AADSTS error responses.

Proofpoint said it observed at least two large-scale campaigns, UNKpyreq2323 and UNK_OutFlareAZ, using different infrastructure, user agents, and client ID generation patterns, indicating the technique is being adopted by multiple threat actors. Microsoft’s published Entra error code behavior helps explain how responses such as AADSTS700016 can leak authentication state, and defenders were urged to review Entra sign-in logs for blank or missing application names or IDs and to treat some apparent failed logins as possible signs of successful credential validation by an attacker..

Fonte: https://mallory.ai/stories/019f5abb-4b51-7c60-87e6-1a798468d7f8]]> https://ransomfeed.it/news.php?id_news=nid&nid=400 18d8042386b79e2c279fd162df0205c8 400 Mon, 13 Jul 2026 15:08:02 RansomFeed Researchers disclosed Ghostcommit, a proof-of-concept software supply-chain attack that hides prompt-injection instructions inside a PNG image referenced by an AGENTS.md file, allowing malicious pull requests to appear benign during review. In the demonstrated scenario, AI code reviewers such as Cursor Bugbot and CodeRabbit did not meaningfully inspect image content, so the pull request could be merged even though the real instructions were concealed in the image rather than visible text.

After merge, the attack is triggered when a developer later asks a coding agent to perform a routine task and the agent reads the hidden image instructions, accesses repository secrets such as the .env file, encodes the contents as integer tuples, and inserts them into source code in a way that can evade typical secret scanners. Researchers from the University of Missouri-Kansas City's ASSET Research Group said exploitation depended more on the coding harness than the underlying model, with Cursor and Antigravity leaking secrets across multiple models while Claude Code consistently refused; they reported the issue to vendors and built a multimodal GitHub review app that detected nearly all tested variants, including image-based attacks, with no false positives in their evaluation..

Fonte: https://mallory.ai/stories/019f50a6-03b8-72f2-b359-ff29c2feb3a5]]> https://ransomfeed.it/news.php?id_news=nid&nid=403 bbf94b34eb32268ada57a3be5062fe7d 403 Mon, 13 Jul 2026 15:05:36 RansomFeed The UK, France, the EU, and partner cyber agencies publicly attributed a broad cyber-espionage campaign to FSB Centre 16, linking the Russian intelligence unit to both the long-running Turla intrusion set and active exploitation of internet-facing routers and network devices. UK and allied authorities warned that the actor is scanning globally for poorly configured infrastructure, abusing default or weak SNMP credentials and known Cisco-related weaknesses such as Smart Install and web-management flaws to seize control of devices, with critical sectors including communications, defence, energy, financial services, government, and healthcare identified as high-risk targets.

French authorities said entities in France, including ministries and organizations in the diplomatic, defence, justice, and technology sectors, were targeted and compromised using Turla tradecraft that has been active since at least 2004. The coordinated disclosures were accompanied by formal attribution statements from France and the EU, while the UK said EU member states and London also attributed the December 2025 attack on Poland’s energy grid to FSB Centre 16 and announced sanctions against 24 individuals and entities tied to Russian destructive cyber and hybrid operations. Defenders were urged to harden network devices by adopting SNMPv3, disabling legacy SNMP versions, enforcing strong unique passwords, and restricting access to management interfaces..

Fonte: https://mallory.ai/stories/019f5abb-5619-7aae-accc-87ddc094fc21]]> https://ransomfeed.it/news.php?id_news=nid&nid=399 352fe25daf686bdb4edca223c921acea 399 Mon, 13 Jul 2026 14:05:21 RansomFeed CERT Polska disclosed four vulnerabilities in GNU gawk, tracked as CVE-2026-40467, CVE-2026-40468, CVE-2026-40469, and CVE-2026-40553. The issues were highlighted in a CERT Polska advisory and later amplified by security reporting, identifying the widely used pattern-scanning and text-processing utility as affected software.

Public reporting provides only limited detail so far, with no technical breakdown, exploitation evidence, or impact assessment included in the referenced notices. Organizations using GNU gawk should review the CERT Polska advisory, identify affected deployments, and prioritize vendor guidance or updates as more remediation details become available..

Fonte: https://mallory.ai/stories/019f5b28-bfb0-7acf-99f4-71bd82994a80]]> https://ransomfeed.it/news.php?id_news=nid&nid=398 b7b16ecf8ca53723593894116071700c 398 Mon, 13 Jul 2026 02:06:43 RansomFeed Debian has released Debian 13.6 as a point update focused on security and maintenance, alongside Debian 12.15 for the previous stable branch. Debian 13.6 bundles roughly 120 security updates and more than 120 bug fixes, with patches affecting the Linux kernel and widely deployed packages including Nginx, Redis, FFmpeg, Thunderbird, Chromium, PHP, Postfix, Samba, wireless-regdb, and Wireshark. The update is intended to bring existing installations current rather than introduce a new major version.

A notable change in Debian 13.6 is an updated shim-signed and fwupd 2.0.20 stack to support newer Microsoft UEFI Secure Boot certificate chains and updates to Secure Boot CA, KEK, and DBX databases after expiration issues with the default UEFI Secure Boot CA used on many PCs. Debian also reverted or removed the legacy geoip-database package because newer GeoLite data was found incompatible with Debian Free Software Guidelines and the older dataset had become outdated, pushing migration toward maintained alternatives such as GeoLite2..

Fonte: https://mallory.ai/stories/019f51b7-da1b-7b72-b763-0a04a088ac18]]> https://ransomfeed.it/news.php?id_news=nid&nid=397 e46de7e1bcaaced9a54f1e9d0d2f800d 397 Mon, 13 Jul 2026 01:06:48 RansomFeed U.S. prosecutors announced two significant ransomware case outcomes: Armenian national Karen Serobovich Vardanyan pleaded guilty to conspiracy and computer fraud for helping compromise U.S. organizations and deploy Ryuk ransomware, while Florida resident Angelo Martino was sentenced to 70 months for assisting the BlackCat/ALPHV gang. Court records say Vardanyan provided initial access to victim networks between November 2019 and April 2020, with victims including a Michigan company, a technology firm in Wilsonville, Oregon, and a Texas school. Prosecutors linked Vardanyan and his co-conspirators to roughly 1,610 bitcoin in ransom payments, valued at about $15 million at the time.

Vardanyan was arrested in Kyiv in April 2025, extradited to the United States in 2025, and now faces up to 15 years in prison, fines of $250,000 per charge, and more than $1.1 million in restitution; sentencing is scheduled for September 2026. In the separate BlackCat/ALPHV case, Martino was convicted for abusing his position as a ransomware negotiator to share confidential victim negotiation information with attackers, and his co-conspirators Ryan Goldberg and Kevin Martin had already received four-year prison terms. The cases underscore continued U.S. efforts to disrupt both ransomware operators and the support networks that enable extortion campaigns..

Fonte: https://mallory.ai/stories/019f4d36-dce5-75ea-904c-04dc8b8f6d93]]> https://ransomfeed.it/news.php?id_news=nid&nid=396 f8c1f23d6a8d8d7904fc0ea8e066b3bb 396 Mon, 13 Jul 2026 00:53:06 RansomFeed Keycloak disclosed and patched a high-severity privilege escalation flaw, CVE-2026-9795, in its Fine-Grained Admin Permissions v2 (FGAPv2) feature after researchers reported that a delegated administrator could bypass missing authorization checks in the admin REST API and add arbitrary realm roles to a client’s scope mapping. That weakness allowed limited administrators to inject elevated roles such as realm-admin into tokens later issued to users authenticating through the affected client, creating a path to downstream privilege escalation in deployments running Keycloak 26.2.0 and later with FGAPv2 enabled.

The issue was later listed as fixed in Keycloak release 26.6.4, alongside several other security bugs including CVE-2026-9099, CVE-2026-9083, CVE-2026-9086, CVE-2026-9705, CVE-2026-9799, CVE-2026-9800, and CVE-2026-11800. Red Hat also shipped security updates for its Keycloak 26.4.11 images and operator on OpenShift, addressing a broad set of vulnerabilities across the Admin REST API, Account REST API, OIDC dynamic client registration, UMA authorization, token handling, redirect validation, and scope processing, with impacts ranging from information disclosure and SSRF to account takeover, policy bypass, and denial of service..

Fonte: https://mallory.ai/stories/019f4df5-0b3a-78dd-b762-c6d2c348e533]]> https://ransomfeed.it/news.php?id_news=nid&nid=395 1543843a4723ed2ab08e18053ae6dc5b 395 Tue, 07 Jul 2026 14:10:18 RansomFeed Google said it disrupted NetNut—also known as Popa—a large residential proxy network that investigators linked to malware delivery, command-and-control activity, and efforts by cybercriminal and espionage actors to mask their origin IP addresses while accessing victim environments. Working with the FBI, Lumen, and other partners, Google disabled accounts and services allegedly used by the operation, shared technical intelligence on NetNut SDKs and backend infrastructure, and used Google Play Protect against apps that incorporated the NetNut SDK. Google estimated the network relied on at least 2 million devices and said 316 threat clusters used suspected NetNut exit nodes during a single week in June.

The coordinated action also included FBI seizures of NetNut-associated domains, a move that parent company Alarum Technologies said disrupted part of the service and could materially affect operations and financial results if the outage persists. Google said the operation significantly degraded the network and cut its available device pool by millions, describing the move as part of a broader campaign against malicious proxy providers after an earlier action against IPIDEA. The disruption is being viewed as a blow not only to a botnet-linked service but also to the broader supply of residential proxy infrastructure relied on by multiple threat actors..

Fonte: https://mallory.ai/stories/019f36e8-0635-7787-8724-2441a8f208df]]> https://ransomfeed.it/news.php?id_news=nid&nid=394 28f0b864598a1291557bed248a998d4e 394 Tue, 07 Jul 2026 14:09:10 RansomFeed Alibaba has ordered employees to stop using Anthropic’s Claude Code for work and reportedly directed them to remove other Anthropic products, classifying the software as high risk over alleged security vulnerabilities and backdoor concerns. Internal guidance said the ban would take effect on July 10, with staff told to switch to Alibaba’s internal Qoder platform instead. The move followed claims that Claude Code contained concealed environment-detection logic that checked proxy settings and system time zones against lists associated with Chinese companies including Alibaba, Baidu, ByteDance, Ant Group, and Moonshot AI.

The allegations originated from a June 30 Reddit reverse-engineering post that said the logic had been present since Claude Code version 2.1.91 and encoded detection results through subtle changes to internal system prompts rather than explicit telemetry, making monitoring difficult. Anthropic had not publicly confirmed the issue in full, but an engineer reportedly said the mechanism was an experiment aimed at preventing reseller abuse, unauthorized access, and model distillation, and that the code was removed on July 1. The dispute comes amid broader tensions between the companies after Anthropic accused operators linked to Alibaba’s Qwen lab of using fraudulent accounts in a large-scale model distillation effort..

Fonte: https://mallory.ai/stories/019f2887-a9f5-7ec2-927a-d3afc0fc3535]]> https://ransomfeed.it/news.php?id_news=nid&nid=393 70c639df5e30bdee440e4cdf599fec2b 393 Tue, 07 Jul 2026 07:21:42 RansomFeed Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. Coder Workspace Agent patched GHSA-QRWJ-VH9X-GW5V, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP 307/308 redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions v2.34.4, v2.33.10, v2.32.9, and v2.29.19 ESR. Coolify disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as dockerfilelocation, allowing RCE and secrets exposure through deployment logs, while OpenRemote fixed GHSA-cgfv-jrfp-2r7v, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials.

Additional disclosures affected AI and package-management components. Langroid fixed a prompt-injection-driven flaw in Neo4jChatAgent that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version 0.65.5 with new safety controls that were also extended to ArangoChatAgent. pnpm also reported a path traversal weakness in configDependencies processing from pnpm-lock.yaml, where a malicious repository could force symlink creation outside nodemodules/.pnpm-config even with --ignore-scripts, creating a filesystem write primitive within or potentially beyond the project directory..

Fonte: https://mallory.ai/stories/019f3a1e-9c92-7c90-a9b3-258ef7b78180]]> https://ransomfeed.it/news.php?id_news=nid&nid=392 f73b76ce8949fe29bf2a537cfa420e8f 392 Tue, 07 Jul 2026 04:04:58 RansomFeed Adobe ColdFusion is facing active exploitation of CVE-2026-48282, a maximum-severity flaw tied to RDS arbitrary file write that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include ColdFusion 2025.9, 2023.20, and earlier, and internet scanning data from Shadowserver shows nearly 800 ColdFusion instances exposed online, though the number still vulnerable is unclear.

Separate reporting on CVE-2026-48276 highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious CFML payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a CVSS v3.1 score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for CVE-2026-48282, underscoring defender focus on identifying exposed and unpatched ColdFusion systems..

Fonte: https://mallory.ai/stories/019f3755-ff1e-7e51-886d-1d5833807fe3]]> https://ransomfeed.it/news.php?id_news=nid&nid=391 5a4b25aaed25c2ee1b74de72dc03c14e 391 Tue, 07 Jul 2026 02:06:23 RansomFeed France's cybersecurity agency, ANSSI, said it will stop certifying security products that lack post-quantum or quantum-resistant encryption beginning in 2027. Because ANSSI certification is required for products used by French government agencies and critical infrastructure operators, the policy will effectively force a phaseout of older encryption technologies across those sectors.

ANSSI official Samih Souissi said the move is intended to accelerate France's transition to quantum-safe cryptography as concerns grow over future attacks against current encryption standards. The agency also signaled a broader market shift by urging businesses to prioritize purchasing quantum-safe products by 2030, extending pressure beyond the public sector and regulated operators..

Fonte: https://mallory.ai/stories/019f371d-29b6-7520-8a0b-0df354c15fad]]> https://ransomfeed.it/news.php?id_news=nid&nid=389 c86a7ee3d8ef0b551ed58e354a836f2b 389 Tue, 07 Jul 2026 01:07:27 RansomFeed Japanese police arrested a 15-year-old high school student from Saitama Prefecture for allegedly carrying out a sustained cyberattack against Bandai Channel, the anime streaming service operated by Bandai Namco Filmworks. Investigators said the suspect exploited a server-side flaw, analyzed network traffic, and used a custom malicious program reportedly developed with assistance from ChatGPT to gain unauthorized backend access, cancel 46,812 member registrations, and collect member data including email addresses and nicknames.

The attack disrupted Bandai Channel in November 2025 and forced the company to suspend the service for more than a month while it repaired systems, refunded subscribers, and implemented stronger security measures before restoring operations in December. Police said the teenager continued the activity after being blocked by repeatedly changing IP addresses, and later identified him through communication record analysis; the suspect reportedly admitted the allegations and said he acted out of technical curiosity rather than any grudge, while the company said it had not confirmed any public leak of personal data or secondary fraud..

Fonte: https://mallory.ai/stories/019f371d-52c4-7802-8cb7-d3ff3b1f5ad9]]> https://ransomfeed.it/news.php?id_news=nid&nid=390 a01a0380ca3c61428c26a231f0e49a09 390 Tue, 07 Jul 2026 00:06:13 RansomFeed OpenSSH has released version 10.4 with eight security fixes affecting both client and server components, including sftp, scp, sshd, ssh, ssh-agent, and cryptographic verification logic. The update addresses path traversal-style and file redirection issues that could let a malicious server write files outside intended locations, a pre-authentication denial-of-service condition in sshd, a client-side use-after-free bug, and gaps in authentication delay enforcement. The release also replaces the wildcard matcher with an NFA-based implementation to remove exponential worst-case behavior.

The release introduces experimental support for a composite post-quantum signature scheme combining ML-DSA 44 with Ed25519, available only when explicitly enabled and configured. OpenSSH also hardened protocol handling by disconnecting peers that send non-KEX messages during post-authentication rekeying and made seccomp sandbox initialization failures fatal on Linux. Maintainers warned that some changes may break existing deployments, including mixed-case output from sshd -G, stricter transport-layer behavior, and the new sandbox failure handling..

Fonte: https://mallory.ai/stories/019f37c4-f905-7a75-ba72-735830fd429b]]> https://ransomfeed.it/news.php?id_news=nid&nid=387 8efb100a295c0c690931222ff4467bb8 387 Mon, 06 Jul 2026 06:04:35 RansomFeed Microsoft Edge (Chromium-based) has received fixes for multiple high-severity vulnerabilities, including remote code execution flaws CVE-2026-58289, CVE-2026-58293, CVE-2026-58285, CVE-2026-58288, CVE-2026-57974, CVE-2026-58284, CVE-2026-58287, CVE-2026-57981, and CVE-2026-56645, as well as the security feature bypass issue CVE-2026-57983. Public records attribute the issues to Microsoft and rate them from high to critical severity, with CVSS scores reaching 9.0 for CVE-2026-58289 and several others scoring in the 8.1-8.8 range.

Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders..

Fonte: https://mallory.ai/stories/019f2a76-66fe-762c-84ef-84f97feb5e08]]> https://ransomfeed.it/news.php?id_news=nid&nid=386 39461a19e9eddfb385ea76b26521ea48 386 Mon, 06 Jul 2026 04:05:07 RansomFeed Researchers identified a malicious npm supply-chain campaign that impersonated Rollup polyfill tooling to compromise developer workstations and CI/build systems. The primary packages, rollup-packages-polyfill-core and rollup-runtime-polyfill-core, mimicked legitimate Rollup-related projects and used staged dependencies including swift-parse-stream, quirky-token, react-icon-svgs, and rollup-plugin-polyfill-connect to trigger a multi-stage infection chain. The malware fetched obfuscated code from JSONKeeper, decrypted additional payloads retrieved from 216.126.236.244, and executed them locally while using evasive checks to avoid some analysis and cloud development environments.

The final payloads gave attackers remote access and enabled theft of browser data, crypto-wallet information, files, clipboard contents, and other developer secrets such as source code, tokens, SSH keys, and cloud credentials. JFrog said the layered package structure, lookalike naming, and tradecraft resemble earlier Lazarus-linked npm operations, while additional reporting tied the activity to a broader North Korea-linked supply-chain effort referred to as PolinRider. Some malicious packages were replaced with security-holding versions, but others remained available at the time of reporting, prompting guidance to remove the packages, treat affected hosts as compromised, rotate credentials, and block related outbound traffic..

Fonte: https://mallory.ai/stories/019f1b39-0a61-7fb2-bb3d-434f2cffeebf]]> https://ransomfeed.it/news.php?id_news=nid&nid=385 dc912a253d1e9ba40e2c597ed2376640 385 Sun, 05 Jul 2026 23:04:47 RansomFeed Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to 3,834,294 individuals. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the ShinyHunters extortion group, which claimed to have stolen about 9 million records and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information.

Medtronic said it found no impact on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering 24 months of credit monitoring, dark web monitoring, and identity theft recovery services..

Fonte: https://mallory.ai/stories/019f311b-8791-78ea-90c4-894329798c83]]> https://ransomfeed.it/news.php?id_news=nid&nid=384 0584ce565c824b7b7f50282d9a19945b 384 Sun, 05 Jul 2026 19:07:08 RansomFeed Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers root access across a wide range of systems, including servers, desktops, and Android devices. One bug, CVE-2026-46242 or Bad Epoll, is a use-after-free race in the kernel's epoll subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because epoll is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports.

A second flaw, CVE-2026-43456, affects the kernel's net/bonding subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible headerops handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions 2.6.24 through 6.12.77 and requires CAPNET_ADMIN privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible..

Fonte: https://mallory.ai/stories/019f2b1a-8651-7e8a-bbe4-9bb9f7ce315c]]> https://ransomfeed.it/news.php?id_news=nid&nid=388 d9fc5b73a8d78fad3d6dffe419384e70 388 Sun, 05 Jul 2026 19:06:38 RansomFeed Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including npm, Go, Chrome, and Packagist. Socket linked the activity to North Korean actors associated with the Contagious Interview operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages html-to-gutenberg 4.2.11 and fetch-page-assets 1.2.9 that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed.

The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a VS Code folder-open task instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on TRON, Aptos, and BNB Smart Chain. Researchers said the campaign deployed components including BeaverTail, DEV#POPPER RAT, OmniStealer, a socket.io backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across Windows, macOS, and Linux. Security firms warned that affected developer systems and credentials should be treated as fully compromised..

Fonte: https://mallory.ai/stories/019f30fa-51d2-72b1-8e27-0f0d5481f4e6]]> https://ransomfeed.it/news.php?id_news=nid&nid=382 4f6ffe13a5d75b2d6a3923922b3922e5 382 Fri, 03 Jul 2026 11:12:54 RansomFeed Researchers have identified PamStealer, a previously unseen macOS malware family distributed through fake websites impersonating the legitimate Maccy clipboard manager. The infection begins with a trojanized disk image and a compiled AppleScript lure that tells users to press Command-R in Script Editor, a step that executes malicious code while sidestepping macOS com.apple.quarantine protections. The malware then deploys a Rust-based second stage that downloads additional payloads, steals browser data, clipboard contents, iCloud Keychain information, and login credentials, and sends the data to attacker-controlled infrastructure over encrypted command-and-control channels.

PamStealer stands out for validating stolen passwords locally through macOS Pluggable Authentication Modules (PAM), repeatedly prompting victims until the correct password is entered before exfiltration. Researchers said the malware is environment-aware, targets Apple Silicon systems, avoids analysis environments, and excludes devices tied to several Eastern European locales and time zones. It also delays Full Disk Access prompts, establishes persistence, and hides app bundles by impersonating Finder or Software Update components, while displaying decoy error messages to make victims think the fake application simply failed to launch..

Fonte: https://mallory.ai/stories/019f2474-8b2b-78be-bc1e-79ba465501e1]]> https://ransomfeed.it/news.php?id_news=nid&nid=381 00ec53c4682d36f5c4359f4ae7bd7ba1 381 Fri, 03 Jul 2026 10:05:32 RansomFeed Citizen Lab found that the iPhone of former European Parliament member Stelios Kouloglou was infected twice with NSO Group’s Pegasus spyware, in October 2022 and March 2023, while he served on the Parliament’s PEGA Committee investigating spyware abuse across Europe. Researchers said the attacks used a zero-click exploit against an Apple iPhone vulnerability that had been patched but not installed on the device, potentially giving the operator access to private messages, location data, photos, and even ambient audio without any user interaction.

The infections occurred during sensitive PEGA work, including hearings and draft reporting on alleged spyware abuses in Cyprus, Greece, Hungary, Poland, and Spain, intensifying concerns that commercial spyware was used against a lawmaker scrutinizing its misuse. Citizen Lab did not name the government behind the operation, but said the same Pegasus-linked email address and infrastructure overlapped with an earlier cluster targeting Russian- and Belarusian-speaking journalists and opposition figures, strongly suggesting a common operator with cross-border reach; Kouloglou has said he believes he was targeted because of his committee role and plans to sue NSO Group..

Fonte: https://mallory.ai/stories/019f2661-c82b-729e-97fe-86fa8824fe70]]> https://ransomfeed.it/news.php?id_news=nid&nid=383 beed13602b9b0e6ecb5b568ff5058f07 383 Fri, 03 Jul 2026 08:05:43 RansomFeed Anthropic said it has globally re-deployed Claude Fable 5 with updated cybersecurity controls and released new technical details on how the model handles cyber-related prompts. The company said the system uses safety classifiers to sort requests into prohibited, high-risk dual-use, low-risk dual-use, and benign categories rather than blocking all security activity, allowing some defensive and educational use while aiming to stop harmful assistance. Anthropic said prohibited requests include malware development, ransomware, wipers, data exfiltration, defense evasion, offensive infrastructure such as C2, destructive attacks, and cyber-physical sabotage, and that the model applies a larger safety margin than earlier versions to reduce dangerous outputs even if that increases false positives.

Anthropic also published an early draft Cyber Jailbreak Severity (CJS) framework, developed with Glasswing, to rate AI jailbreaks from CJS-0 to CJS-4 based on capability gain, breadth of impact, ease of weaponization, and discoverability. The company said the framework is intended to create a shared vocabulary for assessing jailbreak risk across industry and government, particularly for cases involving high-uplift vulnerability discovery or exploit generation. Anthropic invited external feedback through a dedicated contact channel and launched a HackerOne bug bounty program for researchers to report potential cyber jailbreaks affecting Fable 5..

Fonte: https://mallory.ai/stories/019f2550-3b4f-798f-868c-cbeec9a07f6f]]> https://ransomfeed.it/news.php?id_news=nid&nid=380 bca82e41ee7b0833588399b1fcd177c7 380 Fri, 03 Jul 2026 07:30:56 RansomFeed A malware campaign dubbed ChocoPoC used fake or trojanized GitHub proof-of-concept exploit repositories for newly disclosed CVEs to infect cybersecurity researchers, penetration testers, and bug hunters. Researchers at Sekoia and YesWeHack said the visible exploit code often appeared benign, while the real payload was introduced through malicious PyPI dependencies including frint and skytext. The package chain decrypted and executed code that fetched the final Python-based remote access trojan from a Mapbox dataset, and investigators linked at least seven repositories to the operation. The activity appears to have relied largely on compromised accounts to publish the poisoned packages and repositories, with skytext alone drawing roughly 2,400 downloads, mostly on Linux systems.

Once activated, ChocoPoC provided remote shell and Python execution, stole browser credentials and files, uploaded data, enumerated processes, and collected host details such as network configuration and shell history. The malware was designed to evade casual review and simple sandboxing by delaying activation until the PoC was run, while also using DNS-over-HTTPS to resolve infrastructure and 91.132.163.78 for larger uploads. Investigators said related activity may date back to late 2025 through earlier packages such as slogsec and logcrypt.cryptography, raising concern that compromises of researcher workstations could create downstream supply-chain risk for trusted security tooling and frameworks..

Fonte: https://mallory.ai/stories/019f1f86-22f7-7331-8f9c-27cd301ce16f]]> https://ransomfeed.it/news.php?id_news=nid&nid=379 a02ffd91ece5e7efeb46db8f10a74059 379 Fri, 03 Jul 2026 02:05:49 RansomFeed A reported vulnerability in Apple’s iCloud+ Hide My Email service allows an attacker with only a relay alias to uncover the user’s real email address, defeating a privacy feature widely used to mask identity. Researcher Tyler Murphy of EasyOptOuts said he disclosed the issue to Apple in June 2025, and multiple outlets reported that 404 Media independently verified the flaw by recovering a reporter’s actual Apple ID email from a newly created alias. Public reporting says the issue requires no account compromise, special access, or social engineering, raising risks of phishing, spam correlation, account linkage, and exposure of personal details through people-search services.

Apple reportedly acknowledged the bug in 2025 and later told Murphy that a system change had addressed it, but follow-up testing found the deanonymization still worked more than a year after disclosure. Murphy said volunteer testing showed all tested aliases were reversible, though the full scope across the user base remains unclear, and exact exploitation details were withheld while Apple continued investigating. As of the reports, Apple had not issued a public advisory or CVE, and separate coverage noted that Apple’s planned migration of masked addresses to the @private.icloud.com domain could make Hide My Email aliases easier for websites and apps to identify and block..

Fonte: https://mallory.ai/stories/019f1e04-8ca0-7064-aa71-1f2a3c97e955]]> https://ransomfeed.it/news.php?id_news=nid&nid=373 ffd52f3c7e12435a724a8f30fddadd9c 373 Wed, 01 Jul 2026 15:16:16 RansomFeed The Anubis ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring "Anubis Media" persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including XSS, BreachForums, ReHub, and RAMP, as well as X. The group reportedly listed 83 victims between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for Windows, Linux, NAS, and ESXi environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes.

Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, and mRemoteNG, then moved laterally with RDP, SMB, and PsExec. They also harvested credentials with Mimikatz, browser password exports, and ntds.dit theft, used tools such as S3 Browser, rclone, s5cmd, WinSCP, and PuTTY for exfiltration staging, and in some cases established fallback access through cloudflared, authenticated proxies, and SSH SOCKS tunnels, including activity involving Synology NAS devices..

Fonte: https://mallory.ai/stories/019f1d2a-4f07-7c99-9993-d7767fa6cb01]]> https://ransomfeed.it/news.php?id_news=nid&nid=374 ad972f10e0800b49d76fed33a21f6698 374 Wed, 01 Jul 2026 15:15:51 RansomFeed Researchers reported an active Silent Swap campaign that distributes a fake "Google Notes" browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned .NET and Golang installers to silently sideload the malicious extension into Chromium-based browsers including Chrome, Edge, Brave, and Opera, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time.

The malware reportedly abuses Chromium trust mechanisms by altering Secure Preferences and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses EtherHiding-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as devops-offensive[.]cc and Zebregts[.]com, complicating detection and takedown. The activity has been linked to the CountLoader threat actor, with infections observed globally and a heavier concentration in India, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions..

Fonte: https://mallory.ai/stories/019f1d98-6910-746a-8c03-18327effb078]]> https://ransomfeed.it/news.php?id_news=nid&nid=375 f61d6947467ccd3aa5af24db320235dd 375 Wed, 01 Jul 2026 15:12:31 RansomFeed Adobe has released Priority 1 security updates for ColdFusion and Adobe Campaign Classic to fix multiple high-severity vulnerabilities, including seven flaws rated CVSS 10.0. In ColdFusion, the patched issues affect versions 2025.9, 2023.20, and earlier, and include improper input validation (CVE-2026-48281, CVE-2026-48277), unrestricted file upload (CVE-2026-48276, CVE-2026-48283), and path traversal (CVE-2026-48282) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (CVE-2026-48313), an SSRF bug (CVE-2026-48285), and user-interaction issues such as reflected XSS (CVE-2026-48307) and improper input validation tied to malicious files (CVE-2026-48315).

Adobe also patched CVE-2026-48286 in Adobe Campaign Classic, an incorrect authorization flaw affecting version 7.4.3 and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a Priority 1 rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and Campaign Classic 7.4.4 / build 9397 or later..

Fonte: https://mallory.ai/stories/019f1cba-dbec-7d13-84af-d33305908eb0]]> https://ransomfeed.it/news.php?id_news=nid&nid=376 142949df56ea8ae0be8b5306971900a4 376 Wed, 01 Jul 2026 15:07:10 RansomFeed Citrix published a security advisory for NetScaler ADC and NetScaler Gateway, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the 14.1 and 13.1 release lines as well as certain NetScaler FIPS and NDcPP editions, and references six CVEs including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-13474. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions.

The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (CVE-2026-13474); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (CVE-2026-8655); a memory overread caused by insufficient input validation when NetScaler is configured as a SAML Identity Provider (CVE-2026-8451); and a separate memory overflow vulnerability affecting Gateway or AAA virtual servers, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy deployments (CVE-2026-8452). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior..

Fonte: https://mallory.ai/stories/019f1914-2f30-7f5f-9e51-43de4b987eb5]]> https://ransomfeed.it/news.php?id_news=nid&nid=378 8bf1211fd4b7b94528899de0a43b9fb3 378 Wed, 01 Jul 2026 12:06:54 RansomFeed A large-scale password spray campaign targeted Microsoft 365 environments through Azure CLI logins, generating more than 81 million authentication attempts and compromising at least 78 accounts across 64 organizations, according to Huntress. The attackers abused the deprecated OAuth Resource Owner Password Credentials (ROPC) flow to validate stolen username-password pairs and obtain user-delegated tokens, relying on previously breached credentials that had not been rotated.

The activity was observed between mid and late June and in some cases succeeded even where MFA and Conditional Access were enabled, because policies were misconfigured or did not fully cover Azure CLI ROPC authentication. Huntress said most attempts originated from the IPv6 range 2a0a:d683::/32, associated with LSHIY LLC (AS32167), and reported a more than 155-fold increase in credential-spray volume across its customer base over six months. Defenders were urged to enforce MFA for all users, cloud apps, and client app types, and to restrict Azure CLI access for non-admin users..

Fonte: https://mallory.ai/stories/019f1c4c-8e4d-7048-ad8e-fdac1af514fc]]>