Ionut Arghire

The second iteration of the German-speaking online crime marketplace had over 22,000 users and more than 100 sellers.

Victims span across the aviation, critical infrastructure, energy, logistics, public administration, and technology sectors.

Hackers accessed one of the company’s AWS accounts and compromised AI provider secrets stored in Braintrust.

The malware framework targets web applications and cloud environments, including AWS, Docker, Kubernetes, and more.

Lax extension permissions and improper trust implementation allow attackers to inject prompts in the Claude Chrome extension.

The company is expanding its platform’s capabilities with the acquisition of SecureIQx and Korbit.ai.

The fresh browser update resolves critical-severity integer overflow and use-after-free vulnerabilities.

The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages.

Successful exploitation of the flaws could lead to code execution, server-side request forgery attacks, and denial-of-service conditions.

Attackers could inject prompts into a GitHub issue and take over the AI agent designed to automatically triage the issue.

The startup will invest in expanding its training categories, optimizing video generation, and growing its partnership ecosystem.

Likely perpetrated by MuddyWater, the attack combined social engineering, persistence, credential harvesting, and data theft.

The persistent, evasive implant provides remote access, surveillance, and credential exfiltration capabilities.

While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems.

Containing fixes for critical-severity vulnerabilities, the monthly rollouts will focus on addressing priority issues faster.

Dubbed Bleeding Llama, the heap out-of-bounds read issue can be exploited remotely, without authentication.

The most severe of these security defects could allow remote attackers to execute arbitrary code.

Deniss Zolotarjovs was directly involved in extortion strategies and in negotiations with victim companies.

The security defects allow unauthenticated, remote attackers to execute arbitrary code through crafted requests.

Hackers delivered malware via a customer chat channel, infected an analyst’s system, and accessed the internal support portal.