Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Atlassian Rovo AI Can Be Abused to Exfiltrate Jira, Confluence Data

  Atlassian's Rovo AI assistant has been exposed to two independent attack techniques that could cause it to retrieve Jira and Confluen...

All the recent news you need to know
Cyber Security
AI Air Traffic Business Cloudfare Cyber Security

Cloudflare Increases Annual Revenue Projection After AI Driven Traffic


Following impressive quarterly results, Cloudflare increased its full-year revenue projection above Wall Street expectations, wagering that the quick development of AI agents will continue to drive traffic throughout its network, which caused its shares to climb 18% after the bell.

More companies depending on Cloudflare

Demand for Cloudflare's cloud and security products has increased as more companies depend on its network to reliably route traffic and execute those technologies due to the rush to develop and expand AI agents.

Machines driving traffic

For the first time, machines rather than people accounted for more than half of the traffic that passed throughout Cloudflare's (NYSE: NET) network last quarter.

Following Thursday's second-quarter results, the internet infrastructure company's shares surged to a record high on Friday morning, reaching over $325 before partially reversing the day's gains.

During the results call, CEO Matthew Prince stated, "In Q2, more than 50% of the traffic flowing across Cloudflare's network was not human for the first time in human history." Months before his own prediction, which had indicated the first part of 2027, the crossover occurred.

About the growth

In light of this, Cloudflare increased its full-year revenue forecast to a range of $2.864 billion to $2.870 billion, or roughly 32% growth, and revenue increased 36% year over year to $696.1 million. Free cash flow increased 69% year over year to $56.4 million, while adjusted earnings per share came in at $0.29. Management directed revenue to increase by roughly 31% to $736 million to $737 million for the third quarter.

Additionally, there was a significant increase in customers. At the end of June, Cloudflare had 4,698 major customers, those that spend more than $100,000 annually, a 27% increase over the previous year. Additionally, current customers are spending more; dollar-based net retention, which measures how much the same customers spend after churn compared to a year ago, reached 120%, up 6 percentage points from a year ago and 2 percentage points from the first quarter.

Who pays Cloudflare?

Cloudflare is not yet paid by the machine traffic itself. Businesses who use the company's network for speed and cybersecurity pay subscriptions.

Therefore, handling a rapidly increasing amount of artificial intelligence (AI) crawler traffic primarily increases costs without increasing revenue. By that metric, Cloudflare becomes busier rather than larger in a majority-machine network.

Read more »
Malware attacks
Cryptocurrency Crime Cyber Security fake websites Malvertising Malvertising Campaign Malware attacks

Malvertising Campaign Uses Fake Crypto Websites to Build Malware Directly in Browser Memory

 

A major malvertising campaign targets crypto investors and traders with fake Solana, Luno and TradingView sites offering to install malicious JavaScript on users’ browsers, which then proceeds to construct malware locally on the victim’s machine, as opposed to delivering a compiled and ready-to-use executable over the network. The campaign has been active since the end of 2024 and has been localized in 25 languages and regions, with 12 countries being identified as the primary targets, with activity being particularly prominent in the Asia-Pacific and Latin American regions. 

Attackers appear to have implemented a filtering mechanism in order to avoid detection, with researchers postulating that the attackers may be able to distinguish between real users and scanners or researchers attempting to investigate the campaign. Researchers have noted that what makes the campaign particularly noteworthy is the way it leverages the user’s browser to facilitate the generation of malware on the victim’s machine. 

In contrast to traditional malvertising attacks, in which exploit kits are used to deliver payloads, this campaign appears to make use of Service Workers and Shared Workers in order to construct the malware. Initially, the target is directed to a fraudulent website, which proceeds to register a Service Worker that will be responsible for facilitating the download of the malware. A Shared Worker is then used for the assembly of the malware, which receives the necessary instructions and components via the Service Worker. 

Notably, the website is reported to be requesting configuration data in order to construct files with varying hashes, which would allow the attackers to bypass security measures such as signature-based detection. Instead of delivering an executable file, the site then responds with the data necessary for the browser to compile the file locally, with the components being downloaded and compiled in conjunction with remote resources in order to generate the final payload. It should be noted that the file reportedly makes use of a sanitized version of Bun executable. 

It is reported that the generated file is then delivered back to the Service Worker and eventually downloaded by the browser as if it were a legitimate file, which would explain why the malware would not be detected by conventional security measures. In addition, researchers note that the file may be challenging to analyze, as the final payload would only be available once the browser constructs it. Researchers note that the campaign, which goes by the name of SourTrade, previously made use of the StreamSaver project to deliver payloads, but has since switched to distributing malware via Service Workers. 
Reporters have noted that the techniques made use of by the campaign are similar to those described in a previous Bitdefender report on malware that was able to hijack encrypted traffic and exfiltrate sensitive data such as cookies, passwords, cryptocurrency wallet credentials, record keystrokes, take screenshots and maintain persistence on the target machine. Due to the fact that the campaign specifically targets cryptocurrency and trading platforms, it is possible that attackers will be able to leverage the stolen information to gain unauthorized access to the victim’s accounts. 

As such, users are advised to avoid downloading any cryptocurrency or trading-related applications via social media or search engines, and to only download such applications directly on the company’s official website whenever possible.
Read more »
User Privacy
Data Breach Korean Military medical records South Korea User Privacy

South Korean Military Medical System Breached, 1.15 Million Records at Risk

 

South Korea’s military has reported unauthorized access to a medical imaging system containing sensitive records linked to approximately 1.15 million people. The incident involved the Armed Forces Medical Command’s mobile Picture Archiving and Communication System, commonly known as PACS, which enables medical staff to view X-rays, CT scans and MRI images. Although investigators have not confirmed that information was stolen, the breach has raised serious concerns about the security of military healthcare data. 

According to the Defense Ministry, the intrusion took place between November and December 2025 and may have involved approximately 8 gigabytes of medical information. This estimate was based on network traffic, rather than a confirmed list of downloaded files. Officials said the amount could be equivalent to nearly 1,000 X-ray images, but they have not identified the exact records that may have been viewed or accessed. 

The potentially exposed information includes patients’ names, sex, ages, medical imaging dates and diagnostic images. The system was used by six military hospitals located in Goyang, Yangju, Pocheon, Gangneung, Guri and Daegu. However, authorities emphasized that the figure of 1.15 million represents all individuals whose records were stored in the system, not the number of people whose information was definitely accessed or copied. 

The breach was discovered in April during a security inspection led by the Defense Counterintelligence Command. In June, the Defense Ministry, Defense Cyber Command, Defense Counterintelligence Command and Armed Forces Medical Command formed a joint investigation team to determine how the unauthorized access occurred and assess its full impact. Investigators reportedly found that an open network communications port allowed the intruder to enter the system, and that the port remained exposed from November 2025 until March 2026. 

The military suspended the medical imaging system immediately after identifying the incident. Officials have not disclosed the identity or origin of the intruder, nor have they confirmed whether any medical information was transferred outside the network. The case highlights the risks created by exposed network ports and insufficient access controls, particularly in systems containing health and military data. South Korea’s Defense Ministry said it would correct the identified weaknesses and strengthen cybersecurity measures to prevent similar incidents in the future.
Read more »
U.S. Passport Security
Aluminum Foil Passport Hack Data Privacy Passport Data Security Passport Privacy RFID Data Protection RFID Passport RFID Skimming Travel Cybersecurity U.S. Passport Security

U.S. Travelers Warned Against Wrapping Passports in Aluminum Foil Over Data Theft Fears


Travel “privacy hacks” encouraging travelers to secure their passports in aluminum foil are bringing renewed attention as concerns grow over electronic data theft. In addition to not recommending the practice, U.S. Customs and Border Protection (CBP) warns that modifying or covering travel documents may interfere with inspections. Concerns have been expressed regarding the possibility that unauthorized readers could potentially scan the RFID chip embedded in modern U.S. passports. 

In some cases, aluminum foil is regarded as a temporary Faraday shield, blocking radio signals from reaching the chip in a passport. Security concerns concerning passport RFID technology cannot be dismissed entirely. RFID readers can communicate with chips at short distances, but their effective range is affected by the antenna and power of the reader. 

The range of surveillance can be extended by specialized equipment, but such systems are generally unsuitable for routine, covert tracking of travelers, according to reports cited by travel and security experts. A U.S. passport's RFID chip, however, may be overstated. The passport's data page consists of information that has already been printed, including information about the holder, his or her biometric and photographic characteristics, as well as a cryptographic signature for authentication. 

U.S. passports are also equipped with multiple security features designed to prevent counterfeiting and tampering. The new Next Generation Passports, introduced in 2021, are constructed of a durable polycarbonate data page with embedded security features, laser engraving, complex artwork, security fibers and perforated passport numbers. Previously, RFID chips and antennas were contained inside the back cover of older U.S. e-passports. 

A new generation passport was introduced in 2021 that replaced the chip with a rigid, multilayered polycarbonate data page. It was intended to improve the document's durability and make it more protected against tampering. 

CBP Does Not Endorse Aluminum Foil Passport Covers

As reported by TheTravel, CBP does not evaluate, test, or endorse third-party passport covers or DIY modifications, such as aluminum foil. It is imperative that travel documents are presented in their original condition at ports of entry without any modification or obstructions that could interfere with document-reading systems.

The importance of aluminum foil lies in the fact that it can scratch, crease, or otherwise damage a passport. CBP considers issues such as water damage, smudged ink, chemical stains, faded artwork, cracked data pages and heat-related warping among forms of passport damage that can create problems during travel. 

Passport RFID Protection May Be Unnecessary

It is also important to consider the security concerns related to passport RFID chips in context. When a passport is closed, its construction prevents radio signals from reaching the chip. Further, the chip is protected using cryptographic measures, including Basic Access Control, preventing unauthorized access to its stored data. There is no continuous broadcast of a traveler’s location by a passport chip, unlike smartphones or GPS trackers. 

By carrying an electronic passport, criminals are not able to remotely track its movements. In addition to preventing unauthorized access to the information stored on the chip when the passport is open, Basic Access Control (BAC) protects the information stored on the chip when it is opened. The chip is also not able to be used as a tracking device. 

A passport cannot be used to routinely track a traveler's location because, unlike a smartphone or an AirTag, it does not continuously transmit a traveler's location. If travelers wish to protect their passports against everyday wear and tear, spills and physical damage, they can use a conventional passport cover to protect their passports. It is neither recommended nor necessary to wrap a passport in aluminum foil as a routine security measure. 

As a general rule of thumb, travelers should use the security features incorporated into modern passports rather than viral DIY privacy measures that may potentially damage an important travel document. In light of continuing advances in passport technology, travelers should rely on built-in security features rather than unverified viral hacks to ensure their passports remain secure. Passports must be kept in good physical condition in addition to protected data.
Read more »
OpenAI
AI-Powered Cybercrime Cambodia Scam Network ChatGPT Abuse Cyber Fraud human trafficking Investment fraud Online Fraud OpenAI

OpenAI Disrupts Cambodia-Based Scam Network That Used ChatGPT for Global Fraud Campaigns


The use of ChatGPT by OpenAI has enabled it to dismantle a coordinated scam operation based in Poipet, Cambodia which used ChatGPT for multiple online fraud schemes, including investment scams, romance scams, illegal gambling promotion, and impersonating police officers. According to the company, the network operated in an area that has historically been associated with organized cybercrime, scam compounds, and human trafficking. 


Using ChatGPT, OpenAI asserted that the operation was capable of creating convincing fake online identities, generating multilingual messages, translating conversations, and creating promotional materials for fraudulent campaigns using ChatGPT. Furthermore, the AI tool was used in order to streamline the internal administrative tasks of the criminal operation, such as drafting announcements, maintaining employee records, tracking salary deductions, visa statuses, recruitment incentives, and financial obligations.

In a statement, OpenAI said that the investigation was initiated after WhatsApp provided intelligence that led to the identification of coordinated ChatGPT abuse. As the company notes, the network employed AI models for both generating fake online personas and messages, translating conversations, producing promotional content, and managing day-to-day operations, thus demonstrating how generative AI can significantly enhance cyber fraud efficiency and scale. 

There were several noteworthy aspects of the campaign, including social media advertisements advertising "chatter" jobs in Poipet. Specifically, the advertisement targeted job seekers in India and Bangladesh with salaries of $800, performance bonuses, free flights, lodging, meals, work permits, and Cambodian visas for one year. This offer is believed to have been made to lure victims into scam compounds, where forced labor is often practiced. 

OpenAI said its investigation, in collaboration with WhatsApp, resulted in the removal of a coordinated cluster of ChatGPT accounts, which originated from Southeast Asia. The criminal group was operating multiple fraud schemes simultaneously in contrast to one fraud scheme at a time. The victims were contacted via messaging platforms such as WhatsApp and Telegram by individuals who presented themselves as dating profiles, investment advisors, gambling platform representatives, or law enforcement officials using fabricated dating profiles.

In order to build trust with victims, these personas were designed to persuade them to invest in cryptocurrencies or gold trading schemes, to pay fabricated activation fees, to claim fake winnings, or to pay bogus legal fines. An attacker uses forged passports, legal notices, investment confirmations, fabricated payment screenshots, as well as interfaces for gambling platforms to convince victims that their transactions are legitimate. 

According to OpenAI, the scammers employed a ping-zing-sting method to establish contact with potential victims, gain their trust through extended conversations, and ultimately pressure them into making financial payments. A scam compound operated by organized criminal groups was located in Poipet, a Cambodian city widely known for hosting scam operations. 

In the region, there has been a sustained pattern of large-scale cyber fraud and human trafficking operations, in which victims are lured with false job offers and then coerced into conducting online scams against people across the globe. 

There was also evidence of links between the operation and human trafficking, as some artificial intelligence generated content suggested workers were recruited through deceptive job offers, before their passports were confiscated and they were forced into scams. Moreover, investigators discovered internal conversations indicating that some workers recruited through these advertisements may have been victims of human trafficking. 

According to OpenAI, the records referenced employee debts, disciplinary fines, immigration problems, visa overstays, and even discussions about detentions, escape attempts, and criminal liability, illustrating the exploitative nature of scam compounds. However, OpenAI said internal communications indicated the network may have targeted several fraud campaigns and hundreds of victims, with some conversations referring to individual losses worth thousands of dollars, although the full financial impact has not yet been established. 

In light of the disruption, generative artificial intelligence is playing an increasingly important role in organized cybercrime, enabling threat actors to automate content creation, social engineering, and operational management in unprecedented quantities. The findings also aligned with a recent INTERPOL assessment, which indicated that artificial intelligence has increasingly been utilized throughout the cyberattack lifecycle, from reconnaissance and phishing to extortion and evasion. 

While law enforcement agencies are continuing to target scam compounds across Southeast Asia, experts caution that these operations continue to expand into other regions, causing concern about the global reach of AI-assisted cyber fraud.
Read more »
Snowflake
Cloud data security Extortion malware Ransomware Snowflake

Canadian Hacker Pleads Guilty for Stealing Data and Extortion


A Canadian man recently pleaded guilty in a U.S. federal court in planning one of the largest data theft campaigns in recent times, to his involvement in retrieving organization accounts at cloud storage provider company Snowflake. He stole data from 165 companies in an attempt to extort millions of dollars from the targets. 

Connor Riley Moucka is 26-yr old, and also worked under aliases Waifu and Alexander Moucka, was arrested on October 30, 2024, for stealing information from millions of people from organizations that used Snowlake’s storage features. Moucka admitted to four charges: computer fraud, wire fraud, aggravated identity theft, and a related conspiracy count, out of an original 11-count indictment.

How did the attacks happen?

Between February and October 2024, Moucka and his partner John Erin Binns, also arrested for these attacks, accessed Snowflake accounts. Rather than exploiting a flaw in Snowflake's platform itself, the pair relied on credentials harvested through infostealer malware to log into customer accounts. They stole accounts that were not secured by multi-factor authentication (MFA) via login credentials through an infostealer malware.

Without MFA protection, the hackers only needed the right usernames and passwords to sign into customer accounts. After gaining access, the hackers only needed custom-built software to sail through cloud storage incidents for important information.

The illegal access was used for identifying important information such as user roles, IP addresses, and organization name in cloud storage incidents that used Snowflake services.

The accused tried to blackmail various firms after stealing TBs of data from their Snowflake user accounts and got around $2.5 million in bitcoin from three targets.

Scale of the campaign

According to the prosecutors, the campaign exploited data linked to over 100 million individuals and resulted in $9.5 million losses for organizations. The list of impacted companies include: Ticketmaster, Santander, AT&T, Advance Auto Parts, Los Angeles Unified School District, Pure Storage, QuoteWizard/LendingTree, and Neiman Marcus.

Moucka allegedly stole around $495,000 from ransom payments. AT&T paid around $370,000 to avoid future leaks of text records and customer calls. 

“In at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data,” the US Department of Justice said in a press release. 

“Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt.” 

Read more »
Subscribe to: Posts (Atom)

Featured