Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Smart Homes Under Threat: How to Reduce the Risk of IoT Device Hacking

  Most households today use some form of internet of things (IoT) technology, whether it’s a smartphone, tablet, smart plugs, or a network ...

All the recent news you need to know
malware
APT41 China cybersecurity Southeast Asia Cyberthreats malware

China-Linked Hackers Step Up Quiet Spying Across South-East Asia

Threat actors linked to China have been blamed for a new wave of cyber-espionage campaigns targeting government and law-enforcement agencies across South-East Asia during 2025, according several media reports. Researchers at Check Point Research said they are tracking a previously undocumented cluster, which they have named Amaranth-Dragon, that has targeted Cambodia, Thailand, Laos, Indonesia, Singapore and the Philippines. 

The activity shows technical and operational links to APT41, a well-known Chinese hacking ecosystem.  
“Many of the campaigns were timed to coincide with sensitive local political developments, official government decisions, or regional security events,” Check Point said. “By anchoring malicious activity in familiar, timely contexts, the attackers significantly increased the likelihood that targets would engage with the content.” 

The firm described the operations as tightly scoped and deliberately restrained, suggesting an effort to establish long-term access rather than cause disruption. Infrastructure was configured to communicate only with victims in specific countries, reducing the risk of discovery. 

A key technique involved exploiting CVE-2025-8088, a now-patched flaw in WinRAR that allows arbitrary code execution when a malicious archive is opened. Check Point said the group began exploiting the vulnerability within days of its public disclosure in August. “The speed and confidence with which this vulnerability was operationalised underscores the group’s technical maturity and preparedness,” the researchers said. 

Although the initial infection vector remains unclear, analysts believe spear-phishing emails were used to distribute malicious RAR files hosted on cloud services such as Dropbox. Once opened, the archive launches a loader using DLL side-loading, a tactic frequently associated with Chinese groups. The loader then retrieves an encryption key from one server, decrypts a payload from another location and executes it directly in memory. 

The final stage deploys Havoc, an open-source command-and-control framework. Earlier versions of the campaign relied on ZIP files containing Windows shortcuts and batch files, while a separate operation in Indonesia delivered a custom remote-access trojan known as TGAmaranth RAT. That malware used a hard-coded Telegram bot for command and control and supported functions such as taking screenshots, running shell commands and transferring files. 

Check Point said the command infrastructure was shielded by Cloudflare and restricted by geography, accepting traffic only from targeted countries. Compilation times and working patterns pointed to operators based in China’s time zone. 

“In addition, the development style closely mirrors established APT41 practices,” the company said, adding that overlaps in tools and techniques suggest shared resources within the ecosystem. The findings come as another Chinese group, Mustang Panda, was linked to a separate espionage campaign uncovered by Dream Research Labs. The operation, dubbed PlugX Diplomacy, targeted officials involved in diplomacy, elections and international coordination between December 2025 and mid-January 2026.  

“Rather than exploiting software vulnerabilities, the operation relied on impersonation and trust,” Dream said. 

Victims were lured into opening files disguised as diplomatic or policy documents, which triggered infection automatically. The files installed a modified version of PlugX, a long-used Chinese espionage tool, through a multi-step process involving Windows shortcuts, PowerShell scripts and DLL search-order hijacking using a legitimate signed executable. A decoy document was shown to victims while the malware quietly embedded itself in the system. 

“The correlation between actual diplomatic events and the timing of detected lures suggests that analogous campaigns are likely to persist as geopolitical developments unfold,” Dream concluded.
Read more »
Technology
AI Apple Data Google Internet Microsoft Techno Technology

Experts Find Malicious Browser Extensions, Chrome, Safari, and Edge Affected


Threat actors exploit extensions

Cybersecurity experts found 17 extensions for Chrome, Edge, and Firefox browsers which track user's internet activity and install backdoors for access. The extensions were downloaded over 840,000 times. 

The campaign is not new. LayerX claimed that the campaign is part of GhostPoster, another campaign first found by Koi Security last year in December. Last year, researchers discovered 17 different extensions that were downloaded over 50,000 times and showed the same monitoring behaviour and deploying backdoors. 

Few extensions from the new batch were uploaded in 2020, exposing users to malware for years. The extensions appeared in places like the Edge store and later expanded to Firefox and Chrome. 

Few extensions stored malicious JavaScript code in the PNG logo. The code is a kind of instruction on downloading the main payload from a remote server. 

The main payload does multiple things. It can hijack affiliate links on famous e-commerce websites to steal money from content creators and influencers. “The malware watches for visits to major e-commerce platforms. When you click an affiliate link on Taobao or JD.com, the extension intercepts it. The original affiliate, whoever was supposed to earn a commission from your purchase, gets nothing. The malware operators get paid instead,” said Koi researchers. 

After that, it deploys Google Analytics tracking into every page that people open, and removes security headers from HTTP responses. 

In the end, it escapes CAPTCHA via three different ways, and deploy invisible iframes that do ad frauds, click frauds, and tracking. These iframes disappear after 15 seconds.

Besides this, all extensions were deleted from the repositories, but users shoul also remove them personally. 

This staged execution flow demonstrates a clear evolution toward longer dormancy, modularity, and resilience against both static and behavioral detection mechanisms,” said LayerX. 

The PNG steganography technique is employed by some. Some people download JavaScript directly and include it into each page you visit. Others employ bespoke ciphers to encode the C&C domains and use concealed eval() calls. The same assailant. identical servers. many methods of delivery. This appears to be testing several strategies to see which one gets the most installs, avoids detection the longest, and makes the most money.

This campaign reflects a deliberate shift toward patience and precision. By embedding malicious code in images, delaying execution, and rotating delivery techniques across identical infrastructure, the attackers test which methods evade detection longest. The strategy favors longevity and profit over speed, exposing how browser ecosystems remain vulnerable to quietly persistent threats.

Read more »
Liquidity Pool
Cyber Security Finance Sector Financial Loss Flash Loan Flash Loan Attack Illicit Trade Liquidity Pool

Makina Finance Loses $4M in ETH After Flash Loan Price Manipulation Exploit

 

One moment it was operating normally - then suddenly, price feeds went haywire. About 1,299 ETH vanished during what looked like routine activity. That sum now exceeds four million dollars in value. The trigger? A flash loan attack targeting Makina Finance, built on Ethereum. Not a hack of code - but an economic twist inside the system. Security teams such as PeckShield traced moves across the DUSD–DUSDC liquidity pool. Borrowed funds flooded in, shifting valuations without breaking access rules. Prices bent under pressure from artificial trades. Afterward, profits drained off-chain. What stayed behind were distorted reserves and puzzled users. No stolen keys. No failed signatures. Just manipulation riding allowed functions too far. 

The exploit started, researchers say, with a $280 million flash loan taken in USDC. Of that amount, roughly $170 million went toward distorting data from the MachineShareOracle, which sets values for the targeted liquidity pool. With prices artificially raised, trades worth around $110 million passed through the system - leaving over 1,000 ETH missing afterward. What happened fits a known pattern: manipulating value via temporary shifts in market depth. Since Makina's setup depended on immediate price points, sudden influxes of borrowed funds were enough to warp them. Inserting capital, pushing valuations up, then pulling assets out while gains lasted exposed a flaw built into how prices are calculated.  

Even though the exploit worked, the hacker did not receive most of the stolen money. A different actor, an MEV builder, stepped in ahead during the draining transaction and took nearly all the ETH pulled out. According to PeckShield, this twist could make getting back the assets more likely. Yet, there has been no public word from Makina on whether they have reached out to - or even found - the MEV searcher responsible. 

After reviewing what happened, Makina explained the vulnerability only touched its DUSD–DUSDC Curve pool, leaving everything else untouched. Security measures kicked in across all Machines - its smart vault network - as checks continue into how deep the effects go. To stay safe, users putting liquidity in that specific pool got a heads-up to pull out whatever they had left. More details will come once the team learns more through their ongoing review. 

Not long ago, flash loan attacks started showing up more often in DeFi. By October, the Bunni exchange closed for good following one such incident - $8.4 million vanished fast. Its team said restarting safely would mean spending too much on checks and oversight. Just weeks before, another hit struck Shibarium, a layer-two system. That breach pulled out $2.4 million in value almost instantly. 

Even so, wider trends hint at slow progress. Chainalysis notes that losses tied to DeFi stayed modest in 2025, though value held in decentralized systems climbed back near earlier peaks. Despite lingering dangers from flash loans, safeguards within the space seem to be growing more resilient over time.
Read more »
Technology
AI Scanner Business Security LLM Microsoft Technology

Microsoft Unveils Backdoor Scanner for Open-Weight AI Models

 

Microsoft has introduced a new lightweight scanner designed to detect hidden backdoors in open‑weight large language models (LLMs), aiming to boost trust in artificial intelligence systems. The tool, built by the company’s AI Security team, focuses on subtle behavioral patterns inside models to reliably flag tampering without generating many false outcomes. By targeting how specific trigger inputs change a model’s internal operations, Microsoft hopes to offer security teams a practical way to vet AI models before deployment.

The scanner is meant to address a growing problem in AI security: model poisoning and backdoored models that act as “sleeper agents.” In such attacks, threat actors manipulate model weights or training data so the model behaves normally in most scenarios, but switches to malicious or unexpected behavior when it encounters a carefully crafted trigger phrase or pattern. Because these triggers are narrowly defined, the backdoor often evades normal testing and quality checks, making detection difficult. Microsoft notes that both the model’s parameters and its surrounding code can be tampered with, but this tool focuses primarily on backdoors embedded directly into the model’s weights.

To detect these covert modifications, Microsoft’s scanner looks for three practical signals that indicate a poisoned model. First, when given a trigger prompt, compromised models tend to show a distinctive “double triangle” attention pattern, focusing heavily on the trigger itself and sharply reducing the randomness of their output. Second, backdoored LLMs often leak fragments of their own poisoning data, including trigger phrases, through memorization rather than generalization. Third, a single hidden backdoor may respond not just to one exact phrase, but to multiple “fuzzy” variations of that trigger, which the scanner can surface during analysis.

The detection workflow starts by extracting memorized content from the model, then analyzing that content to isolate suspicious substrings that could represent hidden triggers. Microsoft formalizes the three identified signals as loss functions, scores each candidate substring, and returns a ranked list of likely trigger phrases that might activate a backdoor. A key advantage is that the scanner does not require retraining the model or prior knowledge of the specific backdoor behavior, and it can operate across common GPT‑style architectures at scale. This makes it suitable for organizations evaluating open‑weight models obtained from third parties or public repositories.

However, the company stresses that the scanner is not a complete solution to all backdoor risks. It requires direct access to model files, so it cannot be used on proprietary, fully hosted models. It is also optimized for trigger‑based backdoors that produce deterministic outputs, meaning more subtle or probabilistic attacks may still evade detection. Microsoft positions the tool as an important step toward deployable backdoor detection and calls for broader collaboration across the AI security community to refine defenses. In parallel, the firm is expanding its Secure Development Lifecycle to address AI‑specific threats like prompt injection and data poisoning, acknowledging that modern AI systems introduce many new entry points for malicious inputs.
Read more »
XSS Mitigation
Cloud Security Cross-Site Scripting CVE-2026-1591 Enterprise Document Security Foxit eSign Foxit PDF Editor Cloud PDF Security Risks Vulnerabilities and Exploits Web Application Security XSS Mitigation

Foxit Publishes Security Patches for PDF Editor Cloud XSS Bugs


 

In response to findings that exposed weaknesses in the way user-supplied data was processed within interactive components, Foxit Software has issued a set of security fixes intended to address newly identified cross-site scripting vulnerabilities. 

Due to the flaws in Foxit PDF Editor Cloud and Foxit eSign, maliciously crafted input could be rendered in an unsafe manner in the user's browser, potentially allowing arbitrary JavaScript execution during authenticated sessions. 

The fundamental problem was an inconsistency in input validation and output encoding in some UI elements (most notably file attachment metadata and layer naming logic), which enabled attacker-controlled payloads to persist and be triggered during routine user interactions. 

Among these issues, the most important one, CVE-2026-1591, affected the File Attachments list and Layers panel of Foxit PDF Editor Cloud, thus emphasizing the importance of rigorously enforcing client-side trust boundaries in order to prevent the use of seemingly low-risk document features as attack vectors. 

These findings were supported by Foxit's confirmation that the identified weaknesses were related to a specific way in which certain client-side components handled untrusted input within a cloud environment. Affected functionality allowed for the processing of user-controlled values — specifically file attachment names and PDF layer identifiers — without sufficient validation or encoding prior to rendering in the browser. 

By injecting carefully constructed payloads into the application's HTML context, carefully constructed payloads could be executed upon the interaction between an authenticated user and the affected interface components. In response to these security deficiencies, Foxit published its latest security updates, which it described as routine security and stability enhancements that require no remediation other than ensuring deployments are up to date. 

The advisory also identifies two vulnerabilities, tracked as CVE-2026-1591 and CVE-2026-1592, which are both classified under CWE-79 for cross-site scripting vulnerabilities. Each vulnerability has a CVSS v3.0 score of 6.3 and is rated Moderate in severity according to the advisory. 

Foxit PDF Editor Cloud is impacted by CVE-2026-1591, which has a significant impact on its File Attachments and Layers panels due to insufficient input validation and improper output encoding which can allow arbitrary JavaScript execution from the browser. 

The vulnerability CVE-2026-1592 poses a comparable risk through similar paths to data handling. Both vulnerabilities were identified and responsibly disclosed by Novee, a security researcher. However, the potential consequences of exploitation are not trivial, even if user interaction is required. In order to inject a script into a trusted browser context, an attacker would have to persuade a logged-in user to open or interact with a specially crafted attachment or altered layer configuration. 

By executing this script, an attacker can hijack a session, obtain unauthorized access to sensitive document data, or redirect the user to an attacker-controlled resource. As a result, the client-side trust assumptions made by document collaboration platforms pose a broader risk, particularly where dynamic document metadata is not rigorously sanitized. 

During the disclosure period, the source material did not enumerate specific CVE identifiers for each individual flaw, apart from those referenced in the advisory. The vulnerability involved in cross-site scripting has been extensively documented across a wide array of web-based applications and is routinely cataloged in public vulnerability databases such as MITRE's CVE repository.

XSS vulnerabilities in unrelated platforms, such as those described in CVE-2023-38545 and CVE-2023-38546, underscore the broader mechanics and effects of this attack category. This type of example is not directly related to Foxit products, but nevertheless is useful for gaining an understanding of how similar weaknesses may be exploited when web-rendered interfaces mishandle user-controlled data. 


Technically, Foxit PDF Editor Cloud is exploitable via the way it ingests, stores, and renders user-supplied metadata within interactive components like the File Attachments list and Layers dialog box. If input is not rigorously validated, an attacker may embed executable content (such as script tags or event handlers) into attachment filenames or layer names embedded within a PDF file without rigorous input validation. 

Upon presenting these values to the browser without appropriate output encoding, the application unintentionally enables the browser to interpret the injected content as active HTML or JavaScript as opposed to inert text. As soon as the malicious script has been rendered, it is executed within the security context of the authenticated user's session. 

The attacker can exploit the execution environment to gain access to session tokens and other sensitive browser information, manipulate the on-screen content, or redirect the user to unauthorized websites. Foxit cloud environments can be compromised with scripts that can perform unauthorized actions on behalf of users in more advanced scenarios. 

It is important to note that the risk is heightened by the low interaction threshold required to trigger exploitation, since simply opening or viewing a specially crafted document may trigger an injected payload, emphasizing the importance of robust client-side sanitization in cloud-based document platforms. 

These flaws are especially apparent in enterprise settings where Foxit PDF Editor Cloud is frequently integrated into day-to-day collaboration workflows. In such environments, employees exchange and modify documents sourced from customers, partners, and public repositories frequently, thereby increasing the risk that maliciously crafted PDFs could enter the ecosystem undetected. 

As part of its efforts to mitigate this broader risk, Foxit also publicly revealed and resolved a related cross-site scripting vulnerability in Foxit eSign, tracked as CVE-2025-66523, which was attributed to improper handling of URL parameters in specially constructed links. 

By enabling users to access these links with authenticated access, the untrusted input could be introduced into JavaScript code paths and HTML attributes without sufficient encoding, which could result in privilege escalation or cross-domain data exposure. A fix for this problem was released on January 15, 2026. 

Foxit confirmed that all identified vulnerabilities, including CVE-2026-1591, CVE-2026-1592, and CVE-2025-66523, have been fully addressed thanks to updates that strengthen both input validation and output encoding across all affected components. As a result of Foxit PDF Editor Cloud's automated updates or standard update mechanisms, customers are not required to perform any additional configuration changes. 

However, organizations are urged to verify that all instances are running the latest version of the application and remain alert for indicators such as unexpected JavaScript execution, anomalous editor behavior, or irregular entries in application logs which may indicate an attempt at exploitation.

Based on aggregate analysis, these issues are the result of a consistent breakdown in the platform's handling of user-controlled metadata during rendering of the File Attachments list and Layers panel. Insufficient validation controls allow attackers to introduce executable content through seemingly benign fields, such as attachment filenames or layer identifiers, through which malicious content may be introduced. This content, since it is not properly encoded, is interpreted by the browser as active code rather than plain text due to the lack of proper output encoding.

The injected JavaScript executes within the context of an authenticated session when triggered, resulting in a variety of outcomes, including data disclosure, interface manipulation, forced navigation, and unauthorised actions under the user's privilege. In addition to the low interaction threshold, the operational risks posed by these flaws are also highlighted by their limited access. 

While Foxit's remediation efforts address the immediate technical deficiencies, effective risk management extends beyond patch deployment alone. Organizations must ensure that all cloud-based instances are operating on current versions by applying updates promptly. 

In addition to these safeguards, other measures can be taken to minimize residual exposure, such as restricting document collaboration to trusted environments, enforcing browser content security policies, and monitoring application behavior for abnormal script execution.

Additional safeguards, such as web application firewalls and intrusion detection systems, are available at the perimeter of the network to prevent known injection patterns from reaching end users. Together with user education targeted at handling unsolicited documents and suspicious links, these measures can mitigate the broader threat posed by client-side injection vulnerabilities in collaborative documents.
Read more »
Rhysida
California Databreach Exposed Patient Records Healthcare Privacy ransomware attacks Rhysida

Tribal Health Clinics in California Report Patient Data Exposure

 


Patients receiving care at several tribal healthcare clinics in California have been warned that a cyber incident led to the exposure of both personal identification details and private medical information. The clinics are operated by a regional health organization that runs multiple facilities across the Sierra Foothills and primarily serves American Indian communities in that area.

A ransomware group known as Rhysida has publicly claimed responsibility for a cyberattack that took place in November 2025 and affected the MACT Health Board. The organization manages several clinics in the Sierra Foothills region of California that provide healthcare services to Indigenous populations living in nearby communities.

In January, the MACT Health Board informed an unspecified number of patients that their information had been involved in a data breach. The organization stated that the compromised data included several categories of sensitive personal information. This exposed data may include patients’ full names and government-issued Social Security numbers. In addition to identity information, highly confidential medical details were affected. These medical records can include information about treating doctors, medical diagnoses, insurance coverage details, prescribed medications, laboratory and diagnostic test results, stored medical images, and documentation related to ongoing care and treatment.

The cyber incident caused operational disruptions across MACT clinic systems starting on November 20, 2025. During this period, essential digital services became unavailable, including phone communication systems, platforms used to process prescription requests, and scheduling tools used to manage patient appointments. Telephone services were brought back online by December 1. However, as of January 22, some specialized imaging-related services were still not functioning normally, indicating that certain technical systems had not yet fully recovered.

Rhysida later added the MACT Health Board to its online data leak platform and demanded payment in cryptocurrency. The amount requested was eight units of digital currency, which was valued at approximately six hundred sixty-two thousand dollars at the time the demand was reported. To support its claim of responsibility, the group released sample files online, stating that the materials were taken from MACT’s systems. The files shared publicly reportedly included scans of passports and other internal documents.

The MACT Health Board has not confirmed that Rhysida’s claims are accurate. There is also no independent verification that the files published by the group genuinely originated from MACT’s internal systems. At this time, it remains unclear how many individuals received breach notifications, what method was used by the attackers to access MACT’s network, or whether any ransom payment was made. The organization declined to provide further information when questioned.

In its written notification to affected individuals, MACT stated that it experienced an incident that disrupted its information technology operations. The organization reported that an internal investigation found that unauthorized access occurred to certain files stored on its systems during a defined time window between November 12 and November 20, 2025.

The health organization is offering eligible individuals complimentary identity monitoring services. These services are intended to help patients detect possible misuse of personal or financial information following the exposure of sensitive records.

Rhysida is a cybercriminal group that first became active in public reporting in May 2023. The group deploys ransomware designed to both extract sensitive data from victim organizations and prevent access to internal systems by encrypting files. After carrying out an attack, the group demands payment in exchange for deleting stolen data and providing decryption tools that allow victims to regain access to locked systems. Rhysida operates under a ransomware-as-a-service model, in which external partners pay to use its malware and technical infrastructure to carry out attacks and collect ransom payments.

The group has claimed responsibility for more than one hundred confirmed ransomware incidents, along with additional claims that have not been publicly acknowledged by affected organizations. On average, the group’s ransom demands amount to several hundred thousand dollars per incident.

A significant portion of Rhysida’s confirmed attacks have targeted hospitals, clinics, and other healthcare providers. These healthcare-related incidents have resulted in the exposure of millions of sensitive records. Past cases linked to the group include attacks on healthcare organizations in multiple U.S. states, with ransom demands ranging from over one million dollars to several million dollars. In at least one case, the group claimed to have sold stolen data after a breach.

Researchers tracking cybersecurity incidents have recorded more than one hundred confirmed ransomware attacks on hospitals, clinics, and other healthcare providers across the United States in 2025 alone. These attacks collectively led to the exposure of nearly nine million patient records. In a separate incident reported during the same week, another healthcare organization confirmed a 2025 breach that was claimed by a different ransomware group, which demanded a six-figure ransom payment.

Ransomware attacks against healthcare organizations often involve both data theft and system disruption. Such incidents can disable critical medical systems, interfere with patient care, and create risks to patient safety and privacy. When hospitals and clinics lose access to digital systems, staff may be forced to rely on manual processes, delay or cancel appointments, and redirect patients to other facilities until systems are restored. These disruptions can increase operational strain and place patients and healthcare workers at heightened risk.

The MACT Health Board is named after the five California counties it serves: Mariposa, Amador, Alpine, Calaveras, and Tuolumne. The organization operates approximately a dozen healthcare facilities that primarily serve American Indian communities in the region. These clinics provide a range of services, including general medical care, dental treatment, behavioral health support, vision and eye care, and chiropractic services.


Read more »
Subscribe to: Comments (Atom)

Featured