Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Websites
Credit Card Cyber Security Financial Data Web Skimming Websites

Ongoing Web Skimming Operation Quietly Harvests Payment Data From Online Stores

 



Cybersecurity analysts have identified a sophisticated web skimming operation that has been running continuously since early 2022, silently targeting online checkout systems. The campaign focuses on stealing payment card information and is believed to affect businesses that rely on globally used card networks.

Web skimming is a type of cyberattack where criminals tamper with legitimate shopping websites rather than attacking customers directly. By inserting malicious code into payment pages, attackers are able to intercept sensitive information at the exact moment a customer attempts to complete a purchase. Because the website itself appears normal, victims are usually unaware their data has been compromised.

This technique is commonly associated with Magecart-style attacks. While Magecart initially referred to groups exploiting Magento-based websites, the term now broadly describes any client-side attack that captures payment data through infected checkout pages across multiple platforms.

The operation was uncovered during an investigation into a suspicious domain hosting malicious scripts. This domain was linked to infrastructure previously associated with a bulletproof hosting provider that had faced international sanctions. Researchers found that the attackers were using this domain to distribute heavily concealed JavaScript files that were loaded directly by e-commerce websites.

Once active, the malicious script continuously monitors user activity on the payment page. It is programmed to detect whether a website administrator is currently logged in by checking for specific indicators commonly found on WordPress sites. If such indicators are present, the script automatically deletes itself, reducing the risk of detection during maintenance or inspection.

The attack becomes particularly deceptive when certain payment options are selected. In these cases, the malicious code creates a fake payment form that visually replaces the legitimate one. Customers unknowingly enter their card number, expiration date, and security code into this fraudulent interface. After the information is captured, the website displays a generic payment error, making it appear as though the transaction failed due to a simple mistake.

In addition to financial data, the attackers collect personal details such as names, contact numbers, email addresses, and delivery information. This data is sent to an external server controlled by the attackers using standard web communication methods. Once the transfer is complete, the fake form is removed, the real payment form is restored, and the script marks the victim as already compromised to avoid repeating the attack.

Researchers noted that the operation reflects an advanced understanding of website behavior, especially within WordPress-based environments. By exploiting both technical features and user trust, the attackers have managed to sustain this campaign for years without drawing widespread attention.

This discovery reinforces the importance of continuous website monitoring and script validation for businesses, as well as cautious online shopping practices for consumers.

Read more »
Organization security
Corporate Cyber Security data security EOCC Organization security

EOCC Hit by Security Breach Due to Contractor's Unauthorised Access


The Equal Employment Opportunity Commission (EOCC) was hit by an internal security data breach that happened last year. The incident involved a contractor's employees exploiting sensitive data in an agency's systems. 

About the breach

The breach happened in EEOC's Public Portal system where unauthorized access of agency data may have disclosed personal data in logs given to agency by the public. “Staff employed by the contractor, who had privileged access to EEOC systems, were able to handle data in an unauthorized (UA) and prohibited manner in early 2025,” reads the EEOC email notification sent by data security office. 

The email said that the review suggested personally identifiable information (PII) may have been leaked, depending on the individual. The exposed information may contain names, contact and other data. The review of is still ongoing while EOCC works with the law enforcement. 

EOCC has asked individuals to review their financial accounts for any malicious activity and has also asked portal users to reset their passwords. 

Contracting data indicates that EEOC had a contract with Opexus, a company that provides case management software solutions to the federal government.

 Prevention measures 

Open spokesperson confirmed this and said EEOC and Opex “took immediate action when we learned of this activity, and we continue to support investigative and law enforcement efforts into these individuals’ conduct, which is under active prosecution in the Federal Court of the Eastern District of Virginia.” 

Talking about the role of employees in the breach, the spokesperson added that “While the individuals responsible met applicable seven-year background check requirements consistent with prevailing government and industry standards at the time of hire, this incident made clear that personnel screening alone is not sufficient." 

The second Trump administration's efforts to prevent claimed “illegal discrimination” driven by diversity, equity, and inclusion programs, which over the past year have been examined and demolished at almost every level of the federal government, centre on the EEOC. 

Large private companies all throughout the nation have been affected by the developments. In an X post this month, EEOC chairwoman Andrea Lucas asked white men if they had experienced racial or sexual discrimination at work and urged them to report their experiences to the organization "as soon as possible.”

Read more »
Malware Threat
AsyncRAT AsyncRAT attack Cloudfare Cyber Phishing Cyber Security Cyberattacks cybersecurity risks Malware Threat

AsyncRAT Campaign Abuses Cloudflare Services to Hide Malware Operations

 

Cybercriminals distributing the AsyncRAT remote access trojan are exploiting Cloudflare’s free-tier services and TryCloudflare tunneling domains to conceal malicious infrastructure behind widely trusted platforms. By hosting WebDAV servers through Cloudflare, attackers are able to mask command-and-control activity, making detection significantly more difficult for conventional security tools that often whitelist Cloudflare traffic. 

The campaign typically begins with phishing emails that contain Dropbox links. These links deliver files using double extensions, such as .pdf.url, which are designed to mislead recipients into believing they are opening legitimate documents. When the files are opened, victims unknowingly download multi-stage scripts from TryCloudflare domains. At the same time, a genuine PDF document is displayed to reduce suspicion and delay user awareness of malicious activity. 

A notable aspect of this operation is the attackers’ use of legitimate software sources. The malware chain includes downloading official Python distributions directly from Python.org. Once installed, a full Python environment is set up on the compromised system. This environment is then leveraged to execute advanced code injection techniques, specifically targeting the Windows explorer.exe process, allowing the malware to run stealthily within a trusted system component. 

To maintain long-term access, the attackers rely on multiple persistence mechanisms. These include placing scripts such as ahke.bat and olsm.bat in Windows startup folders so they automatically execute when a user logs in. The campaign also uses WebDAV mounting to sustain communication with command-and-control servers hosted through Cloudflare tunnels. 

The threat actors heavily employ so-called “living-off-the-land” techniques, abusing built-in Windows tools such as PowerShell, Windows Script Host, and other native utilities. By blending malicious behavior with legitimate system operations, the attackers further complicate detection and analysis, as their activity closely resembles normal administrative actions. 

According to research cited by Trend Micro, the use of Cloudflare’s infrastructure creates a significant blind spot for many security solutions. Domains containing “trycloudflare.com” often appear trustworthy, allowing AsyncRAT payloads to be delivered without triggering immediate alerts. This abuse of reputable services highlights how attackers increasingly rely on legitimate platforms to scale operations and evade defenses. 

Security researchers warn that although known malicious repositories and infrastructure may be taken down, similar campaigns are likely to reappear using new domains and delivery methods. Monitoring WebDAV connections, scrutinizing traffic involving TryCloudflare domains, and closely analyzing phishing attachments remain critical steps in identifying and mitigating AsyncRAT infections.
Read more »
Sensitive data
AI Agent ai application Cyber Security LangChain Sensitive data

LangChain Security Issue Puts AI Application Data at Risk

 



A critical security vulnerability has been identified in LangChain’s core library that could allow attackers to extract sensitive system data from artificial intelligence applications. The flaw, tracked as CVE-2025-68664, affects how the framework processes and reconstructs internal data, creating serious risks for organizations relying on AI-driven workflows.

LangChain is a widely adopted framework used to build applications powered by large language models, including chatbots, automation tools, and AI agents. Due to its extensive use across the AI ecosystem, security weaknesses within its core components can have widespread consequences.

The issue stems from how LangChain handles serialization and deserialization. These processes convert data into a transferable format and then rebuild it for use by the application. In this case, two core functions failed to properly safeguard user-controlled data that included a reserved internal marker used by LangChain to identify trusted objects. As a result, untrusted input could be mistakenly treated as legitimate system data.

This weakness becomes particularly dangerous when AI-generated outputs or manipulated prompts influence metadata fields used during logging, event streaming, or caching. When such data passes through repeated serialization and deserialization cycles, the system may unknowingly reconstruct malicious objects. This behavior falls under a known security category involving unsafe deserialization and has been rated critical, with a severity score of 9.3.

In practical terms, attackers could craft inputs that cause AI agents to leak environment variables, which often store highly sensitive information such as access tokens, API keys, and internal configuration secrets. In more advanced scenarios, specific approved components could be abused to transmit this data outward, including through unauthorized network requests. Certain templating features may further increase risk if invoked after unsafe deserialization, potentially opening paths toward code execution.

The vulnerability was discovered during security reviews focused on AI trust boundaries, where the researcher traced how untrusted data moved through internal processing paths. After responsible disclosure in early December 2025, the LangChain team acknowledged the issue and released security updates later that month.

The patched versions introduce stricter handling of internal object markers and disable automatic resolution of environment secrets by default, a feature that was previously enabled and contributed to the exposure risk. Developers are strongly advised to upgrade immediately and review related dependencies that interact with LangChain-core.

Security experts stress that AI outputs should always be treated as untrusted input. Organizations are urged to audit logging, streaming, and caching mechanisms, limit deserialization wherever possible, and avoid exposing secrets unless inputs are fully validated. A similar vulnerability identified in LangChain’s JavaScript ecosystem accentuates broader security challenges as AI frameworks become more interconnected.

As AI adoption accelerates, maintaining strict data boundaries and secure design practices is essential to protecting both systems and users from newly developing threats.

Read more »
malicious PDF files
Anti Malwares Confidential Data Confidential Information Cyber Security data security Malicious PDF Attachment malicious PDF files

Epstein Files Redaction Failure Exposes Risks of Improper PDF Sanitization

 

The United States Department of Justice recently released a new set of documents related to the Jeffrey Epstein investigation, drawing widespread attention after it emerged that some redacted information could be easily uncovered. On December 22, the department published more than 11,000 documents as part of the latest Epstein files release. Although many of the records contained blacked-out sections, some individuals were able to reveal hidden content using a simple, well-known technique. As a result, information intended to remain confidential became publicly accessible. 

Shortly after the release, political commentator and journalist Brian Krassenstein demonstrated on social media how the redactions could be bypassed. By highlighting the obscured areas in certain PDF files and copying the text into another document, the concealed information became visible. This incident highlighted a common issue with PDF redaction, where text is often visually covered rather than permanently removed from the file. In such cases, the underlying data remains embedded in the document despite appearing hidden.  

Security experts explain that PDF files often contain multiple layers of information. When redaction is performed by placing a black box over text instead of deleting it, the original content can still be extracted. Copying and pasting from these files may expose sensitive details. Specialists at Redactable, a company focused on AI-powered redaction tools, have warned that many users underestimate how complex proper PDF sanitization can be. They emphasize the importance of verifying documents before sharing them publicly to ensure sensitive information has been fully removed. 

The situation has raised concerns because U.S. government agencies have long had guidance on secure document redaction. As early as 2005, the National Security Agency published detailed instructions on how to safely sanitize documents before public release. In 2010, the Department of Homeland Security issued reminders stressing the importance of following these procedures. The apparent failure to apply such guidance to the Epstein files has prompted questions about internal review processes and potential security implications. 

This is not the first time redaction failures have exposed sensitive information. Legal experts and journalists have documented multiple high-profile cases involving court filings, media publications, and federal documents where hidden text was revealed using the same copy-and-paste method. The recurrence of these incidents suggests that improper PDF redaction remains a persistent and unresolved problem. 

Beyond the exposure of sensitive content, cybersecurity researchers have also warned about the risks of downloading Epstein-related documents from unofficial sources. Past investigations found that some distributed files were embedded with malware. Threat actors often exploit high-profile events to spread malicious content disguised as legitimate documents, particularly in trusted formats such as PDFs. Researchers at Zimperium’s zLabs team have reported an increase in PDF-based malware and phishing campaigns. Attackers favor PDFs because they appear credible, are widely used in professional settings, and can bypass some security defenses. 

These malicious files are often designed to mimic trusted organizations and target both desktop and mobile users. Experts advise accessing sensitive documents only from official sources and following proper sanitization practices before publication. Software providers such as Adobe recommend using dedicated redaction tools to permanently remove both visible and hidden data. The Epstein files incident underscores that visual redaction alone is insufficient and that improper handling of PDFs can pose serious security and privacy risks.
Read more »
Dark Web
Cloud Defense Cyber Security Cybersecurity CyberThreat Dark Web

NtKiller Tool Boasts AV/EDR Evasion on Dark Web

 

A threat actor dubbed AlphaGhoul has now begun to push NtKiller-a perilous tool-on the dark web forums, claiming it silently kills antivirus software and bypasses endpoint detection and response systems. As a malware loader, this tool targets popular security products such as Microsoft Defender, ESET, Kaspersky, Bitdefender, and Trend Micro. This puts organizations relying on traditional security in great danger. Its announcement consolidates the escalating commercialization of evasion tools in the underground. 

NtKiller has a modular pricing system; the base price is $500, while the inclusion of rootkit capabilities or UAC bypass would be an additional $300 each, demonstrating the refinement of cybercriminal sales. KrakenLabs researchers witnessed early-boot persistence, embedding the tool within a system at an early stage of boot time, which is long before most security monitors have become active. This mechanism complicates the work of security teams for detection and removal. 

Beyond basic process killing, NtKiller boasts HVCI disabling, VBS manipulation, and memory integrity bypasses among other advanced evasion tactics. Anti-debugging and anti-analysis protections thwart forensic examination and create a gap between hype and proven performance. The silent UAC bypass escalates privileges with no user prompts, its menace amplified when combined with rootkits for persistent, surreptitious access. 

While the claims target enterprise EDR in aggressive modes, independent verification is lacking, and caution should be exercised when reviewing true efficacy. Such tools pose a more significant challenge to organizations because they take advantage of timing and stealth over signature-based defenses. That makes behavioral detection necessary in the security stacks to help with mitigating these threats.

Cybersecurity professionals recommend vigilance, layered defense, and active monitoring as a way of mitigating tools such as NtKiller in these increasing dark web threats. As cybercriminals continue to improve evasion techniques, it requires moving the advantage beyond simple reliance on traditional antivirus. This incident has highlighted the need for timely threat intelligence within enterprise security strategies.
Read more »
North Korean Agents
Amazon Security Cyber Security Hiring scams AI Screening North Korean Agents

Amazon Thwarts 1,800+ North Korean Job Scams with AI and Tiny Clues

 

Amazon's chief security officer, Stephen Schmidt, revealed how the company blocked over 1,800 suspected North Korean operatives from securing remote IT jobs since April 2024. These agents aimed to funnel salaries back to Pyongyang's weapons programs, bypassing sanctions through stolen identities and sophisticated tactics. Amazon detected a 27% quarter-over-quarter rise in such applications in 2025, using AI screening combined with human verification to spot subtle red flags.

North Korean operatives have evolved their strategies, targeting high-demand AI and machine-learning roles at U.S. firms. They hijack dormant LinkedIn profiles, pay legitimate engineers for credential access, or impersonate real software developers to build credible online presences. Educational claims often shift—from East Asian universities to no-tax U.S. states, and lately California or New York schools—frequently listing degrees from institutions without the claimed majors or mismatched graduation dates.

Amazon's defense relies on AI models scanning nearly 200 high-risk institutions, résumé anomalies, and geographic mismatches, followed by rigorous background checks and interviews. Human reviewers caught one operative via keystroke delays from a remotely controlled U.S. laptop in a "laptop farm"—facilities where locals receive company hardware but allow overseas access. Phone number formatting stands out too: fraudsters use "+1" prefixes uncommon among actual U.S. residents.

These "laptop farms" maintain a domestic IP footprint while operatives work from abroad, evading location checks. U.S. authorities have cracked down, sentencing an Arizona woman to over eight years in July 2025 for running farms that netted $17 million for North Koreans across 300+ firms. Schmidt warns this threat scales industry-wide, urging multi-stage identity checks and device monitoring.

Schmidt calls on employers to analyze HR data for patterns in emails, IPs, and universities, then report suspicions to the FBI. As remote work persists, these small details—pieced together—form a critical barrier against regimes turning corporate payrolls into sanction-busting revenue streams. Sharing tactics, he says, strengthens collective defenses in cybersecurity.
Read more »
state-backed cyberattacks
AI-Driven Cyber Threats Cyber Defense Investments Cyber Security Japan National Security Public-Private Cyber Cooperation state-backed cyberattacks

Japan Prioritizes Cyber Resilience in Latest National Security Push


During the years 2026, Japan positioned economic strategy and security readiness as deeply intertwined priorities, emphasizing national resilience as a core priority. This package of comprehensive economic measures was approved by the Japanese government in November 2025 for a cost of 21.3 trillion yen, one of the most expansive economic policy responses in recent years. 

Three core pillars of the plan aimed at enhancing long-term national security and everyday stability were outlined as the plan's three key components: strengthening the security of citizens and dealing with rising price pressures; accelerating strategic investments so as to make the country more resilient to future crises and to drive sustainable growth, and increasing the capacity of the country's diplomatic and defense systems. 

Prime Minister Sanae Takaichi has designated cybersecurity as a strategic investment domain within the second pillar of the government, aligned with other national-critical sectors, such as semiconductors, quantum computing technology, shipbuilding, space exploration, critical communications infrastructure, vital minerals, and the development of advanced information and communication technologies. 

Among other things, this declaration marked the beginning of a decisive shift towards treating cyber defense as a fundamental part of Japan's economic and geopolitical resilience, rather than only as a technical safeguard. By doing so, the government underscored their intention to channel their investment into bolstering digital infrastructure to withstand an intensifying threat environment worldwide. 

A new inter-agency cyber response architecture has been introduced by Japan as part of its updated national cybersecurity doctrine in order to improve internal security, defense oversight, and the readiness of the military in times of high severity cyber attacks.

There is a new strategy being developed that aims to establish an operational framework enabling real-time collaboration between national law enforcement authorities, the Ministry of Defense, and the Japan Self-Defence Forces. This will allow for an effective and swift response to cyber intrusions that threaten the security of the nation or disrupt critical infrastructure faster and more effectively. 

In partnership with the Department of Homeland Security, the initiative aims to provide an automated response to cyber threats in the context of a rapidly evolving digital threat landscape, one that has transformed cyber operations from isolated incidents to strategic instruments deployed by actors aligned with state interests. China, Russia, and North Korea are categorically listed as major national threats in the policy document. 

It notes that cyber campaigns attributed to these countries have sexed, become increasingly sophisticated, and targeted with a marked increase in the scale, sophistication, and precision of their attacks on critical infrastructure and public agencies. 

A Japanese government official has also voiced an explicit warning about the possibility of artificial intelligence being misused as an attack enabler for the first time, warning that AI-assisted cyber operations pose a new class of risks that may increase systemic damage and accelerate intrusion timelines. 

According to reports by Japan's security agencies, there has been a consistent increase in ransomware offensives, financial cyber fraud, and large-scale data breaches in recent years, which have aligned with this evolving security outlook. 

Cybercrime has had significant economic consequences — the government estimates indicate that online banking fraud losses exceeded 8.7 billion yen in 2023 alone, highlighting the dual burden of digital attacks that threaten both national stability and economic security at the same time. 

The Japanese government is signaling a strategic recalibration by integrating cybersecurity into the National Defense operations, which will result in cyber resilience becoming a core component of security rather than a parallel support function that can be provided.

There is a clear emphasis placed on technological modernization and workforce readiness, in Japan's latest cybersecurity roadmap. It has been pledged that the government will invest sustained amounts of money into cultivating highly specialized cyber professionals, upgrading technical defense systems, and implementing routine simulation drills and incident response exercises in order to ensure that the country is prepared to deal with potential cyber incidents. 

In spite of the fact that technology alone is not enough to safeguard national networks without an equally advanced talent pool that can interpret, counter, and mitigate threats that evolve every day, policymakers and security officials have repeatedly emphasized that technological capabilities alone cannot safeguard national networks.

As a result, the strategy formalizes broader collaboration channels, recognizing that cyber risks do not have regard for traditional governance structures as they travel across national and sectoral boundaries. 

An essential cornerstone of the policy is the concept of public-private cooperation, which encourages critical infrastructure operators, who want to join a newly formed government-led council that aims to enable bidirectional intelligence exchange, threat reporting, and coordinated risk assessment; this is a cornerstone of the policy. 

There is also a strong recommendation to strengthen international alignment, which reinforces the fact that cyber defense is a collective rather than a unilateral challenge, as is emphasized in the statement of the document which states that no nation can combat digital intrusions alone. 

During a press conference held Tuesday, Hisashi Matsumoto, the country's minister for cyber security, reiterated the government's position and drew inspiration from Prime Minister Sanae Takaichi's directive for a better collaboration between the government, domestic industry, and partners overseas. 

The Japanese government has repositioned their cyber posture in accordance with unified internal action and strategic external partnerships, as stressed by Matsumoto, cross-sectoral and cross-border cooperation is crucial to ensuring national resilience in the digital age. Although these ambitions exist, Japan's legislative agenda for active cyber defense remains mired in political and constitutional debates. 

There has been a stalling of efforts in the government to introduce a comprehensive cybersecurity bill, an effort that has been hindered by shifting political dynamics, particularly due to a change in prime ministerial leadership, as well as a loss of the majority in the parliament by the ruling coalition at the general elections held in mid-October. 

Legal scrutiny has been sparked by the proposed legislation, especially in light of the strict constitutional protections that Japan has in place to protect communication secrecy and privacy. According to several legal experts and government advisers, if network monitoring provisions are not properly structured, they will interfere with these safeguards, if not carefully structured. 

According to officials, despite the fact that political consensus is still uncertain, it may be possible to submit the bill as early as possible during the next regular session of the National Diet, reflecting the broader challenge of aligning national cyber ambitions with constitutional precedents that still faces the country. 

As Japan shifts its strategic priorities toward cybersecurity, it is a manifestation of a more fundamental reckoning with the reality of modern conflict, in which economic stability, defense readiness, and digital infrastructure are becoming increasingly irreconcilable. 

In the proposal for the new strategy, a foundation is laid for improved coordination, the development of talent, and cross-sectoral alliances.  However, for the new strategy to be successful long term, a sustained political consensus is required, as is a careful balance between policy alignment with constitutional safeguards. 

Japan's approach could be enhanced if domestic research and development in encryption were accelerated, cyber threat intelligence-sharing agreements across the Indo-Pacific were expanded, and private firms were encouraged to invest in security modernization through tax incentives and security modernization grants. 

There is also the possibility that national cyber drills, modeled after disaster-response frameworks Japan has historically employed, will strengthen institutional muscle memory for handling crisis situations in a fast-paced manner. Furthermore, experts suggest integrating cybersecurity modules into engineering and policy programs at universities so that future-ready professionals may be available. 

As a result of institutionalizing collaboration between Japan's government, industry, and international partners, not only are they preparing to deal with today's threats, but they are also signaling that they intend to create norms and guidelines that will shape the world's cyber resilience.

It is fair to say that the country is at a crucial crossroads in its development-one that requires decisive action if it wishes to improve its digital defenses into a strategic advantage, thereby enhancing both national security and economic continuity in a world defined by persistent and evolving cyber threats.
Read more »
Subscribe to: Comments (Atom)