Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Theft. Show all posts
wifi network
2FA AI Cloud Security Data Theft firmware Privacy Robots Technology vacuums wifi network

The Robot Vacuum in Your Living Room May Know More About You Than You Think

 





The device quietly navigating your living room floor might be doing more than picking up crumbs. Robot vacuums, now a fixture in millions of homes, collect data that goes far beyond what most buyers realize when they pull one off the shelf. Depending on the model, a connected vacuum can generate detailed floor maps, record cleaning histories, capture ambient audio through built-in microphones, and stream live video to an app on your phone. Some models let you monitor progress remotely, routing that footage and data through the manufacturer's servers. And while the machine charts a path between your couch and your coffee table, it may be quietly building a picture of how you live.

iRobot, maker of the popular Roomba line, spells out its data practices in its privacy policy. Connected models can send room names, floor types, detected objects, robot movements, and Wi-Fi network details back to the company. That is not a hidden clause buried in fine print, but it is something most consumers never read before buying. For businesses, this kind of information carries real commercial value: consumer behavior data, household layouts, and everyday habits are precisely the intelligence that advertisers and smart home companies have long sought.


The Flaw That Opened 7,000 Homes

In February 2026, a software engineer named Sammy Azdoufal set out to do something benign: control his DJI Romo vacuum with a PlayStation 5 controller. What he found was a flaw that handed him access to roughly 7,000 other people's vacuums across more than 20 countries.

Azdoufal, an AI strategy specialist, reverse-engineered how the Romo communicated with DJI's servers. The backend authentication system accepted his device token as valid for thousands of other users' devices. From that position, he could view live camera feeds, hear microphone audio, see floor plans and room layouts, and check battery levels and cleaning status. He reportedly watched a journalist's vacuum operating in that person's living room in real time.

"Devices promising convenience can invite unseen observers into private spaces." [Dallas Express, February 2026]

Azdoufal notified DJI immediately. The company closed the vulnerability by late February and attributed the problem to a permission issue in its MQTT communication system, deploying automatic updates that required no action from users. The Romo model was removed from DJI's online store two days later. DJI said no widespread misuse had been detected. Critically, Azdoufal did not bypass encryption or use any sophisticated hacking technique. The problem sat on DJI's server, where device data was stored in plain text and access controls were loose enough that a legitimate customer's token opened thousands of doors.

This was not an isolated episode. In 2024, hackers took over Ecovacs Deebot X2 robot vacuums in several American cities, steering the machines remotely and playing racial slurs through their speakers. Minnesota lawyer Daniel Swenson, one of the affected users, described the intruder: "I got the impression it was a kid, maybe a teenager."


What the Vacuum Actually Knows About You

The data a robot vacuum collects is more revealing than it first appears. Floor maps trace the layout of your home, including where you sleep, where you store valuables, and the shape of your living spaces. Object detection features identify furniture, shoes, and personal items. Layer microphone access on top of that and the device starts resembling something other than a cleaning appliance. A privacy policy describes what a company intends to do with your data. It does not guarantee the product is free of security vulnerabilities. An attacker who reaches a manufacturer's servers could access whatever has already been collected, regardless of what any policy says.


Buying a Vacuum That Collects Less

Not every connected vacuum poses the same degree of risk. Buyers wanting to limit their exposure should look for models that process navigation data locally rather than routing it through manufacturer servers. Matic, a smaller company, builds its vacuum around that principle: maps stay on the home Wi-Fi network and all processing happens on the robot itself. Remote app access is available, but only through encrypted cloud infrastructure with explicit user consent.

One distinction worth keeping straight: a camera-free model still generates maps and sends account data to the manufacturer. "No camera" and "no data collection" are not the same thing. Mandatory cloud features, with no option to use the device offline, are a signal worth weighing as a dealbreaker before purchase.


Steps for People Who Already Own One

For the millions of households already running a connected vacuum, a few changes lower the risk without requiring a new purchase. Set a strong, unique password and enable two-factor authentication on any linked account. Keep the vacuum's firmware updated. Disable remote viewing and other cloud-connected features unless you actually use them. The fewer connections left open, the smaller the surface available to anyone looking for a way in.



Read more »
Healthcare Data
Cyber Networks Cyber Security Cyberattacks cybersecurity in healthcare Data protection data security Data Theft Healthcare Data

Cybersecurity Incident Disrupts New Mexico Hospital Network, Forcing Patient Diversions and Clinic Closures

 

A cybersecurity incident caused ambulance diversions, cancelled appointments and disruptions to medical facilities around the state on Monday October 26, leaving New Mexico with no emergency departments able to treat the most severe traumatic injuries. The University of New Mexico Health System provides the only level 1 trauma centre in the state. 

The health system advised patients not to attend the main hospital in Albuquerque and cancelled appointments at over 30 clinics whilst they tried to resolve the issue. Although officials did not immediately say what exactly had happened, later in the day it was announced that parts of the hospital and clinics were beginning to get back up and running. Presbyterian Healthcare Services and Lovelace Health System are also large healthcare providers in the state and worked with the network to prepare to take in extra patients. 

The University of New Mexico Health System sees around 900,000 outpatients and 100,000 emergency department patients per year (University of New Mexico Health System website), meaning this is a large part of the healthcare system. Multiple staff reported seeing messages on their computers late Monday morning stating that student, staff and patient data had been stolen. A spokesperson for the health system did not want to comment as they said there was an ongoing police investigation. 

An FBI spokesperson confirmed that they were assisting a partner organisation but did not give any further details. Attempts to comment were also sent to the Bernalillo County Sheriff’s Office and Albuquerque Police Department. This incident comes as there has been ongoing concerns about attacks on digital systems within essential services such as healthcare. Ransomware requests and other cyber incidents have been seen with hospitals for around a decade, however it is unusual for messages to be shown on computer systems due to the breach (Josephine Wolff, Professor of Cybersecurity Policy at Tufts University). 

This shows how difficult it can be for organisations to protect their networks. The impact could be seen throughout Albuquerque and surrounding areas. At the main hospital, staff in turquoise uniforms were directing patients away from the waiting area and advising they may have their appointments cancelled. Patients arriving at a medical centre in Rio Rancho were also told by security guards to rearrange their appointments. 

The University of New Mexico’s Health Sciences Centre, the largest academic medical centre in the state, cancelled Monday and Tuesday classes. Staff working in the hospital and medical group will be returning on Tuesday. It has not been confirmed what caused the incident, if data has been extracted or if there was a ransom request. The investigation is ongoing.
Read more »
Fortinet firewall attack
Credential Theft Cyber Attacks data security Data Theft FortiGate FortiGate firewall attack Fortinet Fortinet firewall attack

Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials

 

A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches. 

The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed. 

Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together. This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%. 

The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific. The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used. 

Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access. 

The AdaptixC2 framework is also used. Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts. Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link. 

Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.
Read more »
OLVX
Cyber Crime Data Theft FBI North Macedonia OLVX

FBI and North Macedonia Arrest Alleged OLVX Market Operator

 

Authorities in North Macedonia have arrested and charged the alleged administrator of OLVX, an underground cybercrime marketplace accused of selling stolen personal data, login credentials, and tools used in cyberattacks. The operation was conducted jointly by North Macedonia’s Ministry of Interior and the U.S. Federal Bureau of Investigation (FBI), marking what officials describe as the first coordinated cyber operation between the two countries. The suspect, identified only by the initials E.A., is a 20-year-old man from Golema Rečica near Tetovo. 

According to investigators, OLVX operated from 2023 to 2025 and became a popular platform for criminals seeking access to compromised accounts and digital identities. The marketplace allegedly allowed more than 1,500 seller accounts to offer victims’ personally identifiable information and login credentials. Officials said the site also facilitated the sale of phishing kits, remote desktop access, stolen data, and other resources used to launch cybercrimes. 

The investigation began after the FBI supplied intelligence to North Macedonian authorities. Police later raided the suspect’s home and seized devices for forensic examination. Earlier action against the platform reportedly uncovered a server database containing more than 2,600 customer accounts, while illicit sales were estimated to have exceeded $500,000. The charges against E.A. include computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material.

Authorities also linked the suspect to ONEMILI, a Telegram group allegedly used to advertise software and services for cybercrime, including fraudulent refund schemes. The FBI said the marketplace directly endangered the digital security of thousands of people in the United States by making stolen account credentials and personal information available to criminals. The case underscores how underground platforms can connect data thieves, fraudsters, and attackers across borders. 

The arrest sends a strong signal that international law enforcement is increasingly targeting the infrastructure behind cybercrime rather than only individual attacks. It also highlights the importance of strong account security: users should enable multi-factor authentication, use unique passwords, avoid reusing credentials, and monitor accounts for unauthorized activity. While the charges remain allegations until tested in court, the takedown of OLVX represents a significant blow to a marketplace that allegedly enabled large-scale identity theft and fraud.
Read more »
ShinyHunters Hacker
Cyber Crime Cyber Extortion Data Theft FBI Cybercrime Investigation Hacker Arrest Saif Al-Din Khader ShinyHunters ShinyHunters Hacker

ShinyHunters Hacker Reportedly Detained as FBI Seeks Cooperation


The FBI has reportedly detained a suspected ShinyHunters member known online as “Rey” and is cooperating with the government. Jordanian authorities captured a suspect identified as Saif al-Din Khader this week. According to two sources cited by Reuters, Khader is helping U.S. and international investigators identify other members of the hacking group. 


It is believed that Khader's cooperation will provide investigators with information regarding the group's activities and alleged co-conspirators, according to a source. He has shown investigators his electronic devices and digital communication to help locate other suspected members. The FBI has not responded to Khader's reported detention specifically, however it has stated that it is continuing to investigate the recent cyber incident allegedly involving ShinyHunters and is collaborating with international partners to resolve the matter. 

A series of law enforcement actions targeting individuals affiliated with ShinyHunters has led to this reported detention. Dutch authorities arrested a 24-year-old man in connection with an investigation into the group in September. Following the arrest, the FBI issued a warning encouraging other suspected members to surrender while they continued to investigate the matter. 

The developments are following the claim by ShinyHunters that a job portal breach had taken place. As claimed by the group, it obtained a significant amount of sensitive information from FBI systems. Particularly, it claimed to have acquired employee information, though the extent of the alleged theft has yet to be independently verified. During Khader's reported detention, the group's online activity was also disrupted. 

In addition to the disappearance of the group's data leak website, an account previously used to communicate with journalists no longer responded. Later, another ShinyHunters leak site appeared, indicating the group may continue to conduct activities. Moreover, Khader's reported cooperation strengthens the investigation, which has already been conducted by several individuals associated with the ShinyHunters network in general. 

Khader's identity was previously associated with the group until the latest detention was made. It has been reported that Brian Krebs identified Khader as a member of the Scattered Lapsus$ Hunters umbrella operation in 2025, which is affiliated with ShinyHunters, Lapsus$, and Scattered Spider. Aside from being linked to the HellCat leak site and BreachForums hacking forum, Khader had previously asserted that he was cooperating with law enforcement and had ceased all data theft and extortion activities. Those claims were not independently verified. 

While this was the case, ShinyHunters continued to conduct attacks in 2026, including attacks on Rockstar Games as well as Canvas, which disrupted schools across the country. Despite this, the group has continued to engage in data theft and extortion operations. ShinyHunters has recently begun targeting cloud-based services as well as third-party providers, resulting in incidents that are linked to organizations such as Google, Cisco, and Pornhub.

ShinyHunters has also been linked to the May 2026 breach involving Instructure Canvas, while previous investigations have resulted in arrests related to Snowflake-related attacks, PowerSchool and Breached hacking forums. It may be possible for investigators to gain a better understanding of how this loosely organized network operates and who remains active within it through the recent arrests. 

It has been reported that FBI agents have indicated that information obtained from arrests and seized infrastructure may be useful for identifying additional participants. However, the appearance of a new ShinyHunters leak site following the earlier closure indicates that the organization has not been completely dismantled. Furthermore, the case illustrates the difficulty of disrupting cybercrime groups that are built upon informal networks rather than a rigid organizational structure. 

According to Reuters, investigations and prosecutions can become complicated by the young age of some suspects, the fluid nature of related groups, and the limited cooperation of victims. While ShinyHunters' continued online activity suggests that law enforcement efforts are ongoing, the reported detention and cooperation may provide investigators with valuable insight into ShinyHunters' wider network.
Read more »
Stolen Passwords
Cyber Security Data Theft France Organization Security Stolen Passwords

French Tax Data Theft: Threat Actors Steal Password and Remain Undetected


A threat actor used stolen passwords of employees at France’s tax admin to steal tax data on businesses and hundreds of thousands of taxpayers in June.

Agencies could not detect intrusion 

Neither France's national cybersecurity nor the tax administration could notice the data leaving. According to the agency ANSSI’s report, the attack worked because of weak login security, weak monitoring, and poorly separated networks.

DGFIP, the tax administration, handles France’s tax website impots.gouv.fr. The data came from a tool called E-Contact that taxpayers use to contact the tax administration.
According to the DGFIP, the stolen data includes slightly over 250,000 firms and slightly over 350,000 individuals. Passwords and internet accounts belonging to taxpayers were not hacked.

Attack tactic

For individuals, the data that may have been accessed or copied includes their tax ID, contact details, family circumstances, reference taxable income and tax withholding rate, and a summary of the messages they exchanged with the DGFIP. The messages themselves might have been intercepted by less than 250 individuals.
For companies, it includes the firm name, SIREN registration number, address and basic details of their messaging. 

Different routes used

The threat actor used two different routes, the first started with suspicious logins in May and resulted in E-Contact. 
The first route depended on various stolen passwords of DGFIP staff. The passwords were stolen by infostealers, malware that secretly saved login details, from systems the DGFIP did not handle, most probably from staff’s own systems.

The two portals that the threat actor exploited, ADER and PIGP, required only a password, so the stolen password worked. DGFIP staff use PIGP web portal for HR services and email. ADER offers access to a few DGFIP applications through the RIE, the network that links French government ministries. 

The threat actor reached the RIE via compromised Education ministry systems linked to it. Sensitive DGFIP apps were not taken out from the rest of the RIE, allowing threat actors to access them from parts of the network with no apparent need. Officials also discovered signs of various attempts to hack into other government entities on the network.

The attacker was able to access a lot of data even though the accounts they used had no special rights. ANSSI did not look at how user rights were managed for this report.
Data from the land registry was obtained via the second path. It passed through APEX, a portal for partners like land surveyors and notaries, which requested an email with a one-time code and a password.
Read more »
WhatsApp Spam
API Token Exposure CloudFlare Data Theft Malicious Npm Packages malware WhatsApp Spam

101 Malicious npm Packages Secretly Enroll Developers into WhatsApp Spam Channels

 



Researchers at OX Security have flagged 101 npm packages that silently subscribe developers to WhatsApp spam channels the moment they are installed. The campaign abuses the open-source Baileys library, an unofficial implementation of the WhatsApp API that developers use to build customer support bots, chat managers, and automation tools, to carry out the subscriptions without any visible prompt or warning.

The packages have collectively been downloaded roughly 490,000 times, with 116,000 of those downloads occurring in the last 30 days. The single most downloaded package, `ourin-baileys`, accounts for 130,589 installs on its own, nearly a quarter of the campaign's total reach. As of publication, the majority of the 101 packages remain live on npm. Sixteen had been removed, and seven of those were pulled before researchers could review the code to determine which variant of the malware they carried.

The campaign did not begin in 2026. The oldest package in OX Security's list, `alipclutch-baileys`, was first published in October 2025. Several others date to December 2025, meaning this operation has been running quietly on the registry for close to a year before receiving a formal write-up.


Three Ways to Hide the Same Payload

OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko identified three distinct variants of the malware, each handling the subscription routine differently.

The first variant, found in 19 packages, fetches channel IDs from GitHub at runtime. By hosting the target list externally, operators can swap out which accounts receive new followers without ever publishing a new package version to npm. One package, `@rixxcodex/baileys`, hides the GitHub URL inside media-download code using Base64 encoding so it is unlikely to catch the eye of anyone skimming the source.

The second variant, covering 60 packages, simply embeds the channel IDs in cleartext inside the source code. Two packages took additional steps to bury this, placing the subscription logic inside an upstream connection handler and inside a file named after the Signal cryptographic protocol, a location most developers would never think to inspect.

The third variant, found in 14 packages, encodes the hardcoded channel IDs using Base64. One package in this group, `neuralwhatsapp`, takes a slightly different approach: rather than storing a channel ID directly, it resolves its target from a hardcoded WhatsApp invite code at runtime.


The Follower Inflation Business

The goal is not data theft or ransomware deployment. The channels identified in this campaign are mostly small bot-seller and marketplace accounts, largely Indonesian, where follower counts function as social proof for selling bot scripts, premium APKs, social media boosting services, and in-game resources.

Among the specific channels researchers identified: Neural has 798 followers and markets game-currency sales through a platform called JualanRSS, which deals in in-game resources including food, ore, stone, timber, and gold. MONTE-BMG has 1,000 followers. CORTANA TECH has 1,300 and points visitors to a dedicated website. Fyxzpedia.ID-Utama, with 4,800 followers, sells WhatsApp and Telegram bot scripts and bot-building services outright. One Spanish-language channel called Redes Oficiales sits at 19,000 followers and is linked to a YouTube creator, pushing back against the assumption that this is a purely Indonesian operation.

The threat actors mute these channels on the victim's device after subscribing them, so the added follower count appears organic to outside observers. A channel with thousands of followers reads as trustworthy, and that manufactured trust is the product being sold to the operators running these marketplaces.

One channel, MONTE-BMG, illustrates how the monetisation funnel actually works. It posts what appears to be a screenshotted sales negotiation in Arabic, ending with a group invite link. That link leads to a brand-new channel with only 12 followers, whose own description contains yet another group invite. The inflated parent channel is only the entry point. The actual transaction gets moved progressively deeper into a private chain of groups where there is no public record.

Beyond follower inflation, the SafeDep research team noted earlier this year that some Baileys forks in this campaign also inject the package author's advertising URL into every image and video the bot sends, a second payload the follower-count headline tends to obscure.


One Coordinated Operation, Many Names

OX Security found that 32 channels are followed by more than one package across this campaign. The single most reused channel, identified by the ID `120363400911374213@newsletter`, is targeted by ten separate packages. One remote channel list hosted on GitHub feeds five different packages simultaneously, meaning the operator can retarget all five installations by editing a single file.

Operators routinely publish near-identical packages under slightly different names to preserve the campaign when individual listings get removed. `noxleyss` and `@noxleyss/baileys`, for example, carry the same code under different publisher accounts.

Details of the abuse first emerged in August 2026 when SafeDep identified Baileys npm forks making installers' WhatsApp accounts follow attacker-controlled channels. Earlier this month, the Xygeni Security Research Team separately detailed another Baileys modification, `@dappaoffc/baileys-mod`, which subscribed developers' authenticated WhatsApp bot sessions to attacker-controlled newsletter channels.

The campaign follows a pattern OX Security has tracked on npm before. An earlier operation used the same registry to host fake Cloudflare CAPTCHA pages designed to redirect visitors to ClickFix phishing infrastructure. The registry's scale and the institutional trust developers place in what appear to be legitimate forks of known libraries make it a dependable distribution channel for this kind of abuse.

Because the packages carry none of the classic malware signatures, no API token theft, no heavy obfuscation across the board, no destructive payload, standard threat detection tools are likely to miss them entirely. That is precisely why most of these packages have remained live for months.


What Developers Should Do

Security recommends checking whether your WhatsApp account has been added to unknown channels and blocking or reporting any that appear. Developers should avoid any npm package that requires connecting a personal WhatsApp account and should add detection rules to their pipelines flagging known malicious Baileys forks. Remote channel-list URLs identified in these packages can be added to URL-reputation and threat-intelligence pipelines for ongoing monitoring.


Read more »
Windows
Android Antivirus apis Data Theft Firefox Linux macOS privacy Windows

File Notification APIs in Windows, Linux, and Android Are Leaking What You Do on Your Computer

 



A research team from Graz University of Technology in Austria has shown that a routine feature built into virtually every major operating system can be turned into a surveillance channel that tracks keystrokes, visited websites, and private messaging activity without needing administrator access.

The feature is the file-change notification system. Every major platform ships one: Linux has inotify and fanotify, Windows uses ReadDirectoryChangesW, and Android and macOS have their own equivalents. Text editors, antivirus software, cloud sync clients, and file managers depend on these APIs to react when files are created, modified, or deleted. The catch is that subscribing to those notifications requires no special privileges, only read access to the directory being watched.

What these APIs never hand over is actual file content. What they do leak, the researchers found, is file names and the exact timing of events. That combination is enough to reconstruct meaningful details about what other users on the same machine are doing throughout the day.


Linux: Keystrokes Through the Filesystem

On Linux, if a process is blocked from watching a specific file directly, it can still receive that file's events by watching the parent directory, as long as that directory is readable. The researchers applied this to device files under /dev that represent keyboard hardware. The result is that an unprivileged process can detect every keystroke another user makes, though not which key was pressed.

That gap offers less protection than it appears to. Research going back more than two decades has established that the rhythm of inter-keystroke timing can help reconstruct what was typed. In tests with seven participants, the attack scored between 93.1% and 100% on standard accuracy measures. Input that never echoes to the screen, such as a password entered during a sudo prompt, does not generate filesystem events and stays invisible to the attack.

The team also demonstrated website fingerprinting by watching which system fonts Firefox loads for a given page. Against the top 100 sites, that technique reached 87.9% accuracy. A third Linux attack targeted KDE Plasma 6 on Wayland: a malicious process running as the victim can detect when a real authentication dialog is about to appear and draw a counterfeit one over it to capture credentials before the legitimate prompt ever loads.


Android: No Permissions Required

On Android, an application requesting zero permissions can watch the private storage directory of a completely separate app. Testing against WhatsApp on a Google Pixel and a Samsung Galaxy device, the researchers extracted file names and event timing that revealed when photos, videos, and documents were sent or received. The attack also exposed when that media was later deleted, offering a window into communication patterns that the app's own privacy controls do not address.


Windows: One Watch, Every User's Files

The most consequential Windows scenario arises when a process watches the root of the system drive. Windows reports the full path of every file that changes anywhere on the machine, including paths inside other users' home directories that the monitoring account has no direct permission to access.

Because Firefox names profile subdirectories after associated websites, an unprivileged user watching the drive root can track which sites another logged-in account is browsing in near-real time. Across the top 1,000 websites, the researchers hit 97.8% accuracy against Firefox and 48.5% against Edge, which creates far fewer site-named folders.

This behavior comes from the same ReadDirectoryChangesW API that was flagged under CVE-2007-0843 for a similar class of issue almost two decades ago. Microsoft's position has not shifted. The company told the researchers the behavior is working as designed, on the grounds that file contents remain inaccessible. A Microsoft spokesperson told SecurityWeek that "the technique requires an attacker to already have the ability to run code locally on a device under a separate user account and does not provide access to file contents." Microsoft did note that administrators can enable optional protections it documented in April 2025 covering some path-disclosure scenarios tied to directory change notifications.

macOS came out the least exposed of the four platforms. Its equivalent API can only monitor globally readable files, which limits the attack surface, though the researchers still demonstrated tracking of application launches, app interactions, and settings changes.

The Linux kernel received a targeted patch under CVE-2025-68788, which stops the fsnotify subsystem from generating access and modify events for special files, including the device files representing keyboard input. The researchers describe this as addressing the most serious Linux issue, but other attack paths from their research remain open.

Apple and Google have not responded to requests for comment, and no fixes have been announced for Android or macOS. The researchers say they have found no evidence of active exploitation in the wild. Proof-of-concept code for the full set of attacks has been published on GitHub at isec-tugraz/file-notification-attacks.



Read more »
Telecom Hacking
Cameron Wagenius Credential Theft Cyber Extortion CyberCrime Data Breach Data Theft SIM Swapping Snowflake Attacks Telecom Hacking

Hacking and Extortion Operation Targeting U.S. Official Ends in Conviction


A former U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in prison for participating in a hacking and extortion campaign which exposed sensitive information and targeted telecommunication companies. According to the U.S. Department of Justice, Wagenius has also been ordered to pay $294,978 in restitution. Wagenius was involved in the cybercrime operation while serving as an active duty military member. 

In April 2023 and December 2024, he and other conspirators obtained credentials allowing them to access protected networks belonging to at least ten organizations. The stolen information was then used to extort victims by threatening publication or sale of the data without their payment.

Investigators have stated Wagenius was an online hacker known as “kiberphant0m” and he contributed to the development of the hacking tool SSH Brute, which was used to obtain login credentials. To exchange stolen credentials and coordinate access to victim networks, the group communicated via Telegram. Additionally, public threats were made on cybercrime forums.

Stolen information was made available for sale on platforms including BreachForums and Wagenius published two posts in November 2024 that contained stolen non-content call detail records associated with a former US government official and relatives of another former official. As part of the threats, the Justice Department also stated that additional confidential records would be released if a ransom was paid.

One of the posts indicated that the activity may be partly motivated by retaliation for the arrest of another cybercriminal. There have been several attacks involving major telecommunications companies and other companies. According to cybersecurity researchers, Wagenius' possession of data was related to broader attacks targeting Snowflake customer environments. Several companies were affected by the campaign, including AT&T, Ticketmaster, Advance Auto Parts, and Santander. 

Wagenius pleaded guilty in separate proceedings filed in the Western District of Washington in support of the charges. A conviction for wire fraud, extortion using computers, and aggravated identity theft was obtained in July 2025. Prior to this, he had pleaded guilty to two counts of unlawfully transferring confidential phone records related to the same operation in March 2025. Additionally, Wagenius appears to be tied to the wave of attacks against organizations using Snowflake cloud environments that took place in 2024. 

According to AT&T, attackers accessed call and text records covering nearly all of its mobile customers in December 2022. The stolen information was later associated with extortion activity involving several cyber criminals. Moreover, court records and the investigation report indicate that Wagenius attempted to sell stolen information to an email address he believed was affiliated with a foreign military intelligence service. Moreover, the prosecution alleges that he searched the Internet for information about leaving the United States for Russia. 

The intelligence services involved have not yet been publicly identified by the government. Based on the findings of the investigation, the hacking operation was primarily a result of the use of stolen credentials, rather than an exploit of a specific software vulnerability. The credentials were used by Wagenius and his associates to gain access to company networks and cloud environments, using Telegram to communicate access details and coordinate further intrusions. 

After invading victim networks, the group aimed at obtaining data to be monetized. In some cases, information was provided to other criminals, whereas other records were used for fraud schemes, such as SIM swapping. Additionally, extortion demands were extorted through private communications as well as public postings on cybercrime forums. 

The FBI, Defense Criminal Investigative Service, and other law enforcement agencies investigated these activities. A warrant was issued for Wagenius' arrest in December 2024, bringing to a close the hacking activities he allegedly conducted for more than a year while remaining an active duty soldier.
Read more »
Windows Backdoor
Clipboard Stealing Command And Control Data Theft malware PowerShell Malware Securonix TASK#STOMP Wi-Fi Password Theft Windows Backdoor

STOMP Backdoor Uses PowerShell for Sensitive Data Theft


An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection. 


In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence. 

By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in. 

Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel. 

By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation. 

As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well. 

With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware. 

A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication. 

Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures. 

According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran. 

Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined. 

The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#. 

A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.
Read more »
US Lawmakers
BellTroX Cyber Attacks cyber espionage Cyberattacks CyberRoot Data Theft Entity List Hack-For-Hire India-Based Hacking Firms US Lawmakers

US Lawmakers Raise Alarm Over Alleged Hacking by India-Based Firms


Three Indian-based companies have been accused of conducting hacking campaigns and stealing data from thousands of Americans and US businesses, according to a bipartisan group of US senators. As part of the request, the lawmakers sought restrictions that could limit companies' access to American technology and services in a letter to U.S. Commerce Secretary Howard Lutnick. 

Among the companies named in the letter are Sunkissed Organic Pvt Ltd, BellTrox Ltd, and CyberRoot Ltd. Democratic Senator Ron Wyden and Sheldon Whitehouse, along with Republican Senator Pat Harrigan, allege that the groups had engaged in targeted espionage activities against US citizens, businesses and legal professionals over the past fifteen years. 

A number of senators cited investigations conducted by Reuters and The Citizen Lab, in which they claimed that the companies had been involved in hacking campaigns targeting pharmaceutical companies, private equity firms, and attorneys employed by major law firms. It was stated in the letter that the groups operated under the direction of the Qatari government and some of these operations were intended to influence ongoing litigation. 

According to the senators, the alleged activities included targeting individuals who oppose Qatar's bid for the World Cup, as well as the family members of the former Republican Chairman of the House Permanent Select Committee on Intelligence. 

A number of allegations go beyond the hacking activities themselves, as well. A number of foreign legal actions were taken by legislators that were intended to restrict public reporting of the alleged activities. One such case involved Appin, in which executives related to the company obtained a global court order from an Indian court requiring Reuters to cease investigating the company. The order was subsequently lifted, allowing the investigation to be republished by Reuters. According to the senators, the episode illustrates the possibility of restricting the availability of American information through foreign legal proceedings. Additionally, previous reporting has documented legal threats to media outlets that cover alleged hack-for-hire operations related to Appin. The US Commerce Department has now requested that BellTroX, CyberRoot, and Sunkissed Organic Farms be added to the Entity List by the Bureau of Industry and Security of the US Commerce Department. By making such a designation, US companies may not export or transfer certain technologies, software, and other controlled items to these listed entities without a license. The requested restrictions would specifically target access to American software, cloud infrastructure, and cybersecurity tools. This move remains a request from Congress, and any Entity List designation requires the Commerce Department to take action. US authorities are now considering possible restrictions on the three firms' access to American technology and services in light of the lawmakers' request for the three firms to be under renewed scrutiny.
Read more »
Ransomware Gang
Conti Ransomware CyberCrime Data Theft malware Ransomware Attack Ransomware Developer Ransomware Gang

Conti Ransomware Ties Lead to Four-Year Prison Sentence


Ukrainian nationals have been sentenced to four years in U.S. prison for participating in the Conti ransomware operation. Between 2020 and 2022, the company was carrying out attacks against organizations throughout the United States and other countries. 

In addition to serving as a hacker and developer, Oleksii Oleksiyovych Lytvynenko, 44, was also an integral part of the operation. According to prosecutors, he personally targeted at least 12 companies, handled stolen information obtained from victims, and helped develop tools used during Conti's ransomware attacks. 

Lytvynenko pleaded guilty in June 2026 to conspiracy to commit wire fraud. She was responsible for controlling the theft of data from eight U.S. victims and four foreign victims. A ransom demand was also sent by him during Conti's double-extortion attacks, during which stolen information was used in conjunction with file encryption to pressure victims into paying.

According to the investigation, Lytvynenko also played a role in creating the malware loader for the group. This tool allows attackers to launch or load other malicious software onto compromised systems, providing attackers with another means of executing ransomware operations. 

Conti's Global Ransomware Campaign

In the course of its operation, Conti attacked companies across 47 U.S. states, Washington, D.C., Puerto Rico, and 31 other countries, making it one of the most active ransomware operations of its time. As reported by the FBI, ransom payments associated with Conti exceeded $150 million by January 2022. 

The group targeted hospitals, government agencies, and business entities among its target groups. According to its operations, Lytvynenko stole sensitive information and encrypted systems before demanding cryptocurrency payments from victims. Following a U.S. request, Lytvynenko was arrested in July 2023 at his Cork, Ireland, residence. 

After contesting extradition, he was ultimately transferred to the United States and held in Irish custody for a short period of time. The court's decision adds to the law enforcement response against the Conti ransomware network, which successfully shut down in 2022 in response to mounting pressure and the release of its internal communications. 

Evidence Linked Lytvynenko to Continued Ransomware Activity

It was discovered that Lytvynenko's online accounts contained much more than stolen victim information. Prosecutors alleged that the accounts contained Conti malware and ransom notes, as well as material relating to malware and hacking. As evidenced by his accounts, he searched for potential targets, indicating a deeper involvement than the development side of the operation. Court records also indicated his involvement in cryptocurrency transactions.

A transfer of about $25,042 worth of Bitcoin, involving 0.4 bitcoin, was traced to a victim associated with Lytvynenko's Conti activities. The court imposed a forfeiture of the same amount. Evidence recovered from Lytvynenko's computer after the arrest in 2023 also raised concerns regarding his continued involvement in cybercriminalism.

Investigators discovered Cobalt Strike running on the device and a Rocket.Chat session connected through Tor. Prosecutors said the forensic evidence indicated that Lytvynenko continued to participate in ransomware attacks after Conti ceased to operate. 

Conti's Collapse Did Not End Its Criminal Network

Following the release of internal chats and source code, Conti disbanded in 2022, which revealed details regarding the ransomware group and its members. As a result of the group's public support of Russia after the invasion of Ukraine, investigators were able to gain additional insight into its structure and activities by investigating the leak. 

While the shutdown was initiated, prosecutions did not immediately cease. Four additional Conti members were charged in separate indictments in 2023, and in 2024 Ukrainian authorities arrested another suspected Conti member in Kyiv. Lytvynenko's case contributes to the ongoing legal action against those involved in the ransomware operation by adding another conviction.
Read more »
switch
Cyber Security Data Theft Nintendo qr code switch

Nintendo Switch Security Flaw Lets Nearby Attackers Exploit QR Codes Used to Share Screenshots

 



Nintendo has issued an urgent security advisory for owners of the original Switch console, warning of a flaw that could allow an attacker in close physical proximity to run unauthorized code on the device or pull data stored on it, simply by scanning a QR code displayed on the screen.

The vulnerability, catalogued as CVE-2026-82079, sits inside the console's local wireless networking stack and is classified as a stack-based buffer overflow, a type of memory corruption flaw in which a program writes more data into a fixed-length block of memory than it can hold. According to the technical record logged on OpenCVE, an attacker within wireless range can send specially crafted network packets that overflow this buffer and hijack the execution path of the device using a technique called return-oriented programming, which chains together fragments of existing code to carry out malicious instructions.

The bug affects all Nintendo Switch consoles running firmware earlier than version 23.0.0. The Switch 2 is not affected.


Where the QR code comes in

The attack is not theoretical in isolation, but it does require a specific scenario to work. The vulnerability surfaces when the console generates a QR code as part of its "Send to Smartphone" feature inside the Album application, which players use to transfer screenshots and video clips to a mobile device. It also appears when the local wireless function is active during a session of Mario Kart Live: Home Circuit, a game that pairs a real-world physical kart with the console.

In both cases, a QR code is briefly displayed on the Switch screen or the connected TV. Nintendo's advisory states that an attacker would need to physically scan that code while it is visible. If they manage to do so, the console becomes vulnerable to arbitrary code execution or information disclosure.

Nintendo said it has no evidence the flaw has been exploited in the wild as of September 10. The company also did not say that the vulnerability could be used to steal Nintendo account credentials, though it acknowledged that more serious exploits could theoretically be built on top of it.


Update now, or take these precautions

The fix is straightforward: install system update 23.0.0. Consoles connected to the internet will pull the update automatically, but players should verify the installation has completed in the console's System Settings under System and then System Update.

For players who cannot update immediately, Nintendo recommends keeping QR codes out of sight during photo and video sharing sessions. The company also advises against using another person's smartphone when transferring media, and against letting anyone else use their kart during a Mario Kart Live: Home Circuit session, since either scenario could create an opportunity for an attacker to scan the code.


How exposed is the player base

The scope of this issue is substantial purely because of how many original Switch units are in circulation. The original Switch has shipped over 155.92 million lifetime units as of March 31, 2026, making it one of the best-selling consoles ever made. Even with the Switch 2 now in the market, tens of millions of households around the world are still running the original hardware day to day. 

Nintendo said the flaw was discovered and reported by external security researchers, though it did not name them in its advisory, which was published on September 10.

The practical risk of this exploit being triggered in a real-world attack is relatively narrow. An attacker would need to be physically close to the device, see the QR code on screen, and scan it within the brief window it is displayed. That is a more demanding set of conditions than most software vulnerabilities require. But the potential consequence, unauthorized code execution on the console, is serious enough that Nintendo moved quickly to patch it, and players should move just as quickly to install that patch.

Read more »
User Privacy
Android Trojan Data Theft malware MantaxOtax User Privacy

MantaxOtax Android Malware Merges Ransomware and Spyware in New Indonesian Campaign

 

MantaxOtax is a newly identified Android malware that merges ransomware-style file encryption with aggressive spyware capabilities, enabling attackers to both lock users out of their devices and harvest sensitive personal data. Discovered by Zimperium's zLabs team and detailed in a September 9 technical write-up, the threat appears linked to Indonesian actors and spreads primarily via sideloaded APKs hosted on third-party file-sharing platforms. This dual-function design marks a significant escalation in mobile threats, combining financial extortion with deep surveillance to maximize victim impact. 

Once installed, MantaxOtax requests device administrator privileges, followed by permissions for SMS, contacts, audio, images, and Android Accessibility services, which grant it deep control over user interactions. It dynamically resolves its command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the malware code. 

On Android 9 and earlier, it recursively scans external storage, encrypts files using AES with unique per-device keys fetched from C2, deletes originals, and leaves behind .enc files; on Android 10+, Scoped Storage limits encryption to the app's own directory. The malware also overwrites victims' images with ransom notes and opens a Firebase-based chat interface for extortion negotiations, which researchers found partially exposed due to a server misconfiguration. 

Beyond encryption, MantaxOtax operates as a full-featured spyware, collecting app inventories, hardware specs, location, browser history, notifications, contacts, call logs, and SMS—including one-time passwords (OTPs). It exfiltrates gallery content, linked Google accounts, WhatsApp profiles and messages (via Accessibility), and Telegram credentials and chat histories. By abusing Android's MediaProjection API, it captures screenshots, records MP4 screen videos, and streams near-real-time footage to attackers, storing media on the Catbox file host. It can also silently activate front or rear cameras to take photos without user knowledge, turning infected devices into always-on surveillance tools. 

Researchers observed multiple variants employing psychological pressure tactics: persistent screen locks, application blocking, and transparent overlays that hijack all touch input. Some versions bombard victims with repeating alert dialogs, full-screen video overlays, and image popups appearing every 600 milliseconds, while others use text-to-speech to audibly deliver attacker messages. A second iteration adopted WebSocket communications for more resilient C2 channels and added features like continuous screen locking and app blacklisting, making remediation harder for average users. These harassment techniques are designed to overwhelm victims into compliance, increasing the likelihood of ransom payment or credential surrender. 

Evidence including language markers and recovered victim files suggests MantaxOtax primarily targets Indonesian users. The misconfigured server also leaked what appears to be the operators' control panel, offering rare insight into their infrastructure. This campaign follows closely after the discovery of THost9, another Android trojan that clones banking apps into isolated work profiles to evade detection. Together, these threats underscore a growing trend of multi-stage mobile malware combining financial fraud, surveillance, and ransomware—highlighting the critical need for users to avoid sideloading apps, keep devices updated with the latest security patches, and use reputable mobile security solutions to detect and block such sophisticated threats before they cause harm.
Read more »
Hacker attack
Berlin Commissioner Data Breach data security Data Theft Government Network Security Hacker attack

Berlin Confirms Extortion Attempt After Network Compromise as Manchester Airports Group Reports Customer Data Theft

 

The state of Berlin confirms that it is the victim of an extortion attempt after allegedly having its network hacked back in August. Authorities say they will not give in to the hackers’ demands. 

Forensic analyses of the network of the Senate Department of Mobility, Transport, Climate Protection and the Environment have revealed additional data thefts outside the network in the period between August 7 and 12. The department had first noticed data loss on August 7 and had been cut off on August 14. Berlin is currently still investigating the extent and scope of the data loss, saying that it is possible that personal data or other confidential information had been accessed. 

The amount of data stolen in the cyber-attack on Berlin has not been disclosed officially; however, one entry on the dark web by the hackers’ group Rhysida, published on August 28, claims that 5,79 TB of data containing personal information of 12,076 people were stolen. The entry also stated that approximately 1,44 million files had been scanned. 

According to the post, the target of the attack was Berlin, Germany, without specifying any ransom value. Der Spiegel revealed that the ransom note was published by the hacker collective Rhysida, citing the group’s dark web blog and security sources. According to the report, a monitoring service confirmed on Friday that a post titled “Berlin, Germany” appeared on the leak site of Rhysida on August 28. Berlin has not officially attributed the attack to any hacker group. 

A joint security advisory released by the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and the Multi-State Information Sharing and Analysis Center highlights that Rhysida has been abusing compromised legitimate usernames and passwords from remote access services and has been using phishing and the Zerologon vulnerability (CVE-2020-1472). The advisory recommends prioritizing the response to known exploited vulnerabilities, implementing multi-factor authentication and network segmentation. 

Berlin’s data protection commissioner and the Federal Office for Information Security have been informed of the attack. Interior Minister Iris Spranger stated that, according to preliminary information, no data from the election-relevant IT systems were removed from the network. Thus far, no election functions have been interrupted. Meanwhile, Manchester Airports Group (MAG) has announced that a cyber-security incident involving the unauthorized collection of customer data occurred at its UK airports. 

The personal data of passengers who booked car parking, lounges, or Fast Track services or who subscribed to in-airport WiFi were affected. The data compromised in the breach include customers’ email addresses, phone numbers, vehicle registration numbers, and postcode details. According to MAG, the data do not include customers’ payment or bank details, and no impact has been made on passengers’ safety or aviation safety or airport operations.

As of August 29, the online booking system, called Manage My Booking, has been temporarily offline for security reasons. It has been reported that affected customers have been contacted directly and have been warned to be vigilant of further communication attempts from unauthorized third parties.
Read more »
vishing
Advanced Social Engineering Data Breach Data Theft Exposed Patient Records ransom ShinyHunters vishing

McKesson Probes Data Theft After ShinyHunters Claims Access to Patient Records




McKesson Corporation is investigating a cybersecurity incident involving unauthorized access to third-party applications and data exfiltration, while the ShinyHunters extortion group claims it stole approximately 284 million patient-related records from the healthcare and pharmaceutical distribution company.

McKesson said it discovered the incident on August 25 and immediately activated its incident-response procedures. The company has brought in external cybersecurity specialists to assist with the investigation, which it said remains in its early stages.

In a filing with the U.S. Securities and Exchange Commission, McKesson said it has not determined that the incident is material or that it has had, or is reasonably likely to have, a material impact on its financial condition or operations.

The company confirmed in a separate customer notice that the incident involved unauthorized access to third-party applications and the exfiltration of data. McKesson has not identified the affected applications, disclosed how the attackers obtained access, or confirmed what information was taken.

Customers could also experience intermittent service degradation believed to be related to the incident. McKesson said it was not proactively disconnecting systems within its environment.


ShinyHunters claims employee accounts were compromised

ShinyHunters claims it obtained initial access through voice-phishing, or vishing, attacks targeting multiple McKesson employees.

According to the group, the attacks resulted in the compromise of several employee Okta single sign-on accounts. Those accounts were allegedly used to access McKesson's Salesforce and Snowflake environments.

The group claims it obtained extensive access to Salesforce, including support cases, and extracted a larger volume of patient-related information from Snowflake.

ShinyHunters alleges that approximately 1 TB of data was removed over four days, from August 21 through August 25.

The group has claimed that the Snowflake data contained roughly 284 million patient-related records. However, it later clarified that this figure represents individual database records or lines, rather than 284 million unique patients.

ShinyHunters also said it has not completed its analysis of the stolen material and therefore cannot determine how many individuals are represented in the dataset.

The alleged information includes names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers and medical record numbers. The group also claims the data contains medication and allergy information, illnesses, disabilities, appointments, physician details, prescriptions and medication shipments.

Other allegedly stolen material includes information relating to deceased and terminally ill patients, invoices, employee data, Salesforce records, internal communications, and information about healthcare providers and clinics using McKesson's services.

McKesson has not confirmed any of these specific data categories, and the claims about the stolen information have not been independently verified.


McKesson domain follows ShinyHunters pattern

The alleged campaign also involved the "mckesson[.]claims" domain.

The domain follows a pattern previously associated with ShinyHunters activity. ReliaQuest has documented campaigns in which domains using a targeted company's name or abbreviation alongside the ".claims" top-level domain were used to impersonate help-desk or IT personnel.

The technique is particularly relevant to the alleged McKesson attack because social engineering is increasingly being used to obtain legitimate employee credentials rather than deploying malware directly against an organization's infrastructure.

ReliaQuest recently documented an attempted attack against its own employees in which an attacker used a lookalike domain, impersonated a security employee and attempted to persuade staff to authenticate through a fraudulent SSO page. Additional security controls prevented the attacker from reaching business applications or customer information.

Health-ISAC has also warned healthcare organizations about an increase in ShinyHunters activity involving social engineering, identity compromise and subsequent access to cloud and SaaS platforms.

Its analysis describes an attack chain in which threat actors use vishing or help-desk manipulation to compromise identity-provider accounts before moving into connected services. Such access can allow attackers to retrieve large volumes of information through legitimate cloud applications.

Research from the Retail & Hospitality ISAC has further linked ShinyHunters to the abuse of OAuth relationships and SaaS applications. By operating through legitimate identities or application permissions, attackers can make unauthorized activity more difficult to distinguish from ordinary cloud usage.

The alleged McKesson intrusion has not been independently confirmed to have followed this entire sequence, but the claimed compromise of employee SSO accounts followed by access to Salesforce and Snowflake is consistent with the identity-focused tactics researchers have been tracking.


$55 million ransom demand claimed

ShinyHunters claims it contacted McKesson after completing the alleged data theft on August 25 and demanded $55,236,150 in ransom, giving the company 72 hours to respond.

The group claims McKesson did not negotiate over the demand.

McKesson has not publicly confirmed the ransom demand or its alleged communications with the extortion group.

The incident comes as ShinyHunters-linked attacks continue to target healthcare and health-technology organizations. Recent organizations reportedly targeted by the group include Medtronic, DentaQuest, iRhythm, One Medical and AdaptHealth.

For McKesson, the immediate question remains the actual scope of the incident. The company has confirmed unauthorized access to third-party applications and data exfiltration, but has not established which systems were affected, what information was taken or how many individuals may ultimately be impacted.

Until McKesson completes its investigation, the 284 million-record figure and the specific claims surrounding the alleged Snowflake and Salesforce compromise remain unverified.

Read more »
URL
Data Breach Data Theft Microsoft Copilot prompt injection URL

Microsoft Copilot Flaws Could Expose User Data With One Click

 


Microsoft Copilot Personal contains three vulnerabilities that could allow an attacker to execute a malicious prompt with one click and exfiltrate data from connected applications, according to Varonis Threat Labs.

The researchers collectively named the flaws CoSnitch and reported them to Microsoft in December 2025. Microsoft patched the vulnerabilities on August 18, 2026, with the issue tracked as CVE-2026-24301. Varonis said it found no evidence of exploitation in the wild. The research concerns the consumer Copilot service at copilot.microsoft.com and does not establish that the same behavior affected Microsoft 365 Copilot.


Copilot Revealed Its Own Attack Path

Varonis discovered the vulnerability through what it calls "meta-hacking," repeatedly asking Copilot why a prompt could not execute without user interaction. After several refusals containing technical explanations, Copilot eventually disclosed an undocumented "autorun=1" URL parameter, including the conditions and safeguards associated with it.

Researchers constructed the URL as described and found that the supposedly disabled parameter still executed. They combined "autorun=1" with Copilot's existing "q" parameter, which pre-fills the prompt. While "q" alone requires user interaction, the combination automatically triggered the prompt when the page loaded.

Varonis said the prompt then continued executing even if the victim immediately closed the Copilot tab. Its earlier Reprompt research had also used "q" as a one-click Parameter-to-Prompt mechanism.


Existing Permissions Enable Data Theft

The first two CoSnitch flaws form the one-click exfiltration chain. The injected instruction operates with the same capabilities available to a legitimate user prompt and does not grant Copilot additional permissions.

Researchers demonstrated access to connected mail messages, subject lines and sender and recipient metadata; calendar titles, attendees, times and locations; Google Drive filenames and metadata summaries; previous Copilot conversations; and stored memory instructions and user-defined rules.

The retrieved information could be encoded, including with Base64, and transmitted through Copilot's built-in URL-fetching capability to an attacker-controlled webhook. Varonis said the resulting request could resemble Copilot's ordinary web retrieval traffic, potentially making network-level detection difficult.


Separate Memory Poisoning Path

The third vulnerability involves indirect prompt injection through web summarization. A malicious webpage could contain attacker-controlled instructions that Copilot processed and wrote into its persistent memory.

Varonis said such injected memories could survive password changes, session revocation and device re-enrollment until manually removed. The modification reportedly generated no process, file or network activity that conventional security tooling would necessarily flag, although the change remained visible in Copilot's memory interface.

The finding follows earlier Microsoft 365 Copilot memory research by Håkon Måløy and Johann Rehberger. Microsoft has separately said M365 Copilot applies sanitization and prompt-injection checks to memory writes, performs Task Adherence checks on explicit memory updates, and records those changes for security monitoring through audit data and the "MemoryUpdated" field.

Varonis recommends reviewing connected applications, disconnecting unnecessary services, monitoring AI assistants as privileged systems and exercising caution with links that open AI assistants.

The disclosure follows Varonis's RovoBlast research, which identified another one-click attack involving Atlassian's Rovo assistant. Together, the findings demonstrate how URL handling, authorized application access, external content and persistent AI memory can combine into an attack chain without directly compromising the victim's underlying accounts.

Read more »
Subscribe to: Posts (Atom)