Researchers have uncovered secret AI surveillance projects linked to KYC provider Persona and OpenAI, sending user data to the US government.

Code references include intelligence program codenames "Project SHADOW" and "Project LEGION."

Analysis of source code revealed OpenAI's user verification systems includes biometric tracking, facial scanning, political screening, and intelligence reporting.

Researchers also discovered ONYX on Persona's government server — matching ICE's $4.2M AI surveillance tool — which scrapes social media and the dark web, builds digital footprints, tracks emotional sentiment, assigns risk scores across 300+ platforms and 28B+ data points, and flags individuals for "violent tendencies."

None of it was hidden. It was all internet-facing.

Hacker group targeted Clalit, Israel’s largest healthcare organisation, exposing full patient records, oncology files, diagnostic histories, military-related medical exemptions, billing documents, clinician communications, and backend service logs.

جميع قنوات الأخبار والأخبار السياسية العاجلة باللغة الفارسية على قمر ياه سات الصناعي، وهو قمر اتصالات مقره في الإمارات العربية المتحدة ويستخدم على نطاق واسع في جميع أنحاء الشرق الأوسط، غير متاحة.

السبب الدقيق لا يزال غير واضح ..

The US gave an ultimatum to Anthropic to remove all AI safeguards from their AI for military use, or face the Defense Production Act. Anthropic refused.

300+ employees of Google and OpenAI have now signed a letter putting their jobs on the line.

You can now ask Kali Linux tools in plain English — powered by Anthropic Sonnet 4.5.

Through MCP, Claude SSHs into Kali to run tools like nmap, gobuster, nikto, hydra, sqlmap, metasploit, john, wpscan, enum4linux-ng, checks dependencies, and returns results in-app.

A malicious Go package injected code into ssh/terminal/terminal.go to capture passwords.

It posed as Go’s crypto library, stole secrets, loosened firewall rules, and deployed Rekoobe — a Linux trojan linked to APT31 as recently as 2023.

Microsoft warns of trojanized gaming tools spreading a Java-based RAT.

Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy more payloads.

Once launched, it connects to an external server at "79.110.49[.]15" for command-and-control (C2) communications, allowing it to exfiltrate data and deploy additional payloads.

Elon Musk’s SpaceX blocks Russian access to Starlink.

Microsoft warns of trojanized gaming tools spreading a Java-based RAT.

Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy more payloads.

Meta is suing scam advertisers in Brazil, China, and Vietnam after uncovering celeb-bait and cloaking schemes on its platforms.

It says it now protects 500,000+ celebrity images from repeated abuse and has suspended payments, disabled accounts, and blocked domains.

New botnet loader Aeternum uses Polygon smart contracts as its C2 channel.

Commands go straight to the public blockchain—infected devices pull & execute them. No servers. No domains. No easy takedown.

A previously unseen backdoor called Dohdoor is being deployed against U.S. schools and healthcare orgs.

Tracked as UAT-10027, the campaign chains phishing → PowerShell loaders → DLL side-loading → DoH C2 (via Cloudflare) → final Cobalt Strike payload.

Israel is experiencing a major cyber attack.

The destruction of Israeli infrastructure has begun. This is a major cyber war against Israel since October 7th.

We Condemn False Claims Amid Ongoing #OpIsrael Cyber Campaign

"Israel is experiencing a major cyber attack." @CyberDispatch

"The destruction of Israeli infrastructure has begun. This is a major cyber war against Israel since October 7th." @CyberDispatch

As journalists covering the escalating cyber conflict targeting Israeli infrastructure, we are compelled to address a growing concern within the hacktivist community: the proliferation of false claims of responsibility.

Since October 7th, a sustained and significant cyber offensive has targeted Israeli digital infrastructure. Our verification processes confirm that thousands of Israeli sites have been rendered inaccessible, with military and government domains suffering particularly heavy disruption. The damage is real, and the coordinated effort behind it is substantial.

However, we are observing an increasing number of individuals and groups fraudulently claiming credit for attacks they did not execute. This behavior undermines the integrity of authentic hacktivism. Taking credit for someone else's labor is not activism—it is opportunism. It disrespects the skilled operatives risking exposure to make genuine contributions.

To those participating in the #OpIsrael campaign: we urge you to engage authentically. If you possess the capability to contribute technically, do so for the cause, not for personal recognition or social media attention. If you cannot participate directly, support by amplifying verified information.

"We argue that genuine hacktivists do not falsely claim credit for operations in the cyber war against Israel. Many participants are merely conducting banner grabbing or host checks on target domains rather than executing actual attacks. While thousands of Israeli sites—particularly military and government domains—are reportedly down, taking undue credit undermines the legitimacy of hacktivist operations.

If you are joining the 'OpIsrael' campaign, participate with genuine intent rather than seeking personal recognition. As journalists and security researchers, we are prepared to highlight credible actions, but we will strictly expose and deconflict false claims as part of our operational security (OpSec) protocol."

@TheGhostsITM

We are currently witnessing cyber attacks on Israel, the US, and Iran.

موقع والا العبري:

هجمات سيبرانية إيرانية تسببت بعطل في شبكات الاتصالات والانترنت الليلة في إسرائيل