Attackers are hijacking GitHub accounts and silently planting malware in Python repos.
ForceMemo uses stolen tokens to force-push malicious code while preserving the original commit author and message—rewriting Git history with no visible trace in the UI.
ForceMemo uses stolen tokens to force-push malicious code while preserving the original commit author and message—rewriting Git history with no visible trace in the UI.
ClickFix campaigns are spreading macOS infostealer MacSync.
Victims paste a Terminal command from fake install pages or ChatGPT threads, installing malware that steals credentials, files, Keychain data, and crypto wallet seeds.
Victims paste a Terminal command from fake install pages or ChatGPT threads, installing malware that steals credentials, files, Keychain data, and crypto wallet seeds.
A new ClickFix variant abuses Win+R to mount a remote WebDAV drive and run malware.
It launches a trojanized WorkFlowy Electron app that beacons to C2 every 2 seconds. Atos says it bypassed Microsoft Defender and surfaced only through threat hunting.
It launches a trojanized WorkFlowy Electron app that beacons to C2 every 2 seconds. Atos says it bypassed Microsoft Defender and surfaced only through threat hunting.
Russian hackers targeted Ukrainian entities with DRILLAPP, a JavaScript backdoor executed through Microsoft Edge.
It abuses Chromium debugging flags to access files, record audio, capture webcam images, and grab screen data.
Lures referenced Starlink installs and a Ukrainian charity.
It abuses Chromium debugging flags to access files, record audio, capture webcam images, and grab screen data.
Lures referenced Starlink installs and a Ukrainian charity.
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Hackers have compromised over 100 CCTV cameras across multiple locations in Israel, obtaining sensitive footage in the latest CCTV breach.
@TheGhostITM
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Cyber Attacks During "Operation Israel" (Feb 23 – Mar 17)
The trend continues into the 18th day of the operation, with a significant increase in the number of attacks.
Most of the attacks are DDoS attacks and significant data leaks.
@TheGhostITM
The trend continues into the 18th day of the operation, with a significant increase in the number of attacks.
Most of the attacks are DDoS attacks and significant data leaks.
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
מתקפות סייבר במהלך "מבצע ישראל" (23 בפברואר – 17 במרץ)
המגמה נמשכת גם ביום ה-18 למבצע, עם עלייה משמעותית במספר המתקפות.
רוב המתקפות הן מתקפות DDoS ודליפות מידע משמעותיות.
@TheGhostITM
המגמה נמשכת גם ביום ה-18 למבצע, עם עלייה משמעותית במספר המתקפות.
רוב המתקפות הן מתקפות DDoS ודליפות מידע משמעותיות.
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
More than 150 different hacker groups and lone-wolf operatives are active in the cyber space against Israel. The main and most significant attacks are carried out by pro-Palestinian hacktivist groups and their affiliates, as well as pro-Iranian groups.
The government and financial sectors are the most targeted sectors, primarily through DDoS attacks and similar methods.
@TheGhostITM
The government and financial sectors are the most targeted sectors, primarily through DDoS attacks and similar methods.
@TheGhostITM
❤1
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
יותר מ-150 קבוצות האקרים שונות ופועלים בודדים פועלים במרחב הסייבר נגד ישראל. המתקפות המרכזיות והמשמעותיות ביותר מבוצעות על ידי קבוצות האקטיביסטיות פרו-פלסטיניות ושותפיהן, וכן קבוצות פרו-איראניות.
המגזר הממשלתי והמגזר הפיננסי הם המגזרים המותקפים ביותר, בעיקר באמצעות מתקפות DDoS ושיטות דומות.
@TheGhostITM
המגזר הממשלתי והמגזר הפיננסי הם המגזרים המותקפים ביותר, בעיקר באמצעות מתקפות DDoS ושיטות דומות.
@TheGhostITM
CERT/CC warns a ZIP flaw tracked as CVE-2026-0866 lets attackers hide malware using malformed archive headers.
Security tools trust the header and miss the payload, while it can still be extracted and executed with the right method.
Security tools trust the header and miss the payload, while it can still be extracted and executed with the right method.
A Magecart skimmer hid its payload in a favicon’s EXIF metadata, never entering the codebase.
A fake CDN script fetched the image, decoded a hidden URL, and executed it in the browser.
No repo changes. No scan alerts. Payment data was exfiltrated at checkout.
A fake CDN script fetched the image, decoded a hidden URL, and executed it in the browser.
No repo changes. No scan alerts. Payment data was exfiltrated at checkout.
Low-cost IP KVM devices expose a direct path to full system takeover.
Researchers found 9 flaws across 4 devices, including unauthenticated root access and remote code execution. Operating below the OS, they let attackers bypass security tools and maintain silent, persistent control.
Researchers found 9 flaws across 4 devices, including unauthenticated root access and remote code execution. Operating below the OS, they let attackers bypass security tools and maintain silent, persistent control.
A new flaw in Ubuntu 24.04+ lets attackers gain full root access from low privileges.
By timing system cleanup, they replace a snap directory and execute code as root—no user action required.
By timing system cleanup, they replace a snap directory and execute code as root—no user action required.
Apple patched a WebKit flaw that lets crafted pages bypass browser isolation.
CVE-2026-20643 impacts iOS, iPadOS, and macOS. Fixes now ship via background updates, outside full OS releases.
CVE-2026-20643 impacts iOS, iPadOS, and macOS. Fixes now ship via background updates, outside full OS releases.
An unpatched critical telnetd bug (CVE-2026-32746) lets attackers gain full system access with no credentials.
One connection to port 23 is enough to trigger memory corruption and execute code as root.
No patch yet. Prior telnet flaw is already exploited in the wild.
One connection to port 23 is enough to trigger memory corruption and execute code as root.
No patch yet. Prior telnet flaw is already exploited in the wild.
Amazon Bedrock, LangSmith, and SGLang flaws expose data leaks, token theft, and RCE risks across AI platforms.
Bedrock allows DNS-based exfiltration, LangSmith had account takeover, and SGLang remains vulnerable—showing weak isolation in real-world AI systems.
Bedrock allows DNS-based exfiltration, LangSmith had account takeover, and SGLang remains vulnerable—showing weak isolation in real-world AI systems.
A full Roundcube exploit kit tied to APT28 was found on a live server, targeting Ukrainian government email.
It enables XSS takeover, mailbox exfiltration, hidden forwarding, and even 2FA secret theft. Includes a new CSS-based data exfiltration method.
It enables XSS takeover, mailbox exfiltration, hidden forwarding, and even 2FA secret theft. Includes a new CSS-based data exfiltration method.
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
A hacktivist group has targeted the employee portal (MyTeva) of Israeli pharmaceutical company Teva.
@TheGhostITM
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Akamai reports a 245% surge in cyberattacks on U.S. targets since the war with Iran began. About 40% of these attacks have hit American banks and tech firms.
@TheGhostITM
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Cyber infiltration targeting the information infrastructure of the Zionist regime has intensified, with a new wave of malicious SMS messages sent to settlers in recent hours.
In these messages, hackers impersonate the Israeli military’s Home Front Command, urging recipients to download a purported “shelter safety” application via an embedded link.
The link is malicious, and interacting with it may expose users’ personal and identity data to theft, while also potentially compromising their devices. Initial reports indicate that multiple settlers have already fallen victim to the campaign.
@TheGhostITM
In these messages, hackers impersonate the Israeli military’s Home Front Command, urging recipients to download a purported “shelter safety” application via an embedded link.
The link is malicious, and interacting with it may expose users’ personal and identity data to theft, while also potentially compromising their devices. Initial reports indicate that multiple settlers have already fallen victim to the campaign.
@TheGhostITM