‼️ Hoax bomb threats that hit about 6,000 Italian schools came from at least two university email accounts whose passwords malware had stolen long before.

Together with Hudson Rock we tied one, from an Egyptian university, to a Windows 7 PC hit by the Vidar password stealer in 2021.

The other is a Taiwanese alumni account at Da-Yeh University. Its Microsoft login sat in a stolen-password dump over a year ago. The university says it looked hacked and has suspended it.

The same emails hit 300+ schools in Northern Ireland. No bombs were found.

https://x.com/IntCyberDigest/status/2120850093397913963

‼️ Megaspeed, the Singapore firm at the centre of the Jensen Huang spy row, has hired a leading US law firm to count its own GPUs.

Its statement says it takes US export laws "extremely seriously". It never mentions Nvidia, Jensen Huang or its former executive Alice Huang, whom US officials reportedly suspect of spying for China.

Megaspeed bought more than $4.8B of Nvidia hardware in two years. Bloomberg found it imported about 50,000 more chips than Nvidia counted as sold to it.

Bloomberg also reports the US Justice Department asked investigators to pause the Megaspeed smuggling case late last year.

https://x.com/IntCyberDigest/status/2120864209026089208

‼️ BREAKING: Nvidia CEO Jensen Huang resigned days after admitting an affair with a woman alleged to be a Chinese spy and a day after reports of a second affair with an Nvidia executive.

The board says CFO Colette Kress will serve as interim CEO.

https://x.com/IntCyberDigest/status/2120880647300407379

Belgium's government can't agree on who hacked its supermarket freezers. The interior minister pointed at Iran and asked Defence to consider a military cyber response.

Hours later, the foreign minister's office told Belgian outlet HLN the evidence is not enough to officially blame Iran. No decision has been made on summoning Iran's ambassador.

Earlier this month, hackers remotely switched freezers in dozens of Belgian stores to defrost, some set to 50°C.

https://x.com/IntCyberDigest/status/2120905717854917081

‼️ Dutch researchers found six new ways to take over the Danfoss fridge controller hackers have been hijacking in European supermarkets. None needs a login, and finding them took them under an hour.

Security researchers says every firmware up to the latest, 5.3.2, is affected. There is no patch, and the "strict" mode France's cyber agency advised doesn't help.

The software runs as root with no stack canaries and no secure boot, so an implant could possibly survive a factory reset.

Their write-up is titled "Don't bother patching." Belgium's cyber centre says to get the controllers off the open internet now.

https://x.com/IntCyberDigest/status/2120920955828486438

‼️ A Kremlin propagandist's leaked laptop shows him using Claude and Qwen to mass-produce 43k articles a month, aimed at manipulating AI chatbots into repeating his propaganda as fact.

John Mark Dougan, a US citizen who fled to Moscow, said, "Publish my laptop. I don't care."

https://x.com/IntCyberDigest/status/2120935907918598572

‼️ BREAKING: Hijacked GitHub accounts are pushing a stealer into 61,000+ code repositories to grab the keys to companies' cloud and build systems.

Security firm Aikido counts 4,837 compromised accounts since 10 November. The "wfx" stealer ran in at least 1,806 repos.

It then reverts its change within about a minute and deletes the run logs, so the real number may be higher.

It also plants backdoors in AWS and Azure that keep working after stolen keys are rotated.

The tell is a pull request titled "docs: dependency audit notes". Aikido says any account that opened one is compromised.

https://x.com/IntCyberDigest/status/2120951007878238368

‼️ Microsoft Defender quietly uploaded a developer's unreleased programs to Microsoft 217 times in three months.

Garrett Stimpson found it in Defender's own logs. Most were test builds of one Go program, and one was a Python script from the Recycle Bin. Over 30 days, Defender's sample tool sent 2.8 GB.

On 28 October, Stimpson set sample sharing to "never send." Two hours later the setting flipped back on, and 25 more uploads followed.

The developer says no prompt ever appeared and can't tell what switched it back. Microsoft documents automatic "safe sample" uploads as Defender's default.

https://x.com/IntCyberDigest/status/2120966107313967253