Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene. The affected products include Amazon
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 3:20 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all right under the company’s nose.
Today, we’re excited to announce a few developer experience improvements to Cloudflare AI Search to make it easy to manage a search solution out of the box. Previously, you had to stitch together components of the Cloudflare primitives (Workers AI, AI Gateway, Vectorize, R2, Browser Run) but now, AI Search can do this automatically — and better. Our goal is to give your agents their own search engine, where they can easily find data to provide better answers for themselves and their humans. We’re also sharing an early preview of pricing for customers of AI Search so you can learn how this scales. We modeled pricing in a way that makes it predictable and scalable: embedding and reranking are free when you use the default models, so no need to worry about predicting token count. In AI Search, users can now: Index a collection of data for your agent: Make structured and unstructured data easily accessible for your agent to build with, from individual files to websites you own. (Today, it must be a zone on your Cloudflare account, but with more ways to verify ownership coming soon.) Skip the sitemap for your websites: Previously, AI Search required that websites have a sitemap to use the website integration. Now you can select the “Discover” parsing option to add a website without a sitemap as a source. Get a single public endpoint for searching across a namespace: When you enable public URLs on your namespace, you can get a /search and /mcp endpoint that can search through multiple instances or websites at once without authentication, so you can share easily with your customers. Put your own custom domain over public endpoints: You can now add your own domains over your public URLs, so you can brand your /search
Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese
Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed.
Latest
Thursday, August 6
Today, we’re excited to announce a few developer experience improvements to Cloudflare AI Search to make it easy to manage a search solution out of the box. Previously, you had to stitch together components of the Cloudflare primitives (Workers AI, AI Gateway, Vectorize, R2, Browser Run) but now, AI Search can do this automatically — and better. Our goal is to give your agents their own search engine, where they can easily find data to provide better answers for themselves and their humans. We’re also sharing an early preview of pricing for customers of AI Search so you can learn how this scales. We modeled pricing in a way that makes it predictable and scalable: embedding and reranking are free when you use the default models, so no need to worry about predicting token count. In AI Search, users can now: Index a collection of data for your agent: Make structured and unstructured data easily accessible for your agent to build with, from individual files to websites you own. (Today, it must be a zone on your Cloudflare account, but with more ways to verify ownership coming soon.) Skip the sitemap for your websites: Previously, AI Search required that websites have a sitemap to use the website integration. Now you can select the “Discover” parsing option to add a website without a sitemap as a source. Get a single public endpoint for searching across a namespace: When you enable public URLs on your namespace, you can get a /search and /mcp endpoint that can search through multiple instances or websites at once without authentication, so you can share easily with your customers. Put your own custom domain over public endpoints: You can now add your own domains over your public URLs, so you can brand your /search
Over the last year and a half, the Model Context Protocol (MCP) has become the universal standard for how agents interact with external services. But one of the main criticisms of MCP was that the protocol required a stateful connection between Client and Server. This evolved from MCP’s origins and the first STDIO transport, designed for local applications . When MCP Servers went remote, it translated the stateful connection that worked so well locally and transposed it onto web infrastructure. Building a well-behaved MCP Server meant managing request routing to sticky sessions, holding open streams, message replay, and generally more overhead and complexity than a traditional web server. This changes now. The latest MCP 2026-07-28 specification was released last week, together with updated TypeScript, Python, Go, and C# SDKs. MCP is now a fully stateless protocol. The specification, interaction model and SDKs have all been rewritten to leverage this new protocol and simplify usage. This means that MCP servers can now run in just a Worker, no stateful infrastructure needed, and customers benefit from the operational simplicity and reduced cost of less moving parts. A new MCP At Cloudflare, our journey with MCP goes back to the very beginning. In March 2025, we released our McpAgent primitive for building MCP servers with Cloudflare Agents SDK . Two months later, we ran an MCP Demo Day s
Your next customer may not find you through a search engine. Instead, they'll ask an AI assistant: "how do I do X?"; "which option is best for someone like me?"; "just handle it for me" and an agent will find the answer, weigh the options, and act on their behalf. Increasingly, the moment that determines whether a customer chooses you happens inside a model's response — before a human ever sees your homepage. This agentic audience is already here: by our count, fewer than half of all HTML page requests now come from a human . Not all of those machines are agents acting for a person, but that share is growing fast, and answer engines, shopping assistants, and research tools will shape which businesses are found and recommended. Discoverability used to mean ranking on a results page. Now it means being found, read, and confidently recommended by the agents that guide your customers. The old metrics, human clicks and page views, no longer paint the full picture. We spent time talking to site owners who were staring at access logs full of AI bots, completely blind to whether those bots were capable of using their site or recommending their products and services to their users. We heard two main questions: Can agents actually use my site? Am I getting recommended? To help site owners answer these questions, we have integrated our previous work on Agent Readiness into the Cloudflare dashboard, and added our new Answer Engine Optimization (AEO) tool as well. These tools treat agents as a core user base for your site, showing you how an agent will see it, and how often you get recommended. The opportunity is big, and the bar is low, because most sites aren't built fo
Our data shows that a lot of traffic from well-behaved bots is re-fetching pages that have not changed . Billions of requests. An enormous amount of machine effort, attached to no outcome at all. That's the signature of a web built for humans being visited by something else. Agents are here - not as a new kind of software, but as a new kind of visitor to the web. The web reshaped around this new visitor is what we call the Agentic Internet. We see its future as readable, discoverable, callable, and payable. To realize that future, it needs its own tools and protocols. Cloudflare's developer platform gave agents a place to run, and the first tools to build them. What's missing are the ones that let agents and domain owners cooperate instead of collide — on the open Internet, not just inside a single platform. Every browser has always identified itself to the web with a header called User-Agent. The name only made sense once you realized the browser was acting on your behalf. Now a user agent is truly a user's agent: a program that fetches the web on a person's behalf. Today its most mature form is the coding agent that reads and writes code, pulls the docs it needs, and never sees the pages it reads. An agent doesn't render your CSS, see your hero image, or click your ads. But it has a paying human on the other end. Every request now costs someone money and carries a purpose. Block it and you block your customer. Treat it like a scraper and you lose them. Every agent runs because someone — a person or a business — is paying for what it does. Most people don't spend tokens for the sake of it. This version of the Internet, one with an outcome and a bill on the other end of every request, is going to look nothing like the one we have now. The web was not built for this, and neith
Should we build our own browser? This is one of those questions that has come up every few months internally at Cloudflare for years. Unsurprisingly, it’s the kind that triggers long threads with multiple reasons and persuasive arguments on why we should do it. The browser is obviously the most important software we use every day on our computers; it’s arguably the operating system of the Internet. We’re a company on a mission to help build a better Internet — who wouldn’t want to take on the challenge of building a new browser? But we never quite found the balance between the technical difficulty of such an endeavour and the unique problems we’d be solving by doing it. And so, the idea was shelved, over and over again. Until now. Something magical happened: we reached a tipping point where a series of powerful technical advancements in our Developer Platform became a reality, while the advent of AI agents and the demand for a new kind of browser became critical at the same time. Running WebAssembly (Wasm) in Workers is now very mature. Primitives like dynamic workers , SQLite-based Durable Objects , Worker-to-worker RPC , service bind
Today we are launching a developer preview of WebMCP on Cloudflare. Switch it on and browser agents can start working with your site, with no code and nothing changed at your origin. Cloudflare adds a small bridge to your pages, which registers a set of tools for a visitor’s agent to use. The web was built on the assumption that there is a person on the other end: someone to read the page, click buttons, and fill in the forms. But now more and more visits come from AI agents instead, to an Internet made for humans. The usual approach has been crawlers, which copy content back to a server and, too often, give the original site none of the traffic and little of the credit. There is a better way, and it does not involve scraping. WebMCP is a new browser standard, shipping experimentally in Chrome 146, that shows up in the page as document.modelContext . A site can choose to expose a set of tools for agents running in the browser, meaning agents no longer have to guess their way through a page built for humans. This enables agents to have a different browsing experience from the user and use tokens on tasks, not navigation. The catch: the site has to implement it. Cloudflare has been building both ends of this. BrowserRun , our remote browser, already added WebMCP support, so an agent can discover and call the tools a site exposes. Cloudflare Radar will soon offer WebMCP tools of its own. This preview is about the other side: a way to give any site on Cloudflare those tools with a single switch, and no code. A developer preview of WebMCP on Cloudflare Implementing WebMCP by hand is a small project: design the tools to expose, wire them into your interface, and keep them working as the standard evolves. We wanted it to be simple
Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States, but Forescout could not confirm any were compromised. That figure counts exposed
Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of
Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users' privacy by routing their Safari web traffic through two relays so that no single third-party, including Apple, can determine where the request is originating from
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. Huntress, which tracks the toolkit as khunt,
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene. The affected products include Amazon
Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021. Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firms in California, New York and Nebraska, and others abroad, according to the Justice Department.
A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated attacker with access to a TeamCity server
Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at least 100 million people. Moucka, 26, of Kitchener, Ontario, personally took at least $495,000 from
At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all right under the company’s nose.
Wednesday, August 5
For nearly two years, researcher Vangelis Stykas has maintained access to North Korean hackers’ servers. His work shows they pulled off intrusions in a shocking number of systems across the globe.
Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase.
We're honored to announce that Cloudflare is the only vendor that has been recognized as a Visionary in both the 2026 Gartner® Magic Quadrant™ for SASE Platforms and the 2026 Gartner® Magic Quadrant™ for Security Service Edge reports. To us, this validates our architectural choices and, more importantly, reflects the trust our customers place in us to navigate an increasingly complex security landscape. To every customer who shared feedback with Gartner, discussed your roadmap challenges with our team, and pushed us to build better solutions: thank you. This recognition belongs to you as much as it does to us. The SASE (Secure Access Service Edge) and SSE (Security Service Edge) markets are at an inflection point. Many organizations started with the SSE as the “security half” of SASE to tackle their remote work challenges during the pandemic. More recently, SASE has grown more prominent given the rise in return-to-office work mandates. Now, as AI agents, post-quantum threats, and the sprawl of shadow apps reshape enterprise security, organizations need platforms that can adapt at the speed of change, not vendors locked into yesterday's architecture. That’s exactly where Cloudflare One, our agile SASE platform, comes in. The market gap and where SASE is heading next It’s no secret that most SASE vendors haven't adapted to the architectural realities of modern enterprises. In fact, when customers migrate to Cloudflare, we hear some of the exact same challenges time and time again: Fragmented architectures: When SASE platf
A lawsuit accuses Homeland Security of violating protesters’ free-speech rights—but the agency is using it to try to get access to the plaintiffs’ encrypted communications.
Security researcher James Kettle tried to push the limit of AI’s hacking abilities—and discovered how effective it can be when combined with human expertise.
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft
OpenAI said it disrupted a Cambodia-based scam operation that used its generative artificial intelligence (AI) chatbot ChatGPT to facilitate a wide range of investment, romance, gambling, and law enforcement impersonation schemes. To that end, it banned a coordinated network of ChatGPT accounts likely originating from Southeast Asia and operating from the city of Poipet, a region with extensive
Homeland Security told immigrants that leaving the US would wipe out fines it claims they owe. Now it wants private investigators to find them in their home countries and collect.
More than 50 offending image and video ads were published across Facebook, Instagram, Messenger, or Threads, according to Meta’s ad library data. Some ran as recently as this week.
Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it. A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes
Synack Red Team researcher Malcolm Stagg takes the stage at Black Hat USA 2026 on August 6 to present three years of independent research on a new class of network infrastructure attacks. Here's who he is and why the talk belongs on your calendar. The post From DARPA to Black Hat: An SRT Researcher’s Next Chapter appeared first on Synack .
HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant flaw in HashiCorp's MCP server that lets one user's Terraform token be reused for later users'
To hear both sides of the build vs buy debate around AI pentesting solutions, we spoke with Dow's cyber engineering team lead Dan Lacher and Synack's CTO Mark Kuhr. From Dow's perspective, Synack served as a force multiplier for a small internal red team. Meanwhile, building the Synack Autonomous Red Agent (Sara) from scratch definitely had some trial and error. The post Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack appeared first on Synack .
Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by
Sam Rhea is Cloudflare’s Chief Information Officer. I knew we had a problem about six months ago when a member of our sales organization reached out to me asking for API keys. Keys plural. They used AI to build what they described as a SuperApp that would transform our go-to-market teams. All they needed was production access to about a dozen systems of record at Cloudflare and admin permissions to a deployment pipeline to make it work. We had taken a fairly cautious approach to rolling out AI at Cloudflare during 2025. We deployed informational chat applications and tinkered with using AI to help write some boilerplate code, but we felt that the technology was not ready to change how we work. And then, over the course of a few days at the end of last year, better models and more powerful harnesses changed that calculus. AI agents could do things, and they could do them well. Hundreds of team members across Cloudflare, in technical and non-technical roles, spent the quieter weeks around the New Year experimenting with new tools that made it easier than ever to build. That sales team member building their SuperApp was just the first in an avalanche of people raising their hands to use these tools to transform how they get things done. We had an obligation to equip and enable them to do so. But we also had an obligation to keep our systems, internal data, and customer data safe. We have spent the last several months building a platform to do exactly that inside of Cloudflare. We call it Cloudflare OS. We started by stitching together off-the-shelf components from our Developer and Zero Trust platforms like Cloudflare Workers and Access . As we learned more about the challenge, we also created custom
Let’s imagine the Case of the Endlessly Closing Tickets. The bug tickets start closing at noon. Nobody thinks much of it. Joe moved a few tickets to Done, and Joe is having a productive afternoon. Then the pace picks up. By 4 p.m., thousands of tickets have been closed, all by Joe. Joe is a good engineer. Joe is not a thousand-tickets-an-hour engineer. We learn that he has several background agents running across three concurrent sessions. It takes half an hour to find the one at fault: a cleanup task with a prompt that was a little too broad. Once we’ve stopped the agent, we need to repair the state of the ticketing system. Joe has also been legitimately closing tickets by hand that afternoon. The system records all those changes under Joe regardless of whether it was him or his agent, and the network logs do not distinguish one agent session from another. From the outside, the actions look identical. The example above is relatively low-stakes, but we can all imagine, or read about , much more destructive cases. An agent with access to contract software could amend an agreement. An agent wreaking havoc in a support queue could send hundreds of replies to customers. An agent with database access could drop entire tables. At Cloudflare, we knew we could not depend on every employee to configure every agent perfectly or watch every tool call. So before expanding write access across our own internal MCP servers, we built WriteGuard. We are now bringing those controls to Cloudflare MCP server portals through a private beta. MCP Fundamentals Before explaining WriteGuard, let’s review what an MCP server is and how it works with AI
Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft's real authentication page. Once access and refresh tokens are issued, attackers may retain access to email, documents, and cloud resources, creating a direct path to data exposure, financial fraud,
GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed n8n API tokens and identified 4,576 unique credentials associated with 1,255 hostnames. Of the 896
A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, arms periodic STP timers without an IFF\_UP guard. The teardown path taken by dellink never synchronously deletes those timers, so the backing net\_device (which embeds struct net bridge as private data) is freed with a timer list still queued on a per-CPU timer base. The result is a slab use-after-free in the kmalloc-cg-8k cache.
Tuesday, August 4
EtherRAT off a The Gentlemen staging server. C2 resolution is the fun part: no hardcoded domains. The sample holds an Ethereum contract address + call selector and pulls the active C2 from the contract via public RPC endpoints. Every operator rotation is a contract write, so the full history is recoverable, five domains here. Tasking has no fixed command set. Any response over ten chars is thrown into a new async function with require, process, Buffer, etc. in scope, so arbitrary JS in the user context. Polls use random file-like paths (png/css/ico) to blend in, tell is a custom X-Bot-Server header. MSI drops a Node bootstrapper + XOR-encrypted backdoor, decoder writes plaintext and sets a Run key relaunching via headless conhost. Full write-up with hashes and IOCs: [https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2](https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2)
Now, it is possible to query phishing-suspect FQDNs through the free API, featuring database information on WHOIS, IP, Geolocation, and threat mapping [https://github.com/julioliraup/AT/wiki/REST-API-USE](https://github.com/julioliraup/AT/wiki/REST-API-USE) A frontend interface is also available: [https://julioliraup.github.io/AT](https://julioliraup.github.io/AT)
Facing a growing drone threat, the Pentagon is poised to sign a first-of-its-kind contract for “Enduring High Energy Lasers”—and make directed energy weapons an official part of the Army’s kit.
- [ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2](https://www.stepsecurity.io/blog/chaindrop-npm-worm) - [Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack](https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain) - [npm Worm Poisons 400+ Packages Across Nine Organisations](https://safedep.io/keyv-npm-supply-chain-compromise/)
Technical analysis of Parivahan App ( shared on ScamIndia by /u/ImpressiveYouth3990 couple of days back )
# Fake mParivahan : Malware Analysis Report # 422 Users are affected by it till now ( I was able to get the attackers admin panel ) **Classification:** Critical : Android SMS / UPI spyware RAT **Method:** Static reverse engineering of dropper + payload; no-root payload extraction; StringFog decryption; read-only Firebase C2 IOC enumeration # 1. Executive summary Marketed as **“M Parivahan”** is a **two-stage Android malware** operation: 1. **Dropper** (`com.ioaheishsbsb.ljgcdfhm`) : NP Manager–packed installer with a fake VPN / WebView UI that decrypts and sideloads an embedded APK (`output.apk`). 2. **Payload** (`com.veaheishsbsb.kekskks`) : Sketchware-style SMS/call spyware with **Firebase Realtime Database** command-and-control and **Telegram** first-run alerts. The payload steals SMS and device telemetry, can forward SMS and calls, and can send SMS from the victim’s SIM (commonly abused for UPI / OTP fraud). At the time of analysis the Firebase panel was r**everse engineered too** and contained **422** client device IDs. # 2. Sample identification |Field|Stage 1 (Dropper)|Stage 2 (Payload)| |:-|:-|:-| |Package|`com.ioaheishsbsb.ljgcdfhm`|`com.veaheishsbsb.kekskks`| |Related / alias|`com.mr_fox.bhai`|Label: “M Parivahan”| |Application class|NP Manager shell|`np.protect.assets.ShellApplication`| |Protection|NP Manager (`libnp_protect_res.so`, xhook)|NP Manager + StringFog XOR| |UI|Fake VPN + `file:///android_asset/main_ui.html`|Permission / settings-style UX| |Embedded artifact|Logical asset `output.apk` (encrypted on disk)|—| |SDK|—|minSdk 21, targetSdk 28, compileSdk 33| |Build leftover|—|Synthetic names: `dApp-binance-Trading-Signals`| **Related package queried by dropper:** [`com.avejfhdhd.android`](http://com.avejfhdhd.android) # 3. Infection chain Victim sideloads fake “mParivahan” APK │ ▼ Dropper (NP Manager) decrypts embedded payload │ ▼ Writes temp_info.apk / temp_install.apk → installs com.veaheishsbsb.kekskks │ ▼ Payload requests SMS / phone permissions │ ▼ MyService enrolls device on Firebase + dumps ~50 SMS │ ▼ Telegram alert to operator bot/chat │ ▼ Listens on clients/<deviceId>/webhookEvent for remote commands **Extraction note:** Static decrypt of the packed dropper blob failed due to native crypto. Payload was recovered without device root by patching the unpack path to `getExternalFilesDir` and pulling `/sdcard/Android/data/com.ioaheishsbsb.ljgcdfhm/files/temp_info.apk`. # 4. Capabilities |Capability|Severity|Detail| |:-|:-|:-| |SMS theft|Critical|Intercepts inbound/outbound SMS; uploads to `messages/<deviceId>`| |SMS forward|Critical|Relays SMS to operator number (`SmsForwardTo`)| |Remote SMS send|Critical|Sends SMS from chosen SIM (`sendSms` webhook)| |Call forwarding|High|USSD `**21*<number>#` / `##21#`| |Device fingerprinting|High|Model, Android version, root, storage, CPU, carrier, public IP, SIMs, battery, MSISDN| |Telegram notify|High|First-run HTML report to admin bot/chat| |Persistence|High|Foreground service, boot/alarm receivers, restart in `onDestroy`| |Keylogger flag|Medium|`KeyLogger` webhook present; appears stubbed/partial| # 5. Remote command surface **Listener path:** `clients/<androidId>/webhookEvent/` |Command key|Fields|Action| |:-|:-|:-| |`callForward`|`from`, `to`, `isActive`|Activate/deactivate call forward via USSD| |`smsForward`|`from`, `to`, `isActive`|Toggle SMS forward preference| |`sendSms`|`from`, `to`, `message`, `isSended`|Send SMS from victim SIM| |`checkLiveness`|`text=ping`|Reply `pong` under webhook| |`KeyLogger`|`isActive`|Preference flag (partial implementation)| Presence uses `clients/<id>/status` with Firebase `.info/connected` \+ `onDisconnect`. # 6. C2 infrastructure & IOCs # 6.1 Firebase |Item|Value| |:-|:-| |RTDB URL|`REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP`| |API key|`REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP`| |App ID|`REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP`| |Storage|`REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP`| |Top-level nodes|`clients`, `messages`, `devices`, `deviceMessages`| |Clients observed|**422** (2026-08-04, shallow enumeration)| |Rules posture|Open / world-readable (IOC check succeeded without auth)| # 6.2 Firebase path map |Path|Purpose| |:-|:-| |`clients/<androidId>`|Device profile enrollment| |`clients/<androidId>/status`|Online/offline| |`clients/<androidId>/webhookEvent/*`|Command inbox| |`messages/<androidId>/<timestamp>`|Stolen SMS| |`.info/connected`|Connectivity watch| # 6.3 Telegram |Item|Value| |:-|:-| |Endpoint|`https://api.telegram.org/bot<token>/sendMessage`| |Bot token|`REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP`| |Admin chat ID|`REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP`| |Config source|Raw resource `Loda` (obfuscated APK path `ۦ/ۥ۟`)| { "chatIDs": ["REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP"], "tokens": ["REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP"], "workSuccess": 1 } Only **one** admin chat/token pair is embedded in the sample. # 7. Attacker / mule phone numbers **Not hardcoded in the APK.** Numbers are pushed via Firebase webhooks at runtime. From live `clients/*/webhookEvent` (`smsForward` / `sendSms` `to` fields), 2026-08-04: |Number|Hits|Observed role| |:-|:-|:-| |**8789**\*\*\*\*\*|**6**|**Primary SMS forward target (strongest IOC)**| |9279\*\*\*\*\*\*\*\*\*|2|SMS forward + sendSms| |8340\*\*\*\*\*\*\*\*\*|2|SMS forward| |9522\*\*\*\*\*\*\*\*\*|2|sendSms| |9279\*\*\*\*\*\*\*\*\*|1|sendSms (same line as 927\*\*\*\*\*\*\*\*\* with country code)| |8712\*\*\*\*\*\*\*\*\*|1 each|sendSms / UPI-style collect| |9211\*\*\*\*\*\*\*\*\*|1 each|sendSms / UPI-style collect| |8291\*\*\*\*\*\*\*\*\*|1|sendSms / UPI-style collect| |Others (one-offs)|1|Mixed sendSms destinations| **Primary SMS-intercept candidate:** `8789`\*\*\*\*\*\*\*\*\* UPI collect destinations may be money-mule wallets rather than the panel operator’s personal line. # 8. Persistence & stealth # Components (payload) * Activities: `MainActivity`, `PermissionRequestActivity`, `DebugActivity` * Service: `MyService` (foreground; `FOREGROUND_SERVICE_MEDIA_PLAYBACK`) * Receivers: `SmsReceiver`, `BootReceiver`, `AlarmReceiver`, `MultiEventReceiver`, `BatteryLevelReceiver` * Persistent notification text: **“System Settings is Running…”** # Obfuscation / hardening * NP Manager resource and path mangling * StringFog (Base64 + XOR with key `UTF-8`) * Dropper encrypted asset (non-standard ZIP compression) * `usesCleartextTraffic="true"`, `allowBackup="true"` # 9. Dangerous permissions (payload) * `INTERNET`, `ACCESS_NETWORK_STATE`, `ACCESS_WIFI_STATE`, `CHANGE_*` * `READ_SMS`, `RECEIVE_SMS`, `SEND_SMS`, `DELETE_SMS`, `BROADCAST_SMS` * `CALL_PHONE`, `READ_PHONE_STATE`, `READ_PHONE_NUMBERS` * `RECEIVE_BOOT_COMPLETED`, `WAKE_LOCK` * `FOREGROUND_SERVICE`, `FOREGROUND_SERVICE_MEDIA_PLAYBACK` * `REQUEST_IGNORE_BATTERY_OPTIMIZATIONS`, `POST_NOTIFICATIONS` # 10. Key payload classes |Class|Role| |:-|:-| |`MyService`|Core RAT: enroll, listen, process commands| |`SmsReceiver`|SMS intercept / forward / Firebase write| |`TelegramBotUtils`|HTTP Telegram `sendMessage`| |`AdminInfo`|Load bot token ↔ chat ID map| |`callForwardingUtility`|USSD call forward| |`SmsHelper` / `SMSRetriever`|Send SMS / dump inbox| |`DeviceInfoUtil` / `SimInfoUtil`|Fingerprint + public IP| |`SharedPrefManager`|`isFirst`, `isSmsForward`, `SmsForwardTo`, flags| |`BootReceiver` / `AlarmReceiver`|Keep-alive| # 11. MITRE ATT&CK (Mobile) mapping |ID|Technique|Evidence| |:-|:-|:-| |T1660|Phishing / fake app|mParivahan brand abuse| |T1406|Obfuscated files or information|NP Manager + StringFog| |T1624|Event triggered execution|`BOOT_COMPLETED`, `SMS_RECEIVED`| |T1517|Access notifications / SMS|SMS permissions + receivers| |T1437|Application layer protocol|Firebase + Telegram HTTPS| |T1636|Protected user data|SMS, MSISDN, SIM info| |T1428|Exploit via SMS / USSD|`sendSms`, `**21*`| |T1409|Stored application data|SharedPreferences C2 flags| |T1625|Hijack execution flow / packer|`ShellApplication` dropper|
Intro In 2024 I released the initial version of Pipeleek. At the time the tool was a simple GitLab CI/CD pipeline secrets scanner, not much more. Since then, it has evolved quite a bit: I’ve added support for new CI/CD platforms, integrated the Renovate security research published last year, and built a range of helper commands on top of the scanner. Today it’s time to release version 1.0 of Pipeleek! Features Secret Scanner Platform Additions At its core Pipeleek is still a secrets scanner for exposed credentials in CI/CD pipelines. While many products scan for secrets at the version control level, Pipeleek covers leaked credentials in pipeline logs and artifacts. With version 1, Pipeleek supports the following CI/CD platforms: GitLab GitHub Bitbucket Azure DevOps Gitea CircleCI Jenkins Pentest Helpers
On August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware.
Monday, August 3
Internal documents show ICE's DNA collection has skyrocketed in the second Trump administration. Now hundreds of thousands of people never convicted of a crime are in an FBI criminal database forever.
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond quickly when those accounts appear in a new data breach. This is precisely what the HIBP government service was built for: helping national cyber teams strengthen threat monitoring and incident response capabilities by providing visibility into compromised credentials and breached accounts across their government domain space. Nepal joins a growing list of governments and national cybersecurity teams using HIBP to better understand their exposure, protect government departments and public resources, and reduce the risk posed by compromised credentials before attackers can take advantage.
Obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes of original java program.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite Apparently, Aussies are so obsessed with coffee that it's referred to as the coffee capital of the world down here (some bits, at least). "But what about Italy?" people ask. Having spent a lot of time in a lot of Italy, no, it's just not the same. It's not the same ubiquity of high-quality coffee shops and passion for what many view as the art of making espresso-based drinks. There's comparably little tolerance for the likes of Starbucks ( who have not fared well in Australia ), and other mass-produced forms of the drink (I don't think I've ever seen diner-style filter coffee here ). All that said, we may have gone just a little overboard with the new machine, but anything worth doing is worth doing to excess
Learn how trusted coding-agent projects can execute repository-controlled code before the first prompt through Codex MCP configuration and Claude Code environment settings.
Sunday, August 2
Keep your logins locked down with our favorite password management apps for PC, Mac, Android, iPhone, and web browsers.
Security lapse leaves sensitive information and contact details of 51 government officials exposed for 40 hours The public body in charge of the UK’s state investments has been pushed to improve its internal security after a data breach left “high-level management information” publicly accessible for nearly two days. UK Government Investments (UKGI), the agency that manages the taxpayers’ interest in a swathe of companies including Channel 4 and the Post Office, said the security failure also left more than 50 government officials’ personal details exposed for nearly 40 hours. Continue reading...
Saturday, August 1
The critical RufRoot vulnerability gave unauthenticated attackers a path from an exposed MCP endpoint to shell access, stolen AI provider keys and poisoned agent memory. Paul Mote explains why the incident should change how security teams define, test and recover their AI attack surface. The post RufRoot Exposed the Hidden AI Agent Attack Surface appeared first on Synack .
Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed.
Friday, July 31
In three incidents across six runs, the agents treated real systems as simulated targets and tried weak passwords or unauthenticated endpoints.
Anthropic said its Claude-based security models gained unauthorized access to the sensitive production environments of three outside organizations during internal testing designed to measure the models’ offensive cyber capabilities. The events, which Anthropic revealed Thursday , are the second revelation in 10 days that AI models from the world’s wealthiest providers have trespassed into protected networks, an offense that, in more traditional hacking scenarios, could land the human behind the keyboard in prison for years. Earlier this month, OpenAI said its security models exploited a zero-day vulnerability for use in breaking into the network of Hugging Face, a platform for open source machine-learning models and AI datasets. The OpenAI models went on to steal access credentials and other confidential Hugging Face information. The OpenAI models also exploited publicly exposed credentials to compromise accounts of four other third-party services. Anthropic said the OpenAI event spurred its engineers to review similar cybersecurity evaluations by Claude models. The audit found three incidents “in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.” Read full article Comments ]]>
Overview VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures. Description VPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time. CVE-2026-16503 The Supabase template provides an instance of PostgreSQL that is bound to all network interfaces (0.0.0.0:5432) and uses the hard-coded database password postgres . Because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations. If the the instance is exposed to the internet, a remote attacker could connect to the host's published TCP port 5432 and authenticate as the postgres superuser account using the default postgres password. CVE-2026-16504 The Zulip template ships with a hard-coded application key secret_key: changeme , a default database password zulip , and the setting DISABLE_HTTPS=True . An attacker can use this public secret key to forge or validate signed session material, enabling session forgery and authentication bypass against the instance. If unchanged, t
Created by legendary hardware hacker Andrew “bunnie” Huang, the badges for this year’s famed security conference aim to push the boundaries of security and transparency.
In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real-world organizations during third-party evaluations.
GreyNoise Tactics gives anyone running a Deception Sensor visibility into what adversaries do after initial compromise, automatically mapping qualifying sessions to the MITRE ATT&CK framework.
Thursday, July 30
Craig Rosewarne, Managing Director of Wolfpack Information Risk, explains why continuous, AI-enabled validation, paired with human-verified exploitability, gives security leaders a real-time view of what's actually at risk. The post Guest Blog: The Annual Pentest Is No Longer Enough appeared first on Synack .
With Chrome, Google pioneered the rapid release model for browser security. Now, Google says updates may need to change in the face of AI security analysis. According to the company, the number of bug fixes in Chrome releases has skyrocketed in recent months because AI is detecting so many flaws . We could be looking at more frequent updates soon, but Google is also working on ways to get those updates rolled out without bothering you as much. Google has released two major Chrome milestone builds recently—Chrome 149 in early June and Chrome 150 just a few weeks later. These two updates had a total of 1,072 bug fixes, which is more than the previous 23 releases combined. Such is the impact of giant cybersecurity AI models that can probe software for vulnerabilities at light speed. Some of these vulnerabilities were serious, too, with one bug hiding in the Chrome codebase for 13 years. If it had been exploited, an attacker could have bypassed the Chrome sandbox to make the browser access local files.
VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure
Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful. Description SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows: CVE-2026-15969 SGLang contains unauthenticated RCE in /load_lora_adapter_from_tensors by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. CVE-2026-15971 SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests. CVE-2026-15974 SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions because image_url input is unsanitized, allowing access to internal metadata, secrets, and services. CVE-2026-15976 SGLang contains a RCE vulnerability when attempting to load model weights f
The two Chrome updates in June patched more bugs than the 23 updates before them. Now, Google is ramping up its patching schedule thanks to AI-assisted vulnerability discovery.
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks. Pedro Falé is a threat researcher with the security firm Bitsight . Falé told KrebsOnSecurity he was able to peer inside a vast and complex ad fraud network by registering an expired domain name that was used to coordinate fake ad clicks across a particularly popular brand of these streaming devices known as H96 . An H96 TV streaming device currently advertised for sale on Amazon. Falé said the domain he scooped up was previously used for telemetry, periodically collecting full hardware information and the entire list of installed apps from tens of thousands of H96 streaming sticks plugged into television sets around the globe. But upon inspecting the traffic being funneled to the domain, he discovered nearly all of the TV boxes transmitting data claimed to be mobile phone models from a variety of ma