BolhaSec

bleepingcomputer.comThe silent “Storm”: New infostealer hijacks sessions, decrypts server-sideNew "Storm" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA.

13 Apr

Notícia da BleepingComputer "The silent “Storm”: New infostealer hijacks sessions, decrypts server-side" #bolhasec

bleepingcomputer.comNearly 4,000 US industrial devices exposed to Iranian cyberattacksThe attack surface targeted by Iranian-linked hackers in cyberattacks against U.S. critical infrastructure networks includes thousands of Internet-exposed programmable logic controllers (PLCs) manufac...

13 Apr

Notícia da BleepingComputer "Nearly 4,000 US industrial devices exposed to Iranian cyberattacks" #bolhasec

bleepingcomputer.comMicrosoft: Canadian employees targeted in payroll pirate attacksA financially motivated threat actor tracked as Storm-2755 is stealing Canadian employees' salary payments after hijacking their accounts in payroll pirate attacks.

13 Apr

Notícia da BleepingComputer "Microsoft: Canadian employees targeted in payroll pirate attacks" #bolhasec

BolhaSec reposted

Vico

@vicoo.bsky.social

3 Apr

Pessoal de Tech que quer fazer amizades e trocar uma ideia, entrem no meu grupo de amigos lá no Discord! Tô precisando bater um papo... discord.gg/7eeXcdeaPD #bolhasec #bolhadev

discord.ggJoin the Vico’s Manor Discord Server!O grupo de amigos do Vico no Discord! | 23 members

BolhaSec reposted

CyberTaters

@potato.software

1 Apr

🔗 ravenastar.com --- 💚 "A cor verde significa esperança, liberdade e renovação." --- PotatoSecurity Educator ・CTI・Digital Forensics Investigator ・DevSecOps・Blue Team・Segurança Digital・Psicologia・Ciência da Computação・OSINT ⫘ 🏷️ #potatosecurity #ravenastar #infosec #bolhasec #bolhatech

bleepingcomputer.comAlabama man pleads guilty to hacking, extorting hundreds of womenA 22-year-old Alabama man pleaded guilty to extortion, cyberstalking, and computer fraud charges after hijacking the social media accounts of hundreds of young women (including minors).

Notícia da BleepingComputer "Alabama man pleads guilty to hacking, extorting hundreds of women" #bolhasec

bleepingcomputer.comAmazon: Drone strikes damaged AWS data centers in Middle EastAmazon has confirmed that three Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and one in Bahrain have been damaged by drone strikes, causing an extensive outage that is stil...

Notícia da BleepingComputer "Amazon: Drone strikes damaged AWS data centers in Middle East" #bolhasec

securityweek.comQuantum Decryption of RSA Is Much Closer Than ExpectedThe JVG algorithm factors RSA and ECC keys using fewer quantum resources than Shor’s algorithm, accelerating the time needed to break today’s public-key cryptography.

Notícia da SecurityWeek "Quantum Decryption of RSA is Much Closer than Expected" #bolhasec

bleepingcomputer.comCISA warns that RESURGE malware can be dormant on Ivanti devicesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released new details about RESURGE, a malicious implant used in zero-day attacks exploiting CVE-2025-0282 to breach Ivanti Connect ...

Notícia da BleepingComputer "CISA warns that RESURGE malware can be dormant on Ivanti devices" #bolhasec

securityweek.comHoneywell, Researcher Clash Over Impact of Building Controller VulnerabilityResearcher finds high-risk vulnerability in Honeywell building management controller, but the vendor disputes the severity and impact.

Notícia da SecurityWeek "Honeywell, Researcher Clash Over Impact of Building Controller Vulnerability" #bolhasec

bleepingcomputer.com$4.8M in crypto stolen after Korean tax agency exposes wallet seedSouth Korea's National Tax Service accidentally exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release, allowing hackers to steal 6.4 billion won ($4.8M) w...

Notícia da BleepingComputer "$4.8M in crypto stolen after Korean tax agency exposes wallet seed" #bolhasec

bleepingcomputer.comMicrosoft testing Windows 11 batch file security improvementsMicrosoft is rolling out new Windows 11 Insider Preview builds that improve security and performance during batch file or CMD script execution.

Notícia da BleepingComputer "Microsoft testing Windows 11 batch file security improvements" #bolhasec

securityweek.com900 Sangoma FreePBX Instances Infected With Web ShellsHackers exploited CVE-2025-64328, a FreePBX command injection vulnerability, to infect hundreds of instances with web shells.

Notícia da SecurityWeek "900 Sangoma FreePBX Instances Infected With Web Shells" #bolhasec

bleepingcomputer.comStar Citizen game dev discloses breach affecting user dataCloud Imperium Games (CIG), the game developer behind Star Citizen and Squadron 42, says attackers breached systems containing some users' personal information in January.

Notícia da BleepingComputer "Star Citizen game dev discloses breach affecting user data" #bolhasec

securityweek.comVulnerability in MS-Agent AI Framework Can Allow Full System CompromiseA ModelScope MS-Agent vulnerability allows attackers to feed malicious commands to AI agents and modify system files or steal data.

Notícia da SecurityWeek "Vulnerability in MS-Agent AI Framework Can Allow Full System Compromise" #bolhasec

bleepingcomputer.comEuropol-coordinated action disrupts Tycoon2FA phishing platformAn international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform linked to tens of millions of phishing messages each month.

Notícia da BleepingComputer "Europol-coordinated action disrupts Tycoon2FA phishing platform" #bolhasec

bleepingcomputer.comEuropol-led crackdown on The Com hackers leads to 30 arrestsA yearlong Europol-coordinated operation dubbed "Project Compass" has led to 30 arrests and 179 suspects being tied to "The Com," an online cybercrime collective that targets children and teenagers.

Notícia da BleepingComputer "Europol-led crackdown on The Com hackers leads to 30 arrests" #bolhasec

bleepingcomputer.comHacker mass-mails HungerRush extortion emails to restaurant patronsCustomers of restaurants using the HungerRush point-of-sale (POS) platform say they received emails from a threat actor attempting to extort the company, warning that restaurant and customer data coul...

Notícia da BleepingComputer "Hacker mass-mails HungerRush extortion emails to restaurant patrons" #bolhasec

securityweek.comCritical FreeScout Vulnerability Leads to Full Server CompromiseA critical-severity FreeScout vulnerability can be exploited for remote code execution without authentication or user interaction.

Notícia da SecurityWeek "Critical FreeScout Vulnerability Leads to Full Server Compromise" #bolhasec

securityweek.comFig Security Launches With $38 Million to Bolster SecOps ResilienceFig Security emerged from stealth mode with $38 million in funding across seed and Series A rounds for its SecOps platform.

Notícia da SecurityWeek "Fig Security Launches With $38 Million to Bolster SecOps Resilience" #bolhasec

bleepingcomputer.comSamsung TVs to stop collecting Texans’ data without express consentSamsung and the State of Texas have reached a settlement agreement over the alleged unlawful collection of content-viewing information through its smart TVs

Notícia da BleepingComputer "Samsung TVs to stop collecting Texans’ data without express consent" #bolhasec

securityweek.comCanadian Tire Data Breach Impacts 38 Million AccountsThe personal information of more than 38 million Canadian Tire customers was stolen in an October 2025 data breach.

Notícia da SecurityWeek "Canadian Tire Data Breach Impacts 38 Million Accounts" #bolhasec

securityweek.com38 Million Allegedly Impacted by ManoMano Data BreachA hacker claims to have stolen the personal information of nearly 38 million ManoMano customers from a Zendesk instance.

Notícia da SecurityWeek "38 Million Allegedly Impacted by ManoMano Data Breach" #bolhasec

bleepingcomputer.comQuickLens Chrome extension steals crypto, shows ClickFix attackA Chrome extension named "QuickLens - Search Screen with Google Lens" has been removed from the Chrome Web Store after it was compromised to push malware and attempt to steal crypto from thousands of ...

Notícia da BleepingComputer "QuickLens Chrome extension steals crypto, shows ClickFix attack" #bolhasec

securityweek.comIn Other News: ATT&CK Advisory Council, Russian Cyberattacks Aid Missile Strikes, Predator Bypasses iOS IndicatorsCyber valuations surged in 2025, OpenAI disrupts malicious AI use, and ShinyHunters claims Odido data breach.

Notícia da SecurityWeek "In Other News: ATT&CK Advisory Council, Russian Cyberattacks Aid Missile Strikes, Predator Bypasses iOS Indicators" #bolhasec

securityweek.comAnthropic Refuses to Bend to Pentagon on AI Safeguards as Dispute Nears DeadlineAnthropic wants assurances from the Pentagon that Claude won’t be used for mass surveillance of Americans or in fully autonomous weapons.

Notícia da SecurityWeek "Anthropic Refuses to Bend to Pentagon on AI Safeguards as Dispute Nears Deadline" #bolhasec

bleepingcomputer.comMicrosoft Teams will tag third-party bots trying to join meetingsMicrosoft says Teams will soon automatically tag third-party bots in lobbies, allowing organizers to control whether they can join meetings.

Notícia da BleepingComputer "Microsoft Teams will tag third-party bots trying to join meetings" #bolhasec

bleepingcomputer.comUkrainian man pleads guilty to running AI-powered fake ID siteA Ukrainian man has pleaded guilty to operating OnlyFake, an AI-powered website that generated and sold more than 10,000 photos of fake identification documents to customers worldwide.

Notícia da BleepingComputer "Ukrainian man pleads guilty to running AI-powered fake ID site" #bolhasec

securityweek.comOpenClaw Vulnerability Allowed Websites to Hijack AI AgentsAn OpenClaw vulnerability allowed malicious websites to take over AI agents, exposing sensitive information and enabling data theft.

Notícia da SecurityWeek "OpenClaw Vulnerability Allowed Websites to Hijack AI Agents" #bolhasec

securityweek.comChilean Carding Shop Operator Extradited to USChilean national extradited to the US over his role in running a cybercrime operation that involved the trafficking of payment card data.

Notícia da SecurityWeek "Chilean Carding Shop Operator Extradited to US" #bolhasec

bleepingcomputer.comAPT37 hackers use new malware to breach air-gapped networksNorth Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance.

Notícia da BleepingComputer "APT37 hackers use new malware to breach air-gapped networks" #bolhasec

bleepingcomputer.comUK warns of Iranian cyberattack risks amid Middle-East conflictThe United Kingdom's National Cyber Security Centre (NCSC) alerted British organizations to a heightened risk of Iranian cyberattacks amid the ongoing conflict in the Middle East.

Notícia da BleepingComputer "UK warns of Iranian cyberattack risks amid Middle-East conflict" #bolhasec

bleepingcomputer.comLexisNexis confirms data breach as hackers leak stolen filesAmerican data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information.

Notícia da BleepingComputer "LexisNexis confirms data breach as hackers leak stolen files" #bolhasec

bleepingcomputer.comUH Cancer Center data breach affects nearly 1.2 million peopleThe University of Hawaii confirmed that a ransomware gang stole the data of nearly 1.2 million individuals in August 2025 after breaching its Cancer Center's Epidemiology Division.

Notícia da BleepingComputer "UH Cancer Center data breach affects nearly 1.2 million people" #bolhasec

bleepingcomputer.comClawJacked attack let malicious websites hijack OpenClaw to steal dataSecurity researchers have disclosed a high-severity vulnerability dubbed "ClawJacked" in the popular AI agent OpenClaw that allowed a malicious website to silently bruteforce access to a locally runni...

Notícia da BleepingComputer "ClawJacked attack let malicious websites hijack OpenClaw to steal data" #bolhasec

securityweek.comAI Security Firm JetStream Launches With $34 Million in Seed FundingJetStream Security launched with $34 million in seed funding to help organizations gain visibility into AI assets across their environments.

Notícia da SecurityWeek "AI Security Firm JetStream Launches With $34 Million in Seed Funding" #bolhasec

securityweek.comUS-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran RetaliatesThe escalating conflict between the United States, Israel, and Iran has unfolded alongside extensive cyber operations

Notícia da SecurityWeek "US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates" #bolhasec

bleepingcomputer.comFake Google Security site uses PWA app to steal credentials, MFA codesA phishing campaign is using a fake Google Account security page to deliver a web-based app capable of stealing one-time passcodes, harvesting cryptocurrency wallet addresses, and proxying attacker tr...

Notícia da BleepingComputer "Fake Google Security site uses PWA app to steal credentials, MFA codes" #bolhasec

securityweek.comIran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay LowSecurity firms monitoring US-Israel-Iran cyberattacks report that while hacktivist attacks spiked, state-sponsored actors remain quiet.

Notícia da SecurityWeek "Iran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay Low" #bolhasec

bleepingcomputer.comHow Deepfakes and Injection Attacks Are Breaking Identity VerificationDeepfakes and injection attacks are targeting identity verification moments, from onboarding to account recovery. Incode explains why enterprises must validate the full session—media, device integrity...

Notícia da BleepingComputer "How Deepfakes and Injection Attacks Are Breaking Identity Verification" #bolhasec

securityweek.comLastPass Warns of New Phishing CampaignLastPass is warning users of a new phishing campaign that aims to trick them into handing over their master password.

Notícia da SecurityWeek "LastPass Warns of New Phishing Campaign" #bolhasec

bleepingcomputer.comCISA flags VMware Aria Operations RCE flaw as exploited in attacksThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware Aria Operations vulnerability tracked as CVE-2026-22719 to its Known Exploited Vulnerabilities catalog, flagging the...

Notícia da BleepingComputer "CISA flags VMware Aria Operations RCE flaw as exploited in attacks" #bolhasec

bleepingcomputer.comFBI seizes LeakBase cybercrime forum, data of 142,000 membersThe FBI has seized the LeakBase cybercrime forum, a major online forum used by cybercriminals buy and sell hacking tools and stolen data.

Notícia da BleepingComputer "FBI seizes LeakBase cybercrime forum, data of 142,000 members" #bolhasec

bleepingcomputer.comFlorida woman imprisoned for massive Microsoft license fraud schemeA Florida woman was sentenced to 22 months in prison for running a massive years-long scheme to traffic thousands of stolen Microsoft Certificate of Authenticity (COA) labels.

Notícia da BleepingComputer "Florida woman imprisoned for massive Microsoft license fraud scheme" #bolhasec

securityweek.comZurich Acquires Beazley in $11 Billion Deal to Lead CyberinsuranceThe deal awaits final shareholder and regulatory approvals and is expected to be completed in the second half of 2026.

Notícia da SecurityWeek "Zurich Acquires Beazley in $11 Billion Deal to Lead Cyberinsurance" #bolhasec

securityweek.comTrump Orders All Federal Agencies to Phase Out Use of Anthropic TechnologyPresident Trump ordered federal agencies to stop using Anthropic technology after the company’s dispute with the Pentagon over AI safety.

Notícia da SecurityWeek "Trump Orders All Federal Agencies to Phase Out Use of Anthropic Technology" #bolhasec

bleepingcomputer.comCISA warns feds to patch iOS flaws exploited in crypto-theft attacksCISA ordered U.S. federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.

Notícia da BleepingComputer "CISA warns feds to patch iOS flaws exploited in crypto-theft attacks" #bolhasec

securityweek.comCloned AI Tool Sites Distribute Malware in 'InstallFix' CampaignA newly discovered InstallFix campaign relies on malicious commands on cloned installation webpages to trick victims into installing malware.

Notícia da SecurityWeek "Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign" #bolhasec

securityweek.comRussian Ransomware Operator Pleads Guilty in USA 43-year-old Russian national has pleaded guilty in a US court to charges stemming from his role in the Phobos ransomware operation.

Notícia da SecurityWeek "Russian Ransomware Operator Pleads Guilty in US" #bolhasec