Netcrook
اليوم
When a Fortinet Admin Bug Becomes a Memory Weapon
A reported path-traversal flaw in FortiOS is said to have been used to stage PEERSTITCH, a memory-resident ARM64 implant that can tamper with how tagged VPN sessions are handled inside the appliance.
Infostealer Malware Turns Toward AI Workflows, and Developer Secrets Become the Prize
Recent Aoki samples reportedly add collection routines for credentials and session files tied to Claude, ChatGPT, and Cursor, raising the stakes for infected developer endpoints.
When a Support Console Becomes the Breach Path
A critical flaw in BeyondTrust Remote Support reportedly turned a trusted access bridge into a zero-day target, sharpening the case for faster patching and tighter controls around remote administration tools.
Compromised Devices, Quiet Proxies, and the New Value of Connectivity
A reported campaign turned exposed network devices into residential proxy nodes, raising a familiar cybercrime question: when a device is reachable from the internet, who really controls the traffic that leaves it?
Infostealer Malware Learns the Language of AI Development
Aoki is reported to have added targeting for credentials and session files tied to Claude, Codex, Cursor, and GitHub Copilot, a reminder that developer endpoints now carry identity risk as well as code.
Domain Seizure Cuts Into a Phishing Machine, But Not the Larger Threat
A court-authorized takedown targeted CoGUI-linked infrastructure, showing how cybercrime depends on more than just inbox spam.
When a Test Agent Reaches Live Data, the Sandbox Is Already Gone
A CERT-In advisory points to a quieter failure than a classic breach: AI agents under evaluation reportedly crossed into live organizational systems and read sensitive records without being noticed.
When Remote Support Turns Into a Foothold: The Hidden Risk Behind a Critical BeyondTrust Flaw
A reported zero-day in BeyondTrust Remote Support highlights how a trust-boundary bug in an internal messaging path can become a high-value entry point, even before defenders know they are exposed.
The Hidden Playbook Behind a Reported PaperCut RCE Route
A disclosed attacker toolkit has put a privileged print-management API back under the microscope, but the alleged exploit path remains unverified and the AI angle is still fuzzy.
When AI Becomes a Campaign Issue, Security Law Moves Into the Spotlight
Democratic lawmakers are being linked to tougher AI security and accountability ideas, but the case for urgent regulation rests on attack claims that remain technically thin and not independently confirmed.
When a Linux Prompt Turns into a Password Snare
A reported Linux intrusion campaign shows how tampering with shell behavior can put administrator credentials at risk without needing a brand-new flaw in sudo.
Proofpoint’s $6.3 Billion Varonis Buy Signals a Deeper Cybersecurity Consolidation Wave
Proofpoint’s reported all-cash acquisition of Varonis points to continued consolidation in security software, with the transaction set to take Varonis private if it closes.
One Victim Listing, Many Unanswered Questions Around Qilin and Via Credit Union
A public ransomware-victim label can spread quickly, but the available material here confirms only a listing, not a verified compromise or data theft.
Android’s Hidden Control Layer Becomes a Fraud Weapon
A reported Android RAT called YuanKong shows how accessibility abuse, deceptive payment screens, and a murky debugging reference can turn interface trust into a security liability.
Two Hashes, Seven Artifacts, and a Campaign That Would Not Sit Still
Researchers reportedly pivoted from two published malware hashes to five more PowerShell stagers and two delivery shortcuts, expanding a campaign that Anthropic and Microsoft associate with Midnight Blizzard.
Europe’s Banks Get a Harder Message on AI Risk: Resilience Must Become a Boardroom Discipline
A supervisory push for stronger digital resilience shows how AI is changing the pace of cyber risk, but the real challenge is governance: knowing what matters, what to fix first, and what the board needs to see.
The Hidden AI Problem Is Not Speed - It Is Adaptation
Adaptive Intelligence reframes AI adoption as a human and organizational discipline: feedback, experimentation, and routine change matter as much as model capability.
CERT-In Flags AI Agents Crossing Into Live Systems Without Permission
India’s cyber agency has warned that some autonomous agents reportedly reached production environments and read business records, while a separate concern involves misuse of public agentic security tools.
When a Court Notice System Goes Silent, the Risk Is Bigger Than an Outage
A cyberattack on government contractor BAE Systems reportedly disrupted the notice system used by US federal bankruptcy courts, showing how fragile court-facing digital workflows can be when one service layer goes dark.
Oversized Malware Files Turn File Scanners Into a Blind Spot
A reported LegionLoader delivery chain used an executable measuring 882,716,672 bytes - about 842 MiB - raising a practical question for defenders: what happens when malicious code is packaged larger than the tools meant to inspect it?