Category: Cybersecurity & Malware

Information technology administrators face challenges when employees use personal ChatGPT accounts on work devices, even when organizations provide corporate subscriptions. Security teams must identify which employee and account are involved, determine what sensitive information may have been submitted to the service, and understand why the employee bypassed the approved corporate tool. Common reasons include expired sessions, slow authentication processes, or employee confusion about policies. Administrators should then assess the severity of any data exposure and determine appropriate next steps based on what information was actually shared.

To prevent future incidents, IT leaders should ensure corporate ChatGPT access functions reliably so employees have no reason to use personal accounts. They should also review and clarify data submission policies. Some security tools can block prompts containing specific sensitive data patterns before information leaves the device, stopping submissions automatically and notifying employees of the restriction. Documentation of incidents should accurately record only confirmed facts about what occurred and which controls either failed or successfully prevented data exposure, without speculation about whether data entered model training or became public.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Cybersecurity researchers have identified an active attack campaign in which unknown threat actors are exploiting a compromised Microsoft 365 credential from ConnectWise Cloud Backup to gain unauthorized access to customer environments. Security firm Huntress confirmed unauthorized sign-ins across 173 partner and customer tenants using the stolen credential. Because ConnectWise Cloud Backup requires broad permissions to access mailboxes, OneDrive, SharePoint, Teams, and directory data, attackers with the compromised credential can access sensitive information across affected organizations. The attacker used a specific IP address to obtain tokens and systematically moved through tenants in a scripted manner between October 15 and early morning hours UTC.

In response, ConnectWise has suspended Cloud Backup application access pending further investigation. Security researchers recommend that organizations immediately disable the application, enable Microsoft Graph activity logging, and audit for any unauthorized credential additions or suspicious directory role assignments since October 13. Experts caution that some types of unauthorized access may leave no audit trail, making immediate action preferable to waiting for evidence of data compromise. ConnectWise stated it found no evidence that customer backup data was compromised, though the full impact depends on permissions configured in each affected tenant.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

A maximum-severity vulnerability affecting Magento and Adobe Commerce platforms could allow hackers to execute malicious code on store servers. Known as BlockStrap and identified as CVE-2026-103849, the flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3. Security researchers at Sansec have identified four potential attack paths within 24 hours, though active exploitation has not yet been documented.

Sansec researchers contend that Adobe’s priority rating of the vulnerability does not adequately reflect its severity and urgency, warning that attackers using artificial intelligence tools could develop working exploits relatively quickly. The company notes that administrators must apply both the latest patches and previous security fixes to fully address the risk, as BlockStrap and an earlier flaw called StyleSmuggler require separate corrections. Sansec expects mass attack campaigns to begin soon and plans to provide updates as attacks emerge.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Russian police have detained three suspected members of the DataSuckers hacking group following a cyberattack on Dodo Pizza, a major restaurant chain. A Moscow court placed 19-year-old Denis Fridman under house arrest until December 8 on charges related to illegal handling of computer information containing personal data. The Dodo Pizza breach exposed records related to hundreds of millions of orders placed over 15 years. According to reports, Fridman was identified after accidentally exposing his IP address while accessing stolen data. The hackers reportedly obtained corporate credentials from GitHub to gain access to the company’s systems, and the stolen database was sold on the dark web for $100,000.

DataSuckers is a financially motivated hacking group that has claimed responsibility for multiple attacks on major businesses in Russia and Ukraine in recent months. The group previously targeted tour operator Tez Tour in September and Ukraine’s largest grocery chain ATB earlier this month, demanding $400,000 and claiming to have stolen millions of customer records. Four alleged members of the group have been identified, with two detained, one under house arrest and one remaining at large. The suspects reportedly include citizens of Russia, Kazakhstan and Belarus. In a recent statement, DataSuckers said it would continue operations but reduce its public activity.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Researchers at Citizen Lab have documented the first public technical confirmation of mercenary spyware distributed through targeted online advertisements. The Candiru spyware was delivered to devices at Al Jazeera Media Network through a technique called AdFection, which infected targets without requiring them to click anything. The attack was facilitated by Israeli firm Discover-Tech, which used its Controlium platform to embed malicious code in advertisements purchased through mainstream ad networks and exchanges.

Between March and June 2026, the advertising operation placed billions of ad bids and won millions of auctions, with potentially hundreds of thousands to millions of users directed to attacker-controlled domains. Evidence from Al Jazeera showed that at least 45 devices were targeted between 2024 and 2025. After Citizen Lab reported its findings, major advertising companies including Google, IAB Europe, Beeswax, Eskimi, and Vungle removed offending accounts and blocked associated domains.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Researchers at security firm Calif demonstrated a local privilege escalation exploit affecting OpenBSD 7.9 that combines a 37-year-old integer overflow vulnerability with a separate kernel flaw to gain root access. The exploit bypasses OpenBSD’s KARL kernel-address randomization and hardware protections including SMAP and SMEP. OpenBSD released patches for both vulnerabilities in September 2026 through errata updates, with the integer overflow fix classified as a reliability issue and the use-after-free vulnerability addressed as a security fix.

The integer overflow originates from a shared-memory attachment counter defined as a 16-bit value since 1988, which the exploit causes to wrap to a negative number by mapping numerous shared-memory segments and forking multiple processes. This triggers a use-after-free condition that allows an out-of-bounds write to modify kernel memory protections. The researcher noted that OpenBSD’s memory allocators remain deterministic despite kernel binary randomization, allowing predictable placement of function pointers that the exploit can target. Calif has published detailed documentation and proof-of-concept code following the availability of patches.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Microsoft has identified a problem with its October Windows 11 security update that prevents some users from enabling Smart App Control, a security feature designed to block potentially harmful applications. The issue affects devices running Windows 11 version 24H2 and later, where the Smart App Control option becomes grayed out and cannot be activated if it was previously disabled. Devices that already have Smart App Control turned on are not impacted by this update.

While Microsoft develops a permanent solution, the company has provided temporary workarounds for IT administrators managing enterprise devices. Users can restore the feature by running specific command prompt commands that modify the system registry, or administrators can deploy group policy settings to re-enable Smart App Control on affected computers. This update represents one of several recent Windows issues Microsoft has addressed, including problems with Remote Desktop access and VPN connections.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Security researchers have identified a hacking group with suspected connections to Kazakhstan that has targeted government agencies across multiple former Soviet states since January 2025. The group, tracked under different names by cybersecurity firms Cisco Talos and Recorded Future, has conducted at least eight campaigns against institutions in nine countries including Russia, Belarus, Armenia, Uzbekistan and Tajikistan. The hackers appear focused on obtaining sensitive information related to diplomatic affairs, economic policy, and strategic resources such as energy supplies and water systems.

The group typically uses phishing emails containing malicious attachments, sometimes sent from already-compromised government email accounts, and recently began exploiting software vulnerabilities to deliver malware. Researchers assessed with medium confidence that the group operates from Kazakhstan, based on evidence including Russian-language materials in their malware, testing activity originating from Kazakhstan, and operations aligned with the country’s time zone. The timing of some attacks near diplomatic meetings suggests potential interest in monitoring negotiations and international relations within the region.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.