Malicious GhostPoster Browser Extensions Found With 840,000 Installs

,

17 malicious GhostPoster browser extensions found in Chrome, Firefox, and Edge have accumulated 840,000 installs, employing hidden JavaScript for tracking, ad fraud, and backdoor access. These extensions, initially reported in December, include popular ones like “Google Translate in Right Click” and “Ads Block Ultimate.” They originated on Microsoft Edge and spread to other browsers, with some active since 2020. Recent variants show advanced evasion tactics, but affected users remain at risk even after removals from stores.

https://www.bleepingcomputer.com/news/security/malicious-ghostposter-browser-extensions-found-with-840-000-installs/

Microsoft Knocks Offline RedVDS Cybercrime Marketplace Linked to $40M in Fraud

,

Microsoft disrupted the RedVDS cybercrime marketplace, linked to $40 million in fraud, by seizing key infrastructure and working with international law enforcement. RedVDS enabled mass phishing and account takeover campaigns, compromising over 191,000 organizations worldwide. The service sold access to Windows RDP servers, leaving behind technical indicators like a shared computer name and a cloned Windows Server 2022 image.

https://redmondmag.com/articles/2026/01/15/microsoft-knocks-offline-redvds-cybercrime-marketplace.aspx

‘Signal’ President and VP Warn Agentic AI Is Insecure, Unreliable, and a Surveillance Nightmare

Signal leaders warn agentic AI is insecure, unreliable, and risks surveillance. At 39C3, they highlighted its vulnerabilities, including susceptibility to malware and low task success rates. They advocate for industry changes to improve privacy, security, and transparency, urging firms to halt reckless deployment and prioritize user consent and data protection.

https://coywolf.com/news/productivity/signal-president-and-vp-warn-agentic-ai-is-insecure-unreliable-and-a-surveillance-nightmare/

CodeBreach: Supply Chain Vuln & AWS CodeBuild Misconfig

, ,

Wiz Research uncovered a critical vulnerability, named CodeBreach, in AWS CodeBuild that allowed unauthorized access to key AWS GitHub repositories, notably the JavaScript SDK for the AWS Console. This flaw, stemming from unanchored regex filters in build triggers, let attackers exploit CI/CD processes to extract sensitive credentials, potentially compromising many AWS accounts. Recommendations for safeguarding against such vulnerabilities include implementing strict build gates and securing GitHub connections. AWS promptly remediated the issue and issued additional hardening measures in response to the findings. The incident underscores the increasing targeting of CI/CD environments by attackers.

https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild

Critical WhisperPair Flaw Lets Hackers Track, Eavesdrop Via Bluetooth Audio Devices

, , ,

Security researchers found a critical vulnerability in Google’s Fast Pair protocol, called “WhisperPair,” allowing attackers to hijack Bluetooth audio devices to track and eavesdrop on users. The flaw affects numerous devices, regardless of smartphone OS, due to improper implementation allowing unauthorized pairing. Attackers can exploit it from up to 14 meters away, gaining control of the devices for malicious purposes. Google awarded researchers $15,000, but security updates are still pending for many devices. Users must install firmware updates to mitigate risks.

https://www.bleepingcomputer.com/news/security/critical-whisperpair-flaw-lets-hackers-track-eavesdrop-via-bluetooth-audio-devices/

Reprompt: The Single-Click Microsoft Copilot Attack That Silently Steals Your Personal Data

, ,

Varonis Threat Labs identified a new AI vulnerability called Reprompt in Microsoft Copilot that allows attackers to exploit a single click on a seemingly legitimate link to bypass security controls and exfiltrate sensitive user data without detection. This attack can lead to significant data breaches by firing off malicious commands that continue even after the user interacts with the Copilot. Key methods involve URL parameter manipulation and managing hidden follow-up requests, making it difficult to spot the exploitation attempts. Microsoft has since patched the vulnerability. Recommendations are made for both vendors and users to enhance security against such vulnerabilities.

https://www.varonis.com/blog/reprompt

Inside RedVDS: How a Single Virtual Desktop Provider Fueled Worldwide Cybercriminal Operations

,

RedVDS Infiltration: Microsoft Threat Intelligence reveals RedVDS, a VDS provider, facilitated global cybercrime, enabling phishing and fraud. It operated with cloned Windows servers for low-cost, anonymous access. Investigations resulted in takedowns of its infrastructure, highlighting it employed basic software for phishing campaigns. Cybercriminals exploited it with mass email tools and VPNs, hiding their tracks. RedVDS’ structure, payment via cryptocurrency, and operational model aided criminal scalability, leading to significant fraud losses in various countries. Microsoft calls for increased vigilance against such threats.

https://www.microsoft.com/en-us/security/blog/2026/01/14/inside-redvds-how-a-single-virtual-desktop-provider-fueled-worldwide-cybercriminal-operations/

Exclusive: Beijing Tells Chinese Firms to Stop Using US and Israeli Cybersecurity Software, Sources Say

China bans over a dozen U.S. and Israeli cybersecurity software companies due to national security concerns, urging firms to seek domestic alternatives amidst ongoing trade tensions. Companies affected include Palo Alto Networks, CrowdStrike, and Check Point. This ban reflects China’s aim to replace Western technology and mitigate hacking risks.

https://www.reuters.com/world/china/beijing-tells-chinese-firms-stop-using-us-israeli-cybersecurity-software-sources-2026-01-14/

More Than 40 Countries Impacted by North Korea IT Worker Scams, Crypto Thefts

,

Over 40 countries affected by North Korea IT worker scams and crypto thefts; U.S. urges UN to enforce sanctions against North Korea. Report details North Korea’s schemes to fund weapons programs, including identity theft and laundering via Chinese banks. U.S. accuses China and Russia of harboring North Korean operatives. Discussions at UN highlighted challenges in identifying North Korean workers amidst growing AI integration in scams. North Korea criticized the U.S. for its actions at the UN.

https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations

Remote Code Execution With Modern AI/ML Formats and Libraries

, ,

Three open-source AI/ML Python libraries by Apple, Salesforce, and NVIDIA have vulnerabilities allowing remote code execution (RCE) via malicious metadata in models. Specifically:

  1. NeMo – NVIDIA’s PyTorch framework for diverse AI/ML model development
  2. Uni2TS – Salesforce’s library for time series analysis
  3. FlexTok – Apple’s framework for image processing

The vulnerabilities leverages hydra.utils.instantiate() to execute arbitrary code embedded in model metadata. None have been exploited in the wild as of December 2025. Fixes were issued swiftly by the vendors, with severity ratings classified as High. Modifications in their libraries have improved security against these issues, emphasizing the importance of ongoing vigilance in AI/ML model handling.

https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/

VoidLink: The Cloud-Native Malware Framework

, ,

Extreme TLDR: VoidLink is a modular, cloud-native Linux malware framework designed for stealth and long-term access, featuring over 30 plugins, adaptable OPSEC techniques, and developed by possibly Chinese affiliates for commercial use. It targets cloud environments, adapts behavior based on detected security measures, and includes capabilities for credential harvesting and persistence.

https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/

Apple Opposes India’s Plan to Access iOS Source Code

Apple opposes India’s proposal requiring smartphone manufacturers to submit source code for security reviews. The plan aims to enhance user data security amid rising fraud, but major companies, including Apple, Google, and Samsung, express concerns about revealing proprietary information. Despite the government’s insistence on openness regarding the proposal, industry objections highlight apprehensions about data protection and lack of international precedent.

https://www.macrumors.com/2026/01/12/apple-opposes-india-plan-access-ios-source-code/

Banks Collaborate to Warn Consumers of Recovery Scams

, ,

TLDR: Five banks warn about growing recovery scams targeting fraud victims, where scammers promise to recover lost funds for a fee. Criminals impersonate officials, pressuring vulnerable victims for personal information and money. Legitimate organizations won’t charge fees for recovery. Consumers should verify contacts, avoid unsolicited offers, and report suspected scams to their banks.

https://www.vcnewsreview.com/stories/banks-collaborate-to-warn-consumers-of-recovery-scams,314246

Why Attackers Are Phishing on LinkedIn (and How to Stop It)

, , ,

Phishing attacks have expanded beyond emails to social media and messaging apps like LinkedIn, where they can be particularly effective due to the platform’s professional trust and accessible target identification. LinkedIn phishing is rising because traditional email security measures often do not cover direct messages, allowing attackers to reach high-value targets easily. To mitigate risks, users should treat LinkedIn messages similarly to emails, verify requests through alternative channels, implement multi-factor authentication, and receive training on recognizing phishing attempts outside of email.

https://www.pandasecurity.com/en/mediacenter/why-attackers-are-phishing-on-linkedin-and-how-to-stop-it/

Scroll to Top