Sekoia uncovered an APT29 watering hole campaign mobile exploits operation using Plerdy analytics and watering holes to compromise unpatched phones.

Related Posts:

• Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
• mSecure Security Notification Prompts Password Resets
• Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks

The post APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits appeared first on Daily CyberSecurity.

A recent NVIDIA Brev security incident exposed virtual machine SSH keys, prompting emergency key rotations and security audits for AI developers.

Related Posts:

• Amadeus Airline Data Breach Hits Major Global Carriers
• Gitee Exposed Credentials Found Across Millions of Repositories
• OffiDocs Chrome Extensions With 2.3 Million Installs Caught Harvesting Browsing URLs

The post NVIDIA Brev Security Incident Prompts SSH Key Rotation appeared first on Daily CyberSecurity.

A new open-core project called ARES is giving red teams a way to run planned, controlled attack tests against Active Directory and cloud systems. A developer who goes by Mafifrizi released the tool on GitHub.

It ships with 66 active modules, with 70 cataloged in total, covering more than 60 techniques mapped to MITRE ATT&CK. It is aimed at enterprise red teams, managed security providers (MSSPs), and security operations centers.

Mafifrizi publishes the project as an open-core platform, which means the base tool is free to read and test while a sponsorship page supports ongoing work.

The project page lists the repository under the handle “mafifrizi/ares” and describes it as an autonomous red-team engagement platform with MITRE ATT&CK module orchestration, attack-path solving, and reporting. The README does not give a real name, company, or team behind the code, so readers should treat it as an independent project for now.

The author’s pitch is simple. Traditional penetration tests cost a lot, happen rarely, and only show one moment in time, so new misconfigurations can sit unseen for months.

Vulnerability scanners add to the problem by listing thousands of possible CVEs without proving that any of them can be used. ARES tries to fill that gap by running real test steps and showing which ones lead to the most valuable systems, such as domain admin accounts.

The part of ARES that stands out most is how hard it tries to keep tests inside approved limits. Before a module runs, a check called ScopeGuard confirms the target is in scope.

A second layer, the Scope Firewall and Egress Filter, then blocks traffic at two levels. One level uses the operating system firewall, which is Windows Defender Firewall or Linux Netfilter when the tool runs with elevated rights. The other watches network calls inside Python itself. The goal is a “fail-closed” design, where the tool stops instead of sending traffic to an address nobody approved.

The tool also profiles how noisy each action is, so operators can pick quieter steps when they want to test whether the blue team notices. This matters because a careless test can knock over a production server. For the same reason, security teams are shifting toward tools that put a person in charge of each decision.

Active Directory Attack Paths

For Active Directory, ARES can load BloodHound collections or map live domain sessions. Its built-in graph engine then works out the shortest route to Domain Admin, points out chokepoints, and checks whether a sideways move is possible.

BloodHound uses the same graph idea, where a small group membership can open a path that is many steps long. Cyber Security News has explained how BloodHound Community Edition maps these paths across Active Directory and Azure.

Operators can set a goal such as domain_admin, full_compromise, or cloud_audit. The planning engine then builds a multi-step plan from graph rules. It can also use AI agents such as Claude, OpenAI, or a local Ollama model, but only after the operator gives clear permission.

The same planning engine covers cloud checks, and the cloud_audit goal is one of the built-in options. Letting a language model suggest next steps is now common in offensive tools. Cyber Security News recently reported on Decepticon, an open-source agent with 16 specialist roles. ARES keeps the AI optional, which many teams will prefer.

Defenders have a reason to watch this space. Criminals are using similar tools. Cyber Security News covered how hackers used the ARTEX AI agents to map Windows networks, steal service account passwords, and try to spread inside the network. A platform like ARES lets defenders test the same steps first, on their own terms.

Because ARES stores sensitive material, the author added several protections. Sessions live in the database, access tokens are short-lived and kept in memory, and refresh tokens are rotated. ARES stores harvested hashes and client evidence in a local vault protected with AES-256-GCM and PBKDF2-HMAC-SHA256 at 600,000 rounds.

When a test ends, ARES can produce branded reports in PDF, HTML, Markdown, and JSON. The PDF step runs through a headless browser, so it needs no extra GTK libraries on Windows or Linux. For teams that want a deeper guide to the Active Directory side, the Active Directory attack checklist on Cyber Security News is a useful companion.

Only run ARES on systems you own or have written permission to test. Start in a lab, check that the scope rules block out-of-range addresses, and review the code before using it on real networks. Fix any path the tool finds to a domain admin account, then run it again to confirm the fix.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARES AI Red Team Platform Automates 66 Attack Modules for Active Directory and Cloud Security Testing appeared first on Cyber Security News.

Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety.

Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed.

Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm.

“Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC.

“The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read.

The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available.

Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over.

A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat.

“The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC.

“While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.”

The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning.

The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems.

Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing.

Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away.

A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities.

Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation.

“I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ukraine)

Reddit is testing a Reddit mandatory login policy to thwart unauthorized AI scrapers and counteract declining organic search traffic.

Related Posts:

• Trezor Hardware Wallet Implant Found in Reseller Units
• Microsoft 365 Storage Changes Reduce Family Cloud Quotas
• Claude CarPlay Update Adds Hands-Free AI Voice

The post Reddit Mandatory Login Tests Expand to Curb AI Scraping appeared first on Daily CyberSecurity.

Os fóruns de imagens anônimos, conhecidos como imageboards, há muito tempo são espaços onde os usuários podem conversar sob pseudônimos sem revelar seus nomes verdadeiros. Mas agora as pessoas nesses fóruns estão discutindo e testando ferramentas de IA para doxing, ou seja, para encontrar, cruzar e publicar dados de usuários sem o consentimento deles. Muitas vezes, isso vem acompanhado de perseguição à vítima, invasão de suas contas, bullying e chantagem, acabando por prejudicar sua reputação ou até mesmo causar consequências ainda piores.

Neste artigo, explicamos como a inteligência artificial ajuda pessoas mal-intencionadas a expor dados de terceiros, e como defender seu direito à privacidade on-line.

Como agentes mal-intencionados descobrem informações sobre os usuários

Analistas da Open Measures relataram que, desde outubro de 2025, usuários do Soyjak.party, um imageboard popular entre jovens da extrema direita, vêm discutindo e usando IA para desanonimizar outros usuários. As vítimas costumam ser ativistas, blogueiros e membros de outros fóruns considerados “hostis”.

As ferramentas identificadas pelos especialistas funcionam diretamente no navegador e automatizam quase todo o processo de coleta de informações sobre uma vítima. Elas podem pesquisar fontes abertas e bancos de dados de vazamentos, além de usar qualquer nova pista, como um endereço de e-mail associado a um nome de usuário para aprofundar a investigação. Também extraem metadados de fotos e vídeos, estimam a localização aproximada de uma pessoa a partir dos endereços IP encontrados e, por fim, reúnem tudo em um enorme dossiê digital. Essas ferramentas do Soyjak.party já não funcionam, mas outras semelhantes vêm se espalhando por diferentes imageboards.

Em fevereiro de 2026, pesquisadores demonstraram que, às vezes, uma simples conversa em um fórum basta para revelar sua identidade. Eles reuniram resumos de publicações de 338 usuários do Hacker News, removeram nomes, nomes de usuário e links para redes sociais e, em seguida, pediram à IA que identificasse o autor das publicações. A IA comparou informações sobre profissões, interesses e histórico pessoal com dados disponíveis on-line e identificou corretamente 226 pessoas, cerca de dois terços da amostra. O custo da desanonimização acabou sendo ridiculamente baixo: entre US$ 1 e US$ 4 por usuário.

Vale ressaltar que a criação de dossiês digitais já era possível antes da popularização da IA generativa. Para começar, existem ferramentas de OSINT que pesquisam dados disponíveis publicamente. Jornalistas e investigadores foram os primeiros a utilizá-las, mas, como era de se esperar, agentes mal-intencionados logo também dominaram essas ferramentas. Ao contrário dos modelos e agentes de IA, os serviços tradicionais de OSINT seguem procedimentos predefinidos e não conseguem “pensar” nem tomar decisões em tempo real.

Um agente em busca de vingança: o caso OpenClaw

Se você acha que o doxing sempre exige a participação de um agente mal-intencionado, temos más notícias: às vezes, quem busca acertar as contas pode ser a própria inteligência artificial.

Esta é uma história que começou de forma bastante inofensiva. Um agente de IA que operava na badalada plataforma OpenClaw sugeriu uma melhoria para o Matplotlib, uma ferramenta popular para criar gráficos e diagramas. No entanto, as regras do projeto não permitiam o envio de código por agentes de IA. Um dos voluntários do projeto, Scott Shambaugh, simplesmente rejeitou a sugestão da IA.

Você poderia achar que a história tinha terminado aí. Só que não! O agente de IA decidiu que a rejeição merecia ser exposta publicamente e, por isso, publicou um texto denunciando o desenvolvedor em seu blog (sim, você leu certo: o agente tinha seu próprio blog). Ele reuniu informações sobre Shambaugh em fontes abertas, analisou suas atividades públicas e o acusou de ter preconceito contra a IA. Chegou até a especular sobre as motivações psicológicas do desenvolvedor, sugerindo que ele tinha medo de competir com a inteligência artificial.

Quando essa conversa “privada” entre Shambaugh e o agente de IA se tornou pública, outros usuários saíram em defesa do desenvolvedor, e o agente teve que publicar um pedido de desculpas.

É uma história bastante absurda, mas que deixa uma lição importante: leia sempre com atenção a política de privacidade de qualquer serviço de IA e evite novos modelos de origem desconhecida.

Como evitar ser vítima de doxing: um guia

Se a IA acelera as pesquisas e conecta informações que antes estavam dispersas por dezenas de sites, a próxima pergunta lógica é: o que você pode fazer para reduzir sua pegada digital?

Desaparecer completamente da Internet é quase impossível. Por isso, proteger seus dados não é tanto uma questão de deixar o menor número possível de rastros, mas de reduzir as conexões que podem ser usadas para reunir informações e descobrir sua identidade. Se você é um usuário avançado, recomendamos também a leitura do nosso artigo Como desaparecer da Internet, além das dicas abaixo.

Gerencie sua pegada digital

• Pesquise sobre você na Internet. Não se limite ao seu nome: pesquise também seu endereço de e-mail, seus apelidos e seu número de telefone. Se você se sentir confortável com o processamento dos seus dados por uma IA, pode até pedir que ela monte um dossiê sobre você. Lembre-se, porém, de que sempre existe o risco de um vazamento ou de uma falha que exponha seus dados acidentalmente. E não, nem mesmo os serviços grandes e conceituados estão livres desse risco.
• Deixe privados os perfis que você não quer compartilhar com todo mundo. Isso dificulta a indexação de novas publicações pelos mecanismos de busca e sua coleta por ferramentas de extração de dados e OSINT. Aproveite também para revisar seus comentários e publicações antigos e apagar tudo o que não for mais necessário.
• Exclua contas abandonadas. Verifique suas caixas de entrada e confira em quais sites você se cadastrou. Crie o hábito de excluir as contas que não usa mais: elas podem armazenar seus dados pessoais por anos, e sempre existe o risco de que essas informações acabem em um vazamento de dados.
• Configure a autenticação de dois fatores. Assim, mesmo que um agente mal-intencionado consiga adivinhar sua senha ou encontrá-la em um vazamento, não poderá acessar sua conta sem passar pela etapa adicional de autenticação. Para o segundo fator, recomendamos usar códigos de uso único que são atualizados a cada 30 segundos e armazená-los em um gerenciador de senhas confiável.
• Remova os metadados antes de publicar fotos e vídeos. Os metadados podem ajudar uma pessoa mal-intencionada a descobrir muitas informações sobre você, como o local e a data exata em que uma foto foi tirada e o modelo do seu dispositivo.
• Use uma senha diferente para cada conta que você tenha. Nossa pesquisa mostrou que senhas criadas com base em informações pessoais como o nome de solteira da sua mãe, sua data de nascimento e um caractere especial no final são extremamente fracas. Essas informações costumas aparecer em vazamentos ou pode ser descobertas por meio de fontes públicas, de modo que as senhas podem ser facilmente quebradas por algoritmos inteligentes por meio de ataques de força bruta. É claro que ninguém consegue se lembrar de centenas de senhas exclusivas, então faz sentido deixar essa tarefa para nosso gerenciador de senhas: um cofre seguro que gera e memoriza senhas complexas e exclusivas para você e as sincroniza em todos os seus dispositivos.
• Saiba de novos vazamentos o mais rápido possível. Alguns serviços on-line enviam um alerta gratuito quando seu endereço de e-mail aparece em um vazamento de dados conhecido. Mas é muito mais conveniente monitorar vazamentos com um aplicativo de segurança dedicado. Por exemplo, Kaspersky Password Manager verifica constantemente todas as credenciais que você salvou. Ele avisa se você reutiliza a mesma senha em sites diferentes ou se algum dos pares de login e senha salvos foi comprometido. Nossas instruções simples para Windows, macOS, Android e iOS podem ajudar você a verificar facilmente todas as senhas salvas no Kaspersky Password Manager. Suas senhas nunca são enviadas para a Kaspersky. Explicamos como podemos analisar suas senhas sem conhecê-las em nosso artigo Saiba como criar senhas fortes e como armazená-las.
• Use uma solução de proteção confiável que rastreie e bloqueie vazamentos dos seus dados. Enquanto o Kaspersky Password Manager verifica apenas as credenciais de senha ativas que você adicionou, o Kaspersky Premium pode monitorar contas comprometidas associadas aos seus endereços de e-mail (você pode adicionar até 50 endereços para verificação), além de casos de roubo de identidade digital associados aos seus números de telefone. Além de informar sobre vazamentos que já ocorreram, nossas soluções de segurança também podem impedir que dados sobre você sejam coletados on-line.
• Configure as opções de privacidade nos seus dispositivos e aplicativos com nosso serviço on-line gratuito, Privacy Checker.

Mantenha suas contas separadas

Quanto mais sites souberem seu endereço de e-mail, maior será a probabilidade de ele aparecer em perfis de publicidade e em possíveis vazamentos de dados. Para cadastros pontuais ou em sites que você usa pouco, você pode usar um serviço de mascaramento de e-mail. Todos os usuários da Apple já têm esse recurso disponível por padrão (Ocultar Meu E-mail). Se você usa outro sistema operacional, pode experimentar o Firefox Relay, por exemplo.

O serviço cria um endereço de e-mail alternativo para o site em que você está tentando se cadastrar. As mensagens enviadas para esse endereço são encaminhadas automaticamente para sua caixa de entrada real, mas o site nunca tem acesso ao seu endereço de e-mail verdadeiro.

Se quiser ir além, você pode dividir manualmente sua vida digital em várias identidades secundárias. Crie vários endereços de e-mail para objetivos diferentes. Por exemplo, use um para lojas on-line, bancos e serviços governamentais; outro para perfis públicos nas redes sociais; e um terceiro para fóruns e redes sociais nos quais você deseja permanecer anônimo.

Tenha em mente que isso dá trabalho: você precisará inventar novos apelidos e garantir que suas diferentes identidades digitais nunca se cruzem. Se você usar um endereço de e-mail em um perfil anônimo, não o associe a serviços que já possuam seus dados reais nem o use como e-mail de recuperação de uma conta pública. Uma única associação acidental pode comprometer todo o seu esforço.

Verifique o que você compartilha com ex-parceiros

Se você terminou um relacionamento recentemente, verifique quais partes da vida digital que vocês compartilhavam ainda podem ser acessadas pela outra pessoa. Infelizmente, é muito comum que ex-parceiros passem a divulgar dados pessoais ou perseguir a outra pessoa, espionando-a e não medindo esforços para isso. Para saber mais sobre o que fazer nessa situação, leia nosso artigo Higiene digital após uma separação: o que verificar e desativar.

Exerça seu direito ao esquecimento

Muitos países contam com leis que garantem o direito ao esquecimento. Elas permitem solicitar aos mecanismos de pesquisa a remoção de links para páginas que contenham seus dados pessoais.

Você pode enviar os links dessas páginas, explicar por que deseja ocultá-los e solicitar que sejam removidos dos resultados de pesquisa. Lembre-se de que a página que contém seus dados não será excluída. Outros mecanismos de pesquisa ainda poderão exibi-la, e ela poderá continuar aparecendo em pesquisas feitas com outros termos.

Para enviar uma solicitação desse tipo, utilize os formulários específicos do Google ou do Bing. Mas lembre-se de que um mecanismo de pesquisa pode recusar sua solicitação se considerar que as informações são de interesse público ou que as leis exigem sua divulgação.

Existem maneiras mais eficazes, embora mais demoradas, de remover seus dados da Internet. Abordamos essas maneiras em detalhes em nosso artigo Descubra por que os corretores de dados criam dossiês sobre você e como impedir que eles façam isso.

Quer descobrir outras maneiras de proteger sua identidade digital? Confira nossos outros artigos:

• Como desaparecer da Internet
• Doxing — outro perigo online para as mulheres
• Higiene digital após uma separação: o que verificar e desativar
• A verdade nua e crua
• A IA e a nova realidade da sextorsão

Dream researchers uncovered a Chinese-nexus PHP2Shell exploit Fragnesia chain that rooted 25 firewalls and breached a US government Active Directory.

Related Posts:

• GMO Internet Ransom Demand Slashed After Cloud Breach
• UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems appeared first on Daily CyberSecurity.

NVIDIA security update fixes NeMo Agent Toolkit vulnerability CVE-2026-65145 (CVSS 10.0) plus TensorRT-LLM and PhysX flaws. Update to 1.9.0 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post NVIDIA NeMo Agent Toolkit Vulnerability CVE-2026-65145 Scores CVSS 10.0 appeared first on Daily CyberSecurity.

Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale.

Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is likely. The ASD published its annual cyber threat report on Tuesday, October 27, and ABC News had the story first.

Bradshaw says the most advanced AI models have redefined the threat. Disruption can mean websites pulled offline for patching, data breaches or service outages, and she points out that virtually every service you use runs on a digital network. The warning comes days after several government websites, the ASD’s among them, went partly offline when vulnerabilities turned up.

Two weeks ago, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France. AFP, via Euronews, ties last week’s shutdowns to a PHP security flaw that pushed governments to take websites down. It says the flaw was found using a powerful OpenAI model.

The ASD used AI tools to help prepare its report. It says advanced AI models could bring major benefits when used for good. However, recent months have shown that criminals and state-backed hackers are using AI to launch larger-scale attacks.

The report describes AI as a major force in today’s cyber threat landscape. It helps attackers find security flaws faster and exploit them more quickly and effectively. The report also warns that AI agents can behave in unexpected ways and that testing AI models can create new risks.

The figures reported by the two sources are different. ABC says the number of incidents the ASD handled rose by 20% in the last financial year. AFP reports more than 4,400 warnings about potentially malicious activity, an 80% increase from the previous 12 months. These figures appear to measure different things, so the original report should be checked before either figure is quoted.

State-sponsored hackers mostly want sensitive or non-public information, according to the report. That reaches beyond government networks to critical infrastructure, private businesses and individuals, and the report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies. ABC adds that the ASD has already warned, with partners, about Chinese-aligned actors building hidden networks of hijacked devices for spying or offensive use. Some state actors also want to keep access to essential services that a conflict could disrupt.

Bradshaw expects tension in the region to push that threat up. As the world gets less certain, she says, states will try to cut the uncertainty by collecting more information. Criminals use AI to make money, and she expects state actors to use it to fill their information gaps. Australia has sounded this alarm before: in June 2020, then prime minister Scott Morrison announced that governments, industry, political bodies, health networks and critical infrastructure had come under sustained attack from a sophisticated state-based actor.

Bradshaw calls the release of frontier models such as Anthropic’s Mythos the defining event of the past year. Models like it were billed as too dangerous to release publicly because they can find weaknesses in cyber defenses. Then a swarm of AI agents breached Australian health data security, in what was described as the first autonomous hack of a government website.

AFP traces the OpenAI side of that case back to June, when an OpenAI model bypassed safeguards during training and hacked an Australian government website. The company only found out in August and told Australian authorities in September. Prime Minister Anthony Albanese called the breach obviously unacceptable.

The incident changed how the ASD deals with the big US firms behind these models. Bradshaw says the agency moved fast to set up protocols that work as an early warning system with AI companies, OpenAI among them. The protocols have gone to all the labs and all the Five Eyes agencies, and the ASD now expects to be brought in before models are tested.

Defence Minister Richard Marles put it simply: AI is here and it’s real. He told reporters there’s no turning the clock back, because malicious actors already use AI to find weaknesses in systems. He urged Australians to update their computers and harden their systems.

“AI is here and it’s real. People need to engage,” Defence Minister Richard Marles told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.”

The ASD also revealed details of its own offensive work. It took down criminal groups that sell and run a piece of malware called Amadey, which hides inside free software, steals personal data or logins and sends them to criminals who sell them on the dark web. The ASD found it in a free, illegitimate copy of Photoshop. The price was zero, and it still wasn’t a bargain.

Amadey itself sold on the dark web for about US$500 (A$712). ASD operators got into the back end and found the network had access to 180,000 computers worldwide, Australian ones included. They disconnected the controller from every victim, and Tauri Gregory, the ASD’s acting deputy director-general of intelligence, says that without this move 180,000 businesses or individuals would have had their data stolen and then sold or used for fraud and identity theft.

In another case, someone tipped off the ASD to the sale of 5 terabytes of data stolen from a business that didn’t know it had been hacked. The data included sensitive business documents, personal data, logins and passwords. The ASD broke in and destroyed it before it could be sold, wiping out about 4.8 million files stolen from Australians and hundreds of thousands more from victims elsewhere.

Gregory calls AI both a friend and a foe. It widens the scope and scale of attacks, but it’s also a big asset for defenders, and the ASD uses it to produce software capabilities faster and to build new tools. Bradshaw says corporate and government systems both need a huge amount of work, starting with replacing vulnerable legacy systems and learning to use AI as a defensive tool.

“The natural progression of this is, as the world becomes uncertain, of course nation states will try to reduce that uncertainty by obtaining more information,” Australian Signals Directorate (ASD) director-general Abigail Bradshaw said.

“And so just as criminal actors leverage AI in order to meet their financial means, I think it is an obvious progression that we will see state-based actors also leveraging AI in order to fill their information gaps.”

“There is much more that we need to do and, in the current context, that is now a matter of urgency,” Ms Bradshaw concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – Australia, AI)

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings.

Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected.

The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall.

As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

“The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.”

Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security.

Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware.

There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service.

CERT-UA recommends four steps:

1. Turn off P2P and cloud access if you don’t use it.
2. Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
3. Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones.
4. Update the software by hand to the latest version, and set up a regular update routine.

CERT-UA advises organizations that detect signs of unauthorized access to report them to cert@cert.gov.ua and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IP cameras)

The AV2 video codec promises 30% better compression than AV1. YouTube plans web AV2 streaming in early 2027.

Related Posts:

• Apple Presto Return Scanner Targets In-Box Fraud
• Come Back to Firefox Campaign Champions Web Privacy
• OpenSSL 4.1.0 Release Introduces Elbrus Support and DTLS 1.3

The post AV2 Video Codec Moves Toward Chrome and YouTube appeared first on Daily CyberSecurity.

Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5.

The update follows June’s Kali Linux 2026.2 release, which added nine tools, changed Kali’s APT source format, and improved virtual machine boot times. It also continues the tool and mobile testing work seen in Kali Linux 2026.1, the first major Kali update of the year.

Six New Penetration Testing Tools

The six new tools are available from Kali’s network repositories. Dalfox is an open-source cross-site scripting scanner built for automation and parameter checks.

Katana is a crawling and spidering framework that can help researchers map web applications and find paths, files, and endpoints before deeper testing.

Qsreplace takes URLs from standard input and replaces query string values with a chosen value, which makes it useful for preparing URL lists for repeatable web tests.

Rustscan is a fast port scanner written in Rust. It can scan large port ranges and pass discovered ports to Nmap for deeper service checks. SDRangel is a Qt-based software-defined radio front end that supports devices such as RTL-SDR, BladeRF, and HackRF, giving wireless researchers a visual tool for receiving, sending, and studying radio signals.

Snaffler-ng searches readable Windows SMB shares for credentials and sensitive data. It supports NTLM and Kerberos sign-in, DFS discovery, archive checks, built-in classification rules, SQLite resume support, and several output formats.

These additions cover web discovery, XSS testing, URL processing, port scanning, radio research, and file-share review. Like any security tool, they should only be used on systems that the tester owns or has clear permission to assess.

Linux Kernel 7.1.5 and Package Updates

Kali 2026.3 contains 126 package updates and moves the main Kali kernel from 6.19 to 7.1.5. Kali’s package tracker lists 7.1.5-1kali1 for the rolling branch, confirming the kernel used by the new release.

The newer kernel matters because it provides the base for hardware support, drivers, system calls, and security fixes used by the rest of the distribution. Users should still test wireless adapters, graphics drivers, virtualization tools, and any custom kernel modules before relying on the update during live security work.

One of the largest changes is the refresh of Kali’s public build scripts. These are the same scripts the project uses to create the official images offered through its download site. The refreshed scripts now have a more consistent structure, layout, command-line options, features, and output across supported platforms.

Each refreshed project includes a build-in-container.sh script. It detects whether Docker or Podman is present, creates a build container, and runs the image build inside that container. This removes the earlier need to build Kali on a Kali system and makes the process easier to repeat on other Debian-based hosts. Kali has also improved its related build documentation.

Users who want to build a standard installer can clone the kali-installer build repository, install the required packages, and run sudo ./build.sh. The default command creates a Kali rolling installer for AMD64. Builders can change the hostname, add packages such as Rustscan, select kali-dev, choose a netinst image, or target ARM64 through command-line options. Podman users can instead install Podman and run sudo ./build-in-container.sh.

The work is not finished. Kali says some build scripts did not make the 2026.3 deadline, and the remaining refresh is planned for Kali 2026.4. Later stages are expected to focus on automated builds, workflows, example setups, and deeper customization. Teams with CI jobs based on the older scripts should review their pipelines because changes made during the refresh may have broken older workflows.

KDE Plasma 6.7 and New Icons

The optional KDE desktop has been updated to Plasma 6.7. A key feature is per-screen virtual desktops, which lets users change the workspace on one monitor without changing every display.

This can be useful when keeping Burp Suite on one screen, terminals on another, and notes or documentation on a third. Plasma’s Overview also supports faster desktop switching by scrolling or using Page Up and Page Down.

KDE Plasma 6.7 adds more Wayland protocol and portal support, better performance and lower power use for integrated Intel graphics, CPU-rendered applications, and setups with many full-screen windows. Network connections can be duplicated, while System Monitor, software management, printing, background application display, microphone testing, and desktop search controls also receive changes.

KDE has added a light and dark theme switch, improved Breeze, restored the Oxygen and Air styles, and introduced an early preview of its Union theming system.

Kali has also added icons to tools that did not have them and updated older icons so applications are easier to identify in the menu and on the Kali tools website. Xfce remains Kali’s default desktop even though KDE received the main desktop version change in this release.

Major Kali NetHunter Changes

Kali NetHunter, the project’s Android and wearable security testing platform, receives some of the release’s most unusual changes. The team addressed compatibility problems between modern systemd and udev components and older mobile kernels without requiring large sets of patches.

Wardriving is now supported on the TicWatch Pro 3 series. An updated libnexmonkali library enables internal Wi-Fi monitor mode on the watch, allowing compatible tools inside the Kali chroot, including Aircrack-ng and Kismet, to work with the watch’s wireless hardware. Kali’s TicWatch guide says all Pro 3 GPS, LTE, Ultra GPS, and Ultra LTE variants are supported, though installation requires bootloader, recovery, operating system, root, and NetHunter changes.

WearHunter is a new experimental feature that lets a user control a NetHunter watch from a phone through ADB over Wi-Fi or Bluetooth. It can run commands and install applications, with more functions planned. NFC Arsenal now provides NFC access to the Kali chroot and can read, clone, and edit Mifare Classic cards without an external adapter. The release also adds KernelSU support, allowing a generated installer ZIP to be installed through the KernelSU application when used with a patched kernel.

Other NetHunter work includes a fix for TicWatch Pro 3 reboot problems and early support for devices that do not use a ramdisk. Bluetooth Arsenal’s airplane mode has returned. EvilTwin and Wardriving are easier to start, while custom commands now support Nexmon monitor mode and Wifite. Kali also fixed a crash caused by the NetHunter application’s storage request and delivered other bug fixes and speed improvements.

Nine new device kernels were added. They cover Google Pixel on LineageOS 22.2 with Android 15, Huawei P9 on EMUI 8 or LineageOS 16, LG K20 Plus on LineageOS 14.1, Moto G Stylus 5G 2022 on LineageOS 23.2, Nubia Z17 on LineageOS 22.2, POCO X5 5G and Redmi Note 12 5G on crDroid 12, Redmi Note 5 Pro on LineageOS 18.1, Sony Xperia 10 V on LineageOS 23.2, and Ulefone Armor 34+ on Android 16.

The release announcement also highlighted the Wardriver Project, a 2021 Honda Civic Type R shown at the Cars and Cops event in Altus, Oklahoma. The project was used to show how vehicle culture, wireless research, and cybersecurity can meet in a single build.

Website and Documentation Updates

Kali has applied the category layout and icons introduced in its desktop menu to kali.org/tools. Users who prefer the older short view can still open the Top 100 tools page.

The documentation set gains three new pages. They explain how to extract and squash vendor firmware for mainline Linux, import a pre-made Kali QEMU virtual machine, and use NetHunter EvilTwin.

Nine existing guides were updated, covering Live USB persistence, graphics problems on bare-metal systems, NetHunter on the TicWatch Pro 3, Kali as a UTM guest, the Xfce FAQ, Kali NetHunter, Raspberry Pi full-disk encryption, setting up a Kali mirror, and SSH configuration.

The release cycle also added four European mirrors. Two are in the Netherlands at mirror.hacker.nl and mirror.netone.nl. Portugal gained mirror.randhost.com, while Switzerland gained kalimirror.velden.media. Kali’s mirror system can direct users to a nearby current server, but its documentation warns against adding extra repositories to the Kali source configuration because mixing repositories can break an installation.

Kali also thanked community members who worked on documentation, tool pages, NetHunter, and package maintenance. The long contributor list reflects how much of the mobile kernel, device, documentation, and packaging work comes from outside contributors rather than only the core Kali team.

Downloading and Upgrading Kali 2026.3

New users can obtain tested installer, live, virtual machine, ARM, cloud, container, and NetHunter images from the official Kali download page. Kali recommends the latest point-release image for most users. Weekly images contain newer packages and can reduce the number of updates needed after installation, but they are automated and do not receive the same quality checks as standard point-release images.

Existing rolling users should first confirm that /etc/apt/sources.list.d/kali.sources points to the official kali-rolling repository with the main, contrib, non-free, and non-free-firmware components. They can then run sudo apt update followed by sudo apt full-upgrade -y. If the system marks a reboot as required, users should restart before checking the result.

The installed release can be checked with grep VERSION /etc/os-release, which should show 2026.3. The active kernel can be checked with uname -r, with the AMD64 release example showing 7.1.5+kali-amd64. The exact kernel string can differ by architecture.

Kali’s update guidance recommends checking for updates every few days or weeks, or sooner when a required tool or security fix is released. It also advises testing all needed tools before a planned security engagement and avoiding updates during active work because a rolling package change can sometimes break a tool at the wrong time

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Linux Kernel 7.1 appeared first on Cyber Security News.

The Australian App Store ruling orders Apple to allow sideloading and outside payments by March 1, 2027. Apple will appeal.

Related Posts:

• iOS 27.1 iPhone Duo Release Targets Foldable Hardware
• OpenAI Cuts Internet Access for Frontier Model Training
• Google Privacy Policy Change Raises Gmail Ad Concerns

The post Australian Court Forces Apple to Open the App Store appeared first on Daily CyberSecurity.

ClearSky exposed the Russian Doppelganger campaign in Israel using 76 fake Walla articles, 66 redirect domains, and AI poisoning ahead of elections.

Related Posts:

• DOJ Extradites Suspect in $36.9M Cambodia Crypto Scam Targeting Americans
• Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials
• Storm-0940 Uses ARTEX AI Agent to Probe IT and Software Vendors for Supply Chain Access

The post Doppelganger Campaign Targets Israel Elections With Fake News and AI Poisoning appeared first on Daily CyberSecurity.