Catalin Cimpanu

Russian authorities have arrested a student from the city of Krasnodar for developing the ClayRAT Android spyware

https://rt-solar.ru/solar-4rays/blog/6472/

NetAskari believes a recent hack and leak from China's National Super Computer Center of China (NSCC) might be real

https://netaskari.substack.com/p/chinas-massive-data-leak-of-military

The Tycoon2FA phishing service has restored its server infrastructure after a law enforcement takedown at the start of the month.

Phishing activity is now at pre-takedown levels, according to CrowdStrike telemetry

https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/

A vulnerability in a Linux enterprise app can allow attackers root access over devices

The issue impacts Himmelblau, an interoperability suite to integrate Linux with Entra ID and Intune networks.

https://www.akamai.com/blog/security-research/2026/mar/cve-2026-31979-symlink-root-privilege-escalation-himmelblau

Internet's outage has now reached 3 weeks, is state-mandated and not a result of the strikes, per new reports

https://www.kentik.com/blog/internet-and-airstrikes-tracking-irans-extended-communication-blackout/

https://krypt3ia.wordpress.com/2026/03/16/intelligence-assessment-report/

PDF: https://insights.nccgroup.com/l/898251/2026-03-19/31myn1q/898251/1773936226AmWpHs8F/Middle_East_Crisis_Cyber_Update_19_03_2026.pdf

Foster City in California has shut down all public services after a ransomware attack last week

https://www.fostercity.org/community/page/foster-city-services-impacted-cyber-security-breach

A popular open-source vulnerability scanner (Trivy) was compromised last week in a supply chain attack

https://www.aquasec.com/blog/autonomous-runtime-security-turning-runtime-intelligence-into-agentic-response-2/

https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise

https://github.com/aquasecurity/trivy/discussions/10425

https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise

https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release

https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack

https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/

I went down a rabbit hole for Monday's newsletter and I'm still falling

Why does there have to be so much malware on GitHub... lol

RE: @Techmeme@techhub.social

Google search results are now more dangerous than torrent sites

Android will require a 24-hour wait before sideloading apps

https://android-developers.googleblog.com/2026/03/android-developer-verification.html

LOL... did they ever?

https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/4chan-fined-450000-for-not-protecting-children-from-online-pornography

Oracle issues an out-of-band security update for a pre-auth RCE in Oracle Identity Manager

https://www.oracle.com/security-alerts/alert-cve-2026-21992.html

-AWS kills bucketsquatting
-Second iOS hacking framework found in the wild
-Belgium launches its own secure app
-Cyberattack cripples car breathalyzers in the US
-1/5 suspended Telegram channels are cybercrime related
-Fake security firm linked to crypto-heists
-Venus Protocol hacked for $3.6m
-Bitrefill blames North Korea for hack
-Japan active cyber defense to begin in Oct
-Congress seeks private comms of EU officials

Podcast: https://risky.biz/RBNEWS540/
Newsletter: https://news.risky.biz/risky-bulletin-aws-kills-bucketsquatting/

Belgium police are offering a free database of phishing sites that telcos can implement and block malicious sites before users can access them.

The project is called Phish Nemo.

https://www.politie.be/5998/nl/nieuws/nieuw-overheidsprotocol-moet-belgische-internetgebruikers-beter-beschermen-tegen

Someone finally hacked the Xbox One (with voltage glitching)

https://www.tomshardware.com/video-games/console-gaming/microsofts-unhackable-xbox-one-has-been-hacked-by-bliss-the-2013-console-finally-fell-to-voltage-glitching-allowing-the-loading-of-unsigned-code-at-every-level

https://www.youtube.com/watch?v=FTFn4UZsA5U

There is gonna be an entire cottage industry of hellish "age verification" providers that will collect and then sell all their customers data without any kind of consent

...just like this one:

https://ppc.land/spain-fines-yoti-eu950-000-over-biometric-data-and-consent-failures/

Digg shuts down due to bot and AI spam

https://digg.com/

Major breach in Sweden, where a hacker claims to have stolen PII data and electronic signage documents from Sweden's e-government portal

They leaked the portal's source code to prove the breach

The IT contractor confirmed a breach too

https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-information-har-lagts-ut-pa-darknet

Office EU, an European company, has launched Office.eu, an EU-based alternative to Microsoft Office and Google Workspace, built on open-source technology and running on European server infrastructure.

https://office.eu/media/pressrelease-20260304

"End-to-end encrypted messaging on Instagram will no longer be supported after May 8, 2026." :hurb:

https://help.instagram.com/491565145294150

he European Parliament failed to secure enough votes to pass Chat Control so it extended a provision that grants tech platforms an exemption from EU data privacy rules if they run voluntary scans of users' DMs for CSAM and other illegal material

https://www.heise.de/en/news/Voluntary-Chat-Control-EU-Parliament-for-extension-with-restrictions-11207810.html

A Linux clipboard hijacker.... is this the first one?

I don't remember seeing anything like this before

https://hivepro.com/threat-advisory/clipxdaemon-clipboard-attack-linux-malware-targeting-crypto-payments/

Oh look... ChatGPT sniffing Russian disinformation up its nose 700 times in 5 days

Exactly what researchers have warned about for more than a year but have been told to take a hike

https://buttondown.com/readwrite/archive/edition-11-one-mistake-ties-together-more-than/

AI is powering a new US robber baron era

https://futurism.com/future-society/jeff-bezos-buy-companies-ai

RE: @fedizen@mastodon.social

You should hate Google with the energy of 1000 burning suns for attempting to kill ad blockers in Chrome

There's an Android zero-day getting patched this month:

https://source.android.com/docs/security/bulletin/2026/2026-03-01

"A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 5 targets"

👀👀👀👀👀

https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation

Apple and Google are testing sending encrypted RCS messages between each other's devices

https://9to5google.com/2026/02/23/google-messages-encrypted-rcs-iphone/

Meta's new Threads micro-blogging platform and Twitter rival has been flooded with pro-PRC propaganda bots, according to a new report

https://www.newsguardrealitycheck.com/p/automated-pro-china-bots-swarm-metas

A security firm has gained access to a malvertising test platform and used the information to help ad companies block more than 59 million malicious ads last year

https://blog.confiant.com/p/disrupting-59m-malicious-impressions

More than 723,000 projects use cryptographic libraries (aes-js and pyaes) with insecure defaults.

According to Trail of Bits, the issue has been known to the developers since 2022 but was never fixed.

https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/

Gen Digital's Avast has released Sage, an EDR-like toolkit for AI agents, aka an ADR, an agent detection & response

https://github.com/avast/sage

As part of its internet crackdown, it appears that Russia's internet watchdog accidentally blocked the official website of the Linux kernel.

The block has been lifted after Russian IT engineers reminded Roskomnadzor that the country's native OS also runs on Linux

https://kod.ru/linux-rus-fail

Software engineer Brandon Li has released yt-media-storage, a tool to store files on YouTube by encoding them as lossless video files and then retrieving them when needed. This sounds like a perfect way to store malware on the site, ngl

https://github.com/PulseBeat02/yt-media-storage

Western Digital has recently announced that it sold all of the year's hard-drive inventory to AI companies.

In other words, prepare for huge SSD price surges.

https://wccftech.com/western-digital-has-no-more-hdd-capacity-left-out/

A security researcher has discovered 287 Chrome extensions that exfiltrate a user's browsing history.

The extensions have been installed more than 37 million times.

They range from ad blockers to AI assistants and office aids.

https://qcontinuum.substack.com/p/spying-chrome-extensions-287-extensions-495