4 casos · pág. 1/1
Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all .chatgpt.com and .openai.com origins, so a single XS…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korean organizations. It follows Operation SyncHole and is placed within the broader Cascade Hole activity. The earliest evidence dates to July 2025 (securelist.com, bleepingcomputer.com), and Kaspersky identified at least three victims in the sof…
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…
The Citizen Lab disclosed AdFection on 15 October 2026. It calls this the first public technical confirmation of zero-click mercenary spyware delivered to real devices through targeted online advertising. The Israeli ad firm Discover-Tech (spelled Discovere-Tech by bleepingcomputer.com) posed as a legitimate ad company while acting as a b…
