Resultados

2 casos · pág. 1/1

hacktron.ai · há 1d high

Hacktron chains forums.openai.com postMessage XSS with exposed Mojo IPC in OpenAI ChatGPT Atlas to steal OAuth tokens

Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all .chatgpt.com and .openai.com origins, so a single XS…

technology

cisa.gov · há 1d high

CISA advisory links Flax Typhoon-style actors to Integrity Tech, detailing XSS, SoftEther persistence and mass email theft in Southeast Asia

A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…

Flax Typhoon Ethereal Panda government law enforcement