Security Affairs newsletter Round 591 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 CountriesMalware Hijacks Android Car Head UnitsCritical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command ExecutionU.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalogYour Shredded Visa Card May Still Work at the CheckoutSix Maximum-Severity Flaws Found in Cisco ProductsFake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage TacticsGitLab Warns of Active Exploitation of Critical GraphQL FlawPoland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite FlawU.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalogCl0p Targets 40+ Organizations Through PTC Windchill FlawManic: The Android Malware That Exfiltrates Data Even When the Phone Is OfflineNSA, CISA, FBI, DOE, and EPA Warn of Active AI-Assisted Attacks on Siemens S7 PLCsU.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalogUS Indicts 17 Iranians Over Years-Long Cyber Espionage CampaignStopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal NetworkInside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua CamerasMicrosoft Tracks MacSync Stealer by Its Behavior, Not Its Domains50,000 Stripe Secrets Leaked in Public CodeU.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalogHackers Expose Data of 1.2 Million Heights Finance CustomersProject noRecognition: Teaching AI to Fool Surveillance CamerasGitLab Patches Critical Unauthenticated GraphQL VulnerabilityU.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalogNew Mirai-Based Evooo1Bot Botnet Targets Linux DevicesSafePal Says 39,798 Customers Hit by Data BreachLiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most AffectedInvisible AI Prompts Trigger Court SanctionsMcDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records StolenAkira Ransomware Uses Safe Mode to Bypass EDRDDoS Attacks Cause Major Threema OutagesMustang Panda Upgrades CoolClient With a Kernel RootkitSophisticated Cyberattack Exposes Data of 678,000 French TaxpayersAPT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2

International Press – Newsletter

Cybercrime

McDonald’s employee data listed for sale in wider Entra campaign

$7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret

Live Stripe keys for 659 merchants, published for free

Clop Returns with Custom Implant in Mass-Extortion Campaign  <br>Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation

Malware

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Hunting MacSync Stealer infrastructure through behavioral pivots

Manic: Blend between Banking Malware &amp; Spyware

The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile

The invisible passenger in your car

Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign

Hacking

Large-scale DDoS attacks disrupted Threema secure messaging service

The LiteLLM Supply-Chain Attack — TeamPCP “SANDCLOCK” CI/CD Credential-Harvesting Campaign via a Backdoored Trivy GitHub Action

Actively exploited vulnerability in Zimbra Collaboration Suite

AI-assisted tool helped secure satellite communication system after 2022 Russian hacking

Expired credit cards revived by researchers to make unauthorized payments

CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks

When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86)

Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories

Intelligence and Information Warfare

Operation CameraSwarm:  Over 14,000 Dahua cameras compromised across Ukraine and Russia

17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities

Defending Against an Active Threat to Siemens S7 Series PLCs

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

SilkParasite: Tracking a China-Nexus APT Across Central Asia

Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network

Cybersecurity

France probes unprecedented cyberattack after tax data of 678,000 users stolen

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them

SafePal Unauthorized Access To A Subset Of Customer Order Information

This ‘adversarial’ pattern can prevent surveillance cameras from detecting you

France’s cybersecurity problem demands strong political will

The Powerful Chinese AI Model Experts Warned About—and Waited for—Is Here

OpenAI president says companies should do 10 things ASAP to defend against AI cyber threats

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)