TECHZONE™

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23 https://thehackernews.com/2026/03/critical-telnetd-flaw-cve-2026-32746.html Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set

AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE https://thehackernews.com/2026/03/ai-flaws-in-amazon-bedrock-langsmith.html Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries. In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter's sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader https://thehackernews.com/2026/03/leaknet-ransomware-uses-clickfix-via.html The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials

AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds https://thehackernews.com/2026/03/ai-is-everywhere-but-cisos-are-still.html A majority of security leaders are struggling to defend AI systems with tools and skills that are not fit for the challenge, according to the AI and Adversarial Testing Benchmark Report 2026 from Pentera. The report, based on a survey of 300 US CISOs and senior security leaders, examines how organizations are securing AI infrastructure and highlights critical gaps tied to skills shortages and

Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware https://thehackernews.com/2026/03/konni-deploys-endrat-through-spear.html North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim's KakaoTalk desktop application to distribute malicious payloads to certain contacts. The activity has been attributed by South Korean threat intelligence firm Genians to a hacking group referred to as Konni. "Initial access was achieved through a spear-phishing email disguised as a

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths https://thehackernews.com/2026/03/cisa-flags-actively-exploited-wing-ftp.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions

GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos https://thehackernews.com/2026/03/glassworm-attack-uses-stolen-github.html The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories. "The attack targets Python projects — including Django apps, ML research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files like setup.py, main.py, and app.py," StepSecurity said. "Anyone who runs

⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More https://thehackernews.com/2026/03/weekly-recap-chrome-0-days-router.html Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness,

Why Security Validation Is Becoming Agentic https://thehackernews.com/2026/03/why-security-validation-is-becoming.html If you run security at any reasonably complex organization, your validation stack probably looks something like this: a BAS tool in one corner. A pentest engagement, or maybe an automated pentesting product, in another. A vulnerability scanner feeding an attack surface management platform somewhere else. Each tool gives you a slice of the picture. None of them talks to each other in any

ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. "Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate the implications of running

DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage https://thehackernews.com/2026/03/drillapp-backdoor-targets-ukraine.html Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware

Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse https://thehackernews.com/2026/03/android-17-blocks-non-accessibility.html Google is testing a new security feature as part of Android Advanced Protection Mode (AAPM) that prevents certain kinds of apps from using the accessibility services API. The change, incorporated in Android 17 Beta 2, was first reported by Android Authority last week. AAPM was introduced by Google in Android 16, released last year. When enabled, it causes the device to enter a heightened

OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration https://thehackernews.com/2026/03/openclaw-ai-agent-flaws-could-enable.html China's National Computer Network Emergency Response Technical Team (CNCERT) has issued a warning about the security stemming from the use of OpenClaw (formerly Clawdbot and Moltbot), an open-source and self-hosted autonomous artificial intelligence (AI) agent. In a post shared on WeChat, CNCERT noted that the platform's "inherently weak default security configurations," coupled with its

GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry. "Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing extensionPack and extensionDependencies to turn initially standalone-looking extensions into transitive

Face value: What it takes to fool facial recognition https://www.welivesecurity.com/en/privacy/face-value-what-takes-fool-facial-recognition/ ESET’s Jake Moore used smart glasses, deepfakes and face swaps to ‘hack’ widely-used facial recognition systems – and he'll demo it all at RSAC 2026

Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware https://thehackernews.com/2026/03/chinese-hackers-target-southeast-asian.html A suspected China-based cyber espionage operation has targeted Southeast Asian military organizations as part of a state-sponsored campaign that dates back to at least 2020. Palo Alto Networks Unit 42 is tracking the threat activity under the moniker CL-STA-1087, where CL refers to cluster, and STA stands for state-backed motivation. "The activity demonstrated strategic operational patience and

Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 https://thehackernews.com/2026/03/meta-to-shut-down-instagram-end-to-end.html Meta has announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026. "If you have chats that are impacted by this change, you will see instructions on how you can download any media or messages you may want to keep," the social media giant said in a help document. "If you're on an older version of Instagram, you may also need to update the

INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime https://thehackernews.com/2026/03/interpol-dismantles-45000-malicious-ips.html INTERPOL on Friday announced the takedown of 45,000 malicious IP addresses and servers used in connection with phishing, malware, and ransomware campaigns, as part of the agency's ongoing efforts to dismantle criminal networks, disrupt emerging threats, and safeguard victims from scams. The effort is part of an international law enforcement operation that involved 72 countries and territories.

Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials https://thehackernews.com/2026/03/storm-2561-spreads-trojan-vpn-clients.html Microsoft has disclosed details of a credential theft campaign that employs fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning techniques. "The campaign redirects users searching for legitimate enterprise software to malicious ZIP files on attacker-controlled websites to deploy digitally signed trojans that masquerade as trusted VPN clients