Agregátor RSS

Anthropic čelí podezření ze zneužití nepublikovaných dat k vědeckému objevu • Biolog Mestre vkládal do modelu Claude své podklady k výzkumu enzymů • Případ vyvolal mezi vědci obavy ze sdílení citlivých akademických dat

Pat Gelsinger, bývalý šéf Intelu, ostře zkritizoval technologii HBM, standard nejrychlejších DRAM pamětí. Jen nevysvětlil, proč Intel pod jeho vedením opustil ostatní alternativy a právě k HBM přešel…

The majority of Linux breaches don't begin at root.

Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages.

Working with international authorities and several tech and cybersecurity companies in a nearly year-long investigation, Redmond identified and took down Yam Store, a coordinated underground network dealing in commercial phishing-as-a-service (PhaaS).

The network allowed cybercriminals to readily purchase, and very quickly deploy, pre-made kits they could use in phishing attacks to steal data and credentials.

Microsoft said the takedown began as a simple investigation based on a tip from Japanese authorities.

“Working together, and with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them,” Steven Masada, associate general counsel and GM for Microsoft’s Digital Crimes Unit, wrote in a blog post. “What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”

The evolving PhaaS marketplace

Collectively, YAM Store and the kits and tools sold within it enabled the sending of more than 1 billion messages to 75,000-plus organizations worldwide. More than 750 million of those were sent to Microsoft customers alone, and ultimately generated “tens of millions of dollars” for criminal operators. 

Investigation into the marketplace began in late 2025 after Japan’s National Police Agency (NPA) notified Microsoft of “a wave of fraud and scam activity” targeting people and businesses in Japan. Researchers expected to find multiple individual campaigns; instead, they discovered a “sprawling Chinese-language cybercrime marketplace.” The probe expanded globally and involved the efforts of several other law enforcement agencies, as well as companies like Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

The YAM Store served as an initial access broker (IAB), operating much like an online marketplace; in this case, the merchandise was fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams like credential and data theft. Customers could browse, compare prices, and make purchases. Available tools were arranged based on age and subscription and environment types (like .edu or .org sites).

In some cases, criminal operators were able to register internet domains that legitimate organizations had allowed to expire, then rebuilt them to appear active. They targeted specific sectors (like non-profits or education) to fraudulently obtain Microsoft 365 accounts to later sell through the YAM store.

The researchers discovered that the YAM Store evolved as different kits became available, and identified three popular PhaaS kits: Iron Man System, CoGUI, and Haozi.

The newer Iron Man system came to the fore in mid-2026. It provided pre-built lure pages capturing any victim-submitted data. The lure sites impersonated healthcare providers, police departments, government agencies, postal and courier services, toll and transportation authorities, tax agencies, banks, telecoms, and retailers. Through test purchases and intelligence work, investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.

Iron Man effectively expanded the PhaaS model by giving criminals access to thousands of ready-made templates tailored to specific industries, languages, and regions. Masada noted that many “used the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”

The kits were also equipped with advanced evasion techniques such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations.

Masada emphasized that, while an organization or government entity may have been presented among the template offerings, it does not indicate that its systems were compromised.

However, members of the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit wrote in a blog post, “the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses.”

The importance of cyber hygiene

In nearly all observed cases, phishing lures presented “prescriptive scam red flags,” Microsoft researchers explained: Urgency and time-sensitive tasks.

They advised that users have a basic understanding of common phishing techniques and should be educated to always verify with the purported sender before clicking a link supposedly taking them to a login page, even when the task involves signing in to a known, secure account.

Beyond this, they said, sign-in prompts should clearly identify the application being authenticated to. In Microsoft Azure interactions since 2021, for example, users are prompted to “cancel” or “continue” at login, but this is often missing from phishing sign-ins, the researchers noted.

Hardening credentials and cloud identities is also necessary to defend against phishing attacks; the researchers suggested an initial step of passwordless tools like passkeys and multifactor authentication (MFA) across organizations.

“Invoke the principles of least privilege and zero trust to significantly slow down threat actors who might have been able to gain initial access and buy time for defenders to respond,” the researchers noted. These steps can help lock down global administrator roles in particular.

They also advised additional actions including the use of the Microsoft Authenticator app for passkeys and MFA; configuration of the Microsoft Defender for Office 365 Safe Links policy to apply to internal recipients; complementing MFA with conditional access policies; and only allowing MFA and passkey registrations from trusted locations and devices.

This article originally appeared on CSOonline.

Microsoft Defender nově podporuje linuxové desktopy.

Say a developer queues a build on a shared Linux host.

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

Let's Encrypt switched its staging service to 64-day certificates on October 14, 2026.

Hypotéka na novostavbu domu může znamenat splátku přes 67 tisíc korun měsíčně, u běžného bytu vychází zhruba na 20 tisíc. Spočítali jsme, jak vysoký příjem potřebujete, kolik vám po splátce zbude a co s rodinným rozpočtem udělá růst úrokových sazeb.

Když vás dlužník úmyslně uvede v omyl a vy kvůli tomu své peníze nevymáháte, promlčecí lhůta se může zastavit. Nejvyšší soud také vysvětlil, proč věřitel nemusí sám odhalit dlužníkovu lest. Spor se týkal 2,75 milionu korun.

Nintendo Switch 2 není jen silnější hardware, ale hlavně dospělejší software. Rychlejší systém, svižné menu, GameChat, chytřejší mobilní aplikace, rozumné cloudové volby a zpětná kompatibilita.

A developer clones a repository, changes into it, and opens Zellij.

Nejnovějším BASICem navrženým a implementovaným pro domácí osmibitové mikropočítače Atari je Fast BASIC. Jedná se o projekt, který je v mnoha ohledech odlišný od klasických BASICů.

Společnost HP vydala EliteBoard G2a, kompletní PC řešení integrované v klávesnici. Velkým překvapením je cena, která je rovněž velká. Začíná na zhruba $3000 a podle modelu pokračuje přes $4000 výš…

Zákrok zubaře obvykle začíná slovy: „Otevřete ústa.“ V některých případech je ale třeba sáhnout pro zub někam úplně jinam než do ústní dutiny.

Nobelovu cenu za fyziku v roce 2026 dostal Francis Halzen. Jde o další z řady Nobelových cen spojených s výzkumem neutrin. Tentokrát jde o detekci těch nejenergetičtějších, které vznikají ve velmi vzdáleném vesmíru v procesech, kde se uvolňuje extrémní množství energie. Pro jejich detekci je potřeba extrémně velké detektory, jako je IceCube v ledu Antarktidy.

Americká společnost BAE Systems vyvíjí mikrovlnnou zbraň, která má chránit vojenské základny a vojáky před masovými útoky dronů. Používá elektromagnetické mikrovlnné impulzy schopné vyřadit elektroniku dronů. Stane se z ní řešení problému obránců, kteří často plýtvají nezřízeně drahé protiletadlové střely na likvidaci relativně levných cílů?

Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.” The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system - simply by sending a malicious email. In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue. “We are aware of active exploitation of this vulnerability,” the spokesperson said, but declined to answer our questions about how many appliances had been compromised, and what attackers were doing with this access after exploiting the bug. “We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory,” the spokesperson said. The flaw exists in SEG’s Advanced Malware Protection (AMP) feature, and it’s due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance. This vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met: The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525. Cisco's Wednesday advisory includes steps organizations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed - so give that a read if you are unsure. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds. The vendor recommends any customers who are running Cisco AsyncOS Software releases earlier than v 16.5 migrate to 16.5.0-780. In its alert, Cisco said it became aware of active exploitation in October. This is the second such zero-day in SEG in as many months. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access. In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.®

Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybersecurity would have prevented it.

French authorities say the systems, made up of entire fleets of refrigerators and freezers throughout a store, were hacked. More specifically, Internet-connected controllers that allow technicians to remotely administer the store-wide systems were compromised. The unknown attackers responsible then activated defrosters long enough for the fridges to reach temperatures as high as 50° Celsius (122° Fahrenheit). By the time the mass compromise was discovered, food was spoiled, and in some cases their electrical systems caught fire.

The hacks that didn't have to happen

Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident—sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US—contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators. Until recently, Danfoss controllers, for instance, used a credential that changes each day. The password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn’t received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores.

Read full article

Comments

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]