Over Security

A Chrome extension named "QuickLens - Search Screen with Google Lens" has been removed from the Chrome Web Store after it was compromised to push malware and attempt to steal crypto from thousands of users.

South Korea's National Tax Service accidentally exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release, allowing hackers to steal 6.4 billion won ($4.8M) worth in cryptocurrency.

In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world's largest and most disruptive botnet. Since then, the person in control of Kimwolf -- who goes by the handle…

Microsoft is rolling out new Windows 11 Insider Preview builds that improve security and performance during batch file or CMD script execution.

Il ransomware continua a evolvere come una delle minacce più pervasive per organizzazioni pubbliche e private e i dati emersi dal Crypto Crime Report 2026 di Chainalysis fotografano un fenomeno apparentemente contraddittorio. Nel 2025 i pagamenti legati al ransomware sono diminuiti per il secondo anno consecutivo, ma allo stesso tempo il numero di attacchi e …

North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance.

A yearlong Europol-coordinated operation dubbed "Project Compass" has led to 30 arrests and 179 suspects being tied to "The Com," an online cybercrime collective that targets children and teenagers.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released new details about RESURGE, a malicious implant used in zero-day attacks exploiting CVE-2025-0282 to breach Ivanti Connect Secure devices.

Everyday tools like PDF readers, email clients, and archive utilities quietly define the real attack surface. Action1 explains how third-party software drift increases exploit risk and why consistent patching reduces exposure across endpoints.

Nel report dell'EDPB sul diritto alla cancellazione viene svolta una ricognizione del diritto all'oblio e della sua effettiva attuazione, ma probabilmente bisogna estendere il ragionamento tenendo conto della complessità di Internet

Secondo l'Osservatorio Cybersecurity & Data Protection del Politecnico di Milano, i cyber attacchi sono sempre più mirati e sofisticati nell'era di GenAI ed Agentic AI. Ma per fronteggiare questo scenario, secondo gli esperti, occorre semplificare. Ecco come

What matters to defenders (TL;DR) The PoC modifies ACLs to add Deny ACEs against kernel32.dll for targeted service identities. We did observe Windows Security Event IDs 4670 (high fidelity) and 4663 (lower fidelity) as useful pivots for detection. With administrator privileges, the tool changes the Access Control List (ACL) on kernel32.dll to introduce Deny entries for specific service identities. Quick refresher: ACLs, ACEs, and Deny entries An ACL is made up of Access Control Entries (ACEs) that Allow or Deny a user/group/process access to an object (file, registry key, etc.). A Deny ACE is powerful, especially when applied to a foundational library and aimed at a service identity, because it can override otherwise valid permissions. The key is filtering to: Object: kernel32.dll Change type: introduction of Deny ACEs Subject: service SIDs (commonly under S-1-5-80-* ) The annoying part: 4670 gives service SIDs, not service names Event 4670 includes the SID of the affected service identity rather than a friendly service name. However, for Windows services, the SID can be derived deterministically: Take the uppercase service name Encode as UTF-16 (little endian) Compute SHA1 Reformat bytes into the Service SID structure If you know the targeted services (as you do for the PoC defaults), you can precompute the mapping and hunt for those service SIDs directly or generate them on the fly inside KQL. Parsing SDDL to identify Deny ACEs The ACL data in 4670 is represented using SDDL (Security Descriptor Definition Language). Deny entries are uncommon generally, and extremely rare for kernel32.dll , making false positives unlikely in most environments Event 4670 includes both OldSd and NewSd, allowing “diff-like” analysis.

The Cyber Express weekly roundup for this week shares new cybersecurity news, AI vulnerabilities, space security updates, and global regulatory developments.

A Ukrainian man has pleaded guilty to operating OnlyFake, an AI-powered website that generated and sold more than 10,000 photos of fake identification documents to customers worldwide.

iPhone and iPad running iOS 26 can now handle "restricted" NATO information.

Here’s how Ireland’s National Cyber Security Bill and the NIS2 Directive make management boards accountable for cybersecurity and compliance.

In the context of government cyber security, even small misconfigurations can have widespread consequences.

Il GDPR, nel suo significato più profondo, è un’infrastruttura di governo che orienta linguaggio, responsabilità e scelte strategiche. Ecco esempi concreti, dalle decisioni automatizzate alla profilazione, dalla gestione dei diritti alle crisi, ricostruendo il passaggio dalla compliance alla fiducia operativa

L’introduzione di funzionalità di intelligenza artificiale generativa nelle piattaforme cloud sta ridefinendo il perimetro di sicurezza delle credenziali applicative. Un caso emblematico è stato scoperto dai ricercatori di Truffle Security Co. e riguarda l’ecosistema Google Cloud dove le tradizionali API key — storicamente considerate semplici identificatori di progetto — hanno acquisito nuovi privilegi con l’arrivo …

The framework positions space cyber security as a continuous process rather than a one-time compliance exercise.

The OpenClaw vulnerability lets malicious sites hijack open-source AI agents via a localhost WebSocket flaw and brute force attack.

In February 2026, the Dutch telco Odido was the victim of a data breach and subsequent extortion attempt. Following the incident, 1M records containing 317k unique email addresses was published publicly, with a threat by the attackers to continue leaking more data in the following days. The data also included names, physical addresses, phone numbers, bank account numbers and notes about customers left by service operators. Odido has published a disclosure notice detailing the extent of the incident, providing an FAQ and advising the incident also impacted dates of birth, passport and drivers licence numbers.

Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data.