Daily March 2026

daily@lists.cert.at

1 participants
22 discussions

Tageszusammenfassung - 03.03.2026
by Daily end-of-shift report 03 Mar '26

03 Mar '26

===================== = End-of-Day report = ===================== Timeframe: Montag 02-03-2026 18:00 − Dienstag 03-03-2026 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ LLMs can unmask pseudonymous users at scale with surprising accuracy ∗∗∗ --------------------------------------------- Pseudonymity has never been perfect for preserving privacy. Soon it may be pointless. --------------------------------------------- https://arstechnica.com/security/2026/03/llms-can-unmask-pseudonymous-users… ∗∗∗ Fake Google Security site uses PWA app to steal credentials, MFA codes ∗∗∗ --------------------------------------------- A phishing campaign is using a fake Google Account security page to deliver a web-based app capable of stealing one-time passcodes, harvesting cryptocurrency wallet addresses, and proxying attacker traffic through victims browsers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-google-security-site-us… ∗∗∗ Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets ∗∗∗ --------------------------------------------- Microsoft on Monday warned of phishing campaigns that employ phishing emails and OAuth URL redirection mechanisms to bypass conventional phishing defenses implemented in email and browsers. The activity, the company said, targets government and public-sector organizations with the end goal of redirecting victims to attacker-controlled infrastructure without stealing their tokens. --------------------------------------------- https://thehackernews.com/2026/03/microsoft-warns-oauth-redirect-abuse.html ∗∗∗ Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries ∗∗∗ --------------------------------------------- The threat actor behind the recently disclosed artificial intelligence (AI)-assisted campaign targeting Fortinet FortiGate appliances leveraged an open-source, AI-native security testing platform called CyberStrikeAI to execute the attacks. --------------------------------------------- https://thehackernews.com/2026/03/open-source-cyberstrikeai-deployed-in.html ∗∗∗ Until last month, attackers couldve stolen info from Perplexity Comet users just by sending a calendar invite ∗∗∗ --------------------------------------------- AI browsing agent left local files open for the taking If you wanted to steal local files from someone using Perplexitys Comet browser, until last month you could just schedule the theft by sending your victim a calendar event. --------------------------------------------- https://www.theregister.com/2026/03/03/perplexity_comet_browser_hole_cal_in… ∗∗∗ Breaking Out of Citrix and other Restricted Desktop Environments ∗∗∗ --------------------------------------------- Many organisations are turning to virtualisation of apps and desktops. This often involves virtualisation platforms such as Citrix to deliver these services. Get your configuration or lock-down wrong and you’ll find users ‘breaking out’ of the environment you thought you had secured. --------------------------------------------- https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-ot… ∗∗∗ Fake-Hotelwebsite als Basis für Kombi-Betrugsmasche ∗∗∗ --------------------------------------------- Über den gefälschten Online-Auftritt eines Hotels versuchen Kriminelle an die Kontaktdaten und (vermutlich) das Geld ihrer Opfer zu gelangen. Zusätzlich nutzen sie die Domain der Fake-Seite für den Versand von Phishing-Mails. --------------------------------------------- https://www.watchlist-internet.at/news/fake-hotelwebsite-kombi-betrugsmasch… ∗∗∗ Anonymous credentials: an illustrated primer ∗∗∗ --------------------------------------------- This post has been on my back burner for well over a year. This has bothered me, because every month that goes by I become more convinced that anonymous authentication the most important topic we could be talking about as cryptographers. This is because I’m very worried that we’re headed into a bit of a privacy dystopia, driven largely by bad legislation and the proliferation of AI. --------------------------------------------- https://blog.cryptographyengineering.com/2026/03/02/anonymous-credentials-a… ∗∗∗ Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran ∗∗∗ --------------------------------------------- Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime. We include recommendations for defenders. --------------------------------------------- https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ ∗∗∗ Silver Dragon: China Nexus Cyber Espionage Group Targeting Governments in Asia and Europe ∗∗∗ --------------------------------------------- Silver Dragon is a China nexus cyber espionage group targeting government ministries and public sector organizations across Southeast Asia, with additional victims identified in Europe. The group gains initial access through exploitation of public-facing servers and targeted phishing campaigns aimed at government entities. --------------------------------------------- https://blog.checkpoint.com/research/silver-dragon-china-nexus-cyber-espion… ∗∗∗ Hackers Abuse .arpa Top-Level Domain to Host Phishing Scams ∗∗∗ --------------------------------------------- Hackers abuse the .arpa Top-Level Domain to host phishing scams, using IPv6 tunnels, reverse DNS tricks, and shadow domains to bypass security checks. --------------------------------------------- https://hackread.com/hackers-arpa-top-level-domain-phishing-scams/ ∗∗∗ Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit ∗∗∗ --------------------------------------------- Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-io… ∗∗∗ Analysis of an Integrated Phishing Campaign Utilizing Google Cloud Infrastructure ∗∗∗ --------------------------------------------- In recent weeks, a highly organized phishing campaign has surfaced, characterized by its use of legitimate Google infrastructure to bypass standard security filters. I have identified more than 25 distinct phishing emails targeting a single account, all of which ultimately direct users to a specific URL: hxxps://storage[.]googleapis[.]com/whilewait/comessuccess.html. --------------------------------------------- https://malwr-analysis.com/2026/03/03/analysis-of-an-integrated-phishing-ca… ∗∗∗ Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE) ∗∗∗ --------------------------------------------- On today’s ‘good news disguised as other things’ segment, we’re turning our gaze to CVE-2026-21902 - a recently disclosed “Incorrect Permission Assignment for Critical Resource” vulnerability affecting Juniper’s Junos OS Evolved platform. This vulnerability affects only Juniper’s PTX Series of devices, apparently. --------------------------------------------- https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-… ===================== = Vulnerabilities = ===================== ∗∗∗ Gefährliche Sicherheitslücke: Angriffe auf Android-Nutzer beobachtet ∗∗∗ --------------------------------------------- Eine gefährliche Sicherheitslücke in einer Grafikkomponente von Qualcomm wird aktiv ausgenutzt. Android-Nutzer sollten so bald wie möglich updaten. --------------------------------------------- https://www.golem.de/news/gefaehrliche-sicherheitsluecke-angriffe-auf-andro… ∗∗∗ HPE AutoPass License Server erlaubt Umgehung der Authentifizierung ∗∗∗ --------------------------------------------- HPE warnt vor einer gravierenden Sicherheitslücke im HPE AutoPass Lizenzserver (APLS). Die Authentifizierung lässt sich umgehen. --------------------------------------------- https://www.heise.de/news/HPE-AutoPass-License-Server-erlaubt-Umgehung-der-… ∗∗∗ HCL BigFix: Angreifer können auf Daten im Dateisystem zugreifen ∗∗∗ --------------------------------------------- Die Endpoint-Management-Plattform HCL BigFix ist verwundbar. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://www.heise.de/news/HCL-BigFix-Angreifer-koennen-auf-Daten-im-Dateisy… ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1061043/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 02.03.2026
by Daily end-of-shift report 02 Mar '26

02 Mar '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-02-2026 18:00 − Montag 02-03-2026 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Microsoft testing Windows 11 batch file security improvements ∗∗∗ --------------------------------------------- Microsoft is rolling out new Windows 11 Insider Preview builds that improve security and performance during batch file or CMD script execution. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-testing-windows-1… ∗∗∗ QuickLens Chrome extension steals crypto, shows ClickFix attack ∗∗∗ --------------------------------------------- A Chrome extension named "QuickLens - Search Screen with Google Lens" has been removed from the Chrome Web Store after it was compromised to push malware and attempt to steal crypto from thousands of users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/quicklens-chrome-extension-s… ∗∗∗ UK warns of Iranian cyberattack risks amid Middle-East conflict ∗∗∗ --------------------------------------------- The United Kingdoms National Cyber Security Centre (NCSC) alerted British organizations to a heightened risk of Iranian cyberattacks amid the ongoing conflict in the Middle East. --------------------------------------------- https://www.bleepingcomputer.com/news/security/uk-warns-of-iranian-cyberatt… ∗∗∗ A fake FileZilla site hosts a malicious download ∗∗∗ --------------------------------------------- A tampered copy of FileZilla quietly contacts attacker-controlled servers using encrypted DNS traffic that can slip past traditional monitoring. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intel/2026/03/a-fake-filezilla-sit… ∗∗∗ FinanzOnline-Phishing: Kriminelle drohen mit Hausratpfändung ∗∗∗ --------------------------------------------- Oh Schreck: Eine Pfändung des Hausrats droht, weil ein offener Betrag trotz mehrerer Mahnungen nicht bezahlt worden sein soll. Genau das behauptet derzeit eine E-Mail, die angeblich von FinanzOnline stammt. Tatsächlich handelt es sich dabei aber nicht um eine echte Zahlungsaufforderung. --------------------------------------------- https://www.watchlist-internet.at/news/finanzonline-phishing-hausratpfaendu… ∗∗∗ Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel ∗∗∗ --------------------------------------------- A high-severity CVE-2026-0628 in Chromes Gemini allowed local file access and privacy invasion. Google quickly patched the flaw. --------------------------------------------- https://unit42.paloaltonetworks.com/gemini-live-in-chrome-hijacking/ ∗∗∗ Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure ∗∗∗ --------------------------------------------- 84,000+ scanning sessions targeting SonicWall SonicOS infrastructure in four days. GreyNoise details a coordinated reconnaissance campaign using rotating proxy infrastructure. --------------------------------------------- https://www.greynoise.io/blog/active-reconnaissance-campaign-targets-sonicw… ∗∗∗ Cultivating a robust and efficient quantum-safe HTTPS ∗∗∗ --------------------------------------------- Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). --------------------------------------------- https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.ht… ∗∗∗ Stop Putting Secrets in .env Files ∗∗∗ --------------------------------------------- [..] Why do we still store credentials in plaintext .env files? --------------------------------------------- https://jonmagic.com/posts/stop-putting-secrets-in-dotenv-files/ ∗∗∗ Fooling Gos X.509 Certificate Verification ∗∗∗ --------------------------------------------- Below are two X.509 certificates. The first is the Certificate Authority (CA) root certificate, and the second is a leaf certifcate signed by the private key of the CA. --------------------------------------------- https://danielmangum.com/posts/fooling-go-x509-certificate-verification/ ∗∗∗ Agents attacking agents: AI-powered bot exploiting GitHub Actions ∗∗∗ --------------------------------------------- A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in multiple targets. The attacker, an autonomous bot called hackerbot-claw, used 5 different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub. --------------------------------------------- https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation ===================== = Vulnerabilities = ===================== ∗∗∗ Checkmk: Hochriskante Cross-Site-Scripting-Lücke in Netzwerk-Monitor-Software ∗∗∗ --------------------------------------------- Die Entwickler haben aktualisierte Checkmk-Versionen herausgegeben. Sie schließen eine mindestens hochriskante Cross-Site-Scripting-Lücke. --------------------------------------------- https://www.heise.de/news/Checkmk-Hochriskante-Cross-Site-Scripting-Luecke-… ∗∗∗ Unauthorized AI Agent Execution Code Published to OpenVSX in Aqua Trivy VS Code Extension ∗∗∗ --------------------------------------------- On February 27 and 28, 2026, versions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension were published to the OpenVSX registry under the aquasecurityofficial.trivy-vulnerability-scanner namespace. Socket identified suspicious behavior in these versions shortly after publication and began investigating the releases. --------------------------------------------- https://socket.dev/blog/unauthorized-ai-agent-execution-code-published-to-o… ∗∗∗ LWN Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1060911/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily March 2026