TechLogHub Blog — Page 12 of 25
Insights, guides, and product strategy for builders and product teams.
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
FBI warns of Kali365, a phishing-as-a-service platform that hijacks Microsoft 365 and Entra accounts by abusing OAuth device-code authentication to steal session tokens and bypass MFA. Emerged in April 2026 and distributed via Telegram, it directs victims to a device-login portal to authorize attackers, granting acc…
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
A critical Ghost CMS SQL injection (CVE-2026-26980) is being exploited in a large-scale ClickFix campaign, impacting 700+ domains including Harvard, Oxford, Auburn, and DuckDuckGo. The flaw allows unauthenticated access to read database data and steal admin API keys, enabling attackers to inject malicious JavaScript…
Laravel Lang packages hijacked to deploy credential-stealing malware
A supply-chain attack hit Laravel Lang localization packages by hijacking GitHub tags to point to malicious commits, affecting multiple releases across laravel-lang/lang, http-statuses, attributes, and possibly actions. Attackers rewrote existing tags (not code) to a malicious fork, enabling legitimate-looking relea…
Italy Disrupts CINEMAGOAL Piracy App That Stole Streaming Auth Codes
Italian authorities dismantled the CINEMAGOAL piracy network in the nationwide operation “Tutto Chiaro,” seizing servers in France and Germany, identifying end users, and disrupting a stealth app that stole streaming authentication codes for Netflix, Disney+, Sky, DAZN, Spotify, and more. The scheme, run by a networ…
Netherlands Seizes 800 Servers Linked to Hosting Firm Behind Cyberattacks and Disinformation
Dutch authorities seized 800 servers and arrested two men tied to Stark Industries, a hosting firm accused of enabling cyberattacks, information manipulation, and disruption campaigns on behalf of sanctioned Russian and Belarusian entities. Investigators say Stark Industries operated through WorkTitans B.V. (THE.Hos…
Former US execs plead guilty to aiding tech support scammers
Two former executives of CA Cloud Attribution pleaded guilty to misprision of a felony for aiding a years-long tech support fraud that used deceptive pop-ups and remote access to steal from victims worldwide. They ran the C.A. Cloud business (2017–2022) and a Tunisia call center (2016–2022), allegedly helping frauds…
Google Exposes Unfixed Chromium Flaw That Keeps JavaScript Running in the Background
Google accidentally published details of an unfixed Chromium flaw that lets a background Service Worker keep JavaScript running after the browser is closed, enabling remote code execution on visiting devices. Reported by security researcher Lyra Rebane and known in Chromium Issue Tracker since 2022, the vulnerabilit…
Apple blocked over $11 billion in App Store fraud in six years
Apple says it blocked over $11 billion in fraudulent App Store transactions across six years, with more than $2.2 billion blocked in 2025 alone. In 2025, it rejected over 2 million problematic app submissions, blocked 1.1 billion fraudulent account creations, terminated 193,000 developer accounts, and deactivated ab…
Discord Rolls Out End-to-End Encryption for Voice and Video Calls
Discord now provides end-to-end encryption by default for all voice and video calls across platforms, covering DMs, group DMs, voice channels, and Go Live streams, with stage channels excluded. Built on the extended DAVE protocol after extensive testing, there is no opt-in required and no plans to encrypt text-based…
Microsoft testing adjustable taskbar, Start menu in Windows 11
Microsoft tests Windows 11 Insider Preview Build 26300.8493, bringing back a resizable taskbar that can be placed on any screen edge and use smaller icons, plus Start menu customization (toggle recommendations, adjust size, keep recently installed apps, and hide your name/profile). The release also introduces a fast…
Leaked Shai-Hulud malware fuels new npm infostealer campaign
Leaked Shai-Hulud malware is driving a new npm infostealer campaign, with four typosquatted packages (chalk-tempalte, @deadcode09284814/axios-util, axois-utils, color-style-utils) that exfiltrate credentials, secrets, and crypto wallet data; one also acts as a DDoS bot. Chalk-tempalte appears to be a Shai-Hulud clon…
Grafana Breach Caused by Missed Token Rotation After TanStack Attack
Grafana says a data breach occurred when a single GitHub workflow token was missed during rotation after the TanStack npm supply-chain attack tied to the Shai-Hulud campaign, allowing attackers to access private repositories. The malicious TanStack package exfiltrated tokens after Grafana’s CI/CD pulled it, and alth…
Webinar: The hidden bottlenecks in network incident response
BleepingComputer will host a live webinar on June 2, 2026, titled “From alert to resolution: Fixing the gaps in network incident response,” featuring Edgar Ortiz from Tines. The session explores how high alert volumes and manual cross-system workflows slow incident response, and how AI-assisted workflows and automat…
Microsoft confirms patching issues in restricted Windows networks
Microsoft confirms a Windows Update issue in restricted networks (air‑gapped or tightly firewalled) after January 2026 optional non‑security previews. Affected devices may download the February 2026 security update but then cannot download March and later updates, displaying error 0x80010002. The problem stems from …
Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
Tycoon2FA, a well-known phishing toolkit, has added device-code phishing to its arsenal, using Trustifi tracking URLs to hijack Microsoft 365 accounts via the OAuth device login flow. After an international police disruption in March, the operation rebuilt its infrastructure and returned to normal activity with adde…
Microsoft rejects critical Azure vulnerability report, no CVE issued
Security researcher Justin O'Leary alleges a critical privilege-escalation flaw in Azure Backup for AKS that could let a user with only the Backup Contributor role gain cluster-admin rights via the Trusted Access mechanism. Microsoft says the behavior was expected and that no product changes or CVE were issued, desp…
Russian hackers turn Kazuar backdoor into modular P2P botnet
Russian hacker group Secret Blizzard has upgraded the Kazuar backdoor into a modular, peer-to-peer botnet designed for long-term persistence, stealth, and data exfiltration. The malware now uses three modules—Kernel (leader election and task orchestration), Bridge (external C2 proxy), and Worker (keylogging, screens…
Critical Funnel Builder WordPress Plugin Bug Exploited to Steal Credit Card Data on WooCommerce Checkouts
Security researchers revealed a critical unauthenticated vulnerability in Funnel Builder for WordPress that injects malicious JavaScript into WooCommerce checkout pages, enabling theft of credit card data. The flaw affects all versions prior to 3.15.0.3 and can be triggered through an exposed checkout endpoint to mo…
Avada Builder WordPress plugin flaws allow site credential theft
Two flaws in the Avada Builder WordPress plugin (CVE-2026-4782 and CVE-2026-4798) could let attackers read arbitrary files (potentially exposing wp-config.php) and perform a time-based SQL injection, affecting roughly one million installations. Exploitation paths include authenticated subscriber access for file read…
Microsoft to automatically roll back faulty Windows drivers
Microsoft is piloting Cloud-Initiated Driver Recovery to remotely roll back faulty Windows Update drivers to a previous stable version, eliminating the need for partners or users to intervene. The recovery, managed entirely by Microsoft through Windows Update for drivers rejected during shiproom evaluation, will be …
Showing 20 of 485 articles