30
30
30
30
30
30
45
30
30
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
A ClickFix social engineering campaign compromised 31 organizations, abusing the Polygon blockchain via EtherHiding for dynamically updated command-and-control.
The campaign uses ClickFix-style social engineering to compromise victims, with 31 organizations affected. It employs EtherHiding to dynamically update its command-and-control server, abusing the Polygon blockchain as an attacker-controlled address book. This blockchain-based C2 approach makes the infrastructure more resilient and harder to take down.
60
30
30
30
30
35
30
30
30
30
ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel
Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.
Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.
66
30
30
30
30
30
30
30
30
30
30
30
30
35
30
30
35
30
45
30
45