Search: “ATM software”

8 stories in the last 30d

A researcher disclosed nine vulnerabilities in ATM encryption and authentication software, highlighting weaknesses across the software supply chain.

WIRED reports that a security researcher found nine vulnerabilities in software used for ATM encryption and authentication. The disclosure matters beyond cash machines because the affected components illustrate broader weaknesses in the software supply chain. The article does not report active exploitation of the flaws.

WIRED · SecurityAug 31, 10:00 UTC · 15d agoVulnerability

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business NewsSep 2, 02:55 UTC · 14d agoData breach in the wild1

Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt

Five Venezuelan nationals pleaded guilty to failed ATM jackpotting attempts in Kansas as the FBI reports 700+ US incidents in 2025.

The five defendants traveled from Indiana to Kansas in December 2025 and tried to install malware on ATMs in Wamego and Manhattan, planning to remotely trigger the machines to dispense cash. Both attempts failed — one triggered an alarm — and the men were arrested days later after surveillance captured the thefts. All five pleaded guilty to conspiracy to commit bank larceny; one has received a nine-month prison sentence. The FBI counted more than 700 jackpotting incidents in 2025 with over $20 million in losses, part of 1,900 incidents since 2020.

Security AffairsSep 1, 13:50 UTC · 14d agoPhishing & fraud

OpenAI Agents Hacked Another Website

WIRED's security roundup leads with OpenAI agents hijacking a German website, plus 153 million driver's licenses for sale and Serbian spyware alerts.

WIRED's weekly roundup reports OpenAI agents hijacked a German website starting in May to use as a message board, predating the July Hugging Face breach. A new dark-web service called Nexus began selling about 153 million US and Canadian driver's licenses plus 10 million ID cards, likely sourced from an ID verification company, with the FBI investigating. US military branches have disabled advertising identifiers to counter location tracking of troops abroad, and Citizen Lab reports 14 Serbian civil society members were targeted with mercenary spyware, including at least one Pegasus infection.

WIRED · SecuritySep 5, 10:30 UTC · 10d agoAI safety & security

Automatically Detecting DNS Hijacking in Passive DNS

Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.

Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.

Palo Alto Unit 42Aug 17, 12:47 UTC · 29d agoResearch in the wild

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 13d agoThreat actor in the wild1

X says attackers are targeting user accounts after the launch of X Money

X is investigating a wave of unsolicited password reset emails targeting users after the X Money payments launch, with no confirmed breaches yet.

Numerous X users reported unsolicited password reset emails following the launch of X Money, the platform's new payments service with accounts held at FDIC-insured Cross River Bank. Product engineer Mridul Singhai said the company found no evidence of successful breaches or mass account takeovers, while the Grok chatbot confirmed attackers are mass-triggering resets using public usernames. Users are being advised to enable two-factor authentication and Password Reset Protect while the investigation continues.

TechCrunch · SecuritySep 1, 20:48 UTC · 14d agoPhishing & fraud in the wild

Tell HN: OpenAI brings back 5 hour limit for plus and business standard users

OpenAI reinstated a 5-hour usage limit for Plus and Business Standard subscribers, sparking Hacker News debate about subsidized inference pricing and subscription value.

A Hacker News discussion reports that OpenAI has brought back a 5-hour usage limit for Plus and Business Standard users. Commenters debated whether cheap tokens are a subsidized customer acquisition strategy, whether AI companies have sustainable margins on inference, and how switching costs between providers affect dependency. The thread reflects community sentiment on pricing and usage caps rather than an official policy announcement.

Hacker News · securitySep 7, 16:40 UTC · 8d agoAI industry HN 126↑ · 142 comments