Search: “blob-url”

ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-626 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bzfilelist component.

The Zero Day Initiative published advisory ZDI-26-626 describing a link-following denial-of-service vulnerability in the bzfilelist component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published Advisories·Sep 9, 05:00 UTC · 8d agoVulnerability 5 sourcesCVE-2026-19820

New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners

Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.

Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.

GBHackers·updated Sep 10, 14:04 UTC · 6d ago·first Sep 10, 10:57 UTC · 6d agoPhishing & fraud in the wild 2 sources

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.

Barracuda researchers analyzed a phishing campaign that generates a blob URL to render the phishing page entirely inside the victim's browser, leaving no static page for scanners to inspect. The chain begins with a Docusign-themed email containing a calendar invite, followed by a crafted redirect through Microsoft Teams to a resource on cdn.bloom[.]io that the browser converts into the blob URL. Service workers, iframes, and a hidden command-and-control configuration indicate the page is part of a centrally managed phishing platform that can be updated and steered across victims. Researchers recommend inspecting blob URL activity, monitoring OAuth authorization flows, and analyzing the full click path in email security controls.

SecurityWeek·Sep 9, 10:00 UTC · 8d agoPhishing & fraud in the wild

Trends in Web Threats: Old Web Skimmer Still Active Today

Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.

Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.

Palo Alto Unit 42·Aug 17, 13:05 UTC · Aug 17, 2026Research

Advanced URL Filtering Archives

Palo Alto Networks markets Advanced URL Filtering as combining a malicious URL database with real-time ML and DL web protection.

The Unit 42 blog page is a product category archive for Advanced URL Filtering. The product description states it combines a malicious URL database with a real-time web protection engine powered by machine learning and deep learning models. No research findings, incidents, or vulnerabilities are discussed.

Palo Alto Unit 42·Sep 8, 14:27 UTC · 8d agoIndustry 6 sources

Google Links Redact Extortion Group to BlackFile Rebrand

Infosecurity Magazine·Aug 7, 09:40 UTC · Aug 7, 2026Ransomware

Cybercriminals are building phishing pages that exist only inside victims’ browsers

Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.

Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.

Help Net Security·Sep 10, 05:00 UTC · 7d agoPhishing & fraud in the wild

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42·Aug 17, 13:05 UTC · Aug 17, 2026Research

BleachBit 6.0.4 fixes secure wiping that skipped clusters on Windows

BleachBit 6.0.4 fixes Windows secure-wipe bugs that skipped fragmented-file clusters, adds HSTS tracker deletion, early macOS support, and broad hardening.

The open-source cleaner BleachBit released version 6.0.4, fixing Windows shredding bugs where fragmented files were wiped incompletely because noncontiguous clusters were skipped, leaving potentially sensitive data on disk. The release adds deletion of dynamic HSTS tracking data in six Chromium-based browsers and Zen, early macOS support including a Safari cleaner and full CLI, plus hardening such as absolute paths for ipconfig/taskkill, symlink and reparse-point handling, DTD-free XML parsing, and PATH/environment sanitization when running as root.

Help Net Security·Sep 9, 04:00 UTC · 8d agoTools

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabz·updated Sep 11, 09:12 UTC · 6d ago·first Sep 10, 14:43 UTC · 6d agoMalware in the wild 3 sources

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commits·Sep 8, 19:22 UTC · 8d agoTools

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.

The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.

ZDI Published Advisories·Aug 24, 05:00 UTC · 24d agoAdvisoryCVE-2026-19774

ZDI-26-713: GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-92183, a stack-based buffer overflow in GIMP's APNG file parsing that enables remote code execution (CVSS 7.8).

ZDI published advisory ZDI-26-713 describing a stack-based buffer overflow in GIMP's APNG file parsing, assigned CVE-2026-92183 with a CVSS score of 7.8. Remote attackers can execute arbitrary code on affected installations, but exploitation requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention exploitation in the wild or patch status.

ZDI Published Advisories·Sep 16, 05:00 UTC · 1d agoVulnerability 11 sourcesCVE-2026-92183

Google’s new search redirects make links harder to check before you click

Google routes some search result links through encoded google.com/goto?url= redirects, breaking hover-to-verify link checks and raising scraping costs.

Google has started routing some search result links through opaque google.com/goto?url=... redirects using a custom Google-specific encoding, with the destination visible only via the redirect response's Location header. Google confirmed the rollout as an anti-abuse measure, most likely to make bulk extraction of destination URLs from search results more difficult and costly. Malwarebytes warns the change undermines the standard hover-before-clicking safety advice, while legitimate rank-tracking, SEO auditing, archival, and accessibility tools now face the same rate limits and costs as abusive scrapers.

Malwarebytes Labs·Sep 14, 14:17 UTC · 2d agoIndustry

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker News·Aug 19, 15:27 UTC · 28d agoThreat actor in the wildCVE-2026-12569

Bulk AbuseIPDB reporting using command-line tools

A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.

The author's self-hosted Gitea instance was scraped by distributed bots using random IPs worldwide and randomized, often nonexistent User-Agent strings, generating heavy request load for days. The write-up demonstrates filtering Traefik access logs (CLF and JSON) with grep, awk, and jq to extract offending IPs, tagging them with AbuseIPDB category 19 (Bad Web Bot), deduplicating them, and building a CSV for the Bulk Reporter tool. Reports can then be submitted through the AbuseIPDB bulk-report API, respecting the 5,000-report daily limit.

Lobsters · security·Sep 9, 20:26 UTC · 7d agoTools1

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

Wiz published a DFIR cheatsheet covering log visibility, incident readiness, and threat hunting across GitHub, GitLab, Bitbucket, and Azure DevOps.

Wiz researchers released a practitioner's guide to version control system forensics, incident response, and threat hunting. The cheatsheet maps log sources, audit capabilities, and hunting workflows across GitHub, GitLab, Bitbucket, and Azure DevOps. It aims to improve incident readiness for source code and CI/CD compromise scenarios.

Wiz Blog·Aug 27, 12:00 UTC · 20d agoResearch1

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.

In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.

Zscaler ThreatLabz·Aug 17, 14:06 UTC · Aug 17, 2026Malware in the wild1

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-security·Sep 5, 12:16 UTC · 11d agoVulnerabilityCVE-2026-86137CVE-2026-86138

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security News·Sep 15, 12:21 UTC · 1d agoResearch

ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle Outside In Technology's PostScript parsing (CVE-2026-60412) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-636, a CVSS 7.8 heap-based buffer overflow in PostScript file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code when the target opens a malicious file or visits a malicious page, making user interaction a requirement. The vulnerability is tracked as CVE-2026-60412. The advisory reports no exploitation.

ZDI Published Advisories·Sep 9, 05:00 UTC · 8d agoVulnerability 4 sourcesCVE-2026-604121

India’s STPI serves TerminalFix-style attack via fake Cloudflare check

India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.

A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.

CSO Online·Sep 11, 15:26 UTC · 5d agoPhishing & fraud in the wild1

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackers·Sep 15, 13:42 UTC · 1d agoIndustry

Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters

VBSpam Q3 2026 test shows phishers abusing DKIM-aligned domains, Amazon SES, and multi-stage URL cloaking to defeat email filters.

Virus Bulletin's Q3 2026 VBSpam test (AMTSO-LS1-TP207) found phishing campaigns moving payloads past the email itself via browser-fingerprinting gates, redirect chains, and hidden POST requests. Examples include a Dutch McAfee/TotalAV scareware renewal scam, a German overdue-payment Web3 fraud delivered via Amazon SES from DKIM-aligned moolaah.com, and Romanian BCR PSD2 credential phishing embedding IPv6-mapped URLs resolving to 103.193.179.223. Net at Work NoSpamProxy ranked first with a 99.995 score while open-source Rspamd caught only 62.55% of phishing mail.

GBHackers·Sep 15, 13:04 UTC · 1d agoPhishing & fraud in the wild 2 sources

Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign

Aggah campaign abuses Bit.ly, BlogSpot, and Pastebin as multi-hop C2 to deliver RevengeRAT across the Middle East, US, Europe, and Asia.

Unit 42 details the Aggah campaign, which began with spearphishing emails in March 2019 spoofing a large financial institution and targeting education, media/marketing, and government organizations in the Middle East, later expanding to the US, Europe, and Asia. Delivery documents use Template Injection to load a remote OLE file whose macro runs mshta against a Bit.ly link redirecting to a BlogSpot post, which then uses Pastebin pastes to download RevengeRAT configured with a duckdns[.]org C2 domain. The embedded script also deletes Microsoft Defender signatures and kills Defender and Office processes, and modifies registry keys to enable macros. High-level TTPs resemble the Gorgon Group, but Unit 42 could not confirm attribution.

Palo Alto Unit 42·Aug 17, 13:21 UTC · Aug 17, 2026Threat actor

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers·Sep 11, 12:24 UTC · 5d agoMalware in the wild2