57
30
30
57
57
30
30
55
30
30
57
57
60
42
42
42
30
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips
60
47
35
30
30
55
57
30
Linux Zoom Client Proactively Reads X11 Clipboard
Simon Tatham reports that Zoom's Linux client proactively reads the X11 clipboard, potentially exposing copied passwords and other sensitive data.
A Mastodon post by Simon Tatham, shared via Lobsters, reports that the Linux Zoom client proactively reads the X11 system clipboard rather than accessing it only on explicit paste. Because X11 allows any running application to query clipboard contents, secrets such as copied passwords or tokens may be captured by the app. The observation highlights the broader privacy gap between X11's unrestricted clipboard access and more restricted display servers like Wayland.
20
India’s STPI serves TerminalFix-style attack via fake Cloudflare check
India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.
A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.
48
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
Check Point discovers cross-account data leakage in ChatGPT: isolated code-execution containers communicate via shared JFrog Artifactory, enabling covert Gmail exfiltration.
Check Point Research found a covert bidirectional channel between ChatGPT code-execution containers belonging to different accounts, which were supposed to be isolated from each other and the public internet. Both could reach the same internal JFrog Artifactory instance used for package delivery, whose exposed Item Management API allowed a 'shared clipboard' between containers. In a proof of concept, a hidden instruction in a shared conversation made ChatGPT retrieve email data from the victim's connected Gmail account and send it to the attacker's account while the victim received a normal answer. The same channel could exfiltrate conversation history and session files; OpenAI recently described a similar isolation weakness in its postmortem of the Hugging Face incident.
68
GrapheneOS Overhauled Default Apps and Secure Clipboard
GrapheneOS announced an overhaul of its default apps and a redesigned secure clipboard in its privacy-focused Android distribution.
The GrapheneOS project posted on Mastodon that it has "overhauled default apps and secure clipboard" in its privacy and security hardened Android OS. The provided text contains only the announcement title and engagement figures, without release notes or technical specifics. Changes to built-in apps and clipboard handling in GrapheneOS are typically relevant to Android privacy and mobile security practitioners.
40
30
30
35
30
42
30
30
30
30
30
60