Researchers Uncover Chrome Extensions Abusing Affiliate Links and Stealing ChatGPT Access
"The extension does block ads as advertised, but its primary function is hidden: it automatically injects the developer's affiliate tag (10xprofit-20) into every Amazon product link and replaces existing affiliate codes from content creators," Socket security researcher Kush Pandya said.
📸 Credit: The Hacker News
Cyber_Security_Channel
"The extension does block ads as advertised, but its primary function is hidden: it automatically injects the developer's affiliate tag (10xprofit-20) into every Amazon product link and replaces existing affiliate codes from content creators," Socket security researcher Kush Pandya said.
📸 Credit: The Hacker News
Cyber_Security_Channel
❤7👍2🔥1😱1
Moltbook API Flaw Exposes Millions of User Records Publicly
Researchers found that Moltbook exposed sensitive customer information after an unauthenticated API endpoint allowed bulk access to user profiles, email addresses, and related metadata without proper authorisation.
According to Infosecurity Magazine, the incident was caused by insufficient access controls in the backend API, enabling large-scale data harvesting before the company limited access and launched an internal investigation.
Cyber_Security_Channel
Researchers found that Moltbook exposed sensitive customer information after an unauthenticated API endpoint allowed bulk access to user profiles, email addresses, and related metadata without proper authorisation.
According to Infosecurity Magazine, the incident was caused by insufficient access controls in the backend API, enabling large-scale data harvesting before the company limited access and launched an internal investigation.
Cyber_Security_Channel
🔥9❤2
Cyber Security News
⚡️149 Million Usernames and Passwords Exposed by Unsecured Database Security researcher Jeremiah Fowler discovered an unsecured database with 149 million credentials, including 48M Gmail accounts and 17M Facebook logins. Fowler suspects the massive collection…
🔐 Amidst Recent News — Use This Tool as a Check-Up
We have partnered with LeakAI Bot to help you stay safe online.
Above instrument provides a handful of resources:
• Email & Username Leak Scanning
• AI-Powered Threat Insights
• Domain Security Check
• Zero Data Storage
Test it out for yourself.
Click here to try.
-----
@Cyber_Security_Channel
We have partnered with LeakAI Bot to help you stay safe online.
Above instrument provides a handful of resources:
• Email & Username Leak Scanning
• AI-Powered Threat Insights
• Domain Security Check
• Zero Data Storage
Test it out for yourself.
Click here to try.
-----
@Cyber_Security_Channel
5❤6🔥4👍2
Join the Webinar "Choosing Your Dark Web & CTEM Vendor in 2026"
Best practices to enhance your ImmuniWeb® AI Platform skills, earn CPE credits, and qualify to become ImmuniWeb® Certified Professional.
✔️ Key Insights:
• Dark Web Monitoring, prevent data breaches in 2026
• OWASP Top 10 for LLMs, role in CTEM solutions
• Novel risks from AI & LLMs
• Attack Surface Management (ASM) strategy and cost reduction
• Automated testing of attack surface
• Data sovereignty, third-party risk management (TRPM)
• Response to phishing & malware
• Ransomware & cyber insurance pitfalls
• Regulatory landscape in 2026
• CTEM with ImmuniWeb
Date & Time: February 19th @ 10am and 5pm CET
Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
✅ Register Now:
Session 1 – February 19, 2026 – Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – February 19, 2026 – Geneva 5pm | New York 11am | California 8am
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
Best practices to enhance your ImmuniWeb® AI Platform skills, earn CPE credits, and qualify to become ImmuniWeb® Certified Professional.
✔️ Key Insights:
• Dark Web Monitoring, prevent data breaches in 2026
• OWASP Top 10 for LLMs, role in CTEM solutions
• Novel risks from AI & LLMs
• Attack Surface Management (ASM) strategy and cost reduction
• Automated testing of attack surface
• Data sovereignty, third-party risk management (TRPM)
• Response to phishing & malware
• Ransomware & cyber insurance pitfalls
• Regulatory landscape in 2026
• CTEM with ImmuniWeb
Date & Time: February 19th @ 10am and 5pm CET
Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
✅ Register Now:
Session 1 – February 19, 2026 – Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – February 19, 2026 – Geneva 5pm | New York 11am | California 8am
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤6👍2🔥2
AI-Generated Code is Fast Becoming the Biggest Enterprise Security Risk as Teams Struggle with the ‘Illusion of Correctness’
“The real risk of AI-generated code isn’t obvious breakage; it’s the illusion of correctness.
Code that looks polished can still conceal serious security flaws, and developers are increasingly trusting it,” said Black Duck CEO Jason Schmitt.
Cyber_Security_Channel
“The real risk of AI-generated code isn’t obvious breakage; it’s the illusion of correctness.
Code that looks polished can still conceal serious security flaws, and developers are increasingly trusting it,” said Black Duck CEO Jason Schmitt.
Cyber_Security_Channel
IT Pro
AI-generated code is fast becoming the biggest enterprise security risk as teams struggle with the ‘illusion of correctness’
Security teams are scrambling to catch AI-generated flaws that appear correct before disaster strikes
👍9🥴2
⚡️ In 2026, Phishing is All About Full Attack Chains. MFA Bypass, Delayed Payloads, and Human Verification Traps
The only way for SOCs to detect it early without running hour-long investigations is interactive sandboxing.
It lets analysts execute the flow end-to-end in real time and exposes real risk before it hits the business.
👉 Try it for your team and see how your detection rate gets a massive boost → click here for access.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
The only way for SOCs to detect it early without running hour-long investigations is interactive sandboxing.
It lets analysts execute the flow end-to-end in real time and exposes real risk before it hits the business.
👉 Try it for your team and see how your detection rate gets a massive boost → click here for access.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
👍7❤3👎1
AI Agents Leak Data via Messaging App Link Previews as AI Adoption Has Outpaced Security Governance
Tests revealed that configurations such as Microsoft Teams running Copilot Studio and Slack utilizing specific bots were susceptible to this data exfiltration method.
Because the link preview mechanism functions as a trusted system process, it bypasses standard user-level security checks.
Cyber_Security_Channel
Tests revealed that configurations such as Microsoft Teams running Copilot Studio and Slack utilizing specific bots were susceptible to this data exfiltration method.
Because the link preview mechanism functions as a trusted system process, it bypasses standard user-level security checks.
Cyber_Security_Channel
TechNadu
AI Agents Leak Data via Messaging App Link Previews - TechNadu
New research reveals how AI agents' data leaks occur via zero-click prompt injection in messaging applications such as Microsoft Teams and Slack.
👍4❤1
Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens
That said, the cybersecurity company said the data capture was not facilitated by a custom OpenClaw module within the stealer malware, but rather through a "broad file-grabbing routine" that's designed to look for certain file extensions and specific directory names containing sensitive data.
It's worth noting that the theft of the gateway authentication token can allow an attacker to connect to the victim's local OpenClaw instance remotely if the port is exposed, or even masquerade as the client in authenticated requests to the AI gateway.
📸 Credit: The Hacker News
@Cyber_Security_Channel
That said, the cybersecurity company said the data capture was not facilitated by a custom OpenClaw module within the stealer malware, but rather through a "broad file-grabbing routine" that's designed to look for certain file extensions and specific directory names containing sensitive data.
It's worth noting that the theft of the gateway authentication token can allow an attacker to connect to the victim's local OpenClaw instance remotely if the port is exposed, or even masquerade as the client in authenticated requests to the AI gateway.
📸 Credit: The Hacker News
@Cyber_Security_Channel
❤9👍1🥰1
The Picus Security RED Report 2026: Top 10 MITRE ATT&CK Techniques
The report dissected 1.15 million files and 15.5 million adversarial actions, revealing a massive shift from noisy breaches to stealthy, long‑term residency.
Attackers now blend into legit processes defense‑evasion, persistence, and C2 dominate ≈ 80% of top techniques, exposing why many stacks miss hidden threats.
@Cyber_Security_Channel
The report dissected 1.15 million files and 15.5 million adversarial actions, revealing a massive shift from noisy breaches to stealthy, long‑term residency.
Attackers now blend into legit processes defense‑evasion, persistence, and C2 dominate ≈ 80% of top techniques, exposing why many stacks miss hidden threats.
@Cyber_Security_Channel
Picussecurity
Red Report 2026
Red Report 2026 analyzes 1.1M+ files and 15.5M adversarial actions to show how attackers shift from noisy breaches to long-term residency.
❤10👍4
⚡️French Government Says 1.2 Million Bank Accounts Exposed in Breach
The breach occurred in late January and impacted 1.2 million accounts, including IBANs, account holder names, addresses, and in some cases tax identifiers.
The attacker’s access has been terminated and impacted individuals are being notified.
Cyber_Security_Channel
The breach occurred in late January and impacted 1.2 million accounts, including IBANs, account holder names, addresses, and in some cases tax identifiers.
The attacker’s access has been terminated and impacted individuals are being notified.
Cyber_Security_Channel
SecurityWeek
French Government Says 1.2 Million Bank Accounts Exposed in Breach
The Ministry of Economy reported discovering unauthorized access to the national bank account registry FICOBA.
❤4
Filigran’s Practical Guide to Threat-Informed Defense: White Paper
This cuts through the noise, offering a step-by-step blueprint to align security ops with real-world threats.
Learn how OpenCTI and proactive strategies can shrink attack surfaces especially in high-stakes sectors like finance turning intelligence into action.
@Cyber_Security_Channel
This cuts through the noise, offering a step-by-step blueprint to align security ops with real-world threats.
Learn how OpenCTI and proactive strategies can shrink attack surfaces especially in high-stakes sectors like finance turning intelligence into action.
@Cyber_Security_Channel
Filigran
A Practical Guide to Threat-Informed Defense | Filigran
Filigran's latest industry report on the extensive attack surface in the financial sector and how OpenCTI empowers their management.
👍3👨💻1
🚨 Live Expert Panel Announcement From Our Partners
→ How attackers exploit trust in 2026, featuring executive insights from a Lazarus APT infiltration case?
Join us for a practical discussion focused on enterprise threats, executive-level implications, and modern mitigation strategies.
✔️ Who is this expert panel for?
• Decision-makers
• Business executives
• Heads of SOC teams
• Managers and team leads
👉 Free Sign Up → click here to access.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
→ How attackers exploit trust in 2026, featuring executive insights from a Lazarus APT infiltration case?
Join us for a practical discussion focused on enterprise threats, executive-level implications, and modern mitigation strategies.
✔️ Who is this expert panel for?
• Decision-makers
• Business executives
• Heads of SOC teams
• Managers and team leads
👉 Free Sign Up → click here to access.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤7🤷♀1
OpenAI Launches EVMbench to Detect, Patch, and Exploit Vulnerabilities in Blockchain Environments
OpenAI, in collaboration with crypto investment firm Paradigm, has launched EVMbench, a new benchmark designed to assess AI agents’ ability to detect, patch, and even exploit vulnerabilities in smart contracts — the foundational code behind many blockchain applications.
Drawing from over 120 curated vulnerabilities from 40 security audits, EVMbench tests AI models across three modes: detect, patch, and exploit.
These modes simulate key stages of smart contract security, with agents scored on how accurately they find issues, fix them without breaking functionality, and responsibly exploit in a controlled environment.
Early results show newer models like GPT-5.3-Codex outperform earlier versions in exploit tasks, highlighting rapid AI advancements in understanding blockchain code—but also reinforcing that real-world contract security remains difficult even for cutting-edge systems.
OpenAI has also pledged $10 million in API credits to support defensive security research and continues expanding its AI security research tools.
@Cyber_Security_Channel
OpenAI, in collaboration with crypto investment firm Paradigm, has launched EVMbench, a new benchmark designed to assess AI agents’ ability to detect, patch, and even exploit vulnerabilities in smart contracts — the foundational code behind many blockchain applications.
Drawing from over 120 curated vulnerabilities from 40 security audits, EVMbench tests AI models across three modes: detect, patch, and exploit.
These modes simulate key stages of smart contract security, with agents scored on how accurately they find issues, fix them without breaking functionality, and responsibly exploit in a controlled environment.
Early results show newer models like GPT-5.3-Codex outperform earlier versions in exploit tasks, highlighting rapid AI advancements in understanding blockchain code—but also reinforcing that real-world contract security remains difficult even for cutting-edge systems.
OpenAI has also pledged $10 million in API credits to support defensive security research and continues expanding its AI security research tools.
@Cyber_Security_Channel
Cyber Security News
OpenAI Launches EVMbench to Detect, Patch, and Exploit Vulnerabilities in Blockchain Environments
OpenAI, in collaboration with crypto investment firm Paradigm, has introduced EVMbench, a new benchmark designed to evaluate the ability of AI agents to detect, patch, and exploit high-severity vulnerabilities in smart contracts.
❤3👍3
Semgrep Secure 2026: Keynote
Here the script was flipped on AppSec for the AI era.
With most code now generated by LLMs, legacy tools fail so Semgrep unveils a multimodal engine: zero false positives, context-aware detection, and self-improving systems.
It’s not AI bolted on; it’s AppSec rebuilt from the ground up for code written by prompts, not humans.
@Cyber_Security_Channel
Here the script was flipped on AppSec for the AI era.
With most code now generated by LLMs, legacy tools fail so Semgrep unveils a multimodal engine: zero false positives, context-aware detection, and self-improving systems.
It’s not AI bolted on; it’s AppSec rebuilt from the ground up for code written by prompts, not humans.
@Cyber_Security_Channel
Semgrep
Semgrep Secure 2026: Code Security Rebuilt for the AI Era
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
❤6👍3❤🔥1
Cryptocurrency Scams Target Asia, Combining Malvertising and Pig Butchering with Losses Up to ¥10 Million
A sophisticated cryptocurrency scam campaign is targeting users across Asia, especially in Japan, using a hybrid of malvertising and pig-butchering techniques to defraud victims of significant funds.
The operation starts with malicious ads on platforms like Facebook and Instagram that impersonate financial experts or promise exclusive AI-driven investment insights.
Clicking these ads sends victims to fake investment sites and typically encourages them to join messaging groups (LINE, WhatsApp, KakaoTalk) via QR codes.
Once inside these groups, advanced bots simulate human interaction, building trust and persuading victims to make initial investment transfers.
Reports show losses of up to ¥10 million (~US$60,000) for individual victims before the scammers either block withdrawals or disappear entirely.
@Cyber_Security_Channel
A sophisticated cryptocurrency scam campaign is targeting users across Asia, especially in Japan, using a hybrid of malvertising and pig-butchering techniques to defraud victims of significant funds.
The operation starts with malicious ads on platforms like Facebook and Instagram that impersonate financial experts or promise exclusive AI-driven investment insights.
Clicking these ads sends victims to fake investment sites and typically encourages them to join messaging groups (LINE, WhatsApp, KakaoTalk) via QR codes.
Once inside these groups, advanced bots simulate human interaction, building trust and persuading victims to make initial investment transfers.
Reports show losses of up to ¥10 million (~US$60,000) for individual victims before the scammers either block withdrawals or disappear entirely.
@Cyber_Security_Channel
Cyber Security News
Cryptocurrency Scams Target Asia, Combining Malvertising and Pig Butchering with Losses Up to ¥10 Million
Crypto scam targets Asia, esp. Japan, mixing malvertising and pig butchering to steal millions from investors.
❤3👍2
⚡In 2026, Slow Manual SOC Workflows Increase Business Risk: Delayed Decisions, More Escalations, Longer Exposure.
The only way to keep pace is replacing manual triage with automated investigation inside an interactive sandbox.
It combines automation with safe interaction to deliver behavior-based proof in minutes, cutting response time and limiting impact.
👉 Integrate it into your workflow and see measurable gains in detection speed and risk reduction → click here for automated SOC investigation.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
The only way to keep pace is replacing manual triage with automated investigation inside an interactive sandbox.
It combines automation with safe interaction to deliver behavior-based proof in minutes, cutting response time and limiting impact.
👉 Integrate it into your workflow and see measurable gains in detection speed and risk reduction → click here for automated SOC investigation.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤8👍2
Guardian AI-Penetration Testing Tool Connects Gemini and GPT-4 with 19 Security Tools Including Nmap
A new open-source penetration testing framework called Guardian is reshaping how security professionals automate vulnerability assessments.
Created by security researcher Zakir Kun and released on GitHub, Guardian integrates multiple large language models — including Google’s Gemini and OpenAI’s GPT-4 — alongside a suite of 19 security tools like Nmap. This multi-agent architecture automates tasks traditionally done manually in ethical hacking workflows.
By orchestrating AI models and proven cybersecurity tools, Guardian is designed to perform intelligent, adaptive penetration tests, reducing the time and expertise needed for discovering complex vulnerabilities while capturing full evidence of findings.
This breakthrough tool promises to enhance both offensive and defensive workflows for security teams.
@Cyber_Security_Channel
A new open-source penetration testing framework called Guardian is reshaping how security professionals automate vulnerability assessments.
Created by security researcher Zakir Kun and released on GitHub, Guardian integrates multiple large language models — including Google’s Gemini and OpenAI’s GPT-4 — alongside a suite of 19 security tools like Nmap. This multi-agent architecture automates tasks traditionally done manually in ethical hacking workflows.
By orchestrating AI models and proven cybersecurity tools, Guardian is designed to perform intelligent, adaptive penetration tests, reducing the time and expertise needed for discovering complex vulnerabilities while capturing full evidence of findings.
This breakthrough tool promises to enhance both offensive and defensive workflows for security teams.
@Cyber_Security_Channel
Cyber Security News
Guardian AI-Penetration Testing Tool Connects Gemini, GPT-4 with 19 Security Tools Including Nmap
A new open-source framework is reshaping how security professionals approach penetration testing by placing multiple large language models directly at the helm of automated security assessments.
❤5👍4
Join the Webinar: Automating Your Web, Mobile & API Security Scanning in 2026, enhance ImmuniWeb® AI Platform skills, earn CPE credits, and qualify to become ImmuniWeb® Certified Professional.
✔️ Key Insights:
• AI risks to automate coding
• Application security testing AI automation
• Vide coding threats & vulnerabilities
• OWASP Top 10 LLMs + implications overview
• Application security pitfalls & data breaches
• Application security testing program implementation
• Mobile, web security scanning with CI/CD pipeline automation
• Mobile applications security scanning with Neuron
• Web application, API security Neuron scanning
Date & Time: March 19 at 10am and 5pm CET.
Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
✅ Register Now:
Session 1 – March 19, 2026 – Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – March 19, 2026 – Geneva 5pm | New York 11am | California 8am
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
✔️ Key Insights:
• AI risks to automate coding
• Application security testing AI automation
• Vide coding threats & vulnerabilities
• OWASP Top 10 LLMs + implications overview
• Application security pitfalls & data breaches
• Application security testing program implementation
• Mobile, web security scanning with CI/CD pipeline automation
• Mobile applications security scanning with Neuron
• Web application, API security Neuron scanning
Date & Time: March 19 at 10am and 5pm CET.
Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
✅ Register Now:
Session 1 – March 19, 2026 – Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – March 19, 2026 – Geneva 5pm | New York 11am | California 8am
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
👍4🔥1
Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks
GTIG’s longer period of tracking confirms sightings initially from a customer of a commercial surveillance vendor, subsequent use of the same kit in watering hole attacks by UNC6353 (a suspected Russian state-sponsored espionage group) against Ukrainian users.
And later in a wider campaign by UNC6691 (a financially motivated criminal group operating out of China).
Cyber_Security_Channel
GTIG’s longer period of tracking confirms sightings initially from a customer of a commercial surveillance vendor, subsequent use of the same kit in watering hole attacks by UNC6353 (a suspected Russian state-sponsored espionage group) against Ukrainian users.
And later in a wider campaign by UNC6691 (a financially motivated criminal group operating out of China).
Cyber_Security_Channel
SecurityWeek
Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks
Google and iVerify analysis reveals a powerful exploit kit originally used by Russian state actors that is now appearing in broader criminal campaigns.
38 Million Allegedly Impacted by ManoMano Data Breach
The stolen data allegedly pertains to ManoMano users across all five European countries where it operates, namely France, Germany, Italy, Spain, and the United Kingdom.
Cyber_Security_Channel
The stolen data allegedly pertains to ManoMano users across all five European countries where it operates, namely France, Germany, Italy, Spain, and the United Kingdom.
Cyber_Security_Channel
En-contact
Data breaches of thousands of ManoMano customer data records, reportedly extracted from Zendesk
Serious data breaches at ManoMano, a french market place dedicated to DIY supplies. A Tunisian call center and Zendesk committed.
❤2👍1