💥 BREACHES & INCIDENTS
- AI voice-clone scam steals €95M from Intesa Sanpaolo's Fideuram; €36M still missing
Fraudsters used AI voice cloning and a fake WhatsApp message to trick Fideuram's chairman into authorizing €95 million in fraudulent transfers.- Targets: Fideuram, private banking arm of Italy's largest bank Intesa Sanpaolo; victim was then-chairman Paolo Molesini, who is not under investigation
- What was stolen: €95 million (~$108M) via international wire transfers, mainly to accounts in China and Hong Kong; ~€53-59M recovered, ~€36M untraced after conversion to cryptocurrency
- How it worked: a WhatsApp message impersonating CEO Carlo Messina requested urgent overseas transfers, followed by a phone call using AI-cloned voice of lawyer Paolo Nastasi to confirm
- Bank's systems were not breached; Milan prosecutors are investigating a foreign national for computer fraud; Molesini resigned in March citing personal reasons
🕵️ RESEARCH & DEEP DIVES
- New Windows 'console named-pipe injection' technique evades EDR without WriteProcessMemory
A researcher disclosed a Windows process injection technique that avoids VirtualAllocEx and WriteProcessMemory to evade EDR detection.- Applies to Windows systems; targets EDR detections built around the classic allocate-write-execute injection chain (MITRE ATT&CK T1055).
- Dubbed console named-pipe injection: the injector creates a child console process like nslookup.exe or netsh.exe with stdin redirected to a pipe and writes payload bytes via WriteFile.
- Payload lands in the child's address space as it processes input; the injector scans for a marker prefix, then uses VirtualProtectEx to make pages executable and redirects a thread's instruction pointer.
- PoC demo showed 368 bytes inside nslookup.exe, protection changed from read-write to executable-read-write; payloads must avoid CR, LF, and Ctrl+Z bytes.
- Disclosed by researcher Two Seven One Three; memory scanning, remote VirtualProtectEx changes, and SetThreadContext remain detectable signals.
Sources 📄 Source: zerosalarium.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- Wireshark 4.6.9 released, fixing 19 vulnerabilities including dissector crashes
Wireshark has released version 4.6.9, which fixes 19 vulnerabilities and 16 bugs.- Applies to users of Wireshark, the popular network protocol analyzer; version 4.6.9 is now available.
- Fixed vulnerabilities include crashes in ZigBee ZCL, SCTP, SPDY, CSN.1, MBIM, X11, and IEEE 802.11 dissectors, plus infinite loops in the TTL file parser and USB HID dissector (CVE-2026-95386 through CVE-2026-96423).
- A profile import crash with possible code execution (wnpa-sec-2026-106) and a stack-based buffer overflow in the etwdump extcap when parsing crafted ETL files were also fixed.
- Bug fixes include ZDI-reported remote code execution issues in LBMC fragment reassembly and LoRaWAN decryption, plus an SMB Object Export integer overflow.
- Updated protocol support spans AKP, DICOM, F1AP, IEEE 802.11, LoRaWAN, OpenFlow, QUIC, SMB, and others; capture file support updated for BLF, Network Monitor, pcapng, PEAK TRC, Toshiba, and TTL.