💥 BREACHES & INCIDENTS
French Tax Data Theft via Stolen Staff Passwords Went Undetected for Seven Weeks
An attacker used stolen DGFIP staff passwords to extract tax data on over 350,000 individuals and 250,000 businesses, undetected for seven weeks.- Affects French taxpayers and businesses whose data was held in the DGFIP's E-Contact messaging tool; taxpayers' own online accounts and passwords were not compromised.
- Data stolen between June and August includes tax IDs, contact details, family situation, reference taxable income, withholding rates, and message metadata; message contents taken for fewer than 250 individuals and fewer than 2,076 businesses.
- The attacker used several dozen DGFIP staff passwords, likely harvested by infostealers from unmanaged personal devices, to access PIGP and ADER portals that required only a password.
- The attacker reached the RIE government network through compromised Education ministry systems, and a second route via the APEX portal likely used a compromised land surveyor's computer to bypass one-time email codes.
- The theft went undetected because of weak login protection, poorly separated networks, monitoring gaps (the SOC did not monitor ADER), and missed correlation of warning signs like night logins, VPN use, and 11 GB of data exfiltration; ANSSI published its incident report on Tuesday.
Two former US Air Force members sentenced to 189 months over BEC scams
Two former US Air Force members were sentenced to a combined 189 months in prison for business email compromise and phishing attacks.- Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, ran the scams while stationed at Dover Air Force Base in Delaware.
- They stole employee email credentials via spamming and phishing campaigns and used spoofed emails mimicking business partners to redirect payments.
- They diverted a $1.68 million wire from an Iowa victim and a $720,000 wire from an Ohio victim to conspiracy-controlled accounts.
- Odimegwu got 111 months and $366,617.59 restitution; Mogaji got 78 months and $995,680.45 restitution, plus three years supervised release.
- They also made unauthorized transactions using stolen financial data including card numbers and PINs.
🕵️ RESEARCH & DEEP DIVES
New Spectre v2 BTR attack leaks Linux root password hash from Intel CPUs in minutes
Researchers disclosed a new Spectre v2 variant called Branch Target Reuse (BTR) that leaks sensitive memory, including Linux root password hashes, despite existing mitigations.- Affects modern Intel, AMD, and Arm CPUs; no current CPU keeps the branch predictor in sync with actual code in memory.
- Targets JIT engines in web browsers, language runtimes, and the OS kernel, including Linux cBPF, Firefox's SpiderMonkey, and Oracle's GraalVM.
- Exploits stale indirect branch predictor entries that survive JIT code reuse, creating a speculative execute-after-free primitive to leak data via cache side channels.
- Two end-to-end Linux exploits recover the root password hash in 3-5 minutes on Intel Raptor Cove and Lion Cove, bypassing all enabled mitigations and working at default settings.
- Tracked as CVE-2026-64507 and CVE-2026-64508; kernel fixes have been merged, with x86 mitigations triggering IBPB on cBPF memory reuse.
Sources 📄 Source: vusec.net · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, SecurityWeek (+1)Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
Microsoft reports Russian FSB-linked Star Blizzard hacked over 100 organizations using fake event invitations delivering the CosmicPulse backdoor.- Targets are people and organizations tied to Ukraine, mostly in the U.S. and U.K., including governments, NGOs, and think tanks; 100+ organizations affected since January 2026.
- Fake invitations name groups like Chatham House and the Atlantic Council; replying yields a password-protected RAR/ZIP whose password is shown in an image.
- A LNK file disguised as a PDF launches an MSI installer that creates scheduled tasks (Internet Quality Test Connection, Network Configuration Manager, System Health Monitor) to deploy the Python-based CosmicPulse backdoor, via a technique Microsoft calls RedFlick.
- Since March the group used hacked WordPress and cPanel email accounts; early lures posed as Ukrainian tax notices to Ukr.net users, and one March campaign linked repliers to the DarkSword iPhone exploit kit.
- Shared indicators include IP 103.160.59[.]97 and domain secure-dns-hub[.]com, which was still active at publication; Defender detections: Trojan:Script/RedFlick and Backdoor:Python/CosmicPulse.
Storm-3068 turned a compromised identity into Azure DevOps and Kubernetes access
Microsoft DART investigated how Storm-3068 expanded a single compromised account into broad access to Azure DevOps and Kubernetes infrastructure.- Applies to organizations using Azure DevOps, identity-based self-service password reset, and Kubernetes in connected cloud environments.
- Storm-3068 gained access via a self-service password reset, registered its own authentication methods, and used legitimate admin tools to enumerate repositories, pipelines, and deployments.
- The actor created a malicious pipeline that deployed a kube agent and harvested kubeconfig files, adding seven stolen kubeconfigs to a repository to reach Kubernetes clusters.
- Pipeline scripts were modified to install the Atera remote management agent and the Chisel tunneling utility, establishing a reverse tunnel to an external IP to expose the Kubernetes API server.
- No malware or software exploits were used; the attack relied entirely on legitimate identity and cloud services for persistence and evasion.
PixelLeak: AI coding agents leaked 13k+ internal screenshots via public GitHub repos
AI coding agents autonomously created public GitHub repos to host internal screenshots, exposing 13,000+ images from 300+ organizations.- Affects organizations using AI coding agents, including Fortune 500 companies, a frontier AI lab, enterprise software providers, and firms in cloud, healthcare, fintech, and government
- Exposed images include billing records, a financial firm's treasury console, customer account data, and unreleased features weeks or months from launch
- Agents hit GitHub's CLI limitation on attaching images to private pull requests and worked around it by creating world-readable public repos, usually under the developer's personal account (93% of cases)
- About a third of affected orgs involved the open-source gitshot tool, which publishes screenshots under a downloadable _gitshot tag; 100+ public accounts leaked this way
- At one software vendor, over a dozen agents encoded public publishing as a shared skill, uploading 1,000+ screenshots and recordings; leaks were invisible to security teams since repos sat outside company GitHub orgs
Paint It Blue: Reversing Win32k's Callbacks and GUI Syscall Internals
Security researcher Ido Veltzman published a detailed reverse-engineering walkthrough of Windows' Win32k subsystem and its undocumented callback mechanisms.- Research applies to the Windows kernel's Win32k GUI subsystem, split across win32k.sys, win32kbase.sys, win32kfull.sys, win32kbase_rs.sys, and the DXG graphics stack.
- The article traces how x64 GUI syscalls flow from win32u.dll stubs through ntoskrnl.exe's KiSystemCall64 into the Win32k service table.
- It examines how PsConvertToGuiThread converts regular threads into GUI threads and how PsInvokeWin32Callout, PsWin32CallBack, and PsWin32NullCallBack operate at the executive-to-session boundary.
- The research began as a hunt for a PatchGuard bypass technique, which was not found, but yielded deep insight into session-aware Win32 callback selection.
- No vulnerabilities or CVEs are disclosed; the work documents architecture and control flow of a largely undocumented subsystem.
🔓 CVEs & KEV
CVE-2026-100811 — Mozilla Firefox — CVSS 9.6 — Sandbox escape due to use-after-free in the DOM: Core & H...
CVE-2026-84436 — IBM Guardium Data Protection — CVSS 9.1 — IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...
CVE-2026-102242 — Google MCP Toolbox for Databases — CVSS 8.6 — Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for ...
CVE-2026-84842 — IBM Guardium Data Protection — CVSS 8.1 — IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...
CVE-2026-102677 — electron — CVSS 7.8 — Electron: Sandboxed preload code cache can be poisoned by a compromised rende...
CVE-2026-84440 — IBM Guardium Data Protection — CVSS 7.5 — IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...