نبض سایبری اخبار امنیت سایبری، با ذکر منبع
The Hacker News

An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it

امنیت هویت و دسترسی
خواندن متن کامل در The Hacker News درخواست حذف

این صفحه فقط عنوان و خلاصهٔ کوتاه خبر را نمایش می‌دهد. متن کامل در منبع اصلی منتشر شده است.

خبرهای مرتبط

آرشیو کامل ←
CSO Online

Attackers built a ‘Skynet’ AI agent that hijacks exposed models to run cyberattacks

Skynet is no longer a fictional adversary. Attackers have built an offensive agent that exploits unprotected AI models on the web with a ‘Skynet’ directive that allows them to run unattended for up to 100,000 steps. In this mode, a reference to the humanity-destroying artificial neural network-based superintelligence system in the Terminator film franchise, the agent can kick off tools, scan for and infect targets, d…

بدافزار و آلودگی آسیب‌پذیری و روز صفر بات‌نت و DDoS
منبع
The Hacker News

CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published

امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین
منبع
ANY.RUN

SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises

SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at […] The post SkyW4lker…

بدافزار و آلودگی فیشینگ امنیت هویت و دسترسی
منبع
The Hacker News

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked

توسعه وب
منبع