I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.
Source: Dark Reading · 2026-10-30
Category: Security News
-
Fake PDF and search tools hijacked searches for 13.4 million Chrome users
Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators.
Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators access to users’ queries and let them earn referral payments.
Socket says the extensions were promoted through ads on networks including Google Ads, promoting tools such as “manual finders,” “PDF converters,” “safe search,” and “AI search.”
The extensions were listed in Google’s official store, but most were unlisted. That means people with a direct link could visit a listing and install an extension, while ordinary searches in the store would not show it. An ad offered help with an immediate task, a landing page encouraged installation, and the official store provided a familiar place to complete it.
Search hijacking
The main risk was that operators could see what users searched for. Searches can reveal health worries, financial problems, workplace interests, or other personal matters. Socket says queries were often associated with a unique identifier, which could let the operators link a user’s searches over time.
The proxy could also choose where to send a search. Socket says this could potentially direct users to phishing or malware pages, but it did not find evidence that the extensions had done so.
What should users do?
If your searches start going astray, or you installed a search, PDF-converter, manual-finder, or security extension after clicking an ad, check what’s installed.
- Review your extensions. Enter
chrome://extensionsin Chrome’s address bar. Remove extensions you don’t recognize, no longer use, or don’t trust. To remove one, select Remove and confirm. If you’re unsure about an extension, check it against the list at the end of Socket’s blog. - Check your search settings. In Chrome, at the top right, select More (the three-dot menu), then Settings > Search engine. If Chrome says an extension is controlling a setting, review or remove that extension. The absence of this notice doesn’t confirm that all your extensions are safe.
- Run a Malwarebytes scan to check for malicious extensions and other malware that could be affecting your device.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Source: Malwarebytes Labs · 2026-10-30
- Review your extensions. Enter
-
Bloatware in Aftermarket Auto Parts
This story is interesting:
One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.
Among the pre-installed bloatware—or spyware, if you’re being less charitable—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go.
It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.
Source: Schneier on Security · 2026-10-30
-
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.
A malicious or compromised host can exploit the flaw to crash the viewer’s TeamViewer and, depending on the platform, may also run
Source: The Hacker News · 2026-10-30
-
Defense contractor pleads guilty to aiding North Korean remote worker scheme
A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday.
John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.
The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.
The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.
His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States.
Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company.
The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company.
Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy.
Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated.
The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance.
Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs.
Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives.
Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm.
The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of Fortune 500 companies.
Federal judges previously sentenced other people to prison for their involvement in the scheme, including Matthew Issac Knoot and Erick Ntekereze Prince; Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar and Alexander Paul Travis; Oleksandr Didenko and Christina Chapman.
Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027.
Source: CyberScoop · 2026-10-30
-
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.
Source: SecurityWeek · 2026-10-30
-
This month in security with Tony Anscombe – October 2026 edition
The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans
Source: WeLiveSecurity (ESET) · 2026-10-30
-
In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware.
Source: SecurityWeek · 2026-10-30
-
Malicious Claude Code extension on Cursor planted SSH backdoors
A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. […]
Source: BleepingComputer · 2026-10-30
-
Syrian hacker who served Assad regime gets 42 months in US prison
A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison.
Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department. The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate.
Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S. and allied government bodies, prosecutors said. The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S. military to refuse their orders.
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg.
The most damaging intrusion came April 23, 2013. Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House. The post triggered a flash crash, briefly erasing $136 billion in value from the stock market.
In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S. Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts. In one instance he succeeded, prosecutors said.
The costs to victims were significant. One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses.
“This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia.
Agha and coconspirator Firas Dardar were first charged by criminal complaint June 12, 2014, and indicted May 17, 2018. Dardar remains a fugitive. He was also charged in 2015 in a separate conspiracy alongside Peter Romar, a Syrian national then living in Germany, that involved computer intrusion, extortion, money laundering and violations of the Syrian Sanctions Regulations. Romar was extradited from Germany and pleaded guilty in 2016.
Assad’s regime collapsed in December 2024, and the former president fled the country.
Source: CyberScoop · 2026-10-30