AI is spreading faster than any major technology in history, according to a Microsoft report. More than 1.2 billion people have used an AI tool within three years of the first mainstream releases. The growth is fast, but it puts uneven pressure on governments, industries, and security teams. Adoption grows at record speed The internet, radio, and smartphone all grew quickly. AI has grown faster. Adoption is strongest in countries that invested early in connectivity … More →
The post The next tech divide is written in AI diffusion appeared first on Help Net Security.
JonMon-Lite is a research proof-of-concept “Remote Agentless EDR” that creates an ETW Trace Session through a Data Collector
The post JonMon-Lite: The Remote Agentless EDR Proof-of-Concept for ETW Trace Monitoring appeared first on Penetration Testing Tools.
Ahead of the major pre-holiday sales, a new cause for concern has emerged: popular children’s toys equipped with
The post Dangerously Unsafe: AI Toys Like Kumma and Miko 3 Give Children Harmful Instructions appeared first on Penetration Testing Tools.
Ensuring that older software continues to function on newer versions of Windows has been a challenge shadowing Microsoft
The post Handcrafted Fixes & Secret Patches: The Wild History of Windows 95 Compatibility appeared first on Penetration Testing Tools.
The payment service Checkout.com has faced an extortion attempt: the ShinyHunters group claimed to have obtained data linked
The post ShinyHunters Extortion: Checkout.com Hacked via Neglected Legacy Cloud Storage appeared first on Penetration Testing Tools.
A Chinese cyber-espionage group designated by Anthropic as GTG-1002 exploited the capabilities of the Claude Code model in
The post First AI-Orchestrated Cyber-Espionage: Claude Code Executed 80%+ of China-Linked Intrusion appeared first on Penetration Testing Tools.
一款具备基础勒索软件功能、疑似借助AI生成的恶意扩展，已被发布至微软官方VS Code应用市场。该扩展名为susvsex，发布者为“suspublisher18”，其恶意功能在描述中被公然标注。
Secure Annex公司研究员John Tuckner发现了这款扩展，他表示该扩展是“氛围编程”的产物，技术复杂度较低。
尽管Tuckner已举报该扩展及其明确的功能描述——其中披露会将文件窃取至远程服务器，并通过AES-256-CBC算法加密所有文件，但微软未采纳其举报，也未将该扩展从VS Code应用市场移除。
勒索软件扩展的工作原理
该扩展会在任意事件触发时激活，包括安装完成时或VS Code启动时，随后初始化包含硬编码变量（IP地址、加密密钥、命令与控制服务器地址）的“extension.js”文件。
Tuckner指出：“这些变量中多数带有注释，表明代码并非发布者直接编写，极有可能是通过AI生成的。”激活后，扩展会调用名为zipUploadAndEncrypt的函数，检查标记文本文件是否存在，随后启动加密流程。
它会将指定目标目录下的文件压缩为ZIP归档文件，窃取至硬编码的命令与控制（C2）服务器地址，之后用加密版本替换所有原始文件。
数据盗窃例程
该扩展会轮询一个私人GitHub仓库获取指令，定期检查需通过个人访问令牌（PAT）验证的“index.html”文件，并尝试执行其中的所有命令。
借助硬编码的PAT令牌，研究员成功获取了主机信息，并发现该仓库的所有者疑似位于阿塞拜疆。由于该扩展是公然的威胁，其发布可能是为了测试微软的审核流程。
VS Code 市场上的勒索软件扩展
Secure Annex将susvsex称为“AI slop”，其恶意行为在自述文件（README）中完全暴露，但同时指出，只需稍作修改，这款扩展的危险性将大幅提升。 目前susvsex已被下架。
Microsoft has finally closed the loophole that long sustained one of the most widespread illicit methods of activating
The post KMS38 Loophole Closed: Microsoft Finally Kills Offline Windows Activation Method appeared first on Penetration Testing Tools.
Red Hat compiler engineer Marek Polacek has proposed making the C++20 standard — more precisely, the GNU++20 dialect
The post C++20 Default: Red Hat Proposes Making the Latest Standard the Default in GCC appeared first on Penetration Testing Tools.
A serious issue has been uncovered in the digital photo-frame market: Android-based devices sold under the Uhale brand
The post Uhale Digital Photo Frames Ship with Root Access and Download Hidden Malware appeared first on Penetration Testing Tools.