Voice-Phishing Attacks Breach Four Major Canadian Law Firms

Article Link: https://www.theglobeandmail.com/business/article-law-firms-hackers-how-did-it-happen-client-files-voice-phishing/

• Four of Canada’s largest law firms were breached after attackers used voice phishing, or vishing, to impersonate internal IT staff over Microsoft Teams and spoofed phone calls, convincing employees to grant access to company systems.
• The callers cited expired passwords or software updates, then directed victims to fraudulent sign-in pages capable of bypassing multifactor authentication. At least seven employee accounts were compromised across the four firms.
• The intrusions exposed sensitive client material, including corporate information, legal communications, and tax, financial, or health records. A source involved in McCarthy Tétrault’s response said 31,000 files were stolen.
• Law firms are sharing intelligence and response practices, while Google recommends phishing-resistant multifactor authentication. Experts also stress transparency with affected clients and greater skepticism toward unexpected IT requests, especially in large organizations where employees may not know support staff personally.

What does this mean for me?

• A caller’s phone number, Teams account, or display name may look legitimate but still be fraudulent. Never enter your credentials into a website, approve a multifactor authentication request, or follow account-recovery instructions unless you personally initiated the request or have confirmed it with your organization’s IT team.

Default ‘admin:admin’ Password Let Researchers Take Over Connected-Car Accounts

Article Link: https://thehackernews.com/2026/11/default-adminadmin-server-password.html

• Researchers found that login systems behind two automakers’ mobile apps still exposed an administrative console protected by the documented default username and password, “admin” and “admin,” creating a path into customer accounts.
• The console was not directly internet-accessible, but encoded web requests caused edge defenses and the backend server to interpret the same address differently, allowing researchers to reach the hidden management interface.
• From there, they changed account email addresses and passwords, obtained legitimate access tokens, and used connected-car commands to unlock doors and start test vehicles belonging to themselves or consenting owners.
• The issue was fixed roughly two hours after disclosure. Ping Identity’s guidance already calls for removing the Apache Felix console or changing its default password, and warns against relying on path filtering alone to protect administrative interfaces.

What does this mean for me?

• Small security mistakes can have significant consequences when systems control physical devices. This incident highlights why organizations should remove default passwords, disable unnecessary administrative tools, and regularly review system configurations rather than relying solely on perimeter security controls to protect sensitive systems.

Hackers Exploit ‘SSHole’ Authentication Bypass in OpenSSH

Article Link: https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/

• Attackers have begun exploiting CVE-2026-123158, dubbed SSHole, a recently patched OpenSSH authentication bypass that can allow access to certain Linux accounts by supplying unusually long passwords.
• The flaw affects systems using the musl C library with PAM disabled, including Alpine, Buildroot, and Yocto. Under specific conditions, OpenSSH can mistakenly treat a failed password-hash comparison as valid and grant entry without normal authentication.
• WatchTowr says botnets and crypto miners are currently exploiting the bug, while Previdian observed 20 attempts from 13 attacker IP addresses across nine countries between November 6 and November 8, showing active scanning soon after disclosure.
• Users are directed to update to OpenSSH 10.6p2, restart the SSH service, disable password authentication or SSH where practical, and review logs for unusually long password attempts or other suspicious login activity.

What does this mean for me?

• Cybercriminals often begin exploiting newly disclosed vulnerabilities within days of a fix becoming available. While this specific flaw affects server administrators, it reinforces why software updates, security patches, and scheduled maintenance should be applied promptly. Delaying updates can leave organizations exposed to attacks that are already being actively used in the wild.

Fake Security Tools on GitHub Push Backdoors and Information Stealers

Article Link: https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/

• Researchers at Dr. Web found malicious GitHub projects disguised as tools for network scanning, testing, and log analysis, with more than 2,000 Windows systems compromised in a campaign active for roughly two years.
• Attackers hide malicious code inside Visual Studio projects, Python scripts, and Go source files, sometimes burying it behind long stretches of whitespace or triggering execution before compilation begins.
• The infection chain installs a loader that can disable Windows protections, interfere with recovery features, elevate privileges, and deploy AsyncRAT, clipboard-hijacking malware, and an information stealer that collects browser, VPN, gaming, FTP, and Discord data.
• Dr. Web published indicators of compromise covering the malicious files, infrastructure, and activity associated with the campaign. The researchers also found malware designed to remove antivirus products, interfere with updates, and disrupt Windows backups, giving defenders additional behaviors to investigate on potentially affected systems.

What does this mean for me?

• Attackers often disguise malware as useful software, productivity tools, or troubleshooting utilities. Be cautious when downloading files, scripts, browser extensions, or applications from the internet, even when they appear professional or are hosted on well-known platforms.

React Server Components Flaw Allows Remote Code Execution Without Login

Article Link: https://cybersecuritynews.com/react-server-components-vulnerability-patch/

• React disclosed a high-severity flaw in React Server Components that can let an unauthenticated attacker execute code remotely against affected applications without any user interaction.
• The issue involves specially crafted responses containing multiple typed arrays and attacker-controlled data. Exploitation requires a rare application pattern, meaning simply using React does not automatically make every environment vulnerable.
• Affected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across several React 19 releases. The advisory says applications without server-side React code or supporting frameworks, bundlers, or plugins are not exposed.
• React recommends upgrading affected packages immediately to patched releases 19.0.9, 19.1.10, 19.2.9, or 19.3.1. Teams are directed to verify installed server-dom versions against the official affected ranges rather than rely on older guidance, and as of now no active exploitation has been reported.

What does this mean for me?

• Not every critical vulnerability affects every organization, but determining exposure requires organizations to understand what technologies they use and where they are deployed. This reinforces the importance of maintaining accurate software inventories and promptly applying vendor-recommended security updates when they become available.

Microsoft Warns Fake Game Downloads Are Secretly Monetizing Windows PCs

Article Link: https://cybersecuritynews.com/microsoft-warns-fake-game-downloads/

• Microsoft warns that fake game downloads, cracked software installers, activators, audio plugins, and unofficial tools are being used to turn Windows PCs into revenue-generating assets without users realizing it.
• The deceptive installers can deliver multiple components in one session, including software that shares internet bandwidth, runs distributed-computing workloads, or installs unwanted utilities, giving operators several ways to profit from a single victim.
• Microsoft observed WorldProxyPool proxy software, CharityEngine and BOINC computing components, and Advanced Windows Manager utilities. Some packages create scheduled tasks, run hidden PowerShell processes, and maintain recurring background activity with elevated privileges.
• Microsoft recommends avoiding cracked software and unofficial installers, enabling cloud-delivered protection, tamper protection, and reputation-based controls, and reviewing software inventories for unexpected applications. Investigators can also correlate suspicious installers with network callbacks and newly created scheduled tasks.

What does this mean for me?

• Downloading cracked software, game mods, unofficial utilities, or “free” versions of paid software can do more than install malware. These programs may secretly use your computer’s processing power, internet connection, and system resources to make money for someone else, slowing down your device and creating security risks without your knowledge.