#data_exfiltration — Public Fediverse posts

US Hospital Finance Software Provider Craneware Reports Data Theft in Cyber Incident - https://www.redpacketsecurity.com/us-hospital-finance-software-provider-craneware-reports-data-theft/

#threatintel #Craneware #healthcare_cyberattack #data_exfiltration

US Hospital Finance Software Provider Craneware Reports Data Theft in Cyber Incident - https://www.redpacketsecurity.com/us-hospital-finance-software-provider-craneware-reports-data-theft/

#threatintel #Craneware #healthcare_cyberattack #data_exfiltration

Canvas Data Breach Analysis: CMC Releases Guidance for UK Education Sector After Instructure Incident - https://www.redpacketsecurity.com/cmc-releases-analysis-and-guidance-for-education-sector-after-canvas-data-breach/

#threatintel #Canvas_breach #data_exfiltration #incident_response

Canvas Data Breach Analysis: CMC Releases Guidance for UK Education Sector After Instructure Incident - https://www.redpacketsecurity.com/cmc-releases-analysis-and-guidance-for-education-sector-after-canvas-data-breach/

#threatintel #Canvas_breach #data_exfiltration #incident_response

JetBrains Marketplace Plugins Stealing AI API Keys: Security Researchers Find 15 Malicious IDE Extensions - https://www.redpacketsecurity.com/fifteen-jetbrains-marketplace-plugins-found-stealing-api-keys/

#threatintel #IDE_plugins #AI_api_key_theft #data_exfiltration

JetBrains Marketplace Plugins Stealing AI API Keys: Security Researchers Find 15 Malicious IDE Extensions - https://www.redpacketsecurity.com/fifteen-jetbrains-marketplace-plugins-found-stealing-api-keys/

#threatintel #IDE_plugins #AI_api_key_theft #data_exfiltration

𝐔𝐧𝐢𝐯𝐞𝐫𝐬𝐢𝐭𝐚𝐭 𝐝𝐞 𝐕𝐚𝐥𝐞̀𝐧𝐜𝐢𝐚 𝐓𝐚𝐫𝐠𝐞𝐭𝐞𝐝 𝐛𝐲 𝐍𝐨𝐯𝐚 𝐆𝐫𝐨𝐮𝐩: 𝟑𝟎𝟎𝐆𝐁 𝐃𝐚𝐭𝐚 𝐄𝐱𝐟𝐢𝐥𝐭𝐫𝐚𝐭𝐢𝐨𝐧 𝐂𝐥𝐚𝐢𝐦𝐞𝐝, 𝐈𝐧𝐢𝐭𝐢𝐚𝐥 $𝟓𝟎𝟎,𝟎𝟎𝟎 𝐑𝐚𝐧𝐬𝐨𝐦 𝐃𝐞𝐦𝐚𝐧𝐝 𝐑𝐞𝐯𝐞𝐚𝐥𝐞𝐝

News of the attack was initially reported by the online newspaper Escudo Digital in an article by journalist Alberto Payo, which included statements attributed to a member of the university’s IT team. These details are now complemented by statements provided exclusively to SuspectFile.com directly by the Nova group, introducing additional information that had not previously emerged publicly, including an alleged initial ransom demand of $500,000.

https://www.suspectfile.com/universitat-de-valencia-targeted-by-nova-group-300gb-data-exfiltration-claimed-initial-500000-ransom-demand-revealed/

#Data_Breach #Data_Exfiltration #Nova #Ransomoware #Universitat_de_València

𝐔𝐧𝐢𝐯𝐞𝐫𝐬𝐢𝐭𝐚𝐭 𝐝𝐞 𝐕𝐚𝐥𝐞̀𝐧𝐜𝐢𝐚 𝐓𝐚𝐫𝐠𝐞𝐭𝐞𝐝 𝐛𝐲 𝐍𝐨𝐯𝐚 𝐆𝐫𝐨𝐮𝐩: 𝟑𝟎𝟎𝐆𝐁 𝐃𝐚𝐭𝐚 𝐄𝐱𝐟𝐢𝐥𝐭𝐫𝐚𝐭𝐢𝐨𝐧 𝐂𝐥𝐚𝐢𝐦𝐞𝐝, 𝐈𝐧𝐢𝐭𝐢𝐚𝐥 $𝟓𝟎𝟎,𝟎𝟎𝟎 𝐑𝐚𝐧𝐬𝐨𝐦 𝐃𝐞𝐦𝐚𝐧𝐝 𝐑𝐞𝐯𝐞𝐚𝐥𝐞𝐝

News of the attack was initially reported by the online newspaper Escudo Digital in an article by journalist Alberto Payo, which included statements attributed to a member of the university’s IT team. These details are now complemented by statements provided exclusively to SuspectFile.com directly by the Nova group, introducing additional information that had not previously emerged publicly, including an alleged initial ransom demand of $500,000.

https://www.suspectfile.com/universitat-de-valencia-targeted-by-nova-group-300gb-data-exfiltration-claimed-initial-500000-ransom-demand-revealed/

#Data_Breach #Data_Exfiltration #Nova #Ransomoware #Universitat_de_València

🎯 AI
===================

Executive summary: Urban VPN Proxy, a Chrome extension with over 6 million users, was observed harvesting AI chat data across multiple platforms. The extension injects platform-specific executor scripts, overrides core browser network APIs, and forwards captured conversations to Urban VPN infrastructure.

Technical details:
• The extension deploys dedicated executor scripts (examples: chatgpt.js, claude.js, gemini.js) when targeted AI platform pages load.
• Injected code wraps and overrides fetch and XMLHttpRequest so all request and response payloads for the page flow through the extension first.
• Extracted fields include user prompts, model responses, conversation IDs, timestamps, session metadata, and the specific AI platform/model used.
• Inter-script messaging uses window.postMessage with an identifier PANELOS_MESSAGE to pass parsed data to the extension content script.
• The content script forwards packaged, compressed data to the background service worker, which transmits to endpoints such as analytics.urban-vpn.com and stats.urban-vpn.com.

Analysis:
• The approach is highly invasive: overriding fetch/XMLHttpRequest captures both outgoing prompts and incoming model outputs before rendering, exposing full conversation context.
• Harvesting is independent of VPN functionality and enabled by hardcoded flags with no user-visible opt-out, increasing exposure risk for users who installed the extension for privacy reasons.

Detection guidance:
• Monitor outbound connections to analytics.urban-vpn.com and stats.urban-vpn.com from browser processes.
• Inspect loaded extension scripts for executor filenames and for patterns overriding fetch/XMLHttpRequest and using window.postMessage with PANELOS_MESSAGE.

Limitations:
• Public reporting indicates the extension targeted ten AI platforms; specific historical timeline details were not fully enumerated in the source.
• No CVE identifiers or named threat actor attribution were provided in the disclosed findings.

References / Tags:
chatgpt.js, claude.js, PANELOS_MESSAGE, analytics.urban-vpn.com

🔹 ai #privacy #browser_extension #data_exfiltration

🔗 Source: https://www.koi.ai/blog/urban-vpn-browser-extension-ai-conversations-data-collection

🎯 AI
===================

Executive summary: Urban VPN Proxy, a Chrome extension with over 6 million users, was observed harvesting AI chat data across multiple platforms. The extension injects platform-specific executor scripts, overrides core browser network APIs, and forwards captured conversations to Urban VPN infrastructure.

Technical details:
• The extension deploys dedicated executor scripts (examples: chatgpt.js, claude.js, gemini.js) when targeted AI platform pages load.
• Injected code wraps and overrides fetch and XMLHttpRequest so all request and response payloads for the page flow through the extension first.
• Extracted fields include user prompts, model responses, conversation IDs, timestamps, session metadata, and the specific AI platform/model used.
• Inter-script messaging uses window.postMessage with an identifier PANELOS_MESSAGE to pass parsed data to the extension content script.
• The content script forwards packaged, compressed data to the background service worker, which transmits to endpoints such as analytics.urban-vpn.com and stats.urban-vpn.com.

Analysis:
• The approach is highly invasive: overriding fetch/XMLHttpRequest captures both outgoing prompts and incoming model outputs before rendering, exposing full conversation context.
• Harvesting is independent of VPN functionality and enabled by hardcoded flags with no user-visible opt-out, increasing exposure risk for users who installed the extension for privacy reasons.

Detection guidance:
• Monitor outbound connections to analytics.urban-vpn.com and stats.urban-vpn.com from browser processes.
• Inspect loaded extension scripts for executor filenames and for patterns overriding fetch/XMLHttpRequest and using window.postMessage with PANELOS_MESSAGE.

Limitations:
• Public reporting indicates the extension targeted ten AI platforms; specific historical timeline details were not fully enumerated in the source.
• No CVE identifiers or named threat actor attribution were provided in the disclosed findings.

References / Tags:
chatgpt.js, claude.js, PANELOS_MESSAGE, analytics.urban-vpn.com

🔹 ai #privacy #browser_extension #data_exfiltration

🔗 Source: https://www.koi.ai/blog/urban-vpn-browser-extension-ai-conversations-data-collection

Ransomware Attacks Focus on Data Exfiltration Over Encryption - https://www.redpacketsecurity.com/only-a-fifth-of-ransomware-attacks-now-encrypt-data/

#threatintel #cybersecurity #ransomware #data_exfiltration

Ransomware Attacks Focus on Data Exfiltration Over Encryption - https://www.redpacketsecurity.com/only-a-fifth-of-ransomware-attacks-now-encrypt-data/

#threatintel #cybersecurity #ransomware #data_exfiltration

Chemical Facilities Warned of Possible Data Exfiltration Following CISA Breach - https://www.redpacketsecurity.com/chemical-facilities-warned-of-possible-data-exfiltration-following-cisa-breach/

#threatintel #cybersecurity_breach #data_exfiltration #chemical_security

Chemical Facilities Warned of Possible Data Exfiltration Following CISA Breach - https://www.redpacketsecurity.com/chemical-facilities-warned-of-possible-data-exfiltration-following-cisa-breach/

#threatintel #cybersecurity_breach #data_exfiltration #chemical_security

Russian Coldriver Hackers Deploy Malware to Target Western Officials - https://www.redpacketsecurity.com/russian-coldriver-hackers-deploy-malware-to-target-western-officials/

#threatintel #Coldriver_malware #Russian_threat_group #Data_exfiltration

Russian Coldriver Hackers Deploy Malware to Target Western Officials - https://www.redpacketsecurity.com/russian-coldriver-hackers-deploy-malware-to-target-western-officials/

#threatintel #Coldriver_malware #Russian_threat_group #Data_exfiltration