Tagged articles

data exfiltration

7 articles · Page 1 of 1

Aug 8, 2026 · Information Security

Embedding an Entire Website Inside a Favicon: What the Experiment Reveals

The author demonstrates that a favicon—an 8×8‑pixel PNG image—can store a complete 166‑byte HTML page by encoding each byte into the RGB channels of individual pixels, then analyzes how this steganographic technique can bypass file‑type checks, evade CSP img‑src restrictions, and serve as a covert data channel, while noting its limited practical value for legitimate web publishing.

CSPHTML injectiondata exfiltration

0 likes · 14 min read

Embedding an Entire Website Inside a Favicon: What the Experiment Reveals

Black & White Path

Jul 31, 2026 · Information Security

Outlook Zero‑Day Attack: Opening an Email Triggers Execution via OWA HTML Mis‑handling

TA488’s recent campaign exploits CVE‑2026‑42897, a stored XSS in Outlook Web Access that runs malicious JavaScript simply by opening an email, delivering the OWAReaper browser backdoor with multi‑layer persistence, credential theft, and data exfiltration via GitHub, CDN and DNS tunnels.

C2CVE-2026-42897Credential Theft

0 likes · 13 min read

Outlook Zero‑Day Attack: Opening an Email Triggers Execution via OWA HTML Mis‑handling

Black & White Path

Jul 14, 2026 · Information Security

How Grok Build Turns Your Code into a Data Vacuum

Security researchers discovered that xAI's Grok Build CLI silently uploads an entire Git repository—including .env files, API keys, and full commit history—to a Google Cloud bucket, sending about 5.1 GB of data when only 192 KB is needed, exposing severe privacy and design flaws.

AI coding toolGoogle CloudGrok Build

0 likes · 14 min read

How Grok Build Turns Your Code into a Data Vacuum

Black & White Path

Mar 18, 2026 · Information Security

How Israel’s Red Alert App Became a Spy Tool: War Anxiety Exploited by Hackers

Security firm CloudSEK uncovered a sophisticated smishing campaign that disguises a fake Red Alert APK as an official wartime update, allowing attackers to steal contacts, messages, GPS data and verification codes, turning a life‑saving warning app into a serious information‑security threat.

AndroidRed Alertdata exfiltration

0 likes · 8 min read

How Israel’s Red Alert App Became a Spy Tool: War Anxiety Exploited by Hackers

IT Services Circle

Jan 22, 2026 · Information Security

How Malicious Browser Extensions Turned 8.8M Users into Data Spies

A recent security investigation reveals that over 300 seemingly harmless browser extensions were covertly hijacked by the DarkSpectre campaign, silently collecting browsing history, meeting data, and other personal information from more than 8.8 million users across Chrome, Edge, and Firefox for up to seven years.

browser extensionsdata exfiltrationinformation security

0 likes · 9 min read

How Malicious Browser Extensions Turned 8.8M Users into Data Spies

Liangxu Linux

May 8, 2020 · Information Security

How Hackers Can Leak Data from Air‑Gapped PCs Using Fan Vibrations

Researchers demonstrate that even computers isolated from networks can exfiltrate secret data by modulating fan speed to create vibrations that a nearby smartphone’s accelerometer can capture and decode, revealing a new low‑bandwidth side‑channel attack called AiR‑ViBeR.

air-gapdata exfiltrationfan vibration

0 likes · 8 min read

How Hackers Can Leak Data from Air‑Gapped PCs Using Fan Vibrations

Architect

Dec 9, 2015 · Information Security

Data Exfiltration Techniques via OS Command Injection Using Netcat, cURL, Wget, SMB, Telnet, ICMP and DNS

The article explains how OS command injection can be leveraged for blind data exfiltration and demonstrates practical techniques using tools such as Netcat, cURL, Wget, SMB, Telnet, ICMP and DNS, along with preventive measures to mitigate such vulnerabilities.

DNSICMPOS command injection

0 likes · 10 min read

Data Exfiltration Techniques via OS Command Injection Using Netcat, cURL, Wget, SMB, Telnet, ICMP and DNS