Loading story…
Researchers disclosed Bit2Watt, a cyber-physical attack concept in which a malicious cloud tenant uses legitimate-looking AI training jobs to rapidly modulate GPU power demand and destabilize the electrical systems feeding AI datacenters. The technique does not require malware or direct access to utility or operational technology networks; instead, it abuses authorized user-level control of GPU workloads to create oscillations in electricity demand that can propagate through data-center power infrastructure. In modeled tests on a 1 MW local grid with distributed or renewable-heavy energy resources, synchronized activity from 1,000 GPUs produced 46.8% total harmonic distortion and introduced an unstable mode with a -0.27 damping ratio, conditions the researchers said could trigger voltage excursions, equipment stress, load shedding, cascading failures, or blackouts.
The research also described Watt2Bit, a related side-channel and disruption concept in which power modulation or electrical stress can be used for covert signaling, data leakage, or denial-of-service effects against GPU operations. A proof of concept reportedly recovered a 50-bit test sequence using frequency-shift keying, underscoring that power behavior itself can become an attack surface. The authors recommended cross-layer mitigations including cloud workload monitoring tied to electrical telemetry, limits on tightly synchronized GPU jobs, distribution of workloads across separate power domains, stronger power-electronics protections, local energy buffering, and closer coordination between cloud scheduling teams and power-system engineers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The researchers also described Watt2Bit, a related side-channel concept involving covert data exfiltration via power modulation. One source says they recovered a 50-bit test sequence using frequency-shift keying as a proof of concept.
Researchers from Zhejiang University described Bit2Watt, a cyber-physical attack concept in which a malicious cloud tenant uses specially crafted GPU workloads to destabilize AI datacenters and the supporting power grid. The reported modeling showed synchronized GPU demand could induce voltage excursions, harmonic distortion, damping degradation, and potentially cascading failures or blackouts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecyberaccord.com
Open sourcetheregister.com
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two GPU-based Rowhammer techniques, **`GDDRHammer`** and **`GeForge`**, that can induce bit flips in GDDR6 VRAM on certain Nvidia GPUs and break memory isolation. Tests showed the attacks against Ampere-era cards including the **RTX 3060** and **RTX A6000/RTX 6000**, where corrupted GPU page tables or page directories allowed attackers to gain read/write access to protected VRAM regions and, in some cases, remap access into host memory. The researchers said this could escalate from GPU compromise to **full control of the machine**, including root-level access to system memory. The reports said the attacks require an adversary to already run code on the target system, making shared GPU environments such as AI clusters a more plausible risk than a purely remote attack path. No in-the-wild exploitation has been reported, but the findings highlight a hardware security gap in systems where GPUs can directly access host memory. Recommended mitigations include enabling **IOMMU** in BIOS to restrict device DMA access to sensitive system memory and turning on **ECC** on supported GPUs, though both measures can impose performance or memory-capacity tradeoffs and ECC may not block every Rowhammer variant.
Jun 29, 2026
Security researchers have demonstrated new hardware-based techniques to extract sensitive data from devices previously considered secure, including smartwatches and confidential computing servers. In one case, analysts revived the 'Blinkenlights' technique, adapting it to modern TFT screens to extract firmware from a budget smartwatch by exploiting a dial parser vulnerability. This allowed arbitrary memory content to be displayed on the device's screen, which was then captured using a high-speed Raspberry Pi Pico setup. The smartwatch, which contained fake health sensors and used a JieLi AC6958C6 system-on-chip, was found to have weak authentication and a flawed firmware parser, enabling the out-of-bounds read attack. Separately, researchers from KU Leuven University presented a low-cost hardware attack called 'Battering RAM' at Black Hat Europe 2025, which targets secure CPU enclaves such as Intel SGX and AMD SEV. By using a $50 DDR4 interposer, the researchers manipulated memory address mapping at runtime, bypassing firmware mitigations and gaining unauthorized access to encrypted memory. This allowed them to extract platform provisioning keys, forge attestation reports, and implant persistent backdoors on protected virtual machines, raising concerns about the security of cloud infrastructures relying on these technologies.
Jun 29, 2026
Security researchers reported an emerging web attack technique that uses **generative AI** to turn a benign webpage into a malicious phishing or credential-stealing page *at runtime*. In a proof of concept attributed to Palo Alto Networks’ **Unit 42**, a “clean” page embeds instructions that trigger calls to public LLM APIs (e.g., Google Gemini, DeepSeek) to generate malicious JavaScript after the victim loads the site; the code is then executed in the browser, leaving little or no static payload to detect. Because the generated content is fetched from trusted AI service domains, the approach can also reduce the effectiveness of some network filtering and static analysis controls. Separately, an Anthropic evaluation highlighted that modern AI models are increasingly capable of conducting **multi-stage network attacks** using only standard, open-source tooling rather than specialized custom toolkits. The write-up notes that Claude Sonnet 4.5 could, in some simulated environments, identify a known public CVE and produce working exploit code quickly enough to exfiltrate sensitive data in an Equifax-like breach simulation, underscoring how AI can compress attacker timelines and increase the importance of fundamentals such as rapid patching and vulnerability management.
Jun 29, 2026