Tag: browser
-
Malicious PyPI Packages Deliver SilentSync RAT
IntroductionZscaler ThreatLabz regularly monitors for threats in the popular Python Package Index (PyPI), which contains open source libraries that are frequently used by many Python developers. In July 2025, a malicious Python package named termncolor was identified by ThreatLabz. Just a few weeks later, on August 4, 2025, ThreatLabz uncovered two more malicious Python packages…
-
New Raven Stealer Malware Hits Browsers for Passwords and Payment Data
New research reveals Raven Stealer malware that targets browsers like Chrome and Edge to steal personal data. Learn how this threat uses simple tricks like process hollowing to evade antiviruses and why it’s a growing risk for everyday users. First seen on hackread.com Jump to article: hackread.com/raven-stealer-malware-browsers-passwords-payment-data/
-
CVE-2025-10200 und CVE-2025-10201 – Sicherheitsforscher verdienen 73.000 Dollar mit Chrome-Schwachstellen
First seen on security-insider.de Jump to article: www.security-insider.de/google-chrome-sicherheitsluecken-update-a-1f4d81522be6d6c8237658eef4fb2df5/
-
CVE-2025-10200 und CVE-2025-10201 – Sicherheitsforscher verdienen 73.000 Dollar mit Chrome-Schwachstellen
First seen on security-insider.de Jump to article: www.security-insider.de/google-chrome-sicherheitsluecken-update-a-1f4d81522be6d6c8237658eef4fb2df5/
-
Hackers Hide RMM Installs as Fake Chrome Updates and Teams Invites
New research from Red Canary and Zscaler shows phishing lures now drop RMM tools like ITarian and Atera,… First seen on hackread.com Jump to article: hackread.com/hackers-rmm-installs-fake-chrome-updates-teams-invite/
-
Hackers Hide RMM Installs as Fake Chrome Updates and Teams Invites
New research from Red Canary and Zscaler shows phishing lures now drop RMM tools like ITarian and Atera,… First seen on hackread.com Jump to article: hackread.com/hackers-rmm-installs-fake-chrome-updates-teams-invite/
-
12 digital forensics certifications to accelerate your cyber career
Tags: access, apt, attack, browser, chrome, cloud, computer, corporate, cyber, cybercrime, cybersecurity, data, defense, detection, email, endpoint, exploit, google, government, group, hacker, hacking, Hardware, incident response, international, jobs, law, malicious, malware, microsoft, mobile, network, phone, service, skills, soc, technology, threat, tool, training, windowsCellebrite Certified Mobile Examiner (CCME)Certified Computer Examiner (CCE)CyberSecurity Forensic Analyst (CSFA)EC-Council Computer Hacking Forensic Investigator (CHFI)EnCase Certified Examiner (EnCE)Exterro AccessData Certified Examiner (ACE)GIAC Advanced Smartphone Forensics Certification (GASF)GIAC Certified Forensics Analyst (GCFA)GIAC Certified Forensic Examiner (GCFE)GIAC Cloud Forensic Responder (GCFR)GIAC Network Forensic Analysis (GNFA)Magnet Certified Forensics Examiner (MCFE) Cellebrite Certified Mobile Examiner (CCME) Out of…
-
Malicious Chrome Add-On Steals Facebook, Instagram Ad Credentials
A fake Chrome tool, Madgicx Plus, steals Meta ad credentials, hijacking budgets and accounts via stealthy browser exploits. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/chrome-add-on-steals-meta-ad-accounts/
-
Google fixes critical Chrome flaw, researcher earns $43K
Google addressed a critical use-after-free vulnerability in its Chrome browser that could potentially lead to code execution. A researcher earned $43000 from Google for reporting a critical Chrome vulnerability, tracked as CVE-2025-10200, in the Serviceworker component. A use-after-free (UAF) occurs when a program accesses memory after it has been freed. This can cause crashes, data…
-
Docker malware breaks in through exposed APIs, then changes the locks
The variant has creative twists: Setting the variant apart is its move to deny others access to the same Docker API, effectively monopolizing the attack surface. It tries to modify firewall settings (iptables, nft, firewall-cmd, etc.) via a cron job to drop or reject incoming connections to port 2375. A cron job is a scheduled…
-
Chrome Extension Scam Exposed: Hackers Stealing Meta Accounts
Tags: ai, browser, business, chrome, credentials, cyber, cybercrime, data-breach, hacker, malicious, scam, service, toolA sophisticated campaign targeting Meta advertisers through fake AI-powered ad optimization tools has been uncovered, with cybercriminals deploying malicious Chrome extensions to steal credentials and hijack business accounts. Cybereason Security Services has identified an evolving malicious Chrome extension campaign that specifically targets Meta (Facebook/Instagram) advertisers through a deceptive platform called >>Madgicx Plus.
-
Firefox 115 ESR: Windows 7/8.1-Support bis März 2026
Der Mozilla Firefox 115 ESR läuft unter Windows 7 / 8.1 und befindet sich seit länger Zeit im erweiterten Support. Bisher war bekannt, dass die Entwickler diese Browser-Version bis zum September 2025 unterstützen möchten. Nun haben die Mozilla-Entwickler bestätigt, dass … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/09/06/firefox-115-esr-windows-7-8-1-support-bis-maerz-2026/
-
New Exploit Bypasses Code Integrity to Backdoor Signal, 1Password, Slack, and More
A new security exploit has been discovered that lets attackers slip malicious code into widely used desktop applications including Signal, 1Password, Slack, and Google Chrome by evading built-in code integrity checks. The vulnerability, tracked as Electron CVE-2025-55305, affects nearly every app built on the Chromium engine when they use Electron, a popular framework for making…
-
CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation
Tags: android, browser, chrome, cisa, cyber, cybersecurity, exploit, flaw, infrastructure, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert for a newly discovered zero-day vulnerability in the Android Runtime component. This “use-after-free” flaw could allow attackers to escape the Chrome sandbox and elevate privileges on an affected device. CISA warns that the vulnerability is under active exploitation and urges organizations and users…
-
Judge who ruled Google is a monopoly decides to do hardly anything to break it up
Ad giant won’t be broken up, forced to offload Chrome or Android, thanks to AI First seen on theregister.com Jump to article: www.theregister.com/2025/09/03/google_doj_antitrust_ruling/
-
Google Avoids Chrome Breakup but Must Share Search Data With Competitors
The U.S. District Court for the District of Columbia today imposed landmark remedies in the Justice Department’s monopolization case against Google, ordering the tech giant to share critical search data with competitors and outlawing exclusive distribution agreements for its flagship products. The ruling stops short of forcing Google to divest its Chrome browser but mandates…
-
Chrome 140 Release Fixes Critical RCE Vulnerabilities
Tags: browser, chrome, cyber, google, linux, rce, remote-code-execution, update, vulnerability, windowsGoogle has released Chrome 140 to the stable channel for Windows, Mac, and Linux. This update will roll out to users over the coming days and weeks. The new version, 140.0.7339.80 for Linux and 140.0.7339.80/81 for Windows and Mac, delivers several security fixes and improvements. A full list of changes is available in the Chromium log.…
-
Microsoft to Retire Popular Editor Extensions on Edge and Chrome
Microsoft announced that its AI-powered Editor browser extensions for Microsoft Edge and Google Chrome will be retired effective October 31, 2025. With this move, the company aims to streamline its writing-assistance offerings by integrating the core capabilities of Microsoft Editor directly into Microsoft Edge’s built-in proofing experience. No administrative action is required; users can continue…
-
Angriffe auf npm-Lieferkette gefährden Entwicklungsumgebungen
Tags: ai, api, browser, bug, chrome, cloud, computer, control, cyberattack, data-breach, github, malware, software, supply-chain, toolAngriffe auf das NX-Build-System und React-Pakete zeigen, dass die Bedrohungen für Softwareentwicklung in Unternehmen immer größer werden.Ein ausgeklügelter Supply-Chain-Angriff hat das weit verbreitete Entwickler-Tool Nx-Build-System-Paket kompromittiert, das über den Node Package Manager (npm) installiert und verwendet wird. Dadurch wurden zahlreiche Anmeldedaten von Entwicklern offengelegt. Laut einem neuen Bericht des Sicherheitsunternehmens Wiz wurden bei dieser Kampagne…
-
Angriffe auf npm-Lieferkette gefährden Entwicklungsumgebungen
Tags: ai, api, browser, bug, chrome, cloud, computer, control, cyberattack, data-breach, github, malware, software, supply-chain, toolAngriffe auf das NX-Build-System und React-Pakete zeigen, dass die Bedrohungen für Softwareentwicklung in Unternehmen immer größer werden.Ein ausgeklügelter Supply-Chain-Angriff hat das weit verbreitete Entwickler-Tool Nx-Build-System-Paket kompromittiert, das über den Node Package Manager (npm) installiert und verwendet wird. Dadurch wurden zahlreiche Anmeldedaten von Entwicklern offengelegt. Laut einem neuen Bericht des Sicherheitsunternehmens Wiz wurden bei dieser Kampagne…
-
8 bösartige Open-Source-Pakete, die auf WindowsBenutzerdaten abzielen
JFrog, das Liquid-Software-Unternehmen gibt die Entdeckung von acht bösartigen Paketen bekannt, die auf npm, einem der weltweit größten Repositorys für Open-Source-Javascript-Komponenten, veröffentlicht wurden. Die Pakete, darunter react-sxt (Version 2.4.1), react-typex (Version 0.1.0) und react-native-control (Version 2.4.1), wurden von böswilligen npm-Benutzern hochgeladen. Sie enthielten eine hochentwickelte multi-layer Verschleierung mit über 70 Layers versteckten Codes, die es Angreifern ermöglichte,…
-
When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
As enterprises continue to shift their operations to the browser, security teams face a growing set of cyber challenges. In fact, over 80% of security incidents now originate from web applications accessed via Chrome, Edge, Firefox, and other browsers. One particularly fast-evolving adversary, Scattered Spider, has made it their mission to wreak havoc on enterprises…
-
8 Malicious NPM Packages Stole Chrome User Data on Windows
JFrog researchers found eight malicious NPM packages using 70 layers of obfuscation to steal data from Chrome browser… First seen on hackread.com Jump to article: hackread.com/malicious-npm-packages-stole-chrome-user-data-windows/
-
Google Big Sleep AI Tool Finds Critical Chrome Vulnerability
Make sure your Chrome browser is updated to the latest version to stay protected. First seen on hackread.com Jump to article: hackread.com/google-big-sleep-ai-tool-critical-chrome-vulnerability/
-
China Hijacks Captive Portals to Spy on Asian Diplomats
The Mustang Panda APT is hijacking Google Chrome browsers when they attempt to connect to new networks and redirecting them to phishing sites. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/china-hijacks-captive-portals-spy-asian-diplomats
-
Critical Chrome UseFree Flaw Enables Arbitrary Code Execution
Google has released an urgent security update for the Chrome Stable channel to address acritical use-after-free vulnerabilityin the ANGLE graphics library that could allow attackers to execute arbitrary code on vulnerable systems. The fixes arrive as part of Chrome Stable versions 139.0.7258.154/.155 on Windows and macOS, and 139.0.7258.154 on Linux. Users are advised to update immediately, as the patch…
-
TDL003 – Breaking Barriers: IPv6 Adoption and DNS Transformation with Tommy Jensen
Tags: access, ai, apple, attack, backup, banking, browser, business, ceo, chrome, ciso, compliance, computer, computing, control, country, credentials, cybersecurity, data, data-breach, ddos, dns, encryption, endpoint, google, government, group, international, Internet, jobs, law, microsoft, mobile, network, phishing, phone, privacy, programming, radius, risk, service, smishing, strategy, switch, technology, threat, update, vpn, windows, zero-trustSummary This episode of the Defender’s Log features special guest Tommy Jensen, an internet technologist specializing in IPv6, Zero Trust, and standards. Jensen’s career path, from an AppleCare contractor to a key figure in advancing internet technologies, is explored. The discussion highlights the critical importance and challenges of migrating to IPv6 and the necessity of…
-
PoC Exploit Published for Chrome 0-Day Already Under Active Attack
A proof-of-concept exploit for a high-severity Google Chrome zero-day vulnerability has been published publicly, less than three months after the flaw was first disclosed, amid reports of active in-the-wild exploitation. The vulnerability, tracked as CVE-2025-5419, stems from out-of-bounds reads and writes in Chrome’s V8 JavaScript engine, affecting versions prior to 137.0.7151.68 and opening the door…
-
PoC Exploit Published for Chrome 0-Day Already Under Active Attack
A proof-of-concept exploit for a high-severity Google Chrome zero-day vulnerability has been published publicly, less than three months after the flaw was first disclosed, amid reports of active in-the-wild exploitation. The vulnerability, tracked as CVE-2025-5419, stems from out-of-bounds reads and writes in Chrome’s V8 JavaScript engine, affecting versions prior to 137.0.7151.68 and opening the door…
-
Chrome-Erweiterung FreeVPN.One zeichnete Screenshots von Seitenbesuchen auf
Wer bisher glaubte, dass Microsofts Recall in Punkto Überwachung an der Spitze liegt, muss umdenken. Sicherheitsforscher sind auf die Erweiterung FreeVPN.One des Google Chrome-Browsers gestoßen. Diese fertigte Screenshots von allen besuchten Seiten an und sammelte weitere Daten. Die Erweiterung ist … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/08/24/chrome-erweiterung-freevpn-one-zeichnet-screenshots-von-seitenbesuchen-auf/