Tag: cyber
-
>>Nomad Leopard<< Spotted in the Wild: Cyber Espionage Campaign Targets Afghan Government
The post >>Nomad Leopard<< Spotted in the Wild: Cyber Espionage Campaign Targets Afghan Government appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/nomad-leopard-spotted-in-the-wild-cyber-espionage-campaign-targets-afghan-government/
-
Russian Hacktivists Intensify Disruptive Cyber Pressure on UK Orgs
UK NCSC warned of disruptive cyber attacks by Russian hacktivists targeting critical infrastructure First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russia-cyber-pressure-uk-orgs/
-
Visual Studio Code Abused in Sophisticated Multistage Malware Attacks
A newly analyzed campaign dubbed “Evelyn Stealer” is turning the Visual Studio Code (VSC) extension ecosystem into an attack delivery platform, enabling threat actors to compromise software developers and pivot deeper into enterprise environments. The campaign abuses seemingly legitimate extensions including a “Bitcoin Black” theme and a “Codo AI” coding assistant as the initial lure.…
-
Windows SMB Client Vulnerability Exposes Organizations to Full Active Directory Compromise
A severe vulnerability in Windows Server Message Block (SMB) client authentication hasemergedas a critical threat to Active Directory environments. CVE-2025-33073, a logical flaw in NTLM reflection handling, enables authenticated attackers to escalate to SYSTEM-level privileges and compromise domain controllers, potentially allowing them to take over entire Active Directory forests. Field Value CVE ID CVE-2025-33073 Vulnerability…
-
Cybercriminals Impersonate Malwarebytes to Steal User Credentials
As part of an ongoing effort to highlight active and technically interesting intrusions, a new “Flash Hunting Findings” investigation has uncovered a short but well”‘structured malware campaign impersonating MalwareBytes to deliver infostealers and steal user logins and crypto”‘wallet data. The activity was observed between January 11 and January 15, 2026, and is characterized by consistent…
-
Attackers Abuse WSL2 to Operate Undetected on Windows Systems
Windows Subsystem for Linux (WSL) has transformed the developer experience on Windows. However, it has also quietly created a powerful hiding place for attackers. With WSL2, Microsoft moved from lightweight translation to a whole virtual machine (VM) model. That architectural change gives adversaries a semi-isolated Linux environment running inside Hyper”‘V that is rarely monitored by…
-
Attackers Rerouted Employee Pay Without Breaching IT Systems
An unnamed organization recently discovered that several employees’ paychecks had silently vanished not because of a ransomware attack, data-wiping malware, or a cloud breach, but because an attacker convinced people to do exactly what they wanted. Instead of hacking through firewalls or exploiting zero-days, the threat actor went after the weakest link: operational processes and…
-
Spear-Phishing Campaign Leverages Google Ads to Distribute EndRAT Malware
Genians Security Center has published an in-depth analysis of Operation Poseidon, a sophisticated APT campaign attributed to the Konni threat group that exploits legitimate advertising infrastructure to distribute EndRAT malware. This advanced spear-phishing operation demonstrates how threat actors leverage trusted platforms to circumvent traditional security defenses while targeting South Korean financial institutions and human rights…
-
Redmi Buds Vulnerability Could Allow Call Data Theft and Firmware Instability
Xiaomi’s Redmi Buds series faces critical security flaws that enable attackers to steal sensitive call data and crash devices without authentication. Two newly disclosed vulnerabilities affect Redmi Buds 3 Pro through 6 Pro, allowing unauthenticated adversaries within Bluetooth range to access private phone numbers and trigger repeated denial of service conditions. The vulnerabilities stem from…
-
Don’t underestimate pro-Russia hacktivists, warns UK’s cyber crew
They’re not the most sophisticated, but even simple attacks can lead to costly consequences First seen on theregister.com Jump to article: www.theregister.com/2026/01/19/dont_underestimate_prorussia_hacktivists_warns/
-
Remcos RAT Campaign Uses Trojanized VeraCrypt Installers to Steal Credentials
AhnLab Security Intelligence Center (ASEC) has identified an active Remcos RAT campaign targeting users in South Korea. The malware is being spread through multiple channels. It often masquerades as VeraCrypt utilities or tools used within illegal online gambling ecosystems. Once installed, the RAT can steal login credentials, monitor user activity, and give attackers remote control…
-
Unmasked by Leaks: The Hidden Backbone of a Ransomware Operation
The leaks tied to the BlackBasta ransomware group and Russian hosting company Media Land pulled back the curtain on something defenders rarely get to see: the internal machinery and people behind a major ransomware operation. In February 2025, an unknown individual using the handle ExploitWhispers appeared on Telegram and published a massive archive of BlackBasta’s internal chats…
-
CIRO Confirms Data Breach Impacting 750,000 Canadian Investors
The Canadian Investment Regulatory Organization (CIRO) has officially confirmed a significant data breach affecting approximately 750,000 Canadian investors, stemming from a sophisticated phishing attack initially detected in August 2025. The organization publiclydisclosedthe incident on January 14, 2026, following a comprehensive forensic investigation spanning over 9,000 hours. CIRO traced the breach tounauthorized accessgained through a targeted…
-
DevOps & SaaS Downtime: The High (and Hidden) Costs for Cloud-First Businesses
Just a few years ago, the cloud was touted as the “magic pill” for any cyber threat or performance issue. Many were lured by the “always-on” dream, trading granular control for the convenience of managed services.In recent years, many of us have learned (often the hard way) that public cloud service providers are not immune…
-
The culture you can’t see is running your security operations
Tags: apache, breach, business, compliance, control, credentials, cyber, data, email, exploit, finance, firewall, flaw, identity, intelligence, jobs, network, north-korea, phishing, risk, technology, threat, tool, training, update, vulnerabilityNon-observable culture: The hidden drivers: Now we get interesting.Non-observable culture is everything happening inside people’s heads. Their beliefs about cyber risk. Their attitudes toward security. Their values and priorities when security conflicts with convenience or speed.This is where the real decisions get made.You can’t see someone’s belief that “we’re too small to be targeted” or…
-
British Army to spend £279 million on permanent cyber regiment base
The British Army has announced a new permanent base for its cyber regiment, backed by £279 million in government spending. The plan centres on 13 Signal Regiment, the unit … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/19/british-army-cyber-operations-279-million-spending/
-
Cyber Breaches, Compliance and Reputation Top UK Corporate Concerns
UK firms face confluence of cyber-related risks in 2026, says Nardello & Co First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-breaches-compliance/
-
Five Chrome Extensions Used to Hijack Enterprise HR and ERP Systems
Socket’s Threat Research Team has uncovered a coordinated Chrome extension campaign targeting enterprise HR and ERP platforms, including Workday, NetSuite, and SAP SuccessFactors. Five malicious extensions, collectively installed over 2,300 times, work together to steal session tokens, block security controls, and enable complete account takeover through session hijacking. Four of the extensions are published under…
-
From arts degree to cybersecurity: Rona Michele Spiegel brings fresh perspective to cyber leadership
Tags: ai, awareness, business, cisco, ciso, cloud, compliance, computer, cyber, cybersecurity, data, governance, group, hacking, Hardware, intelligence, jobs, network, office, penetration-testing, privacy, psychology, risk, risk-management, skills, software, startup, strategy, supply-chain, technology, tool, vulnerabilityRona Michele Spiegel’s journey to cybersecurity might seem unconventional to some: She studied the arts. But as someone who grew up when computers first appeared and everyone wanted to experiment with them, she did a lot of multimedia work. She was always interested in technology and discussed with art colleagues about where the world was…
-
PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses
Security researchers have identified a sophisticated backdoor malware variant, PDFSIDER, that leverages DLL side-loading to evade endpoint detection and response (EDR) systems. The threat demonstrates advanced persistent threat (APT) tradecraft, combining evasion mechanisms with encrypted command-and-control capabilities to maintain covert access on compromised systems. PDFSIDER’s infection chain originates through spear-phishing campaigns delivering ZIP archives containing…
-
Mandiant Publishes Rainbow Tables That Crack NTLMv1 Admin Passwords
Mandiant haspublicly releasedcomprehensive rainbow tables designed to crack Net-NTLMv1 authentication hashes, addressing a critical security gap that has persisted for over two decades, despite the protocol being deprecated and widely recognized as fundamentally insecure. The decision to release these tables underscores the urgency of migrating away from this outdated authentication mechanism, whichremainsprevalent in active environments…
-
Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence
Security researchers and penetration testers gain a comprehensive open-source reconnaissance platform with the release of Argus v2.0, a Python-based information gathering toolkit that consolidates 135 specialised modules into a unified command-line interface. The toolkit addresses the growing complexity of modern attack surface management by providing integrated access to network mapping, web application analysis, and threat…
-
How Security Teams Use IP Location and DNS History In Cybercrime Investigation
In many security teams, a cybercrime investigation often begins without a complete picture. It starts with a small signal. A suspicious login. An unexpected outbound connection. A single alert that does not look right. From that moment, investigators need context. Logs alone show what happened, but not who is behind it or why it matters.…
-
Global tensions are pushing cyber activity toward dangerous territory
Cybersecurity is inseparable from geopolitics. Ongoing conflicts, sanctions, trade wars, geoeconomic rivalry, and technological competition have pushed state competition into … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/19/cybersecurity-geopolitical-tensions/
-
Microsoft January 2026 Security Update Triggers Credential Prompt Failures in Remote Desktop
Microsoft’s January 2026 security update has disrupted enterpriseRemote Desktopinfrastructure, triggering widespread credential prompt failures that prevent users from accessingAzure Virtual Desktopand Windows 365 environments. The problematic patch KB5074109, released January 13, 2026, introduced an authentication regression affecting Windows 11 versions 24H2 and 25H2 running builds 26100.7623 and 26200.7623. The issue manifests as immediate sign-in failures when…
-
New “BodySnatcher” Flaw Allows Full ServiceNow User Impersonation
Security researcher has disclosed a critical vulnerability in ServiceNow’s Virtual Agent API and Now Assist AI Agents application, tracked as CVE-2025-12420. Dubbed >>BodySnatcher,<< this flaw enables unauthenticated attackers to impersonate any ServiceNow user using only their email address, bypassing multi-factor authentication and single sign-on controls to execute privileged AI workflows and create backdoor administrator accounts.…
-
Researchers Hijack Hacker Domain Using Name Server Delegation
Security researchers from Infoblox have successfully intercepted millions of malicious push notification advertisements by exploiting a DNS misconfiguration technique known as >>lame nameserver delegation,<< gaining complete visibility into a large-scale affiliate advertising operation without directly compromising any systems. The researchers claimed to have identified abandoned domains used by threat actors, receiving copies of over 57…
-
Threat Actors Abuse Browser Extensions to Deliver Fake Warning Messages
Threat intelligence researchers at Huntress have uncovered a sophisticated browser extension campaign orchestrated by the KongTuke threat actor group, featuring a malicious ad blocker impersonating the legitimate uBlock Origin Lite extension. The campaign weaponizes fake browser crash warnings to trick users into executing malicious PowerShell commands, ultimately delivering ModeloRAT, a previously undocumented Python-based remote access…
-
Microsoft January 2026 Security Update Triggers Credential Prompt Failures in Remote Desktop
Microsoft’s January 2026 security update has disrupted enterpriseRemote Desktopinfrastructure, triggering widespread credential prompt failures that prevent users from accessingAzure Virtual Desktopand Windows 365 environments. The problematic patch KB5074109, released January 13, 2026, introduced an authentication regression affecting Windows 11 versions 24H2 and 25H2 running builds 26100.7623 and 26200.7623. The issue manifests as immediate sign-in failures when…
-
When the Olympics connect everything, attackers pay attention
Global sporting events bring a surge of network traffic, new systems, and short term partnerships. That mix draws attention from cyber threat actors who see opportunity in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/19/palo-alto-networks-olympic-cybersecurity-risks-report/