Tag: cyber
-
Microsoft 365 Copilot and Office Apps Now Protected by SafeLinks at Click Time
Microsoft announced a major update aimed at bolstering the cybersecurity of its flagship AI-powered productivity assistant, Microsoft 365 Copilot, and its suite of Office apps. The integration of SafeLinks protection at time-of-click marks a significant step forward in safeguarding users from modern cyber threats. AI is revolutionizing workflows across industries, and Microsoft Copilot is at…
-
Initial Access Brokers Play a Vital Role in Modern Ransomware Attacks
The ransomware threat landscape has evolved dramatically in recent years, with specialized cybercriminals like Initial Access Brokers (IAbBs) emerging as critical enablers in the Ransomware-as-a-Service (RaaS) ecosystem. These actors serve as high-value middlemen, focusing on breaching organizational networks and selling access to other threat actors who execute the final stages of ransomware and Business Email…
-
Darcula PhaaS: 884,000 Credit Card Details Stolen from 13 Million Global User Clicks
The Darcula group has orchestrated a massive phishing-as-a-service (PhaaS) operation, dubbed Magic Cat, compromising an estimated 884,000 credit card details from over 13 million user interactions worldwide. This smishing (SMS phishing) campaign, first detected in December 2023, impersonates trusted brands like the Norwegian Postal Service to lure victims into divulging sensitive information. Sophisticated Phishing-as-a-Service Operation…
-
Microsoft Resolves Group Policy Issue Blocking Windows 11 24H2 Installation
Microsoft has resolved a critical enterprise-focused bug that blocked organizations from deploying Windows 11 24H2 through Windows Server Update Services (WSUS), alongside addressing a separate dual-boot Linux compatibility issue tied to older security updates. These fixes come as part of broader efforts to stabilize the 2024 Update rollout, which introduces AI-driven Copilot+ PC features and…
-
DragonForce Ransomware Targets Major UK Retailers, Including Harrods, Marks Spencer, and Co-Op
Major UK retailers including Harrods, Marks and Spencer, and Co-Op are currently experiencing significant service disruptions following a series of coordinated ransomware attacks attributed to the DragonForce group. The attacks have affected critical business functions including payment systems, inventory management, and payroll processing. This campaign marks a significant escalation in DragonForce’s operations, which previously targeted…
-
Google’s NotebookLM Introduces Voice Summaries in Over 50 Languages
Google has significantly expanded the capabilities of NotebookLM, its AI-powered research tool, by introducing Audio Overviews in more than 50 languages. This enhancement builds upon the platform’s global expansion to over 200 countries last year and marks a pivotal development in making AI-assisted research more accessible worldwide. The feature transforms users’ source materials into engaging,…
-
Android Security Update -A Critical RCE Vulnerability Actively Exploited in the Wild
Google has released critical security patches for Android devices to address 57 vulnerabilities across multiple subsystems, including an actively exploited remote code execution flaw tracked as CVE-2025-27363. The May 2025 security bulletin confirms this high-severity vulnerability in Android’s System component enables local code execution without requiring additional privileges or user interaction. Devices running Android 13…
-
OpenAI Shifts For-Profit Branch to Public Benefit Corporation, Staying Under Nonprofit Oversight
Landmark organizational shift, OpenAI announced its transition from a capped-profit LLC to a Public Benefit Corporation (PBC) while maintaining governance under its original nonprofit structure. The move, detailed in a May 2025 letter from CEO Sam Altman, aims to balance scalable resource acquisition with the company’s mission of ensuring artificial general intelligence (AGI) benefits all…
-
Retail cyber crime spree a ‘wake-up call’, says NCSC CEO
The National Cyber Security Centre confirms it is providing assistance to M&S, Co-op and Harrods as concerns grow among UK retailers First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623390/Retail-cyber-crime-spree-a-wake-up-call-says-NCSC-CEO
-
New ClickFix Attack Imitates Ministry of Defence Website to Target Windows Linux Systems
Tags: attack, cyber, cyberattack, government, india, infection, intelligence, linux, malicious, malware, threat, windowsA newly identified cyberattack campaign has surfaced, leveraging the recognizable branding of India’s Ministry of Defence to distribute cross-platform malware targeting both Windows and Linux systems. Uncovered by threat intelligence researchers at Hunt.io, this operation employs a ClickFix-style infection chain, mimicking official government press release portals to lure unsuspecting users into executing malicious payloads. The…
-
Samsung MagicINFO 9 Server Vulnerability Actively Exploited in the Wild
A critical security vulnerability in the Samsung MagicINFO 9 Server has come under active exploit, security researchers from Arctic Wolf have warned. The flaw, tracked as CVE-2024-7399, allows unauthenticated attackers to remotely execute code and compromise digital signage infrastructure in organizations around the world. Details of the Vulnerability The Samsung MagicINFO 9 Server is a popular…
-
UK Retail Chains Targeted by Ransomware Attackers Claiming Data Theft
Major ransomware campaign targeting UK retailers has escalated as hackers provided BBC News with evidence of extensive network infiltration and data theft from Co-op, contradicting the company’s initial statements that downplayed the incident. The cyber criminals, operating under the name DragonForce, claim to possess personal information of approximately 20 million Co-op loyalty scheme members and…
-
Researcher Exploits Regex Filter Flaw to Gain Remote Code Execution
Target application included a username field restricted by a frontend regex filter (/^[a-zA-Z0-9]{1,20}$/), designed to accept only alphanumeric characters. While this initially appeared robust, the researcher discovered that the backend failed to revalidate inputs after the regex check. This oversight allowed specially crafted payloads to bypass client-side controls and execute arbitrary commands on the server.…
-
TikTok Hit with Euro530 Million Fine Over Data Transfers to China
Irish Data Protection Commission (DPC) has imposed a landmark Euro530 million fine on TikTok Technology Limited for illegally transferring European Economic Area (EEA) user data to China and failing to meet transparency obligations under the General Data Protection Regulation (GDPR). The decision, finalized on May 5, 2025, follows a multi-year inquiry into TikTok’s data governance…
-
Firefox’s Future Uncertain Without Google Search Deal, Insider Warns
Mozilla’s Chief Financial Officer testified that Firefox could face extinction if Justice Department proposals targeting Google’s search dominance are fully implemented, revealing the browser’s precarious financial position amid ongoing antitrust proceedings. Mozilla Corporation CFO Eric Muhlheim delivered stark testimony Friday, characterizing the potential loss of Google search revenue as >>very frightening
-
UK’s NCSC Offers Security Tips as Co-op Confirms Data Loss
The National Cyber Security Centre has published advice for retailers while the Co-op admits customer data was stolen First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/uks-ncsc-security-tips-coop-data/
-
What a future without CVEs means for cyber defense
The importance of the MITRE-run Common Vulnerabilities and Exposures (CVE) Program shouldn’t be understated. For 25 years, it has acted as the point of reference for … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/06/cve-program-foundation/
-
>>Firefox’s Future Uncertain Without Google Search Deal, Insider Warns<<
Mozilla’s Chief Financial Officer testified that Firefox could face extinction if Justice Department proposals targeting Google’s search dominance are fully implemented, revealing the browser’s precarious financial position amid ongoing antitrust proceedings. Mozilla Corporation CFO Eric Muhlheim delivered stark testimony Friday, characterizing the potential loss of Google search revenue as >>very frightening
-
Google Gemini Introduces Built-In Image Editing in App
Google has integrated advanced AI-powered image editing tools directly into its Gemini app, enabling users to manipulate both AI-generated and uploaded images through text prompts. The update, which began rolling out globally on May 5, 2025, introduces multi-step editing workflows, contextual text-to-image integration, and embedded ethical safeguards. This marks the first time generative image modification…
-
Signal App Used by Trump Associate Targeted in Security Breach
A major security scare has erupted in Washington after reports emerged that a Trump associate was using an unofficial version of the secure messaging platform Signal-an application that was subsequently targeted in a data breach, according to a Sunday report from tech outlet 404 Media. According to the Reuters report, the report centers on former…
-
CISA Issues Alert on Langflow Vulnerability Actively Exploited in Attacks
Tags: attack, cisa, cyber, cybersecurity, exploit, flaw, framework, infrastructure, malicious, open-source, risk, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding an actively exploited vulnerability in Langflow, a popular open-source framework for building language model applications. Tracked as CVE-2025-3248, the flaw allows unauthenticated attackers to execute malicious code remotely, posing significant risks to organizations using the platform. Vulnerability Details The critical flaw resides in Langflow’sapi/v1/validate/codeendpoint,…
-
Windows Deployment Services Hit by 0-Click UDP Flaw Leading to System Failures
Tags: authentication, cyber, exploit, flaw, malicious, microsoft, network, remote-code-execution, service, windowsA newly discoveredpre-authentication denial-of-service (DoS) vulnerabilityin Microsoft’s Windows Deployment Services (WDS) exposes enterprise networks to instant system crashes via malicious UDP packets. Dubbed a “0-click” flaw, attackers can exploit it remotely without user interaction, draining server memory until critical services fail. While much attention focuses on remote code execution bugs, memory exhaustion vulnerabilities in UDP-based services like…
-
Critical Microsoft 0-Click Telnet Vulnerability Enables Credential Theft Without User Action
A critical vulnerability has been uncovered in Microsoft’s Telnet Client (telnet.exe), enabling attackers to steal Windows credentials from unsuspecting users, even without interaction in certain network scenarios. Security researchers warn that this >>zero-click
-
What it really takes to build a resilient cyber program
In this Help Net Security interview, Dylan Owen, CISO at Nightwing, talks about what it really takes to build an effective defense: choosing the right frameworks, setting up … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/06/dylan-owen-nightwing-cyber-defense-strategy/
-
10 Kennzahlen, die CISOs weiterbringen
Geht es um Security-Kennzahlen, sollten CISOs sich auf das Wesentliche fokussieren. Die Security-Performance zu messen, gehört vielleicht nicht zu den aufregendsten Aufgaben eines CISOs kann allerdings sehr nützlich sein, um eine ganze Reihe von Herausforderungen zu bewältigen. Neben der Erkenntnis darüber, wie effektiv ihre Security-Bemühungen sind, können Sicherheitsentscheider mit den richtigen Kennzahlen unter anderem auch…