Tag: cyber
-
Lucid PhAAS Platform Uses RCS and iMessage to Evade Detection
The cybersecurity landscape has been disrupted by the emergence of Lucid, a sophisticated Phishing-as-a-Service (PhAAS) platform developed by Chinese-speaking threat actors. This advanced toolkit enables cybercriminals to conduct large-scale phishing campaigns, targeting 169 entities across 88 countries globally. Lucid’s innovation lies in its exploitation of Rich Communication Services (RCS) and Apple’s iMessage protocol to circumvent…
-
Malicious Google Ads Target DeepSeek Users to Spread Malware
Cybersecurity threats continue to evolve, with malicious actors exploiting popular platforms like Google Ads to spread malware. Recently, a sophisticated campaign targeting DeepSeek users has been uncovered, highlighting the ongoing risks associated with sponsored search results. The Threat Landscape DeepSeek, a rising platform, has become a lure for cybercriminals who are using fake sponsored Google…
-
NCA Warns of Sadistic Online “Com” Networks
The UK’s National Crime Agency is warning of a growing cyber and physical threat from homegrown teens First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nca-warns-of-sadistic-online-com/
-
CISA Adds Sitecore CMS Code Execution Vulnerability to Exploited List
The Cybersecurity and Infrastructure Security Agency (CISA) has included a critical deserialization vulnerability affecting Sitecore CMS and Experience Platform (XP). This vulnerability, tracked as CVE-2019-9874, allows unauthenticated attackers to execute arbitrary code by manipulating HTTP POST parameters, specifically the __CSRFTOKEN field. The vulnerability exploits a weakness in the Sitecore.Security.AntiCSRF module, enabling malicious actors to send…
-
Malaysian PM says >>no way<< to $10 million ransom after alleged cyber attack against Kuala Lumpur airport
According to some reports, Kuala Lumpur International Airport had to resort to using whiteboards to communicate with passengers. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/malaysian-pm-says-no-way-to-10-million-ransom-after-alleged-cyber-attack-against-kuala-lumpur-airport
-
NCSC Urges Domain Registrars to Improve Security
Tags: cyberThe UK’s National Cyber Security Centre has released new guidance to help domain registrars enhance security First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ncsc-urges-domain-registrars/
-
New “ReaderUpdate” macOS Malware Evolves with Nim and Rust Variants
Security researchers at SentinelOne have discovered that ReaderUpdate, a macOS malware loader platform that has been active since at least 2020, has significantly evolved with new variants written in multiple programming languages. The malware, which previously went relatively unnoticed by many vendors, now includes versions written in Crystal, Nim, Rust, and most recently Go, in…
-
Advanced CoffeeLoader Malware Evades Security to Deliver Rhadamanthys Shellcode
Security researchers at Zscaler ThreatLabz have identified a new sophisticated malware family called CoffeeLoader, which emerged around September 2024. This advanced loader employs numerous techniques to bypass security solutions and evade detection while delivering second-stage payloads, particularly the Rhadamanthys stealer. CoffeeLoader utilizes a specialized packer named Armoury that leverages the GPU to execute code, hindering…
-
PoC Exploit Released for Ingress-NGINX RCE Vulnerabilities
A recently disclosed vulnerability in Ingress-NGINX, tracked as CVE-2025-1974, has raised concerns about the security of Kubernetes environments. This vulnerability allows for Remote Code Execution (RCE) through the validating webhook server integrated into Ingress-NGINX. A Proof of Concept (PoC) exploit has been released, demonstrating how attackers could exploit this flaw. CVE-2025-1974 affects versions of Ingress-NGINX…
-
CodeQLEAKED: GitHub Supply Chain Attack Enables Code Execution via CodeQL Repositories
A recent discovery has revealed a potential supply chain attack vulnerability in GitHub’s CodeQL repositories, which could have led to wide-ranging consequences for hundreds of thousands of GitHub users. The exploit hinges on a publicly exposed secret found in a GitHub Actions workflow artifact, which, if utilized by an attacker, could allow malicious code execution…
-
Cyber insurance isn’t always what it seems
Many companies think cyber insurance will protect them from financial losses after an attack. But many policies have gaps. Some claims get denied. Others cover less than … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/27/cyber-insurance-ciso/
-
Exim UseFree Vulnerability Enables Privilege Escalation
A significant security threat has been uncovered in Exim, a popular open-source mail transfer agent (MTA) widely used in Linux distributions. Identified as CVE-2025-30232, this vulnerability allows for a potentially severe form of exploitation known as a use-after-free (UAF). This type of bug can lead to privilege escalation, posing substantial risks for administrators and users…
-
OpenAI Offers Up to $100,000 for Critical Infrastructure Vulnerability Reports
OpenAI has announced major updates to its cybersecurity initiatives. The company is expanding its Security Bug Bounty Program, increasing the maximum reward for critical vulnerability reports to $100,000, up from $20,000 previously. This enhanced program aims to attract top security researchers worldwide to help identify and fix potential threats before they become major issues. OpenAI’s…
-
Splunk RCE Vulnerability Enables Remote Code Execution via File Upload
A severe vulnerability in Splunk Enterprise and Splunk Cloud Platform has been identified, allowing for Remote Code Execution (RCE) via file uploads. This exploit can be triggered by a low-privileged user, highlighting significant security risks for affected organizations. Vulnerability Overview: The vulnerability, tracked as CVE-2025-20229, has a CVSSv3.1 score of 8.0, classified as High. The…
-
12 Cybercriminals Arrested After Ghost Communication Platform Shutdown
Law enforcement agencies have successfully dismantled a clandestine communication platform known as >>Ghost,
-
Unbefugter Zugriff bei einem Unternehmen für Kfz-Inspektionen in Frankreich
Information cyber attaque First seen on autosur.fr Jump to article: www.autosur.fr/information-cyber-attaque/
-
Raspberry Robin: From Copy Shop Worm to Russian GRU Cyber Tool
Raspberry Robin, also known as Roshtyak or Storm-0856, has evolved from a simple worm targeting copy shops to First seen on securityonline.info Jump to article: securityonline.info/raspberry-robin-from-copy-shop-worm-to-russian-gru-cyber-tool/
-
US defense contractor cops to sloppy security, settles after infosec lead blows whistle
MORSE to pay — .. .-.. .-.. .. — -. … for failing to meet cyber-grade First seen on theregister.com Jump to article: www.theregister.com/2025/03/26/us_defense_contractor/
-
B1ack’s Stash Marketplace Actors Set to Release 4 Million Stolen Credit Card Records for Free
In a significant escalation of illicit activities, B1ack’s Stash, a notorious dark web carding marketplace, has announced plans to release an additional 4 million stolen credit card records for free. This move is part of a broader strategy to attract cybercriminals and establish credibility within the underground economy. The marketplace first gained attention in April…
-
Pakistan APT Hackers Weaponize malicious IndiaPost Site to Target Windows and Android Users
A Pakistan-based Advanced Persistent Threat (APT) group, likely APT36, has launched a multi-platform cyberattack campaign targeting Indian users through a fraudulent website impersonating the Indian Post Office. The attack, discovered by CYFIRMA researchers, exploits both Windows and Android vulnerabilities, demonstrating a significant evolution in the group’s tactics. Sophisticated Attack Leverages Youth Laptop Scheme The malicious…
-
New IOCONTROL Malware Let Attackers Control Critical Infrastructure Gain Remote Access
A new malware strain called IOCONTROL has emerged, posing a significant threat to Internet of Things (IoT) devices and operational technology (OT) systems, particularly those in critical infrastructure. First observed in December 2024, IOCONTROL is allegedly created by the anti-Israeli and pro-Iranian hacktivist group >>Cyber Av3ngers.
-
YouTube Creators Targeted by Weaponized Brand Deals Using ‘Clickflix’ Attack Tactic
A new wave of cyberattacks is targeting YouTube creators, leveraging fake brand collaboration offers to distribute malware. Cybersecurity firm CloudSEK has uncovered a sophisticated phishing campaign that employs the >>Clickflix
-
Windows MMC Framework Zero-Day Exploited to Execute Malicious Code
Trend Research has uncovered a sophisticated campaign by the Russian threat actor Water Gamayun, exploiting a zero-day vulnerability in the Microsoft Management Console (MMC) framework. The vulnerability, dubbed MSC EvilTwin (CVE-2025-26633), allows attackers to execute malicious code on infected machines. The attack manipulates .msc files and the Multilingual User Interface Path (MUIPath) to download and…
-
Windows 11 24H2 Update Disrupts Connection to Veeam Backup Server
Users of the Veeam Backup Server have encountered a significant issue following the Windows 11 24H2 update. Specifically, the update has disrupted the connection between Veeam Recovery Media and the Veeam Backup Server. This problem affects users who have created recovery media from Windows 11 version 24H2 (build 26100.3194) or higher. When attempting to restore…
-
Beyond STIX: Next-Level Cyber-Threat Intelligence
While industry experts continue to analyze, interpret, and act on threat data, the complexity of cyber threats necessitates solutions that can quickly convert expert knowledge into machine-readable formats. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/beyond-stix-next-level-cyber-threat-intelligence
-
Google Hastily Patches Chrome Zero-Day Exploited by APT
Researchers at Kaspersky discovered cyber-espionage activity that used the vulnerability in a one-click phishing attack to deliver malware. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/google-patches-chrome-zero-day-exploited-apt
-
New SparrowDoor Backdoor Variants Found in Attacks on U.S. and Mexican Organizations
The Chinese threat actor known as FamousSparrow has been linked to a cyber attack targeting a trade group in the United States and a research institute in Mexico to deliver its flagship backdoor SparrowDoor and ShadowPad.The activity, observed in July 2024, marks the first time the hacking crew has deployed ShadowPad, a malware widely shared…
-
New York’s cyber chief on keeping cities and states safe from cyberattacks
Colin Ahern sat down with Recorded Future News earlier this year to discuss New York’s efforts to protect local governments from ransomware and more. First seen on therecord.media Jump to article: therecord.media/new-york-cyber-chief-on-keeping-cities-states-safe