Tag: email
-
A critical flaw in OpenPGP.js lets attackers spoof message signatures
A critical flaw in OpenPGP.js, tracked as CVE-2025-47934, lets attackers spoof message signatures; updates have been released to address the flaw. A critical vulnerability, tracked as CVE-2025-47934, in OpenPGP.js allowed spoofing of message signature verification. OpenPGP.js is an open-source JavaScript library that implements the OpenPGP standard for email and data encryption. It allows developers to…
-
New Phishing Attack Uses AES Malicious npm Packages to Office 365 Login Credentials
Fortra’s Suspicious Email Analysis (SEA) team uncovered a highly sophisticated phishing campaign targeting Microsoft Office 365 (O365) credentials. Unlike typical phishing attempts, this attack stood out due to its intricate use of modern technologies and developer infrastructure. The threat actors employed a multi-layered strategy involving AES (Advanced Encryption Standard) encryption, malicious npm (Node Package Manager)…
-
Threat intelligence platform buyer’s guide: Top vendors, selection advice
Tags: ai, attack, automation, breach, cloud, computing, credentials, crowdstrike, cyber, cybersecurity, dark-web, data, data-breach, deep-fake, detection, dns, edr, email, endpoint, exploit, finance, firewall, fraud, gartner, google, group, guide, identity, incident response, infrastructure, intelligence, kubernetes, law, malicious, malware, microsoft, mitigation, monitoring, network, open-source, phishing, privacy, risk, service, siem, soar, soc, sophos, sql, supply-chain, technology, threat, tool, vpn, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) found that since 2023 the majority of exploits were zero days, meaning exploiting heretofore unknown methods. And according to the latest Verizon Data Breach Investigations report (DBIR), the percentage of AI-assisted malicious emails doubled to 10% of the totals they observed over the past two years, making staying…
-
Poor DNS hygiene is leading to domain hijacking
Tags: attack, authentication, ciso, cloud, control, credentials, detection, dns, email, exploit, incident response, intelligence, threat, toolDNS hijacking comes in many forms: DNS hijacking comes in many forms. In 2019, CSO inteviewed Paul Vixie, a DNS system contributor, about the need to strengthen security. We later wrote about the problem of abandoned domain names. And things haven’t changed a lot since then. Most CISOs may be familiar with typosquatting, where “firm.com”…
-
What to do if you can’t get into your Facebook or Instagram account
How to prove your identity after your account gets hacked and how to improve security for the future<ul><li><a href=”https://viewer.gutools.co.uk/technology/2025/apr/23/what-to-do-phone-lost-stolen-change-passwords”>Phone lost or stolen? Practical steps to restore peace of mind</li><li><a href=”https://www.theguardian.com/money/2025/may/07/what-to-do-if-your-uk-passport-is-lost-or-stolen-steps-you-need-to-take”>UK passport lost or stolen? Here are the steps you need to take</li></ul>Your Facebook or Instagram account can be your link to friends, a profile for…
-
Poor DNS hygiene is leading to domain hijacking: Report
Tags: attack, authentication, ciso, cloud, control, credentials, detection, dns, email, exploit, incident response, intelligence, threat, toolDNS hijacking comes in many forms: DNS hijacking comes in many forms. In 2019, CSO inteviewed Paul Vixie, a DNS system contributor, about the need to strengthen security. We later wrote about the problem of abandoned domain names. And things haven’t changed a lot since then. Most CISOs may be familiar with typosquatting, where “firm.com”…
-
Let’s Talk About SaaS Risk Again”¦ This Time, Louder.
By Kevin Hanes, CEO of Reveal Security A few weeks ago, I shared a thought that sparked a lot of discussion: SaaS is not a black box we can ignore. It’s a rich, dynamic attack surface and one that attackers are increasingly targeting. That urgency was echoed powerfully in JPMorgan CISO Patrick Opet’s open letter…
-
More_Eggs Malware Uses Job Application Emails to Distribute Malicious Payloads
The More_Eggs malware, operated by the financially motivated Venom Spider group (also known as Golden Chickens), continues to exploit human trust through meticulously crafted social engineering. Sold as a Malware-as-a-Service (MaaS) to notorious threat actors like FIN6 and Cobalt Group, this potent JavaScript backdoor primarily targets human resources (HR) departments by masquerading as job application…
-
Hackers Abuse TikTok and Instagram APIs to Verify Stolen Account Credentials
Cybercriminals are leveraging the Python Package Index (PyPI) to distribute malicious tools designed to exploit TikTok and Instagram APIs for verifying stolen account credentials. Security researchers at Socket have identified three such packages checker-SaGaF, steinlurks, and sinnercore that automate the process of validating emails and usernames against social media platforms. Released between April 2023 and…
-
CISA Includes MDaemon Email Server XSS Flaw in KEV Catalog
Tags: cisa, cve, cyber, cybersecurity, email, exploit, flaw, infrastructure, kev, malicious, vulnerability, xssCybersecurity and Infrastructure Security Agency (CISA) has added a cross-site scripting (XSS) vulnerability affecting MDaemon Email Server to its Known Exploited Vulnerabilities (KEV) Catalog on May 19, 2025. This critical addition, identified as CVE-2024-11182, highlights a security flaw that allows attackers to inject malicious JavaScript code via crafted HTML emails. Federal agencies now have until…
-
South Asian Ministries Hit by SideWinder APT Using Old Office Flaws and Custom Malware
High-level government institutions in Sri Lanka, Bangladesh, and Pakistan have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder.”The attackers used spear phishing emails paired with geofenced payloads to ensure that only victims in specific countries received the malicious content,” Acronis researchers Santiago Pontiroli, Jozsef Gegeny, and Prakas…
-
Ransomware Simulation Playbook- Build Real-World Cyber Resilience Without Paying the Price
It started like any other Monday morning. Coffee cups steamed beside keyboards, servers hummed gently in climate-controlled rooms, and email inboxes pinged with weekend catch-up. But within minutes, that ordinary… The post Ransomware Simulation Playbook- Build Real-World Cyber Resilience Without Paying the Price appeared first on Strobes Security. First seen on securityboulevard.com Jump to article:…
-
Chinese Hackers Deploy MarsSnake Backdoor in Multi-Year Attack on Saudi Organization
Tags: attack, backdoor, china, data-breach, email, group, hacker, hacking, international, phishing, spear-phishing, tactics, threatThreat hunters have exposed the tactics of a China-aligned threat actor called UnsolicitedBooker that targeted an unnamed international organization in Saudi Arabia with a previously undocumented backdoor dubbed MarsSnake.ESET, which first discovered the hacking group’s intrusions targeting the entity in March 2023 and again a year later, said the activity leverages spear-phishing emails using First…
-
Malicious PyPI Packages Exploit Instagram and TikTok APIs to Validate User Accounts
Cybersecurity researchers have uncovered malicious packages uploaded to the Python Package Index (PyPI) repository that act as checker tools to validate stolen email addresses against TikTok and Instagram APIs.All three packages are no longer available on PyPI. The names of the Python packages are below -checker-SaGaF (2,605 downloads)steinlurks (1,049 downloads)sinnercore (3,300 downloads) First seen on…
-
Microsoft 365 Users Targeted by Tycoon2FA Linked Phishing Attack to Steal Credentials
A new wave of targeted phishing campaigns, linked to the Tycoon2FA group, has been identified specifically targeting Microsoft 365 users. Security researchers have observed that these campaigns are leveraging an innovative tactic: the use of malformed URLs containing backslash characters, such as https:\\, in order to bypass conventional email security filters and evade URL-based detection…
-
New ModiLoader Malware Campaign Targets Windows PCs, Harvesting User Credentials
AhnLab Security Intelligence Center (ASEC) has recently uncovered a malicious campaign distributing ModiLoader (also known as DBatLoader) malware through phishing emails. These emails, crafted in Turkish and impersonating a Turkish bank, urge recipients to open a malicious attachment under the guise of checking their transaction history. Inside the compressed RAR file lies a BAT script…
-
Security Affairs newsletter Round 524 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. US Government officials targeted with texts and AI-generated deepfake voice messages impersonating senior U.S. officials Shields up US…
-
‘Would rather pay bounty than ransom’: Coinbase on $20M extortion attempt
Hackers are demanding a ransom of the same amount: According to the filing, the email communication by the threat actor demanded $20 million in exchange for not publicly disclosing the information. It remains to be seen how threat actors respond to Coinbase refusing to pay the ransom.”Coinbase’s decision to publicly counter-extort with a $20 million…
-
Russian Espionage Operation Targets Organizations Linked to Ukraine War
In Operation RoundPress, the compromise vector is a spearphishing email leveraging an XSS vulnerability to inject malicious JavaScript code into the victim’s webmail page First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fancy-bear-russia-cyber-espionage/
-
Vipre Email Threat Trends Report Q1 2025 – Low-Tech-Strategien und SVG-Phishing im Aufwind
First seen on security-insider.de Jump to article: www.security-insider.de/email-bedrohungen-2025-mensch-schwachstelle-low-tech-angriffe-a-74edccf998dc8e09590abee39c8f065e/
-
Polymorphic phishing attacks flood inboxes
AI is transforming the phishing threat landscape at a pace many security teams are struggling to match, according to Cofense. In 2024, researchers tracked one malicious email … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/16/polymorphic-phishing-attacks-cofense/
-
Proofpoint buying Hornetsecurity in a play to expand email security scope
One of many big purchases in the industry: While the terms are confidential, sources have reported the price of the Hornetsecurity purchase, which is expected to close in the second half of 2025, to be well over $1 billion. This would make it Proofpoint’s largest acquisition, and also one of the biggest cybersecurity deals in…
-
After helping Russia on the ground North Korea targets Ukraine with cyberespionage
Tags: credentials, cyber, cyberespionage, email, government, hacker, identity, intelligence, korea, microsoft, north-korea, phishing, resilience, risk, russia, ukraineCredential harvesting: Before the phishing emails, the same Ukrainian government entities were targeted with email alerts impersonating Microsoft and claiming unusual sign-in activity was detected on their accounts. The victims were asked to perform identity verification by clicking on a button, which took them to credential harvesting pages.The Proofpoint researchers didn’t manage to obtain any…
-
Government webmail hacked via XSS bugs in global spy campaign
Hackers are running a worldwide cyberespionage campaign dubbed ‘RoundPress,’ leveraging zero-day and n-day flaws in webmail servers to steal email from high-value government organizations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/government-webmail-hacked-via-xss-bugs-in-global-spy-campaign/
-
CISA Alerts on Active Exploitation of Zero-Day Vulnerability in Multiple Fortinet Products
Tags: cisa, communications, cve, cyber, cybersecurity, detection, email, exploit, fortinet, infrastructure, network, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding five zero-day vulnerabilities affecting multiple Fortinet products, after evidence emerged of active exploitation in the wild. The vulnerabilities, tracked as CVE-2025-32756, impact Fortinet’s FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera platforms, widely used in enterprise environments for unified communications, email, network detection,…
-
Largest US crypto exchange says cost of recent cyber-attack could reach $400m
Hackers paid overseas Coinbase employees for account data; company is offering $20m reward for informationThe biggest cryptocurrency exchange in the US forecast that a cyber-attack that breached account data of a “small subset” of its customers would cost it between $180m and $400m. Coinbase said that price tag would not include the $20m ransom demanded…
-
Microsoft Outlook Down Millions of Business Personal Users Worldwide Impacted
A major outage hit Microsoft Outlook and other Microsoft 365 services on Thursday, May 15, 2025, leaving millions of users around the globe unable to access their email, calendars, and other essential productivity tools. The disruption began in the evening IST, with users quickly taking to social media and outage-tracking platforms to report widespread connectivity…
-
Largest US crypto exchange hit by cyber-attack with costs expected of up to $400m
Hackers paid overseas Coinbase employees for account data; company is offering $20m reward for informationThe biggest cryptocurrency exchange in the US forecast that a cyber-attack that breached account data of a “small subset” of its customers would cost it between $180m and $400m. Coinbase said that price tag would not include the $20m ransom demanded…
-
Russian Hackers Exploit XSS Vulnerabilities to Inject Malicious Code into Email Servers
Tags: blizzard, cyber, cyberespionage, cybersecurity, email, exploit, group, hacker, malicious, russia, vulnerability, xssA sophisticated cyberespionage campaign, dubbed Operation RoundPress, has been uncovered by cybersecurity researchers at ESET. Attributed with medium confidence to the Russian-linked Sednit group-also known as APT28, Fancy Bear, and Forest Blizzard-this operation targets high-value webmail servers using cross-site scripting (XSS) vulnerabilities. Active since at least 2004, Sednit has a notorious history, including alleged involvement…