Tag: malicious
-
CoffeeLoader Malware Is Stacked With Vicious Evasion Tricks
Next-level malware represents a new era of malicious code developed specifically to get around modern security software like digital forensics tools and EDR, new research warns. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/coffeeloader-malware-evasion-tricks
-
Triton RAT Uses Telegram for Remote System Access and Control
Cado Security Labs has uncovered a new Python-based Remote Access Tool (RAT) named Triton RAT, which leverages Telegram for remote system access and data exfiltration. This open-source malware, available on GitHub, is designed to execute a wide range of malicious activities, including credential theft, system control, and persistence establishment. Technical Overview Triton RAT initiates its…
-
Latest gambit for Gamaredon: Fake Ukraine troop movement documents with malicious links
The Kremlin-linked hacking group Gamaredon appears to be behind a recent campaign that aims to install a malicious version of the Remcos tool on Ukrainian computers. First seen on therecord.media Jump to article: therecord.media/gamaredon-phishing-campaign-fake-ukraine-documents-remcos
-
Hackers abuse WordPress MU-Plugins to hide malicious code
Hackers are utilizing the WordPress mu-plugins (“Must-Use Plugins”) directory to stealthily run malicious code on every page while evading detection. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abuse-wordpress-mu-plugins-to-hide-malicious-code/
-
Qakbot Resurfaces in Fresh Wave of ClickFix Attacks
Attackers post links to fake websites on LinkedIn to ask people to complete malicious CAPTCHA challenges that install malware. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/qakbot-resurfaces-fresh-wave-clickfix-attacks
-
Beware! A Fake Zoom Installer Drops BlackSuit Ransomware on Your Windows Systems
Tags: attack, cyber, cybersecurity, exploit, malicious, malware, ransomware, software, threat, windowsCybersecurity analysts have uncovered a sophisticated campaign exploiting a fake Zoom installer to deliver BlackSuit ransomware across Windows-based systems. The attack, documented by DFIR experts, highlights how threat actors are leveraging popular software to deceive unsuspecting victims into installing malware capable of crippling entire networks. The Fake Zoom Installer The malicious activity began with a…
-
Apache Tomcat Vulnerability Exploited to Execute Malicious Arbitrary Code on Servers
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-24813, is being actively exploited in Apache Tomcat servers. Critical RCE Flaw in Apache Tomcat The flaw allows attackers to upload malicious files via unauthenticated HTTP PUT requests, followed by a GET request to trigger deserialization, leading to arbitrary code execution. Affected versions include Tomcat 9.0.0-M1…
-
Water Gamayun Hackers Exploit MSC EvilTwin Zero-day Vulnerability to Hack Windows Machine
Water Gamayun, a suspected Russian threat actor, has been identified exploiting the MSC EvilTwin zero-day vulnerability (CVE-2025-26633) to compromise Windows systems. This vulnerability, embedded in the Microsoft Management Console (MSC) framework, allows attackers to execute malicious code remotely, exfiltrate sensitive data, and maintain persistent control over infected machines. The exploit leverages custom payloads and advanced…
-
Evilginx Tool (Still) Bypasses MFA
Based on the open source NGINX Web server, the malicious tool allows threat actors to steal user credentials and session tokens. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/evilginx-bypasses-mfa
-
Hackers Exploit WordPress mu-Plugins to Inject Spam and Hijack Site Images
Threat actors are using the “mu-plugins” directory in WordPress sites to conceal malicious code with the goal of maintaining persistent remote access and redirecting site visitors to bogus sites.mu-plugins, short for must-use plugins, refers to plugins in a special directory (“wp-content/mu-plugins”) that are automatically executed by WordPress without the need to enable them explicitly via…
-
CISA warns of RESURGE malware exploiting Ivanti flaw
Tags: attack, cisa, cve, cybersecurity, exploit, flaw, infrastructure, ivanti, malicious, malware, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of RESURGE malware, targeting a vulnerability in Ivanti Connect Secure (ICS) appliances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a Malware Analysis Report (MAR) on a new malware calledRESURGE. The malicious code has been used in attacks targeting the flaw CVE-2025-0282 in Ivanti Connect…
-
Gamaredon Hackers Weaponize LNK Files to Deliver Remcos Backdoor
Cisco Talos has uncovered an ongoing cyber campaign by the Gamaredon threat actor group, targeting Ukrainian users with malicious LNK files to deliver the Remcos backdoor. Active since at least November 2024, this campaign employs spear-phishing tactics, leveraging themes related to the Ukraine conflict to lure victims into executing the malicious files. The LNK files,…
-
Top 5 Web Application Penetration Testing Companies UK
Web Application Penetration Testing (WAPT) is a methodical approach to security that involves ethical hackers simulating real-world cyber-attacks on your web application to uncover vulnerabilities. By mimicking the tactics of cybercriminals, these professionals can identify weaknesses before malicious actors can exploit them. This proactive process allows businesses to address security flaws early and maintain a…
-
4 Tips For Crypto Wallet Security
Cryptocurrency will be more popular in 2025 than it has ever been and this means that there is a greater need for wallet security. As the crypto sector becomes more profitable and popular, malicious actors will look to exploit investors and steal their funds through methods like phishing schemes, wallet hacks, and so on. Then…
-
Hackers target Taiwan with malware delivered via fake messaging apps
Hackers have been targeting users in Taiwan with PJobRAT malware delivered through malicious instant messaging apps, according to new research. First seen on therecord.media Jump to article: therecord.media/hackers-target-taiwan-fake-messaging-apps
-
Gamaredon campaign abuses LNK files to distribute Remcos backdoor
Cisco Talos is actively tracking an ongoing campaign, targeting users in Ukraine with malicious LNK files which run a PowerShell downloader since at least November 2024. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/
-
Malicious Snow White Movie Download Targets Viewers with New Malware
As the latest adaptation of Snow White hits theaters with lukewarm reception, the absence of streaming options on platforms like Disney+ has led many viewers to seek pirated versions online. This trend is not new; every major movie release without a digital option becomes a prime opportunity for attackers to exploit users eager to watch…
-
Researchers claim their protocol can create truly random numbers on a current quantum computer
Could be used on near-term quantum machines: The authors of the paper, published in Nature, said research shows quantum computers have the potential to solve problems better than classical computing techniques, but the resource requirements of known quantum algorithms for these problems put them far out of reach of quantum machines that exist now or…
-
Infostealer campaign compromises 10 npm packages, targets devs
Ten npm packages were suddenly updated with malicious code yesterday to steal environment variables and other sensitive data from developers’ systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/
-
Malicious AI tools, AI jailbreaks increasingly sought by cybercriminals
First seen on scworld.com Jump to article: www.scworld.com/brief/malicious-ai-tools-ai-jailbreaks-increasingly-sought-by-cybercriminals
-
PCI DSS 4.0 Compliance Requires a New Approach to API Security
Retailers, Financial Services, and the API Security Wake-Up Call With the PCI DSS 4.0 compliance deadline fast approaching, Cequence threat researchers have uncovered troubling data: 66.5% of malicious traffic is targeting retailers. And attackers aren’t just after payment data. They’re weaponizing APIs to exploit every stage of the digital buying process. The conclusions in this……
-
Browser extension sales, updates pose hidden threat to enterprises
Some browser extension permissions are too broad, and owners can quickly repurpose pre-approved capabilities for malicious intent, a security researcher told CyberScoop. First seen on cyberscoop.com Jump to article: cyberscoop.com/browser-extension-sales-permissions-hidden-threat/
-
Classiscam Operators Use Automated Malicious Sites to Steal Financial Data
Classiscam, an automated scam-as-a-service operation, has been identified as a significant threat in Central Asia, leveraging sophisticated techniques to defraud users of online marketplaces and e-commerce platforms. This fraudulent scheme, highlighted in the High-Tech Crime Trends Report 2025, utilizes Telegram bots to generate fake websites that mimic legitimate services, effectively deceiving victims into sharing their…
-
Malicious npm packages found to create a backdoor in legitimate code
Attackers open a reverse shell: This payload is a reverse shell that uses the ssh2 client functionality from the original ethers-provider2 to establish an SSH connection to an attacker-controlled server. The ethers-provider2 ssh client code is modified to listen to certain messages from the server and turn into a reverse shell, meaning the server can…
-
Threat Actors Compromise 150,000 Websites to Promote Chinese Gambling Platforms
A large-scale cyberattack has compromised approximately 150,000 legitimate websites by injecting malicious JavaScript to redirect visitors to Chinese-language gambling platforms. The campaign, first detected in February 2025 with 35,000 infected sites, has since expanded significantly, leveraging obfuscated scripts and iframe injections to hijack browsers. Attackers use domains like zuizhongyj[.]com to host payloads, which display full-screen…
-
New Report Explains Why CASB Solutions Fail to Address Shadow SaaS and How to Fix It
Whether it’s CRMs, project management tools, payment processors, or lead management tools – your workforce is using SaaS applications by the pound. Organizations often rely on traditional CASB solutions for protecting against malicious access and data exfiltration, but these fall short for protecting against shadow SaaS, data damage, and more.A new report, Understanding SaaS Security…
-
Malicious Google Ads Target DeepSeek Users to Spread Malware
Cybersecurity threats continue to evolve, with malicious actors exploiting popular platforms like Google Ads to spread malware. Recently, a sophisticated campaign targeting DeepSeek users has been uncovered, highlighting the ongoing risks associated with sponsored search results. The Threat Landscape DeepSeek, a rising platform, has become a lure for cybercriminals who are using fake sponsored Google…
-
CISA Adds Sitecore CMS Code Execution Vulnerability to Exploited List
The Cybersecurity and Infrastructure Security Agency (CISA) has included a critical deserialization vulnerability affecting Sitecore CMS and Experience Platform (XP). This vulnerability, tracked as CVE-2019-9874, allows unauthenticated attackers to execute arbitrary code by manipulating HTTP POST parameters, specifically the __CSRFTOKEN field. The vulnerability exploits a weakness in the Sitecore.Security.AntiCSRF module, enabling malicious actors to send…