Tag: malicious
-
Blind Eagle Targets Colombian Government with Malicious .url Files
Blind Eagle has been running campaigns targeting the Colombian government with malicious .url files and phishing attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/blind-eagle-targets-colombian-gov/
-
Ex-Employee Sabotages Company Systems, Faces Up to 10 Years
Disgruntled ex-employee sabotages company systems with malicious code, causing major disruptions and financial losses. Learn about the case… First seen on hackread.com Jump to article: hackread.com/ex-employee-sabotages-company-systems-10-years-prison/
-
AI-Generated Fake GitHub Repositories Steal Login Credentials
Tags: ai, credentials, cyber, cybercrime, cybersecurity, exploit, github, login, malicious, malware, tactics, threatA concerning cybersecurity threat has emerged with the discovery of AI-generated fake GitHub repositories designed to distribute malware, including the notorious SmartLoader and Lumma Stealer. These malicious repositories, crafted to appear legitimate, exploit GitHub’s trusted reputation to deceive users into downloading ZIP files containing malicious code. The campaign highlights the evolving tactics cybercriminals employ to…
-
Blind Eagle Hackers Exploit Google Drive, Dropbox GitHub to Evade Security Measures
In a recent cyber campaign, the notorious threat actor group Blind Eagle, also known as APT-C-36, has been leveraging trusted cloud platforms like Google Drive, Dropbox, GitHub, and Bitbucket to distribute malware and evade traditional security defenses. This sophisticated approach allows them to bypass detection by disguising malicious files as harmless ones hosted on these…
-
PlayPraetor Malware Targets Android Users via Fake Play Store Apps to Steal Passwords
A sophisticated malware campaign, dubbed PlayPraetor, has been uncovered by cybersecurity firm CTM360. This operation involves creating fake Google Play Store websites that deceive users into downloading malicious Android applications. These apps, though appearing legitimate, are actually advanced banking Trojans designed to steal sensitive user information, including banking credentials and clipboard data. Operation Details The…
-
What is Rootkit Detection and Prevention
The intricacy of cyberattacks is growing. Imagine a stealthy cyberattack that infiltrates your network, computers, etc, hides malicious software, and silently dismantles your defenses without detection. This is how the rootkit works. Another aspect that makes rootkits a serious problem is that they are now easily available on the dark web, once exclusive only to……
-
Lazarus Hackers Exploit 6 NPM Packages to Steal Login Credentials
North Korea’s Lazarus Group has launched a new wave of attacks targeting the npm ecosystem, compromising six packages designed to steal login credentials and deploy backdoors. The malicious packages is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator have collectively been downloaded over 330 times. These packages mimic the names of widely trusted libraries, employing a typosquatting…
-
Hackers Compromise Windows Systems Using 5000+ Malicious Packages
A recent analysis by FortiGuard Labs has revealed a significant increase in malicious software packages, with over 5,000 identified since November 2024. These packages employ sophisticated techniques to evade detection and exploit system vulnerabilities, posing a substantial threat to Windows systems and other software environments. The tactics used by attackers include low-file-count packages, suspicious install…
-
Critical Veritas Vulnerability Allows Attackers to Execute Malicious Code
A critical vulnerability has been discovered in Veritas’ Arctera InfoScale product, a solution widely used for disaster recovery and high availability scenarios. The issue lies in the insecure deserialization of untrusted data in the .NET remoting endpoint, allowing attackers to execute malicious code on affected systems. Critical Veritas Vulnerability The vulnerability, identified as CVE-2025-27816, has a…
-
Almost 1 million business and home PCs compromised after users visited illegal streaming sites: Microsoft
Tags: authentication, awareness, business, control, cybersecurity, data, detection, email, endpoint, malicious, microsoft, privacy, technology, trainingPowerShell.exe, MSBuilt.exe and RegAsm.exe to connect to command and control (C2) servers and for data exfiltration of user data and browser credentials.Microsoft’s defensive recommendations include strengthening endpoint detection, particularly to block malicious artifacts, and requiring the use of multifactor authentication for logins. Security awareness training is critical: To be effective, any security awareness and training program needs to recognize…
-
North Korean Hackers Use ZIP Files to Deploy Malicious PowerShell Scripts
North Korean state-sponsored hackers, known as APT37 or ScarCruft, have been employing sophisticated tactics to breach systems, leveraging malicious ZIP files containing LNK files to initiate attacks. These LNK files, often disguised as documents related to North Korean affairs or trade agreements, are distributed via phishing emails. Once opened, they trigger a multi-stage attack involving…
-
Ragnar Loader Used by Multiple Ransomware Groups to Bypass Detection
Ragnar Loader, a sophisticated toolkit associated with the Ragnar Locker ransomware group, has been instrumental in facilitating targeted cyberattacks on organizations since its emergence in 2020. This malware is part of the Monstrous Mantis ransomware ecosystem and is designed to maintain persistent access to compromised systems, enabling sustained malicious operations. Ragnar Loader employs advanced tactics…
-
Over 1000 Malicious Packages Found Exploiting Open-Source Platforms
Over 1,000 malicious packages found using low file counts, suspicious installs, and hidden APIs. Learn key detection methods… First seen on hackread.com Jump to article: hackread.com/malicious-packages-exploiting-open-source-platforms/
-
Scam spoofs Binance website and uses TRUMP coin as lure for malware
Researchers at phishing defense company Cofense say hackers are spreading a malicious remote access tool through a fake Binance page that offers access to the TRUMP coin. First seen on therecord.media Jump to article: therecord.media/email-scam-spoofs-binance-offers-trump-coin-connectwise-rat
-
Former NSA cyber director warns drastic job cuts threaten national security
Rob Joyce told lawmakers;mass layoffs of federal workers;will hurt the ability of the U.S. to combat malicious cyber activity from China and other adversaries. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/nsa-cyber-director-job-cuts-national-security/742021/
-
Researchers Expose New Polymorphic Attack That Clones Browser Extensions to Steal Credentials
Cybersecurity researchers have demonstrated a novel technique that allows a malicious web browser extension to impersonate any installed add-on.”The polymorphic extensions create a pixel perfect replica of the target’s icon, HTML popup, workflows and even temporarily disables the legitimate extension, making it extremely convincing for victims to believe that they are providing credentials to First…
-
Surge in Malicious Software Packages Exploits System Flaws
A new report by Fortinet reveals techniques used by attackers to evade detection and compromise systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/malicious-software-packages/
-
North Korean IT Workers Linked to 2,400 Astrill VPN IP Addresses
new data has emerged linking over 2,400 IP addresses associated with Astrill VPN to individuals believed to be North Korean IT workers. These findings were reported by a cyber security source, who obtained the information from http://Spur.us, a platform known for tracking and exposing malicious online activity. This development raises serious concerns about the extent to…
-
Developer Convicted for Hacking Former Employer’s Systems
Davis Lu was convicted of sabotaging his employer’s systems through malicious code, and deleting encrypted data. The post Developer Convicted for Hacking Former Employer’s Systems appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/developer-convicted-for-hacking-former-employers-systems/
-
Laravel Framework Flaw Allows Attackers to Execute Malicious JavaScript
A significant vulnerability has been identified in the Laravel framework, specifically affecting versions between 11.9.0 and 11.35.1. The issue revolves around improper encoding of request parameters on the error page when the application is running in debug mode, leading to reflected cross-site scripting (XSS). This flaw has been assigned the CVE identifier CVE-2024-13918 and has…
-
Developer Pleads Guilty to Injecting Malware and Crippling Company Systems
In a stunning case of corporate sabotage, a former software developer for Eaton Corp., Davis Lu, 55, of Houston, has been found guilty by a jury of intentionally damaging the company’s internal computer systems. This malicious act occurred after his work responsibilities were reduced in 2018. The verdict was delivered after a six-day trial in…
-
New Apache Traffic Server Flaws Allow Malformed Request Exploits
The Apache Software Foundation has disclosed several vulnerabilities affecting its Traffic Server software. These vulnerabilities allow malicious actors to exploit malformed requests and access control list (ACL) issues, posing serious security risks to users. The vulnerabilities, identified by CVE numbersCVE-2024-38311,CVE-2024-56195,CVE-2024-56196, andCVE-2024-56202, havebeen reported byvarious researchers and affect multiple versions of the Apache Traffic Server. Description…
-
Commvault Webserver Flaw Allows Attackers to Gain Full Control
Commvault has revealed a major vulnerability in its software that could allow malicious actors to gain full control of its webservers. The issue, identified as CV_2025_03_1, has been categorized as a high-severity flaw and impacts multiple versions of the Commvault platform running on both Linux and Windows. The vulnerability in question allows attackers to create and…
-
Over 43 Million Python Installations Vulnerable to Dangerous Code Execution Flaw
A significant vulnerability has been uncovered in the Python JSON Logger package (python-json-logger), affecting versions 3.2.0 and 3.2.1. This flaw, CVE-2025-27607 allows for remote code execution (RCE) due to misusing a missing dependency known as msgspec-python313-pre. The issue gained widespread attention due to a recent experiment demonstrating how malicious actors could exploit this vulnerability by claiming…
-
Typo DGAs: A New Tactic in Malicious Redirection Campaigns
Unit 42 researchers have uncovered a new malware campaign employing a novel technique: typo-squatting domain generation algorithms (DGAs). First seen on securityonline.info Jump to article: securityonline.info/typo-dgas-a-new-tactic-in-malicious-redirection-campaigns/
-
Malvertising op targets almost 1M devices via malicious GitHub repos
First seen on scworld.com Jump to article: www.scworld.com/news/malvertising-campaign-uses-malicious-github-repos-to-target-nearly-1-million-devices
-
What Happens When Push Notifications Go Malicious?
A Storm of Scams Awaits! First seen on hackread.com Jump to article: hackread.com/what-happens-when-push-notifications-go-malicious/
-
10 Best Penetration Testing Companies in 2025
Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by identifying vulnerabilities in their systems, applications, and networks. These firms simulate real-world cyberattacks to uncover weaknesses that could be exploited by malicious actors, helping businesses implement proactive security measures. They provide services tailored to various industries, including web application security,…