Collecting Cyber-News from over 60 sources

Tag: malicious

Lumma Stealer Using Fake Google Meet Windows Update Sites to Launch “Click Fix” Style Attack

Mar 8, 2025 6:53 AM

Tags: attack, cyber, cybersecurity, google, malicious, malware, powershell, social-engineering, tactics, update, windows

Cybersecurity researchers continue to track sophisticated >>Click Fix
Malicious backdoor-deploying JavaScript facilitates widespread WordPress site compromise

Mar 7, 2025 9:54 PM

Tags: backdoor, malicious, wordpress

First seen on scworld.com Jump to article: www.scworld.com/brief/malicious-backdoor-deploying-javascript-facilitates-widespread-wordpress-site-compromise
Static Scans, Red Teams, and Frameworks Aim to Find Bad AI Models

Mar 7, 2025 9:54 PM

Tags: ai, cybersecurity, framework, intelligence, malicious, RedTeam, technology

With hundreds of artificial intelligence models found harboring malicious code, cybersecurity firms are releasing technology to help companies manage their AI development and deployment efforts. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/static-scans-red-teams-frameworks-aim-find-bad-ai-models
Malicious use of Cobalt Strike down 80% after crackdown, Fortra says

Mar 7, 2025 8:53 PM

Tags: cybercrime, malicious, software

An effort launched in 2023 to curb the longstanding issue of pirated Cobalt Strike software being used by cybercriminals appears to have borne fruit. First seen on therecord.media Jump to article: therecord.media/malicious-cobalt-strike-use-down
Cybersecurity Snapshot: CSA Outlines Data Security Challenges and Best Practices, While ISACA Offers Tips To Retain IT Pros

Mar 7, 2025 8:53 PM

Tags: advisory, ai, awareness, banking, best-practice, business, cloud, compliance, corporate, crime, crypto, cve, cyber, cybercrime, cybersecurity, data, defense, exploit, extortion, finance, fraud, governance, government, group, healthcare, infrastructure, iot, jobs, mail, malicious, microsoft, mitigation, monitoring, network, nis-2, privacy, qr, ransom, ransomware, regulation, resilience, risk, risk-assessment, risk-management, scam, service, strategy, technology, threat, tool, vmware, vulnerability, vulnerability-management, zero-day

Check out best practices for shoring up data security and reducing cyber risk. Plus, get tips on how to improve job satisfaction among tech staff. Meanwhile, find out why Congress wants federal contractors to adopt vulnerability disclosure programs. And get the latest on cyber scams; zero-day vulnerabilities; and critical infrastructure security. Dive into six things…
New PyPI Malware Targets Developers to Steal Ethereum Wallets

Mar 7, 2025 5:53 PM

Tags: cyber, exploit, malicious, malware, pypi

A recent discovery by the Socket Research Team has unveiled a malicious PyPI package named set-utils, designed to steal Ethereum private keys by exploiting commonly used account creation functions. This package masquerades as a utility for Python sets, mimicking popular libraries like python-utils and utils, thereby deceiving developers into installing it. Since its release it…
Microsoft Warns: 1 Million Devices Infected by Malware from GitHub

Mar 7, 2025 5:53 PM

Tags: attack, cyber, github, malicious, malware, microsoft

In a recent alert, Microsoft revealed a large-scale malvertising campaign that has compromised nearly one million devices worldwide. This campaign, which began in early December 2024, leverages malicious redirects from illegal streaming websites to deliver malware hosted on platforms like GitHub. The attack is notable for its indiscriminate targeting, affecting both consumer and enterprise devices…
YouTube Alerts Creators About Phishing Emails Targeting Login Credentials

Mar 7, 2025 2:53 PM

Tags: advisory, ai, attack, ceo, credentials, cyber, deep-fake, email, exploit, login, malicious, phishing, social-engineering, tactics, tool

YouTube has issued a critical security advisory following a widespread phishing campaign exploiting private video sharing to distribute AI-generated deepfakes of CEO Neal Mohan. The fraudulent videos falsely claim changes to the platform’s monetization policies, urging creators to click malicious links. This sophisticated attack vector combines social engineering tactics with advanced generative AI tools, targeting…
Linux, macOS users infected with malware posing as legitimate Go packages

Mar 7, 2025 1:53 PM

Tags: linux, macOS, malicious, malware, tactics, threat, tool

Campaign is tailor-made for persistence : The repeated use of identical filenames, array-based string obfuscation, and delayed execution tactics strongly suggests a coordinated adversary who plans to persist and adapt, the researchers added.The presence of multiple malicious Hypert and Layout packages along with several fallback domains also suggests a resilient infrastructure. This setup will allow threat…
Phantom Goblin Uses Social Engineering Tactics to Deploy Stealer Malware

Mar 7, 2025 12:54 PM

Tags: access, cyber, cybersecurity, data, malicious, malware, social-engineering, tactics, unauthorized

A sophisticated malware operation, dubbed >>Phantom Goblin,
AMD Microcode Vulnerability Allows Attackers to Load Malicious Patches

Mar 7, 2025 11:53 AM

Tags: attack, cyber, flaw, Hardware, malicious, update, vulnerability

A critical vulnerability in AMD’s Zen 1 through Zen 4 processors allows attackers to bypass microcode signature validation, potentially undermining hardware-based security mechanisms. The flaw stems from AMD’s use of AES-CMAC as a hash function during microcode patch verification a design decision that enables collision attacks and forged RSA keys. Vulnerability Rooted in Cryptographic […]…
This Malicious PyPI Package Stole Ethereum Private Keys via Polygon RPC Transactions

Mar 7, 2025 11:53 AM

Tags: cybersecurity, malicious, pypi

Cybersecurity researchers have discovered a malicious Python package on the Python Package Index (PyPI) repository that’s equipped to steal a victim’s Ethereum private keys by impersonating popular libraries.The package in question is set-utils, which has received 1,077 downloads to date. It’s no longer available for download from the official registry.”Disguised as a simple utility for…
Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist

Mar 7, 2025 7:53 AM

Tags: attack, cloud, crypto, cybersecurity, google, hacker, malicious, mandiant, north-korea, threat

Safe{Wallet} has revealed that the cybersecurity incident that led to the Bybit $1.5 billion crypto heist is a “highly sophisticated, state-sponsored attack,” stating the North Korean threat actors behind the hack took steps to erase traces of the malicious activity in an effort to hamper investigation efforts.The multi-signature (multisig) platform, which has roped in Google…
PHP-CGI RCE Flaw Exploited in Attacks on Japan’s Tech, Telecom, and E-Commerce Sectors

Mar 7, 2025 6:53 AM

Tags: access, attack, cisco, cve, exploit, flaw, malicious, rce, remote-code-execution, threat, vulnerability, windows

Threat actors of unknown provenance have been attributed to a malicious campaign predominantly targeting organizations in Japan since January 2025.”The attacker has exploited the vulnerability CVE-2024-4577, a remote code execution (RCE) flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access to victim machines,” Cisco Talos researcher Chetan Raghuprasad said in a…
Detecting Malicious Activities With Traffic Distribution Systems

Mar 6, 2025 7:54 PM

Tags: attack, cyber, cybercrime, exploit, infrastructure, malicious, malware, network, phishing, service, tool

Traffic Distribution Systems (TDS) have emerged as critical tools for both legitimate and malicious purposes, serving as sophisticated redirection networks that manage traffic flow across multiple endpoints. While businesses use TDS to optimize marketing campaigns and improve service reliability, cybercriminals exploit this infrastructure to orchestrate phishing attacks, malvertising campaigns, and illicit services. These systems obfuscate…
Hackers Deploy Advanced Social Engineering Tactics in Phishing Attacks

Mar 6, 2025 7:54 PM

Tags: apt, attack, cyber, cybercrime, hacker, malicious, phishing, social-engineering, strategy, tactics, threat

Cybercriminals are evolving their phishing methods, employing more sophisticated social engineering tactics to deceive their targets. Recent findings from ESET’s APT Activity Report highlight a concerning trend where threat actors are establishing relationships with potential victims before deploying malicious content. This shift in strategy makes it increasingly challenging for employees to identify and avoid phishing…
BadBox Malware Infects 50,000+ Android Devices via 24 Apps on Google Play

Mar 6, 2025 7:54 PM

Tags: android, botnet, cyber, cyberattack, google, intelligence, malicious, malware, threat

HUMAN’s Satori Threat Intelligence and Research team has uncovered a complex cyberattack dubbed >>BADBOX 2.0,
Hackers Exploit ‘Any/Any’ Communication Configurations in Cloud Services to Host Malware

Mar 6, 2025 7:54 PM

Tags: cloud, control, cyber, cybersecurity, detection, exploit, hacker, infrastructure, malicious, malware, service, tactics

Recent research by Veriti has uncovered a disturbing trend in cybersecurity: malicious actors are increasingly leveraging cloud infrastructure to distribute malware and operate command-and-control (C2) servers. This shift in tactics presents significant challenges for detection and exposes organizations to heightened security risks. Cloud Misconfigurations Open Doors for Attackers The study reveals that over 40% of…
Ethereum private key stealer on PyPI downloaded over 1,000 times

Mar 6, 2025 6:53 PM

Tags: malicious, pypi

A malicious Python Package Index (PyPI) package named “set-utils” has been stealing Ethereum private keys through intercepted wallet creation functions and exfiltrating them via the Polygon blockchain. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ethereum-private-key-stealer-on-pypi-downloaded-over-1-000-times/
EvilLoader Unpatched Telegram for Android 0-Day Vulnerability Lets Attackers Install Malware Via Video Files

Mar 6, 2025 6:53 PM

Tags: android, cyber, exploit, malicious, malware, threat, unauthorized, vulnerability, zero-day

A new zero-day vulnerability in Telegram for Android, dubbed EvilLoader, has been uncovered by malware analyst 0x6rss. This exploit enables threat actors to disguise malicious APKs as video files, potentially leading to unauthorized malware installations on users’ devices. The vulnerability, which remains unpatched in the latest Telegram for Android version 11.7.4, allows attackers to manipulate…
Malware Infects Linux and macOS via Typosquatted Go Packages

Mar 6, 2025 5:53 PM

Tags: linux, macOS, malicious, malware

Socket exposes a typosquatting campaign delivering malware to Linux and macOS systems via malicious Go packages. Discover the… First seen on hackread.com Jump to article: hackread.com/malware-infects-linux-macos-typosquatted-go-packages/
BadBox malware disrupted on 500K infected Android devices

Mar 5, 2025 6:34 PM

Tags: android, botnet, communications, google, malicious, malware

The BadBox Android malware botnet has been disrupted again by removing 24 malicious apps from Google Play and sinkholing communications for half a million infected devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/badbox-malware-disrupted-on-500k-infected-android-devices/
We’re losing”Š”, “Šbut it can’t get any worse, right?

Mar 5, 2025 5:34 PM

Tags: access, ai, antivirus, api, attack, chatgpt, cloud, control, crowdstrike, cybersecurity, defense, detection, edr, encryption, github, infection, injection, korea, LLM, malicious, malware, mandiant, ml, monitoring, network, north-korea, openai, phishing, powershell, service, social-engineering, threat, tool

We’re losing”Š”, “Šbut it can’t get any worse, right? LLMs are being used in many ways by attackers; how blind are you? We’re spending hundreds of billions and losing trillions in cybersecurity. The industry structure is partially to blame. AI is here to help, right? Well, as others have pointed out, AI is being adopted more rapidly…
Critical vulnerabilities expose network security risks in Keysight’s infrastructure

Mar 5, 2025 3:34 PM

Tags: access, advisory, attack, best-practice, cisa, control, cve, cyber, cybersecurity, data, defense, exploit, flaw, infrastructure, Internet, malicious, mitigation, network, risk, service, software, strategy, threat, unauthorized, update, vpn, vulnerability

Potential threats to enterprises: Successful exploitation of these vulnerabilities could have dire consequences, including system crashes, arbitrary file deletions, and unauthorized access to sensitive information. Attackers leveraging these flaws may gain control over affected devices, facilitating further attacks within an enterprise’s network.Furthermore, multiple path traversal vulnerabilities (CVE-2025-21095 and CVE-2025-23416) identified in the affected software versions…
Vim Vulnerability (CVE-2025-27423) Allows Code Execution via Malicious TAR Archives

Mar 5, 2025 12:34 PM

Tags: cyber, flaw, malicious, update, vulnerability

A high-severity security flaw in the widely used Vim text editor allows attackers to execute arbitrary code on vulnerable systems by tricking users into opening specially crafted TAR archives. Tracked as CVE-2025-27423, this vulnerability has prompted urgent patching efforts and warnings for developers and system administrators globally. Technical Breakdown of the Vulnerability The flaw resides in…
Telegram EvilVideo Vulnerability Exploited to Run Malicious Code on Victims’ Devices

Mar 5, 2025 11:34 AM

Tags: attack, cyber, cybersecurity, exploit, infrastructure, malicious, vulnerability

A newly documented exploitation technique targeting Telegram’s file-sharing infrastructure has raised alarms in cybersecurity circles. Dubbed >>EvilVideo,
The dirty dozen: 12 worst ransomware groups active today

Mar 5, 2025 10:34 AM

Tags: access, ai, alphv, apt, attack, backup, breach, cloud, cyber, cybercrime, dark-web, data, detection, email, encryption, endpoint, exploit, extortion, finance, government, group, healthcare, infrastructure, intelligence, korea, law, leak, linux, lockbit, malicious, malware, moveIT, network, north-korea, organized, phishing, ransom, ransomware, russia, service, social-engineering, software, strategy, threat, tool, usa, vmware, vulnerability, windows, zero-day

Black Basta: History: Black Basta appeared on the ransomware scene in early 2022 and is believed to be a spin-off from Conti, a group notorious for attacking major organizations.How it works: Black Basta usually deploys malware through exploitation of known vulnerabilities and social engineering campaigns. “Employees in the target environment are email bombed and then…
Seven Malicious Go Packages Found Deploying Malware on Linux and macOS Systems

Mar 5, 2025 9:34 AM

Tags: apple, cybersecurity, finance, linux, macOS, malicious, malware, threat

Cybersecurity researchers are alerting of an ongoing malicious campaign targeting the Go ecosystem with typosquatted modules that are designed to deploy loader malware on Linux and Apple macOS systems.”The threat actor has published at least seven packages impersonating widely used Go libraries, including one (github[.]com/shallowmulti/hypert) that appears to target financial-sector developers First seen on thehackernews.com…
NVIDIA Issues Warning About Severe Security Flaws Enabling Code Attacks

Mar 5, 2025 7:34 AM

Tags: attack, computing, cyber, firmware, flaw, infrastructure, malicious, nvidia, service, update

NVIDIA has issued an urgent security bulletin urging customers using itsHopper HGX 8-GPU High-Performance Computing (HMC) systemsto immediately install firmware updates addressing two critical vulnerabilities. Released on February 28, 2025, the patches target flaws that could allow attackers to execute malicious code, escalate privileges, or cripple enterprise GPU infrastructure through denial-of-service (DoS) attacks. The advisories…
Polyglot files used to spread new backdoor

Mar 5, 2025 5:34 AM

Tags: access, attack, awareness, backdoor, business, ceo, cio, ciso, computer, control, corporate, cybercrime, data, detection, email, endpoint, espionage, exploit, india, infection, infrastructure, malicious, malware, social-engineering, technology, threat, training

the attackers first compromised the email account of an Indian electronics company, then used that access to send email messages with malicious links;the link led to a ZIP file that includes polyglot files to obfuscate payload content.According to Proofpoint, the use by threat actors of polyglot files, which are files that can be interpreted by…