Tag: malicious
-
Malicious npm Package Targets Developers for Supply Chain Attack
The Socket Research Team has uncovered a malicious npm package@ton-wallet/create designed to steal sensitive cryptocurrency wallet keys from developers and users in the TON blockchain ecosystem. TON, originally developed by Telegram, is a growing platform for decentralized applications (dApps), smart contracts, and cryptocurrency transactions. The malicious package impersonated the legitimate @ton/ton package and remained undetected…
-
Over 35,000 Websites Hacked to Inject Malicious Scripts Redirecting Users to Chinese Websites
In a widespread cyberattack, over 35,000 websites have been compromised by a malicious campaign that injects harmful scripts into their codebase. The injected scripts redirect users to Chinese-language gambling platforms, primarily under the >>Kaiyun
-
Lumma Stealer Malware Delivered Through Weaponized Files Disguised as Videos
The Lumma Stealer malware, a sophisticated infostealer, is being actively distributed through malicious files disguised as video content on platforms like YouTube. Researchers at Silent Push have uncovered alarming patterns in the malware’s infrastructure, revealing its use of weaponized files to steal sensitive user data. These files are often embedded in video descriptions, comments, or…
-
200 Malicious GitHub Repositories Distributing Malware to Developers
A sophisticated malware campaign dubbedGitVenomhas infected over 200 GitHub repositories, targeting developers with fake projects masquerading as legitimate tools. The repositories, active for nearly two years, deploy stealers, remote access Trojans (RATs), and clippers to compromise systems and steal sensitive data, including cryptocurrency wallets. According to the Kaspersky Report, Security researchers estimate the threat actors…
-
How to create an effective incident response plan
Tags: access, advisory, attack, backup, breach, business, ceo, ciso, communications, corporate, cyber, cybersecurity, email, endpoint, exploit, finance, governance, guide, incident, incident response, insurance, law, lessons-learned, malicious, monitoring, network, office, phone, ransomware, risk, security-incident, service, strategy, supply-chain, technology, threat, updateEstablish a comprehensive post-incident communications strategy: Another key element that can make or break an incident response strategy is communications. Without clear communications among the major stakeholders of the business, a company might experience much longer downtimes or the loss of vital processes for extended periods.”How are you going to go about communicating? With whom?…
-
Beware of Fake Job Interview Challenges Targeting Developers to Deliver Malware
Tags: attack, credentials, crypto, cyber, cyberattack, jobs, korea, login, malicious, malware, north-korea, software, threatA new wave of cyberattacks, dubbed >>DeceptiveDevelopment,
-
Hackers Evade Outlook Spam Filters to Deliver Malicious ISO Files
A newly discovered technique allows threat actors to circumvent Microsoft Outlook’s spam filters to deliver malicious ISO files, exposing organizations to sophisticated phishing campaigns. The bypass leverages hyperlink obfuscation to disguise malicious links as benign URLs, enabling attackers to distribute malware-laden disk image files directly to victims’ inboxes. As per a report by Afine, Security…
-
Essential Steps for Military Members to Protect Against Identity Theft
Over the course of my professional and military career, I’ve noticed an increasing trend in malicious actions targeting the military community. Military personnel face unique cybersecurity threats, including targeted identity theft from foreign adversaries. Service members in particular are high-value targets due to their security clearances, financial stability, and access to classified or sensitive information. ……
-
OpenAI cracks down on malicious ChatGPT usage
First seen on scworld.com Jump to article: www.scworld.com/brief/openai-cracks-down-on-malicious-chatgpt-usage
-
GitVenom Campaign Abuses Thousands of GitHub Repositories to Infect Users
The GitVenom campaign, a sophisticated cyber threat, has been exploiting GitHub repositories to spread malware and steal cryptocurrency. This campaign involves creating hundreds of fake GitHub repositories that appear legitimate but contain malicious code. These repositories are designed to lure unsuspecting developers into downloading and executing the malicious code, which can lead to significant financial…
-
Widespread Chrome Malware: 16 Extensions Infect Over 3.2 Million Users
A recent cybersecurity investigation has uncovered a cluster of 16 malicious Chrome extensions that have compromised at least 3.2 million users. These extensions, which include functionalities like screen capture, ad blocking, and emoji keyboards, were found to inject code into browsers, facilitating advertising and search engine optimization fraud. The threat actor behind this campaign is…
-
Android App on Google Play Targets Indian Users to Steal Login Credentials
A malicious Android application, Finance Simplified (package: com.someca.count), has been identified on the Google Play Store, targeting Indian users under the guise of a financial management tool. The app, which claims to offer an EMI calculator, is instead a sophisticated malware platform facilitating predatory lending, data theft, and extortion. Rapid Spread and Exploitative Practices The…
-
Essential Addons for Elementor XSS Vulnerability Discovered
Elementor plugin flaw puts 2m WordPress websites at risk, allowing XSS attacks via malicious scripts First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/elementor-plugin-vulnerability-2m/
-
Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign
ighlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to…
-
GitVenom Campaign: Malicious GitHub Repositories Target Crypto and Credentials
Security researchers at Kaspersky Labs have uncovered a large-scale cybercrime campaign, dubbed GitVenom, that targets GitHub users by First seen on securityonline.info Jump to article: securityonline.info/gitvenom-campaign-malicious-github-repositories-target-crypto-and-credentials/
-
LockBit Ransomware Strikes: Exploiting a Confluence Vulnerability
Tags: attack, cvss, cyber, data-breach, exploit, lockbit, malicious, ransomware, remote-code-execution, vulnerability, windowsIn a swift and highly coordinated attack, LockBit ransomware operators exploited a critical remote code execution vulnerability (CVE-2023-22527) in Atlassian Confluence servers, targeting an exposed Windows server. This vulnerability, rated CVSS 10.0, enabled unauthenticated attackers to execute arbitrary commands by injecting malicious Object-Graph Navigation Language (OGNL) expressions into improperly sanitized template files. The attack commenced…
-
Exim Mail Transfer Vulnerability Allows Attackers to Inject Malicious SQL
A newly disclosed vulnerability in the Exim mail transfer agent (CVE-2025-26794) has sent shockwaves through the cybersecurity community, revealing a critical SQL injection flaw that enables attackers to compromise email systems and manipulate underlying databases. The vulnerability, confirmed in Exim Version 4.98 installations using SQLite for hints databases, represents one of the most severe email…
-
New Apiiro tools show promise in malicious code detection
First seen on scworld.com Jump to article: www.scworld.com/brief/new-apiiro-tools-show-promise-in-malicious-code-detection
-
How malicious AI powers the latest surge of advanced email threats
First seen on scworld.com Jump to article: www.scworld.com/perspective/how-malicious-ai-powers-the-latest-surge-of-advanced-email-threats
-
Ghost in the Shell: Null-AMSI Bypasses Security to Deploy AsyncRAT
Cyble Research and Intelligence Labs (CRIL) has uncovered a stealthy campaign that uses malicious LNK files disguised as seemingly innocent wallpapers to deliver AsyncRAT”, an infamous remote access trojan (RAT). First seen on thecyberexpress.com Jump to article: thecyberexpress.com/asyncrat-attack/
-
CVE-2024-12284: NetScaler Users Urged to Update Against Critical Flaw
Cloud Software Group released critical security updates to address a high-severity vulnerability in the NetScaler Console and NetScaler Console Agent, identified as CVE-2024-12284. This vulnerability could potentially allow an authenticated malicious actor to execute commands without additional authorization, which could lead to security risks if not addressed promptly. First seen on thecyberexpress.com Jump to article:…
-
Hackers pose as employers to steal crypto, login credentials
Since early 2024, ESET researchers have been tracking DeceptiveDevelopment, a series of malicious campaigns linked to North Korea-aligned operators. Disguising themselves as … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/20/deceptivedevelopment-fake-job-offers/
-
CISA and FBI Issue Alert as Ghost Ransomware Targets 70+ Organizations
Tags: access, advisory, cisa, cyber, cybersecurity, exploit, infrastructure, malicious, ransomware, software, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued a joint advisory warning about the increasing threat posed by Ghost ransomware. This malicious campaign has already impacted more than 70 organizations across various sectors, exploiting vulnerabilities in widely-used software to gain access to targeted networks. Exploitation of Vulnerabilities…
-
Windows Disk Cleanup Tool Exploit Allows SYSTEM Privilege Escalation
Microsoft has urgently addressed a high-severity privilege escalation vulnerability (CVE-2025-21420) in the Windows Disk Cleanup Utility (cleanmgr.exe) during its February 2025 Patch Tuesday updates. The flaw, scoring 7.8 on the CVSS scale, enabled attackers to execute malicious code with SYSTEM privileges through DLL sideloading techniques. Technical Mechanism of the Exploit The vulnerability leverages cleanmgr.exe’s privileged…
-
Russian cyberespionage groups target Signal users with fake group invites
QR codes provide a means of phishing Signal users: These features now work by scanning QR codes that contain the cryptographic information needed to exchange keys between different devices in a group or to authorize a new device to an account. The QR codes are actually representations of special links that the Signal application knows…
-
WordPress Plugin Vulnerability Exposes 90,000 Sites to Attack
A flaw in the Jupiter X Core plugin has been identified, allowing upload of malicious SVG files and remote code execution on vulnerable servers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/wordpress-plugin-flaw-exposes/