Tag: malicious
-
Malicious package found in the Go ecosystem
A malicious typosquat package has been found in the Go language ecosystem. The package, which contains a backdoor to enable remote code execution, was discovered by researchers at the application security company Socket.A February 3 Socket blog post states that the package impersonates the widely used Bolt database module. The BoltDB package is widely adopted in the Go ecosystem, with 8,367…
-
Lazarus Group tricks job seekers on LinkedIn with crypto-stealer
North Korea-linked Lazarus Group is duping job seekers and professionals in an ongoing campaign that runs a LinkedIn recruiting scam to capture browser credentials, steal crypto wallet data, and launch persistence.According to a discovery made by BitDefender Labs, threat actors reach out with fake LinkedIn job offers to lure the victims into downloading and executing…
-
Cybercriminals Abusing ScreenConnect RMM Tool for Persistent Access
Tags: access, cyber, cybercrime, cybersecurity, exploit, malicious, monitoring, software, threat, toolCybersecurity experts have identified an alarming trend of cybercriminals exploiting ConnectWise ScreenConnect, a widely-used Remote Monitoring and Management (RMM) tool, to establish persistent access to compromised systems. Threat Actors Exploit Legitimate Software for Malicious Gains Silent Push Threat Analysts and other researchers have observed a surge in the abuse of this legitimate software, leveraging its…
-
SmartApeSG Campaign Uncovered: A Deep Dive into NetSupport RAT Distribution and Suspected Threat Actor Connections
A recent investigation by Team Cymru has revealed an intricate web of malicious infrastructure linking the SmartApeSG FakeUpdate First seen on securityonline.info Jump to article: securityonline.info/smartapesg-campaign-uncovered-a-deep-dive-into-netsupport-rat-distribution-and-suspected-threat-actor-connections/
-
SparkCat campaign target crypto wallets using OCR to steal recovery phrases
In late 2024, Kaspersky experts discovered a malicious campaign, called SparkCat, spreading malware to target crypto wallets. In March 2023, ESET found malware in modified versions of messengers using OCR to scan the victim’s gallery for images with recovery phrases to restore access to crypto wallets. In late 2024, Kaspersky discovered a new malicious campaign,…
-
IBM Cloud Pak Security Vulnerabilities Expose Sensitive Data to Attackers
IBM recently disclosed a series of significant security vulnerabilities in its Cloud Pak for Business Automation platform, raising alarms about the potential exposure of sensitive data to malicious actors. The security issues, detailed in an official bulletin published on February 4, 2025, affect multiple versions of the Cloud Pak ecosystem and associated open-source components. Vulnerabilities…
-
MacOS Ferret operators add a deceptive bite to their malware family
The macOS Ferret family, variants of malware used by North Korean APTs for cyber espionage, has received a new member as samples of a detection-resistant variant, Flexible-Ferret, appear in the wild.The discovery of the samples was made by SentinelOne researchers who noted the variant’s capability to evade the recent XProtect signature update that Apple pushed…
-
Chinese CDN Exploiting AWS Microsoft Cloud to Host Malicious Websites
Tags: china, cloud, cyber, cybercrime, cybersecurity, exploit, malicious, microsoft, network, serviceA recent investigation by cybersecurity firm Silent Push has revealed how a China-linked Content Delivery Network (CDN), known as FUNNULL, is exploiting major cloud providers like Amazon Web Services (AWS) and Microsoft Azure to host malicious websites. The technique, termed >>infrastructure laundering,
-
Weaponized Go Package Module Let Attackers Gain Remote Access to Infected Systems
Tags: access, attack, backdoor, cyber, cybersecurity, malicious, open-source, software, supply-chain, threatIn a significant software supply chain attack, cybersecurity researchers uncovered a malicious Go package that impersonates the widely trusted BoltDB database module. The typosquat packagegithub.com/boltdb-go/bolt was found to include a backdoor enabling remote access to infected systems, allowing attackers to execute arbitrary commands. This discovery underscores the growing sophistication of threats targeting open-source ecosystems. The…
-
Critical Netgear Vulnerabilities Allow Hackers to Execute Remote Code
Netgear has addressed critical security vulnerabilities in several of its popular router models that could allow hackers to execute remote code without authentication. If not resolved promptly, these vulnerabilities pose a significant risk to affected devices, potentially enabling malicious actors to compromise networks. Critical Security Threat The vulnerability, rated as Critical with a CVSS score of 9.8,…
-
Threat Actors Exploiting DeepSeek’s Rise to Fuel Cyber Attacks
Amid the surging popularity of DeepSeek, a cutting-edge AI reasoning model from an emerging Chinese startup, cybercriminals have wasted no time leveraging the widespread attention to launch fraudulent schemes. While the innovative AI tool has captivated global audiences, its meteoric rise has brought with it a new wave of malicious campaigns that prey on users’…
-
New trojan hijacks Linux and IoT devices
There’s a new trojan on the block, one that specifically targets network appliances and internet of things (IoT) devices running the open-source Linux operating system.FortiGuard Labs has identified a new malware kit, dubbed “ELF/Sshdinjector.A!tr”, that has the ability to infect and remotely control systems, establish root privilege, maintain malware presence, exfiltrate data such as user…
-
How to make any AMD Zen CPU always generate 4 as a random number
Malicious microcode vulnerability discovered, fixes rolling out for Epycs at least First seen on theregister.com Jump to article: www.theregister.com/2025/02/04/google_amd_microcode/
-
AMD, Google disclose Zen processor microcode vulnerability
AMD said CVE-2024-56161, which first leaked last month, requires an attacker to have local administrator privileges as well as developed and executed malicious microcode. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366618758/AMD-Google-disclose-Zen-processor-microcode-vulnerability
-
Infostealers spread via malicious DeepSeek-spoofing PyPI packages
First seen on scworld.com Jump to article: www.scworld.com/brief/infostealers-spread-via-malicious-deepseek-spoofing-pypi-packages
-
AMD Patches CPU Vulnerability That Could Break Confidential Computing Protections
AMD has released patches for a microprocessor vulnerability found by Google that could allow an attacker to load malicious microcode. The post AMD Patches CPU Vulnerability That Could Break Confidential Computing Protections appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/amd-patches-cpu-vulnerability-found-by-google/
-
Super Bowl Betting Under Attack: Weak Security Puts Users Winnings at Risk
As the Super Bowl approaches, betting websites are experiencing a surge in traffic, attracting not just enthusiastic bettors but also malicious actors looking to exploit security gaps First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/super-bowl-betting-under-attack-weak-security-puts-users-winnings-at-risk/
-
AMD fixed a flaw that allowed to load malicious microcode
AMD released security patches to fix a flaw that could bypass SEV protection, letting attackers load malicious microcode. Researchers from Google disclosed an improper signature verification vulnerability, tracked as CVE-2024-56161 (CVSS score of 7.2), in AMD’s Secure Encrypted Virtualization (SEV). An attacker could trigger the flaw to load a malicious CPU microcode under specific conditions. >>Improper…
-
Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access
Cybersecurity researchers have called attention to a software supply chain attack targeting the Go ecosystem that involves a malicious package capable of granting the adversary remote access to infected systems.The package, named github.com/boltdb-go/bolt, is a typosquat of the legitimate BoltDB database module (github.com/boltdb/bolt), per Socket. The malicious version (1.3.1) was published to First seen on…
-
CVE-2025-21415: Critical Flaw in Azure AI Face Service
Microsoft has addressed two critical security vulnerabilities that posed potential threats to its cloud-based services. The patches resolve security flaws affecting Azure AI Face Service and Microsoft Account, both of which could have allowed malicious actors to escalate privileges under… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2025-21415-azure-ai-face-service/
-
AMD Patches CPU Vulnerability Found by Google
AMD has released patches for a microprocessor vulnerability that could allow an attacker to load malicious microcode. The post AMD Patches CPU Vulnerability Found by Google appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/amd-patches-cpu-vulnerability-found-by-google/
-
Hackers impersonate DeepSeek to distribute malware
Tags: access, ai, api, attack, automation, breach, china, cloud, computer, credentials, cyberattack, data, hacker, infrastructure, leak, LLM, malicious, malware, ml, pypi, threat, tool, vulnerabilityTo make things worse than they already are for DeepSeek, hackers are found flooding the Python Package Index (PyPI) repository with fake DeepSeek packages carrying malicious payloads.According to a discovery made by Positive Expert Security Center (PT ESC), a campaign was seen using this trick to dupe unsuspecting developers, ML engineers, and AI enthusiasts looking…
-
How to Root Out Malicious Employees
Malicious employees and insider threats pose one of the biggest security risks to organizations, as these users have more access and permissions than cybercriminals attacking the organization externally. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/how-to-root-out-malicious-employees/
-
Here’s all the ways an abandoned cloud instance can cause security issues
Research released Tuesday by watchTowr shows how easy an old storage bucket can be repurposed by malicious attackers. First seen on cyberscoop.com Jump to article: cyberscoop.com/abandoned-cloud-aws-s3-buckets-security-risk-watchtowr/
-
Developers Targeted With Malware Disguised as DeepSeek Package
Python developers looking to integrate DeepSeek into their projects were targeted with malicious packages delivered through PyPI. The post Developers Targeted With Malware Disguised as DeepSeek Package appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/developers-targeted-with-malware-disguised-as-deepseek-package/
-
Contec Patient Monitors Not Malicious, but Still Pose Big Risk to Healthcare
The Contec CMS8000 patient monitors do not contain a malicious backdoor but are plagued by an insecure and vulnerable design. The post Contec Patient Monitors Not Malicious, but Still Pose Big Risk to Healthcare appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/contec-patient-monitors-not-malicious-but-still-pose-big-risk-to-healthcare/