Tag: malicious
-
LockBit Ransomware: 11-Day Timeline from Initial Compromise to Deployment
A well-coordinated cyber intrusion, spanning 11 days, culminated in the deployment of LockBit ransomware across a corporate environment. The attack, which began with the execution of a malicious file posing as a Windows Media Configuration Utility, displayed a sophisticated playbook leveraging Cobalt Strike, advanced persistence mechanisms, lateral movement, data exfiltration tools, and an eventual ransomware…
-
Cloudflare CDN Bug Outs User Locations on Signal, Discord
Attackers can use a zero- or one-click flaw to send a malicious image to targets, an image that can deanonymize a user within seconds, posing a threat to journalists, activists, hackers, and others whose locations are sensitive. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/cloudflare-cdn-bug-outs-user-locations-signal-discord
-
Securing APIs at Scale: How to Achieve Comprehensive API Visibility and Threat Detection
e=4>APIs are the backbone of modern applications, enabling connectivity and functionality across diverse systems. However, the growing complexity of API ecosystems introduces vulnerabilities that attackers exploit to disrupt operations, steal data, or launch other malicious activities. Without real-time visibility and robust threat detection, businesses face significant risks. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/securing-apis-at-scale-how-to-achieve-comprehensive-api-visibility-threat-a-27364
-
Ivanti Vulns Chained Together in Cyberattack Onslaught
The threat actors are abusing the vulnerabilities to gain initial access, obtain credentials, and install malicious scripts on user devices. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/cisa-ivanti-vulns-chained-attacks
-
Meet GhostGPT: The Malicious AI Chatbot Fueling Cybercrime and Scams
Abnormal Security uncovers GhostGPT, an uncensored AI chatbot built for cybercrime. Learn how it boosts cybercriminals’ abilities, makes… First seen on hackread.com Jump to article: hackread.com/ghostgpt-malicious-ai-chatbot-fuel-cybercrime-scams/
-
Stealthy ‘Magic Packet’ malware targets Juniper VPN gateways
A malicious campaign has been specifically targeting Juniper edge devices, many acting as VPN gateways, with malware dubbed J-magic that starts a reverse shell only if it detects a “magic packet” in the network traffic. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/stealthy-magic-packet-malware-targets-juniper-vpn-gateways/
-
New backdoor discovered that specifically targets Juniper routers
Researchers at Black Lotus Labs have uncovered an operation where a back door is dropped onto enterprise-grade Juniper Networks routers and listens for specific network signals, known as >>magic packets,
-
GhostGPT Jailbreaked ChatGPT that Creates Malware Exploits
Artificial intelligence (AI) tools have revolutionized how we approach everyday tasks, but they also come with a dark side. Cybercriminals are increasingly exploiting AI for malicious purposes, as evidenced by the emergence of uncensored chatbots like WormGPT, WolfGPT, and EscapeGPT. The latest and most concerning addition to this list isGhostGPT, a jailbroken variant of ChatGPT…
-
Homebrew macOS Users Targeted With Information Stealer Malware
A malicious campaign has been redirecting macOS users to a fake Homebrew website, infecting them with information stealer malware. The post Homebrew macOS Users Targeted With Information Stealer Malware appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/homebrew-macos-users-targeted-with-information-stealer-malware/
-
New GhostGPT AI Chatbot Facilitates Malware Creation and Phishing
Cybercriminals are selling access to the malicious GenAI chatbot via Telegram, providing rapid assistance for a range of nefarious activities, according to Abnormal Security First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ghostgpt-ai-chatbot-malware/
-
10 top XDR tools and how to evaluate them
Tags: ai, attack, automation, business, cloud, computing, container, corporate, credentials, data, defense, detection, edr, email, encryption, endpoint, finance, firewall, google, guide, Hardware, iam, ibm, identity, incident response, infrastructure, intelligence, malicious, malware, marketplace, microsoft, mitigation, network, office, okta, open-source, organized, risk, security-incident, service, siem, skills, soar, software, spam, technology, threat, tool, training, vulnerability, zero-dayLittle in the modern IT world lends itself to manual or siloed management, and this is doubly true in the security realm. The scale of modern enterprise computing and modern application stack architecture requires security tools that can bring visibility into the security posture of modern IT components and integrate tightly to bring real-time threat…
-
New Supply Chain Attack Targeting Chrome Extensions to Inject Malicious Code
A sophisticated supply chain attack targeting Chrome browser extensions has come to light, potentially compromising hundreds of thousands of users. The attack, which unfolded in December 2024, involved phishing campaigns aimed at extension developers and the injection of malicious code into legitimate Chrome extensions. Sensitive user data, including API keys, session cookies, and authentication tokens…
-
Python administrator moves to improve software security
The administrators of the Python Package Index (PyPI) have begun an effort to improve the hundreds of thousands of software packages that are listed. The attempt, which began earlier last year, is to identify and stop malware-laced packages from proliferating across the open-source community that contributes and consumes Python software. As previously reported, hijacking Python…
-
ApateWeb Campaign Hijacks Blogspot, Spreads Phishing and Malware
Security researcher Aaron Meese, in collaboration with Validin, has uncovered an ongoing malicious campaign exploiting Blogspot redirectors to First seen on securityonline.info Jump to article: securityonline.info/apateweb-campaign-hijacks-blogspot-spreads-phishing-and-malware/
-
Telegram captcha tricks you into running malicious PowerShell scripts
Threat actors on X are exploiting the news around Ross Ulbricht to direct unsuspecting users to a Telegram channel that tricks them into executing PowerShell code that infects them with malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/telegram-captcha-tricks-you-into-running-malicious-powershell-scripts/
-
China-linked hacker group targets victims in East Asia with malicious VPN installers
The group compromised a virtual private network installer developed by the South Korean firm IPany to deploy custom malware on victims’ devices.]]> First seen on therecord.media Jump to article: therecord.media/china-hacker-group-vpns-backdoor
-
Supply chain attack hits Chrome extensions, could expose millions
Threat actor exploited phishing and OAuth abuse to inject malicious code First seen on theregister.com Jump to article: www.theregister.com/2025/01/22/supply_chain_attack_chrome_extension/
-
Record Breaking 5.6 Tbps DDoS attack Launched by Mirai Botnet
The Mirai botnet unleashed a record-breaking Distributed Denial of Service (DDoS) attack on October 29, 2024, peaking at an astonishing 5.6 terabits per second (Tbps). This mega surge of malicious traffic targeted a Cloudflare customer, an Internet Service Provider (ISP) based in Eastern Asia, marking the largest DDoS attack ever recorded. Understanding DDoS Attacks DDoS…
-
SQL Injection Vulnerability in Microsoft’s DevBlogs Lets Hackers Injecting Malicious SQL
In a recent discovery, a security researcher uncovered a critical SQL injection vulnerability on Microsoft’s DevBlogs website (accessible at https://devblogs.microsoft.com). This vulnerability could allow attackers to manipulate the site’s underlying database by injecting malicious SQL queries, posing a significant risk to the platform and its data integrity. Identifying the Vulnerability The vulnerability was found in the…
-
Weaponized VS Code Impersonate Zoom App Steals Cookies From Chrome
A newly identified extension for Visual Studio Code (VS Code) has been found to impersonate a legitimate Zoom application, enabling cybercriminals to steal sensitive cookies from Google Chrome. This incident marks a significant escalation in the tactics employed by malicious actors to exploit trusted software ecosystems. The Discovery The nefarious extension, uploaded to the VS…
-
DONOT Group Deploys Malicious Android Apps in India
The advanced persistent threat (APT) group is likely India-based and targeting individuals with connections to the country’s intelligence community. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/donot-group-malicious-android-apps-india
-
7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now
A high-severity vulnerability in the 7-Zip file archiver allows attackers to bypass the Mark of the Web (MotW) Windows security feature and execute code on users’ computers when extracting malicious files from nested archives. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/7-zip-fixes-bug-that-bypasses-the-windows-motw-security-mechanism-patch-now/
-
Brave Browser Vulnerability Allows Malicious Website Appears as Trusted One
A security vulnerability has been identified in Brave Browser, potentially allowing malicious websites to masquerade as trusted ones during file upload or download operations. The issue, tracked under CVE-2025-23086, affects specific versions of the Brave browser on desktop platforms, creating a risk for unsuspecting users. Brave Browser Vulnerability The vulnerability impacts Brave Browser versions 1.70.x…
-
EU to take aim at healthcare cyber threat
Tags: attack, cyber, cyberattack, cybercrime, cybersecurity, data, data-breach, extortion, healthcare, malicious, ransomware, service, threat, toolThe European Commission is presenting an action plan to strengthen cybersecurity in healthcare as one of its key priorities in the first 100 days of the commission’s new mandate.The healthcare sector has been under increasing pressure from cyberattacks in the past few years, with 309 cybersecurity incidents reported by member states in 2023. Ransomware tops…
-
Ridding your network of NTLM
Tags: attack, authentication, cloud, crowdstrike, cve, email, encryption, exploit, group, hacker, ibm, Internet, jobs, malicious, microsoft, network, ntlm, password, service, technology, tool, update, vulnerability, windowsMicrosoft has hinted at a possible end to NTLM a few times, but with quite a few Windows 95 or 98 in use that do not support the alternative, Kerberos, it won’t be an easy job to do. There is the option to disable NTLM when using Azure Active Directory but that may not always…