Tag: malicious
-
eSchool News: How K-12 IT Teams Lock Down QR-Based SSO Without Hurting Usability
This article was originally published in eSchool News on 11/10/25 by Charlie Sander. Phishing via QR codes, a tactic now known as “quishing,” involves attackers embedding malicious QR codes in emails or posters Schools can keep QR logins safe and seamless by blending clear visual cues, ongoing user education, and risk-based checks behind the scenes…
-
The nexus of risk and intelligence: How vulnerability-informed hunting uncovers what everything else misses
Tags: access, attack, authentication, business, cisa, compliance, cve, cvss, dark-web, data, defense, detection, dns, edr, endpoint, exploit, framework, intelligence, kev, linux, malicious, mitigation, mitre, monitoring, ntlm, nvd, open-source, password, powershell, remote-code-execution, risk, risk-management, siem, soc, strategy, tactics, technology, threat, update, vulnerability, vulnerability-managementTurning vulnerability data into intelligence: Once vulnerabilities are contextualized, they can be turned into actionable intelligence. Every significant CVE tells a story, known exploit activity, actor interest, proof-of-concept code or links to MITRE ATT&CK techniques. This external intelligence gives us the who and how behind potential exploitation.For example, when a privilege escalation vulnerability in Linux…
-
Security startup Guardio nabs $80M from ION Crossover Partners
Guardio is leveraging its experience building browser extensions and apps that scan for malicious and phishing sites to build a tool that looks for artifacts in code and websites made with vibe coding tools. First seen on techcrunch.com Jump to article: techcrunch.com/2025/11/19/security-startup-guardio-nabs-80m-from-ion-crossover-partners/
-
Sue The Hackers Google Sues Over Phishing as a Service
Google’s Lighthouse lawsuit signals a new era in cybersecurity, where companies use civil litigation”, including the CFAA, Lanham Act, and RICO”, to dismantle phishing networks, seize malicious infrastructure, and fight hackers when criminal prosecution falls short. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/sue-the-hackers-google-sues-over-phishing-as-a-service/
-
Sue The Hackers Google Sues Over Phishing as a Service
Google’s Lighthouse lawsuit signals a new era in cybersecurity, where companies use civil litigation”, including the CFAA, Lanham Act, and RICO”, to dismantle phishing networks, seize malicious infrastructure, and fight hackers when criminal prosecution falls short. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/sue-the-hackers-google-sues-over-phishing-as-a-service/
-
China-aligned threat actor is conducting widespread cyberespionage campaigns
The threat group PlushDaemon uses routers and other network device implants to redirect domain name system (DNS) queries to malicious external servers which take over updates to unleash tools used for cyberespionage. First seen on therecord.media Jump to article: therecord.media/china-aligned-threat-actor-espionage-network-devices
-
‘PlushDaemon’ hackers hijack software updates in supply-chain attacks
The China-aligned advanced persistent threat (APT) tracked as ‘PlushDaemon’ is hijacking software update traffic to deliver malicious payloads to its targets. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/plushdaemon-hackers-hijack-software-updates-in-supply-chain-attacks/
-
China-aligned threat actor is conducting widespread cyberespionage campaigns
The threat group PlushDaemon uses routers and other network device implants to redirect domain name system (DNS) queries to malicious external servers which take over updates to unleash tools used for cyberespionage. First seen on therecord.media Jump to article: therecord.media/china-aligned-threat-actor-espionage-network-devices
-
EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates
The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks.EdgeStepper “redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure First seen on thehackernews.com Jump to article: thehackernews.com/2025/11/edgestepper-implant-reroutes-dns.html
-
New npm Malware Campaign Checks If Visitor Is a Victim or Researcher Before Initiating Infection
The Socket Threat Research Team has uncovered a sophisticated npm malware campaign orchestrated by the threat actor dino_reborn, who deployed 7 malicious packages designed to distinguish genuine targets from security researchers before executing their payloads. This nuanced approach represents a significant evolution in supply chain attacks, blending traffic cloaking, anti-analysis techniques, and deceptive UI elements…
-
Microsoft Adds Azure Firewall With AI-Powered Security Copilot
Microsoft has integrated Azure Firewall with its AI-powered Security Copilot platform, bringing natural language threat investigation capabilities to cloud network security teams. The new integration allows security analysts to investigate malicious network traffic using conversational prompts instead of complex query languages. AI-Powered Threat Investigation Security Copilot is Microsoft’s generative AI solution designed to enhance security…
-
New .NET Malware Conceals Lokibot Inside PNG/BMP Files to Bypass Detection
Remote Access Trojans (RATs) and Trojan Stealers continue to dominate the threat landscape as some of the most prevalent malware families. To evade detection on compromised systems, these threats increasingly employ sophisticated crypters, loaders, and steganographic techniques that disguise malicious code within seemingly benign file formats such as images. Building on their August 2025 analysis…
-
Hackers turn open-source AI framework into global cryptojacking operation
Malicious hackers have been attacking the development environment of an open-source AI framework, twisting its functions into a global cryptojacking bot for profit, according to researchers at cybersecurity firm Oligo. The flaw exists in an Application Programming Interface for Ray, an open-source framework for automating, scaling and optimizing compute resources that Oligo researchers called “Kubernetes…
-
New EchoGram Trick Makes AI Models Accept Dangerous Inputs
Security researchers at HiddenLayer have uncovered a critical vulnerability that exposes fundamental weaknesses in the guardrails protecting today’s most powerful artificial intelligence models. The newly discovered EchoGram attack technique demonstrates how defensive systems safeguarding AI giants like GPT-4, Claude, and Gemini can be systematically manipulated to either approve malicious content or generate false security alerts.…
-
New EchoGram Trick Makes AI Models Accept Dangerous Inputs
Security researchers at HiddenLayer have uncovered a critical vulnerability that exposes fundamental weaknesses in the guardrails protecting today’s most powerful artificial intelligence models. The newly discovered EchoGram attack technique demonstrates how defensive systems safeguarding AI giants like GPT-4, Claude, and Gemini can be systematically manipulated to either approve malicious content or generate false security alerts.…
-
Authorities Dismantle Thousands of Servers from Illicit Hosting Company Linked to Cyberattacks
In a landmark operation targeting cybercriminal infrastructure, the East Netherlands cybercrime team conducted a major takedown of a rogue hosting company suspected of facilitating a broad spectrum of malicious activities. During the coordinated enforcement action on November 12th, law enforcement seized approximately 250 physical servers located in data centers across The Hague and Zoetermeer. The…
-
New Technique Shows Gaps in LLM Safety Screening
Attackers Can Flip Safety Filters Using Short Token Sequences. A few stray characters, sometimes as small as oz or generic as =coffee may be all it takes to steer past an AI system’s safety checks. HiddenLayer researchers have found a way to identify short token sequences that can cause guardrail models to misclassify malicious prompts…
-
New Technique Shows Gaps in LLM Safety Screening
Attackers Can Flip Safety Filters Using Short Token Sequences. A few stray characters, sometimes as small as oz or generic as =coffee may be all it takes to steer past an AI system’s safety checks. HiddenLayer researchers have found a way to identify short token sequences that can cause guardrail models to misclassify malicious prompts…
-
Malicious Npm Packages Abuse Adspect Cloaking in Crypto Scam
A malware campaign presents fake websites that can check if a visitor is a potential victim or a security researcher, and then proceed accordingly to defraud or evade. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/malicious-npm-packages-adspect-cloaking-crypto-scam
-
Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages
Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and security researchers to ultimately redirect them to sketchy crypto-themed sites.The malicious npm packages, published by a threat actor named “dino_reborn” between September and November 2025, are…
-
Rethinking identity for the AI era: CISOs must build trust at machine speed
Tags: access, ai, api, attack, authentication, business, ciso, cloud, control, cybersecurity, data, data-breach, google, governance, group, identity, infrastructure, injection, Internet, LLM, malicious, mitigation, network, risk, theft, threat, tool, training, vulnerabilityIdentity as a trust fabric: Most organizations currently rely on a welter of identity and access management systems for a variety of reasons. Some systems might be tied to a specific vendor’s technology; some might be legacy systems from mergers or acquisitions; some might be in place due to legal or regulatory requirements.”What happens even…
-
Malicious NPM packages abuse Adspect redirects to evade security
Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-npm-packages-abuse-adspect-redirects-to-evade-security/
-
Cursor Issue Paves Way for Credential-Stealing Attacks
Researchers discovered a security weakness in the AI-powered coding tool that allows malicious MCP server to hijack Cursor’s internal browser. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/cursor-issue-credential-stealing-attacks
-
Cursor Issue Paves Way for Credential-Stealing Attacks
Researchers discovered a security weakness in the AI-powered coding tool that allows malicious MCP server to hijack Cursor’s internal browser. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/cursor-issue-credential-stealing-attacks
-
North Korea’s ‘Job Test’ trap upgrades to JSON malware dropboxes
Developers remain a high-value target: Researchers highlighted that the campaign specifically targets developers involved in crypto and Web3 projects, using realistic-sounding personas and demo applications (real estate, DeFi, game forks) to lower suspicion. The state-linked actors’ shift from direct payload hosting to abusing legitimate JSON storage services suggests that even benign developer-centric platforms are now…
-
North Korea’s ‘Job Test’ trap upgrades to JSON malware dropboxes
Developers remain a high-value target: Researchers highlighted that the campaign specifically targets developers involved in crypto and Web3 projects, using realistic-sounding personas and demo applications (real estate, DeFi, game forks) to lower suspicion. The state-linked actors’ shift from direct payload hosting to abusing legitimate JSON storage services suggests that even benign developer-centric platforms are now…
-
Spam flooding npm registry with token stealers still isn’t under control
Tags: access, antivirus, attack, authentication, blockchain, breach, control, credentials, crypto, detection, edr, exploit, finance, firewall, governance, identity, login, malicious, malware, mfa, monitoring, network, open-source, pypi, risk, software, spam, supply-chain, threat, tool, wormCSO that number has now grown to 153,000.And while this payload merely steals tokens, other threat actors are paying attention, said Sonatype CTO Brian Fox.When Sonatype wrote about the campaign just over a year ago, it found a mere 15,000 packages that appeared to come from a single person.With the swollen numbers reported this week,…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 71
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter 9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure Gootloader Returns: What Goodies Did They Bring? Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector…