Tag: microsoft
-
Lumma infostealer’s infrastructure seized during US, EU, Microsoft operation
A sting involving law enforcement and private sector companies disrupted the Lumma infostealer, malware sold around the globe to cybercriminals and credited for millions of infections. First seen on therecord.media Jump to article: therecord.media/lumma-infostealer-malware-takedown-microsoft-fbi
-
FBI, Microsoft, international cops bust Lumma infostealer service
Credit card theft losses in 2023 alone totaled $36.5M First seen on theregister.com Jump to article: www.theregister.com/2025/05/21/lumma_infostealer_service_busted/
-
Lumma Stealer Malware-as-a-Service operation disrupted
A coordinated action by US, European and Japanese authorities and tech companies like Microsoft and Cloudflare has disrupted the infrastructure behind Lumma Stealer, the most … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/21/lumma-stealer-malware-as-a-service-operation-disrupted/
-
BadSuccessor: Unpatched Microsoft Active Directory attack enables domain takeover
Tags: access, attack, authentication, computer, container, control, credentials, group, microsoft, network, password, powershell, service, updatemsDS-DelegatedMSAState, which indicates whether the migration process is unknown, in progress, or completed; msDS-ManagedAccountPrecededByLink, which indicates the superseded account; and msDS-GroupMSAMembership, which indicates which principals (users, groups, and computers) can authenticate as the account.Once migration to a dMSA account is complete, any machine that authenticates as the superseded service account will receive from Domain Controller…
-
Microsoft leads international takedown of Lumma Stealer
The Lumma infostealer malware is a popular way for hackers to steal passwords, credit cards and cryptocurrency wallets. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/microsoft-takedown-lumma-stealer/748727/
-
Lumma Stealer toppled by globally coordinated takedown
Global law enforcement authorities and Microsoft seized or disrupted the prolific infostealer’s central command infrastructure, malicious domains and marketplaces where the malware was sold. First seen on cyberscoop.com Jump to article: cyberscoop.com/lumma-stealer-infostealer-takedown/
-
Authorities Carry Out Elaborate Global Takedown of Infostealer Heavily Used by Cybercriminals
US, European, and Japanese authorities, along with tech companies including Microsoft and Cloudflare, say they’ve disrupted Lumma, an infostealer popular with criminal gangs. First seen on wired.com Jump to article: www.wired.com/story/lumma-stealer-takedown-disrupted/
-
Windows 11 Introduces Enhanced Administrator Protection to Strengthen Security Against Elevated Privilege Attacks
Microsoft has unveiled Administrator Protection, a groundbreaking security feature for Windows 11 designed to safeguard systems against privilege escalation attacks. This new capability creates a security boundary around administrative operations, significantly reducing the attack surface that hackers exploit when targeting elevated processes. According to Microsoft’s Digital Defense Report 2024, token theft incidents have escalated to…
-
SideWinder APT Hackers Exploits Legacy Office Vulnerabilities to Deploy Malware Undetected
Tags: apt, credentials, cyber, exploit, government, hacker, malware, microsoft, military, office, threat, vulnerabilityThe Acronis Threat Research Unit (TRU) has revealed an advanced campaign believed to be orchestrated by the SideWinder advanced persistent threat (APT) group. This operation, running through early 2025, has primarily targeted high-value government and military institutions across Sri Lanka, Bangladesh, and Pakistan, exploiting unpatched legacy Microsoft Office vulnerabilities to deploy credential-stealing malware while evading…
-
Upgrade to Microsoft Windows 11 Home for Just $15
You can now upgrade up to five computers to Microsoft Windows 11 Home for one low price and get a new sleek interface, advanced tools and enhanced security. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/microsoft-windows-11-home/
-
New Phishing Attack Uses AES Malicious npm Packages to Office 365 Login Credentials
Fortra’s Suspicious Email Analysis (SEA) team uncovered a highly sophisticated phishing campaign targeting Microsoft Office 365 (O365) credentials. Unlike typical phishing attempts, this attack stood out due to its intricate use of modern technologies and developer infrastructure. The threat actors employed a multi-layered strategy involving AES (Advanced Encryption Standard) encryption, malicious npm (Node Package Manager)…
-
Threat intelligence platform buyer’s guide: Top vendors, selection advice
Tags: ai, attack, automation, breach, cloud, computing, credentials, crowdstrike, cyber, cybersecurity, dark-web, data, data-breach, deep-fake, detection, dns, edr, email, endpoint, exploit, finance, firewall, fraud, gartner, google, group, guide, identity, incident response, infrastructure, intelligence, kubernetes, law, malicious, malware, microsoft, mitigation, monitoring, network, open-source, phishing, privacy, risk, service, siem, soar, soc, sophos, sql, supply-chain, technology, threat, tool, vpn, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) found that since 2023 the majority of exploits were zero days, meaning exploiting heretofore unknown methods. And according to the latest Verizon Data Breach Investigations report (DBIR), the percentage of AI-assisted malicious emails doubled to 10% of the totals they observed over the past two years, making staying…
-
Judge Lets Delta Lawsuit Over CrowdStrike Outage Proceed
Georgia Court Allows Claims of Fraud, Trespass Over Falcon Software Update. Delta can proceed with its lawsuit against CrowdStrike over a July 2024 update that allegedly bypassed Microsoft safeguards and crashed thousands of systems. The judge found that Delta sufficiently alleged fraud, computer trespass and gross negligence, allowing key claims to move forward. First seen…
-
Microsoft Extends Entra, Purview, and Defender to Secure AI Agents Across the Stack
First seen on scworld.com Jump to article: www.scworld.com/news/microsoft-extends-entra-purview-and-defender-to-secure-ai-agents-across-the-stack
-
Tenable Adds Third-Party Connectors to Exposure Management Platform
TenableOne now pulls in data from AWS, Microsoft, and competitors to provide a holistic security view of the organization’s attack surface. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/tenable-third-party-connectors-exposure-management
-
Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery
A threat actor known as Hazy Hawk has been observed hijacking abandoned cloud resources of high-profile organizations, including Amazon S3 buckets and Microsoft Azure endpoints, by leveraging misconfigurations in the Domain Name System (DNS) records.The hijacked domains are then used to host URLs that direct users to scams and malware via traffic distribution systems (TDSes),…
-
Windows 11 Privilege Escalation Vulnerability Let Attackers Gain Admin Access in Under 300 Milliseconds
Security researchers have uncovered a critical vulnerability in Windows 11 that allowed attackers to escalate privileges from a standard user to system-level administrator in just 300 milliseconds. The flaw, tracked as CVE-2025-24076, has been patched by Microsoft but represents a significant security risk for unpatched systems. The vulnerability leveraged a Dynamic-link Library (DLL) hijacking technique…
-
Microsoft Issues Urgent Patch to Resolve BitLocker Recovery Problem
Microsoft has released an emergency update to address a critical issue affecting Windows 10 devices with specific Intel processors. The update (KB5061768) fixes a problem introduced in the May 13, 2025 security update that was causing unexpected system failures and forcing users to enter BitLocker recovery keys. This fix comes as Microsoft continues its regular…
-
The Windows Subsystem for Linux goes open source
Microsoft has officially open-sourced the Windows Subsystem for Linux (WSL), closing the very first issue ever filed on the Microsoft/WSL GitHub repository: “Will this be open … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/20/microsoft-wsl-open-sourced/
-
Microsoft 365 Users Targeted by Tycoon2FA Linked Phishing Attack to Steal Credentials
A new wave of targeted phishing campaigns, linked to the Tycoon2FA group, has been identified specifically targeting Microsoft 365 users. Security researchers have observed that these campaigns are leveraging an innovative tactic: the use of malformed URLs containing backslash characters, such as https:\\, in order to bypass conventional email security filters and evade URL-based detection…
-
So viele Microsoft-Schwachstellen wie noch nie
Erhöhung von Berechtigungen und Remotecodeausführung zur Systemkompromittierung sind höchste Sicherheitsrisiken. BeyondTrust, Cybersicherheitsanbieter beim Schutz privilegierter Zugriffswege, hat seinen neuesten Microsoft Vulnerabilities Report herausgegeben [1]. Mit einer Gesamtzahl von 1.360 Schwachstellen führt der diesjährige Bericht so viele Sicherheitslücken in Microsoft-Systemen auf wie noch nie zuvor. Gegenüber dem bisherigen Rekordjahr 2022 entspricht das einem Anstieg von… First…
-
Ethical hackers exploited zero-day vulnerabilities against popular OS, browsers, VMs and AI frameworks
Virtual machine and container escapes: Virtualization sits at the core of public cloud infrastructure and private data centers, allowing companies to run their workloads and applications inside isolated containers or virtual servers. Any flaw that allows escaping from the confines of a virtual machine or a Linux container poses a risk not only to the…
-
Microsoft Defender deactivated by new tool
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-defender-deactivated-by-new-tool
-
Windows 10 emergency updates fix BitLocker recovery issues
Microsoft has released out-of-band updates to fix a known issue causing Windows 10 systems to boot into BitLocker recovery after installing the May 2025 security updates. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-10-emergency-updates-fix-bitlocker-recovery-issues/
-
Microsoft unveils Windows AI Foundry for AI-powered PC apps
Microsoft is replacing ‘Copilot Runtime’ with Windows AI Foundry to help developers build, experiment, and reach users with AI experiences in their apps. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-unveils-windows-ai-foundry-for-ai-powered-pc-apps/
-
Microsoft open-sources Windows Subsystem for Linux at Build 2025
Microsoft has open-sourced the Windows Subsystem for Linux (WSL), making its source code available on GitHub, except for a few components that are part of Windows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-open-sources-windows-subsystem-for-linux-at-build-2025/
-
Microsoft confirms new “Advanced” Settings for Windows 11
At the Build 2025 developer conference, Microsoft announced a new ‘Advanced Settings’ feature to help users and developers personalize the OS experience. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-confirms-new-advanced-settings-for-windows-11/
-
Massives Datenleck in Cloud-Speichern
Durch falsch konfigurierte Speicher-Buckets bei mehreren großen Cloud-Anbietern sind 200 Milliarden Dateien öffentlich einsehbar.Forscher der Cybersicherheitsfirma Cyble warnen vor einem massiven Datenleck in Cloud-Speichern. Bei einer Schwachstellenanalyse identifizierten sie insgesamt mehr als 660.000 ungeschützte Buckets, die auf sieben große Cloud-Plattformen verteilt sind. Darunter sollen sich mehr als 200 Milliarden gefährdete Dateien befinden. Besonders brisant: Nach…
-
A spoof antivirus makes Windows Defender disable security scans
Persistent API-level spoofing: While WSC is typically guarded by mechanisms like Protected Process Light (PPL) and signature validation, Defendnot sidesteps these barriers by injecting its code into Taskmgr.exea system-signed, trusted process. From there, it registers the ghost antivirus entry under a spoofed name.Additionally, to ensure it sticks around, defendnot sets up persistence via Windows Task…
-
Brussels Court Slams Tracking-Based Ads, Upholds GDPR Privacy Standards
The Brussels Court of Appeal ruled on May 14, 2025, that the consent model used in tracking-based advertising by major tech companies such as Google, Microsoft, Amazon, and X (formerly Twitter) does not comply with EU privacy laws, including the General Data Protection Regulation (GDPR). First seen on thecyberexpress.com Jump to article: thecyberexpress.com/brussels-court-tracking-ads-gdpr/