Tag: microsoft
-
Microsoft Text Services Framework Exploited for Stealthy Persistence
A novel persistence mechanism exploiting Microsoft’s Text Services Framework (TSF) has been uncovered by researchers at Praetorian Labs, revealing a sophisticated method for maintaining long-term access to compromised systems. While requiring administrative privileges for initial deployment, this technique enables stealthy code execution across dozens of critical Windows processes through aboriginal system components designed for text…
-
Earth Preta APT Exploit Microsoft Utility Tool Bypass AV Detection to Control Windows
Researchers from Trend Micro’s Threat Hunting team have uncovered a sophisticated cyberattack campaign by the advanced persistent threat (APT) group Earth Preta, also known as Mustang Panda. The group has been leveraging new techniques to infiltrate systems and evade detection, primarily targeting government entities in the Asia-Pacific region, including Taiwan, Vietnam, Malaysia, and Thailand. Earth…
-
Storm-2372: Russian-Linked Hackers Exploit Device Code Phishing in Global Campaign
Microsoft Threat Intelligence has uncovered an active and ongoing phishing campaign conducted by the threat actor Storm-2372, a First seen on securityonline.info Jump to article: securityonline.info/storm-2372-russian-linked-hackers-exploit-device-code-phishing-in-global-campaign/
-
New family of data-stealing malware leverages Microsoft Outlook
certutil application which handles certificates, to download files.Espionage seems to be the motive, says the report, and there are Windows and Linux versions of the malware. But fortunately the gang “exhibited poor campaign management and inconsistent evasion tactics,” it notes. Nevertheless, CISOs should be watching for signs of attack using this group’s techniques, because their…
-
Microsoft to remove the Location History feature in Windows
Microsoft announced the deprecation of the Location History feature from Windows, which let applications like the Cortana virtual assistant to fetch location history of the device. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-to-remove-the-location-history-feature-in-windows/
-
The XCSSET info-stealing malware is back, targeting macOS users and devs
A new, improved variant of the XCSSET macOS malware has been spotted >>in limited attacks
-
Privacy Roundup: Week 7 of Year 2025
Tags: access, antivirus, api, apple, attack, breach, business, cctv, cve, cybersecurity, data, data-breach, detection, email, exploit, firmware, flaw, google, group, law, leak, malware, microsoft, military, network, password, phishing, privacy, router, scam, service, software, technology, threat, tool, update, virus, vpn, vulnerability, windows, zero-dayThis is a news item roundup of privacy or privacy-related news items for 9 FEB 2025 – 15 FEB 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
-
Microsoft Uncovers New XCSSET macOS Malware Variant with Advanced Obfuscation Tactics
Microsoft said it has discovered a new variant of a known Apple macOS malware called XCSSET as part of limited attacks in the wild.”Its first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies,” the Microsoft Threat Intelligence team said in a post shared on…
-
Microsoft Defender vs. McAfee: Features, Pricing, Pros Cons
Tags: microsoftOur comprehensive comparison reviews Microsoft Defender and McAfee, highlighting features, pricing, and performance to help you make an informed decision. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/windows-defender-vs-mcafee-antivirus/
-
Microsoft Detects New XCSSET MacOS Malware Variant
Microsoft has observed a new variant of XCSSET, a sophisticated macOS malware that infects Xcode projects First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/new-xcsset-macos-malware-variant/
-
Microsoft spots XCSSET macOS malware variant used for crypto theft
A new variant of the XCSSET macOS modular malware has emerged in attacks that target users’ sensitive information, including digital wallets and data from the legitimate Notes app. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-spots-xcsset-macos-malware-variant-used-for-crypto-theft/
-
XCSSET macOS malware returns with first new version since 2022
Known for popping zero-days of yesteryear, Microsoft puts Apple devs on high alert First seen on theregister.com Jump to article: www.theregister.com/2025/02/17/macos_xcsset_malware_returns/
-
New FinalDraft Malware Spotted in Espionage Campaign
A newly identified malware family abuses the Outlook mail service for communication, via the Microsoft Graph API. The post New FinalDraft Malware Spotted in Espionage Campaign appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/new-finaldraft-malware-spotted-in-espionage-campaign/
-
New XCSSET Malware Targets macOS Users Through Infected Xcode Projects
Microsoft Threat Intelligence has identified a new variant of the XCSSET macOS malware, marking its first update since 2022. This sophisticated malware continues to target macOS users by infecting Xcode projects, a critical tool for Apple developers. The latest variant introduces advanced obfuscation techniques, updated persistence mechanisms, and novel infection strategies, making it more challenging…
-
Microsoft rolls out BIOS update that fixes ASUS blue screen issues
More ASUS customers can now install Windows 11 24H2 after applying a BIOS update that resolves blue screen of death (BSOD) issues acknowledged in October. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-bios-update-that-fixes-asus-blue-screen-issues/
-
How to evaluate and mitigate risks to the global supply chain
Tags: access, business, ceo, ciso, communications, compliance, control, cyberattack, cybersecurity, data, framework, governance, government, intelligence, international, ISO-27001, kaspersky, microsoft, mitigation, monitoring, office, resilience, risk, risk-assessment, risk-management, russia, service, soc, software, supply-chain, technology, threat, tool, update, vulnerabilityMaintain a diversified supply chain: Organizations that source from international technology suppliers need to ensure they are not overly reliant on a single vendor, single region or even a single technology. Maintaining a diversified supply chain can mitigate costly disruptions from a cyberattack or vulnerability involving a key supplier, or from disruptions tied to regulatory…
-
Hacker greifen Microsoft 365 mit Device Code Phishing an
Eine mutmaßlich russische Hackergruppe namens Storm-237 hat eine Phishing-Kampagne gestartet, die sich gezielt gegen Microsoft 365-Konten richtet. Die Angreifer nutzen dabei eine eigentlich für Geräte ohne Tastatur gedachte Authentifizierungsmethode aus, wie Microsoft nun berichtet. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-greifen-microsoft-365-mit-device-code-phishing-an
-
CVE-2024-1709 and CVE-2023-48788: Exploits Fueling Russia’s BadPilot Campaign
Microsoft Threat Intelligence has exposed a multiyear cyber espionage campaign conducted by a subgroup of the Russian state-sponsored First seen on securityonline.info Jump to article: securityonline.info/cve-2024-1709-and-cve-2023-48788-exploits-fueling-russias-badpilot-campaign/
-
Fake ‘Adobe Drive X’ App Sneaks Through Microsoft Login to Steal Credentials
Cofense’s Phishing Defense Center (PDC) has uncovered a phishing campaign that uses a legitimate Microsoft login page to First seen on securityonline.info Jump to article: securityonline.info/fake-adobe-drive-x-app-sneaks-through-microsoft-login-to-steal-credentials/
-
Storm-2372 used the device code phishing technique since August 2024
Russia-linked group Storm-2372 used the device code phishing technique since Aug 2024 to steal login tokens from governments, NGOs, and industries. Microsoft Threat Intelligence researchers warn that threat actor Storm-2372, likely linked to Russia, has been targeting governments, NGOs, and various industries across multiple regions since August 2024. The attackers employ a phishing technique called…
-
Week in review: Microsoft fixes two actively exploited 0-days, PAN-OS auth bypass hole plugged
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes two actively exploited zero-days (CVE-2025-21418, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/16/week-in-review-microsoft-fixes-two-actively-exploited-0-days-pan-os-auth-bypass-hole-plugged/
-
Microsoft 365 accounts targeted in device code spear-phishing scheme
First seen on scworld.com Jump to article: www.scworld.com/news/microsoft-365-accounts-targeted-in-device-code-spear-phishing-scheme
-
Hackers steal emails in device code phishing attacks
An active campaign from a threat actor potentially linked to Russia is targeting Microsoft 365 accounts of individuals at organizations of interest using device code phishing. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-hackers-steal-emails-in-device-code-phishing-attacks/
-
Threat researchers spot ‘device code’ phishing attacks targeting Microsoft accounts
Suspected Russian nation-state threat groups have duped multiple victims into granting potentially persistent access to networks via authentication requests and valid tokens. First seen on cyberscoop.com Jump to article: cyberscoop.com/russia-threat-groups-device-code-phishing-microsoft-accounts/
-
If you dread a Microsoft Teams invite, just wait until it turns out to be a Russian phish
Roses aren’t cheap, violets are dear, now all your access token are belong to Vladimir First seen on theregister.com Jump to article: www.theregister.com/2025/02/15/russia_spies_spoofing_teams/
-
Why Private Equity Is Now Kicking the Tires on Trend Micro
Sluggish Sales Growth and Lower Relevance in Endpoint Could Make Trend Attractive Endpoint security vendors are changing up their ownership or business models as Microsoft and CrowdStrike increasingly blot out the sun in this rapidly consolidating market. Reuters said that Advent International, Bain Capital, EQT AB and KKR have expressed interest in taking Trend Micro…
-
Threat actors are using legitimate Microsoft feature to compromise M365 accounts
Suspected Russian threat actors have been taking advantage of Microsoft Device Code Authentication to trick targets into granting them access to their Microsoft 365 (M365) … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/14/microsoft-device-code-authentication-phishing-m365-account-compromise/