Tag: threat
-
New Android Banking Trojan Uses Hidden VNC for Full Remote Control of Devices
In late August 2025, Cleafy’s Threat Intelligence team uncovered Klopatra, a new, highly sophisticated Android banking trojan and Remote Access Trojan (RAT) that grants attackers full control of compromised devices and facilitates large-scale financial fraud. Active campaigns in Spain and Italy have already infected over 3,000 devices, targeting users of major financial institutions and draining…
-
Hackers Actively Probe Palo Alto PAN-OS GlobalProtect Vulnerability for Exploitation
An uptick in internet-wide scanning activity indicates that threat actors are actively probing for systems vulnerable toCVE-2024-3400, a critical GlobalProtect flaw in Palo Alto Networks PAN-OS. Security researchers at SANS ISC observed a single source IP address 141.98.82.26, systematically targeting the GlobalProtect portal’s file-upload endpoint in an attempt to place and retrieve session files on…
-
Warning: Malicious AI Tools Being Distributed as Chrome Extensions by Threat Actors
Cybercriminals are exploiting the growing popularity of artificial intelligence tools by distributing malicious Chrome browser extensions that masquerade as legitimate AI services. These fake extensions, mimicking popular AI platforms like ChatGPT, Claude, Perplexity, and Meta’s Llama, are designed to hijack user prompts and redirect them to attacker-controlled domains for malicious purposes. Security researchers from Palo…
-
Tech companies should be shielded from spyware lawsuits, report says
Congress should protect makers of devices and messaging apps from lawsuits when their products are infected with spyware, a think tank says, with the goal of improved threat hunting and information sharing. First seen on therecord.media Jump to article: therecord.media/spyware-safe-harbor-law-proposed-tech-companies
-
CISA Issues Alert on Actively Exploited Libraesva ESG Command Injection Vulnerability
Tags: cisa, cve, cyber, cybersecurity, email, exploit, infrastructure, injection, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert highlighting the active exploitation of a serious vulnerability in the Libraesva Email Security Gateway (ESG). Cataloged as CVE-2025-59689, this command injection vulnerability has emerged as a significant threat for organizations relying on Libraesva’s email security defenses. Libraesva’s Email Security Gateway is widely…
-
Microsoft Flags AI Phishing Attack Hiding in SVG Files
Microsoft Threat Intelligence detected a new AI-powered phishing campaign using LLMs to hide malicious code inside SVG files disguised as business dashboards. First seen on hackread.com Jump to article: hackread.com/microsoft-ai-phishing-attack-hiding-svg-files/
-
Microsoft Flags AI Phishing Attack Hiding in SVG Files
Microsoft Threat Intelligence detected a new AI-powered phishing campaign using LLMs to hide malicious code inside SVG files disguised as business dashboards. First seen on hackread.com Jump to article: hackread.com/microsoft-ai-phishing-attack-hiding-svg-files/
-
Threat Actors Exploiting MS-SQL Servers to Deploy XiebroC2 Framework
A surge in attacks targeting improperly managed MS-SQL servers, culminating in the deployment of the open-source XiebroC2 command-and-control (C2) framework. Similar in functionality to legitimate tools like Cobalt Strike, XiebroC2 offers capabilities for information gathering, remote control, and defense evasion, making it an attractive option for threat actors seeking a cost-effective intrusion platform. In one…
-
Threat Actors Exploiting MS-SQL Servers to Deploy XiebroC2 Framework
A surge in attacks targeting improperly managed MS-SQL servers, culminating in the deployment of the open-source XiebroC2 command-and-control (C2) framework. Similar in functionality to legitimate tools like Cobalt Strike, XiebroC2 offers capabilities for information gathering, remote control, and defense evasion, making it an attractive option for threat actors seeking a cost-effective intrusion platform. In one…
-
CIISec Members Say Budgets Are Falling Behind Threats
Most UK cybersecurity professionals tell CIISec that their budgets are stagnating First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ciisec-members-budget-falling/
-
APT35 Hackers Targeting Government and Military to Steal Login Credentials
Tags: credentials, cyber, government, hacker, intelligence, login, malicious, military, phishing, threatStormshield CTI researchers have identified two active phishing servers linked to APT35, revealing ongoing credential-stealing operations targeting government and military entities. In an active threat-hunting operation, Stormshield’s Cyber Threat Intelligence (CTI) team discovered two malicious servers exhibiting hallmark characteristics of APT35 infrastructure. These servers, mirroring footprints documented by Check Point, are hosting phishing pages designed…
-
How to restructure your security program to modernize defense
Restructuring the security program when technology and skills change: When revamping the security programs, CISOs can have in mind Venables’ four-phase framework, which is flexible enough to fit almost any organization. Companies can start where they are, make the changes they want, and then return to complete the remaining tasks.Restructuring the security program should be…
-
Malicious Code in Fake Postmark MCP Server Steals Thousands of Emails
A newly discovered attack on the npm ecosystem has exposed a deceptive backdoor embedded in a malicious package impersonating Postmark. The package, named postmark-mcp, quietly siphoned off thousands of emails from unsuspecting developers and organizations, all with just one line of code. Over the course of 15 incremental releases, the threat actor behind postmark-mcp built…
-
Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials
A sophisticated cybercriminal group known as Lunar Spider successfully compromised a Windows machine through a single malicious click, establishing a foothold that allowed them to harvest credentials and maintain persistent access for nearly two months. The intrusion, which began in May 2024, demonstrates the evolving threat landscape where initial access can rapidly escalate to full…
-
Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access
Cybersecurity researchers have identified a sophisticated campaign where threat actors are using malicious advertisements and search engine optimization poisoning to distribute fake Microsoft Teams installers containing the Oyster backdoor malware. The campaign targets users searching for legitimate Microsoft Teams downloads through search engines. When users search for terms like >>teams download,
-
New Harrods Data Breach Leaks Personal Information of 430,000 Customers
Luxury department store Harrods has become the latest victim of a significant cybersecurity incident after hackers successfully accessed personal data belonging to 430,000 customers. The prestigious London retailer confirmed that threat actors contacted the company following the breach, though Harrods has stated it will not engage with the attackers. Limited Data Exposure The compromised information was obtained from…
-
Hacker umgehen immer häufiger MFA
Der Threat Intelligence Report 1H 2025 zeigt: Malware lauert oft in ungewöhnlichen Dateiformaten und auf kompromittierten USB-Devices. Ontinue, Experte für Managed Extended Detection and Response (MXDR), hat seinen Threat Intelligence Report für das erste Halbjahr 2025 veröffentlicht [1]. Die Ergebnisse zeigen einen deutlichen Anstieg von Cyberangriffen, die Multi-Faktor-Authentifizierung (MFA) umgehen. Zudem nutzen Hacker offene… First…
-
Feds cut funding to program that shared cyber threat info with local governments
The federal government’s not the only thing shutting down on Oct. 1 First seen on theregister.com Jump to article: www.theregister.com/2025/09/30/cisa_kills_cis_agreement/
-
Dynamic DNS Abuse Helps Threat Actors Evade Detection and Persist
Threat actors exploit Dynamic DNS for resilient C2 networks. Learn why DDNS abuse matters and how defenders can respond. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/dns-abuse-fuels-cyber-attacks/
-
IoT Security Flounders Amid Churning Risk
The Internet of Things (IoT) has made everything more interconnected than ever, but an important US government security initiative is stuck in limbo even as threat actors step up attacks on everything from medical gear to printers. First seen on darkreading.com Jump to article: www.darkreading.com/iot/iot-security-flounders-amid-churning-risk
-
Sneaky, Malicious MCP Server Exfiltrates Secrets via BCC
The first known malicious MCP server is an AI integration tool that automatically sends email such as those related to password resets, account confirmations, security alerts, invoices, and receipts to threat actors. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/malicious-mcp-server-exfiltrates-secrets-bcc
-
Surging Threats, Complexity Means VPNs Are On Their Way Out: Experts
The continuing intensification of attacks targeting VPNs and the complexities of hybrid IT environments are accelerating the shift away from the technology and toward cloud-based alternatives such as zero trust network access (ZTNA), experts told CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2025/surging-threats-complexity-means-vpns-are-on-their-way-out-experts
-
Ransomware gang sought BBC reporter’s help in hacking media giant
Threat actors claiming to represent the Medusa ransomware gang tempted a BBC correspondent to become an insider threat by offering a significant amount of money. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-gang-sought-bbc-reporters-help-in-hacking-media-giant/
-
Ukraine’s digital chief pushes for AI-first state amid war and cyber threats
Ukraine’s deputy prime minister is betting big on artificial intelligence’s ability to shape governance, education and even the battlefield. First seen on therecord.media Jump to article: therecord.media/ukraine-ai-state-digital
-
EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
Threat actors have been observed using seemingly legitimate artificial intelligence (AI) tools and software to sneakily slip malware for future attacks on organizations worldwide.According to Trend Micro, the campaign is using productivity or AI-enhanced tools to deliver malware targeting various regions, including Europe, the Americas, and the Asia, Middle East, and Africa (AMEA) region. First…
-
AI-Generated Code Used in Phishing Campaign Blocked by Microsoft
Microsoft Threat Intelligence stopped an AI-driven credential phishing campaign using SVG files disguised as PDFs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-generated-code-phishing/
-
New Spear-Phishing Attack Deploys DarkCloud Malware to Steal Keystrokes and Credentials
Tags: attack, credentials, cyber, detection, intelligence, malware, phishing, soc, spear-phishing, threatAdversaries don’t work 95 and neither do we. At eSentire, our 24/7 SOCs are staffed with elite threat hunters and cyber analysts who hunt, investigate, contain and respond to threats within minutes. Backed by threat intelligence, tactical threat response and advanced threat analytics from our Threat Response Unit (TRU), eSentire delivers rapid detection and disruption…
-
Chinese hackers breached critical infrastructure globally using enterprise network gear
Tags: access, backdoor, breach, business, china, communications, control, cve, defense, exploit, framework, germany, government, group, hacker, infrastructure, Internet, korea, law, malware, military, monitoring, network, open-source, penetration-testing, programming, service, threat, tool, update, vpn, vulnerability72-hour vulnerability exploitation window: RedNovember demonstrated the ability to weaponize newly disclosed vulnerabilities faster than most organizations could deploy patches, researchers found. When researchers published proof-of-concept code for Check Point VPN vulnerability CVE-2024-24919 on May 30, 2024, RedNovember was attacking vulnerable systems by June 3.That campaign hit at least 60 organizations across Brazil, Germany, Japan,…
-
Kampagne mit Ransomware Akira zielt auf Sonicwall-VPNs ab
Ende Juli 2025 hat Arctic Wolf Labs, das Threat-Research-Team von Arctic Wolf, eine Reihe von Angriffen beobachtet, bei denen verdächtige -Aktivitäten aufgetreten sind. Hierbei folgten auf unberechtigte Anmeldungen innerhalb weniger Minuten Port-Scans, Impacket-SMB-Aktivitäten und die schnelle Verbreitung der Akira-Ransomware. Die betroffenen Unternehmen sind aus verschiedenen Branchen und weisen unterschiedliche Größen auf, was auf eine opportunistische Herangehensweise…
-
Acreed Infostealer Gaining Popularity Among Cybercriminals for C2 via Steam Platform
Acreed, a novel infostealer first observed in February 2025, has rapidly gained traction among threat actors seeking discreet credential and cryptocurrency data harvesting. Leveraging a unique command-and-control (C2) mechanism via the Steam platform’s community profiles, Acreed exhibits advanced OPSEC measures and versatility that distinguish it from established stealers such as Lumma. Acreed noted on Russian…