Tag: threat
-
Stealthy backdoor found hiding in SOHO devices running Linux
SecurityScorecard’s STRIKE team has uncovered a network of compromised small office and home office (SOHO) devices they’re calling LapDogs. The threat is part of a broader … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/23/lapdogs-shortleash-backdoor-linux-soho-devices/
-
Iran-Linked Threat Actors Leak Visitors and Athletes’ Data from Saudi Games
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/iran-linked-threat-actors-leak-visitors-and-athletes-data-from-saudi-games
-
Quantum risk is already changing cybersecurity
A new report from the Cyber Threat Alliance warns that the era of quantum risk is already underway, and security teams need to stop treating it like a problem for tomorrow. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/23/quantum-cybersecurity-readiness/
-
CoinMarketCap Doodle Image Vulnerability Lets Attackers Run Malicious Code via API Call
CoinMarketCap, the globally recognized cryptocurrency data aggregator, experienced a significant security incident when a vulnerability in its homepage doodle image was exploited to inject malicious code, leading to a phishing campaign targeting user wallets. Incident Overview The breach originated from a seemingly innocuous doodle image featured on CoinMarketCap’s homepage. Threat actors manipulated the backend API…
-
Threat Casting a Nation State Attack on Critical Infrastructure Scenario at CognectCon2025
Tags: attack, conference, cyber, cyberattack, cybersecurity, data, disinformation, infrastructure, iran, malicious, middle-east, risk, threat, vulnerability, wormDuring exercises at CognectCon2025 a number of cyberattack scenarios were discussed that highlighted the risks of cyber attackers leveraging cognitive vulnerabilities to cause major impacts to nation critical infrastructures. This video is a short report-out on one such possible scenario, before we began discussing how to prevent, detect, and respond to such an event. In…
-
Scattered Spider Targets Aflac, Other Insurance Companies
The prolific Scattered Spider threat group, which recently targeted U.S. and UK retailers in a series of attacks, is now turning its attention to the insurance industry and appears to have landed a big victim in Aflac after compromising networks and systems of the Philadelphia Insurance and Erie Insurance companies. First seen on securityboulevard.com Jump…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 50
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet Predator Still Active, with New Client and Corporate Links Identified Threat Group Targets Companies in Taiwan Feeling Blue(Noroff): Inside a Sophisticated DPRK Web3 Intrusion Anubis: A…
-
16 Billion Leaked Records May Not Be a New Breach, But They’re a Threat
Cybernews researchers reported that since the beginning of the year, they’ve detected 30 datasets containing 16 billion stolen credentials exposed on the internet, most of which had not been previously recorded and represent a massive trove of records that can be used in ransomware, phishing, BEC, and other attacks. First seen on securityboulevard.com Jump to…
-
Week in review: Keyloggers found on Outlook login pages, police shut down dark web drug market
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Researchers unearth keyloggers on Outlook login pages Unknown threat actors … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/22/week-in-review-keyloggers-found-on-outlook-login-pages-police-shut-down-dark-web-drug-market/
-
DuckDuckGo Browser’s Scam Blocker to Guard Against Phishing and Malware Sites
DuckDuckGo has rolled out an advanced update to its browser’s built-in Scam Blocker, a robust security feature designed to shield users from a wide array of online threats, including phishing sites, malware, and sophisticated scams. Now integrated into the DuckDuckGo browser for both desktop and mobile platforms, Scam Blocker offers protection by default, requiring no…
-
Open Directories Exposes Publically Available tools Used by Hackers
A series of misconfigured web servers have been uncovered, revealing a treasure trove of publicly accessible tools and tactics employed by malicious actors targeting critical infrastructure. These exposed open directories, discovered through Hunt’s advanced scanning capabilities, highlight a significant security lapse that threat actors are exploiting with low-cost, high-reward methods. Unveiling Hidden Threats on the…
-
Microsoft Announces New Graph Powered Detection of Hybrid Attack Targeting Organizations
Microsoft has unveiled a groundbreaking advancement in cybersecurity with the integration of the Enterprise Exposure Graph into its threat detection and response capabilities. This cutting-edge solution, part of Microsoft Defender XDR and Microsoft Security Exposure Management (MSEM), is designed to combat the increasing sophistication of hybrid attacks that span on-premises and cloud environments. Innovative Exposure…
-
Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks
A new FS-ISAC and Akamai report warns that sophisticated DDoS attacks are severely impacting the global financial sector, leading to multi-day outages. Learn about these evolving threats and how institutions can strengthen defences. First seen on hackread.com Jump to article: hackread.com/sophisticated-ddos-campaigns-crippling-global-banks/
-
Iran confirmed it shut down internet to protect the country against cyberattacks
Iran confirmed an Internet shutdown to counter Israeli cyberattacks, citing threats to critical infrastructure, and interfere with drone control. Iran experienced a near-total internet blackout on Wednesday as tensions with Israel escalated into the first week of conflict. However, the exact cause behind the collapse of Iran’s internet remains unclear. While the timing coincides with…
-
Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages
The April 2025 cyber attacks targeting U.K. retailers Marks & Spencer and Co-op have been classified as a “single combined cyber event.”That’s according to an assessment from the Cyber Monitoring Centre (CMC), a U.K.-based independent, non-profit body set up by the insurance industry to categorize major cyber events.”Given that one threat actor claimed responsibility for…
-
The $4.88 Million Question: Why Password-Based Breaches Are Getting More Expensive
The $4.88 million question isn’t really whether organizations can afford to implement passwordless authentication”, it’s whether they can afford not to. With breach costs rising 10% annually, credential-based attacks representing the primary threat vector, and operational costs of password management continuing to escalate, the economic case for passwordless transformation has moved from compelling to urgent.…
-
Hackers Target 700+ ComfyUI AI Image Generation Servers to Spread Malware
Tags: ai, backdoor, china, cyber, cybersecurity, exploit, flaw, framework, group, hacker, intelligence, malware, threat, vulnerabilityChina’s National Cybersecurity Notification Center has issued an urgent warning about critical vulnerabilities in ComfyUI, a widely used image-generation framework for large AI models. These flaws, already under active exploitation by hacker groups, have compromised at least 695 servers worldwide, according to threat intelligence from XLab. The attackers are deploying a sophisticated backdoor named >>Pickai,
-
Hackers Post Dozens of Malicious Copycat Repos to GitHub
As package registries find better ways to combat cyberattacks, threat actors are finding other methods for spreading their malware to developers. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/dozens-malicious-copycat-repos-github
-
Prometei Botnet Targets Linux Servers for Cryptocurrency Mining Operations
Unit 42 researchers from Palo Alto Networks have identified a renewed wave of attacks by the Prometei botnet, specifically targeting Linux servers, as of March 2025. Initially discovered in July 2020 with a focus on Windows systems, Prometei has since evolved, with its Linux variant gaining prominence since December 2020. Resurgence of a Persistent Threat…
-
Beware of Weaponized MSI Installer Masquerading as WhatsApp to Deliver XWorm RAT
A newly identified cyber threat linked to a China-based threat actor has emerged, targeting users across East and Southeast Asia with a trojanized MSI installer disguised as a legitimate WhatsApp setup file. This deceptive campaign delivers a customized version of the XWorm Remote Access Trojan (RAT), a malicious tool designed to infiltrate systems, steal sensitive…
-
Threat Actors Manipulate Google Search Results to Display Scammer’s Phone Number Instead of Real Number
Threat actors are increasingly exploiting the trust users place in sponsored search results on platforms like Google to orchestrate sophisticated scams. These malicious entities craft deceptive advertisements that mimic legitimate websites, particularly targeting popular brands and tech support services. By leveraging the visibility of paid ads, which often appear at the top of search results,…
-
Threat Actors Exploit Vercel Hosting Platform to Distribute Remote Access Malware
CyberArmor has uncovered a sophisticated phishing campaign exploiting Vercel, a widely used frontend hosting platform, to distribute a malicious variant of LogMeIn, a legitimate remote access tool. Over the past two months, threat actors have orchestrated at least 28 distinct campaigns, targeting more than 1,271 users with deceptive emails that lead to fraudulent pages hosted…
-
New Detection Method Uses Hackers’ Own Jitter Patterns Against Them
A new detection method from Varonis Threat Labs turns hackers’ sneaky random patterns into a way to catch hidden cyberattacks. Learn about Jitter-Trap and how it boosts cybersecurity defenses. First seen on hackread.com Jump to article: hackread.com/cyber-detection-hackers-jitter-patterns-against-them/
-
PowerShell Loaders Use In-Memory Execution to Evade Disk-Based Detection
A recent threat hunting session has revealed a sophisticated PowerShell script, named y1.ps1, hosted in an open directory on a Chinese server (IP: 123.207.215.76). First detected on June 1, 2025, this script operates as a shellcode loader, employing advanced in-memory execution techniques to bypass traditional disk-based detection mechanisms. The discovery, attributed to Shenzhen Tencent Computer…
-
Qilin Ransomware Adds “Call Lawyer” Feature to Pressure Victims for Larger Ransoms
The threat actors behind the Qilin ransomware-as-a-service (RaaS) scheme are now offering legal counsel for affiliates to put more pressure on victims to pay up, as the cybercrime group intensifies its activity and tries to fill the void left by its rivals.The new feature takes the form of a “Call Lawyer” feature on the affiliate…
-
New Android Malware Surge Hits Devices via Overlays, Virtualization Fraud, and NFC Theft
Cybersecurity researchers have exposed the inner workings of an Android malware called AntiDot that has compromised over 3,775 devices as part of 273 unique campaigns.”Operated by the financially motivated threat actor LARVA-398, AntiDot is actively sold as a Malware-as-a-Service (MaaS) on underground forums and has been linked to a wide range of mobile campaigns,” PRODAFT…
-
New Mocha Manakin Malware Deploys NodeInitRAT via Clickfix Attack
Red Canary uncovers ‘Mocha Manakin,’ a new threat using paste and runs to deliver custom NodeInitRAT malware, potentially leading to ransomware. Learn to protect your systems. First seen on hackread.com Jump to article: hackread.com/mocha-manakin-malware-nodeinitrat-via-clickfix-attack/
-
AntiDot 31 Android Botnet Malware Grants Attackers Full Control Over Victim Devices
A new Android botnet malware named AntiDot has emerged as a formidable threat, granting cybercriminals unprecedented control over infected devices. Operated and sold by LARVA-398 as a Malware-as-a-Service (MaaS) on underground forums like XSS, AntiDot is marketed as a >>3-in-1