Cybersecurity researchers at Palo Alto Networks’ Unit 42 have uncovered a novel obfuscation method employed by threat actors to conceal malware within bitmap resources of seemingly benign 32-bit .NET applications. This advanced steganography technique embeds malicious payloads in bitmap files,…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Scattered Spider Malware Targets Klaviyo, HubSpot, and Pure Storage Platforms
Silent Push researchers have identified that the notorious hacker collective Scattered Spider, also known as UNC3944 or Octo Tempest, continues to actively target prominent services in 2025, including Klaviyo, HubSpot, and Pure Storage. This group, active since at least 2022,…
Hackers Target IT Admins by Poisoning SEO to Push Malware to Top Search Results
Cybercriminals are increasingly targeting IT administrators through sophisticated Search Engine Optimization (SEO) poisoning techniques. By leveraging SEO tactics typically used for legitimate online marketing, attackers manipulate search engine rankings to push malicious websites to the top of results on platforms…
Chinese Hackers Exploit SAP RCE Vulnerability to Deploy Supershell Backdoors
A critical remote code execution (RCE) vulnerability, identified as CVE-2025-31324, in SAP NetWeaver Visual Composer 7.x is being actively exploited by a Chinese threat actor, tracked as Chaya_004. This deserialization flaw allows attackers to upload malicious binaries, including web shells,…
New Supply Chain Attack Compromises Popular npm Package with 45,000 Weekly Downloads
An advanced supply chain attack has targeted the well-known npm package rand-user-agent, which receives about 45,000 downloads every week, in a worrying development for the JavaScript developer community. Maintained by WebScrapingAPI, this package is designed to generate randomized, real-world user-agent…
Malicious Python Package Impersonates Discord Developers to Deploy Remote Commands
A seemingly innocuous Python package named ‘discordpydebug’ surfaced on the Python Package Index (PyPI) under the guise of “Discord py error logger.” Marketed as a debugging utility for developers working on Discord bots with the Discord.py library, this package was…
New Mamona Ransomware Targets Windows Systems Using Abused Ping Command
Cybersecurity researchers are raising the alarm about a newly discovered commodity ransomware strain dubbed Mamona, which is rapidly spreading across Windows systems. Unlike traditional ransomware, Mamona employs a unique set of tactics, notably exploiting the humble Windows “ping” command as a…
Indirect Prompt Injection Exploits LLMs’ Lack of Informational Context
A new wave of cyber threats targeting large language models (LLMs) has emerged, exploiting their inherent inability to differentiate between informational content and actionable instructions. Termed “indirect prompt injection attacks,” these exploits embed malicious directives within external data sources-such as…
Hackers Exploit PDF Invoices to Target Windows, Linux, and macOS Systems
A recent discovery by the FortiMail Incident Response team has revealed a highly sophisticated email campaign targeting organizations in Spain, Italy, and Portugal. This attack distributes a potent Remote Access Trojan (RAT) known as RATty, primarily affecting Windows systems, but…
Threat Actors Leverage Multimedia Systems in Stealthy Vishing Attacks
Threat actors have begun exploiting multimedia systems as a pivotal component of their voice phishing (vishing) attacks. Unlike traditional vishing schemes that rely solely on spoofed phone numbers and social engineering tactics, these advanced operations integrate compromised multimedia platforms, such…
FreeDrain Phishing Attack Targets Users to Steal Financial Login Credentials
PIVOTcon, joint research by Validin and SentinelLABS has exposed FreeDrain, an industrial-scale cryptocurrency phishing operation that has been stealthily siphoning digital assets for years. This sophisticated campaign leverages search engine optimization (SEO) manipulation, free-tier web services, and intricate redirection techniques…
Hackers Exploit Windows Remote Management to Evade Detection in AD Networks
A new wave of cyberattacks is targeting Active Directory (AD) environments by abusing Windows Remote Management (WinRM), a legitimate administrative tool, to move laterally and evade detection across enterprise networks. Security researchers and incident responders are raising alarms as attackers…
Hackers Exploit Host Header Injection to Breach Web Applications
Cybersecurity researchers have reported a significant rise in web breaches triggered by a lesser-known technique: Host Header Injection. This sophisticated attack vector has enabled hackers to compromise numerous web applications, steal sensitive information, and manipulate website operations-raising alarm bells among…
UK Government to Shift Away from Passwords in New Security Move
UK government has unveiled plans to implement passkey technology across its digital services later this year, marking a significant shift away from traditional password and SMS-based verification methods. Announced at the government’s flagship cyber security event CYBERUK, this transition aims…
Kaspersky Alerts on AI-Driven Slopsquatting as Emerging Supply Chain Threat
Cybersecurity researchers at Kaspersky have identified a new supply chain vulnerability emerging from the widespread adoption of AI-generated code. As AI assistants increasingly participate in software development-with Microsoft CTO Kevin Scott predicting AI will write 95% of code within five…
Apache ActiveMQ Vulnerability Allows Attackers to Induce DoS Condition
Critical vulnerability in Apache ActiveMQ (CVE-2024-XXXX) exposes brokers to denial-of-service (DoS) attacks by allowing malicious actors to exhaust system memory through specially crafted OpenWire commands. The flaw, tracked as AMQ-6596, affects multiple legacy versions of the widely used open-source messaging…
Researchers Uncover Remote Code Execution Flaw in macOS – CVE-2024-44236
Security researchers Nikolai Skliarenko and Yazhi Wang of Trend Micro’s Research Team have disclosed critical details about CVE-2024-44236, a memory corruption vulnerability in Apple’s macOS Scriptable Image Processing System (sips). Discovered by Hossein Lotfi through Trend Micro’s Zero Day Initiative,…
New Advanced Phishing Attack Exploits Discord to Target Crypto Users
Check Point Research has uncovered a sophisticated phishing campaign that leverages Discord to target cryptocurrency users. The attack redirects victims from legitimate Web3 websites to a fake Collab.Land bot and then to a phishing site, ultimately tricking them into signing…
Play Ransomware Deployed in the Wild Exploiting Windows 0-Day Vulnerability
Patched Windows zero-day vulnerability (CVE-2025-29824) in the Common Log File System (CLFS) driver was exploited in attacks linked to the Play ransomware operation prior to its disclosure on April 8, 2025. The flaw, which enabled privilege escalation via a use-after-free…
Europol Dismantles DDoS-for-Hire Network and Arrests Four Administrators
Significant blow to cybercriminal infrastructure, Europol has coordinated an international operation resulting in the arrest of four individuals in Poland who allegedly operated six DDoS-for-hire platforms. These platforms, which allowed paying customers to launch devastating cyberattacks for as little as…
SonicWall Unveils New Firewalls and Comprehensive Managed Cybersecurity Service
SonicWall has unveiled a new line of advanced firewalls and a comprehensive managed cybersecurity service designed to combat the evolving threat landscape, with particular emphasis on attacks targeting non-standard ports. The announcement comes on the heels of concerning findings in…
160-Year-Old Haulage Firm Falls After Cyber-Attack: Director Issues Urgent Warning
The 160-year-old haulage giant Knights of Old, once a stalwart of the UK’s logistics sector, was forced into administration in 2023 following a devastating cyber-attack that crippled its financial systems. Paul Abbott, a board director at the Kettering-based firm, has…
Nomad Bridge Hacker Apprehended in Connection with $190 Million Heist
Alexander Gurevich, a 47-year-old dual Russian-Israeli citizen, was arrested last Thursday at Ben-Gurion Airport while attempting to flee to Russia under a new identity. Gurevich is the primary suspect in the 2022 Nomad Bridge hack that resulted in approximately $190…
Microsoft Launches “Copilot+ PC” for an Upgraded Windows Experience
Microsoft has announced a significant wave of new Windows experiences designed for Copilot+ PCs, which the company describes as “the fastest, most intelligent and most secure Windows PCs ever built.” These AI-powered enhancements aim to make Windows more intuitive, accessible,…
Fedora Linux Joins the Windows Subsystem for Linux Officially
Fedora Project has announced the official availability of Fedora Linux on the Windows Subsystem for Linux (WSL), marking a significant expansion of Fedora’s ecosystem. Starting with Fedora 42, users can now seamlessly integrate Fedora’s cutting-edge tools and development environment directly…
FBI Warns Hackers Are Using End-of-Life Routers to Mask Their Tracks
The Federal Bureau of Investigation (FBI) has issued a stark warning to businesses and home users: cybercriminals are actively exploiting outdated, unsupported routers to hide their tracks and launch attacks, making them a favored tool for masking malicious operations. According…
Azure Storage Utility Vulnerability Allows Privilege Escalation to Root Access
A critical vulnerability discovered by Varonis Threat Labs has exposed users of Microsoft Azure’s AI and High-Performance Computing (HPC) workloads to a potential privilege escalation attack. The flaw, found in a utility pre-installed on select Azure Linux virtual machines, made…
Seamless AI Communication: Microsoft Azure Adopts Google’s A2A Protocol
Microsoft has announced its support for the Agent2Agent (A2A) protocol, an open standard developed in collaboration with industry partners including Google, to enable seamless communication between AI agents across platforms, clouds, and organizational boundaries. This strategic move, integrated into Azure…
Cisco IOS Software SISF Vulnerability Could Enable Attackers to Launch DoS Attacks
Cisco has released security updates addressing a critical vulnerability in the Switch Integrated Security Features (SISF) of multiple software platforms that could allow unauthenticated attackers to cause denial of service (DoS) conditions. The vulnerability stems from incorrect handling of DHCPv6…
IXON VPN Client Vulnerability Allows Privilege Escalation for Attackers
A critical security vulnerability in IXON’s widely used VPN client has exposed Windows, Linux, and macOS systems to local privilege escalation attacks, enabling non-privileged users to gain root or SYSTEM-level access. Designated as CVE-2025-26168 and CVE-2025-26169, these flaws affect versions…
Critical Vulnerability in Ubiquiti UniFi Protect Camera Allows Remote Code Execution by Attackers
Critical security vulnerabilities in Ubiquiti’s UniFi Protect surveillance ecosystem-one rated the maximum severity score of 10.0-could allow attackers to hijack cameras, execute malicious code remotely, and maintain unauthorized access to video feeds. The flaws, disclosed on May 6, 2025, affect…
Radware Cloud Web App Firewall Flaw Allows Attackers to Bypass Security Filters
Security researchers have uncovered two critical vulnerabilities in Radware’s Cloud Web Application Firewall (WAF) that enable attackers to bypass security filters and deliver malicious payloads to protected web applications. These flaws, designated CVE-2024-56523 and CVE-2024-56524, highlight systemic weaknesses in how…
ESET Reveals How to Spot Fake Calls Demanding Payment for ‘Missed Jury Duty’
ESET, a leading cybersecurity firm, has shed light on one particularly insidious scheme: fake calls purportedly from government officials demanding payment for ‘missed jury duty’. Here’s how to identify and protect against these scams. Scammers employing these tactics often impersonate…
New Spam Campaign Leverages Remote Monitoring Tools to Exploit Organizations
A sophisticated spam campaign targeting Portuguese-speaking users in Brazil has been uncovered by Cisco Talos, active since at least January 2025. This campaign exploits commercial remote monitoring and management (RMM) tools, such as PDQ Connect and N-able Remote Access, to…
Researchers Turn the Tables: Scamming the Scammers in Telegram’s PigButchering Scheme
Cybersecurity specialists have devised an innovative approach to combat an emerging cybercrime called “PigButchering” on the Telegram platform. This form of cyber fraud involves scammers cultivating false relationships with victims over time, much like fattening a pig for slaughter, only…
Iranian Hackers Posing as Model Agency to Target Victims
Unit 42, the threat intelligence arm of Palo Alto Networks, has exposed a covert operation likely orchestrated by Iranian cyber actors. The campaign involves a fraudulent website, megamodelstudio[.]com, meticulously designed to impersonate the Hamburg-based Mega Model Agency. Cyberespionage Campaign Uncovered…
Ransomware-as-a-Service (RaaS) Emerges as a Leading Framework for Cyberattacks
Ransomware-as-a-Service (RaaS) has solidified its position as the dominant framework driving ransomware attacks in 2024, according to the latest insights from Kaspersky ahead of International Anti-Ransomware Day on May 12. Kaspersky Security Network data reveals an 18% drop in ransomware…
DOGE Big Balls Ransomware Leverages Open-Source Tools and Custom Scripts for Multi-Stage Attacks
A recent discovery by Netskope Threat Labs has brought to light a highly complex ransomware variant dubbed “DOGE Big Balls,” a derivative of the Fog ransomware. Named provocatively after the Department of Government Efficiency (DOGE), this ransomware incorporates political statements…
Guess Which Browser Tops the List for Data Collection!
Google Chrome has emerged as the undisputed champion of data collection among 10 popular web browsers studied on the Apple App Store. Collecting a staggering 20 different data types, Chrome surpasses all competitors by a significant margin. From personal contact…
New Attack Exploits X/Twitter Ad URL Feature to Deceive Users
Silent Push Threat Analysts have recently exposed a sophisticated financial scam leveraging a vulnerability in X/Twitter’s advertising display URL feature to deceive users. This attack manipulates the platform’s URL display mechanism to present a legitimate-looking link, such as “From CNN[.]com,”…
Microsoft Bookings Vulnerability Allows Unauthorized Changes to Meeting Details
Security researchers have uncovered a significant vulnerability in Microsoft Bookings, the scheduling tool integrated with Microsoft 365. The flaw, discovered through technical analysis of the service’s appointment creation and update APIs, allows unauthorized modification of meeting details, posing risks such…
Cisco IOS XE Vulnerability Allows Attackers to Gain Elevated Privileges
Cisco has issued an urgent security advisory (ID: cisco-sa-iosxe-privesc-su7scvdp) following the discovery of multiple privilege escalation vulnerabilities in its widely used IOS XE Software. The flaws could allow attackers with existing high-level device access to gain root privileges, jeopardizing the…
Nmap 7.96 Released with Enhanced Scanning Capabilities and Updated Libraries
The popular network mapping and security auditing tool Nmap has released version 7.96, featuring a host of significant improvements. This latest version introduces parallel forward DNS resolution for dramatically faster hostname scanning, upgraded core libraries, new scripting capabilities, and enhanced…
Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots
Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in its widely used IOS, IOS XE, and IOS XR software. The flaw, tracked as CVE-2025-20154, allows unauthenticated attackers to trigger denial-of-service (DoS) conditions by forcing devices to…
OpenCTI: Free Cyber Threat Intelligence Platform for Security Experts
OpenCTI (Open Cyber Threat Intelligence) stands out as a free, open source platform specifically designed to address this need-delivering robust capabilities for cyber threat intelligence (CTI) management and analysis. Created by Filigran, OpenCTI allows organizations to structure, store, and visualize…
LockBit Ransomware Group Breached: Internal Chats and Data Leaked Online
The notorious LockBit ransomware group, once considered one of the world’s most prolific cyber extortion rings, has itself become the victim of a major cyberattack. On May 7, attackers breached and defaced the group’s dark web sites, leaking a trove…
Cisco IOS XE Wireless Controllers Vulnerability Lets Attackers Seize Full Control
A critical security flaw has been discovered in Cisco IOS XE Wireless LAN Controllers (WLCs), potentially allowing unauthenticated remote attackers to gain full control of affected devices. The vulnerability, tracked as CVE-2025-20188, lets attackers upload arbitrary files and execute commands with…
Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER
The Agenda ransomware group, also known as Qilin, has been reported to intensify its attacks in the first quarter of 2025, targeting critical sectors like healthcare, technology, financial services, and telecommunications across the US, the Netherlands, Brazil, India, and the…
Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed
Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector emerged as a prime target for cyber threat actors, with 406 publicly disclosed victims falling prey to ransomware attacks alone. This figure accounts for roughly seven…
Healthcare Sector Becomes a Major Target for Cyber Attacks in 2025
The healthcare sector has emerged as a prime target for cyber attackers, driven by the increasing reliance on cloud applications and the rapid integration of generative AI (genAI) tools into organizational workflows. According to the Netskope Threat Labs Report for…
PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability
F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect servers vulnerable to the recently disclosed Apache Parquet vulnerability, CVE-2025-30065. This vulnerability, which received a maximum CVSS score of 10.0, puts countless data-driven environments at risk…
SysAid ITSM Vulnerabilities Enables Pre-Auth Remote Command Execution
Security researchers have disclosed a chain of critical vulnerabilities affecting SysAid ITSM’s On-Premise solution, enabling unauthenticated attackers to execute remote commands by exploiting several pre-auth XML External Entity (XXE) injection flaws. The vulnerabilities, registered as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777, highlight…
Russian Company Gains Full Control Over Critical Open Source Easyjson Library
A startling discovery by Hunted Labs has brought to light a potential security risk lurking within the heart of the cloud-native ecosystem. The open source Go package easyjson, widely used for optimizing JSON serialization and deserialization, has been found to…
CISA Warns of Cyber Threats to Oil and Gas SCADA and ICS Networks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert warning critical infrastructure operators-particularly those in the oil and natural gas sector-of emerging cyber threats targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) networks.…
DragonForce: Emerging Hybrid Cyber Threat in the 2025 Ransomware Landscape
DragonForce has swiftly risen as a formidable player in 2025, embodying a hybrid threat that blends ideological ambiguity with ruthless opportunism. First identified in December 2023 with the debut of its “DragonLeaks” dark web portal, DragonForce may trace its origins…
Lampion Banking Malware Uses ClickFix Lures to Steal Banking Credentials
Unit 42 researchers at Palo Alto Networks, a highly targeted malicious campaign orchestrated by the threat actors behind the Lampion banking malware has been uncovered. Active since at least 2019, Lampion is an infostealer notorious for extracting sensitive banking information.…
Researchers Simulate DPRK’s Largest Cryptocurrency Heist Through Compromised macOS Developer and AWS Pivoting
Security researchers at Elastic have recreated the intricate details of the February 21, 2025, ByBit cryptocurrency heist, where approximately 400,000 ETH-valued at over a billion dollars-was stolen. Attributed to North Korea’s elite cyber unit, TraderTraitor, this attack exploited a trusted…
Mirai Botnet Actively Targeting GeoVision IoT Devices for Command Injection Exploits
The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of command injection vulnerabilities in discontinued GeoVision Internet of Things (IoT) devices. The vulnerabilities, tracked as CVE-2024-6047 and CVE-2024-11120, were initially disclosed in June and November 2024, respectively,…
IBM Cognos Analytics Security Vulnerability Allowed Unauthorized File Uploads
IBM has issued a security bulletin addressing two newly discovered, high-severity vulnerabilities in its Cognos Analytics platform. These flaws, tracked as CVE-2024-40695 (Malicious File Upload) and CVE-2024-51466 (Expression Language Injection), potentially expose enterprise systems to unauthorized file uploads and the risk of sensitive data…
Critical AWS Amplify Studio Flaw Allowed Attackers to Execute Arbitrary Code
Amazon Web Services (AWS) has addressed a critical security flaw (CVE-2025-4318) in its AWS Amplify Studio platform, which could have allowed authenticated attackers to execute malicious JavaScript code during component rendering. The vulnerability, publicly disclosed on May 5, 2025, affects the amplify-codegen-ui package, a…
Severe Kibana Flaw Allowed Attackers to Run Arbitrary Code
A newly disclosed security vulnerability in Elastic’s Kibana platform has put thousands of businesses at risk, with attackers able to execute arbitrary code on vulnerable systems. The flaw, identified as CVE-2025-25014, carries a critical CVSS score of 9.1, underscoring the urgency for…
IT Worker from Computacenter Let Girlfriend Into Deutsche Bank’s Restricted Areas
A former information technology manager has filed a whistleblower lawsuit alleging a major security breach at Deutsche Bank’s Manhattan headquarters, claiming a fellow IT contractor repeatedly brought his girlfriend – an unauthorized Chinese national with computer expertise – into the…
NSO Group Ordered to Pay $168 Million to WhatsApp in US Spyware Verdict
A federal jury in California has ordered Israeli spyware maker NSO Group to pay approximately $168 million in damages to WhatsApp. The verdict, delivered on Tuesday, represents a pivotal victory in the ongoing global battle against commercial cyberespionage and sets…
UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion
UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider, has transitioned from niche SIM swapping operations targeting telecommunications organizations to a more aggressive focus on ransomware and data theft extortion across diverse industries. Initially observed…
Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX
As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search Service are revolutionizing data retrieval with advanced fuzzy search and LLM-driven Retrieval Augmented Generation (RAG) capabilities. However, beneath the promise of efficiency lies a critical security…
BFDOOR Malware Targets Organizations to Establish Long-Term Persistence
The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations, particularly in the telecommunications sector. First identified by PwC in 2021, BPFDoor is a highly sophisticated backdoor malware designed to infiltrate Linux systems with an emphasis…
Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware
Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800 compromised websites. The operation, dubbed “MacReaper,” uses sophisticated social engineering and blockchain technology to deliver the Atomic Stealer (AMOS) malware, capable of stealing passwords, cryptocurrency wallets,…
Microsoft Alerts That Default Helm Charts May Expose Kubernetes Apps to Data Leaks
Microsoft’s cybersecurity research team has issued a stark warning about the risks of using default Helm charts and Kubernetes deployment templates, revealing that popular cloud-native applications like Apache Pinot, Meshery, and Selenium Grid are being deployed with critical security gaps.…
Hackers Bypass AI Filters from Microsoft, Nvidia, and Meta Using a Simple Emoji
Cybersecurity researchers have uncovered a critical flaw in the content moderation systems of AI models developed by industry giants Microsoft, Nvidia, and Meta. Hackers have reportedly found a way to bypass the stringent filters designed to prevent the generation of…
Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months
The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in 2025, with ransomware attacks doubling in the first quarter compared to the same period in 2024. Speaking at the RSA Conference on Thursday, Jonathan Braley, director…
Popular Instagram Blogger’s Account Hacked to Phish Users and Steal Banking Credentials
A high-profile Russian Instagram blogger recently fell victim to a sophisticated cyberattack, where scammers hijacked her account to orchestrate a fake $125,000 cash giveaway. The attackers employed advanced techniques, including AI-generated deepfake videos and meticulously crafted phishing campaigns, to deceive…
Microsoft Resolves Group Policy Issue Blocking Windows 11 24H2 Installation
Microsoft has resolved a critical enterprise-focused bug that blocked organizations from deploying Windows 11 24H2 through Windows Server Update Services (WSUS), alongside addressing a separate dual-boot Linux compatibility issue tied to older security updates. These fixes come as part of…
Darcula PhaaS: 884,000 Credit Card Details Stolen from 13 Million Global User Clicks
The Darcula group has orchestrated a massive phishing-as-a-service (PhaaS) operation, dubbed Magic Cat, compromising an estimated 884,000 credit card details from over 13 million user interactions worldwide. This smishing (SMS phishing) campaign, first detected in December 2023, impersonates trusted brands…
Initial Access Brokers Play a Vital Role in Modern Ransomware Attacks
The ransomware threat landscape has evolved dramatically in recent years, with specialized cybercriminals like Initial Access Brokers (IAbBs) emerging as critical enablers in the Ransomware-as-a-Service (RaaS) ecosystem. These actors serve as high-value middlemen, focusing on breaching organizational networks and selling…
Hackers Targeting Schools and Universities in New Mexico with Cyber Attacks
A major cyberattack on the Coweta County School System’s computer network occurred late Friday night, which is a worrying development for New Mexico’s educational institutions. The unauthorized intrusion, detected around 7:00 p.m., prompted immediate action from the school system’s IT department and external cybersecurity partners. Following established protocols, critical systems were taken offline to halt the malicious activity and trace its origins. This…
Microsoft 365 Copilot and Office Apps Now Protected by SafeLinks at Click Time
Microsoft announced a major update aimed at bolstering the cybersecurity of its flagship AI-powered productivity assistant, Microsoft 365 Copilot, and its suite of Office apps. The integration of SafeLinks protection at time-of-click marks a significant step forward in safeguarding users…
DragonForce Ransomware Targets Major UK Retailers, Including Harrods, Marks & Spencer, and Co-Op
Major UK retailers including Harrods, Marks and Spencer, and Co-Op are currently experiencing significant service disruptions following a series of coordinated ransomware attacks attributed to the DragonForce group. The attacks have affected critical business functions including payment systems, inventory management,…
Google’s NotebookLM Introduces Voice Summaries in Over 50 Languages
Google has significantly expanded the capabilities of NotebookLM, its AI-powered research tool, by introducing Audio Overviews in more than 50 languages. This enhancement builds upon the platform’s global expansion to over 200 countries last year and marks a pivotal development…
OpenAI Shifts For-Profit Branch to Public Benefit Corporation, Staying Under Nonprofit Oversight
Landmark organizational shift, OpenAI announced its transition from a capped-profit LLC to a Public Benefit Corporation (PBC) while maintaining governance under its original nonprofit structure. The move, detailed in a May 2025 letter from CEO Sam Altman, aims to balance…
Android Security Update -A Critical RCE Vulnerability Actively Exploited in the Wild
Google has released critical security patches for Android devices to address 57 vulnerabilities across multiple subsystems, including an actively exploited remote code execution flaw tracked as CVE-2025-27363. The May 2025 security bulletin confirms this high-severity vulnerability in Android’s System component…
Hackers Exploit Fake Chrome Error Pages to Deploy Malicious Scripts on Windows Users
Hackers are leveraging a sophisticated social engineering technique dubbed “ClickFix” to trick Windows users into executing malicious scripts on their systems. This method capitalizes on fake error pages and notifications that mimic legitimate alerts, often resembling Chrome browser errors or…
UK Retail Chains Targeted by Ransomware Attackers Claiming Data Theft
Major ransomware campaign targeting UK retailers has escalated as hackers provided BBC News with evidence of extensive network infiltration and data theft from Co-op, contradicting the company’s initial statements that downplayed the incident. The cyber criminals, operating under the name…
Samsung MagicINFO 9 Server Vulnerability Actively Exploited in the Wild
A critical security vulnerability in the Samsung MagicINFO 9 Server has come under active exploit, security researchers from Arctic Wolf have warned. The flaw, tracked as CVE-2024-7399, allows unauthenticated attackers to remotely execute code and compromise digital signage infrastructure in organizations…
Threat Actor Evades SentinelOne EDR to Deploy Babuk Ransomware
Aon’s Stroz Friedberg Incident Response Services has uncovered a method used by a threat actor to bypass SentinelOne Endpoint Detection and Response (EDR) protections, ultimately deploying a variant of the notorious Babuk ransomware. SentinelOne EDR, a widely-used endpoint protection solution,…
New ClickFix Attack Imitates Ministry of Defence Website to Target Windows & Linux Systems
A newly identified cyberattack campaign has surfaced, leveraging the recognizable branding of India’s Ministry of Defence to distribute cross-platform malware targeting both Windows and Linux systems. Uncovered by threat intelligence researchers at Hunt.io, this operation employs a ClickFix-style infection chain,…
Firefox’s Future Uncertain Without Google Search Deal, Insider Warns
Mozilla’s Chief Financial Officer testified that Firefox could face extinction if Justice Department proposals targeting Google’s search dominance are fully implemented, revealing the browser’s precarious financial position amid ongoing antitrust proceedings. Mozilla Corporation CFO Eric Muhlheim delivered stark testimony Friday,…
xAI API Key Leak Exposes Proprietary Language Models on GitHub
Employee at Elon Musk’s artificial intelligence firm xAI inadvertently exposed a private API key on GitHub for over two months, granting unauthorized access to proprietary large language models (LLMs) fine-tuned on internal data from SpaceX, Tesla, and Twitter/X. Security researchers…
TikTok Hit with €530 Million Fine Over Data Transfers to China
Irish Data Protection Commission (DPC) has imposed a landmark €530 million fine on TikTok Technology Limited for illegally transferring European Economic Area (EEA) user data to China and failing to meet transparency obligations under the General Data Protection Regulation (GDPR).…
Researcher Exploits Regex Filter Flaw to Gain Remote Code Execution
Target application included a username field restricted by a frontend regex filter (/^[a-zA-Z0-9]{1,20}$/), designed to accept only alphanumeric characters. While this initially appeared robust, the researcher discovered that the backend failed to revalidate inputs after the regex check. This oversight…
Google Gemini Introduces Built-In Image Editing in App
Google has integrated advanced AI-powered image editing tools directly into its Gemini app, enabling users to manipulate both AI-generated and uploaded images through text prompts. The update, which began rolling out globally on May 5, 2025, introduces multi-step editing workflows,…
New GPOHound Tool Analyzes Active Directory GPOs for Escalation Risks
Security researchers have released GPOHound, a powerful open-source tool designed to analyze Group Policy Objects (GPOs) in Active Directory environments for misconfigurations and privilege escalation risks. Developed by cybersecurity firm Cogiceo, the tool automates the detection of insecure settings like exposed…
Signal App Used by Trump Associate Targeted in Security Breach
A major security scare has erupted in Washington after reports emerged that a Trump associate was using an unofficial version of the secure messaging platform Signal-an application that was subsequently targeted in a data breach, according to a Sunday report…
Critical Microsoft 0-Click Telnet Vulnerability Enables Credential Theft Without User Action
A critical vulnerability has been uncovered in Microsoft’s Telnet Client (telnet.exe), enabling attackers to steal Windows credentials from unsuspecting users, even without interaction in certain network scenarios. Security researchers warn that this “zero-click” flaw could be readily exploited in corporate…
Windows Deployment Services Hit by 0-Click UDP Flaw Leading to System Failures
A newly discovered pre-authentication denial-of-service (DoS) vulnerability in Microsoft’s Windows Deployment Services (WDS) exposes enterprise networks to instant system crashes via malicious UDP packets. Dubbed a “0-click” flaw, attackers can exploit it remotely without user interaction, draining server memory until critical services…
CISA Issues Alert on Langflow Vulnerability Actively Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding an actively exploited vulnerability in Langflow, a popular open-source framework for building language model applications. Tracked as CVE-2025-3248, the flaw allows unauthenticated attackers to execute malicious code remotely, posing…
Gunra Ransomware’s Double‑Extortion Playbook and Global Impact
Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems across industries such as real estate, pharmaceuticals, and manufacturing. As reported by CYFIRMA, this ransomware employs a sophisticated double-extortion strategy, encrypting victims’ data while exfiltrating sensitive…
Hackers Use Pahalgam Attack-Themed Decoys to Target Indian Government Officials
The Seqrite Labs APT team has uncovered a sophisticated cyber campaign by the Pakistan-linked Transparent Tribe (APT36) targeting Indian Government and Defense personnel. This operation, centered around the recent Pahalgam terror attack on April 22, 2025, leverages emotionally charged themes…
RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals
The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu, has been targeting UK companies in the retail, hospitality, and critical national infrastructure (CNI) sectors in a recently discovered cyber espionage and profit-driven operation called “Operation…
Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware
The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its focus to corporate Human Resources (HR) departments with a highly targeted spear-phishing operation. According to research by Arctic Wolf Labs, the group is leveraging legitimate job…
Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers
Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21 popular e-commerce applications, granting hackers full control over hundreds of online stores. This malicious campaign, which began with the injection of backdoors as early as six…