The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated threat. This Ransomware-as-a-Service (RaaS) operation, first observed in May 2024, has rapidly evolved, executing coordinated attacks that disrupt critical processes, encrypt data, and hinder recovery…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
500 Million Proton VPN & Pass Users at Risk Due to Memory Protection Vulnerability
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass, is facing scrutiny after the discovery of severe memory protection vulnerabilities in its products. Despite having established itself as a trusted name for safeguarding user…
Microsoft Enhances Windows 11 Security with Admin Protection to Prevent Crowdstrike-Like Incident
Microsoft has introduced “Administrator Protection” (AP), a sophisticated security feature aimed at elevating Windows operating system security by redefining how administrative privileges are managed and reducing the risk of privilege escalation attacks. Detailed in its latest technical blog post, this…
CISA Releases Seven ICS Advisories to Strengthen Cybersecurity Posture
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued seven Industrial Control Systems (ICS) advisories, highlighting critical vulnerabilities in systems vital to industrial and operational processes. These advisories aim to enhance awareness and encourage mitigation strategies to maintain the…
Lazarus Group Drop Malicious NPM Packages in Developers Systems Remotely
In a recent discovery by Socket researchers, a malicious npm package named postcss-optimizer has been identified as an operation spearheaded by the North Korean state-sponsored group, Lazarus Advanced Persistent Threat (APT). Tied to past campaigns and employing code-level similarities, the…
TeamViewer Clients Vulnerability Leads to Privilege Escalation
TeamViewer, a widely used remote access software, has announced a critical vulnerability in its Windows clients. The company disclosed on January 28, 2025, that its software is affected by a security flaw that could allow local attackers to escalate privileges.…
Lazarus Hackers Tamper with Software Packages to Gain Backdoor Access to the Victims Device
A recent investigation conducted by STRIKE, a division of SecurityScorecard, has unveiled the intricate and far-reaching operation of the Lazarus Group, a North Korean advanced persistent threat (APT) group. Dubbed “Operation Phantom Circuit,” the campaign highlights a deliberate and sophisticated…
Tria Stealer Malware Exploits Android Devices to Harvest SMS Data
Cybersecurity researchers have uncovered a sophisticated Android malware campaign known as “Tria Stealer,” which is targeting users in Malaysia and Brunei to collect sensitive information such as SMS data, call logs, WhatsApp messages, and emails. The malware campaign, which has…
Hackers Sell Compromised Emails and Google Ads Accounts on Dark Web
A new wave of cybercrime is surfacing as hackers exploit compromised emails and digital advertising platforms to create a thriving underground economy. This illegal marketplace, primarily hosted on the dark web, trades in aged and pre-verified accounts, offering tech-savvy criminals…
Cybercriminals Hijack Government Sites to Lauch Phishing Attacks
Cybersecurity researchers have identified a persistent trend in which threat actors exploit vulnerabilities in government websites to further phishing campaigns. Based on data spanning November 2022 through November 2024, malicious actors have misused numerous .gov top-level domains (TLDs) across more…
10,000 WordPress Websites Hacked to Distributing MacOS and Microsoft Malware
Over 10,000 WordPress websites have been hijacked to deliver malicious software targeting both macOS and Windows users. Researchers revealed this week how attackers leveraged vulnerabilities in outdated WordPress software and plugins to distribute malware via fake browser update pages presented…
New RDP Exploit Allows Attackers to Take Over Windows and Browser Sessions
Cybersecurity experts have uncovered a new exploit leveraging the widely used Remote Desktop Protocol (RDP). This vulnerability enables attackers to gain unauthorized control over Windows systems and hijack browser activity, posing a significant threat to individual and enterprise data security.…
DeepSeek Database Publicly Exposed Sensitive Information, Secret Keys & Logs
Experts at Wiz Research have identified a publicly exposed ClickHouse database belonging to DeepSeek, a Chinese AI startup renowned for its innovative models. The vulnerability granted full control over database operations, exposing sensitive information such as chat history, secret keys,…
New SMS-Based Phishing Tool ‘DevilTraff’ Enables Mass Cyber Attacks
Cybersecurity experts are sounding the alarm about a new SMS-based phishing tool, Devil-Traff, that is enabling large-scale cyberattacks worldwide. By exploiting trust and leveraging advanced automation, this malicious platform empowers attackers to conduct high-volume phishing campaigns with devastating results. How…
OPNsense 25.1 Released, What’s New!
The highly anticipated release of OPNsense 25.1 has officially arrived! Nicknamed “Ultimate Unicorn,” this update marks a significant milestone for the open-source firewall platform, celebrating its decade-long journey of innovation, security, and reliable performance. Packed with exciting features, new integrations,…
DeepSeek is Now Available With Microsoft Azure AI Foundry
Microsoft has officially added DeepSeek R1, an advanced AI model, to its Azure AI Foundry and GitHub Model Catalog. This move places DeepSeek R1 among a curated selection of over 1,800 AI models, spanning open-source, task-specific, and industry-focused solutions. Businesses…
Lynx Ransomware Architecture to Attack Windows, Linux, ESXi Uncovered
The emergence of the Lynx Ransomware-as-a-Service (RaaS) platform has drawn significant attention in cybersecurity circles, owing to its advanced technical capabilities, structured affiliate workflow, and expansive ransomware arsenal. Lynx has proven to be a highly organized and efficient cybercriminal operation,…
Russian APT28 Hackers Exploit Zero-Day Vulnerabilities to Target Government and Security Sectors
A detailed analysis from Maverits, a leading cybersecurity firm, reveals a significant evolution in the strategies and objectives of APT28, a cyber-espionage group linked to Russia’s GRU military intelligence unit. Covering activities from 2022 to 2024, the report highlights APT28’s…
Hackers Exploit OAuth 2.0 Code Flow Using AiTM Attack on Microsoft Azure AD
Security enthusiasts and professionals are turning their focus towards a new angle on phishing attacks in the identity and access management space. During the “Offensive Entra ID (Azure AD) and Hybrid AD Security” training, a clever demonstration showcased how a…
New Apple SLAP & FLOP Side-Channel Attacks Let Attackers Steal Login Details From Browser
Researchers from the Georgia Institute of Technology and Ruhr University Bochum have uncovered two novel speculative execution attacks, named SLAP (Speculative Data Attacks via Load Address Prediction) and FLOP (Breaking the Apple M3 CPU via False Load Output Predictions). These…
WhatsApp’s “View Once” Feature Flaw Let Anyone View the Image Unlimitedly
Privacy is the cornerstone of digital communication in today’s world, and platforms like WhatsApp consistently introduce features to enhance user security. One such feature is WhatsApp’s “View Once” option, which ensures that sensitive photos and videos disappear after being viewed…
A Security Loophole in WhatsApp’s “View Once” Mode
Privacy is the cornerstone of digital communication in today’s world, and platforms like WhatsApp consistently introduce features to enhance user security. One such feature is WhatsApp’s “View Once” option, which ensures that sensitive photos and videos disappear after being viewed…
Windows CLFS Buffer Overflow Vulnerability CVE-2024-49138 – PoC Released
A recently disclosed Windows kernel-level vulnerability, identified as CVE-2024-49138, has raised significant security concerns in the cybersecurity community. Leveraging a buffer overflow vulnerability within the Windows Common Log File System (CLFS), researchers have released a proof-of-concept (PoC) exploit, showcasing the critical risks…
Hackers Attacking Windows, macOS, and Linux systems With SparkRAT
Researchers have uncovered new developments in SparkRAT operations, shedding light on its persistent use in malicious campaigns targeting macOS users and government organizations. The findings, detailed in a recent report, underscore the evolving tactics of threat actors leveraging SparkRAT’s modular…
New Aquabot Malware Actively Exploiting Mitel SIP phones injection vulnerability
Akamai’s Security Intelligence and Response Team (SIRT) has uncovered a novel variant of the Mirai-based botnet malware, dubbed Aquabotv3, actively targeting Mitel SIP phones via a critical vulnerability. This marks the third observed iteration of Aquabot, which now showcases unique…
Hellcat Ransomware Attacking Government Organizations & Educational Institutions
A new ransomware gang, Hellcat, emerged on dark web forums in 2024, targeting critical infrastructure, government organizations, educational institutions, and the energy sector. Operating on a ransomware-as-a-service (RaaS) model, Hellcat offers ransomware tools and infrastructure to affiliates in exchange for…
Researchers Jailbreaked DeepSeek R1 to Generate Malicious Scripts
Researchers have successfully jailbroken DeepSeek R1, a cutting-edge reasoning model originating from China. Dubbed a potential challenger to tech giants like OpenAI, DeepSeek R1 has garnered international attention for its impressive problem-solving abilities in mathematics, logic, and coding. However, the…
Google Researchers Breakdowns Scatterbrain Behind PoisonPlug Malware
Google’s Threat Intelligence Group (GTIG) in collaboration with Mandiant has revealed critical insights into ScatterBrain, a sophisticated obfuscation tool utilized by China-nexus cyber espionage groups, specifically APT41, to deploy the advanced backdoor family POISONPLUG.SHADOW. This analysis underscores the significant evolution…
Zyxel CPE Zero-Day (CVE-2024-40891) Exploited in the Wild
Security researchers have raised alarms about active exploitation attempts targeting a newly discovered zero-day command injection vulnerability in Zyxel CPE Series devices, tracked as CVE-2024-40891. This critical vulnerability, which remains unpatched and undisclosed by the vendor, has left over 1,500 devices…
FleshStealer: A new Infostealer Attacking Chrome & Mozilla Users
A newly identified strain of information-stealing malware, FleshStealer, is making headlines in 2025 due to its advanced evasion techniques and targeted data extraction capabilities. Flashpoint analysts have shed light on its operation, revealing a sophisticated tool that poses significant risk…
Windows 11 24H2 Update Bug: Users Report Disruptions in Web Camera and USB Devices
Windows 11 KB5050009 for version 24H2 has sparked widespread frustrations among users due to a slew of compatibility and functionality issues. Reports indicate that the update, which aims to introduce improvements and security fixes, has instead caused disruptions in Bluetooth…
Vulnerability in Airline Integration Service enables A Hacker to Gain Entry To User Accounts
A recent security vulnerability in a widely used airline integration service has exposed millions of users to account takeovers, raising concerns over the safety of online travel services. Security researchers from Salt Labs discovered the flaw, which enabled hackers to…
TP-Link Router Web Interface XSS Vulnerability – PoC Exploit Released
A recently discovered Cross-site Scripting (XSS) vulnerability, CVE-2024-57514, affecting the TP-Link Archer A20 v3 Router has raised security concerns among users. The flaw CVE-2024-57514, identified in firmware version 1.0.6 Build 20231011 rel.85717(5553), allows attackers to execute arbitrary JavaScript code through the…
PoC Exploit Released for Critical Cacti Vulnerability Let Attackers Code Remotely
A critical vulnerability in the Cacti performance monitoring framework, tracked as CVE-2025-22604, has been disclosed, with a proof-of-concept (PoC) exploit now publicly available. This vulnerability allows authenticated users with device management permissions to execute arbitrary code on the server by…
Hackers Seize Control of 3,000 Companies Through Critical Vulnerabilities
In a groundbreaking cybersecurity investigation, researchers identified several critical vulnerabilities in a target system, eventually gaining control over 3,000 subsidiary companies managed by a parent organization. The exploration leveraged flaws in API configurations, bypassed key security protocols, and exposed sensitive…
Hackers Could Bypassing EDR Using Windows Symbolic Links to Disable Service Executables
A groundbreaking technique for exploiting Windows systems has emerged, combining the “Bring Your Own Vulnerable Driver” (BYOVD) approach with the manipulation of symbolic links. Security researchers have uncovered how this method can bypass Endpoint Detection and Response (EDR) mechanisms and…
TorNet Backdoor Exploits Windows Scheduled Tasks to Deploy Malware
Cisco Talos researchers have identified an ongoing cyber campaign, active since mid-2024, deploying a previously undocumented backdoor known as “TorNet.” This operation, believed to be orchestrated by a financially motivated threat actor, predominantly targets users in Poland and Germany through…
Microsoft Unveils Phishing Attack Protection for Teams Chat
Microsoft has taken a significant step toward enhancing cybersecurity by introducing a new phishing attack protection feature for Microsoft Teams. The feature aims to safeguard users from brand impersonation in chats initiated by external domains, a common tactic used by…
Apple Security Update – Patch for iOS Zero-day, MacOS & More
Apple has responded to a newly discovered zero-day vulnerability affecting its operating systems by releasing an array of security updates to protect users from potential exploitation. The updates span iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari, demonstrating Apple’s commitment…
New Phishing Scam Targets Amazon Prime Membership to Steal Credit Card Data
A recent investigation has uncovered a sophisticated phishing campaign leveraging malicious PDF files to redirect unsuspecting users to fake Amazon-branded phishing websites. Researchers from Unit 42 reported that this campaign utilizes PDFs containing embedded links as an initial lure to…
Hackers Use Hidden Text Salting to Bypass Spam Filters and Evade Detection
In the latter half of 2024, Cisco Talos identified a significant increase in email threats leveraging “hidden text salting,” also referred to as HTML poisoning. This deceptive yet effective technique enables cybercriminals to bypass email parsers, confuse spam filters, and…
New Hacker Group Using 7z & UltraVNC Tool to Deploy Malware Evading Detection
A sophisticated cyber campaign targeting Russian-speaking entities has been identified by cybersecurity researchers, unveiling a deceptive operation imitating the Tactics, Techniques, and Procedures (TTPs) of the Gamaredon APT group. The attackers believed to be part of the GamaCopy group, exploited…
Hackers Mimic USPS To Deliver Malicious PDF In Attack Targeted Mobile Devices
In a detailed analysis published on January 27, 2025, Zimperium’s zLabs team uncovered a sophisticated phishing campaign targeting mobile devices through malicious PDF files. Disguised as communications from the United States Postal Service (USPS), this campaign employs advanced social engineering…
Stratoshark – A New Wireshark Tool Released for Cloud
The masterminds behind the revolutionary network analyzer Wireshark have unveiled a new tool, Stratoshark, designed to bring their proven methodology to system call analysis. Marking over 25 years since Wireshark’s inception, this latest development continues the legacy of democratizing complex…
Fortinet Authentication Vulnerability Exploited to Gain Super-Admin Access
A critical authentication vulnerability in Fortinet’s FortiGate SSL VPN appliance tracked as CVE-2024-55591, has been weaponized in active attacks. Threat actors have exploited this vulnerability to gain super-admin privileges, bypassing the authentication mechanism, and compromising devices globally. Cybersecurity experts warn organizations using…
Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows
A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through 9.7.0. The issue, classified as a Relative Path Traversal vulnerability, exposes Solr instances running on Windows to potential risks of arbitrary file path manipulation and write-access.…
Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft
IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory Integrator and IBM Security Verify Directory Integrator products. The vulnerabilities, identified through the Common Vulnerabilities and Exposures (CVE) system, expose users to various risks, including sensitive…
White House Considers Oracle-Led Takeover of TikTok with U.S. Investors
In a significant development, the Trump administration is reportedly formulating a plan to prevent a nationwide ban on TikTok, involving Oracle and a consortium of private investors. Under the proposed arrangement, ByteDance, TikTok’s Chinese parent company, would retain a minority…
Critical Isolation Vulnerability in Intel Trust Domain Extensions Exposes Sensitive Data
Researchers from IIT Kharagpur and Intel Corporation have identified a significant security vulnerability in Intel Trust Domain Extensions (TDX), a foundational technology designed to ensure robust isolation between virtual machines (VMs) in secure environments. The study reveals that hardware performance…
GitHub Vulnerability Exposes User Credentials via Malicious Repositories
A cybersecurity researcher recently disclosed several critical vulnerabilities affecting Git-related projects, revealing how improper handling of credential protocols can lead to sensitive data leaks. From GitHub Desktop to Git Credential Manager and Git LFS, these issues were uncovered during a…
Burp Suite 2025.1 Released, What’s New!
Burp Suite 2025.1, is packed with new features and enhancements designed to improve your web application testing workflow. This latest version brings exciting upgrades like auto-pausing Burp Intruder attacks based on response content, exporting Collaborator interactions to CSV, highlighting Content-Length…
New Phishing Framework Attack Multiple Brands Login Pages To Steal Credentials
Researchers have identified a sophisticated phishing tactic leveraging Cloudflare’s workers.dev, a free domain name service, to execute credential theft campaigns. The modus operandi involves a generic phishing page that can impersonate any brand, with significant technical ingenuity aimed at deceiving…
Chrome Security Update – Patch for 3 High-Severity Vulnerabilities
Google has released a critical update for the Chrome browser, addressing three high-severity security vulnerabilities. This patch, part of the latest Stable channel release, ensures users remain protected from potential threats. The new version rolled out progressively, underscores Chrome’s commitment…
Apache Solr For Windows instances Vulnerability Allows Arbitrary Path Write-Access
A critical security vulnerability (CVE-2024-52012) affecting Apache Solr instances on Windows has been identified, allowing attackers to gain arbitrary file path write access using the “configset upload” API. The flaw, categorized as a relative path traversal vulnerability, poses a moderate…
LockBit Ransomware: 11-Day Timeline from Initial Compromise to Deployment
A well-coordinated cyber intrusion, spanning 11 days, culminated in the deployment of LockBit ransomware across a corporate environment. The attack, which began with the execution of a malicious file posing as a Windows Media Configuration Utility, displayed a sophisticated playbook…
Weaponised XWorm RAT Builder Attacking Script Kiddies To Hack 18,000 Devices
A recent cybersecurity attack involving a Trojanized version of the XWorm Remote Access Trojan (RAT) builder has compromised over 18,000 devices worldwide. This sophisticated malware, primarily distributed via GitHub repositories, Telegram channels, and other platforms, has targeted cybersecurity novices, also…
New SCAVY Framework to Detect Memory Corruption Privilege Escalation in Linux Kernel
A breakthrough framework named SCAVY has been introduced to proactively detect memory corruption targets that could potentially lead to privilege escalation in the Linux kernel. Presented at the prestigious USENIX Security Symposium in August 2024, the framework aims to address long-standing gaps…
Researchers Exploited Windows Charset Conversion Feature to Execute Remote Code
Researchers have exposed a systemic vulnerability within the Windows operating system, leveraging its “Best-Fit” charset conversion feature to bypass security checks and execute remote code. The findings highlight widespread implications across various applications, with real-world exploitation scenarios impacting widely used…
GitLab Security Update – Patch for Multiple Vulnerabilities
GitLab, the widely adopted DevOps platform, has announced the immediate release of versions 17.8.1, 17.7.3, and 17.6.4 for both its Community Edition (CE) and Enterprise Edition (EE). These updates address multiple security vulnerabilities and provide critical fixes, underscoring GitLab’s commitment to maintaining…
Critical Vulnerability in Meta Llama Framework Let Remote Attackers Execute Arbitrary Code
The Oligo Research team has disclosed a critical vulnerability in Meta’s widely used Llama-stack framework. This vulnerability, tracked as CVE-2024-50050, allows remote attackers to execute arbitrary code on servers running the Llama-stack framework. Due to its potential impact, the flaw has…
Subaru’s STARLINK Connected Car’s Vulnerability Let Attackers Gain Restricted Access
In a groundbreaking discovery on November 20, 2024, cybersecurity researchers Shubham Shah and a colleague unearthed a major security vulnerability in Subaru’s STARLINK connected vehicle service. The flaw allowed unauthorized, unrestricted access to vehicles and customer accounts across the United…
Android Kiosk Tablets Vulnerability Let Attackers Control AC & Lights
A security flaw found in Android-based kiosk tablets at luxury hotels has exposed a grave vulnerability, potentially allowing attackers to control air conditioning, lighting, and other room functions remotely. The investigation, highlighted by security researchers at LAC Co., Ltd., reveals…
Android Kisok Tablets Vulnerability Let Attackers Control AC & Lights
A startling security flaw found in Android-based kiosk tablets at luxury hotels has exposed a grave vulnerability, potentially allowing attackers to control air conditioning, lighting, and other room functions remotely. The investigation, highlighted by security researchers at LAC Co., Ltd.,…
CISA Releases Six ICS Advisories Details Security Issues
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued six Industrial Control Systems (ICS) advisories addressing vulnerabilities in a range of critical systems. These advisories aim to inform organizations about risks that could lead to unauthorized access, system compromise, or…
PayPal Fined $2 Million Fine For Violating Cybersecurity Regulations
The New York State Department of Financial Services (NYDFS) has imposed a $2 million penalty on PayPal, Inc. for breaches of the state’s stringent cybersecurity regulations. The fine marks a significant move in ensuring accountability for financial institutions handling sensitive…
KEYPLUG Infrastructure Exposed: Server Configurations and TLS Certificates Revealed
In a recent technical investigation, researchers uncovered critical insights into the infrastructure linked to a suspected Chinese state-backed cyber actor referred to as “RedGolf.” The group, also known as APT41, BARIUM, or Earth Baku, gained attention following a report by…
Beware of Fake Captcha Verifications Spreading Lumma Malware
In January, Netskope Threat Labs uncovered a sophisticated global malware campaign leveraging fake CAPTCHA pages to deliver the Lumma Stealer malware. Lumma, a malware-as-a-service (MaaS) tool that has been active since at least 2022, is designed to steal sensitive information…
Juniper Routers Exploited via Magic Packet Vulnerability to Deploy Custom Backdoor
A sophisticated cyber campaign dubbed “J-magic” has been discovered targeting enterprise-grade Juniper routers with a backdoor attack that leverages a passive monitoring agent. The operation, first detected in September 2023, employs a variant of the cd00r backdoor that continuously scans…
Salt Typhoon Hacked Nine U.S. Telecoms, Tactics and Techniques Revealed
Salt Typhoon, a state-sponsored Advanced Persistent Threat (APT) group linked to the People’s Republic of China (PRC), has executed one of the most sophisticated cyber-espionage campaigns in recent history. The group targeted at least nine U.S.-based telecommunications companies throughout 2024,…
HellCat and Morpheus Ransomware Share Identical Payloads for Attacks
The cybersecurity landscape witnessed a surge in ransomware activity during the latter half of 2024 and into early 2025, with the emergence of operations like HellCat and Morpheus. Alongside their rise, notable groups such as FunkSec, Nitrogen, and Termite gained…
370+ Ivanti Connect Secure Exploited Using 0-Day Vulnerability
A major cybersecurity incident has come to light, with more than 370 Ivanti Connect Secure (ICS) devices reportedly compromised through the exploitation of a zero-day vulnerability, CVE-2025-0282. This alarming development, revealed by the shadowserver.org security analysts, highlights escalating risks tied…
BASHE Ransomware Allegedly Leaked ICICI Bank Customers Data
A major cyber threat looms over Indian financial giant ICICI Bank as the notorious BASHE ransomware group, also known as Eraleign (APT73), claims responsibility for a significant data breach. The group has allegedly obtained sensitive customer information and set a…
North Korean IT Workers Steal Companies Source Codes to Demand Ransomware
The Federal Bureau of Investigation (FBI) has issued fresh warnings about malicious activities by North Korean IT workers targeting U.S.-based businesses. According to the latest update, these IT workers are reportedly engaging in data extortion and stealing sensitive proprietary information,…
Zero-Click Outlook RCE Vulnerability (CVE-2025-21298), PoC Released
Microsoft issued a critical patch to address CVE-2025-21298, a zero-click Remote Code Execution (RCE) vulnerability in Windows Object Linking and Embedding (OLE). This flaw exploits a double-free bug in the ole32.dll library, putting millions of systems at risk with minimal…
Critical Vulnerability in Next.js Framework Exposes Websites to Cache Poisoning and XSS Attacks
A new report has put the spotlight on potential security vulnerabilities within the popular open-source framework Next.js, demonstrating how improper caching mechanisms can lead to critical server-side cache poisoning attacks. Developed by Vercel, Next.js remains a cornerstone for building server-rendered…
New Cookie Sandwich Technique Allows Stealing of HttpOnly Cookies
The “Cookie Sandwich Attack” showcases a sophisticated way of exploiting inconsistencies in cookie parsing by web servers. This technique allows attackers to manipulate HTTP cookie headers to expose sensitive session cookies, including those marked with the HttpOnly flag, making it…
Nnice Ransomware Attacking Windows Systems With Advanced Encryption Techniques
CYFIRMA’s Research and Advisory team has identified a new strain of ransomware labeled “Nnice,” following the continuous monitoring of underground forums as part of its Threat Discovery Process. This ransomware specifically targets Windows systems, utilizing advanced encryption methods and employing…
Tycoon 2FA Phishing Kit Using Specially Crafted Code to Evade Detection
The rapid evolution of Phishing-as-a-Service (PhaaS) platforms is reshaping the threat landscape, enabling attackers to launch increasingly sophisticated phishing campaigns. One such advanced PhaaS platform, Tycoon, has seen widespread use since its emergence in August 2023. In November 2024, it…
GhostGPT – Jailbreaked ChatGPT that Creates Malware & Exploits
Artificial intelligence (AI) tools have revolutionized how we approach everyday tasks, but they also come with a dark side. Cybercriminals are increasingly exploiting AI for malicious purposes, as evidenced by the emergence of uncensored chatbots like WormGPT, WolfGPT, and EscapeGPT.…
Microsoft Unveils New Identity Secure Score Recommendations in General Availability
Microsoft has announced the general availability of 11 new Identity Secure Score recommendations in Microsoft Entra, aimed at bolstering organizational security and providing actionable insights to mitigate risks. The Identity Secure Score recommendations are designed to act as a trusted…
Hackers Deliver Ransomware on Windows Via Microsoft Teams Voice Calls
Sophos X-Ops’ Managed Detection and Response (MDR) team has uncovered two highly active threat actor clusters exploiting Microsoft Office 365 to target organizations. Identified as STAC5143 and STAC5777, these clusters use advanced social engineering tactics, such as email bombing, fake…
SonicWall Arbitrary OS Commands Execution Vulnerability Exploited in Attacks
A critical vulnerability in SonicWall’s SMA1000 series tracked as CVE-2025-23006, has come under active exploitation by threat actors. SonicWall’s PSIRT (Product Security Incident Response Team) has issued an urgent advisory urging users to update their systems immediately to mitigate risks. Details…
AI Assistant Jailbreaked to Reveal its System Prompts
Anonymous tinkerer claims to have bypassed an AI assistant’s safeguards to uncover its highly confidential system prompt—the underlying instructions shaping its behavior. The breach, achieved through creative manipulation rather than brute force, has sparked conversations about the vulnerabilities and ethical…
Murdoc Botnet Exploiting AVTECH Cameras & Huawei Routers to Gain Complete Control
Researchers have identified an active malware campaign involving a Mirai botnet variant, dubbed Murdoc, which has been targeting AVTECH cameras and Huawei HG532 routers since at least July 2024. Mass Campaign Leveraging Two Key Vulnerabilities The campaign exploits two known…
Open-Source ClamAV Releases Security Update for Buffer Overflow Vulnerability – Patch Now
ClamAV, a widely used open-source antivirus software, has released security patch updates to address a critical buffer overflow vulnerability (CVE-2025-20128). The vulnerability, identified in the OLE2 file parser, posed a potential risk of denial-of-service (DoS) attacks. Users are urged to…
Rails Apps Arbitrary File Write Vulnerability Let Attackers Execute Code Remotely
A newly exposed vulnerability in Ruby on Rails applications allows attackers to achieve Remote Code Execution (RCE) through a flaw that permits arbitrary file writing. This vulnerability, which leverages the Rails library Bootsnap, underscores the critical importance of secure file handling…
New Supply Chain Attack Targeting Chrome Extensions to Inject Malicious Code
A sophisticated supply chain attack targeting Chrome browser extensions has come to light, potentially compromising hundreds of thousands of users. The attack, which unfolded in December 2024, involved phishing campaigns aimed at extension developers and the injection of malicious code…
New Cookie Sandwich Technique Allows Stealing of HttpOnly cookies
A new attack technique known as the “cookie sandwich” has surfaced, raising significant concerns among cybersecurity professionals. This technique enables attackers to bypass the HttpOnly flag and access sensitive cookies, potentially exposing vulnerable applications to data theft and session hijacking.…
WordPress Plugin Vulnerability Exposes 23k+ Websites to Hacking
Researchers from Patchstack have warned that over 23,000 real estate websites using the popular RealHomes WordPress theme and its bundled Easy Real Estate plugin are exposed to critical security vulnerabilities. These vulnerabilities allow unauthenticated attackers to escalate privileges, take over…
Cisco Warns of Meeting Management API Privilege Escalation Vulnerability
Cisco has issued a critical advisory regarding a privilege escalation vulnerability in its Meeting Management REST API. The flaw tracked as CVE-2025-20156, allows a remote, authenticated attacker with low privileges to elevate their access to administrator-level control on affected devices, posing…
The Growing Role of AI-Powered SAST in the Developer Toolkit
In today’s app dev world, where new apps and millions of lines of code are being deployed every day, the need for fast and secure development practices has never been greater. Static Application Security Testing (SAST) plays a big role…
Ex-CIA Analyst Pleaded Guilty For Leaking Top Secret National Defense Information
A former CIA analyst, Asif William Rahman, has pleaded guilty to charges of retaining and transmitting Top Secret National Defense Information to unauthorized recipients. This alarming breach of national security came to light after classified information was publicly posted on…
Record Breaking 5.6 Tbps DDoS attack Launched by Mirai Botnet
The Mirai botnet unleashed a record-breaking Distributed Denial of Service (DDoS) attack on October 29, 2024, peaking at an astonishing 5.6 terabits per second (Tbps). This mega surge of malicious traffic targeted a Cloudflare customer, an Internet Service Provider (ISP)…
Three New ICS Advisories Released by CISA Detailing Vulnerabilities & Mitigations
The Cybersecurity and Infrastructure Security Agency (CISA) announced three new Industrial Control Systems (ICS) advisories. These advisories provide critical insights into vulnerabilities impacting Traffic Alert and Collision Avoidance Systems (TCAS) II, Siemens SIMATIC S7-1200 CPUs, and ZF Roll Stability Support…
IBM i Access Client Solutions Might Be Leaking Your Passwords
A potential security flaw in IBM i Access Client Solutions (ACS) has raised serious concerns about password leakage, leaving users vulnerable to exploitation. Research published yesterday by a vulnerability assessment team revealed that the *WINLOGON authentication feature in IBM ACS…
Security Researchers Discover Critical RCE Vulnerability, Earn $40,000 Bounty
Cybersecurity researchers Abdullah Nawaf and Orwa Atyat, successfully escalated a limited path traversal vulnerability into a full-blown remote code execution (RCE). Their discovery earned a massive $40,000 bounty from the targeted organization’s bug bounty program. The team documented their step-by-step…
Weaponized VS Code Impersonate Zoom App Steals Cookies From Chrome
A newly identified extension for Visual Studio Code (VS Code) has been found to impersonate a legitimate Zoom application, enabling cybercriminals to steal sensitive cookies from Google Chrome. This incident marks a significant escalation in the tactics employed by malicious…
PoC Exploit Released for TP-Link Code Execution Vulnerability(CVE-2024-54887)
A security researcher, exploring reverse engineering and exploit development, has successfully identified a critical vulnerability in the TP-Link TL-WR940N router, specifically affecting hardware versions 3 and 4 with all firmware up to the latest version. This vulnerability, which has been…
Brave Browser Vulnerability Allows Malicious Website Appears as Trusted One
A security vulnerability has been identified in Brave Browser, potentially allowing malicious websites to masquerade as trusted ones during file upload or download operations. The issue, tracked under CVE-2025-23086, affects specific versions of the Brave browser on desktop platforms, creating…
Critical SUSE Linux Distro Injection Vulnerability Allow Attackers Exploits “go-git” Library
A significant security vulnerability, designated CVE-2025-21613, has been discovered in the go-git library, used for Git version control in pure Go applications. This issue affects all versions before 5.13.0 and is characterized by an argument injection vulnerability, enabling potential attackers…