Ubuntu has announced its availability on Microsoft’s new tar-based Windows Subsystem for Linux (WSL) distribution architecture. This enhancement simplifies deployment and improves scalability, making Ubuntu on WSL more accessible and optimized for enterprise environments. Ubuntu has long been a popular…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Cybercriminals Leveraging AI to Verify Stolen Credit Card Data
Cybercriminals are increasingly leveraging artificial intelligence (AI) agents to validate stolen credit card data, posing a significant threat to financial institutions and consumers. These AI-powered systems, originally designed for legitimate automation tasks, are being repurposed to execute card testing attacks…
Malicious Android & iOS Apps Downloaded Over 242,000 Times, Stealing Crypto Recovery Keys
A sophisticated malware campaign, dubbed SparkCat, has infiltrated Google Play and Apple’s App Store, marking the first known instance of an optical character recognition (OCR)-based cryptocurrency stealer on iOS. According to cybersecurity firm Kaspersky, the malware has been downloaded over…
BADBOX Botnet Surges: Over 190,000 Android Devices Infected, Including LED TVs
The BADBOX botnet, a sophisticated malware operation targeting Android-based devices, has now infected over 192,000 systems globally. Originally confined to low-cost and off-brand devices, the malware has expanded its reach to include well-known brands such as Yandex 4K QLED TVs…
Threat Actors Exploiting Free Email Services to Target Government and Educational Institutions
Threat actors are increasingly leveraging free email services to infiltrate government and educational institutions, exploiting these platforms’ accessibility and widespread use. Increasing Sophistication in Cyber Threats Recent investigations reveal that advanced persistent threat (APT) groups, such as GreenSpot, have employed…
Zero-Day Vulnerabilities in Microsoft Sysinternals Tools Enable DLL Injection Attacks on Windows
A significant zero-day vulnerability has been uncovered in Microsoft Sysinternals tools, posing a severe risk to Windows systems. These widely-used utilities, essential for IT administrators and developers, are now susceptible to DLL injection attacks due to flaws in their dynamic…
Hackers Using AI Agents to Validate Stolen Credit Cards
Cybercriminals are increasingly leveraging artificial intelligence (AI) agents to validate stolen credit card data, posing a significant threat to financial institutions and consumers. These AI-powered systems, originally designed for legitimate automation tasks, are being repurposed to execute card testing attacks…
IBM Cloud Pak Security Vulnerabilities Expose Sensitive Data to Attackers
IBM recently disclosed a series of significant security vulnerabilities in its Cloud Pak for Business Automation platform, raising alarms about the potential exposure of sensitive data to malicious actors. The security issues, detailed in an official bulletin published on February…
Apple’s macOS Kernel Vulnerability (CVE-2025-24118) Exposes Users to Privilege Escalation Attacks – PoC Released
A critical privilege escalation vulnerability in Apple’s macOS kernel has been revealed, posing a significant risk to users. The flaw, identified as CVE-2025-24118, affects multiple versions of macOS, iPadOS, and macOS Sequoia. Security researcher Joseph Ravichandran (@0xjprx) from MIT CSAIL brought this issue…
Critical Netgear Vulnerabilities Allow Hackers to Execute Remote Code
Netgear has addressed critical security vulnerabilities in several of its popular router models that could allow hackers to execute remote code without authentication. If not resolved promptly, these vulnerabilities pose a significant risk to affected devices, potentially enabling malicious actors…
CISA Adds Actively Exploited Apache and Microsoft Vulnerabilities to its Database
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities Catalog with several critical security flaws, prompting heightened vigilance among organizations using affected software platforms. Among these newly added vulnerabilities are severe flaws in Apache OFBiz, Microsoft…
Threat Actors Exploiting DeepSeek’s Rise to Fuel Cyber Attacks
Amid the surging popularity of DeepSeek, a cutting-edge AI reasoning model from an emerging Chinese startup, cybercriminals have wasted no time leveraging the widespread attention to launch fraudulent schemes. While the innovative AI tool has captivated global audiences, its meteoric…
Hackers Can Exploit GPU Flaws to Gain Full Control of Your Device
Several critical vulnerabilities affecting Mali Graphics Processing Units (GPUs) have surfaced, allowing hackers to exploit flaws in GPU drivers to gain full control of devices. The vulnerabilities tracked as CVE-2022-22706 and CVE-2021-39793, expose millions of devices to privilege escalation attacks, enabling attackers to…
Chinese Hackers Attacking Linux Devices With New SSH Backdoor
A sophisticated cyber espionage campaign attributed to the Chinese hacking group DaggerFly has been identified, targeting Linux systems through an advanced Secure Shell (SSH) backdoor known as ELF/Sshdinjector.A!tr. This malware, part of a broader attack framework, compromises Linux-based network appliances…
Hackers Exploit ADFS to Bypass MFA and Access Critical Systems
Hackers are targeting organizations using Microsoft’s Active Directory Federation Services (ADFS) to bypass multi-factor authentication (MFA) and infiltrate critical systems. Leveraging phishing techniques, these attackers deceive users with spoofed login pages, harvest credentials, and manipulate ADFS integrations to gain unauthorized…
CISA Releases Nine Security Advisories on ICS Vulnerabilities and Exploits
The Cybersecurity and Infrastructure Security Agency (CISA) has released nine advisories targeting security vulnerabilities in Industrial Control Systems (ICS). These vulnerabilities pose significant risks, including denial of service (DoS), information disclosure, and even remote code execution. Organizations using ICS technologies…
Hackers Exploiting a Six-year-old IIS Vulnerability to Gain Remote Access
In a concerning revelation, cybersecurity firm eSentire’s Threat Response Unit (TRU) has detected active exploitation of a six-year-old vulnerability, CVE-2019-18935, in Progress Telerik UI for ASP.NET AJAX. This flaw, which affects Internet Information Services (IIS) servers, enables malicious actors to…
Veeam Backup Vulnerability Allows Attackers to Execute Arbitrary Code
A critical vulnerability, CVE-2025-23114, has been discovered within the Veeam Updater component that poses a serious risk to organizations utilizing Veeam’s backup solutions. The flaw allows attackers to leverage a Man-in-the-Middle (MitM) attack to inject and execute arbitrary code with…
CISA Releases New Guidelines to Secure Firewalls, Routers, and Internet-Facing Servers
The Cybersecurity and Infrastructure Security Agency (CISA) has unveiled a new set of guidelines to fortify firewalls, routers, internet-facing servers, and other edge devices against cyber threats. This collaborative guidance, supported by leading international cybersecurity organizations, aims to address vulnerabilities…
Android Security Update Fixes Linux Kernel RCE Flaw Allow Read/Write Access
On February 3, 2025, Google published its February Android Security Bulletin, which addresses a total of 47 vulnerabilities affecting Android devices. Among these, a critical flaw in the Linux kernel’s USB Video Class (UVC) driver, tracked as CVE-2024-53104, has been…
1- Click RCE Vulnerability in Voyager PHP Allow Attackers Execute Arbitrary Code
A recently disclosed security vulnerability in the Voyager PHP package, a popular tool for managing Laravel applications, has raised significant concerns regarding the potential for remote code execution (RCE) on affected servers. This vulnerability, identified through ongoing security scans using…
Apache Cassandra Vulnerability Allows Attackers to Gain Access Data Centers
In a recent security advisory, a moderate-severity vulnerability has been identified in Apache Cassandra, potentially allowing unauthorized users to access restricted data centers or IP/CIDR groups. This flaw, designated CVE-2025-24860, affects multiple versions of the database management system, specifically those…
ANY.RUN Enhances Malware Detection and Performance to Combat 2025 Cyber Threats
As cyber threats grow more sophisticated, ANY.RUN has unveiled a series of updates aimed at improving malware detection, analysis, and overall performance of its platform. These updates, implemented in January 2025, focus on optimizing the platform’s core functionality, enhancing detection…
SpyCloud Leads the Way in Comprehensive Identity Threat Protection
SpyCloud, a leading identity threat protection company, has unveiled key innovations in its portfolio, driving a shift towards holistic identity security. By leveraging its vast collection of darknet data and automated identity analytics, SpyCloud correlates malware, phishing, and breach exposures…
Cybercriminals Exploiting HTTP Client Tools to Hijack Microsoft 365 Accounts
A recent report by Proofpoint has revealed an alarming trend of cybercriminals exploiting HTTP client tools to target Microsoft 365 accounts. These tools, originally designed for legitimate use, are now being repurposed for large-scale account takeover (ATO) attacks, employing tactics…
New FUD Malware Targets MacOS, Evading Antivirus and Security Tools
A new strain of Fully Undetectable (FUD) macOS malware, dubbed “Tiny FUD,” has emerged, showcasing sophisticated evasion techniques capable of bypassing antivirus and macOS security frameworks, including Gatekeeper and System Integrity Protection (SIP). The malware employs advanced methods, such as…
Beware of SmartApeSG Campaigns that Deliver NetSupport RAT
SmartApeSG, a FakeUpdate cyber threat, has emerged as a significant vector for delivering NetSupport RAT, a maliciously exploited remote administration tool. The campaign ensnares victims by tricking them into downloading fake browser updates, ultimately enabling attackers to gain unauthorized access…
Amazon Introduces Redshift Security Features to Prevent Data Leaks
Amazon Web Services (AWS) has announced significant updates to its popular data warehousing service, Amazon Redshift, with the introduction of enhanced security features aimed at minimizing data leaks and unauthorized access. These new default settings strengthen the security posture of…
Apple Service Ticket Portal Vulnerability Leaks Sensitive Information
Apple, one of the most trusted technology brands in the world, recently faced a critical security exposure in its service ticket portal. The vulnerability, discovered by a tech enthusiast while submitting a repair request uncovered severe flaws in Apple’s system…
FlexibleFerret Malware Attacking macOS Users, Evading XProtect Detections
A new macOS malware variant, dubbed “FlexibleFerret,” has been identified targeting developers and job seekers as part of an ongoing North Korean phishing campaign. Despite Apple’s recent signature updates to its XProtect malware detection tool, this latest variant demonstrates the…
New Attack Method Bypasses EDR with Low Privileged Access
A new endpoint detection and response (EDR) evasion technique has been identified that allows attackers with low-privilege access to bypass detection and operate under the radar. Unlike traditional evasion methods that require high privileges, this method exploits masquerading to deceive…
Researchers Discover Novel Techniques to Protect AI Models from Universal Jailbreaks
In a significant advancement in AI safety, the Anthropic Safeguards Research Team has introduced a cutting-edge framework called Constitutional Classifiers to defend large language models (LLMs) against universal jailbreaks. This pioneering approach demonstrates heightened resilience to malicious inputs while maintaining…
Beware of Fake DeepSeek PyPI packages that Delivers Malware
The Positive Technologies Expert Security Center (PT ESC) recently uncovered a malicious campaign targeting the Python Package Index (PyPI) repository. The campaign involved two packages, named deepseeek and deepseekai, designed to collect sensitive user data and environment variables. These packages…
ValleyRAT Attacking Org’s Accounting Department with New Delivery Techniques
A concerning uptick in cyberattacks has emerged with ValleyRAT, a Remote Access Trojan (RAT) linked to the Silver Fox advanced persistent threat (APT) group. The malware is now employing innovative delivery techniques to infiltrate organizational networks, targeting finance and accounting…
Linux Kernel 6.14 Officially Released for Testers
Linus Torvalds, the creator of Linux, announced the release of the first release candidate (rc1) for the Linux Kernel 6.14 in an official email on Sunday, February 2, 2025. This marks the end of the merge window for the new…
Canadian National Charged with Stealing $65 Million in Crypto
A Canadian man has been charged with exploiting decentralized finance (DeFi) protocols to steal approximately $65 million from unsuspecting investors. A five-count criminal indictment, unsealed today in a federal court in New York, accuses 22-year-old Andean Medjedovic of targeting vulnerabilities…
Multiple Flaws in Dell PowerProtect Allow System Compromise
Dell has released a Critical Security Update (DSA-2025-022) for its PowerProtect Data Domain (DD) systems to address multiple vulnerabilities that could allow attackers to compromise affected systems. These vulnerabilities, identified in various components and open-source dependencies, highlight the importance of timely patching…
Roundcube XSS Flaw Allows Attackers to Inject Malicious Files
A critical Cross-Site Scripting (XSS) vulnerability has been discovered in the popular open-source webmail client, Roundcube, potentially exposing users to serious security risks. Tracked as CVE-2024-57004, the flaw affects Roundcube Webmail version 1.6.9 and allows remote authenticated users to upload malicious files disguised as…
Hackers Exploit AWS & Microsoft Azure for Large-Scale Cyber Attacks
Silent Push, a cybersecurity research firm, has introduced the term “infrastructure laundering” to describe a sophisticated method used by cybercriminals to exploit legitimate cloud hosting services for illegal purposes. This practice involves renting IP addresses from mainstream providers like Amazon…
New Phishing Attack Hijacks High-Profile X Accounts to Promote Scam Sites
A new wave of phishing attacks has been identified, targeting high-profile accounts on the social media platform X (formerly Twitter). This campaign, analyzed by SentinelLABS, aims to hijack accounts belonging to prominent individuals and organizations, including U.S. political figures, international…
Lazarus Group Exploits Trusted Apps for Data Theft via Dropbox
In an alarming development, North Korea’s infamous Lazarus Group has been linked to a global cyber espionage campaign, code-named Operation Phantom Circuit. Beginning in September 2024, this operation exploited trusted software development tools to infiltrate systems worldwide, targeting cryptocurrency and…
New 0-Day Vulnerability in Arm Mali GPU Kernel Driver Exploited in the Wild
On February 3, 2025, Arm disclosed a vulnerability in the Mali GPU Kernel Driver that allows improper GPU processing operations. This issue affects Valhall GPU Kernel Driver versions ranging from r48p0 to r49p1 and r50p0 to r52p0, as well as…
Coyote Malware Launches Stealthy Attack on Windows Systems via LNK Files
FortiGuard Labs has issued a high-severity alert regarding the Coyote Banking Trojan, a sophisticated malware targeting Microsoft Windows users. Over the past month, researchers have identified malicious LNK files employing PowerShell commands to execute scripts and connect to remote servers,…
CryptoDNA: AI-Powered Cryptojacking Defense Against DDoS Threats in Healthcare IoT
The integration of Internet of Things (IoT) and Internet of Medical (IoM) devices has revolutionized healthcare, enabling real-time monitoring, remote diagnostics, and data-driven decision-making. However, these advancements have also introduced significant cybersecurity vulnerabilities, particularly Distributed Denial-of-Service (DDoS) attacks. These attacks…
Microsoft Introduces AI-Generated Team Avatars for Personalization
Tech giant Microsoft has unveiled a groundbreaking feature for its Microsoft Teams platform: AI-generated avatars designed to revolutionize meeting personalization. This innovative feature allows users to represent themselves in meetings as digital avatars, offering a dynamic alternative to traditional video…
Globe Life Ransomware Attack Exposes Personal and Health Data of 850,000+ Users
Globe Life Inc., a prominent insurance provider, has confirmed a major data breach that exposed the personal and health-related information of over 850,000 users. The company disclosed the incident in a recent filing with the U.S. Securities and Exchange Commission…
Linux 6.14 Released – What’s New
The Linux Kernel 6.14-rc1 (release candidate 1) has been officially announced by Linus Torvalds, marking the conclusion of the merge window. Described as notably “tiny” compared to previous release cycles, this development reflects the impact of the holiday season on…
PyPl Added Project Archival To Stop Attackers to Weaponize Malicious Packages
The Python Package Index (PyPI) has introduced a new feature that allows maintainers to mark projects as archived, signaling that the project is no longer actively maintained or expected to receive updates. This marks a significant step forward in supporting…
NVIDIA GPU Display Drivers Vulnerability Lets Attackers Access Files Remotely
NVIDIA has issued a critical security update to address multiple vulnerabilities in its GPU Display Driver and vGPU software, affecting both Windows and Linux systems. These vulnerabilities, disclosed in January 2025, pose risks such as denial of service (DoS), data…
APT37 Hackers Exploit Group Chats to Deliver Malicious LNK Files
In 2024, South Korea witnessed an alarming surge in Advanced Persistent Threat (APT) attacks, with the state-sponsored APT37 group emerging as a significant threat actor. Leveraging sophisticated techniques, the group targeted individuals and organizations through malicious Hancom Office HWP documents…
INDOHAXSEC Hacker Group Allegedly Breaches Malaysia’s National Tuberculosis Registry
The Indonesian hacker group “INDOHAXSEC” has allegedly breached the National Tuberculosis Registry (NTBR) of Malaysia, managed by the Ministry of Health. The group announced their claim via a post on a hacking forum, stirring fears over the safety of sensitive…
Devil-Traff: Emerging Malicious SMS Platform Powering Phishing Attacks
In the ever-evolving landscape of cybercrime, bulk SMS platforms like Devil-Traff have emerged as powerful tools for phishing campaigns, exploiting trust and compromising security on a massive scale. Employees in organizations today face an increasing volume of communications emails, instant…
ChatGPT’s Deep Research Breakthrough Enables Faster-Than-Human Task Handling
OpenAI has introduced “Deep Research,” a cutting-edge feature within ChatGPT that promises to revolutionize the way people handle complex and time-intensive tasks. Designed to synthesize vast amounts of information from the web in mere minutes, Deep Research aims to outperform…
Parrot 6.3 Release, What’s New
The cybersecurity realm received an exciting update this week with the release of Parrot 6.3, the latest version of the Parrot Security operating system. As one of the most trusted Linux distributions tailored for ethical hackers, penetration testers, and security researchers,…
Alibaba Cloud Storage Flaw Exposes Data to Unauthorized Uploads
A significant vulnerability has been discovered in the Alibaba Cloud Object Storage Service (OSS) that allows unauthorized users to upload data, posing critical security risks for organizations relying on this cloud solution. The vulnerability, caused by the misconfiguration of the…
BeyondTrust Zero-Day Breach – 17 SaaS Customers API Key Compromised
BeyondTrust, a leading provider of identity and access management solutions, disclosed a zero-day breach impacting 17 Remote Support SaaS customers. The incident, detected on December 5, 2024, has been linked to the compromise of an infrastructure API key used to…
Microsoft Advertisers Account Hacked Using Malicious Google Ads
Cybersecurity experts have uncovered a sophisticated phishing campaign targeting Microsoft advertising accounts. The attack, orchestrated through malicious Google Ads, aims to steal login credentials of users accessing Microsoft’s advertising platform. This incident highlights the growing risk of malvertising, where cybercriminals…
Cybercriminals Exploit GitHub Infrastructure to Distribute Lumma Stealer
In a recent investigation, Trend Micro’s Managed XDR team identified a sophisticated malware campaign exploiting GitHub’s release infrastructure to distribute Lumma Stealer, along with SectopRAT, Vidar, and Cobeacon malware. This campaign underscores the evolving tactics of attackers leveraging trusted platforms…
Google Blocks 2.28 Million Malicious Apps from Play Store in Security Crackdown
In a continued commitment to enhancing user safety and trust, Google has outlined significant strides made in 2023 to mitigate malicious activities across the Android ecosystem. Guided by the SAFE principles Safeguard Users, Advocate for Developer Protection, Foster Responsible Innovation,…
Researchers Launch Open-Source UEFI Memory Forensics Framework to Counter Advanced Bootkits
A team of researchers from Ben Gurion University of the Negev has pioneered a novel memory forensics framework for analyzing Unified Extensible Firmware Interface (UEFI) memory during the pre-operating system (pre-OS) phase. Their study, published on January 28, 2025, introduces…
New ‘SHIELD’ Platform Leverages FPGA and Off-Host Monitoring to Tackle Advanced Ransomware Threats
In a significant advancement against increasingly sophisticated ransomware threats, researchers from NYU Tandon School of Engineering have introduced SHIELD (Secure Host-Independent Extensible Logging), an innovative detection architecture. This system leverages hardware-level, tamper-proof metrics for real-time ransomware identification. By operating independently…
Windows COM Object Vulnerability Enables Remote Code Execution for System Takeover
A critical bug class termed “trapped object” has been identified by Google’s Project Zero team. This vulnerability primarily arises from improper use of object-oriented remoting technologies like DCOM and .NET Remoting, which facilitate cross-process and cross-security boundary services. These systems,…
DeepSeek’s Evolving Tactics Amplify the Fraud and Phishing Threat
The rapid growth of Chinese artificial intelligence firm DeepSeek is drawing attention not just for its technological advancements but also for an alarming increase in cyber threats capitalizing on its success. Cyble Research and Intelligence Labs (CRIL) has uncovered multiple…
GitHub Copilot Vulnerability Exploited to Train Malicious AI Models
GitHub Copilot, the popular AI-powered code-completion tool, has come under scrutiny after Apex Security’s research unveiled two major vulnerabilities. The findings highlight weaknesses in AI safeguards, including an “affirmation jailbreak” that destabilizes ethical boundaries and a loophole in proxy settings,…
Coyote Banking Malware: Abusing Windows LNK Files to Deploy Malicious Scripts
A sophisticated cyberattack campaign involving the Coyote Banking Trojan has been discovered by FortiGuard Labs, with Microsoft Windows users, particularly in Brazil, as its primary targets. The attack utilizes malicious LNK (shortcut) files embedded with PowerShell commands to execute staged…
CRLF Injection Vulnerabilities Identified in Popular .NET Libraries RestSharp and Refit
Security researchers have uncovered critical CRLF (Carriage Return Line Feed) injection vulnerabilities in two widely used .NET libraries, RestSharp and Refit. These flaws, which allow attackers to manipulate HTTP headers and potentially execute HTTP request splitting, have been assigned CVE-2024-45302 for RestSharp and…
New York Blood Center Targeted by Ransomware, IT Operations Impacted
New York Blood Center Enterprises (NYBC), one of the nation’s largest blood donation and research organizations, has fallen victim to a ransomware attack, severely disrupting its IT systems. The incident, which was detected on Sunday, January 26, has triggered swift…
Authorities Seized 39 Websites that Selling Hacking Tools to Launch Cyber Attacks
Authorities have seized 39 websites allegedly used to sell hacking tools and fraud-enabling software. The crackdown targeted a Pakistan-based network of online marketplaces operated by a group known as Saim Raza (aka HeartSender), which allegedly facilitated cyberattacks on individuals and businesses worldwide. The…
Yeti Forensic Platform Vulnerability Allows Attackers to Execute Remote Code
A critical security flaw has been identified in the popular Yeti Forensic Intelligence platform, exposing its users to unauthenticated remote code execution (RCE) attacks. Two vulnerabilities designated CVE-2024-46507 and CVE-2024-46508, affect versions 2.0 to 2.1.11 of the Yeti platform, posing significant risks…
Cisco Webex Chat Vulnerabilities Expose Organization Chat Histories to Attackers
A major cybersecurity vulnerability in Cisco Webex Chat (previously known as IMI Chat) has raised alarming concerns after it was revealed that unauthenticated attackers could access the chat histories of organizations using the platform. First identified in July 2024, the…
VMware Aria Operations Vulnerabilities Allow Attackers to Perform Admin-Level Actions
VMware has released a critical security advisory, VMSA-2025-0003, addressing multiple vulnerabilities in VMware Aria Operations for Logs, VMware Aria Operations, and VMware Cloud Foundation. These vulnerabilities—tracked as CVE-2025-22218, CVE-2025-22219, CVE-2025-22220, CVE-2025-22221, and CVE-2025-22222—can be exploited to perform admin-level actions, putting affected systems at serious risk. Rated…
Jailbreaking DeepSeek: Researchers Reveal Three New Methods to Override LLM Safety
Researchers at Palo Alto Networks’ Unit 42 have revealed a troubling surge in large language model (LLM) security risks, citing three newly identified jailbreak techniques “Bad Likert Judge,” “Crescendo,” and “Deceptive Delight” capable of bypassing safety protocols in DeepSeek’s open-source…
Malware Discovered in Healthcare Patient Monitors, Traced to Chinese IP Address
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical advisory regarding multiple vulnerabilities identified in Contec Health’s CMS8000 Patient Monitor. These flaws pose significant security risks, potentially allowing remote attacks, privacy breaches, and unauthorized data access. The vulnerabilities,…
Critical D-Link Router Flaw Allows Attackers to Take Full Remote Control
A critical unauthenticated Remote Code Execution (RCE) vulnerability has been identified in D-Link’s DSL-3788 routers, specifically hardware revisions Ax/Bx running firmware version v1.01R1B036_EU_EN or below. This flaw enables attackers to gain full remote access to the device, posing significant security…
Microsoft Enhances M365 Bounty Program with New Services & Rewards Up to $27,000
Microsoft has announced updates to its Microsoft 365 (M365) Bug Bounty Program, offering expanded services, clearer guidelines, and bounty rewards ranging from $500 to a significant $27,000. The initiative reflects Microsoft’s ongoing commitment to cybersecurity and enlisting global security researchers…
Massive Hacking Forum Network Dismantled by Authorities, Impacting 10M Users
Authorities have delivered a major blow to the cybercrime world by dismantling two of the largest hacking forums globally—Cracked.io and Nulled.to—bringing down platforms that catered to over 10 million users. This Europol-supported operation, dubbed “Operation Talent“, was spearheaded by German authorities…
Tata Technologies Hit by Ransomware Attack, Some IT Services Suspended
Tata Technologies, a leading provider of engineering and IT services, has reported a ransomware attack on its IT infrastructure. The company disclosed the incident through an official communication to stock exchanges, including the Bombay Stock Exchange (BSE) and the National…
New Android Malware Exploiting Wedding Invitations to Steal Victims WhatsApp Messages
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed “Tria Stealer,” which exploits fake wedding invitations to lure users into installing malicious apps (APK files). Malware Campaign Overview The campaign primarily targets users in Malaysia and…
Hackers Exploiting DNS Poisoning to Compromise Active Directory Environments
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed by cybersecurity researchers. Introduced by James Forshaw and further developed using the Responder and krbrelayx tools, this approach exploits local name resolution protocols like LLMNR…
Doppler Announces Integration with Datadog to Streamline Security and Monitoring
Doppler, the leading provider of secrets management solutions, announced a new integration with Datadog, a cloud application monitoring and security platform. This collaboration provides engineering and operations teams with an integrated solution for securely managing sensitive credentials and gaining insights…
Cybercriminals Exploit Public-Facing IIS, Apache, and SQL Servers to Breach Gov & Telecom Systems
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored cyberespionage operation, tracked as CL-STA-0048. The campaign targeted high-value organizations in South Asia, particularly a telecommunications company. Employing rare tactics and tools, the attackers leveraged…
Hackers Impersonate Top Tax Firm with 40,000 Phishing Messages to Steal Credentials
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed to exploit tax filing season. These operations, targeting countries such as the UK, US, Switzerland, and Australia, leverage tax-related themes to dupe victims into divulging…
Arcus Media Ransomware Strikes: Files Locked, Backups Erased, and Remote Access Disabled
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated threat. This Ransomware-as-a-Service (RaaS) operation, first observed in May 2024, has rapidly evolved, executing coordinated attacks that disrupt critical processes, encrypt data, and hinder recovery…
500 Million Proton VPN & Pass Users at Risk Due to Memory Protection Vulnerability
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass, is facing scrutiny after the discovery of severe memory protection vulnerabilities in its products. Despite having established itself as a trusted name for safeguarding user…
Microsoft Enhances Windows 11 Security with Admin Protection to Prevent Crowdstrike-Like Incident
Microsoft has introduced “Administrator Protection” (AP), a sophisticated security feature aimed at elevating Windows operating system security by redefining how administrative privileges are managed and reducing the risk of privilege escalation attacks. Detailed in its latest technical blog post, this…
CISA Releases Seven ICS Advisories to Strengthen Cybersecurity Posture
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued seven Industrial Control Systems (ICS) advisories, highlighting critical vulnerabilities in systems vital to industrial and operational processes. These advisories aim to enhance awareness and encourage mitigation strategies to maintain the…
Lazarus Group Drop Malicious NPM Packages in Developers Systems Remotely
In a recent discovery by Socket researchers, a malicious npm package named postcss-optimizer has been identified as an operation spearheaded by the North Korean state-sponsored group, Lazarus Advanced Persistent Threat (APT). Tied to past campaigns and employing code-level similarities, the…
TeamViewer Clients Vulnerability Leads to Privilege Escalation
TeamViewer, a widely used remote access software, has announced a critical vulnerability in its Windows clients. The company disclosed on January 28, 2025, that its software is affected by a security flaw that could allow local attackers to escalate privileges.…
Lazarus Hackers Tamper with Software Packages to Gain Backdoor Access to the Victims Device
A recent investigation conducted by STRIKE, a division of SecurityScorecard, has unveiled the intricate and far-reaching operation of the Lazarus Group, a North Korean advanced persistent threat (APT) group. Dubbed “Operation Phantom Circuit,” the campaign highlights a deliberate and sophisticated…
Tria Stealer Malware Exploits Android Devices to Harvest SMS Data
Cybersecurity researchers have uncovered a sophisticated Android malware campaign known as “Tria Stealer,” which is targeting users in Malaysia and Brunei to collect sensitive information such as SMS data, call logs, WhatsApp messages, and emails. The malware campaign, which has…
Hackers Sell Compromised Emails and Google Ads Accounts on Dark Web
A new wave of cybercrime is surfacing as hackers exploit compromised emails and digital advertising platforms to create a thriving underground economy. This illegal marketplace, primarily hosted on the dark web, trades in aged and pre-verified accounts, offering tech-savvy criminals…
Cybercriminals Hijack Government Sites to Lauch Phishing Attacks
Cybersecurity researchers have identified a persistent trend in which threat actors exploit vulnerabilities in government websites to further phishing campaigns. Based on data spanning November 2022 through November 2024, malicious actors have misused numerous .gov top-level domains (TLDs) across more…
10,000 WordPress Websites Hacked to Distributing MacOS and Microsoft Malware
Over 10,000 WordPress websites have been hijacked to deliver malicious software targeting both macOS and Windows users. Researchers revealed this week how attackers leveraged vulnerabilities in outdated WordPress software and plugins to distribute malware via fake browser update pages presented…
New RDP Exploit Allows Attackers to Take Over Windows and Browser Sessions
Cybersecurity experts have uncovered a new exploit leveraging the widely used Remote Desktop Protocol (RDP). This vulnerability enables attackers to gain unauthorized control over Windows systems and hijack browser activity, posing a significant threat to individual and enterprise data security.…
DeepSeek Database Publicly Exposed Sensitive Information, Secret Keys & Logs
Experts at Wiz Research have identified a publicly exposed ClickHouse database belonging to DeepSeek, a Chinese AI startup renowned for its innovative models. The vulnerability granted full control over database operations, exposing sensitive information such as chat history, secret keys,…
New SMS-Based Phishing Tool ‘DevilTraff’ Enables Mass Cyber Attacks
Cybersecurity experts are sounding the alarm about a new SMS-based phishing tool, Devil-Traff, that is enabling large-scale cyberattacks worldwide. By exploiting trust and leveraging advanced automation, this malicious platform empowers attackers to conduct high-volume phishing campaigns with devastating results. How…
OPNsense 25.1 Released, What’s New!
The highly anticipated release of OPNsense 25.1 has officially arrived! Nicknamed “Ultimate Unicorn,” this update marks a significant milestone for the open-source firewall platform, celebrating its decade-long journey of innovation, security, and reliable performance. Packed with exciting features, new integrations,…
DeepSeek is Now Available With Microsoft Azure AI Foundry
Microsoft has officially added DeepSeek R1, an advanced AI model, to its Azure AI Foundry and GitHub Model Catalog. This move places DeepSeek R1 among a curated selection of over 1,800 AI models, spanning open-source, task-specific, and industry-focused solutions. Businesses…
Lynx Ransomware Architecture to Attack Windows, Linux, ESXi Uncovered
The emergence of the Lynx Ransomware-as-a-Service (RaaS) platform has drawn significant attention in cybersecurity circles, owing to its advanced technical capabilities, structured affiliate workflow, and expansive ransomware arsenal. Lynx has proven to be a highly organized and efficient cybercriminal operation,…
Russian APT28 Hackers Exploit Zero-Day Vulnerabilities to Target Government and Security Sectors
A detailed analysis from Maverits, a leading cybersecurity firm, reveals a significant evolution in the strategies and objectives of APT28, a cyber-espionage group linked to Russia’s GRU military intelligence unit. Covering activities from 2022 to 2024, the report highlights APT28’s…