A novel social engineering technique called “FileFix” that exploits Windows File Explorer’s address bar functionality to execute malicious commands, presenting a dangerous alternative to the increasingly popular ClickFix attack method. The technique, discovered by security researcher mr.d0x, leverages browser file…
Tag: Cyber Security News
Threat Actors Abuse ConnectWise Configuration to Build a Signed Malware
A sophisticated malware campaign has emerged that exploits legitimate ConnectWise remote access software to create validly signed malicious applications, representing a significant evolution in cybercriminal tactics. Since March 2025, security researchers have observed a dramatic increase in attacks using what…
Google Cloud Donates A2A Protocol to Linux Foundation Enables Secure, Intelligent Communication
Google Cloud has transferred its groundbreaking Agent2Agent (A2A) protocol to the Linux Foundation, marking a pivotal moment in artificial intelligence interoperability. The announcement, made at Open Source Summit North America on June 23, 2025, establishes a new collaborative framework for…
Zimbra Classic Web Client Vulnerability Let Attackers Execute Arbitrary JavaScript
A critical security vulnerability has been discovered in Zimbra Classic Web Client that enables attackers to execute arbitrary JavaScript code through stored cross-site scripting (XSS) attacks. The vulnerability, designated as CVE-2025-27915, poses significant risks to organizations using affected Zimbra installations,…
Facebook, Netflix, Microsoft Hijacked to Insert Fake Phone Number
A sophisticated scam operation targeting major American companies, including Netflix, Microsoft, and Bank of America, where attackers manipulate legitimate websites to display fraudulent phone numbers. The attack, technically classified as a search parameter injection attack, exploits vulnerabilities in website search…
2,000+ Devices Hacked Using Weaponized Social Security Statement Themes
A sophisticated phishing campaign masquerading as official Social Security Administration (SSA) communications has successfully compromised more than 2,000 devices, according to a recent investigation. The attack, which leverages the trust associated with government correspondence, represents a concerning evolution in social…
Critical Convoy Vulnerability Let Attackers Execute Remote Code on Affected Servers
A critical security vulnerability has been discovered in Performave Convoy that allows unauthenticated remote attackers to execute arbitrary code on affected servers. The vulnerability, identified as CVE-2025-52562, affects all versions from 3.9.0-rc.3 through 4.4.0 of the ConvoyPanel/panel package. Security researcher…
Xiaomi’s Interoperability App Vulnerability Let Hackers Gain Unauthorized Access to the Victim’s Device
A severe security vulnerability has been discovered in Xiaomi’s interoperability application, potentially exposing millions of users to unauthorized device access. The vulnerability, assigned CVE-2024-45347, carries a severe CVSS score of 9.6, indicating its high-risk nature for affected users. Attackers can…
OPPO Clone Phone Weak WiFi Hotspot Exposes Sensitive Data
A critical security vulnerability has been discovered in OPPO’s Clone Phone feature that could expose sensitive user data through inadequately secured WiFi hotspots. The vulnerability, designated CVE-2025-27387, affects ColorOS 15.0.2 and earlier versions, presenting a high-severity risk with a CVSS…
Pro-Iranian Hacktivists Targeting US Networks Department of Homeland Security Warns
The Department of Homeland Security has issued a critical advisory warning of escalating cyber threats from pro-Iranian hacktivist groups targeting United States networks, as tensions between Iran and the US reach a dangerous new peak following recent military exchanges. The…
Weaponized DMV-Themed Phishing Attacking U.S. Citizens to Harvest Personal and Financial Data
A sophisticated phishing campaign emerged in May 2025, targeting U.S. citizens through a coordinated impersonation of state Department of Motor Vehicles (DMV) agencies. This large-scale operation utilized SMS phishing techniques combined with deceptive web infrastructure to harvest personal and financial…
OWASP AI Testing Guide – A New Project to Detect Vulnerabilities in AI Applications
The Open Web Application Security Project (OWASP) has announced the development of a comprehensive OWASP AI Testing Guide, marking a significant milestone in addressing the growing security challenges posed by artificial intelligence implementations across industries. This specialized framework emerges as…
Aviatrix Cloud Controller Authentication Vulnerability Let Attackers Execute Remote Code
Two critical vulnerabilities in Aviatrix Controller, a Software-Defined Networking (SDN) utility that enables cloud connectivity across different vendors and regions. The vulnerabilities allowed attackers to bypass authentication and execute remote code with root privileges, potentially compromising entire cloud infrastructures. Critical…
WinRAR Directory Vulnerability Allows Arbitrary Code Execution Using a Malicious File
A severe security vulnerability has been identified in RARLAB’s WinRAR software that enables remote attackers to execute arbitrary code through malicious archive files. The flaw, designated as CVE-2025-6218, carries a CVSS score of 7.8 and affects the handling of directory…
Sophisticated Malware Campaign Targets WordPress and WooCommerce Sites with Obfuscated Skimmers
A sophisticated malware campaign has emerged targeting WordPress and WooCommerce websites with highly obfuscated credit card skimmers and credential theft capabilities, representing a significant escalation in e-commerce cyberthreats. The malware family demonstrates advanced technical sophistication through its modular architecture, featuring…
WinRAR Vulnerability Let Execute Arbitrary Code Using a Malicious File
A severe security vulnerability has been identified in RARLAB’s WinRAR software that enables remote attackers to execute arbitrary code through malicious archive files. The flaw, designated as CVE-2025-6218, carries a CVSS score of 7.8 and affects the handling of directory…
WhatsApp Banned on U.S. House Staffers Devices Due to Potential Security Risks
The U.S. House of Representatives has implemented a comprehensive ban on the WhatsApp messaging application across all government-issued devices used by congressional staffers, marking a significant escalation in federal cybersecurity protocols. The Chief Administrative Officer (CAO) issued the directive Monday,…
North Korean Hackers Trick Users With Weaponized Zoom Apps to Execute System-Takeover Commands
A sophisticated cybercriminal campaign has emerged targeting professionals through meticulously crafted fake Zoom applications designed to execute system takeover commands. The attack leverages advanced social engineering techniques combined with convincing domain spoofing to deceive users into compromising their systems, representing…
LapDogs Hackers Leverages 1,000 SOHO Devices Using a Custom Backdoor to Act Covertly
A sophisticated China-linked cyber espionage campaign has emerged, targeting over 1,000 Small Office/Home Office (SOHO) devices worldwide through an advanced Operational Relay Box (ORB) network dubbed “LapDogs.” This covert infrastructure operation, active since September 2023, represents a significant evolution in…
Notepad++ Vulnerability Let Attacker Gain Complete System Control – PoC Released
A severe privilege escalation vulnerability has been discovered in Notepad++ version 8.8.1, potentially exposing millions of users worldwide to complete system compromise. The flaw, designated CVE-2025-49144, allows attackers to gain SYSTEM-level privileges through a technique known as binary planting, with…
Critical Teleport Vulnerability Let Attackers Remotely Bypass Authentication Controls
A critical vulnerability, designated as CVE-2025-49825 that enables attackers to remotely bypass authentication controls in Teleport, a popular secure access platform. The vulnerability affects multiple versions of Teleport infrastructure, prompting immediate security updates across all deployment environments. Cloud customers have…
UAC-0001 Hackers Attacking ICS Devices Running Windows Systems as a Server
Ukrainian government agencies have fallen victim to a sophisticated cyberattack campaign orchestrated by the UAC-0001 group, also known as APT28, targeting industrial control systems (ICS) devices running Windows operating systems as servers. The attacks, which occurred between March and April…
New Echo Chamber Attack Jailbreaks Most AI Models by Weaponizing Indirect References
A sophisticated new jailbreak technique that defeats the safety mechanisms of today’s most advanced Large Language Models (LLMs). Dubbed the “Echo Chamber Attack,” this method leverages context poisoning and multi-turn reasoning to guide models into generating harmful content without ever…
McLaren Health Care Data Breach Exposes 743,000 People Personal Information
McLaren Health Care, a major healthcare organization based in Grand Blanc, Michigan, has disclosed a significant data breach that compromised the personal information of 743,131 individuals nationwide. The breach notification, filed with the Office of the Maine Attorney General, reveals…
Hands-on Cybersecurity Threat Hunting Guide for SOC Analysts and MSSPs
This comprehensive guide provides SOC analysts and MSSP teams with practical threat hunting techniques using advanced threat intelligence platforms. Modern threat actors continuously develop sophisticated evasion techniques, making traditional detection methods insufficient for comprehensive security operations. The strategies outlined here…
Steelmaker Nucor Hacked – Attackers Gained Unauthorized Access to IT Systems
Charlotte-based steel giant Nucor Corporation disclosed a significant cybersecurity incident where threat actors gained unauthorized access to the company’s information technology infrastructure. The breach prompted temporary production shutdowns across multiple facilities as the company implemented emergency containment protocols and engaged…
Hackers Allegedly Selling Intelbras Router 0-Day Exploit on Hacker Forums
A notorious threat actor has allegedly listed a previously unknown—or “0day”—exploit for Intelbras routers on a prominent hacker forum. This exploit poses significant risks for many users and organizations that rely on Intelbras hardware for their networking needs. The sale…
Microsoft Defender for Office 365 to Provide Detailed Results for Spam, Phishing or Clean Emails
Microsoft is set to revolutionize email security transparency with the introduction of AI-powered explanations for email submission results in Microsoft Defender for Office 365. This groundbreaking feature, leveraging large language models (LLMs), will provide clear, human-readable rationales for why messages…
Linux Firewall IPFire 2.29 Core Update 195 Released With VPN Protocol Support
IPFire has released Core Update 195 for version 2.29, marking a significant milestone with the introduction of native WireGuard VPN protocol support. This highly anticipated update transforms the open-source firewall distribution by integrating modern VPN capabilities alongside comprehensive security enhancements…
APT36 Hackers Attacking Indian Defense Personnel in Sophisticated Phishing Attack
A Pakistan-based cyber espionage group known as APT36 or Transparent Tribe has launched a highly sophisticated phishing campaign targeting Indian defense personnel, utilizing credential-stealing malware designed to establish long-term infiltration within sensitive military networks. The campaign represents a significant escalation…
RapperBot Attacking DVRs to Gain Access Over Surveillance Cameras to Record Video
A sophisticated botnet campaign targeting digital video recorders (DVRs) has emerged as a significant threat to surveillance infrastructure worldwide, with cybercriminals exploiting vulnerable IoT devices to build massive botnets capable of large-scale distributed denial-of-service attacks. RapperBot, a variant of the…
Shadow Vector Malware Weaponizes SVG Images to Deploy AsyncRAT and RemcosRAT
A sophisticated malware campaign dubbed Shadow Vector is actively targeting users in Colombia through malicious Scalable Vector Graphics (SVG) files that act as decoys for deploying dangerous remote access tools. The campaign distributes spear-phishing emails impersonating trusted Colombian institutions, particularly…
North Korean Hackers Weaponizes Github Infrastructure Used to Deliver Malware
A sophisticated cyber espionage campaign has emerged, demonstrating how North Korean threat actors are increasingly leveraging legitimate cloud platforms to distribute malware and establish persistent command and control infrastructure. Security researchers have uncovered a complex spearphishing operation that exploits GitHub’s…
DDoS Attack Crippling Financial Sectors, Leds to Multi-Day Outages
Recent DDoS attacks have evolved from mere nuisances to strategic threats capable of paralyzing financial institutions for extended periods. The financial services sector has emerged as the primary target of these sophisticated attacks, which are designed to overwhelm digital infrastructure…
Microsoft Family Safety Blocking All the Version of Chrome Browsers
Microsoft Family Safety’s recent update has triggered an unexpected system-wide blocking of Google Chrome browsers across all versions, creating significant operational challenges for educational institutions and families utilizing Windows devices with parental controls enabled. The issue, which emerged on June…
Microsoft Limits Windows 11 24H2 Restore Points From 90 to 60 Days
Microsoft has implemented a significant change to its Windows 11 system recovery functionality, reducing the retention period for system restore points from 90 days to 60 days in the latest security update. This modification affects Windows 11 version 24H2 users…
Windows Screencast Snipping Tool Allow Users to Export Captures as GIF
Microsoft has begun rolling out a significant update to the Windows Snipping Tool that enables users to export screen recordings as GIF files, marking a notable enhancement to the productivity toolkit available on Windows 11. The new functionality, designated as…
SparkKitty Attacks iOS and Android Devices in Wild Via App Store and Google Play
Cybersecurity researchers have uncovered a sophisticated new spyware campaign called SparkKitty that has successfully infiltrated both Apple’s App Store and Google Play Store, marking a significant escalation in mobile malware distribution through official channels. This Trojan spy represents the latest…
CoinMarketCap Doodle Image Vulnerability Triggered Malicious Code Through an API Call
CoinMarketCap, one of the world’s leading cryptocurrency data platforms, experienced a security vulnerability on June 20, 2025, when a doodle image on their homepage contained malicious code that triggered unauthorized API calls, resulting in unexpected pop-ups for users. The company’s…
Critical Meshtastic Vulnerability Let Attackers to Decrypt Private Messages
A critical security vulnerability has been discovered in Meshtastic firmware that could allow attackers to decrypt private messages sent between devices. The flaw, assigned a CVSS score of 9.5 out of 10, affects all versions above 2.5.0 and stems from…
BlueNoroff Hackers Weaponize Zoom App to Attack System Using Infostealer Malware
A sophisticated social engineering campaign leveraging the trusted Zoom platform has emerged as the latest weapon in the arsenal of North Korean state-sponsored hackers. The BlueNoroff group, a financially motivated subgroup of the notorious Lazarus Group, has been orchestrating targeted…
NCSC Warns of ‘UMBRELLA STAND’ Malware Attacking Fortinet FortiGate Firewalls
The UK’s National Cyber Security Centre (NCSC) has issued a critical warning about a sophisticated malware campaign dubbed “UMBRELLA STAND” that specifically targets internet-facing Fortinet FortiGate 100D series firewalls. This newly identified threat represents a significant escalation in attacks against…
Amazon EKS Vulnerabilities Expose Sensitive AWS Credentials and Escalate Privileges
Critical vulnerabilities in Amazon Elastic Kubernetes Service (EKS) allow overprivileged containers to expose sensitive AWS credentials through packet sniffing and API spoofing attacks. The investigation, published on June 19, 2025, demonstrates how misconfigured containers can facilitate unauthorized access and privilege…
Weekly Cybersecurity News Recap – Top Vulnerabilities, Threat and Data Breaches
In our fast-paced, interconnected world, the dangers of cyberattacks are becoming more frequent and complex. That’s why it’s more important than ever to stay updated and aware of the risks. Every week, our newsletter offers a simple roundup of the…
Threat Actor Allegedly Selling FortiGate API Exploit Tool Targeting FortiOS
A threat actor has reportedly put up for sale a sophisticated FortiGate API exploit tool on a dark web marketplace, igniting significant concern within the cybersecurity community. The tool, which is being marketed for a price of $12,000 and comes…
Critical OpenVPN Driver Vulnerability Allows Attackers to Crash Windows Systems
A critical buffer overflow vulnerability in OpenVPN’s data channel offload driver for Windows has been discovered, allowing local attackers to crash Windows systems by sending maliciously crafted control messages. The vulnerability, identified as CVE-2025-50054, affects the ovpn-dco-win driver versions 1.3.0…
DuckDuckGo Rolls Out New Scam Blocker to Protect Users from Online Threats
DuckDuckGo has significantly upgraded its Scam Blocker feature to protect users against a broader range of digital threats, including sham e-commerce platforms, fake cryptocurrency exchanges, and “scareware” tactics. This enhancement comes as consumers reported $12.5 billion in fraud losses to…
How Smart Timesheet Software Is Changing the Way of Work
As an employee have been managing projects in remote, hybrid, and traditional work environments, employees have always faced the same challenge: the inability to understand where time, actually is spent. Regular tasks are not completed on time as they are…
Microsoft Warns of OneDrive Bug that Causes Searches to Appear Blank
Microsoft has acknowledged a significant bug affecting OneDrive personal accounts that is causing search results to appear blank, preventing users from locating files they know exist within their cloud storage. The tech giant is actively investigating the issue, which appears…
Microsoft Announces New Security Defaults for Windows 365 Cloud PCs
Microsoft unveiled significant security enhancements for Windows 365 Cloud PCs on June 18, 2025, introducing new default configurations that prioritize data protection and system integrity. The updates include disabling clipboard, drive, USB, and printer redirections by default, while enabling advanced…
Prometei Botnet Attacking Linux Servers to Mine Cryptocurrency
Cybersecurity researchers have uncovered a significant resurgence of the Prometei botnet, a sophisticated malware operation targeting Linux servers for cryptocurrency mining and credential theft. This latest campaign, observed since March 2025, demonstrates the evolving nature of cryptomining malware and its…
Beware of Weaponized MSI Installer Mimic as WhatsApp Delivers Modified XWorm RAT
Cybersecurity professionals across East and Southeast Asia are facing a sophisticated new threat as China-linked attackers deploy a weaponized MSI installer disguised as a legitimate WhatsApp setup package. This malicious campaign represents a significant escalation in social engineering tactics, leveraging…
Mocha Manakin Using Paste and Run Technique to Trick Users Into Downloading Malicious Payloads
A sophisticated new threat actor known as Mocha Manakin has emerged in the cybersecurity landscape, employing an increasingly popular social engineering technique called “paste and run” to deceive users into executing malicious scripts on their systems. This deceptive method has…
Record Breaking 7.3 Tbps DDoS Attack Blasting 37.4 Terabytes in Just 45 Seconds
The largest distributed denial-of-service (DDoS) attack ever documented was successfully stopped by Cloudflare in mid-May 2025, with attackers unleashing a devastating 7.3 terabits per second (Tbps) attack that delivered 37.4 terabytes of malicious traffic in just 45 seconds. This unprecedented…
Threat Actors Poisoning Google Search Results to Display The Scammer’s Phone Number Instead of Real Number
In a concerning development for internet users, cybercriminals have devised a sophisticated new technique to manipulate Google search results, effectively poisoning them to display fraudulent contact information. Unlike traditional phishing schemes that rely on fake websites, this novel approach leverages…
Hackers Exploit ComfyUI 700+ AI Image Generation Servers to Deploy Malware
A sophisticated malware campaign targeting ComfyUI, a popular AI image generation framework, has successfully compromised at least 695 servers worldwide, security researchers have discovered. The attack represents a significant escalation in threats against AI infrastructure, exploiting vulnerabilities in ComfyUI to…
Threat Actors Leverage Hosting Platform Vercel to Deliver Remote Access Malware
Cybercriminals have discovered a sophisticated new method to distribute malicious remote access tools by exploiting Vercel, a legitimate frontend hosting platform, to host convincing phishing pages that deliver weaponized versions of LogMeIn software. This emerging threat demonstrates how attackers increasingly…
Insomnia API Client Vulnerability Arbitrary Code Execution via Template Injection
A severe security vulnerability has been discovered in the widely-used Insomnia API Client that allows attackers to execute arbitrary code through malicious template injection. The vulnerability, tracked as CVE-2025-1087 and assigned a critical CVSS score of 9.3, affects the popular…
ClamAV 1.4.3 and 1.0.9 Released With Fix for Vulnerabilities that Enable Remote Code Execution
Multiple high-severity vulnerabilities, including a dangerous buffer overflow capable of remote code execution, have been fixed in critical security updates released by the ClamAV team for versions 1.4.3 and 1.0.9. These patch releases target several security issues that affect all…
New TxTag Phishing Attack Leverages .gov Domain to Trick Employees
A sophisticated phishing campaign targeting employees with fake toll payment notices has been identified, combining government domain spoofing with social engineering tactics. The attackers craft messages claiming to be from TxTag, warning recipients that their accounts face suspension unless outstanding…
PowerShell Loaders With In-Memory Execution Techniques To Evade Disk-Based Detection
Cybersecurity researchers have uncovered a sophisticated PowerShell-based attack campaign that leverages advanced in-memory execution techniques to bypass traditional disk-based security controls. The malicious infrastructure spans across Chinese, Russian, and global hosting providers, demonstrating the international scope of modern cyber threats.…
Hackers Exploit Atlassian’s Model Context Protocol by Submitting a Malicious Support Ticket
A sophisticated attack vector targeting Atlassian’s Model Context Protocol (MCP) that allows external threat actors to gain privileged access to internal systems through malicious support tickets. The attack, dubbed “Living off AI,” exploits the trust boundary between external users submitting…
Apache SeaTunnel Vulnerability Allows Unauthorized Users to Perform Deserialization Attack
Apache SeaTunnel, the widely used distributed data integration platform, has disclosed a significant security vulnerability that enables unauthorized users to execute arbitrary file read operations and deserialization attacks through its RESTful API interface. The vulnerability, tracked as CVE-2025-32896 and reported…
AntiDot – 3-in-1 Android Malware Let Attackers Full Control of Compromised Devices
A sophisticated new Android botnet malware called AntiDot has emerged as a significant threat to mobile device security, offering cybercriminals unprecedented control over infected devices. This malicious software operates as part of a Malware-as-a-Service (MaaS) model, marketed by threat actor…
Massive 16 Billion Passwords From Apple, Facebook, Google and More Leaked From 320 Million Computers
A new report has uncovered a staggering 16 billion login credentials from major platforms, including Apple, Facebook, Google, GitHub, Telegram, and government services. The massive leak, discovered through 30 separate datasets, represents an unprecedented threat to global cybersecurity and digital…
IBM QRadar SIEM Vulnerabilities Allows Attackers to Execute Arbitrary Commands
Multiple high-severity vulnerabilities in IBM QRadar SIEM could allow attackers to execute arbitrary commands and access sensitive data. The most critical flaw, tracked as CVE-2025-33117, carries a CVSS score of 9.1 and enables privileged users to upload malicious files that…
GodFather Android Malware Leverages On-Device Virtualization Technique to Hijack Legitimate Banking Apps
A sophisticated evolution of the GodFather banking malware has emerged, introducing a groundbreaking attack methodology that exploits on-device virtualization to compromise legitimate mobile applications. This advanced threat represents a significant departure from traditional overlay attacks, creating complete isolated virtual environments…
Tesla Wall Connector Charger Hacked Through Charging Port in 18-Minute Attack
Tesla’s popular Wall Connector home charging system was exploited during the January 2025 Pwn2Own Automotive competition, demonstrating how attackers could gain control of the device through the charging cable itself. The groundbreaking attack targeted the Tesla Wall Connector Gen 3,…
New Sophisticated Attack Exploits Google App Passwords to Bypass Multi-Factor Authentication
A sophisticated Russian state-sponsored cyber operation has successfully exploited Google’s App-Specific Password (ASP) feature to bypass multi-factor authentication protections, targeting prominent critics of Russia in a campaign that demonstrates the evolving threat landscape facing high-profile individuals. The attack, attributed to…
Qilin Ransomware Emerges as World’s Top Threat, Demands $50 Million Ransom
Qilin ransomware has rapidly ascended to become the world’s most prevalent ransomware threat, accumulating over $50 million in ransom payments throughout 2024 alone. Originally developed as ‘Agent’ in 2022 and later recorded in the Rust programming language, this sophisticated malware…
Silver Fox APT Using Weaponized Medical Software to Deploy Remote Access Tools & Disable AV
A sophisticated China-based advanced persistent threat group known as Silver Fox has emerged as a significant cybersecurity concern, leveraging trojanized medical software to infiltrate healthcare organizations and public sector entities. Active since 2024, this state-sponsored group has demonstrated advanced capabilities…
North Korean Hackers Using Weaponized Calendly and Google Meet Link to Deliver Malware
A sophisticated North Korean Advanced Persistent Threat (APT) group has been identified deploying malware through weaponized meeting scheduling platforms, targeting cryptocurrency organizations with an elaborate social engineering campaign that combines deepfake technology, legitimate meeting tools, and advanced macOS malware. The…
100,000+ WordPress Sites Exposed to Privilege Escalation Attacks via MCP AI Engine
A critical security vulnerability has emerged in the WordPress ecosystem, exposing over 100,000 websites to privilege escalation attacks through the AI Engine plugin’s Model Context Protocol (MCP) implementation. The vulnerability, designated CVE-2025-5071 with a high CVSS rating of 8.8, affects…
jQuery Migrate Library Silently Compromised to Steal Logins Using Parrot Traffic Direction System
A sophisticated supply chain attack has emerged that weaponizes the trusted jQuery Migrate library to deliver stealthy malware capable of harvesting user credentials and session data. Security researchers discovered this campaign after investigating unusual online behavior from a senior executive…
Gamers Under Attack! Fake Minecraft Mods Allow Attackers to Control Your System
The gaming community faces a sophisticated new threat as cybercriminals exploit the massive popularity of Minecraft to distribute advanced malware through fake modifications. With over 200 million monthly active players and more than 1 million users actively involved in modding,…
60+ GitHub Repositories Exploited to Store Windows-Based Payloads to Steal Sensitive Data
A sophisticated supply chain attack campaign has emerged targeting software developers through the exploitation of over 60 GitHub repositories containing trojanized Python files designed to steal sensitive Windows-based data. The threat actor, known as Banana Squad, has demonstrated remarkable stealth…
Microsoft Entra ID Expands Passkey (FIDO2) Authentication Methods for Public Preview
Microsoft is expanding the number of passkey authentication methods available in Microsoft Entra ID to improve its identity and access management features. The public preview rollout is scheduled to commence in mid-October 2025, with full deployment expected by mid-November 2025. …
Android Spyware SpyNote That Mimicked Google Translate Hosted in Open Directories
Cybersecurity researchers have uncovered a sophisticated Android spyware campaign involving SpyNote malware cleverly disguised as legitimate applications, including Google Translate, hosted in unsecured open directories across the internet. This discovery highlights the evolving tactics employed by cybercriminals to distribute malicious…
Hackers Deliver Amatera Stealer via Sophisticated Web Injection & Anti-Analysis Features
Cybercriminals have unleashed a new and sophisticated information stealer called Amatera Stealer, which represents a significant evolution in malware-as-a-service offerings targeting sensitive user data. This malicious software emerged as a rebranded and enhanced version of the previously known ACR Stealer,…
Krispy Kreme Confirms Data Breach – Personal Information Stolen by Attackers
Krispy Kreme Doughnut Corporation has confirmed a significant data security incident affecting thousands of current and former employees, along with their family members, following unauthorized access to company systems discovered in late November 2024. The popular doughnut chain became aware…
Hackers Leverage VBScript Files to Deploy Masslogger Credential Stealer Malware
A sophisticated new variant of the Masslogger credential stealer has emerged, utilizing VBScript encoded (.VBE) files to deploy a multi-stage fileless malware campaign that operates entirely from the Windows Registry. This advanced threat represents a significant evolution in information-stealing malware,…
Jitter-Trap – A New Technique to Detect Stealthy Beacon Traffic
A new detection method called Jitter-Trap that turns cybercriminals’ own evasion tactics against them, offering new hope in the battle against sophisticated post-exploitation attacks. Released on June 18, 2025, this technique focuses on identifying stealthy beacon communications that traditional security…
Russian Hackers Impersonating as U.S. Department of State to Obtain ASP Passcode
A sophisticated Russian state-sponsored cyber campaign has targeted prominent academics and critics of Russia through an innovative social engineering attack that exploited Google’s Application Specific Password (ASP) functionality. The operation, which ran from April through early June 2025, demonstrated a…
Microsoft Entra ID to Extend Passkey (FIDO2) Authentication Methods to Support Public Preview
Microsoft is expanding the number of passkey authentication methods available in Microsoft Entra ID to improve its identity and access management features. The public preview rollout is scheduled to commence in mid-October 2025, with full deployment expected by mid-November 2025. …
Open Next for Cloudflare SSRF Vulnerability Let Attackers Load Remote Resources from Arbitrary Hosts
A high-severity Server-Side Request Forgery (SSRF) vulnerability has been identified in the @opennextjs/cloudflare package, enabling attackers to exploit the /_next/image endpoint to load remote resources from arbitrary hosts. The vulnerability, assigned CVE-2025-6087 with a CVSS score of 7.8, affects all…
Apache Traffic Server Vulnerability Let Attackers Trigger DoS Attack via Memory Exhaustion
A critical security vulnerability has been discovered in Apache Traffic Server that allows remote attackers to trigger denial-of-service (DoS) attacks through memory exhaustion. The vulnerability, tracked as CVE-2025-49763, affects the Edge Side Includes (ESI) plugin and poses significant risks to…
Hackers Leverage Cloudflare Tunnels to Infect Systems Using Stealthy Python-Based Malware
A sophisticated malware campaign has emerged that exploits Cloudflare’s tunneling infrastructure to deliver multi-stage Python-based payloads, demonstrating an alarming evolution in cybercriminal tactics. The campaign, tracked as SERPENTINE#CLOUD, represents a significant escalation in the abuse of legitimate cloud services for…
Authorities Busted Ransomware Gang – Nine Laptops and 15 Mobile Devices Were Seized
Thai law enforcement successfully dismantled a sophisticated ransomware operation during a coordinated raid at the Antai Holiday Hotel in central Pattaya on Monday, June 16, 2025. The operation resulted in the arrest of six Chinese nationals specifically tasked with distributing…
Cisco AnyConnect VPN Server Vulnerability Let Attackers Trigger DoS Attack
A critical security vulnerability affecting Cisco Meraki MX and Z Series devices could allow unauthenticated attackers to launch denial of service (DoS) attacks against AnyConnect VPN services. The vulnerability, tracked as CVE-2025-20271 with a CVSS score of 8.6, was published…
Password Reset Poisoning Attack Allows Account Takeover Using the Password Reset Link
A critical vulnerability in password reset mechanisms has been discovered that allows attackers to completely take over user accounts by manipulating password reset links. Security researcher Pratik Dabhi recently disclosed details of a Host Header Injection attack that exploits how…
Golden SAML Attack Let Attackers Gains Control of The Private Keyused by Federation Server
Cybersecurity professionals are facing a sophisticated new threat as Golden SAML attacks emerge as one of the most dangerous yet stealthy techniques targeting enterprise identity infrastructure. These attacks represent a significant escalation in the threat landscape, allowing malicious actors to…
Xiaomi Smartwatch Hacked Using Touch Point to Find Unlock PIN coordinates
Security researcher Sergei Volokitin has presented findings on hardware vulnerabilities discovered in Xiaomi devices, including the company’s S3 smartwatch, during a presentation at a major cybersecurity conference. The research was conducted as part of a collaborative security event where researchers…
5 New Trends In Phishing Attacks On Businesses – Must Aware Threats
Phishing remains one of the most effective ways attackers infiltrate corporate environments. Today’s phishing campaigns are no longer just poorly written emails with obvious red flags. They’re sophisticated, well-disguised, and tailored to exploit trust in everyday tools your teams use. …
New SuperCard Malware Using Hacked Android Phones to Relay Data from Users Payment Cards to Attackers Device
In a concerning development for mobile payment security, cybersecurity experts have identified a sophisticated new malware strain named “SuperCard” that exploits Android devices to steal payment card data. This malicious application, a modified version of the legitimate NFCGate program, intercepts…
Insecure GitHub Actions in Open Source Projects MITRE and Splunk Exposes Critical Vulnerabilities
A comprehensive security investigation has revealed widespread vulnerabilities in GitHub Actions workflows across major open source repositories, including those maintained by prestigious organizations such as MITRE and Splunk. The discovery highlights a concerning pattern of insecure continuous integration and continuous…
RapperBot Botnet Attack Peaks 50,000+ Attacks Targeting Network Edge Devices
The RapperBot botnet has reached unprecedented scale, with security researchers observing over 50,000 active bot infections targeting network edge devices across the globe. This sophisticated malware campaign represents one of the most persistent and evolving cyber threats currently plaguing internet-connected…
Microsoft Defender for Office 365 to Block Email Bombing Attacks
Microsoft has announced a new security capability within its Defender for Office 365 suite aimed at combating the growing threat of email bombing attacks. The feature, officially labeled “Mail Bombing Detection,” will automatically identify and quarantine high-volume email flooding campaigns…
PLA Rapidly Deploys AI Technology Across Military Intelligence Operations
China’s People’s Liberation Army has accelerated its integration of generative artificial intelligence across military intelligence operations, marking a significant shift in how the world’s largest military force approaches data collection, analysis, and strategic decision-making. This technological transformation represents the PLA’s…
Researchers Uncovered on How Russia Leverages Private Companies, Hacktivist to Strengthen Cyber Capabilities
A comprehensive new study reveals the sophisticated architecture behind Russia’s externalized cyber warfare strategy, exposing how the Kremlin systematically exploits private companies, hacktivist collectives, and cybercriminal groups to enhance its digital offensive capabilities while maintaining plausible deniability. The research demonstrates…
Beware of Fake CAPTCHA Pop-Up Windows That Silently Installs LightPerlGirl Malware
Cybersecurity researchers have uncovered a sophisticated malware campaign leveraging fake CAPTCHA verification windows to trick users into manually executing malicious PowerShell commands. The newly identified threat, dubbed LightPerlGirl, represents a concerning evolution in social engineering tactics that exploits users’ trust…