The Socket Research Team has discovered a sophisticated malicious PyPI package named ‘set-utils’ designed to steal Ethereum private keys from unsuspecting developers. This package, which has been downloaded over 1,000 times since January 29, 2025, disguises itself as a simple…
Tag: Cyber Security News
Threat Actor Allegedly Selling Bruteforcer for Cisco VPN
A threat actor has surfaced on underground forums, allegedly offering tools designed to exploit Cisco VPNs via brute force and credential-checking attacks. These tools, marketed as a “checker” and “bruteforcer,” are tailored to target Cisco VPN services, raising significant cybersecurity…
Researchers Jailbreaked 17 Popular LLM Models To Communicate Sensitive Data
A comprehensive study by Palo Alto Networks’ Unit 42 has revealed that 17 popular generative AI web applications remain vulnerable to various jailbreaking techniques. These vulnerabilities potentially allow malicious actors to bypass AI safety mechanisms to extract sensitive information or…
Phantom Goblin Leveraging Social Engineering Tactics To Deliver Stealer Malware
Cyble Research and Intelligence Labs (CRIL) has identified a sophisticated malware operation named ‘Phantom Goblin’ that employs deceptive social engineering techniques to distribute information-stealing malware. The attack begins with RAR file attachments containing malicious shortcut (LNK) files disguised as legitimate…
New Polymorphic Attack That Mimic Any Chrome Extension Installed On The Browser
SquareX’s research team has recently uncovered a sophisticated browser attack technique that allows malicious extensions to impersonate any extension installed on a victim’s browser. This newly discovered “polymorphic extension attack” creates pixel-perfect replicas of legitimate extensions’ icons, HTML popups, and…
Threat Actors Exploited PHP-CGI RCE Vulnerability To Attack Windows Machines
Cisco Talos recently uncovered a series of sophisticated cyberattacks exploiting a critical PHP vulnerability to compromise Windows machines. The malicious activities conducted by unknown attackers have been ongoing since January 2025, predominantly targeting organizations in Japan across various business sectors…
Thinkware Dashcam Vulnerability Let Attackers Extract the Credentials in Plain-text
A series of critical vulnerabilities in Thinkware’s F800 Pro dashcam has revealed systemic security flaws, including the exposure of user credentials in plain text, default authentication bypasses, and insecure data storage practices. These issues, disclosed between November 2024 and March…
Peaklight Malware Attacking Users To Exfiltrate Login Credentials, Browser History & Financial Data
A sophisticated information stealer known as Peaklight is actively targeting Windows users worldwide. This malware, identified on March 6, 2025, is designed to harvest sensitive information from compromised endpoints, creating significant risks for both individuals and organizations. Peaklight utilizes a…
New North Korean Moonstone Sleet Employs Creative Tactics To Deploy Custom Ransomware
Cybersecurity researchers have identified a sophisticated ransomware campaign attributed to a North Korean threat actor dubbed “Moonstone Sleet.” The group has deployed an advanced custom ransomware strain targeting financial institutions and cryptocurrency exchanges across Southeast Asia and Europe, demonstrating evolving…
Apache Traffic Server Vulnerabilities Let Attackers Perform Malformed Requests
The Apache Software Foundation has issued urgent patches for multiple high-severity vulnerabilities in Apache Traffic Server (ATS), its enterprise-grade caching proxy server. Four distinct flaws (CVE-2024-38311, CVE-2024-56195, CVE-2024-56196, and CVE-2024-56202) enable threat actors to execute request smuggling attacks, bypass access…
Akira Ransomware Attacking Windows Server via RDP & Evades EDR Using Webcam
A sophisticated ransomware group called Akira has been responsible for approximately 15% of cybersecurity incidents in 2024. The threat actor has deployed novel techniques to bypass security defenses, most notably by exploiting unsecured webcams to circumvent Endpoint Detection and Response…
Commvault Webserver Vulnerability Let Attackers Compromise Webserver
Commvault, a global leader in enterprise data protection and management solutions, has urgently patched a high-severity webserver vulnerability that enables attackers to compromise systems by creating and executing malicious webshells. The flaw affects multiple versions of Commvault’s software across Linux…
Microsoft WinDbg RCE Vulnerability Let Attackers Execute Arbitrary Code Remotely
A high-severity vulnerability CVE-2025-24043, remote code execution (RCE) through improper cryptographic signature validation in the SOS debugging extension. The vulnerability affects critical .NET diagnostic packages including dotnet-sos, dotnet-dump, and dotnet-debugger-extensions, which are integral to .NET Core application debugging workflows. According…
1 Million Devices Infected by Malwares Hosted on GitHub, Microsoft Warns
Microsoft Threat Intelligence detected a large-scale malvertising campaign in early December 2024 that infected nearly one million devices globally in an opportunistic attack designed to steal information. The campaign impacted a wide range of organizations and industries, affecting both consumer…
Hackers Leveraging Compromised Email Server To Send Fraudulent Emails
In a sophisticated business email compromise (BEC) attack recently uncovered by Trend Micro Managed XDR team, threat actors exploited a compromised third-party email server to conduct fraudulent financial transactions between business partners. The scheme, which unfolded over several days, involved…
Popular Python Library Vulnerability Exposes 43 million Installations to Code Execution Attacks
A recently disclosed vulnerability in the widely used Python JSON Logger library has exposed an estimated 43 million installations to potential remote code execution (RCE) attacks through a dependency chain flaw. Tracked as GHSA-wmxh-pxcx-9w24 and scoring 8.8/10 on the CVSS…
Notorious Black Basta Tactics, Techniques and Procedures Uncovered From Leak
A significant leak of internal chat logs from the Black Basta ransomware group has provided cybersecurity researchers with unprecedented insight into their operations. A Telegram user named ExploitWhispers unveiled the leak contained approximately 200,000 chat messages dated between September 2023…
Hackers Using Advanced Social Engineering Techniques With Phishing Attacks
Cybercriminals are advancing beyond rudimentary phishing attempts, adopting sophisticated social engineering strategies that build relationships with targets before delivering malicious payloads. ESET’s APT Activity Report shows that the North Korea-aligned threat actors have significantly refined their tactics, making traditional security…
North Korean Hackers Cash Out $300 Million From Record $1.46 Billion ByBit Crypto Heist
Lazarus Group hackers believed to be affiliated with North Korea’s regime have successfully laundered at least $300 million from their unprecedented $1.5 billion cryptocurrency heist targeting the ByBit exchange. The cybercriminals, identified as the infamous Lazarus Group, executed the attack…
Detecting Cyber Attack Patterns by Analyzing Threats Actors Infrastructure
The identification of cyber attack patterns through infrastructure analysis has emerged as a crucial methodology in modern threat intelligence. By examining the digital footprints left by threat actors, security analysts can now reconstruct attack campaigns and attribute them to specific…
Hackers Exploiting ‘any/any’ Communication Configs in Cloud Services to Host Malware
Veriti has uncovered a concerning trend where cybercriminals are actively exploiting misconfigured cloud services to distribute malware and control compromised systems. Over 40% of networks allow “any/any” communication with at least one major cloud provider, creating significant security vulnerabilities for…
PrintSteal Cyber Criminal Group Distributing Fake Aadhaar & PAN Cards at Large Scale
A sophisticated cyber criminal operation known as “PrintSteal” has been discovered generating and distributing fraudulent Indian identity documents on a massive scale. This operation has established over 1,800 domains impersonating government websites, with approximately 600 currently active. The criminal network…
7 Weaponized Go Packages Attacking Linux & macOS To Install Hidden Malware Loader
Security researchers have uncovered an ongoing malicious campaign targeting the Go ecosystem with seven typosquatted packages designed to install hidden loader malware on Linux and macOS systems. The threat actor has published packages that impersonate widely used Go libraries, employing…
Top 50 Best Penetration Testing Companies – 2025
Penetration testing companies specialize in evaluating the security of an organization’s IT infrastructure by simulating real-world cyberattacks. These companies use ethical hacking techniques to identify vulnerabilities in networks, applications, and systems before malicious hackers can exploit them. What Do Penetration…
PoC Exploit Released for Actively Exploited Linux Kernel Out-Of-Bounds Write Vulnerability
A proof-of-concept (PoC) exploit has been released for a high-severity out-of-bounds write vulnerability in the Linux kernel, identified as CVE-2024-53104. The vulnerability exists within the USB Video Class (UVC) driver and can lead to privilege escalation. The flaw stems from…
Hackers Registered 10K Domains With Same Name for Smishing Attack Via iMessage
A large-scale SMS phishing (smishing) campaign distributed via iMessage involving more than 10,000 domains registered by a threat actor was discovered recently. These domains are designed to impersonate toll services and package delivery platforms across multiple U.S. states and one…
Lumma Stealer Launch “Click Fix” Style Attack via Fake Google Meet & Windows Update Sites
Recent Palo Alto research investigations have revealed the ongoing evolution of “click fix” style campaigns used to distribute the Lumma Stealer malware. These campaigns exploit user interaction by leveraging malicious scripts that are inserted into the copy-paste buffer, tricking victims…
Getting Access to Internal Networks Via Physical Pentest – Case Study
Physical penetration testing provides crucial insights into real-world security vulnerabilities that might be overlooked in purely digital assessments. A recent case study conducted by Hackmosphere for a furniture retailer, referred to as ExCorp, revealed how physical access to facilities could…
Threat Actors Leverage YouTubers to Attack Windows Systems Via SilentCryptoMiner
Security researchers have uncovered a sophisticated malware campaign where threat actors are coercing popular YouTubers to distribute SilentCryptoMiner malware disguised as restriction bypass tools. This campaign has already affected more than 2,000 victims in Russia, with the actual number potentially…
New Malware Attacked ‘Desert Dexter’ Compromised 900+ Victims Worldwide
Security researchers at Positive Technologies have uncovered a sophisticated malware campaign dubbed “Desert Dexter” that has compromised more than 900 victims worldwide since September 2024. The attack, discovered in February 2025, primarily targets countries in the Middle East and North…
Beware of Fake CAPTCHA Prompts That May Silently Install LummaStealer on Your Device
Cybersecurity researchers at G DATA have uncovered a sophisticated malware campaign using fake CAPTCHA prompts to deliver LummaStealer, a dangerous information-stealing malware. This emerging threat, first discovered in January 2025, represents a new approach for LummaStealer distribution which previously spread…
Beware of Fake Tax Claims that Tricks Users to Steal Over $10,000 From Victims
Tax season has become a high-stakes battleground for cybercriminals, who leverage advanced technologies like deepfake audio and AI-generated phishing campaigns to steal over $10,000 from unsuspecting victims. According to a 2025 McAfee survey, 10% of tax scam losses exceeded $10,000,…
Linux Distro Tails 6.13 Released with Improved Wi-Fi Hardware Detection
The Tails Project announced the release of Tails 6.13 on March 6, 2025, marking a significant update to its privacy-centric Linux distribution. This iteration introduces improved diagnostics for Wi-Fi hardware compatibility, updates to the Tor Browser and client, and critical…
Hackers Leveraging x86-64 Binaries on Apple Silicon to Deploy macOS Malware
Advanced threat actors increasingly leverage x86-64 binaries and Apple’s Rosetta 2 translation technology to bypass execution policies and deploy malware on Apple Silicon devices. The technique exploits architectural differences between Intel and ARM64 processors while leaving behind forensic artifacts that…
YouTube Warns of Phishing Emails Attacking Creators to Steal Login Credentials
YouTube has issued an urgent alert to content creators regarding a highly sophisticated phishing campaign exploiting AI-generated deepfake technology to hijack accounts. The attack, first detected in late February 2025, uses fabricated videos of YouTube CEO Neal Mohan to deceive…
Multiple Jenkins Vulnerability Let Attackers Expose Secrets
Jenkins, the widely adopted open-source automation server central to CI/CD pipelines, has disclosed four critical security vulnerabilities enabling unauthorized secret disclosure, cross-site request forgery (CSRF), and open redirect attacks. These flaws, patched in versions 2.500 (weekly) and 2.492.2 (LTS), affect…
Critical Vulnerabilities in DrayTek Routers Exposes Devices to RCE Attack
A series of critical vulnerabilities in DrayTek Vigor routers widely deployed in small office/home office (SOHO) environments have been uncovered, exposing devices to remote code execution (RCE), denial-of-service (DoS) attacks, and credential theft. The flaws discovered during firmware reverse-engineering efforts…
Operation Sea Elephant Attacking Organizations to Steal Research Details
A sophisticated cyber espionage campaign dubbed “Operation Sea Elephant” has been discovered targeting scientific research organizations, with a particular focus on ocean-related studies. The operation, attributed to a threat actor group known as CNC with South Asian origins, aims to…
AMD Microcode Signature Verification Vulnerability Let Attackers Load Malicious Patches
Security researchers have uncovered a critical vulnerability in AMD Zen CPUs that allows attackers with elevated privileges to load malicious microcode patches, bypassing cryptographic signature checks. Dubbed “EntrySign,” this flaw stems from AMD’s use of the AES-CMAC algorithm as a…
CISA Warns of Edimax IC-7100 IP Camera 0-Day Vulnerability Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding a severe vulnerability in the Edimax IC-7100 IP Camera. This vulnerability, CVE-2025-1316, allows attackers to execute remote code on the device by sending specially crafted requests, exploiting…
North Korean IT Workers Using GitHub To Attack Organization Globally
Cybersecurity research firm NISOS has uncovered a network of suspected North Korean IT workers who are leveraging GitHub to create elaborate fake personas aimed at securing employment with companies in Japan and the United States. These individuals pose as Vietnamese,…
GitHub Details How Security Professionals Can Use Copilot to Analyze Logs
GitHub has unveiled groundbreaking applications of its AI-powered coding assistant, Copilot, specifically tailored for security professionals analyzing system logs and operational data. The tool now demonstrates unprecedented capabilities in parsing security event information, identifying anomalies, and accelerating incident response workflows…
Enabling Incognito Mode in RDP to Hide All the Traces
Microsoft’s Remote Desktop Protocol (RDP) has introduced a lesser-known but critical security feature colloquially referred to as “incognito mode” through its /public command-line parameter. This functionality, formally called public mode, prevents the client from storing sensitive session artifacts—a development with…
FBI Warns of Threats Actors Mimic as BianLian Group to Attack Corporate Executives
The Federal Bureau of Investigation (FBI) has issued an urgent alert regarding a sophisticated email-based extortion campaign targeting corporate executives, wherein threat actors impersonate the notorious BianLian ransomware group. The scam, first identified in early March 2025, involves physical letters…
Apache Pinot Vulnerability Let Remote Attackers Bypass Authentication
A critical security vulnerability in Apache Pinot designated CVE-2024-56325, has been disclosed. It allows unauthenticated, remote attackers to bypass authentication mechanisms and gain unauthorized access to sensitive systems. Researchers from the Knownsec 404 Team discovered the flaw and disclosed it…
Microsoft 365 Announces E5 Security for Business Premium Customers as Add-on
Microsoft has announced the immediate availability of Microsoft 365 E5 Security as a cost-effective add-on for Business Premium subscribers, marking a strategic expansion of enterprise-grade cybersecurity tools for small and medium businesses (SMBs). The release introduces enhanced threat detection, identity…
Cisco Secure Client for Windows Let Attackers Execute Arbitrary Code With SYSTEM Privileges
A newly identified vulnerability in the Cisco Secure Client for Windows could allow attackers to execute arbitrary code with SYSTEM privileges. The vulnerability lies within the interprocess communication (IPC) channel and can be exploited by an authenticated, local attacker to…
As an SOC/DFIR Team Member, How to Analyse Real-Time Linux Malware Network Traffic
Network traffic analysis has emerged as one of the most effective methods for detecting and investigating linux based malware infections . By scrutinizing communication patterns, security professionals can uncover signs of malicious activity, including command-and-control (C2) connections, data exfiltration, and…
Threat Actors Mimic Electronic Frontier Foundation To Attack Gaming Community
Cybersecurity researchers have uncovered a sophisticated campaign targeting the Albion Online gaming community through impersonation of the Electronic Frontier Foundation (EFF). The operation, discovered in early March 2025, leverages decoy documents designed to appear as official EFF communications while deploying…
As a SOC/DFIR Team Member, How to Analyse Real-Time Linux Malware Network Traffic
Network traffic analysis has emerged as one of the most effective methods for detecting and investigating linux based malware infections . By scrutinizing communication patterns, security professionals can uncover signs of malicious activity, including command-and-control (C2) connections, data exfiltration, and…
Misconfigured Apache Airflow Servers Exposes Login Credentials to Hackers
A critical security oversight in widely used Apache Airflow instances has exposed credentials for platforms like AWS, Slack, PayPal, and other services, leaving organizations vulnerable to data breaches and supply chain attacks. Researchers at Intezer discovered thousands of unprotected instances…
Sitecore 0-Day Vulnerability Let Attackers Execute Remote Code
A newly disclosed critical vulnerability in Sitecore Experience Platform (CVE-2025-27218) allows unauthenticated attackers to execute arbitrary code on unpatched systems. The flaw, rooted in insecure deserialization practices, affects Sitecore Experience Manager (XM) and Experience Platform (XP) versions 8.2 through 10.4…
Researchers Bypassed CrowdStrike Falcon Sensor to Execute Malicious Applications
Security researchers at SEC Consult have discovered a significant vulnerability in CrowdStrike’s Falcon Sensor that allowed attackers to bypass detection mechanisms and execute malicious applications. This vulnerability, dubbed “Sleeping Beauty,” was initially reported to CrowdStrike in late 2023 but was…
Two Hackers Arrested For ATM Jackpotting by Deploying Malware
Federal prosecutors unsealed criminal complaints today against David Jose Gomez Cegarra, 24, and Jesus Segundo Hernandez-Gil, 19, members of the Tren de Aragua Gang, for allegedly orchestrating a coordinated ATM “jackpotting” campaign across four U.S. states. The defendants face charges…
ZITADEL IDOR Vulnerabilities Let Attackers Modify Sensitive Settings
A critical Insecure Direct Object Reference (IDOR) vulnerability chain in ZITADEL’s administration interface (CVE-2025-27507) has exposed organizations to systemic risks of account takeover and configuration tampering. Rated 9.0/10 on the CVSS v3.1 scale, these flaws enable authenticated low-privilege users to…
Google Announces AI-Powered Scam Detector For Android Users
In its latest Android security update, Google has unveiled a dual-layer defense system combining AI-powered scam detection for both text messages and voice calls. The new features, powered by Gemini Nano AI models operating entirely on-device, aim to combat the…
LibreOffice Vulnerability Let Attackers Execute Arbitrary Script Using Macro URL
A critical security vulnerability in LibreOffice tracked as CVE-2025-1080, has exposed millions of users to potential remote code execution attacks through manipulated macro URLs. Patched in versions 24.8.5 and 25.2.1 released on March 4, 2025, this flaw allowed attackers to…
Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code
Elastic has issued an urgent security advisory for a critical vulnerability in Kibana, tracked as CVE-2025-25012, that allows authenticated attackers to execute arbitrary code on affected systems. The flaw, rated 9.9 on the CVSS v3.1 scale, stems from a prototype…
Google Silently Tracks Android Device Even No Apps Opened by User
Google collects and stores significant amounts of user data on Android devices, even when users haven’t opened any Google apps. The study by Professor D.J. Leith from Trinity College Dublin, documents for the first time how pre-installed Google apps silently…
Android App With 220,000+ Downloads From Google Play Installs Banking Trojan
A sophisticated Android banking trojan campaign leveraging a malicious file manager application accumulated over 220,000 downloads on the Google Play Store before its removal. Dubbed Anatsa (also known as TeaBot), the malware targets global financial institutions through a multi-stage infection…
SecP0 Ransomware Group Threatens Organizations to Leak Vulnerability Details
A new ransomware group, SecP0, has emerged on the cybercrime landscape, adopting a novel and deeply concerning tactic: demanding ransom payments not for encrypted data, but for undisclosed software vulnerabilities. This shift in strategy represents a significant evolution in ransomware…
Two Hackers Arrested for Stealing Taylor Swift Era Concert Tickets Worth $600k
In a sophisticated cybercrime operation targeting high-demand events, two individuals were arrested this week for allegedly orchestrating a $600,000 ticket theft scheme involving Taylor Swift’s Eras Tour and other major concerts. Queens District Attorney Melinda Katz revealed that Tyrone Rose,…
Google Announces GoStringUngarbler Tool to Decrypt Go Based Malware
In a landmark development for cybersecurity infrastructure, Google’s Mandiant subsidiary has unveiled GoStringUngarbler – an open-source deobfuscation framework designed to neutralize advanced string encryption techniques in Go-based malware. This innovation specifically targets binaries obfuscated using garble, an increasingly prevalent obfuscation…
15 Best Patch Management Tools In 2025
Patch management tools are essential for maintaining the security and efficiency of IT systems in 2025. These tools automate the process of identifying, testing, and deploying software updates and security patches across various operating systems and applications. Top contenders in…
50 World’s Best Cyber Security Companies – 2025
Cybersecurity has transformed from a niche technical field into a critical business priority that shapes organizational strategies worldwide. As we navigate through 2025, the cybersecurity industry continues to expand in response to increasingly sophisticated threats, digital transformation initiatives, and regulatory requirements. The global cybersecurity market is…
12 Chinese Hackers Charged For Cyber Attacks on U.S Treasury
The U.S. Department of Justice (DOJ) unsealed indictments today against 12 Chinese nationals linked to state-sponsored cyber espionage campaigns targeting the U.S. Treasury Department, religious organizations, media outlets, and critical infrastructure. The charges reveal an extensive, decade-long operation leveraging advanced…
Bybit Hot Wallet Exploit for Malicious Transaction – Technical Analysis Released
Researchers uncovered one of the most technically sophisticated attacks in cryptocurrency history, exploiting Bybit’s Ethereum hot wallet infrastructure through a malicious proxy contract upgrade. The breach, attributed to North Korea’s Lazarus Group via blockchain fingerprinting, resulted in the theft of…
41,500+ VMware ESXi Instances Vulnerable to Code Execution Attacks
Shadowserver observed that 41,500+ internet-exposed VMware ESXi hypervisors as of March 4, 2025, are vulnerable to CVE-2025-22224, a critical zero-day vulnerability actively exploited in attacks. Broadcom patched the vulnerability in an emergency update. It enables attackers with local administrative access…
BadBox Malware from Google Play Hacked 50,000+ Android Devices Using 24 Apps
HUMAN Security’s Satori Threat Intelligence team has uncovered a sophisticated malware operation dubbed “BADBOX 2.0” that compromised over 50,000 Android devices using 24 deceptive applications. This operation represents a major expansion of the original BADBOX campaign first identified in 2023,…
Microsoft To Harden The Trust Boundary of VBS Enclaves
Microsoft has recently published comprehensive guidance for developers working with Virtualization-Based Security (VBS) enclaves, highlighting critical security measures to strengthen the trust boundary between different virtual trust levels. The guidance by the Microsoft Security team, addresses fundamental security challenges that…
Microsoft Warns of Silk Typhoon Hackers Attacking IT Supply Chain
Microsoft Threat Intelligence has identified a significant shift in tactics by Silk Typhoon, a Chinese state-sponsored espionage group that has begun targeting common IT solutions including remote management tools and cloud applications to gain initial access to organizational networks. This…
Hackers Leveraging Business Relationship To Attack Arab Emirates Aviation Sector
Security researchers at Proofpoint have uncovered a sophisticated cyber espionage campaign targeting aviation and satellite communications organizations in the United Arab Emirates. The campaign, attributed to a threat actor tracked as UNK_CraftyCamel, leveraged a compromised Indian electronics company to deliver…
Cisco Webex for BroadWorks Vulnerability Let Remote Attackers Access Data & Credentials
A newly disclosed vulnerability in Cisco Webex for BroadWorks Release 45.2 enables remote attackers to intercept sensitive credentials and user data when Session Initiation Protocol (SIP) communications lack encryption. This vulnerability, rated as low severity but with significant operational implications,…
WordPress Plugin Vulnerability Exposes 10,000 Sites to Code Execution Attacks
A critical security flaw in the GiveWP Donation Plugin tracked as CVE-2025-0912, has exposed over 100,000 WordPress websites to unauthenticated remote code execution (RCE) attacks. The vulnerability, scoring a maximum CVSS 9.8 (Critical) severity rating, originates from improper handling of…
U.S Treasury Sanctions Admin of Nemesis Darknet Marketplace
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sweeping sanctions today against Behrouz Parsarad, an Iran-based cybercriminal identified as the sole administrator of the Nemesis darknet marketplace. This move marks OFAC’s first recognition as a…
CISA Warns of Actively Exploited VMware Vulnerabilities, Urges Immediate Patching
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert on March 4, 2025, adding three critical VMware vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following confirmed in-the-wild exploitation. The vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 allow attackers…
Microsoft To Remove DES Encryption from Windows 11 24H2 & Windows Server 2025
Microsoft has announced plans to enhance security measures by removing the Data Encryption Standard (DES) encryption algorithm from Kerberos authentication in upcoming Windows releases. This security change will affect Windows Server 2025 and Windows 11 version 24H2 computers after they…
Vim Editor Vulnerability Exploited Via TAR Files to Trigger Code Execution
The Vim text editor vulnerability CVE-2025-27423 is a high-severity issue that allows for arbitrary code execution via malicious TAR archives. Affecting Vim versions prior to 9.1.1164, this flaw in the bundled tar.vim plugin exposes users to potential command injection attacks…
Telegram EvilVideo Vulnerability Exploited to Execute Malicious Code on Victim Device
A critical evolution of the CVE-2024-7014 vulnerability, originally patched in July 2024, has resurfaced with updated tactics to bypass security measures. Dubbed Evilloader, this new exploit leverages Telegram’s multimedia handling mechanisms to execute malicious JavaScript code by disguising .htm files…
NVIDIA Warns of Multiple Vulnerabilities that Let Attackers Execute Malicious Code
NVIDIA has issued urgent security advisories addressing multiple vulnerabilities in its Hopper HGX 8-GPU High-Performance Computing (HMC) platforms, including a high-severity flaw (CVE-2024-0114, CVSS 8.1) that permits unauthorized code execution, privilege escalation, and systemic data compromise. A secondary medium-severity vulnerability…
Zoho ADSelfService Plus Vulnerability Let Attackers Gain Unauthorized Access
Zoho has patched a high-severity vulnerability (CVE-2025-1723) in its ADSelfService Plus software, a widely used self-service password management and single sign-on solution. The flaw, discovered in builds 6510 and earlier, could enable attackers to bypass authentication safeguards and access sensitive…
HPE Remote Support Tool Vulnerability Let Attackers Execute Arbitrary code – PoC Released
A newly disclosed vulnerability in Hewlett Packard Enterprise’s (HPE) Insight Remote Support tool enables unauthenticated attackers to execute arbitrary code on vulnerable systems, with proof-of-concept (PoC) exploit code now publicly available. Tracked as CVE-2024-53676, this critical remote code execution (RCE)…
GrassCall Malware Attacking Job Seekers To Steal Login Credentials
A sophisticated malware campaign named “GrassCall” was detected that specifically targets job seekers through deceptive tactics. The campaign, attributed to the threat group known as Crazy Evil, has been actively exploiting job hunters’ vulnerability by luring them with fake employment…
Researchers Detailed APT28’s HTA Trojan Multi-Layer Obfuscation Techniques
A security researcher known as “Seeker” has published an in-depth analysis of advanced obfuscation techniques employed by APT28, a threat actor known for sophisticated cyber espionage operations. The report provides a comprehensive examination of a heavily obfuscated HTA Trojan used…
Chrome 134 Released, Fixes 14 Vulnerabilities That Could Crash the Browser
Google has rolled out Chrome 134 to the stable channel, delivering critical security updates that resolve 14 vulnerabilities, including high-severity flaws that could enable browser crashes, data leaks, or arbitrary code execution. The update (versions 134.0.6998.35 for Linux, 134.0.6998.35/36 for…
AV Detection & Anti-Malware Scans Bypassed Using Red Team Tool SpecterInsight
A new report published recently, details how red team operators can use SpecterInsight 4.2.0 to successfully bypass Windows Defender and other antivirus solutions. The technique allows threat actors to evade detection while loading malicious .NET payloads into memory, presenting significant…
Windows KDC Proxy RCE Vulnerability Let Attackers Control The Server Remotely – Technical Analysis
Security researchers have uncovered a significant remote code execution vulnerability in Microsoft’s Windows Key Distribution Center (KDC) Proxy that could potentially allow attackers to gain complete control over affected servers. The vulnerability, tracked as CVE-2024-43639, stems from an integer overflow…
49,000+ Access Management Systems Worldwide Configured With Massive Security Gaps
Dutch IT security consultancy Modat has uncovered alarming security vulnerabilities in approximately 49,000 access management systems (AMS) deployed worldwide. These systems, designed to control building access through authentication methods like passwords, biometrics, and multi-factor authentication, have been found to contain…
Hackers Deliver XWorm via Malicious Registry Files in a New Stegocampaign Attack
Stegoсampaign, a complex attack that leverages phishing, a multi-functional RAT, а loader, and malicious scripts, got a new twist. ANY.RUN’s malware analysts discovered a Stegocampaign variant that uses a Windows registry file to add a malicious script to Autorun. While…
Hackers Hijacking Access to Cloud-based AI Models With Exposed Keys in 19 Minutes
New research reveals that threat actors are exploiting exposed cloud credentials to hijack enterprise AI systems within minutes of credential leakage. Recent incidents have demonstrated that attackers can compromise large language model (LLM) infrastructure in under 19 minutes. Dubbed LLMjacking,…
Google, Meta and Apple Fuel the World’s Largest Surveillance Machine
The exponential growth of government data requests to technology giants has transformed Silicon Valley into the backbone of modern surveillance infrastructure. Between 2014 and 2024, Apple, Google, and Meta collectively disclosed data from 3.16 million user accounts to U.S. authorities,…
U.S. Seizes $31 Million Funds Drained from Crypto Exchange
U.S. law enforcement announced the recovery of $31 million in cryptocurrency tied to the 2021 Uranium Finance exploit, marking one of the largest DeFi-related asset seizures. The operation, spearheaded by the Southern District of New York (SDNY) and Homeland Security…
Tata Technologies Allegedly Breached – Huntress Claim Leak of Sensitive data
Indian multinational tech giant Tata Technologies, a subsidiary of Tata Motors, is in the spotlight following allegations by ransomware group Hunters International of a major data breach. According to Huntress Group, the claim resulted in the theft of 1.4 TB…
VMware ESXi Vulnerabilities Exploited in Wild to Execute Malicious Code
VMware has issued a critical security advisory (VMSA-2025-0004) warning of active exploitation of three vulnerabilities in its ESXi, Workstation, and Fusion products. These flaws, CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, allow attackers to execute malicious code, escalate privileges, and leak sensitive memory…
New Android RAT Dubbed “AndroRAT” Attacking to Steal Pattern, PIN & Passcodes
A newly identified variant of the Android Remote Access Tool (RAT), AndroRAT, has emerged as a critical cybersecurity threat, leveraging sophisticated techniques to steal device unlock patterns, PINs, and passcodes. The malware, first documented in 2012 as an open-source university…
Docusnap for Windows Vulnerability Let Attackers Access Sensitive Data
A critical information disclosure vulnerability in Docusnap, a widely used IT inventory management solution, allows attackers to decrypt sensitive system data collected from Windows hosts. Designated as CVE-2025-26849, the flaw stems from the use of a static encryption key to…
Hackers Attacking 4000+ ISPs With New Malware for Remote Access
Researchers from Splunk have identified a sophisticated malware campaign targeting over 4,000 Internet Service Providers (ISPs) primarily located on the West Coast of the United States and in China. The campaign, which originated from Eastern Europe, uses a combination of…
CISA Warns of Windows Win32k Vulnerability Exploited to Run Arbitrary code
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding CVE-2018-8639, a privilege escalation vulnerability in the Microsoft Windows Win32k component, which threat actors are actively exploiting to execute arbitrary code in kernel mode. Added to CISA’s Known…
33.3 Million Cyber Attacks Targeted Mobile Devices In 2024, Keep Your Devices Safe!
A staggering 33.3 million attacks involving malware, adware, and unwanted mobile software were prevented throughout 2024. This alarming figure translates to an average of 2.8 million attempted attacks per month, highlighting the persistent and evolving threat landscape facing mobile device…
IBM Storage Virtualize Vulnerabilities Let Attackers Execute Arbitrary Code
IBM has issued urgent security advisories for two high-severity vulnerabilities (CVE-2025-0159, CVE-2025-0160) affecting its Storage Virtualize product suite, including SAN Volume Controller, Storwize, and FlashSystem families. These flaws enable attackers to bypass authentication and execute arbitrary code remotely via the…