Hackers are increasingly leveraging cloud platforms like Amazon Web Services (AWS) and Microsoft Azure to orchestrate large-scale cyber attacks. These platforms, which host critical infrastructure for businesses worldwide, are being exploited through sophisticated methods, including fraudulent account setups, API key…
Tag: Cyber Security News
New Phishing Attack Hijacking High-Profile X Accounts To Promote Phishing Sites
A sophisticated phishing campaign has emerged, targeting high-profile X (formerly Twitter) accounts to promote fraudulent cryptocurrency schemes. The attack exploits the credibility of verified accounts, leveraging their reach to deceive users into visiting phishing sites. The attackers employ a variety…
Alibaba Cloud Storage Service Vulnerability Allows Unauthorized Data Uploads
A significant security vulnerability has been discovered in Alibaba Cloud Object Storage Service (OSS), enabling unauthorized users to upload data to cloud storage. This misconfiguration poses risks such as unauthorized data storage, overwriting sensitive files, and potential data breaches. The…
NVIDIA GPU Display Driver Vulnerability Lets Attackers Steal Files Remotely – Update Now
NVIDIA has released a critical software security update to address multiple vulnerabilities affecting its GPU Display Driver and Virtual GPU (vGPU) software. Among these is CVE‑2024‑0149, a vulnerability in the NVIDIA GPU Display Driver for Linux that could allow attackers unauthorized…
Linux 6.14 Released – 500,000 Lines of Code Modified
Linus Torvalds, the creator of the Linux kernel, has announced the release of Linux 6.14-rc1, marking the end of the two-week merge window. This release is notably smaller than usual, attributed to reduced development activity during the holiday season. Despite…
U.S Community Health Center Hacked – 1 Million Patients Data Stolen
Community Health Center, Inc. (CHC), a Connecticut-based federally qualified health center, has disclosed a data breach following a criminal cyberattack on its systems. The breach potentially exposed the sensitive personal and health information of patients and individuals who received COVID-19…
APT37 Hackers Abusing Group Chats To Attack Via Malicious LNK File
The North Korean state-sponsored hacking group APT37 (aka ScarCruft, Reaper), has been identified leveraging group chat platforms to distribute malicious LNK files. This latest tactic highlights the group’s evolving methods to infiltrate systems and exfiltrate sensitive data. APT37’s recent campaign…
Parrot 6.3 Released With Improved Security & New Hacking Tools
ParrotOS, the cybersecurity-focused Linux distribution, has recently released its latest update, Parrot 6.3, which includes a number of new features, performance improvements, and updated tools to enhance the user experience. This release is designed to make ParrotOS faster, more stable,…
5 Best Infrastructure as Code (IaC) Vulnerability Scanning Tools in 2025
As organizations increasingly adopt Infrastructure as Code (IaC) to automate and manage their cloud environments, ensuring the security of these configurations has become a critical priority. IaC allows teams to define infrastructure using code, enabling rapid deployment and scalability, but…
Devil-Traff – New Malicious Bulk SMS Portal That Fuels Phishing Attacks
A new threat to cybersecurity has emerged in the form of Devil-Traff, a bulk SMS platform designed to facilitate large-scale phishing campaigns. Leveraging advanced features such as sender ID spoofing, API integration, and support for malicious content, this platform has…
10 Best Web Application Firewall (WAF) – 2025
A Web Application Firewall (WAF) is a security solution designed to protect web applications by monitoring, filtering, and blocking malicious HTTP/S traffic. Operating at the OSI model’s application layer (Layer 7), a WAF acts as a reverse proxy between users…
New Windows 11 (x64) Modern Kernel Race Conditions Uncovered – PoC Released
A sophisticated race condition vulnerability affecting Windows 11 (x64) kernel operations, highlighting ongoing concerns about kernel-level security in modern operating systems. These race conditions, which stem from the operating system’s inability to synchronize shared resources during concurrent operations properly, could…
New Process Hollowing Attack Vectors Uncovered in Windows 11 (24H2)
The recent release of Windows 11 version 24H2 has introduced a range of new features and updates, but it has also raised significant cybersecurity concerns. A longstanding malware technique known as Process Hollowing or RunPE has encountered compatibility issues on…
Weekly Cybersecurity Update: Recent Cyber Attacks, Vulnerabilities, and Data Breaches
Welcome to this week’s Cybersecurity Newsletter, which presents the latest updates and key insights from the continuously evolving domain of cybersecurity. In the fast-paced digital environment of today, it is imperative to remain informed, and our objective is to provide…
National Change Your Password Day! – CISA Recommends to Enable MFA
February 1 marks National Change Your Password Day, a timely initiative to combat escalating cyber risks by promoting stronger password practices. With hacking incidents surging globally, the Cybersecurity and Infrastructure Security Agency (CISA) emphasizes the critical role of multi-factor authentication (MFA) in safeguarding digital accounts. Despite annual reminders to update…
WantToCry Ransomware Exploits SMB Vulnerabilities to Remotely Encrypts NAS Drives
The notorious WantToCry ransomware group leverages misconfigured Server Message Block (SMB) services to infiltrate networks and launch widespread attacks. The weaknesses in SMBs, such as weak credentials, outdated software, and poor security configurations, are providing attackers with an easy entry…
Israeli Firm Paragon Attack WhatsApp With New Zero-Click Spyware
WhatsApp revealed on Friday that a “zero-click” spyware attack, attributed to the Israeli firm Paragon, has targeted scores of users worldwide, including journalists and members of civil society. The spyware targeted nearly 100 WhatsApp users, including journalists, and did not…
WhatsApp New Privacy Let Users Control who Can See The Profile Photo
In a move to enhance user privacy, WhatsApp has rolled out a significant update allowing users to control who can view their profile photos. This feature, available on both iOS and Android devices, provides users with more granular control over…
Google Has Blocked 2.28 Million Malicious Apps Entering Into Play Store
Google announced today it blocked a record 2.28 million policy-violating apps from entering the Play Store in 2023, leveraging advanced machine learning, stricter developer vetting, and cross-industry collaborations to combat evolving cyberthreats. The milestone underscores efforts to uphold its SAFE…
New Threat Hunting Technique to Uncover Malicious Infrastructure Using SSL History
As internet security evolves, SSL (Secure Sockets Layer) certificates, cornerstones of encrypted communication, are stepping into a brand-new role as vital tools in the fight against cyberattacks. Experts are now leveraging SSL intelligence and historical SSL data to expose hidden…
SSL Intelligence – New Threat Hunting Technique to Uncover Malicious Infrastructure Using SSL History
As internet security evolves, SSL (Secure Sockets Layer) certificates, cornerstones of encrypted communication, are stepping into a brand-new role as vital tools in the fight against cyberattacks. Experts are now leveraging SSL intelligence and historical SSL data to expose hidden…
TAG-124 Hacked 1000+ WordPress Sites To Embed Payloads
A sophisticated cyber campaign orchestrated by the threat group TAG-124 has compromised over 1,000 WordPress websites to deploy malicious payloads. The operation leverages a multi-layered Traffic Distribution System (TDS) to infect users with malware, demonstrating advanced evasion tactics and infrastructure…
Hackers Abusing GitHub Infrastructure to Deliver Lumma Stealer
Cybersecurity researchers have uncovered a sophisticated campaign leveraging GitHub’s trusted release infrastructure to distribute the Lumma Stealer malware. This information-stealing malware, part of a growing trend of cybercriminals abusing legitimate platforms, poses significant risks by exfiltrating sensitive data and deploying…
New York Blood Center Hit By Ransomware Attack – IT Systems Affected
The New York Blood Center Enterprises (NYBC), a vital organization responsible for supplying blood and blood products to hospitals across the region, has fallen victim to a ransomware attack. The incident has significantly disrupted its IT systems, forcing the organization…
DeepSeek’s Growing Influence Sparks a Surge in Frauds and Phishing Attacks
The rapid rise of DeepSeek, a Chinese artificial intelligence (AI) company, has not only disrupted the AI industry but also attracted the attention of cybercriminals. As its AI Assistant app became the most downloaded free app on the iOS App…
GitHub Copilot Jailbreak Vulnerability Let Attackers Train Malicious Models
Researchers have uncovered two critical vulnerabilities in GitHub Copilot, Microsoft’s AI-powered coding assistant, that expose systemic weaknesses in enterprise AI tools. The flaws—dubbed “Affirmation Jailbreak” and “Proxy Hijack”—allow attackers to bypass ethical safeguards, manipulate model behavior, and even hijack access…
Coyote Banking Malware Weaponizing Windows LNK Files To Execute Malicious Scripts
A new wave of cyberattacks leveraging the Coyote Banking Trojan has been identified, targeting financial institutions in Brazil. This sophisticated malware employs malicious Windows LNK (shortcut) files as an entry point to execute PowerShell scripts, enabling multi-stage infection chains that…
Cisco’s Webex Chat Vulnerabilities Let Attackers Access Organizations Chat Histories
Cisco’s Webex Chat (formerly known as IMI Chat) was found to have a significant security flaw that exposed the sensitive chat histories of hundreds to thousands of organizations. The exploit allowed unauthorized attackers to access millions of live customer support…
Malware Found in Healthcare Patient Monitors Linked to Chinese IP Address
A critical cybersecurity vulnerability has been uncovered in Contec CMS8000 patient monitors, revealing embedded malware that poses significant risks to patient safety and data security. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that the devices include a backdoor…
Authorities Take Down Cracked & Nulled Hacking Forums Used by 10 Million Users
In a law enforcement operation dubbed “Operation Talent,” an international coalition of law enforcement agencies led by Germany’s Bundeskriminalamt (BKA) and Europol has dismantled two of the world’s largest cybercrime forums: Cracked.io and Nulled.to. These platforms, which collectively hosted over…
D-Link Routers Vulnerability Let Attackers Gain Full Router Control Remotely
A critical unauthenticated Remote Code Execution (RCE) vulnerability has been affecting DSL-3788 routers, allowing attackers to acquire complete control over the router remotely. The flaw has been detected in firmware versions v1.01R1B036_EU_EN and below. This vulnerability was reported by Max…
Microsoft to Boost M365 Bounty Program With New Products & Rewards Up to $27,000
A significant extension of Microsoft’s Microsoft 365 (M365) Bounty Program has been announced. The program now includes new Viva products under its scope for identifying vulnerabilities, with rewards reaching up to $27,000 for critical submissions. This update underscores Microsoft’s commitment…
VMware Aria Operations Vulnerabilities Let Attackers Perform Admin Operations
Broadcom has addressed multiple vulnerabilities in its VMware Aria Operations for Logs and VMware Aria Operations products. These vulnerabilities, identified as CVE-2025-22218, CVE-2025-22219, CVE-2025-22220, CVE-2025-22221, and CVE-2025-22222, pose significant risks, including unauthorized access to sensitive data and privilege escalation. The…
Windows Vulnerability in COM Objects Trigger RCE To Control The Systems Remotely
James Forshaw of Google Project Zero has shed light on a significant security vulnerability in Windows related to accessing trapped COM objects through the IDispatch interface. This research highlights an intriguing bug class that exploits cross-process communication features in object-oriented…
New Jailbreak Techniques Expose DeepSeek LLM Vulnerabilities, Enabling Malicious Exploits
Recent revelations have exposed critical vulnerabilities in DeepSeek’s large language models (LLMs), particularly DeepSeek-R1, through advanced jailbreaking techniques. These exploits, including “Bad Likert Judge,” “Crescendo,” and “Deceptive Delight,” have demonstrated the ease with which malicious actors can bypass safety measures…
Tata Technologies Hacked – Ransomware Attack Compromises IT Systems
In a recent disclosure to the stock exchanges, Tata Technologies Limited announced that it has been the victim of a ransomware attack affecting some of its IT assets. Tata Technologies, headquartered in Pune, India, is a subsidiary of the Tata…
ChatGPT-4o Jailbreak Vulnerability “Time Bandit” Let Attackers Create Malware
A new jailbreak vulnerability in OpenAI’s ChatGPT-4o, dubbed “Time Bandit,” has been exploited to bypass the chatbot’s built-in safety functions. This vulnerability allows attackers to manipulate the chatbot into producing illicit or dangerous content, including instructions for malware creation, phishing…
Tor Project X Account Hacked to Promote Cryptocurrency Scheme
The Tor Project, a renowned organization dedicated to online privacy and anonymity, has fallen victim to a cyberattack. On January 30, 2025, the group’s official X (formerly Twitter) account was compromised and used to promote a fraudulent cryptocurrency scheme. The…
Tria Stealer Trojan Exploits Android Phones To Exfiltrate SMS Messages
A newly discovered Android malware campaign, dubbed Tria Stealer, has been targeting users in Malaysia and Brunei since mid-2024. Leveraging fake wedding invitations as a lure, this Trojan steals sensitive data, including SMS messages, call logs, and app notifications, and…
Phorpiex Botnet Distributes LockBit Ransomware Through Compromised Websites
Cybersecurity experts have uncovered the use of the Phorpiex botnet to distribute LockBit Black ransomware (LockBit 3.0) through millions of phishing emails and compromised websites. This campaign, active since April 2024, marks a significant evolution in ransomware delivery methods, leveraging…
Top 3 Most Popular Malware TTPs of the Past Year
Cyber threats evolve rapidly, but some tactics stand out for their widespread use and effectiveness. In its latest 2024 trends report, ANY.RUN identified the top malware Tactics, Techniques, and Procedures (TTPs) employed by cyber attackers for malicious purposes. Let’s dive…
Arcus Media Ransomware Delete Backup, Clear Logs, Disable Remote After Lock The Files
The Arcus Media ransomware has emerged as a significant cybersecurity threat, employing advanced techniques to maximize disruption and hinder recovery efforts. Operating under a Ransomware-as-a-Service (RaaS) model, the group has targeted industries worldwide, including business services, retail, and media, since…
New Android Malware Exploiting Wedding Invitations to Steal Victims WhatsApp Messages
A sophisticated Android malware campaign, dubbed Tria Stealer, has been targeting users in Malaysia and Brunei since mid-2024. The malware uses fake wedding invitations as a lure to trick victims into installing a malicious Android Package Kit (APK). Once installed,…
Canon Printer Vulnerabilities Let Attackers Execute Arbitrary Code Remotely
Multiple critical security vulnerabilities affecting Canon Laser Printers and Small Office Multifunctional Printers. These vulnerabilities, identified as buffer overflow flaws, could allow attackers to execute arbitrary code remotely or render the devices inoperative through Denial-of-Service (DoS) attacks. The affected models…
Windows 11 Start Menu Now Let Users Access Their Android & iPhones
Microsoft has unveiled a significant update to Windows 11, enhancing the Start menu with seamless integration for both Android and iPhone devices. This feature, previously exclusive to Android users, now extends to iPhone owners, allowing them to access their phone’s…
Hackers Exploit Public-facing Vulnerable IIS, Apache, SQL Servers to Attack Gov & Telcom Networks
A sophisticated cyberespionage campaign, tracked as CL-STA-0048, has been identified targeting government and telecommunications networks in South Asia. The attackers exploited vulnerabilities in public-facing servers running Microsoft IIS, Apache Tomcat, and MSSQL to gain unauthorized access and exfiltrate sensitive data.…
North Korean APT Lazarus Compromises Developers via Malicious NPM Packages
The North Korean state-sponsored hacking group Lazarus has been implicated in a sophisticated supply chain attack targeting developers through malicious Node Package Manager (NPM) packages. Security researchers have identified the package, postcss-optimizer, as a key vector for delivering malware to…
Hackers Use 10,000 WordPress Sites To Deliver Malware To macOS and Microsoft Systems
A sophisticated cyberattack has compromised over 10,000 WordPress websites, delivering cross-platform malware to unsuspecting users. The campaign exploits outdated WordPress versions and plugins, redirecting visitors to fake browser update pages that deploy malicious software targeting both macOS and Windows systems.…
Hackers Poisoning DNS Responses to Exploit Vulnerabilities in Active Directory Environments
A new implementation of Kerberos relaying over HTTP has been unveiled, leveraging multicast poisoning to exploit vulnerabilities in Active Directory environments. The research, published by Quentin Roland, builds on previous work by cybersecurity expert James Forshaw, demonstrating how attackers can…
Lazarus Hackers Altering Legitimate Software Packages To Launch Large-Scale Cyber Attack
The notorious Lazarus Group, a North Korean state-sponsored Advanced Persistent Threat (APT), has been implicated in a large-scale cyberattack campaign dubbed “Operation Phantom Circuit.” This operation involves embedding malicious backdoors into legitimate software packages, targeting developers and organizations worldwide. The…
New SystemBC RAT Attack Linux Systems to Hack Corporate Infrastructure
A new variant of the SystemBC Remote Access Trojan (RAT) has emerged, explicitly targeting Linux-based systems. Known for its stealth capabilities, this malware is designed to infiltrate corporate networks, cloud servers, and IoT devices, posing a significant threat to internal…
DeepSeek AI is Now Powering With Huawei Ascend 910C Chip
DeepSeek AI has announced that its latest AI model, DeepSeek R1, now relies on Huawei’s Ascend 910C chip for inference tasks in a bold move that could ripple through the tech industry. This shift comes after the model was initially…
Critical RCE Vulnerability Found In AI Development Platform Lets Attackers Gain Root Access
A critical Remote Code Execution (RCE) vulnerability was discovered in the Lightning AI platform, a widely used tool for AI development. The flaw, which has since been patched, allowed attackers to gain root access by exploiting a hidden URL parameter.…
TeamViewer Windows App Let Attackers Escalate Privileges to System User
A critical security vulnerability has been identified in TeamViewer Clients for Windows, allowing attackers with local access to escalate their privileges to the system level. The flaw, tracked as CVE-2025-0065, affects versions of TeamViewer Full Client and Host prior to…
OPNsense 25.1 Released With Improved Security Zones & FreeBSD 14.2 Plus
OPNsense, the widely recognized open-source firewall and routing platform, celebrates its 10th anniversary with the release of version 25.1, codenamed “Ultimate Unicorn.” This milestone release introduces significant upgrades, including enhanced security zone configurations, a redesigned user interface, and the integration…
DeepSeek is Now Available With Microsoft Azure AI Foundry & GitHub
Microsoft has officially announced the integration of DeepSeek R1, an AI model, into its Azure AI Foundry platform and GitHub. This move positions DeepSeek R1 among over 1,800 models, including frontier, open-source, and task-specific AI solutions. The integration aims to…
Hackers Exploit RDP Protocol To Gain Windows Access To Control Browser Remotely
Cybercriminals have been exploiting vulnerabilities in the Remote Desktop Protocol (RDP) to gain unauthorized access to Windows systems and remotely control web browsers. This method not only compromises individual machines but also poses a significant threat to enterprise networks. RDP,…
Google’s Subdomain ‘g.co’ Hacked – A Tricky Phone Call Lets Hackers Access Your Google Account Remotely
Cybercriminals recently exploited Google’s g.co subdomain to carry out a meticulously crafted scam over a vishing call. The incident was chronicled by Zach Latta, founder of Hack Club, who nearly fell victim to the attack. His account sheds light on…
Threat Actors Exploit Government Website Vulnerabilities For Phishing Attacks
Cybercriminals are increasingly exploiting vulnerabilities in government websites to carry out phishing campaigns, leveraging the inherent trust users place in official domains. A recent report by Cofense Intelligence shows that how attackers are weaponizing .gov top-level domains (TLDs) across multiple…
DeepSeek Database Leaked – Full Control Over DB Secret keys, Logs & Chat History Exposed
A security vulnerability in DeepSeek, a prominent Chinese AI startup, exposed a publicly accessible ClickHouse database containing highly sensitive information, including over a million lines of log streams. The breach, which included chat logs, API keys, backend details, and operational…
Microsoft 365 Down – Widespread Outage Affects Users and Admins
Microsoft 365 users worldwide encountered significant disruptions today as multiple services, including the Microsoft 365 Admin Center, reported degradation or complete inaccessibility. The issue, first noted around 18:45 GMT, has left many users unable to access key services, with some…
Hackers Allegedly Selling Fortinet Vulnerability Exploit on Dark Web Forums
A significant cybersecurity threat has emerged as hackers on a prominent Russian dark web forum claim to be selling an active exploit targeting Fortinet devices. The exploit reportedly leverages a critical vulnerability, CVE-2024-55591, which affects FortiOS versions 7.0.0 through 7.0.16. …
Apple Chips Vulnerability Exposes Credit Cards & Location History to Hackers
Researchers have uncovered two critical vulnerabilities in Apple’s custom silicon chips, dubbed SLAP (Speculative Load Address Prediction) and FLOP (False Load Output Predictions). These flaws, found in Apple’s A- and M-series processors, expose sensitive user data such as credit card…
State-sponsored Actors Abusing Gemini to Fuel Cyber Attacks
The state-sponsored threat actors are increasingly exploiting Google’s AI-powered assistant, Gemini, to enhance their cyber operations. While generative AI tools like Gemini hold immense potential for innovation and productivity, their misuse by advanced persistent threat (APT) groups and information operations…
Windows 11 24H2 Update Breaks Web camera, Audio, & USB
The most recent update for Windows 11 24H2, identified as KB5050009, has caused various kinds of technical issues for users, affecting critical functionalities like audio, Bluetooth, USB devices, and webcams. Released earlier this month, the update was intended to enhance…
WhatsApp’s Image “View Once” Feature Flaw Allowing Unlimited Views
WhatsApp’s “View Once” option is one of the privacy features in the instant messaging space that is intended to provide users with a sense of security. This feature allows users to send photos or videos that disappear after being viewed…
Google Researchers Breakdowns The Malware Obfuscator Scatterbrain
Google’s Threat Intelligence Group (GTIG), in collaboration with Mandiant, has unveiled a comprehensive analysis of ScatterBrain, an advanced obfuscation tool used by China-linked cyber espionage group APT41. This obfuscator is central to the deployment of POISONPLUG.SHADOW, a modular backdoor targeting…
Hackers Using SparkRAT In Wild To Attack Windows, macOS, and Linux Systems
Cybersecurity researchers have uncovered a surge in attacks leveraging SparkRAT, a cross-platform Remote Access Trojan (RAT) written in GoLang. This open-source tool, initially released on GitHub in 2022, has become a favorite among hackers due to its modular design, multi-platform…
Hellcat Ransomware Attacking Organization In Raas Model With Affiliates
A significant threat in the cybersecurity landscape has emerged, dubbed Hellcat, a new ransomware group. This ransomware group leverages a Ransomware-as-a-Service (RaaS) model to target critical sectors such as government, education, and energy. First identified in mid-2024, Hellcat operates by…
FleshStealer, A New Infostealer Attacking Chrome & Mozilla Users
A new strain of information-stealing malware, dubbed FleshStealer, has emerged as a significant threat to internet users worldwide. This advanced infostealer targets Chromium and Mozilla-based web browsers, exploiting their vulnerabilities to steal sensitive data, including credentials, cryptocurrency wallet information, and…
PoC Exploit Released for Actively Exploited Windows CLFS Buffer Overflow
A proof-of-concept (PoC) exploit for the actively exploited Windows Common Log File System (CLFS) vulnerability, tracked as CVE-2024-49138 has been released. This vulnerability, which Microsoft patched on December 10, 2024, with update KB5048685 for Windows 11 versions 23H2 and 22H2,…
API Vulnerabilities Surge 1,025%, Threatening AI Security (PDF)
Wallarm’s 2025 API ThreatStats Report exposes a startling rise in AI-focused attacks, with researchers tracking 439 AI-related CVEs in 2024—a 1,025% jump over the previous year. Almost all of these exploits 99% involve weak or poorly configured APIs. Injection flaws,…
New Aquabot Malware Attacking Mitel SIP To Inject Commands
A new variant of the Mirai-based malware, dubbed Aquabotv3, has been identified by the Akamai Security Intelligence and Response Team (SIRT). This malware is actively exploiting a command injection vulnerability in Mitel SIP phones to execute malicious commands and propagate…
Lynx Ransomware Infrastructure To Attack Windows, Linux, ESXi & Affiliate Panel Uncovered
Security experts has uncovered the sophisticated infrastructure of the Lynx Ransomware-as-a-Service (RaaS) group in a recent investigation. This ransomware group is Known for its cross-platform capabilities and affiliate-driven model. Lynx targets Windows, Linux, and VMware ESXi environments, posing a significant…
DeepSeek R1 Jailbroken to Generate Ransomware Development Scripts
DeepSeek R1, the latest AI model from China, is making waves in the tech world for its reasoning capabilities. Positioned as a challenger to AI giants like OpenAI, it has already climbed to 6th place on the Chatbot Arena benchmarking…
Critical Cacti Vulnerability Let Attackers Code Remotely – PoC Released
The widely used open-source network monitoring tool, Cacti, identified a critical vulnerability. The flaw, tracked as CVE-2025-22604 has a CVSS score of 9.1, indicating high severity. It allows authenticated users with device management permissions to execute arbitrary commands on the server,…
API Supply Chain Attack Exposes Millions of Airline Users Accounts to Hackers
A vulnerability in a third-party travel service API has exposed millions of airline users to potential account takeovers, enabling attackers to exploit airline loyalty points and access sensitive personal information. The flaw, discovered by Salt Labs, highlights the risks associated…
PoC Exploit Released for TP-Link Router Web Interface XSS Vulnerability
A Cross-Site Scripting (XSS) vulnerability has been identified in the TP-Link Archer A20 v3 router, specifically in firmware version 1.0.6 Build 20231011 rel.85717(5553). The issue stems from improper handling of directory listing paths on the router’s web interface. When a…
Hackers Actively Exploiting Zyxel 0-day Vulnerability to Execute Arbitrary Commands
A significant zero-day vulnerability in Zyxel CPE series devices, identified as CVE-2024-40891, is being actively exploited by attackers. This vulnerability enables attackers to execute arbitrary commands on affected devices, posing significant risks of system compromise, data theft, and network infiltration.…
Fake DeepSeek Campaign Attacking macOS Users to Deliver Poseidon Malware
A new cyberattack campaign, dubbed the “Fake DeepSeek Campaign,” has been discovered targeting macOS users. DeepSeek, a Chinese-developed AI chatbot, has rapidly gained popularity globally. Threat Actors started exploiting its popularity to deliver malware & infect users’ computers. This campaign is…
Azure Key Vault Vulnerabilities Could Leak Sensitive Data After Entra ID Breach
A detailed walkthrough demonstrates how attackers can manipulate Azure Key Vault’s access policies after compromising Entra ID (formerly Azure AD) credentials. According to Faran Siddiqui, a penetration tester report, a “Key Vault 06 – Abuse Decryption Key,” shed light on…
Cloudflare’s Data Pipeline Powered to Handle 700 Million Events Per Second
Cloudflare revealed how its data pipeline has achieved unprecedented scalability, processing up to 706 million events per second as of December 2024 representing a staggering 100x growth since 2018. This massive data flow, which peaks at 107 GiB/s of compressed…
PowerSchool Starts Notifying Students Following Massive Breach
PowerSchool, a leading U.S.-based education technology provider, has begun notifying students, teachers, and other affected individuals following a massive data breach that occurred in December 2024. The breach, which compromised sensitive personal information, is one of the largest cybersecurity incidents…
VMware Avi Load Balancer Vulnerability Let Attackers Gain Database Access
Broadcom disclosed a critical vulnerability affecting its Avi Load Balancer product. The vulnerability, identified as CVE-2025-22217, is an unauthenticated blind SQL injection vulnerability that could allow attackers with network access to execute specially crafted SQL queries to gain unauthorized access…
How SOC/DFIR Teams Prevent Ransomware Threats in Healthcare – A Case Study on Interlock Ransomware
Ransomware attacks targeting the healthcare sector have become increasingly challenging to manage due to financial losses and the risks posed to patient safety and operational continuity. Researchers at ANR.RUN analyze the impact of ransomware threats in healthcare, using the notorious…
EU Sanctioned Three Russian Hackers for Attacking Govt Agencies
The European Union today imposed sanctions on three Russian military intelligence officers for their involvement in a series of cyberattacks targeting Estonian government agencies in 2020. The individuals, identified as Nikolay Alexandrovich Korchagin, Vitaly Shevchenko, and Yuriy Fedorovich Denisov, are…
Hackers Stolen $85 Million Worth of Cryptocurrency from Phemex
Phemex, a cryptocurrency exchange based in Singapore, suffered a significant cyberattack that resulted in the theft of $85 million worth of digital assets. The platform’s hot wallets, which are linked to the internet for real-time transactions, were the primary target…
Vulnerabilities in Telecom Networks Let Hackers Gain Access to 3,000 Companies
Cybersecurity researchers have exposed critical vulnerabilities in a telecom network that allowed unauthorized access to sensitive data and control over 3,000 companies. The research revealed obvious vulnerabilities in the network’s backend APIs, authentication systems, and Know Your Customer (KYC) processes,…
New TorNet Backdoor Abusing Windows Schedule Task to Deliver Malware
A financially motivated threat actor has been linked to a sophisticated cyber campaign that has been targeting users in Poland and Germany since July 2024. The effort uses phishing emails to spread a range of malware payloads, including Agent Tesla,…
Hackers Exploit Outdated Electricity Controller Using Flipper Zero to Disconnect Power Supply
Researchers Fabian Bräunlein and Luca Melette demonstrated how outdated Radio Ripple Control systems, used to manage up to 60 gigawatts (GW) of electricity, could be exploited by attackers to disrupt power supply on a massive scale. Their findings, presented at…
NVIDIA GPU Display Driver Vulnerabilities Let Attackers Trigger DoS
NVIDIA has issued a critical software security update for its GPU Display Driver, addressing multiple vulnerabilities that could potentially expose systems to denial-of-service (DoS) attacks, data tampering, and information disclosure. This update impacts users across Windows and Linux platforms and…
Destroying EDR Service Executable File by Using a Combination of Windows Symbolic Links
A new method of exploiting the “Bring Your Own Vulnerable Driver” (BYOVD) technique has emerged, combining it with Windows symbolic links to elevate its effectiveness. This innovative approach exploits drivers with file-writing capabilities, bypassing the need to rely solely on…
Hackers Using Hidden Text Salting Technique To Confuse Spam Filters & Evade Detection
Cybercriminals are increasingly employing a technique known as “hidden text salting” to bypass spam filters and evade detection. This method, which saw a surge in usage during the latter half of 2024, poses a significant threat to organizations relying on…
New Attack Mimics USPS To Deliver Malicious PDF In To Attack Mobile Devices
A sophisticated phishing campaign has been uncovered, leveraging malicious PDFs disguised as official U.S. Postal Service (USPS) communications to target mobile users. This attack, identified by Zimperium’s zLabs team, employs a novel obfuscation technique to bypass traditional endpoint security measures…
Critical One Identity Manager Vulnerability Let Attackers Escalate Privileges
A critical Insecure Direct Object Reference (IDOR) vulnerability has been identified in One Identity Manager, a widely used identity and access management solution. This vulnerability, officially tracked as CVE-2024-56404, allows unauthorized privilege escalation under specific configurations. The issue affects only…
Akira’s New Linux Ransomware Attacking VMware ESXi Servers
The Akira ransomware group, a prominent player in the Ransomware-as-a-Service (RaaS) domain since March 2023, has intensified its operations with a new Linux variant targeting VMware ESXi servers. Initially focused on Windows systems, Akira expanded its scope in April 2023…
Apple Security Update Fixed Actively Exploited Zero-day Vulnerability Affected iOS, macOS and More
Apple has released updates across its platforms, including iOS 18.3, iPadOS 18.3, macOS Ventura, macOS Sonoma, macOS Sequoia, and Safari, to address multiple vulnerabilities. These updates include critical fixes for zero-day vulnerabilities that were actively being exploited, as well as…
Apple Zero-day Vulnerability Actively Exploited to Attack iPhone Users
Apple has released critical security updates to address a zero-day vulnerability actively exploited in attacks targeting iPhone users. The flaw, identified as CVE-2025-24085, is a use-after-free issue in the Core Media framework, which handles multimedia processing across Apple’s ecosystem. This…
Stratoshark – Wireshark Has Got a Friend for Cloud
The creators of Wireshark, Gerald Combs and Loris Degioanni, have unveiled Stratoshark, a groundbreaking tool designed to bring Wireshark’s renowned capabilities into the cloud era. Building on over 25 years of experience with Wireshark, which has become a staple for…
New Docker 1-Click RCE Attack Exploits Misconfigured API Settings
A newly disclosed attack method targeting Docker installations has raised significant security concerns among developers and system administrators. The vulnerability leverages a misconfigured Docker Engine API setting, allowing attackers to achieve remote code execution (RCE) with minimal user interaction. While…