Cybercriminals have discovered a new avenue for malicious activities by exploiting Lovable, an AI-powered website creation platform, to develop sophisticated phishing campaigns and malware delivery systems. The platform, designed to democratize web development through natural language prompts, has inadvertently become…
Tag: Cyber Security News
Hackers Weaponize QR Codes Embedded with Malicious Links to Steal Sensitive Information
Cybersecurity researchers have observed a surge in phishing campaigns leveraging QR codes to deliver malicious payloads. This emerging threat, often dubbed “quishing,” exploits the opaque nature of QR codes to conceal harmful URLs that redirect victims to credential-harvesting sites or…
Threat Actors Gaining Access to Victims’ Machines and Monetizing Access to Their Bandwidth
A stealthy campaign emerged in early March 2025 that capitalized on a critical remote code execution flaw in GeoServer (CVE-2024-36401) to compromise publicly exposed geospatial servers. Attackers exploited JXPath query injection within Apache Commons libraries, allowing arbitrary code execution through…
New QUIC-LEAK Vulnerability Let Attackers Exhaust Server Memory and Trigger DoS Attack
A critical pre-handshake vulnerability in the LSQUIC QUIC implementation that allows remote attackers to crash servers through memory exhaustion attacks. The vulnerability, designated CVE-2025-54939 and dubbed “QUIC-LEAK,” affects the second most widely used QUIC implementation globally, potentially impacting over 34%…
APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task
A sophisticated cyber espionage campaign attributed to APT MuddyWater has emerged targeting Chief Financial Officers and finance executives across Europe, North America, South America, Africa, and Asia. The threat actors are deploying a multi-stage phishing operation that masquerades as legitimate…
Mozilla High Severity Vulnerabilities Enables Remote Code Execution
Mozilla has released Firefox 142 to address multiple high-severity security vulnerabilities that could allow attackers to execute arbitrary code remotely on affected systems. The security advisory, published on August 19, 2025, reveals nine distinct vulnerabilities ranging from sandbox escapes to…
Internet Archive Abused for Hosting Stealthy JScript Loader Malware
Security researchers have uncovered a novel malware delivery chain in recent weeks that leverages the Internet Archive’s legitimate infrastructure to host obfuscated payloads. The attack begins with a seemingly innocuous JScript file delivered via malspam, which in turn invokes a…
Warlock Ransomware Exploiting SharePoint Vulnerabilities to Gain Access and Steal Credentials
In recent weeks, the cybersecurity community has witnessed the rapid emergence of Warlock, a novel ransomware strain that weaponizes unpatched Microsoft SharePoint servers to infiltrate enterprise networks. Initial analysis reveals that threat actors exploit publicly exposed SharePoint instances via specially…
First Member of ‘Scattered Spider’ Hackers Group Sentenced to 10 Years
A 20-year-old Florida man, identified as a key member of the prolific cybercrime group “Scattered Spider,” was sentenced to 10 years in federal prison today. Noah Michael Urban of Palm Coast, Fla., was also ordered to pay approximately $13 million…
Hacker Charged in Connection with DDoS-for-Hire ‘Rapper Bot’ Scheme
Federal investigators have dismantled one of the world’s most powerful distributed denial-of-service (DDoS) botnets and charged its alleged administrator with orchestrating cyberattacks that targeted victims across more than 80 countries. Ethan Foltz, 22, of Eugene, Oregon, faces federal charges for…
FBI Warns of Russian Government Hackers Attacking Networking Devices of Critical Infrastructure
The Federal Bureau of Investigation has issued a critical security alert regarding sophisticated cyber operations conducted by Russian Federal Security Service (FSB) Center 16, targeting networking infrastructure across the United States and globally. The threat actors have been exploiting vulnerable…
Kali Vagrant Rebuilt Released – Pre-configured DebOS VMs via Command Line
The Kali Linux team has announced a significant enhancement of its Vagrant image build process, streamlining development and simplifying deployment for users. In a move to unify its infrastructure, the team has transitioned from HashiCorp’s Packer to DebOS for generating…
Threat Actors Weaponize PDF Editor With New Torjan to Turn Device Into Proxy
Cybersecurity researchers have uncovered a sophisticated new threat campaign that leverages a seemingly legitimate PDF editor application to transform infected devices into residential proxies. The malicious software, distributed under the guise of productivity tools, represents an evolving approach by threat…
DragonForce Ransomware Attack Analysis – Targets, TTPs and IoCs
DragonForce represents a sophisticated and rapidly evolving ransomware operation that has emerged as a significant threat in the cybersecurity landscape since late 2023. Operating under a Ransomware-as-a-Service (RaaS) model, this group has demonstrated exceptional adaptability by leveraging leaked ransomware builders…
UNC5518 Group Hacks Legitimate Websites to Inject Fake Captcha That Tricks Users to Execute Malware
A sophisticated cybercrime operation has emerged, targeting unsuspecting internet users through a deceptive social engineering technique that exploits one of the web’s most trusted security mechanisms. Since June 2024, the financially motivated threat group UNC5518 has been systematically compromising legitimate…
New SHAMOS Malware Attacking macOS Via Fake Help Websites to Steal Login Credentials
A sophisticated malware campaign targeting macOS users has emerged between June and August 2025, successfully attempting to compromise over 300 customer environments through deceptive help websites. The malicious operation deploys SHAMOS, a variant of the notorious Atomic macOS Stealer (AMOS),…
New MITM6 + NTLM Relay Attack Let Attackers Escalate Privileges and Compromise Entire Domain
A sophisticated attack chain that combines MITM6 with NTLM relay techniques to achieve full Active Directory domain compromise. The attack exploits Windows’ default IPv6 auto-configuration behavior, allowing attackers to escalate from network access to Domain Admin privileges in minutes. Key…
CISA Releases Four ICS Advisories Surrounding Vulnerabilities, and Exploits
CISA issued four comprehensive Industrial Control Systems (ICS) advisories on August 19, 2025, highlighting serious vulnerabilities affecting critical infrastructure sectors including energy and manufacturing. These advisories detail exploitable vulnerabilities with CVSS scores ranging from 5.8 to 9.8, requiring immediate attention…
Microsoft VS Code Remote-SSH Extension Hacked to Execute Malicious Code on Developer’s Machine
A critical security vulnerability has been discovered in Microsoft’s VS Code Remote-SSH extension that allows attackers to execute malicious code on developers’ local machines through compromised remote servers. Security researchers have demonstrated how this attack, dubbed “Vibe Hacking,” exploits the…
New Loader Malware Dubbed ‘QuirkyLoader’ Delivering Infostealers and RATs
A sophisticated new malware loader called QuirkyLoader has emerged as a significant cybersecurity threat, actively distributing well-known infostealers and remote access trojans (RATs) since November 2024. The malware has demonstrated remarkable versatility in delivering multiple payload families, including Agent Tesla,…
Google Announces New Capabilities for Enabling Defenders and Securing AI Innovation
Google Cloud has unveiled a comprehensive suite of security enhancements at its Security Summit 2025, marking a significant evolution in enterprise AI security frameworks. The technology giant’s latest announcements, delivered by VP and GM Jon Ramsey, focus on two critical…
New PromptFix Attack Tricks AI Browsers to Run Malicious Hidden Prompts
A new attack vector called PromptFix exploits AI-powered browsers by embedding malicious instructions within seemingly innocent web content. The attack represents an evolution of traditional ClickFix scams, specifically designed to manipulate agentic AI systems rather than human users. The research,…
Russian Hackers Exploiting 7-Year-Old Cisco Vulnerability to Collect Configs from Industrial Systems
A Russian state-sponsored cyber espionage group designated as Static Tundra has been actively exploiting a seven-year-old vulnerability in Cisco networking devices to steal configuration data and establish persistent access across critical infrastructure networks. The sophisticated threat actor, linked to Russia’s…
Critical Apache Tika PDF Parser Vulnerability Allow Attackers to Access Sensitive Data
A critical security vulnerability has been discovered in Apache Tika’s PDF parser module that could enable attackers to access sensitive data and trigger malicious requests to internal systems. The flaw, designated as CVE-2025-54988, affects multiple versions of the widely used…
Ransomware Incidents Targeting Japan Increased by Approximately 1.4 Times
Japan experienced a significant surge in ransomware attacks during the first half of 2025, with incidents increasing by approximately 1.4 times compared to the same period in 2024. According to comprehensive research conducted by cybersecurity analysts, 68 ransomware cases affected…
Critical Apple 0-Day Vulnerability Actively Exploited in the Wild – Update Now
Apple yesterday released emergency security updates for iOS and iPadOS to patch a critical zero-day vulnerability in its core Image I/O framework. The flaw, tracked as CVE-2025-43300, is confirmed to be under active exploitation in highly targeted attacks. The urgent…
Hackers Weaponize Active Directory Federation Services and office.com to Steal Microsoft 365 logins
A novel and highly tricky phishing campaign is actively stealing Microsoft 365 credentials by exploiting Microsoft’s own Active Directory Federation Services (ADFS) to redirect users from legitimate office.com links to malicious login pages. The technique, identified by researchers at the…
SafeLine: A Free Zero Trust Web Application Firewall for 2026
Every type of organization—whether it’s a multinational giant with thousands of employees or a single tech enthusiast running a homelab—needs a web application firewall (WAF). The reason is straightforward: web applications face constant threats from cyber attacks that can exploit…
New Salty 2FA PhaaS Attacking Microsoft 365 Users to Steal Login Credentials
A sophisticated new Phishing-as-a-Service (PhaaS) framework dubbed “Salty 2FA” has emerged as a significant threat to Microsoft 365 users across the US and European industries. This previously undocumented platform employs advanced obfuscation techniques and multi-stage execution chains specifically designed to…
Okta Security Releases Auth0 Event Logs for Proactive Threat Detection
Okta has announced the launch of the Auth0 Customer Detection Catalog, a comprehensive open-source repository designed to enhance proactive threat detection capabilities for Auth0 customers. This strategic release represents a significant advancement in identity and access management security, providing security…
Git 2.51 Released With Performance Optimizations and SHA-256 as Default hash Function
Git 2.51.0 has been officially released after an accelerated 8-week development cycle, introducing significant performance improvements and security enhancements that lay the groundwork for the upcoming Git 3.0 major release. The latest version delivers substantial speed improvements for core Git…
How Businesses Stop Complex Social Engineering Attacks Early – An SOC Team Guide
Attackers have leveled up. Powered by AI and professional-grade toolkits, today’s social engineering scams are nearly impossible to tell apart from the real thing, and automated defenses rarely catch them. That’s the real challenge for security leaders: these threats only…
Threat Actors Allegedly Listed Windows Zero-Day RCE Exploit For Sale on Dark Web
An alleged threat actor has listed a Windows Zero-Day Remote Code Execution (RCE) exploit for sale, claiming it targets fully updated Windows 10, Windows 11, and Windows Server 2022 systems. The posting reported by ThreatMon advertises weaponized exploit code purportedly…
Microsoft Office.com Suffers Major Outage, Investigation Underway
Microsoft’s comprehensive suite of online services, including the central Office.com portal, is currently experiencing a significant and widespread outage, leaving millions of users unable to access essential productivity applications. The company has confirmed the issue and is actively investigating the…
Lenovo AI Chatbot Vulnerability Let Attackers Run Remote Scripts on Corporate Machines
A critical security flaw in Lenovo’s AI chatbot “Lena” has been discovered that allows attackers to execute malicious scripts on corporate machines through simple prompt manipulation. The vulnerability, identified by cybersecurity researchers, exploits Cross-Site Scripting (XSS) weaknesses in the chatbot’s…
Threat Actors Leverage GenAI Platforms to Create Realistic Phishing Content
Cybercriminals are increasingly exploiting generative artificial intelligence platforms to orchestrate sophisticated phishing campaigns that pose unprecedented challenges to traditional security detection mechanisms. The rapid proliferation of GenAI services has created a fertile ecosystem for threat actors who leverage these platforms…
RingReaper Malware Attacking Linux Servers Evading EDR Solutions
A sophisticated new malware strain targeting Linux environments has emerged, demonstrating advanced evasion capabilities that challenge traditional endpoint detection and response systems. RingReaper, identified as a post-exploitation agent, leverages the Linux kernel’s modern asynchronous I/O interface to conduct covert operations…
Microsoft Releases Emergency Updates to Fix Windows Reset and Recovery Error
Microsoft has issued critical out-of-band updates on August 19, 2025, to address a significant issue affecting Windows reset and recovery operations following the deployment of the August 2025 security updates. The emergency patches resolve failures that prevented users from successfully…
Critical Namespace Injection Vulnerability in Kubernetes Capsule Let Attackers Inject Arbitrary Labels
A critical security vulnerability has been identified in Kubernetes Capsule v0.10.3 and earlier versions, allowing authenticated tenant users to inject arbitrary labels into system namespaces and bypass multi-tenant isolation controls. The vulnerability, tracked as GHSA-fcpm-6mxq-m5vv, was disclosed by security researcher…
Copilot Vulnerability Breaks Audit Logs and Access Files Secretly for Hackers
A significant security vulnerability has been discovered in Microsoft’s Copilot for M365 that allowed users, including potential malicious insiders, to access and interact with sensitive files without leaving any record in the official audit logs. After patching the flaw, Microsoft…
Scaly Wolf Attacking Organizations to Uncover Organizations’ Secrets
The cybersecurity landscape continues to witness sophisticated threat actors developing increasingly complex attack methodologies to infiltrate organizational networks and steal sensitive information. A recent investigation by security researchers has uncovered a persistent campaign orchestrated by the Scaly Wolf Advanced Persistent…
Legitimate Chrome VPN With 100,000+ Installs Silently Captures Screenshots and Exfiltrate Sensitive Data
A Chrome VPN extension with over 100,000 installations and verified badge status has been discovered operating as sophisticated spyware, continuously capturing user screenshots and exfiltrating sensitive data without consent. The extension, known as FreeVPN.One, masqueraded as a legitimate privacy tool…
CodeRabbit’s Production Servers RCE Vulnerability Enables Write Access on 1M Repositories
A critical remote code execution (RCE) vulnerability in CodeRabbit’s production infrastructure that provided unauthorized access to over one million code repositories, including private ones. The vulnerability, discovered in December 2024 and responsibly disclosed in January 2025, exploited the platform’s static…
Paper Werewolf Exploiting WinRAR Zero‑Day Vulnerability to Deliver Malware
Cybersecurity researchers have uncovered a sophisticated campaign by the Paper Werewolf threat actor group, also known as GOFFEE, targeting Russian organizations through the exploitation of critical vulnerabilities in WinRAR archiving software. The campaign, active since July 2025, demonstrates the group’s…
Hackers Exploiting Apache ActiveMQ Vulnerability to Gain Access to Cloud Linux Systems
A sophisticated campaign uncovered where adversaries are exploiting CVE-2023-46604, a critical remote code execution vulnerability in Apache ActiveMQ, to compromise cloud-based Linux systems. In this case, attackers are patching the very vulnerability they exploited to maintain exclusive access and evade…
Serial Hacker Jailed for Hacking and Defacing Organizations’ Websites
A sophisticated cybercriminal operation targeting government institutions and private organizations across multiple continents has culminated in the sentencing of Al-Tahery Al-Mashriky, a 26-year-old hacker from Rotherham, South Yorkshire. The prolific attacker, who operated under multiple aliases within the extremist hacking…
0-Day Clickjacking Vulnerabilities Found in Major Password Managers like 1Password, LastPass and Others
A cybersecurity researcher has disclosed zero-day clickjacking vulnerabilities affecting eleven major password managers, potentially exposing tens of millions of users to credential theft through a single malicious click. The research, conducted by security expert Marek Tóth, reveals that attackers can…
New GodRAT Weaponizing Screen Saver and Program Files to Attack Organizations
A sophisticated new Remote Access Trojan named GodRAT has emerged as a significant threat to financial institutions, leveraging deceptive screen saver files and steganographic techniques to infiltrate organizational networks. First detected in September 2024, this malware campaign has demonstrated remarkable…
New Salty 2FA PhaaS platform Attacking Microsoft 365 Users to Steal Login Credentials
A sophisticated new Phishing-as-a-Service (PhaaS) framework dubbed “Salty 2FA” has emerged as a significant threat to Microsoft 365 users across US and European industries. This previously undocumented platform employs advanced obfuscation techniques and multi-stage execution chains specifically designed to bypass…
Chrome High-Severity Vulnerability Let Attackers Execute Arbitrary Code
Google has released an emergency security update for Chrome to address a critical vulnerability that could allow attackers to crash the browser or execute arbitrary code on affected systems. The high-severity flaw, designated as CVE-2025-9132, affects Chrome’s V8 JavaScript engine…
Microsoft Teams “couldn’t connect” Error Following Recent Sidebar Update – Fix Released
Microsoft is in the process of deploying a fix for a service degradation issue affecting Microsoft Teams users globally, which presents a “couldn’t connect to this app” error upon launching the desktop and web applications. The problem, tracked under Microsoft…
New Research Uncovers Connection Between VPN Apps and Multiple Security Vulnerabilities
A comprehensive security analysis has revealed alarming vulnerabilities affecting over 700 million users across multiple VPN applications, exposing critical flaws that compromise the very privacy and security these services promise to protect. Research conducted by cybersecurity experts from Arizona State…
New Research Unmask DPRK IT Workers Email Address and Hiring Patterns
Recent cybersecurity intelligence has exposed a sophisticated infiltration campaign orchestrated by North Korean state-sponsored threat actors, specifically the Jasper Sleet group, who have systematically penetrated Western organizations through fraudulent employment schemes. This operation, targeting primarily Web3, blockchain, and cryptocurrency companies,…
How Winning SOCs Always Stay Ahead of Threats
Despite the escalating danger of cybersecurity breaches, high-performing Security Operations Centers are able to maintain their resilience and prevent attacks. That’s what makes them essential for sustainable growth of businesses and organizations. But what enables powerful SOC teams to stay…
OpenAI Launches $4 ChatGPT Go Plan with Unlimited Access to GPT-5
OpenAI has unveiled ChatGPT Go, a budget-friendly subscription plan priced at just ₹399 per month (approximately $4 USD, GST included). The announcement, made today, positions the service as an accessible entry point to cutting-edge AI capabilities, including unlimited access to…
North Korean Kimsuky Hackers Leveraged GitHub to Attack Foreign Embassies with XenoRAT Malware
A sophisticated espionage campaign targeting diplomatic missions in South Korea has exposed the evolving tactics of North Korean state-sponsored hackers. Between March and July 2025, threat actors linked to the notorious Kimsuky group conducted at least 19 spear-phishing attacks against…
MCDonald’s Free Nuggets Hack Leads to Expose of Confidential Data
A series of alarming vulnerabilities in McDonald’s digital infrastructure, from free food exploits to exposed executive data. What started as a simple app glitch developed into a months-long trial, culminating in the researcher, BobDaHacker, cold-calling the company’s headquarters while mentioning…
Threat Actors Attacking Organizations Key Employees With Weaponized Copyright Documents to Deliver Noodlophile Stealer
A sophisticated phishing campaign has emerged targeting enterprises with significant social media footprints, leveraging weaponized copyright infringement notices to deliver the evolved Noodlophile Stealer malware. This highly targeted threat represents a significant escalation from previous iterations, exploiting enterprises’ reliance on…
Microsoft Defender AI to Uncover Plain Text Credentials Within Active Directory
Microsoft has unveiled a groundbreaking AI-powered security feature that addresses one of cybersecurity’s most persistent vulnerabilities: plain text credentials stored in Active Directory (AD) free-text fields. The new posture alert in Microsoft Defender for Identity leverages artificial intelligence to detect…
Scans From Hacked Cisco Small Business Routers, Linksys and Araknis are at the Raise
Researchers have identified a significant surge in malicious HTTP scanning activities originating from approximately 2,200 compromised small business routers across multiple vendors. The campaign, which began escalating on July 30th, 2025, primarily targets Cisco Small Business RV series, Linksys LRT…
Lockbit Linux ESXi Ransomware Variant Evasion Techniques, File Encryption Process Uncovered
A sophisticated Linux ransomware variant targeting VMware ESXi infrastructure has emerged as a significant threat to enterprise virtualization environments. The Lockbit Linux ESXi ransomware represents a concerning evolution in the ransomware landscape, specifically engineered to compromise and encrypt virtual machine…
PyPI to Block Domains Resurrection Attacks by Blocking Access to 1800 Expired Domains
The Python Package Index (PyPI) has deployed a significant security enhancement to combat domain resurrection attacks, a sophisticated supply-chain attack vector that exploits expired domain names to compromise user accounts. Since early June 2025, the platform has proactively unverified over…
New Exploit for SAP 0-Day Vulnerability Allegedly Released in the Wild by ShinyHunters Hackers
Key Takeaways1. ShinyHunters publicly released exploits for critical SAP vulnerabilities.2. Unauthenticated attackers can achieve complete system takeover and remote code execution.3. Immediately apply SAP Security Notes 3594142 and 3604119. A working exploit targeting critical SAP vulnerabilities CVE-2025-31324 and CVE-2025-42999 has…
1.1 Million Users Data Exposed in Massive Allianz Life Data Breach
Allianz Life, a primary insurance provider, has fallen victim to a sophisticated social engineering attack that compromised the personal data of approximately 1.1 million customers in July 2025. The breach, which targeted the company’s Salesforce CRM platform, represents one of…
New Sni5Gect 5G Attack Sniffs Messages in Real-time and Injects Malicious Payloads
Cybersecurity researchers from Singapore University of Technology and Design have developed a new framework called Sni5Gect that can intercept and manipulate 5G network communications in real-time, posing significant new security risks to commercial mobile devices worldwide. The framework, presented at…
Palo Alto Networks Founder and CTO Retires After 20-Year Tenure
Palo Alto Networks announced a significant leadership transition as founder and Chief Technology Officer Nir Zuk steps down after two decades of pioneering cybersecurity innovation. The global cybersecurity leader has appointed longtime executive Lee Klarich as the new CTO and…
New Blue Locker Ransomware Attacking Oil & Gas Sector in Pakistan
Pakistan’s National Cyber Emergency Response Team (NCERT) has issued urgent warnings to 39 government ministries following a sophisticated ransomware campaign targeting the country’s critical infrastructure. The Blue Locker ransomware has successfully compromised Pakistan Petroleum Limited (PPL), the nation’s second-largest oil…
Threat Actors Weaponized Pirated Games to Bypass Microsoft Defender SmartScreen and Adblockers
Cybercriminals have successfully weaponized pirated gaming content to distribute sophisticated malware while bypassing popular security measures, including Microsoft Defender SmartScreen and widely-used adblockers. The campaign leverages trusted piracy platforms to deliver HijackLoader, a modular malware framework that has become increasingly…
Microsoft Confirms August Update Broken Reset and Recovery Options in Windows 11, 22H2, 23H2, and Others
Microsoft has officially confirmed that its August 2025 security update, known as KB5063709, is causing failures in key reset and recovery features across multiple versions of Windows. This issue, which emerged shortly after the update’s release on August 12, 2025,…
SSH Keys Are Crucial for Secure Remote Access but Often Remain a Blind Spot in Enterprise Security
Enterprise security strategies have evolved dramatically to address modern threats, yet SSH keys—critical cryptographic credentials that provide direct access to mission-critical systems—remain largely ungoverned and poorly managed across organizations. Despite their fundamental role in securing remote access to servers, cloud…
PipeMagic Malware Mimic as ChatGPT App Exploits Windows Vulnerability to Deploy Ransomware
A sophisticated malware campaign has been identified, utilizing PipeMagic, a highly modular backdoor deployed by the financially motivated threat actor Storm-2460. This advanced malware masquerades as a legitimate open-source ChatGPT Desktop Application while exploiting the zero-day vulnerability CVE-2025-29824 in Windows…
New ClickFix Attack Uses Fake BBC News Page and Fraudulent Cloudflare Verification to Trick Users
A sophisticated new cyberthreat campaign has emerged that combines impersonation of trusted news sources with deceptive security verification prompts to trick users into executing malicious commands on their systems. According to a Reddit post, the ClickFix attack masquerades as legitimate BBC news…
Hackers Exploit Cisco Secure Links to Evade Link Scanners and Bypass Network Filters
A sophisticated attack campaign uncovered where cybercriminals are weaponizing Cisco’s own security infrastructure to conduct phishing attacks. The attackers are exploiting Cisco Safe Links technology, designed to protect users from malicious URLs, to evade detection systems and bypass network filters…
CISA Warns of Trend Micro Apex One OS Command Injection Vulnerability Exploited in Attacks
CISA has issued a critical warning regarding a high-severity OS command injection vulnerability in Trend Micro Apex One Management Console that threat actors are actively exploiting in the wild. The vulnerability, tracked as CVE-2025-54948 and classified under CWE-78, poses significant…
Crypto Developers Attacked With Malicious npm Packages to Steal Login Details
A sophisticated new threat campaign has emerged targeting cryptocurrency developers through malicious npm packages designed to steal sensitive credentials and wallet information. The attack, dubbed “Solana-Scan” by researchers, specifically targets the Solana cryptocurrency ecosystem by masquerading as legitimate software development…
Threat Actors Abuse Microsoft Help Index File to Execute PipeMagic Malware
Cybersecurity researchers have uncovered a sophisticated malware campaign exploiting Microsoft Help Index Files (.mshi) to deliver the notorious PipeMagic backdoor, marking a significant evolution in the threat actors’ tactics since the malware’s first detection in 2022. The campaign, which has…
Threats Actors Using Telegram as The Communication Channel to Exfiltrate The Stolen Data
Cybersecurity researchers have identified an alarming trend where threat actors are increasingly leveraging Telegram’s Bot API infrastructure as a covert communication channel for data exfiltration. This sophisticated attack methodology combines traditional phishing techniques with legitimate messaging services to bypass conventional…
Weaponized Python Package Termncolor Attacking Leverages Windows Run Key to Maintain Persistence
A sophisticated supply chain attack targeting Python developers has emerged through a seemingly innocuous package named termncolor, which conceals a multi-stage malware operation designed to establish persistent access on compromised systems. The malicious package, distributed through the Python Package Index…
DoJ Seizes $2.8 Million in Crypto From Zeppelin Ransomware Operators
The U.S. Department of Justice (DoJ) announced the seizure of over $2.8 million in cryptocurrency, $70,000 in cash, and a luxury vehicle linked to Zeppelin ransomware operations. The warrants were unsealed on August 14, 2025, in federal courts across Virginia,…
Technical Details of SAP 0-Day Exploitation Script Used to Achieve RCE Disclosed
A sophisticated zero-day exploitation script targeting SAP systems has emerged in the cybersecurity landscape, demonstrating advanced remote code execution capabilities that pose significant risks to enterprise environments worldwide. The malicious payload specifically targets SAP NetWeaver Application Server vulnerabilities, exploiting weaknesses…
Intel Websites Exploited to Hack Every Intel Employee and View Confidential Data
A series of critical vulnerabilities across multiple internal Intel websites allowed for the complete exfiltration of the company’s global employee database and access to confidential supplier information. The flaws, stemming from basic security oversights, exposed the personal details of over…
APT SideWinder Actor Profile – Recent Attacks, Tactics, Techniques, and Procedures
APT SideWinder, also known as Rattlesnake, Razor Tiger, and T-APT-04, is a nation-state advanced persistent threat (APT) group active since at least 2012 and believed to originate from India. Noted for targeting military, government, and strategic business entities, particularly in…
X-VPN’s August Update Lets Mobile Users Choose Servers in 26 Regions with Military-Grade AES-256 Encryption
San Francisco, CA – August 12, 2025 — Addressing the growing demand for data privacy in financial workflows, X-VPN has rolled out an update to its mobile application, now offering free users the ability to manually choose from 26 server…
Linux Kernel Netfilter Vulnerability Let Attackers Escalate Privileges
A critical vulnerability in the Linux kernel’s netfilter ipset subsystem has been discovered that allows local attackers to escalate privileges to root-level access. The flaw, identified in the bitmap:ip implementation within the ipset framework, stems from insufficient range validation when…
New Ghost-tapping Attacks Steal Customers’ Cards Linked to Services Like Apple Pay and Google Pay
A sophisticated new cybercriminal technique known as “ghost-tapping” has emerged as a significant threat to contactless payment systems, enabling Chinese-speaking threat actors to exploit stolen payment card details linked to mobile wallet services such as Apple Pay and Google Pay.…
Bragg Confirms Cyber Attack – Hackers Accessed Internal IT Systems
Bragg Gaming Group has confirmed a significant cybersecurity incident that compromised the company’s internal IT infrastructure early Saturday morning, August 16, 2025. The online gaming technology provider discovered unauthorized network intrusion attempts that successfully breached their security perimeter, prompting immediate…
VirtualBox 7.2 Released With Support for Windows 11/Arm VMs and 50 Bug Fixes
Oracle has announced the release of VirtualBox 7.2, a major update to the popular open-source virtualization platform that introduces significant enhancements for Windows 11/Arm virtualization, comprehensive GUI improvements, and numerous bug fixes. Released on August 14, 2025, this version marks…
1000+ Exposed N-able N-central RMM Servers Unpatched for 0-Day Vulnerabilities
Over 1,000 exposed and unpatched N-able N-central Remote Monitoring and Management (RMM) servers are vulnerable to two newly disclosed zero-day vulnerabilities – CVE-2025-8875 and CVE-2025-8876. As of August 15, 2025, exactly 1,077 unique IPs have been identified as running outdated…
Critical PostgreSQL Vulnerabilities Allow Arbitrary Code Injection During Restoration
The PostgreSQL Global Development Group has issued emergency security updates across all supported versions to address three critical vulnerabilities that could allow attackers to execute arbitrary code during database restoration processes. The vulnerabilities affect PostgreSQL versions 13 through 17, with…
What is Use-After-Free Vulnerability? – Impact and Mitigation
Use-after-free (UAF) vulnerabilities represent one of the most critical and prevalent security threats in modern software systems, particularly affecting applications written in memory-unsafe languages like C and C++. These vulnerabilities occur when a program continues to use a memory location…
Rockwell ControlLogix Ethernet Vulnerability Let Attackers Execute Remote Code
A critical security vulnerability has been discovered in Rockwell Automation’s ControlLogix Ethernet communication modules, potentially allowing remote attackers to execute arbitrary code on industrial control systems. The vulnerability, tracked as CVE-2025-7353, affects multiple ControlLogix Ethernet modules and carries a maximum…
Hundreds of TeslaMate Installations Leaking Sensitive Vehicle Data in Real Time
A cybersecurity researcher has discovered that hundreds of publicly accessible TeslaMate installations are exposing sensitive Tesla vehicle data without authentication, revealing GPS coordinates, charging patterns, and personal driving habits to anyone on the internet. The vulnerability stems from misconfigured deployments…
HR Giant Workday Discloses Data Breach After Hackers Compromise Third-Party CRM
Workday, a leading provider of enterprise cloud applications for finance and human resources, has confirmed it was the target of a sophisticated social engineering campaign that resulted in a data breach via a third-party Customer Relationship Management (CRM) platform. The…
Threat Actor Allegedly Claiming Access to 15.8 Million PayPal Email and Passwords in Plaintext
A threat actor operating under the alias “Chucky_BF” has posted a concerning advertisement on a well-known cybercrime forum, claiming to possess and sell a “Global PayPal Credential Dump 2025” containing over 15.8 million email and plaintext password pairs. The dataset,…
North Korean Hackers Stealthy Linux Malware Leaked Online
In a significant breach of both cybersecurity defenses and secrecy, a trove of sensitive hacking tools and technical documentation, believed to originate from a North Korean threat actor, has recently been leaked online. The dump, revealed through an extensive article…
Windows 11 24H2 Security Update Causes SSD/HDD Failures and Potential Data Corruption
A significant security update rolled out by Microsoft with the Windows 11 24H2 (KB5063878) release is causing widespread issues for users, with reports surfacing that the update can render SSDs and HDDs inaccessible and may potentially corrupt user data. Last…
Beware of New back-to-school Shopping Scams That Tricks Drives Users to Fake Shopping Sites
As families across the country prepare for the return to school, cybercriminals are exploiting the seasonal rush with a fresh wave of sophisticated shopping scams. Leveraging peaks in online spending, scammers are deploying malicious campaigns that prey on unsuspecting users…
Weekly Cybersecurity News Recap : Microsoft, Cisco, Fortinet Security Updates and Cyber Attacks
In the week of August 11-17, 2025, the cybersecurity landscape was marked by critical updates from major vendors and a surge in sophisticated threats, underscoring the ongoing battle against digital vulnerabilities. Microsoft rolled out its Patch Tuesday updates on August…
CISA Releases Operational Technology Guide for Owners and Operators Across all Critical Infrastructure
CISA in collaboration with international partners, has released comprehensive guidance, titled “Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators,” to strengthen cybersecurity defenses across critical infrastructure sectors. The document emphasizes the critical importance of maintaining accurate operational…
New Elastic EDR 0-Day Vulnerability Allows Attackers to Bypass Detection, Execute Malware, and Cause BSOD
A newly discovered zero-day vulnerability in Elastic’s Endpoint Detection and Response (EDR) solution allows attackers to bypass security measures, execute malicious code, and trigger a BSOD system crash, according to the Ashes Cybersecurity research. The vulnerability resides in a core…