Tag: EN

FreeVPN.One Extension Turns from Privacy Tool to Surveillance Threat

  Security researchers at Koi Security have discovered troubling behavior from FreeVPN.One, a popular Chrome VPN extension with over 100,000 installations that has begun secretly capturing and transmitting users’ screenshots to remote servers.  Threat discovery  The extension, which had maintained…

New HTTP Smuggling Attack Technique Let Hackers Inject Malicious Requests

A sophisticated HTTP request smuggling attack that exploits inconsistent parsing behaviors between front-end proxy servers and back-end application servers.  This newly discovered technique leverages malformed chunked transfer encoding extensions to bypass established security controls and inject unauthorized secondary requests into…

Hackers Abuse VPS Servers To Compromise Software-as-a-service (SaaS) Accounts

Cybercriminals are increasingly leveraging Virtual Private Server (VPS) infrastructure to orchestrate sophisticated attacks against Software-as-a-Service (SaaS) platforms, exploiting the anonymity and clean reputation of these hosting services to bypass traditional security controls. A coordinated campaign identified in early 2025 demonstrated…

Chinese MURKY PANDA Attacking Government and Professional Services Entities

A sophisticated China-nexus threat actor designated MURKY PANDA has emerged as a significant cybersecurity concern, conducting extensive cyberespionage operations against government, technology, academic, legal, and professional services entities across North America since late 2024. This advanced persistent threat group demonstrates…

Hackers Hijack VPS Servers to Breach Software-as-a-Service Accounts

Virtual Private Servers (VPS) have long served as versatile tools for developers and businesses, offering dedicated resources on shared physical hardware with enhanced control and scalability. However, threat actors are increasingly exploiting these platforms to orchestrate stealthy attacks against Software-as-a-Service…

Clickjack attack steals password managers’ secrets

A clickjack attack was revealed this summer that can steal the credentials from password managers that are integrated into web browsers. This article has been indexed from Malwarebytes Read the original article: Clickjack attack steals password managers’ secrets