The Trellix Advanced Research Center has exposed a highly sophisticated Advanced Persistent Threat (APT) malware campaign dubbed “OneClik,” specifically targeting the energy, oil, and gas sectors. This operation, which exhibits traits potentially linked to Chinese-affiliated threat actors, employs phishing attacks…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Google Plans to Remove Chrome’s Tab Scrolling Feature
Google has decided to deprecate the “Tab Scrolling” feature in its Chrome browser, marking the end of a tool that many users relied on to manage large numbers of open tabs. This feature, previously accessible through a Chrome flag, allowed…
CentOS Web Panel Vulnerability Allows Remote Code Execution – PoC Released
A critical security vulnerability has been discovered in CentOS Web Panel (CWP), a widely used web hosting management solution. The flaw, tracked as CVE-2025-48703, allows unauthenticated attackers to execute arbitrary commands on affected systems, potentially leading to full server compromise.…
Critical Kibana Flaws Enable Heap Corruption and Remote Code Execution
A critical security flaw has been uncovered in Kibana, the popular data visualization platform for the Elastic Stack, exposing organizations to severe risks of heap corruption and potential remote code execution. The vulnerability, tracked as CVE-2025-2135, carries a CVSS v3.1…
TeamViewer for Windows Vulnerability Lets Hackers Delete Files with SYSTEM Rights
A critical security vulnerability has been discovered in TeamViewer Remote Management for Windows, exposing systems to potential privilege escalation attacks. The flaw, tracked as CVE-2025-36537, allows a local unprivileged attacker to delete arbitrary files with SYSTEM-level privileges, posing a significant…
CISA Releases New ICS Advisories Highlighting Ongoing Threats and Exploits
The Cybersecurity and Infrastructure Security Agency (CISA) has released eight new Industrial Control Systems (ICS) advisories on June 24, 2025, addressing critical vulnerabilities and ongoing threats to essential infrastructure. These advisories provide detailed technical information and mitigation guidance for a…
NVIDIA Megatron LM Flaw Allows Attackers to Inject Malicious Code
NVIDIA has issued an urgent security update for its open-source Megatron-LM framework, following the discovery of two critical vulnerabilities that could allow attackers to inject and execute malicious code on affected systems. The flaws, tracked as CVE-2025-23264 and CVE-2025-23265, impact…
New FileFix Exploit Uses Windows File Explorer to Run Malicious Commands
A newly discovered exploit, dubbed “FileFix,” is raising alarms in the cybersecurity community for its innovative use of Windows File Explorer to execute malicious commands, without ever leaving the web browser. Developed by security researcher mr.d0x, FileFix is a creative…
Bank of America, Netflix, and Microsoft Hacked to Inject Fake Phone Numbers
Jérôme Segura, cybercriminals are exploiting search parameter vulnerabilities to inject fake phone numbers into the legitimate websites of major brands like Apple, Bank of America, Facebook, HP, Microsoft, Netflix, and PayPal. This sophisticated attack, technically termed a “search parameter injection…
New DRAT V2 Update Enhances C2 Protocol with Shell Command Execution Capabilities
A new variant of the DRAT remote access trojan (RAT), dubbed DRAT V2, has been uncovered as part of a TAG-140 campaign targeting Indian government entities. This threat actor, believed to overlap with SideCopy and linked to Transparent Tribe (aka…
Gonjeshke Darande Hackers Pose as Activists to Infiltrate Iranian Crypto Exchange
Gonjeshke Darande, a cyber threat actor widely suspected to be an Israeli state-sponsored group masquerading as an Iranian opposition hacktivist entity, executed a devastating attack on Nobitex, Iran’s largest cryptocurrency exchange. This high-profile breach resulted in the destruction of US$90…
Threat Actors Exploit ConnectWise Configuration to Create Signed Malware
Threat actors have increasingly exploited vulnerabilities and configurations in ConnectWise software to distribute signed malware, masquerading as legitimate applications. Initially observed in February 2024 with ransomware attacks linked to vulnerabilities CVE-2024-1708 and CVE-2024-1709, the abuse escalated by March 2025 under…
Over 2,000 Devices Compromised by Weaponized Social Security Statement Phishing Attacks
CyberArmor analysts have uncovered a meticulously crafted phishing campaign that has already compromised over 2,000 devices by exploiting the trusted theme of Social Security Administration (SSA) statements. Cybercriminals behind this operation deployed a highly convincing email lure masquerading as an…
Weaponized DMV-Themed Phishing Scam Targets U.S. Citizens to Steal Personal and Financial Data
A highly coordinated phishing campaign impersonating various U.S. state Departments of Motor Vehicles (DMVs) has emerged as a significant threat, targeting citizens across multiple states with the intent to harvest personal and financial data. This sophisticated operation employs SMS phishing,…
EagleSpy v5 RAT Promoted by Hacker for Stealthy Android Access
A notorious threat actor known as “xperttechy” is actively promoting a new version of the EagleSpy remote access Trojan (RAT), dubbed EagleSpy v5, on a prominent dark web forum. Marketed as a “lifetime activated” tool, EagleSpy v5 is raising alarms…
Zimbra Classic Web Client Vulnerability Allows Arbitrary JavaScript Execution
A critical security flaw has been discovered and patched in the Zimbra Collaboration Suite (ZCS) Classic Web Client, exposing millions of business users to the risk of arbitrary JavaScript execution through stored cross-site scripting (XSS). Tracked as CVE-2025-27915, this vulnerability…
Google Cloud Donates A2A Protocol to Linux Foundation for Smarter, Secure Communication
In a landmark move for the artificial intelligence industry, Google Cloud has donated its Agent2Agent (A2A) protocol to the Linux Foundation, marking a significant step toward open, secure, and interoperable communication between AI agents. The announcement was made at the…
NCSC Warns of SHOE RACK Malware Targeting Fortinet Firewalls via DOH & SSH Protocols
The National Cyber Security Centre (NCSC) has issued a critical alert regarding a newly identified malware, dubbed SHOE RACK, which has been observed targeting Fortinet firewalls and other perimeter devices. Developed using the Go 1.18 programming language, this malicious software…
Critical Convoy Flaw Allows Remote Code Execution on Servers
A critical vulnerability (CVE-2025-52562) in Performave Convoy—a KVM server management panel widely used by hosting providers—enables unauthenticated attackers to execute arbitrary code on affected systems. Rated the maximum CVSS score of 10.0, this flaw exposes servers to complete compromise without…
DHS Warns of Pro-Iranian Hacktivists Targeting U.S. Networks
The Department of Homeland Security (DHS) has raised alarms over an increasing wave of low-level cyberattacks targeting U.S. networks, orchestrated by pro-Iranian hacktivist groups. This warning comes in the wake of heightened geopolitical tensions following the United States’ military strikes…