Cybercriminals have begun openly marketing a powerful new variant of the HiddenMiner malware on underground dark web forums, raising alarms within the cybersecurity community. The malware, a heavily modified Monero (XMR) cryptocurrency miner, attracts buyers due to its advanced stealth…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Cybersecurity Firm CEO Arrested for Planting Malware in Hospital Systems
Jeffrey Bowie, the CEO of a local cybersecurity firm, has been arrested for allegedly planting malware on computers at SSM St. Anthony Hospital. Bowie, who until recently touted himself as a leader in protecting businesses from cyber threats, now faces…
Building A Strong Compliance Framework: A CISO’s Guide To Meeting Regulatory Requirements
In the current digital landscape, Chief Information Security Officers (CISOs) are under mounting pressure to ensure their organizations meet a growing array of regulatory requirements while maintaining robust cybersecurity. The proliferation of regulations such as the General Data Protection Regulation…
How To Use Digital Forensics To Strengthen Your Organization’s Cybersecurity Posture
Digital forensics has become a cornerstone of modern cybersecurity strategies, moving beyond its traditional role of post-incident investigation to become an essential proactive defense mechanism. Organizations today face an ever-expanding threat landscape, with attackers employing increasingly sophisticated tactics to breach…
New AI-Generated ‘TikDocs’ Exploits Trust in the Medical Profession to Drive Sales
AI-generated medical scams across TikTok and Instagram, where deepfake avatars pose as healthcare professionals to promote unverified supplements and treatments. These synthetic “doctors” exploit public trust in the medical field, often directing users to purchase products with exaggerated or entirely…
Two Systemic Jailbreaks Uncovered, Exposing Widespread Vulnerabilities in Generative AI Models
Two significant security vulnerabilities in generative AI systems have been discovered, allowing attackers to bypass safety protocols and extract potentially dangerous content from multiple popular AI platforms. These “jailbreaks” affect services from industry leaders including OpenAI, Google, Microsoft, and Anthropic,…
Gamers Beware! New Attack Targets Gamers to Deploy AgeoStealer Malware
The cybersecurity landscape faces an escalating crisis as AgeoStealer joins the ranks of advanced infostealers targeting global gaming communities. Documented in Flashpoint’s 2025 Global Threat Intelligence Report, this malware strain exploits gaming enthusiasts’ trust through socially engineered distribution channels, leveraging…
XDR, MDR, And EDR: Enhancing Your Penetration Testing Process With Advanced Threat Detection
In the ever-evolving world of cybersecurity, organizations must continuously adapt their defense strategies to stay ahead of increasingly sophisticated threats. One of the most effective ways to identify and mitigate vulnerabilities is through penetration testing, a proactive approach that simulates…
Compliance And Governance: What Every CISO Needs To Know About Data Protection Regulations
The cybersecurity landscape has changed dramatically in recent years, largely due to the introduction of comprehensive data protection regulations across the globe. Chief Information Security Officers (CISOs) now find themselves at the intersection of technical security, regulatory compliance, and organizational…
How to Develop a Strong Security Culture – Advice for CISOs and CSOs
Developing a strong security culture is one of the most critical responsibilities for today’s CISOs (Chief Information Security Officers) and CSOs (Chief Security Officers). As cyber threats become more sophisticated and pervasive, technical defenses alone are insufficient. A resilient security…
North Korean APT Hackers Pose as Companies to Spread Malware to Job Seekers
Silent Push Threat Analysts have uncovered a chilling new cyberattack campaign orchestrated by the North Korean Advanced Persistent Threat (APT) group known as Contagious Interview, also referred to as Famous Chollima, a subgroup of the notorious Lazarus group. This state-sponsored…
Russian Hackers Attempt to Sabotage Digital Control Systems of Dutch Public Service
The Dutch Defense Ministry has revealed that critical infrastructure, democratic processes, and North Sea installations in the Netherlands have become focal points for Russian cyber operations. These attacks, identified as part of a coordinated strategy to destabilize social cohesion and…
Threat Actors Register Over 26,000 Domains Imitating Brands to Deceive Users
Researchers from Unit 42 have uncovered a massive wave of SMS phishing, or “smishing,” activity targeting unsuspecting users. Since the FBI’s initial warning in April 2024, over 91,500 root domains associated with smishing have been identified and blocked. However, the…
“Power Parasites” Phishing Campaign Targets Energy Firms and Major Brands
Silent Push Threat Analysts have uncovered a widespread phishing and scam operation dubbed “Power Parasites,” targeting prominent energy companies and major global brands across multiple sectors in 2024. This campaign, active primarily in Asian countries such as Bangladesh, Nepal, and…
DragonForce and Anubis Ransomware Gangs Launch New Affiliate Programs
Secureworks Counter Threat Unit (CTU) researchers have uncovered innovative strategies deployed by the DragonForce and Anubis ransomware operators in 2025. These groups are adapting to law enforcement pressures with novel affiliate models designed to maximize profits and expand their reach,…
WooCommerce Users Targeted by Fake Security Vulnerability Alerts
A concerning large-scale phishing campaign targeting WooCommerce users has been uncovered by the Patchstack securpity team, employing a highly sophisticated email and web-based phishing template to deceive website owners. The attackers behind this operation warn users of a fabricated “Unauthenticated…
Threat Actors Target Organizations in Thailand with Ransomware Attacks
Thailand is experiencing a significant escalation in ransomware attacks, with both state-sponsored advanced persistent threat (APT) groups and cybercriminal organizations zeroing in on key industries across the country. The surge is underpinned by Thailand’s position as a burgeoning financial hub…
North Korean Hackers Exploit GenAI to Land Remote Jobs Worldwide
A groundbreaking report from Okta Threat Intelligence reveals how operatives linked to the Democratic People’s Republic of Korea (DPRK), often referred to as North Korean hackers, are leveraging Generative Artificial Intelligence (GenAI) to infiltrate remote technical roles across the globe.…
7 Best Third-Party Risk Management Software in 2025
Whether you operate a small business or run a large enterprise, you rely on third-party suppliers, merchants or software providers. They are fundamental to your operations, but they can pose security risks. The better you understand how that happens, the…
Chrome UAF Process Vulnerabilities Actively Exploited
Security researchers have revealed that two critical use-after-free (UAF) vulnerabilities in Google Chrome’s Browser process were actively exploited in the wild, exposing users to potential sandbox escapes and arbitrary code execution. However, Google’s deployment of the MiraclePtr defense mechanism ensures…
Microsoft Defender XDR False Positive Leaked Massive 1,700+ Sensitive Documents to Publish
An alarming data leak involving Microsoft Defender XDR has exposed more than 1,700 sensitive documents from hundreds of organizations, following a chain reaction triggered by a critical false positive error. Security researchers at ANY.RUN first identified and reported the incident,…
Hackers Exploit MS-SQL Servers to Deploy Ammyy Admin for Remote Access
A sophisticated cyberattack campaign has surfaced, targeting poorly managed Microsoft SQL (MS-SQL) servers to deploy malicious tools like Ammyy Admin and PetitPotato malware. Cybersecurity researchers have observed attackers exploiting vulnerabilities in these servers to gain unauthorized access, execute commands for…
‘SessionShark’ – A New Toolkit Bypasses Microsoft Office 365 MFA Security
Security researchers have uncovered a new and sophisticated threat to Microsoft Office 365 users: a phishing-as-a-service toolkit dubbed “SessionShark O365 2FA/MFA.” Promoted through cybercriminal marketplaces, SessionShark is designed to bypass Microsoft’s multi-factor authentication (MFA) protections—an alarming escalation in the ongoing…
159 CVEs Exploited in the Wild in Q1 2025, 8.3% Targeted Within 1-Day Vulnerabilities Exploited
VulnCheck’s latest report for Q1 2025 has identified 159 Common Vulnerabilities and Exposures (CVEs) publicly disclosed as exploited in the wild for the first time. Alarmingly, 28.3% of these Known Exploited Vulnerabilities (KEVs) saw evidence of exploitation within just one…
New Report Reveals How AI is Rapidly Enhancing Phishing Attack Precision
The Zscaler ThreatLabz 2025 Phishing Report unveils the alarming sophistication of modern phishing attacks, driven by generative AI (GenAI). By examining over 2 billion blocked phishing transactions on the Zscaler Zero Trust Exchange™ cloud security platform from January to December…
FBI Offers $10 Million Reward for information on Salt Typhoon Hackers
The Federal Bureau of Investigation (FBI), in partnership with the U.S. Department of State, has announced a reward of up to $10 million for information leading to the identification or location of individuals connected to the recent “Salt Typhoon” cyberattacks.…
Hackers Claim TikTok Breach, Leak Over 900,000 Usernames and Passwords
A hacker collective known as R00TK1T claims to have breached TikTok’s user database, allegedly leaking login information for over 900,000 users. The group, which has previously made waves in the hacking community with bold claims—often with little substantiated evidence—has taken…
Spring Security Vulnerability Exposes Valid Usernames to Attackers
A newly identified security vulnerability, CVE-2025-22234, has exposed a critical weakness in the widely-used Spring Security framework. According to the HeroDevs report, affecting several versions of the spring-security-crypto package, this flaw makes it possible for attackers to discern valid usernames…
Russian VPS Servers With RDP and Proxy Servers Enable North Korean Cybercrime Operations
Trend Research has uncovered a sophisticated network of cybercrime operations linked to North Korea, heavily utilizing Russian internet infrastructure. Specifically, IP address ranges in the towns of Khasan and Khabarovsk, Russia, assigned to organizations under TransTelecom (ASN AS20485), are pivotal…
Microsoft’s Patch for Symlink Vulnerability Introduces New Windows Denial-of-Service Flaw
Microsoft’s recent attempt to resolve a critical privilege escalation vulnerability has inadvertently introduced a new denial-of-service (DoS) flaw in Windows systems, leaving organizations vulnerable to update failures and potential security risks. In early April 2025, Microsoft addressed CVE-2025-21204, a security flaw…
SAP NetWeaver 0-Day Vulnerability Enables Webshell Deployment
Cybersecurity analysts have issued a high-priority warning after several incidents revealed active exploitation of SAP NetWeaver, the widely deployed enterprise integration platform. Attackers have leveraged an unreported 0-day vulnerability to deploy web shells, which give them remote command execution capabilities…
U.S. Secret Service Reveals Ways to Identify Credit Card Skimmers
With credit card skimming crimes escalating nationwide, the U.S. Secret Service’s Washington Field Office is sharing essential tips for the public to protect themselves from this growing threat, shared by Officials in LinkedIn post. According to the agency, credit card…
Lazarus APT Targets Organizations by Exploiting One-Day Vulnerabilities
A recent cyber espionage campaign by the notorious Lazarus Advanced Persistent Threat (APT) group, tracked as “Operation SyncHole,” has compromised at least six South Korean organizations across software, IT, financial, semiconductor, and telecommunications sectors since November 2024. According to detailed…
Verizon DBIR Report: Small Businesses Identified as Key Targets in Ransomware Attacks
Verizon Business’s 2025 Data Breach Investigations Report (DBIR), released on April 24, 2025, paints a stark picture of the cybersecurity landscape, drawing from an analysis of over 22,000 security incidents, including 12,195 confirmed data breaches. The report identifies credential abuse…
Weaponized SVG Files Used by Threat Actors to Redirect Users to Malicious Sites
Cybercriminals are increasingly weaponizing Scalable Vector Graphics (SVG) files to orchestrate sophisticated phishing campaigns. According to research from Intezer, a cybersecurity firm that triages millions of alerts for enterprises globally, attackers are embedding malicious JavaScript within SVG files to redirect…
Hackers Exploit Ivanti Connect Secure 0-Day to Deploy DslogdRAT and Web Shell
Threat actors exploited a zero-day vulnerability in Ivanti Connect Secure, identified as CVE-2025-0282, to deploy malicious tools including a web shell and a sophisticated remote access trojan (RAT) named DslogdRAT. According to a detailed analysis by JPCERT/CC, these attacks underscore…
New Steganography Campaign Exploits MS Office Vulnerability to Distribute AsyncRAT
A recently uncovered cyberattack campaign has brought steganography back into the spotlight, showcasing the creative and insidious methods attackers employ to deliver malware. This operation, dubbed the “Stego-Campaign,” exploits a known Microsoft Office vulnerability, CVE-2017-0199, to initiate infections and ultimately…
Threat Actors Exploiting Unsecured Kubernetes Clusters for Crypto Mining
In a startling revelation from Microsoft Threat Intelligence, threat actors are increasingly targeting unsecured Kubernetes clusters to conduct illicit activities such as cryptomining. The dynamic and complex nature of containerized environments poses significant challenges for security teams in detecting runtime…
ToyMaker Hackers Compromise Numerous Hosts via SSH and File Transfer Tools
In a alarming cybersecurity breach uncovered by Cisco Talos in 2023, a critical infrastructure enterprise fell victim to a meticulously orchestrated attack involving multiple threat actors. The initial access broker, identified as “ToyMaker” with medium confidence as a financially motivated…
NVIDIA NeMo Vulnerability Enables Remote Exploits
NVIDIA has issued an urgent security advisory addressing three high-severity vulnerabilities in its NeMo Framework, a platform widely used for developing AI-powered applications. The flaws, if exploited, could allow attackers to execute malicious code, tamper with data, or take control…
Commvault RCE Vulnerability Exploited—PoC Released
Enterprises and managed service providers globally are now facing urgent security concerns following the disclosure of a major pre-authenticated remote code execution (RCE) vulnerability in Commvault’s on-premise backup and recovery software. The issue, tracked as CVE-2025-34028, has rocked the cybersecurity…
Multiple Cisco Tools at Risk from Erlang/OTP SSH Remote Code Execution Flaw
Cisco has issued a high-severity advisory (cisco-sa-erlang-otp-ssh-xyZZy) warning of a critical remote code execution (RCE) vulnerability in products using Erlang/OTP’s SSH server. The flaw, tracked as CVE-2025-32433, allows unauthenticated attackers to execute arbitrary code on vulnerable devices, posing systemic risks to…
Zyxel RCE Flaw Lets Attackers Run Commands Without Authentication
Security researcher Alessandro Sgreccia (aka “rainpwn”) has revealed a set of critical vulnerabilities in Zyxel’s USG FLEX-H firewall series that enable remote code execution (RCE) and privilege escalation—without authentication. The findings, affecting models including the FLEX 100H and FLEX 700H,…
Redis DoS Flaw Allows Attackers to Crash Servers or Drain Memory
A high-severity denial-of-service (DoS) vulnerability in Redis, tracked as CVE-2025-21605, allows unauthenticated attackers to crash servers or exhaust system memory by exploiting improperly limited output buffers. The flaw affects Redis versions 2.6 and newer, with patches now available in updates 6.2.18, 7.2.8, and 7.4.3.…
Critical Langflow Flaw Enables Malicious Code Injection – Technical Breakdown Released
A critical remote code execution (RCE) vulnerability, identified as CVE-2025-3248 with a CVSS score of 9.8, has been uncovered in Langflow, an open-source platform widely used for visually designing AI-driven agents and workflows. This flaw, residing in the platform’s /api/v1/validate/code…
Google Warns: Threat Actors Growing More Sophisticated, Exploiting Zero-Day Vulnerabilities
Google’s Mandiant team has released its M-Trends 2025 report, highlighting the increasing sophistication of threat actors, particularly China-nexus groups. These adversaries are deploying custom malware ecosystems, exploiting zero-day vulnerabilities in security appliances, and utilizing proxy networks resembling botnets to evade…
GitLab Releases Critical Patch for XSS, DoS, and Account Takeover Bugs
GitLab, a leading DevOps platform, has released a critical security patch impacting both its Community (CE) and Enterprise (EE) editions, urging all self-managed users to update immediately. The new versions—17.11.1, 17.10.5, and 17.9.7—address several high and medium-severity vulnerabilities, including cross-site…
SonicWall SSLVPN Flaw Allows Hackers to Crash Firewalls Remotely
SonicWall has issued an urgent advisory (SNWLID-2025-0009) warning of a high-severity vulnerability in its SSLVPN Virtual Office interface that enables unauthenticated attackers to remotely crash firewalls, causing widespread network disruptions. Tracked as CVE-2025-32818, this flaw carries a CVSS v3 score of…
Hackers Use 1000+ IP Addresses to Target Ivanti VPN Vulnerabilities
A sweeping wave of suspicious online activity is putting organizations on alert as hackers ramp up their efforts to probe vulnerabilities in Ivanti Connect Secure (ICS) and Ivanti Pulse Secure (IPS) VPN systems. Cybersecurity firm GreyNoise has identified a dramatic…
Blue Shield Exposed Health Data of 4.7 Million via Google Ads
Blue Shield of California has disclosed a significant data privacy incident affecting up to 4.7 million members, after discovering that protected health information (PHI) may have been inadvertently shared with Google Ads over nearly three years. The healthcare provider is…
Microsoft Offers $30,000 Bounties for AI Security Flaws
Microsoft has launched a new bounty program that offers up to $30,000 to security researchers who discover vulnerabilities in its AI and machine learning (AI/ML) technologies. This initiative, announced by the Microsoft Security Response Center (MSRC), aims to encourage responsible…
The Human Firewall: Strengthening Your Weakest Security Link
Despite billions spent annually on cybersecurity technology, organizations continue to experience breaches with alarming frequency. The most sophisticated security systems and robust network defenses can be rendered ineffective by a single employee clicking a malicious link or sharing credentials with…
WhatsApp Launches Advanced Privacy Tool to Secure Private Chats
WhatsApp, the world’s leading messaging platform, has unveiled a major privacy upgrade called “Advanced Chat Privacy,” taking another leap in its ongoing commitment to user security and confidentiality. Building upon its already robust end-to-end encryption, WhatsApp’s latest feature aims to…
Russian Hackers Exploit Microsoft OAuth 2.0 to Target Organizations
Cybersecurity firm Volexity has tracked a series of highly targeted attacks by suspected Russian threat actors, identified as UTA0352 and UTA0355. It exploits Microsoft 365 (M365) OAuth 2.0 authentication workflows to compromise accounts of individuals at non-governmental organizations (NGOs), think…
New SMS Phishing Attack Weaponizes Google AMP Links to Evade Detection
Group-IB’s High-Tech Crime Trends Report 2025 reveals a sharp 22% surge in phishing websites, with over 80,000 detected in 2024. Among the most concerning discoveries is a sophisticated SMS phishing campaign targeting users of a toll road service provider, active…
Ransomware Actors Ramp Up Attacks Organizations with Emerging Extortion Trends
Unit 42’s 2025 Global Incident Response Report, ransomware actors are intensifying their cyberattacks, with 86% of incidents causing significant business disruptions such as operational downtime and reputational damage. Cybercriminals are adopting increasingly sophisticated and deceptive strategies to maximize the impact…
Threat Actors Leverage TAG-124 Infrastructure to Deliver Malicious Payloads
In a concerning trend for cybersecurity, multiple threat actors, including ransomware groups and state-sponsored entities, are utilizing a malicious traffic distribution system (TDS) known as TAG-124 to optimize the delivery of malware payloads to high-value targets. According to research by…
Hackers Exploit NFC Technology to Steal Money from ATMs and POS Terminals
In a disturbing trend, cybercriminals, predominantly from Chinese underground networks, are exploiting Near Field Communication (NFC) technology to perpetrate large-scale fraud at ATMs and Point-of-Sale (POS) terminals. According to cyber threat intelligence analysts at Resecurity, numerous banks, FinTech companies, and…
Hackers Weaponize Google Forms to Bypass Email Security and Steal Login Credentials
Threat actors are increasingly leveraging Google Forms, the tech giant’s widely-used form and quiz-building tool, to orchestrate sophisticated phishing and malware distribution campaigns. Since its launch in 2008, Google Forms has captured nearly 50% of the market share in its…
FireEye EDR Vulnerability Allows Attackers to Execute Unauthorized Code
A critical vulnerability (CVE-2025-0618) in FireEye’s Endpoint Detection and Response (EDR) agent has been disclosed, enabling attackers to execute unauthorized code and trigger persistent denial-of-service (DoS) conditions. The flaw, rated high severity, impacts tamper protection mechanisms in FireEye’s HX service…
APT34 Hackers Use Port 8080 for Fake 404 Responses and Shared SSH Keys
Researchers have uncovered early indicators of malicious infrastructure linked to APT34, also known as OilRig, a suspected Iranian threat group notorious for targeting sectors like education, government, energy, telecom, and NGOs. Between November 2024 and April 2025, a series of…
Critical Browser Wallet Vulnerabilities Enable Unauthorized Fund Transfers
Researchers have disclosed a series of alarming vulnerabilities in popular browser-based cryptocurrency wallets that could allow attackers to silently drain user funds, without any phishing, social engineering, or wallet connection approval required. As per a report by Coinspect, Industry-leading wallets…
New Malware Hijacks Docker Images Using Unique Obfuscation Technique
A recently uncovered malware campaign targeting Docker, one of the most frequently attacked services according to Darktrace’s honeypot data, has revealed a startling level of sophistication in obfuscation and cryptojacking methods. This novel attack begins with a seemingly innocuous request…
Hackers Exploit Weaponized Word Docs to Steal Windows Login Credentials
A sophisticated phishing campaign has been uncovered by Fortinet’s FortiGuard Labs, targeting Windows users with malicious Word documents designed to steal sensitive data. Disguised as legitimate sales orders, these emails trick recipients into opening attachments that exploit a known vulnerability,…
Cookie-Bite Attack Enables MFA Bypass and Persistent Cloud Server Access
Researchers have exposed a sophisticated cyberattack technique dubbed the “Cookie-Bite Attack,” which allows adversaries to bypass Multi-Factor Authentication (MFA) and maintain persistent access to cloud servers such as Microsoft 365, Azure Portal, and Teams. This method leverages stolen browser cookies,…
Synology Network File System Vulnerability Allows Unauthorized File Access
A critical security vulnerability in Synology’s Network File System (NFS) service, tracked as CVE-2025-1021, has been resolved after allowing unauthorized remote attackers to access sensitive files on vulnerable DiskStation Manager (DSM) devices. The flaw, marked as “Important” in severity by…
Hackers Deploy New Malware Disguised as Networking Software Updates
A sophisticated backdoor has been uncovered targeting major organizations across Russia, including government bodies, financial institutions, and industrial sectors. This malware, distributed under the guise of legitimate updates for ViPNet a widely used software suite for creating secure networks poses…
Super-Smart AI Could Launch Attacks Sooner Than We Think
In a development for cybersecurity, large language models (LLMs) are being weaponized by malicious actors to orchestrate sophisticated attacks at an unprecedented pace. Despite built-in safeguards akin to a digital Hippocratic Oath that prevent these models from directly aiding harmful…
Zyxel Releases Patches for Privilege Management Vulnerabilities in Firewalls
Zyxel, a leading provider of secure networking solutions, has released critical security patches to address two privilege management vulnerabilities in the USG FLEX H series firewalls. The flaws, tracked as CVE-2025-1731 and CVE-2025-1732, could allow authenticated local attackers to escalate…
CrowdStrike Launches Falcon® Privileged Access with Advanced Identity Protection
CrowdStrike today announced the general availability of Falcon® Privileged Access, a breakthrough module in its Falcon® Identity Protection suite, aimed at redefining identity security for modern organizations. This launch positions CrowdStrike’s AI-native Falcon platform as the only solution capable of…
CISA Issues Five ICS Advisories Highlighting Critical Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released five urgent advisories on April 22, 2025, targeting critical vulnerabilities in widely-used Industrial Control Systems (ICS) from Siemens, ABB, and Schneider Electric. With the increasing frequency and severity of cyberattacks…
Marks & Spencer Confirms Cyberattack Disrupting Payments and Online Orders
Leading British retailer Marks & Spencer Group plc (M&S) has confirmed it has been grappling with a cyberattack over the past several days, causing temporary disruptions to payment processing and online orders. According to an official company statement, the incident…
Google Cloud Composer Flaw Allows Attackers to Gain Elevated Privileges
Research disclosed a now-patched high-severity vulnerability in Google Cloud Platform’s (GCP) Cloud Composer service, dubbed ConfusedComposer. It could have allowed attackers to hijack cloud workflows and gain control over critical resources. The flaw highlights risks in automated cloud service orchestration. What…
Moodle Core vulnerabilities Allow Attackers to Evade Security Measures
A recent security audit has uncovered critical vulnerabilities within Moodle, the widely used open-source learning management system (LMS). These vulnerabilities allow attackers to evade core security mechanisms and potentially exploit systems via Server-Side Request Forgery (SSRF). The flaws center around…
Hackers Exploit Cloudflare Tunnel Infrastructure to Deploy Multiple Remote Access Trojans
The Sekoia TDR (Threat Detection & Research) team has reported on a sophisticated network infrastructure named “Cloudflare tunnel infrastructure to deliver multiple RATs” being exploited by cyber attackers since at least February 2024. This infrastructure has been utilized to host…
Threat Actors Leverage npm and PyPI with Impersonated Dev Tools for Credential Theft
The Socket Threat Research Team has unearthed a trio of malicious packages, two hosted on the Python Package Index (PyPI) and one on the npm registry, designed to silently pilfer cryptocurrency secrets, including mnemonic seed phrases and private keys. Released…
Cybercriminals Exploit Network Edge Devices to Infiltrate SMBs
Small and midsized businesses (SMBs) continue to be prime targets for cybercriminals, with network edge devices playing a critical role in initial attacks, according to the latest annual threat report by Sophos. The report highlights the persistent threat of ransomware,…
Hackers Exploit Legitimate Microsoft Utility to Deliver Malicious DLL Payload
Hackers are now exploiting a legitimate Microsoft utility, mavinject.exe, to inject malicious DLLs into unsuspecting systems. This utility, intended for injecting DLLs in Application Virtualization (App-V) environments, has become a tool of choice for cyber attackers due to its signed…
TP-Link Router Vulnerabilities Allow Attackers to Execute Malicious SQL Commands
Cybersecurity researchers have uncovered critical SQL injection vulnerabilities in four TP-Link router models, enabling attackers to execute malicious commands, bypass authentication, and potentially hijack devices. The flaws, discovered by researcher The Veteran between February and March 2025, highlight ongoing security risks in…
Faster Vulnerability Patching Reduces Risk and Lowers Cyber Risk Index
Trend Micro’s Cyber Risk Exposure Management (CREM) solution has highlighted the critical role that timely patching plays in reducing an organization’s cyber risk exposure. The report, which scrutinizes the Cyber Risk Index (CRI) a metric quantifying an organization’s security risk…
Samsung One UI Vulnerability Leaks Sensitive Data in Plain Text With No Expiration!
A glaring vulnerability has come to light within Samsung’s One UI interface: the clipboard history function stores all copied text, including sensitive data like passwords and personal information, in plain text and retains it indefinitely, unless users manually delete it.…
Malicious npm Packages Target Linux Developers with SSH Backdoor Attacks
In a sophisticated onslaught targeting the open-source ecosystem, reports have emerged detailing several malicious npm packages that are nefariously exploiting the Telegram Bot API to install backdoors on unsuspecting developers’ Linux systems. This alarming trend has escalated concerns over the…
Magecart Launches New Attack Using Malicious JavaScript to Steal Credit Card Data
The notorious Magecart group has been identified by the Yarix Incident Response Team as the culprits behind a recent credit card data theft operation on an e-commerce platform. This latest assault on consumer data showcases the group’s evolving tactics to…
Latest Lumma InfoStealer Variant Found Using Code Flow Obfuscation
Researchers have uncovered a sophisticated new variant of the notorious Lumma InfoStealer malware, employing advanced code flow obfuscation techniques to evade detection. This new development marks a significant escalation in cybercrime methodologies, potentially making it more challenging for traditional security…
New Rust-Based Botnet Hijacks Routers to Inject Remote Commands
A new malware named “RustoBot” has been discovered exploiting vulnerabilities in various router models to gain unauthorized access and initiate Distributed Denial of Service (DDoS) attacks. This advanced cyber-threat, first observed in January to February 2025, targets TOTOLINK and DrayTek…
FBI Alerts Public to Scammers Posing as IC3 Officials in Fraud Scheme
The Federal Bureau of Investigation (FBI) has issued a warning regarding an emerging scam where criminals impersonate officials from the Internet Crime Complaint Center (IC3) to defraud unsuspecting victims. Prevalence and Mechanics of the Scheme Between December 2023 and February…
Japan Sounds Alarm Over Hackers Draining Millions from Compromised Trading Accounts
Cybersecurity in Japan has hit a new low as the Financial Services Agency (FSA) reports a staggering increase in unauthorized access to internet trading accounts, leading to fraudulent transactions worth billions of yen. Anatomy of the Cyber Assault The first…
CISA Issues Warning Against Using Censys, VirusTotal in Threat Hunting Ops
The Cybersecurity and Infrastructure Security Agency (CISA) has alerted its threat hunting teams to immediately discontinue use of two widely trusted cyber threat intelligence tools, Censys and VirusTotal. The notification, sent to hundreds of CISA staffers this week, marks a…
Critical Flaw in Windows Update Stack Enables Code Execution and Privilege Escalation
A newly discovered vulnerability in the Windows Update Stack, tracked as CVE-2025-21204, has sent shockwaves through the cybersecurity community after researchers revealed it could enable attackers to execute arbitrary code and escalate privileges to SYSTEM level on targeted machines. The…
PoC Released for Critical Unauthenticated Erlang/OTP RCE Vulnerability
A critical remote code execution (RCE) vulnerability in Erlang/OTP’s SSH implementation (CVE-2025-32433) has now entered active exploit risk after researchers published a proof-of-concept (PoC) this week. The flaw, discovered by Fabian Bäumer, Marcus Brinkmann, Marcel Maehren, and Jörg Schwenk of…
Fake Certificate Issued for Alibaba Cloud After SSL.com Validation Trick
A critical vulnerability in SSL.com’s domain validation process allowed unauthorized parties to fraudulently obtain TLS certificates for high-profile domains, including Alibaba Cloud’s aliyun.com, researchers revealed this week. The certificate authority (CA) has since revoked 11 improperly issued certificates, raising concerns about…
WordPress Ad-Fraud Plugins Trigger Massive 1.4 Billion Daily Ad Requests
Cybersecurity researchers have uncovered a sprawling ad-fraud operation exploiting WordPress plugins to trigger over 1.4 billion fraudulent ad requests every day. Dubbed “Scallywag,” this scheme leverages customizable extensions to monetize digital piracy through a complex web of cashout domains, URL…
HPE Performance Cluster Manager Vulnerability Enables Unauthorized Access
Hewlett Packard Enterprise (HPE) has disclosed a severe security flaw in its Performance Cluster Manager (HPCM) software that could allow attackers to bypass authentication and gain unauthorized remote access to sensitive systems. The vulnerability, tracked as CVE-2025-27086, affects HPCM versions 1.12…
MITRE Unveils D3FEND CAD Tool to Model Advanced Cybersecurity Scenarios
MITRE has officially launched D3FEND CAD, an innovative tool designed to revolutionize how organizations model, analyze, and defend against sophisticated cyber threats. D3FEND CAD is targeted at security architects, digital engineers, and cyber risk professionals and is positioned to become…
North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs
A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean IT workers to infiltrate organizations globally using real-time deepfake technology. This operation, which has raised critical security, legal, and compliance issues, involves creating synthetic identities for…
Infostealer Attacks Surge 84% Weekly Through Phishing Emails
The volume of infostealer malware distributed through phishing emails has surged by 84% week-on-week in 2024, according to the latest IBM X-Force report. This sharp increase not only signals a shift in attack strategies but also underscores the growing sophistication…
Akira Ransomware Launches New Cyberattacks Using Stolen Credentials and Public Tools
The Akira ransomware group has intensified its operations, targeting over 350 organizations and claiming approximately $42 million USD in ransom proceeds by the beginning of 2024. This sophisticated cybercriminal entity has been deploying a strategy known as “double extortion,” where…
Detecting And Blocking DNS Tunneling Techniques Using Network Analytics
DNS tunneling is a covert technique that cybercriminals use to bypass traditional network security measures and exfiltrate data or establish command and control channels within an organization. By leveraging the essential and often trusted Domain Name System (DNS) protocol, attackers…
New Phishing Technique Hides Weaponized HTML Files Within SVG Images
Cybersecurity experts have observed an alarming increase in the use of SVG (Scalable Vector Graphics) files for phishing attacks. These attacks leverage the versatility of SVG format, which allows embedding of HTML and JavaScript code within what appears to be…
Security Awareness Metrics That Matter to the CISO
In today’s rapidly evolving threat landscape, Chief Information Security Officers (CISOs) are tasked with more than just deploying the latest security technologies; they must also foster a culture of security awareness across their organizations. While technical controls are essential, the…