A critical vulnerability in GamiPress, a popular WordPress plugin used for gamification and rewards systems on websites. The high-impact flaw, categorized as CVE-2024-13496 with a CVSS 3.1 score of 7.5, allowed unauthenticated attackers to inject malicious SQL queries that could…
Category: Cyber Security News
FCC Conducting Investigation into Chinese Entities Placed on the Government’s Prohibited List
The Federal Communications Commission (FCC) has launched a sweeping investigation into nine Chinese technology and telecommunications companies that were previously placed on its Covered List, aiming to determine if these firms are evading U.S. restrictions. FCC Chairman Brendan Carr announced…
Clio – Real-Time Logging Tool With Locking, User Authentication, and Audit Trails
Clio has emerged as a revolutionary real-time logging solution developed by cybersecurity engineers at CyberLock Technologies in the evolving landscape of cybersecurity tools. Launched in January 2025, this sophisticated tool addresses critical gaps in traditional logging frameworks by providing comprehensive…
Critical Chrome Vulnerability Let Attackers Execute Arbitrary Code
Google has confirmed a critical security flaw in Chrome that affects billions of users across Windows, Mac, Linux, and Android platforms. The vulnerability, which could allow attackers to execute arbitrary code through specially crafted web pages, prompted an urgent update…
CleanStack – A Dual-Stack for Defending Against Memory Corruption Attacks
Memory corruption vulnerabilities remain a persistent threat to software systems, particularly those built using low-level languages like C/C++. These vulnerabilities can lead to devastating attacks, allowing malicious actors to execute arbitrary code or manipulate critical program data. Traditional protection mechanisms…
Millions of Internet-Connected Weight Machines Via API Endpoints
The fitness technology landscape has undergone a dramatic transformation. Millions of weight machines worldwide now connect to the internet through standardized API endpoints, creating an unprecedented ecosystem of smart fitness equipment. Industry analysts project this market will exceed $8 billion…
Four Faces of Hacker Group Behind 90 Data Breaches Worldwide Revealed
A lone cybercriminal masquerading as a hacker group has been unmasked as the entity behind more than 90 data breaches worldwide over a four-year period. The individual, who operated under four distinct aliases, ALTDOS, DESORDEN, GHOSTR, and Omid16B targeted companies…
Chinese Web Shell Whisperer Using Web Shells & Tunnels To Establish Persistence
A sophisticated threat actor dubbed “Weaver Ant,” Web Shell Whisperer has emerged from China, deploying advanced web shell payloads across critical infrastructure sectors worldwide. This persistent campaign, active since late 2024, targets vulnerable web applications and content management systems in…
Critical Next.js Middleware Vulnerability Let Attackers Gain Unauthorized Access
A critical security vulnerability (CVE-2025-29927) has been discovered in Next.js that allows attackers to completely bypass middleware-based security controls by manipulating the x-middleware-subrequest header. This critical flaw affects authentication flows, authorization controls, path rewriting, and security header implementations across multiple…
New Browser-Based RDP for Secure Remote Windows Server Access
Cloudflare has unveiled a clientless, browser-based Remote Desktop Protocol (RDP) solution, expanding its Zero Trust Network Access (ZTNA) capabilities for secure Windows server access. This new offering, which follows the October 2024 release of short-lived SSH access, eliminates the need…
China’s Baidu Data Leak, Following Data Leak from User
Baidu, China’s leading search engine giant, has firmly denied allegations of an internal data breach after a controversial incident involving a senior executive’s teenage daughter. The company got involved in a data security incident, which prompted significant concerns about personal…
New SvcStealer Malware Attacking Users To Steal Sensitive Data From Browsers & Apps
A sophisticated new information stealer dubbed SvcStealer 2025 has emerged, targeting sensitive user data through spear phishing email attachments. First observed in late January 2025, this malware harvests extensive personal and financial information from infected systems, including machine data, installed…
North Korea Launches New Military Based Research Center To Strengthen Hacking Capabilities
North Korean leader Kim Jong Un has ordered the establishment of a new cyber warfare research center, codenamed “Research Center 227,” under the military’s Reconnaissance General Bureau (RGB). This move, confirmed in late February 2025, signals a significant escalation in…
New VanHelsingRaaS Attacking Linux, BSD, ARM, and ESXi Systems
A new and rapidly evolving ransomware-as-a-service (RaaS) operation called VanHelsingRaaS has emerged in the cybercrime landscape. Launched on March 7, 2025, this sophisticated threat has already claimed three victims in less than two weeks, demanding ransoms of $500,000 paid to…
10 Best Linux Firewalls in 2025
At present, many computers are connected via numerous networks. Monitoring all traffic and having something to filter out good and harmful traffic is critical, and we achieve this with an application or service known as a firewall. Early firewalls were…
Top 10 Best EDR Solutions (Endpoint Detection & Response) In 2025
Endpoint Detection and Response (EDR) solutions have become crucial for organizations to protect their devices and data from cyber threats. As of 2025, several top EDR solutions stand out in the market. CrowdStrike Falcon Insight XDR is widely recognized for…
Hacker Claims Sale of 6 Million Records Stolen from Oracle Cloud Servers
A threat actor named “rose87168” claimed to have stolen six million records from Oracle Cloud servers. The stolen data reportedly includes Java Key Store (JKS) files, encrypted Single Sign-On (SSO) passwords, hashed Lightweight Directory Access Protocol (LDAP) passwords, key files,…
VMware Vulnerabilities Exploited Actively to Bypass Security Controls & Deploy Ransomware
A surge of ransomware attacks leveraging critical VMware virtualization vulnerabilities has triggered global alerts. Threat actors exploit flaws in ESXi, Workstation, and Fusion products to paralyze enterprise infrastructures. The vulnerabilities CVE-2025-22224 (CVSS 9.3), CVE-2025-22225 (CVSS 8.2), and CVE-2025-22226 (CVSS 7.1)…
Russian 0-Day Seller Offering Record Breaking $4,000,000 for Full Chain Telegram Exploits
A Russian exploit brokerage firm, Operation Zero, has publicly announced bounties of up to $4 million for zero-day vulnerabilities in Telegram, signaling heightened state-sponsored interest in compromising the popular messaging app. The company, which exclusively serves the Russian government and…
Attackers Using Weaponized CAPTCHA’s to Execute PowerShell Commands & Install Malware
A growing attack trend since the second half of 2024 involves threat actors using fake CAPTCHA challenges to trick users into executing malicious PowerShell commands and infecting their systems with dangerous malware. These sophisticated social engineering tactics leverage users’ familiarity…
Researchers Unboxed FIN7’s Stealthy Python-based Anubis Backdoor
Cybersecurity experts have identified a sophisticated new backdoor tool developed by the notorious financial cybercrime group FIN7. The Python-based malware, dubbed “Anubis Backdoor,” represents an evolution in the group’s tactics, techniques, and procedures (TTPs) that have historically caused billions in…
JumpServer Vulnerabilities Let Attacker Bypass Authentication & Gain Complete Control
A series of critical vulnerabilities discovered in JumpServer, an open-source Privileged Access Management (PAM) tool developed by Fit2Cloud, has raised significant security concerns. JumpServer serves as a bastion host to internal networks, offering a centralized point for accessing internal resources…
Researchers Details macOS Vulnerability That Exposes System Passwords
Recent revelations about a critical vulnerability affecting macOS systems have raised significant concerns among cybersecurity professionals and users alike. The flaw, which potentially exposes sensitive system passwords, has been thoroughly analyzed and documented in a newly released report. This vulnerability…
Veeam RCE Vulnerability Let Any Domain User Hack the Backup Servers
A remote code execution (RCE) vulnerability in Veeam Backup & Replication could allow any domain user to compromise backup servers with SYSTEM-level privileges. The findings, assigned CVE-2025-23120, affect Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds, demonstrating how blacklist-based…
Over 150 US Government Database Servers Exposed to the Internet – New Report
Over 150 government database servers normally hidden behind layers of security are now directly exposed to the Internet, leaving Americans’ data vulnerable to cyberattacks. A groundbreaking open-source investigation has revealed what experts describe as “one of history’s largest exposures of…
Beware of Fake Meta Email’s From Hackers That Steal Your Ad Account Login’s
A dangerous new phishing campaign targeting businesses that use Meta platforms for advertising has been discovered. The scam begins with users receiving an urgent email claiming “YOUR ADS ARE TEMPORARILY SUSPENDED” due to alleged violations of Instagram’s Advertising Policies and…
Hackers Are Actively Exploiting Apache Tomcat Servers – Patch Now!
Threat actors actively exploit a critical vulnerability in Apache Tomcat, tracked as CVE-2025-24813, which could enable unauthorized remote code execution (RCE) on vulnerable servers. The vulnerability, first disclosed on March 10, 2025, has already seen exploitation attempts beginning just 30…
Albabat Ransomware Attacking Windows, Linux & macOS by Leveraging GitHub
A new cross-platform threat has emerged in the ransomware landscape as researchers uncover new versions of Albabat ransomware targeting Windows, Linux, and macOS systems simultaneously. The ransomware operators have implemented a sophisticated approach to manage their operations through GitHub repositories,…
UAT-5918 Hackers Exploiting Exposed Web and Application Servers N-Day Vulnerabilities
A sophisticated threat actor tracked as UAT-5918 has been observed actively exploiting known vulnerabilities in web and application servers that remain unpatched across multiple organizations. The campaign, which began in early 2025, primarily targets infrastructures running outdated versions of Apache,…
Hackers Are Actively Exploiting Apache Tomcat Servers Exploiting – Patch Now
Threat actors actively exploit a critical vulnerability in Apache Tomcat, tracked as CVE-2025-24813, which could enable unauthorized remote code execution (RCE) on vulnerable servers. The vulnerability, first disclosed on March 10, 2025, has already seen exploitation attempts beginning just 30…
Cloudflare to Close All HTTP Ports for APIs, Enforces HTTPS Connection
Cloudflare announced today that it has closed all HTTP ports on api.cloudflare.com, taking a significant step toward eliminating the security risks associated with cleartext HTTP traffic. The change, effective immediately, prevents sensitive information such as API tokens from being transmitted…
Hellcat Ransomware Group Hacked Ascom Technical Ticketing System
Swiss telecommunications solutions provider Ascom has fallen victim to a cyberattack by the notorious Hellcat ransomware group, which compromised the company’s technical ticketing system on March 16, 2025. The attack represents the latest in a global hacking spree targeting Jira…
Infosys Agrees to $17.5 Million Settlement Following 2023 Data Breach
Indian technology giant Infosys Limited has agreed to pay $17.5 million to settle six class action lawsuits from a significant data breach at its U.S. subsidiary, Infosys McCamish Systems LLC (McCamish). The settlement, announced on March 14, 2025, resolves allegations…
MEDUSA Ransomware Using Malicious ABYSSWORKER Driver to Disable EDR
MEDUSA ransomware operation has been observed leveraging a sophisticated malicious driver called ABYSSWORKER to disable endpoint detection and response (EDR) systems. This dangerous capability allows the ransomware to operate undetected, significantly increasing the threat to organizations’ security infrastructure. The ABYSSWORKER…
Hackers Exploiting Checkpoint’s Driver in BYOVD Attack to Bypass Windows Security
A sophisticated attack where threat actors exploited vulnerabilities in vsdatant.sys, a kernel-level driver used by Checkpoint’s ZoneAlarm antivirus software. Originally released in 2016, this driver became the target of a Bring Your Own Vulnerable Driver (BYOVD) attack, allowing attackers to…
Chinese FishMonger APT Operated by I‑SOON Attacking Government Entities & NGOs
Recent cybersecurity investigations have uncovered a sophisticated threat actor dubbed “FishMonger” operating under the umbrella of I-SOON, a Chinese company with alleged ties to state-sponsored hacking operations. This Advanced Persistent Threat (APT) group has been systematically targeting government institutions and…
Threat Actors Leveraging Reddit Posts To Actively Spread AMOS and Lumma Stealers
A sophisticated malware campaign is currently targeting cryptocurrency enthusiasts on Reddit, offering fake “cracked” versions of the popular trading platform TradingView. The malicious actors are distributing two dangerous data stealers—AMOS for macOS users and Lumma Stealer for Windows users—through seemingly…
CISA Releases Five Industrial Control Systems Advisories Covering Vulnerabilities & Exploits
The Cybersecurity and Infrastructure Security Agency (CISA) released five Industrial Control Systems (ICS) advisories on March 20, 2025, providing critical information about security vulnerabilities affecting industrial control systems across multiple vendors. These advisories offer essential guidance on mitigations for vulnerabilities…
Caido v0.47.0 Released – Burp Suite Alternative Web Pentesting Tool Brings New Features
Caido, the innovative security testing tool positioning itself as a compelling alternative to Burp Suite, has just rolled out its latest update, version 0.47.0. This release introduces a slew of exciting features, a revamped user experience, and critical bug fixes,…
Apple Faces Federal Lawsuit Over Delayed Apple Intelligence Features
Tech giant Apple is once again in the legal spotlight as a class-action lawsuit filed in U.S. District Court in San Jose accuses the company of false advertising and unfair competition related to its highly touted Apple Intelligence features. The…
IBM AIX Vulnerability Let Attackers Execute Arbitrary Commands
Critical security vulnerabilities in IBM AIX operating systems could allow unauthorized remote attackers to execute arbitrary commands, potentially compromising the entire system. IBM has released security patches to address these high-severity flaws affecting multiple Unix-based operating system versions. Security researchers have…
Hackers Exploiting Multiple Cisco Smart Licensing Utility Vulnerability
Researchers have detected active exploitation attempts targeting two critical vulnerabilities in Cisco’s Smart Licensing Utility that were patched approximately six months ago. Threat actors leverage these flaws, which could potentially grant unauthorized access to sensitive licensing data and administrative functions.…
Rooted (Jailbroken) Mobile Devices 3.5 Times More Vulnerable to Cyber Attacks
A recent study has revealed that rooted devices are over 3.5 times more likely to be targeted by mobile malware, underscoring the risks they bring to organizations. Rooting and jailbreaking, once popular methods for customizing mobile devices, are now primarily…
Microsoft Attributes Recent Outage of Outlook Web to Code Error in Recent Update
Microsoft experienced a widespread outage on March 19, 2025, affecting Outlook on the web services. The tech giant has attributed the issue to a problematic code change in a recent update, which left thousands of users unable to access their…
RansomHub Affiliate Deploying New Custom Backdoor Dubbed ‘Betruger’ For Persistence
A RansomHub affiliate has been observed recently deploying a new custom backdoor named ‘Betruger’. This sophisticated malware, discovered on March 20, 2025, by the Symantec Threat Hunter team, represents a concerning evolution in ransomware attack methodologies. The Betruger backdoor is…
New Steganographic Malware Exploits JPEG Files to Distribute Infostealers
A sophisticated malware campaign employing steganographic techniques has recently been identified, targeting users through seemingly innocent JPEG image files. The attack leverages hidden malicious code embedded within image files that, when executed, initiates a complex chain of events designed to…
Zero-Hour Phishing Attacks Exploiting Browser Vulnerabilities Increases by 130%
Recent cybersecurity data reveals an alarming 130% surge in zero-hour phishing attacks targeting previously unknown browser vulnerabilities. These sophisticated attacks leverage unpatched security flaws in popular browsers to deploy malicious payloads before security teams can implement countermeasures, leaving users and…
Paragon Spyware Exploited WhatsApp Zero-day Vulnerability to Attack High-value Targets
Researchers have uncovered extensive evidence linking Israeli firm Paragon Solutions to a sophisticated spyware operation that exploited a zero-day vulnerability in WhatsApp to target journalists and civil society members. Following the investigation, WhatsApp notified approximately 90 potential victims and confirmed…
Babuk2 Ransomware Issuing Fake Extortion Demands With Data from Old Breaches
The Babuk2 ransomware group has been caught issuing extortion demands based on false claims and recycled data from previous breaches. This revelation comes from recent investigations conducted by the Halcyon RISE Team, shedding light on a concerning trend in the…
Multiple Dell Secure Connect Gateway Flaws Allows System Compromise
Dell Technologies has issued a critical security advisory warning customers about multiple vulnerabilities in its Secure Connect Gateway (SCG) product that could potentially lead to system compromise. The vulnerabilities affect versions prior to 5.28.00.14 and require immediate attention from system…
North Korean IT Workers Exploiting GitHub to Attack Organizations Worldwide
A sophisticated network of suspected North Korean IT workers has been discovered leveraging GitHub to create false identities and secure remote employment opportunities in Japan and the United States. These operatives pose as Vietnamese, Japanese, and Singaporean professionals, primarily targeting…
Beware Tax Payers! Scammers Taking Advantage of Tax Season as Filing Deadline Draws Near
With less than a month until the federal income tax return deadline on April 15, cybercriminals are intensifying their efforts to exploit taxpayers rushing to file their returns. Security experts warn that this time-sensitive period creates an ideal environment for…
CISA Warns of NAKIVO Backup Vulnerability Exploited in Attacks – PoC Released
CISA has issued an urgent warning regarding a critical vulnerability in NAKIVO Backup and Replication solutions. As reports of active exploitation emerge, organizations are urged to patch immediately. The vulnerability, tracked as CVE-2024-48248, allows unauthenticated attackers to read arbitrary files…
Dragon RaaS Leading ‘Five Families’ Crimeware With New Initial Access & Exploitation Methods
A sophisticated Ransomware-as-a-Service (RaaS) operation known as ‘Dragon’ has emerged as the dominant force within the notorious “Five Families” of crimeware, implementing advanced initial access techniques and exploitation methods that have alarmed cybersecurity experts. The Dragon RaaS operation has been…
Signal Messenger Leveraged for Targeted Attacks on Employees of Defense Industry
A sophisticated cyber espionage campaign targeting employees of defense industrial complex enterprises and representatives of the Defense Forces of Ukraine has been uncovered. The attackers are using the popular Signal messenger app to distribute malicious archives that purportedly contain meeting…
Chinese Salt Typhoon Hackers Exploiting Exchange Vulnerabilities to Attack Organizations
Security researchers have identified a sophisticated Chinese APT group known as Salt Typhoon that has been actively exploiting Microsoft Exchange’s ProxyLogon vulnerabilities to compromise organizations worldwide. The group, also tracked as FamousSparrow, GhostEmperor, Earth Estries, and UNC2286, has been operational…
Spyware Maker SpyX Data Breach Exposes Nearly 2 Million Users Personal Data
A massive data breach at consumer-grade spyware operation SpyX has compromised the personal information of nearly 2 million individuals, including thousands of Apple users with exposed iCloud credentials. The breach, which occurred in June 2024 but remained unreported until March…
Critical Veeam Backup & Replication Vulnerability Allows Malicious Remote Code Execution
A critical vulnerability in Veeam Backup & Replication systems that allows authenticated domain users to execute remote code, potentially compromising enterprise backup infrastructures. The vulnerability, identified as CVE-2025-23120, carries a severe CVSS score of 9.9, indicating its high potential for…
Malware Operation ‘DollyWay’ Hacked 20,000+ WordPress Sites Globally
In recent years, the cybersecurity landscape has witnessed a significant rise in sophisticated malware operations. One such operation is “DollyWay,” a long-running campaign that has compromised over 20,000 WordPress sites globally. This operation is notable for its advanced techniques in…
Linux Kernel Out-of-bounds Write Vulnerability Let Attackers Escalate Privileges
A severe vulnerability in the Linux kernel has remained undetected for nearly two decades, allowing local users to gain root privileges on affected systems. Designated as CVE-2025-0927, this out-of-bounds write vulnerability in the Linux kernel’s HFS+ filesystem driver affects systems…
Kali Linux 2025.1a Released With New Tool & Updates to Desktop Environments
Kali Linux, the widely acclaimed cybersecurity-focused distribution, has officially unveiled its latest release, Kali Linux 2025.1a. This update not only significantly enhances desktop environments but also introduces exciting new tools and improvements tailored for cybersecurity professionals and enthusiasts. The release, available for download or upgrade, builds upon…
Kali Linux 2025.1a New Tool & Upates to Desktop Environments
Kali Linux, the widely acclaimed cybersecurity-focused distribution, has officially unveiled its latest release, Kali Linux 2025.1a. This update not only significantly enhances desktop environments but also introduces exciting new tools and improvements tailored for cybersecurity professionals and enthusiasts. The release, available for download or upgrade, builds upon…
Threat Actors Exploiting Legacy Drivers to Bypass TLS Certificate Validation
A sophisticated attack employing Legacy Driver Exploitation technique has emerged as a significant cybersecurity threat, according to a recent security report. The attack, first documented in June 2024 by CheckPoint-Research (CPR), primarily focuses on remotely controlling infected systems using GhOstRAT…
ANY.RUN’s New Android OS Support Let SOC/DFIR Team Perform Android APK Malware Analysis
ANY.RUN, the interactive malware analysis platform has announced full support for Android OS in its cloud-based sandbox environment, enabling security teams to investigate Android malware with unprecedented accuracy and efficiency. With this new feature, ANY.RUN allows Security Operations Center (SOC)…
Hackers Leveraging RMM Tools To Maintain Persistence To Infiltrate And Move Through Networks
Cybersecurity experts have identified a persistent trend of threat actors exploiting legitimate remote monitoring and management (RMM) software to infiltrate networks, maintain access, and facilitate lateral movement. These legitimate tools, which are typically used by IT administrators for system maintenance…
Critical AMI BMC Vulnerability Allows Attackers To Bypass Authentication Remotely
Security researchers have discovered a new critical vulnerability in AMI’s MegaRAC software that enables attackers to bypass authentication remotely. This latest security flaw, identified as CVE-2024-54085, affects numerous data center equipment and server models, potentially compromising cloud infrastructure security across…
Beware of Fake GitHub “Security Alerts” Let Hackers Hijack Your Account Login Credentials
A widespread phishing campaign is currently targeting GitHub repositories with fake security alerts, potentially compromising thousands of developer accounts. Cybersecurity experts warn that these sophisticated attacks could grant hackers complete control over victims’ code repositories and personal information. Security researcher…
Attackers Embedding Malicious Word file into a PDF to Evade Detections
A sophisticated attack vector dubbed “MalDoc in PDF” allows threat actors to bypass traditional security scanning by embedding malicious Word documents into PDF files. This technique, observed in attacks dating back to July, enables macros to execute when victims open…
41% of Success Logins Across Websites Involves Compromised Passwords
Password reuse continues to be one of the most significant security vulnerabilities in 2025, with alarming new data showing nearly half of all successful website logins involve previously exposed credentials. This widespread practice of recycling passwords across multiple services creates…
US Sperm Donor Giant California Cryobank Hacked – Customers Personal Data Exposed
California Cryobank LLC, one of America’s largest sperm donor repositories, has confirmed a significant data breach that exposed sensitive customer information. The cyber intrusion, which occurred on April 20, 2024, but remained undetected until October 4, 2024, has triggered mandatory…
Threat Actors Stolen Over 3.2 Billion Login Credentials & Infected 23 Million Devices Worldwide
In what security experts are calling one of the largest credential theft campaigns in history, sophisticated threat actors have successfully exfiltrated over 3.2 billion login credentials and compromised approximately 23 million devices across six continents. The massive operation, identified in…
Arcane Stealer Via YouTube Videos Steal Data From Network Utilities Including VPN & FileZilla
A sophisticated new malware strain called “Arcane” that specifically targets network utilities, VPN clients, and file transfer applications. The malware, discovered in late 2024, is being distributed through seemingly innocent YouTube videos that promote game cheats and cracks, putting thousands…
New AI Jailbreak Technique Bypasses Security Measures to Write Malware for Google Chrome
A new report indicates that individuals lacking technical knowledge can create advanced malware using widely recognized AI systems, thereby turning ordinary people into significant cybersecurity threats. The 2025 Cato CTRL™ Threat Report, published on March 18, details how a threat…
Cloudflare Launches Cloudforce One Threat Platform to Analyze IoCs, IP, Hashes & Domains
Cloudflare has unveiled its new threat events platform for Cloudforce One customers, offering a comprehensive solution to one of the most significant challenges in cybersecurity today: contextualizing threat intelligence data. The platform provides security practitioners with actionable insights by analyzing indicators…
Hackers Leveraging Azure App Proxy Pre-authentication to Access Orgs Private Network Resources
Recent security findings reveal that threat actors are actively exploiting misconfigured Azure application proxies to gain unauthorized access to organizations’ internal resources. When Azure app proxy pre-authentication is set to “Passthrough” instead of the default “Microsoft Entra ID” setting, private…
PHP RCE Vulnerability Actively Exploited in Wild to Attack Windows-based Systems
Security researchers at Bitdefender Labs have detected a significant surge in exploitation attempts targeting a critical PHP vulnerability that allows attackers to execute malicious code on Windows-based systems. The vulnerability, tracked as CVE-2024-4577, has been actively exploited since June 2024,…
MirrorFace Hackers Customized AsyncRAT Execution Chain to Run Within Windows Sandbox
The China-aligned advanced persistent threat (APT) group MirrorFace has updated its tactics, techniques, and procedures (TTPs) with a sophisticated approach to deploying malware. Known primarily for targeting Japanese entities, the group has expanded its operations to include a Central European…
Threat Actors Exploiting DLL Side-Loading Vulnerability in Google Chrome to Execute Malicious Payloads
Cybersecurity researchers have identified a concerning new attack vector where threat actors are actively exploiting a vulnerability in Google Chrome version 133.0.6943.126 through DLL side-loading techniques. This sophisticated attack allows malicious code execution through Chrome’s trusted subprocesses, creating a significant…
Hackers Abuse Cobalt Strike, SQLMap & Other Tools to Target Organizations’ Web Applications
Cybersecurity experts have uncovered a sophisticated campaign targeting enterprise web applications through the abuse of legitimate penetration testing tools. Threat actors are increasingly leveraging professional security tools including Cobalt Strike, SQLMap, and other reconnaissance utilities to compromise corporate networks with…
Sophisticated Attack Via Booking Websites Installs LummaStealer Malware
Cybercriminals have launched a new sophisticated attack campaign targeting travelers through fake booking websites. The campaign, discovered in early 2025, tricks users into installing LummaStealer malware through deceptive CAPTCHA verification processes, putting personal and financial information at risk. The attack…
VPN Vulnerabilities Emerges As The Key Tool for Threat Actors to Attack Organizations
VPN infrastructure has become a prime target for cybercriminals and state-sponsored actors, with vulnerabilities in these systems serving as gateways to widespread organizational compromise. Even years after their disclosure, critical VPN vulnerabilities continue to enable threat actors to steal credentials…
Beware of Fake Coinbase Migration Messages Aimed to Steal Your Wallet Credentials
A sophisticated phishing campaign is targeting cryptocurrency investors with fraudulent emails claiming a mandatory Coinbase wallet migration requirement. These deceptive messages, bearing the subject line “Migrate to Coinbase wallet,” are being distributed at a large scale, potentially bypassing spam filters…
Hackers Allegedly Selling Firewall Access to Canon Inc on Hacking Forums
Threat actors are allegedly offering root access to Canon Inc.’s internal firewall systems on underground hacking forums. According to security monitoring firm ThreatMon, the advertisement appeared on a popular dark web marketplace, claiming to provide administrator-level access to the Japanese…
Microsoft Windows File Explorer Vulnerability Let Attackers Perform Network Spoofing – PoC Released
A critical vulnerability in Windows File Explorer, identified as CVE-2025-24071, enables attackers to steal NTLM hashed passwords without any user interaction beyond simply extracting a compressed file. Security researchers have released a proof-of-concept exploit demonstrating this high-severity flaw, which Microsoft…
Critical Synology Vulnerability Let Attackers Remote Execute Arbitrary Code
A severe vulnerability in Synology’s DiskStation Manager (DSM) allows remote attackers to execute arbitrary code with no user interaction. The flaw, disclosed during PWN2OWN 2024, received a Critical severity rating with a CVSS score of 9.8, indicating its potential for…
Hacker Weaponizing Hard Disk Image Files To Deliver VenomRAT
A sophisticated phishing campaign is leveraging virtual hard disk (.vhd) files to distribute the dangerous VenomRAT malware. The attack begins with purchase order-themed emails containing archive attachments that, when extracted, reveal hard disk image files designed to evade traditional security…
CISA Warns of Fortinet FortiOS Authentication Bypass Vulnerability Exploited in Wild
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert highlighting a significant vulnerability in Fortinet’s FortiOS and FortiProxy systems, which threat actors are actively exploiting. The authentication bypass vulnerability, tracked as CVE-2025-24472, has been added to…
8-Year Old Windows Shortcut Zero-Day Exploited by 11 State-Sponsored Groups
A critical Windows vulnerability that has been exploited since 2017 by state-sponsored threat actors has been uncovered recently by researchers. The vulnerability, tracked as ZDI-CAN-25373, allows attackers to execute hidden malicious commands on victims’ machines by leveraging specially crafted Windows…
New Clearfake Variant Leverages Fake reCAPTCHA To Trick Users Deliver Malicious PowerShell Code
ClearFake, a malicious JavaScript framework first identified in July 2023, has evolved with sophisticated new social engineering tactics. Originally designed to display fake browser update pages, the framework has undergone significant developments, incorporating more advanced deception techniques to deliver malware…
Hackers Employ DLL Side-Loading To Deliver Malicious Python Code
A sophisticated cybersecurity threat has emerged as threat actors have begun leveraging DLL side-loading techniques to distribute malicious Python code. This attack vector allows hackers to bypass standard security controls by exploiting the way legitimate applications search for and load…
Bybit Hack – Sophisticated Multi-Stage Attack Details Revealed
Cryptocurrency exchange Bybit detected unauthorized activity involving its Ethereum cold wallets, leading to a major security breach. The incident occurred during an ETH multisig transaction facilitated through Safe{Wallet}, when attackers intervened and manipulated the transaction, ultimately siphoning over 400,000 ETH…
Squid Werewolf Mimic as Recruiters Attacking Job Seekers To Exfiltrate Personal Data
A sophisticated cyber espionage campaign has been uncovered where threat actors are masquerading as recruiters to target job seekers and employees of specific organizations. The attackers send phishing emails disguised as job opportunities from legitimate industrial organizations, attaching malicious files…
Cloudflare to Implement Post-Quantum Cryptography to Defend Attacks from Quantum Computers
Cloudflare has announced the first phase of end-to-end quantum readiness for its Zero Trust platform, enabling organizations to protect their corporate network traffic against future quantum computer threats. The initiative, which builds on Cloudflare’s research into post-quantum cryptography since 2017,…
New Sophisticated Phishing Attack Exploiting Microsoft 365 Infrastructure To Attack Users
A sophisticated new phishing campaign has been discovered that exploits Microsoft 365’s legitimate infrastructure to conduct highly convincing credential harvesting and account takeover attempts. Unlike traditional phishing attempts that rely on lookalike domains or email spoofing, this attack leverages Microsoft’s…
331 Malicious Apps with 60 Million Downloads on Google Play Bypass Android 13 Security
Security researchers from Bitdefender have uncovered a large-scale ad fraud campaign involving 331 malicious apps on the Google Play Store. These apps, which have accumulated over 60 million downloads, exploit vulnerabilities in Android 13 to bypass security restrictions and carry…
Microsoft Warns of New StilachiRAT Stealing Remote Desktop Protocol Sessions Data
Microsoft has issued an urgent security advisory regarding a newly discovered malware strain called StilachiRAT, which specifically targets and exfiltrates data from Remote Desktop Protocol (RDP) sessions. The sophisticated malware has been observed in targeted attacks against financial institutions, government…
DocSwap Malware as Security Document Viewer Attacking Android Users Worldwide
A sophisticated malware campaign dubbed “DocSwap” has emerged targeting Android users globally by disguising itself as a legitimate document security and viewing application. The malware leverages social engineering tactics to trick users into installing what appears to be a productivity…
ChatGPT Vulnerability Actively Exploited From 10,000+ IPs to Attack US Government Organizations
Attackers are actively exploiting a Server-Side Request Forgery (SSRF) vulnerability in OpenAI’s ChatGPT infrastructure. The vulnerability, identified as CVE-2024-27564, has become a significant threat despite its medium severity classification. According to research by cybersecurity firm Veriti, this vulnerability has already been…
Google Parent Alphabet in Talks to Acquire Cyber Security Group Wiz for $30bn
Google’s parent company, Alphabet Inc., is reportedly in advanced negotiations to acquire cybersecurity startup Wiz for approximately $30 billion. If completed, this acquisition would become the tech giant’s largest deal in its history, far surpassing its previous record of $12.5…
GIMP 3.0 Image Editor Released For Linux, macOS, Unix, and Windows
At long last, the first release of GIMP 3.0 is here! This is the end result of seven years of rigorous development by volunteer developers, designers, artists, and community members (for reference, GIMP 2.10 was first published in 2018). With…