A GitHub repository titled Windows-WiFi-Password-Stealer has surfaced, raising concerns among cybersecurity professionals. This repository, hosted by the user “cyberthirty,” provides a Python-based script capable of extracting saved WiFi credentials from Windows systems and saving them to a text file. While…
Tag: Cyber Security News
New NailaoLocker Ransomware Attacking European Healthcare
European healthcare organizations are facing a sophisticated cyber threat from a newly identified ransomware strain called NailaoLocker, deployed as part of a campaign tracked as Green Nailao by Orange Cyberdefense CERT. The attacks, first detected between June and October 2024,…
Ivanti Endpoint Manager Vulnerabilities Proof-of-Concept (PoC) Exploit Released
A cluster of four critical vulnerabilities in Ivanti Endpoint Manager (EPM) has entered a dangerous new phase with the public release of proof-of-concept (PoC) exploit code, escalating risks for organizations using the enterprise device management platform. Discovered by researchers in…
Beware of North Korean Job Interview Process Delivers Malware Via Fake Chrome Update
A new malware campaign attributed to North Korean threat actors has been identified, targeting individuals through fake job interview processes. Dubbed “Contagious Interview,” this operation delivers malicious Swift applications disguised as legitimate software updates, including a recently discovered “DriverEasy.app” masquerading…
Chinese Hackers Exploiting Check Point Firewall Vulnerability To Deploy Ransomware
A sophisticated cyber espionage campaign linked to Chinese state-aligned threat actors has targeted organizations across 15 countries using an updated variant of the Shadowpad malware to deploy previously undocumented ransomware. The attacks, analyzed by Trend Micro’s incident response team, exploit…
IBM OpenPages Vulnerability Let Attackers Steal Authentication Credentials
IBM has addressed multiple high-severity vulnerabilities in its OpenPages Governance, Risk, and Compliance (GRC) platform that could enable attackers to hijack user sessions, steal authentication credentials, and manipulate critical enterprise data. The flaws affect versions 8.3 and 9.0 of the…
Rhadamanthys Infostealer Exploiting Microsoft Management Console to Execute Malicious Script
Researchers uncovered an ongoing campaign distributing the Rhadamanthys Infostealer through malicious Microsoft Management Console (MMC) files (.MSC), leveraging both a patched DLL vulnerability and legitimate MMC functionalities to execute scripts and deploy malware. This advanced attack vector highlights evolving techniques…
Free SOC Webinar – Better SOC with Interactive Malware Sandbox, Practical Use Cases 2025
If you work in a Security Operations Center (SOC), you know the struggle all too well: hundreds of alerts flood in daily, each demanding attention. Some are false positives, others are routine, but buried among them are real threats that…
Sophisticated Phishing Attacks Targeting Decision-Makers Including CEOs and CTOs
A recent study by cybersecurity firm Hackmosphere reveals alarming gaps in phishing awareness among C-suite executives, with CEOs demonstrating particularly high susceptibility to socially engineered attacks. The research, conducted through simulated phishing campaigns, shows how even experienced decision-makers remain vulnerable…
New Zhong Malware Exploit AnyDesk Tool To Attack Fintech & Cryptocurrency
A sophisticated malware campaign leveraging social engineering tactics has targeted financial technology and cryptocurrency platforms between December 20–24, 2024. Dubbed Zhong Stealer, this previously undocumented threat employed compromised AnyDesk installations and phishing lures to infiltrate systems, stealing credentials and establishing…
Multiple NVIDIA CUDA Toolkit Vulnerabilities Let Attackers Trigger DoS
Researchers uncovered nine critical vulnerabilities in NVIDIA’s CUDA Toolkit, a cornerstone software suite for GPU-accelerated computing. These vulnerabilities, spanning the cuobjdump and nvdisasm utilities, expose developers to denial-of-service (DoS) attacks and information disclosure risks when analyzing maliciously crafted cubin files.…
Fedora Linux Kernel Vulnerability Let Attackers Gain Access to Sensitive Data
A critical vulnerability (CVE-2025-1272) in Fedora Linux kernels starting at version 6.12 has disabled the kernel’s Lockdown Mode by default, potentially allowing attackers to bypass Secure Boot protections, load unsigned kernel modules, and access sensitive kernel memory regions. The regression,…
AWS Key Hunter – A Free Automated Tool to Detect Exposed AWS keys
AWS-Key-Hunter is an open-source tool released to automatically scan public GitHub repositories for exposed AWS access keys. The tool, which leverages continuous monitoring and Discord-based alerts, aims to mitigate risks associated with accidental credential leaks in version control systems. According to the…
Microsoft Admin Technical Guide to Block & Remove Apps on Endpoints
In response to growing regulatory requirements worldwide, Microsoft has published detailed technical guidance for Intune administrators on blocking and removing specific applications from managed endpoints. The guide focuses on compliance with international frameworks such as Australia’s Protective Security Policy Framework…
APT-C-28 Group Launched New Cyber Attack With Fileless RokRat Malware
The 360 Advanced Threat Research Institute has uncovered a sophisticated cyber espionage campaign orchestrated by the North Korean-linked threat actor APT-C-28, also known as ScarCruft or APT37. The group, active since 2012, has shifted tactics to employ fileless malware delivery…
Microsoft Power Pages 0-Day Vulnerability Exploited in the Wild
Microsoft has confirmed active exploitation of a critical elevation-of-privilege vulnerability (CVE-2025-24989) in its Power Pages platform, a low-code tool organizations use to build business websites. The vulnerability, which allowed unauthorized attackers to bypass registration controls and escalate network privileges, underscores…
Ghost Ransomware Compromised Organisations Across 70+ Countries – CISA & FBI Warns
The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint advisory warning of widespread attacks by the Ghost ransomware group, which has compromised over 70 organizations across critical sectors globally. Operating under aliases…
NSA Added New Features to Supercharge Ghidra 11.3
The National Security Agency (NSA) has unveiled Ghidra 11.3, a transformative update to its open-source Software Reverse Engineering (SRE) framework, delivering advanced debugging tools, accelerated emulation, and modernized integrations for cybersecurity professionals. This version introduces critical enhancements tailored for kernel-level…
Symantec Diagnostic Tool Vulnerability Let Attackers Escalate Privileges
Symantec, a division of Broadcom, has addressed a critical security flaw (CVE-2025-0893) in its Diagnostic Tool (SymDiag) that could allow attackers to escalate privileges on affected systems. The vulnerability, which impacted SymDiag versions prior to 3.0.79, received a CVSSv3 score…
Windows Disk Cleanup Tool Vulnerability Exploited to Gain SYSTEM Privileges
Microsoft has addressed a critical vulnerability in the Windows Disk Cleanup Tool (cleanmgr.exe) in the February 2025 Patch Tuesday security updates. Tracked as CVE-2025-21420, the vulnerability has a CVSS rating of 7.8 and could allow a threat actor to gain…
Citrix NetScaler Vulnerability Allows Unauthorized Command Execution
Cloud Software Group issued urgent patches on February 18, 2025, for a high-severity vulnerability (CVE-2024-12284) affecting its NetScaler Console (formerly NetScaler ADM) and NetScaler Agent. Rated 8.8 on the CVSS v4.0 scale, the flaw enables authenticated attackers to execute unauthorized…
Hackers Weaponize Jarsigner App To Execute XLoader Malware
Threat actors have been observed exploiting the legitimate Java Archive (JAR) signing tool jarsigner.exe to deploy the notorious XLoader malware, according to recent findings from the AhnLab Security Intelligence Center (ASEC). This attack leverages DLL side-loading techniques to bypass security…
Critical Microsoft Bing Vulnerability Let Attackers Execute Code Remotely
Microsoft has addressed a critical security flaw in its Bing search engine, tracked as CVE-2025-21355, which could have allowed unauthorized attackers to execute arbitrary code remotely. The vulnerability, classified as a Missing authentication for a Critical Function flaw, posed significant…
New Snake Keylogger Attacking Chrome, Edge, and Firefox Users
A sophisticated new variant of the Snake Keylogger (detected as Autolt/Injector.GTY!tr) has emerged as a critical threat to Windows users. It leverages advanced evasion techniques to steal sensitive data from Chrome, Edge, and Firefox browsers. FortiGuard Labs reports over 280…
New Web Inject Attack Campaigns Targeting MacOS Users To Deploy FrigidStealer Malware
Security researchers at Proofpoint have uncovered a sophisticated web inject campaign targeting MacOS users with a new information-stealing malware called FrigidStealer. The operation involves two newly identified threat actors, TA2726 and TA2727, collaborating to compromise legitimate websites and redirect victims…
Hackers Inject FrigidStealer Malware on Your macOS Via Fake Browser Updates
A surge in malicious web inject campaigns has introduced FrigidStealer, a new macOS-specific information stealer, deployed via fake browser update prompts. Cybersecurity firm Proofpoint identified two previously unknown threat actors, TA2726 and TA2727, collaborating to distribute this malware globally, marking…
Russian CryptoBytes Hackers Exploiting Windows Machines To Deploy UxCryptor Ransomware
The Russian cybercriminal group CryptoBytes has intensified its ransomware campaigns using a modified version of the UxCryptor malware, according to new findings from SonicWall’s Capture Labs threat research team. This financially motivated group, active since at least 2023, leverages leaked…
Beware! New Fake Browser Updates Deploy NetSupport RAT & StealC Malware on Your Windows
A sophisticated malware campaign attributed to the SmartApeSG threat actor (also tracked as ZPHP/HANEYMANEY) has targeted users through compromised websites since early 2024, deploying NetSupport RAT and StealC malware via fraudulent browser update notifications. The campaign exemplifies the growing sophistication…
BlackLock Emerging As a Major Player In RaaS With Variants for Windows, VMWare ESXi, & Linux Environments
Since its emergence in March 2024, the BlackLock ransomware operation (aka El Dorado) has executed a meteoric rise through the ransomware-as-a-service (RaaS) ranks, leveraging custom-built malware and sophisticated anti-detection techniques to compromise Windows, VMWare ESXi, and Linux environments. By Q4…
North Korean Hackers Using Dropbox & PowerShell Scripts To Infiltrate Organizations
A coordinated cyber espionage campaign, attributed to North Korea’s state-sponsored Kimsuky group (APT43), has targeted South Korean businesses, government agencies, and cryptocurrency users since late 2024. Dubbed ‘DEEP#DRIVE’ by researchers at Securonix, the operation leverages phishing lures, obfuscated PowerShell scripts,…
Palo Alto Warns of Hackers Combining Vulnerabilities to Compromise Firewalls
Palo Alto Networks has issued urgent warnings as cybersecurity researchers observe threat actors exploiting a combination of vulnerabilities in PAN-OS, the operating system powering its next-generation firewalls. Coordinated attacks, which bypass chain authentication and privilege escalation flaws, enable unauthorized access…
Threat Actors Using $10 Infostealer Malware To Breach Critical US Security
A new class of cyber threats leveraging $10 infostealer malware kits has compromised critical U.S. military, defense contractor, and federal agency systems, exposing vulnerabilities in national security infrastructure. According to Hudson Rock’s cybercrime intelligence data, over 30,000 infected devices across…
Hackers Turning Stolen Payment Card Data into Apple & Google Wallets
Recent advances in cybercrime strategies are reviving the carding sector, with threat actors leveraging stolen credit card data to create fraudulent Apple Pay and Google Wallet accounts. Dubbed “Ghost Tap,” this new attack methodology uses Near Field Communication (NFC) relay…
Lee Enterprises Ransomware Attack Compromises ‘Critical’ Systems
Lee Enterprises, one of the largest newspaper publishers in the U.S., has confirmed a cybersecurity attack involving adversarial encryption of critical business applications and data exfiltration through double-extortion ransomware tactics. The incident has disrupted print distribution, billing systems, and digital…
Russian Hackers Attacking Signal Messenger Users To Gain Access To Sensitive Data
Google Threat Intelligence Group (GTIG) reveal an escalating campaign by multiple Russia-aligned threat actors targeting Signal Messenger users through sophisticated exploitation of the app’s “linked devices” feature. These attacks, primarily focused on Ukrainian military personnel, government officials, journalists, and activists,…
Raymond IT Systems Hit by Cyber Attack – Investigation In progress
Raymond Limited, a textile and clothing company, reported a cybersecurity attack that affected some of its IT infrastructure. In a regulatory filing to the Bombay Stock Exchange (BSE) and National Stock Exchange (NSE), the company confirmed that threat actors breached…
South Korea Confirm DeepSeek Sending Data Chinese ByteDance Servers
South Korea’s Personal Information Protection Commission (PIPC) announced today that the Chinese AI chatbot DeepSeek transmitted sensitive user data to servers controlled by ByteDance, TikTok’s Beijing-based parent company. The findings follow a technical audit revealing critical security flaws, including unencrypted…
New IRS and Tax-Themed Cyber Attacks Fueled With New Domain Registrations
As the 2025 U.S. tax season reaches its peak, cybersecurity analysts report a dramatic escalation in phishing campaigns exploiting IRS and federal tax themes. Between January 1 and February 18, threat actors registered 158 unique domains mimicking official IRS subdomains…
New Wave of ‘Scam-Yourself’ Attacks Utilizing AI-Generated Videos With DeepFake
A new wave of “Scam-Yourself” attacks leveraging AI-generated deepfake videos and malicious scripts is targeting cryptocurrency enthusiasts and financial traders, marking a dangerous evolution in social engineering tactics. Discovered by cybersecurity researchers at Gen Digital, this campaign exploits verified YouTube…
Most Popular Passwords Cracked Within a Second
Passwords are the first line of defense for protecting sensitive data, yet millions of users worldwide continue to rely on weak and predictable combinations. A recent study by KnownHost reveals alarming trends in password security. It shows that many commonly…
90,000 WordPress Sites Vulnerable to Local File Inclusion Attacks
A severe security flaw in the Jupiter X Core plugin for WordPress exposed over 90,000 websites to Local File Inclusion (LFI) and Remote Code Execution (RCE) attacks. The vulnerability tracked as CVE-2025-0366 with a CVSS score of 8.8 (High), enables authenticated attackers…
Firefox 135.0.1 Released with Fix for High-Severity Memory Safety Vulnerabilities
Mozilla has released Firefox 135.0.1, a stability and security update addressing a high-severity memory safety vulnerability (CVE-2025-1414) that exposed users to potential remote code execution (RCE) attacks. The patch resolves critical flaws in Firefox 135.0, which could have allowed attackers…
Yahoo Data Leak – Hackers Allegedly Advertised 602,000 Email Accounts
A hacker operating under the alias “exelo” has allegedly advertised a database containing 602,800 Yahoo email accounts on an underground forum. The post claims the dataset is “private and non-Russian. ” The full list costs $100. A free sample of…
Critical Apache Ignite Vulnerability Let Attackers Execute Remote Code
A critical vulnerability in Apache Ignite tracked as CVE-2024-52577, exposes systems to remote code execution (RCE) attacks due to improper enforcement of class serialization filters. Rated CVSS 9.8, this flaw affects Ignite versions 2.6.0 through 2.16.x, enabling attackers to execute…
CISA Releases Two New ICS Advisories Exploits Following Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) released two Industrial Control Systems (ICS) advisories, addressing critical vulnerabilities in Delta Electronics CNCSoft-G2 and Rockwell Automation GuardLogix controllers. These advisories highlight exploitable flaws in systems widely used in manufacturing, energy, and critical…
Weaponized Signal, Line, and Gmail Apps Delivers Malware That Changes System Defenses
A sophisticated cyberattack campaign targeting Chinese-speaking users, malicious actors have weaponized fake versions of popular applications such as Signal, Line, and Gmail. These fake and weaponized apps are distributed via deceptive download pages that deliver malware capable of altering system…
GPT-4o Copilot Trained in Over 30 Popular Programming Languages
Microsoft has unveiled GPT-4o Copilot, a cutting-edge code completion model now available for Visual Studio Code (VS Code) users. Built on the GPT-4o mini architecture and trained on over 275,000 high-quality public repositories spanning more than 30 popular programming languages,…
Russian Government Proposed New Penalties to Combat Cybercrime
The Russian government announced a comprehensive legislative package on February 10, 2025, introducing severe penalties for cybercrimes. The reforms, which amend over 30 existing laws, aim to modernize Russia’s cybersecurity framework by escalating prison terms, expanding asset confiscation protocols, and…
Does AI Detection Remover Really Work? How to Fix Text Like a Pro!
Artificial intelligence (AI) is transforming everything! It influences how we communicate and how we write. Click-click — your text is ready. ChatGPT and other language models are helping people generate content. But, just like every superhero has a weakness, AI-generated…
CISA Warns of Palo Alto PAN-OS Vulnerability Actively Exploited in the Wild
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding actively exploiting a high-severity authentication bypass vulnerability (CVE-2025-0108) in Palo Alto Networks PAN-OS, the operating system powering the company’s firewall devices. With over 25 malicious IPs targeting…
Chrome Buffer Overflow Vulnerabilities Allow Arbitrary Code Execution & Gain System Access
Google has urgently patched two high-severity heap buffer overflow vulnerabilities in its Chrome browser, CVE-2025-0999, and CVE-2025-1426, that could allow attackers to execute arbitrary code and seize control of affected systems. The vulnerabilities, fixed in Chrome 133.0.6943.126/.127 for Windows/Mac and…
CISA Warns of SonicWall SonicOS RCE Vulnerability Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has escalated warnings about a critical zero-day vulnerability in SonicWall’s SonicOS, designating CVE-2024-53704 for immediate remediation in its Known Exploited Vulnerabilities (KEV) catalog. This improper authentication flaw, which enables remote attackers to…
Threat Actors Trojanize Popular Versions of Games To Infect Systems Bypassing Evasion Techniques
In a sophisticated cyberattack campaign dubbed “StaryDobry,” threat actors have exploited popular games to distribute malicious software, targeting users worldwide. The campaign, first detected on December 31, 2024, leveraged trojanized versions of games such as BeamNG.drive, Garry’s Mod, and Dyson…
New Research Proposed To Enhance MITRE ATT&CK In Dynamic Cybersecurity Environments
Cybersecurity researchers have proposed groundbreaking enhancements to the MITRE ATT&CK framework, aiming to strengthen its adaptability in dynamic and evolving threat landscapes. As cyber adversaries increasingly exploit emerging technologies like generative AI and industrial control systems (ICS), the need for…
How Cyber Threat Intelligence Helps with Alert Triage
Between threat detection and response, there is a vitally important operation known as alert triage. If not staged properly, it can render the whole SOC’s performance inefficient. This operation is alert triage — assessing and prioritizing security alerts. SIEM tools,…
OpenSSH Client & Server Vulnerabilities Enables MiTM & DoS Attacks
The Qualys Threat Research Unit (TRU) has uncovered two high-severity vulnerabilities in OpenSSH, the widely used suite for secure network communication. Tracked as CVE-2025-26465 and CVE-2025-26466, these flaws enable machine-in-the-middle (MitM) attacks against clients and pre-authentication denial-of-service (DoS) exploits targeting…
Weaponized PDF Documents Deliver Lumma InfoStealer Attacking Educational Institutions
The Lumma InfoStealer malware has been observed leveraging weaponized PDF documents to target educational institutions. This sophisticated campaign exploits malicious LNK (shortcut) files disguised as legitimate PDFs, initiating multi-stage infection processes that compromise sensitive data. Educational infrastructures, often less fortified…
4 Million Stolen Credit Cards to Be Released for Free by B1ack’s Stash Marketplace
The cybersecurity community is on high alert as B1ack’s Stash, a known marketplace on the dark web, has announced a massive leak of 4 million stolen credit card details. The Dark Web Informer threat intelligence researchers posted on X state…
New LLM Vulnerability Let Attackers Exploit The ChatGPT Like AI Models
A newly uncovered vulnerability in large language models (LLMs) has raised significant concerns about the security and ethical use of AI systems like OpenAI’s ChatGPT. Dubbed “Time Bandit,” this exploit manipulates the temporal reasoning capabilities of LLMs. This enables the…
Intruder Added Free Vulnerability Intelligence Platform ‘Intel’ with AI-Generated CVE Descriptions
Intel by Intruder now uses AI to contextualize NVD descriptions, helping security teams assess risk faster. Intruder, a leader in attack surface management, has launched AI-generated descriptions for Common Vulnerabilities and Exposures (CVEs) within its free vulnerability intelligence platform, Intel.…
Hackers Hiding Credit Card Stealer Script Within ![]()
Tag
Cybercriminals have developed a sophisticated method to steal credit card information by embedding malicious scripts within <img> tags on e-commerce websites. This technique, often associated with MageCart attacks, exploits the trustworthiness of image tags to evade detection while targeting platforms…
EagerBee Malware Attacking Government Entities & ISPs To Deploy Backdoor
A sophisticated malware framework dubbed EagerBee is actively targeting government agencies and Internet Service Providers (ISPs). EagerBee is actively targeting these organizations across the Middle East. While the EagerBee was found deploying advanced backdoor capabilities through novel technical implementations. The…
Earth Preta Abuse Microsoft Application Virtualization Injector To Inject Malicious Payloads
Advanced Persistent Threat (APT) group Earth Preta (a.k.a. Mustang Panda) has been observed weaponizing the Microsoft Application Virtualization Injector (MAVInject.exe) to bypass security software and implant backdoors in government systems across Asia-Pacific regions. The campaign, analyzed by Trend Micro’s Threat…
Free Security Incident Response Toolkit Released to Detect Cyber Intrusions
In a significant development for cybersecurity professionals and organizations worldwide, SecTemplates has announced the release of its Incident Response Program Pack 1.5, a free, open-source toolkit designed to streamline the implementation of robust security incident response protocols. This release provides…
Juniper Warns of Critical Authentication Bypass Vulnerability Affecting Multiple Products
Juniper Networks has issued an urgent security advisory addressing a critical API authentication bypass vulnerability (CVE-2025-21589) affecting its Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router product lines. The flaw, carrying a maximum CVSS base score of…
Indian Authorities Seize Loot From Collapsed BitConnect Crypto Scam
In a significant crackdown on one of India’s largest cryptocurrency frauds, the Enforcement Directorate (ED) has seized digital assets valued at ₹1,646 crore linked to the now-defunct BitConnect lending program. The operation, conducted under the Prevention of Money Laundering Act (PMLA),…
DarkMind A Novel Backdoor Attack Exploits Reasoning Capabilities of Customized LLMs
A groundbreaking study by researchers Zhen Guo and Reza Tourani at Saint Louis University has exposed a novel vulnerability in customized large language models (LLMs) like GPT-4o and LLaMA-3. Dubbed DarkMind, this backdoor attack exploits the reasoning capabilities of LLMs…
Unauthorized Access to Grok-3 AI Achieved via Client-Side Code Exploitation – Researcher Claim
A researcher with the handle “single mode” has demonstrated how client-side code manipulation can bypass access controls and gain unauthorized access to Grok-3, an AI model integrated into Elon Musk’s X platform. The exploit involves running a custom JavaScript snippet…
Vgod RANSOMWARE Encrypt Your Entire System and Set A Ransom Notes As Wallpaper
A new ransomware strain dubbed Vgod has emerged recently as a critical cybersecurity threat. This new ransomware employs advanced encryption techniques and psychological pressure tactics. While the ransomware do so by altering the desktop wallpapers of the targeted victims. First…
LibreOffice Vulnerabilities Let Attackers Write to Arbitrary File & Extract Values
Critical vulnerabilities in LibreOffice (CVE-2024-12425 and CVE-2024-12426) allow attackers to overwrite arbitrary files and retrieve sensitive system data via malicious documents. These flaws affect both desktop users and server-side implementations, posing significant risks to enterprises and individual users relying on…
WinRAR 7.10 Latest Version Released For 500 Million Users – What’s New
The latest version of the widely-used file compression tool, WinRAR 7.10, introduces a suite of significant updates aimed at enhancing user experience, performance, and security. Released on February 18, 2025, this iteration marks a major overhaul of the software’s interface,…
Beware of Fake Timesheet Report Email Leading to the Tycoon 2FA Phishing Kit
A new wave of phishing attacks is exploiting fake timesheet report emails to lure victims into the sophisticated Tycoon 2FA phishing kit. This campaign leverages Pinterest Visual Bookmarks as intermediaries, adding a deceptive layer of legitimacy to its tactics. Spider…
ChatGPT Operator Prompt Injection Exploit Leaking Private Data
OpenAI’s ChatGPT Operator, a cutting-edge research preview tool designed for ChatGPT Pro users, has recently come under scrutiny for vulnerabilities that could expose sensitive personal data through prompt injection exploits. ChatGPT Operator is an advanced AI agent equipped with web…
Ransomware Gangs Encrypt Systems After 17hrs From Initial Infection
New research reveals ransomware gangs are accelerating encryption timelines while adopting advanced evasion techniques and data extortion strategies. A 2025 threat report by cybersecurity firm Huntress reveals ransomware gangs now take just 17 hours on average to encrypt systems after…
Xerox Printers Vulnerability Let Attackers Capture Authentication Data From LDAP & SMB
Multiple vulnerabilities in enterprise-grade Xerox Versalink C7025 multifunction printers (MFPs) enable attackers to intercept authentication credentials from Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) services. Designated as CVE-2024-12510 and CVE-2024-12511, these flaws allow malicious actors to execute…
CISA Warns of Apple iOS Vulnerability Exploited in Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, tracked as CVE-2025-24200, being actively exploited in targeted attacks. The flaw, an authorization bypass in Apple’s USB…
RansomHub Evolves To Attack Windows, ESXi, Linux and FreeBSD Operating Systems
The RansomHub ransomware group has rapidly emerged as one of the most prolific cybercrime syndicates of 2024–2025. As this ransomware group done by expanding its arsenal to target Windows, VMware ESXi, Linux, and FreeBSD systems in global attacks. RansomHub ransomware…
New XCSSET Malware Attacking macOS Users by Infecting Xcode Projects
Microsoft Threat Intelligence has identified an evolved iteration of the XCSSET malware family actively exploiting macOS developers via weaponized Xcode projects. This modular backdoor, first documented in 2020, now employs advanced obfuscation techniques, refined persistence mechanisms, and novel infection vectors…
Hidden Malware in WordPress Websites Allows Attackers to Execute Malicious Code Remotely
A sophisticated malware campaign has recently been uncovered by security researchers at Sucuri, targeting WordPress websites through hidden malware and backdoors in the mu-plugins directory. This attack chain allows remote execution of malicious code, enabling full server compromise, data theft,…
IDOR Vulnerability in ExHub Let Attacker Modify Web Hosting Configuration
A critical Insecure Direct Object Reference (IDOR) vulnerability was recently discovered in ExHub, a cloud-based platform for hulia-based development. This flaw allowed attackers to modify web hosting configurations of any project without proper authorization, posing significant risks to affected systems. …
New Android Security Feature that Blocks Changing Sensitive Setting During Calls
Google has unveiled a groundbreaking security feature in Android 16 Beta 2 aimed at combating phone scams by blocking users from altering sensitive settings during active phone calls. This feature, currently live in the beta version, prevents enabling permissions like…
Indian Post Office Portal Exposed Thousands of KYC Records With Username & Mobile Number
The Indian Post Office portal was found vulnerable to an Insecure Direct Object Reference (IDOR) attack, exposing sensitive Know Your Customer (KYC) data of thousands of users. This breach highlights the critical need for robust security measures in government-operated digital…
Multiple Russian Actors Attacking Orgs To Hack Microsoft 365 Accounts via Device Code Authentication
Security researchers at Volexity have uncovered multiple Russian threat actors conducting sophisticated social engineering and spear-phishing campaigns targeting Microsoft 365 accounts through Device Code Authentication exploitation. The attacks, observed since mid-January 2025, involve three distinct groups: “CozyLarch (APT29),” “UTA0304,” and…
Beware of Fake Outlook Troubleshooting Calls that Ends Up In Ransomware Deployment
A sophisticated cyber threat has emerged in recent weeks, targeting unsuspecting users with fake Outlook troubleshooting calls. These calls, designed to appear legitimate, ultimately lead to the deployment of ransomware on the victim’s system. The scam involves a malicious binary…
Threat Actors Leveraging Modified Version of SharpHide Tool To Create Hidden Registry
Threat actors have been utilizing a modified version of the SharpHide tool to create hidden registry values, significantly complicating detection and deletion efforts. This technique exploits Windows registry redirection, making it challenging for standard tools to identify and remove these…
Meta Paid Out $2.3 Million to Researchers via Bug Bounty Program
In 2024, Meta, the parent company of Facebook, Instagram, and WhatsApp, continued its commitment to cybersecurity by awarding over $2.3 million through its bug bounty program. This initiative, which began in 2011, has now surpassed $20 million in total payouts,…
PurpleLab – A Free Cybersecurity Lab for Security Teams to Detect, Analyze & Simulate Threats
In a significant step forward for cybersecurity professionals, PurpleLab offers an innovative open-source cybersecurity lab for creating and testing detection rules, simulating logs, and running malware tests. Designed as an all-in-one lab environment, PurpleLab equips analysts with tools to enhance…
Hackers Abusing Microsoft Teams Meeting Invites to Trick Victims for Gaining Access
In a sophisticated cyberattack campaign, a threat actor identified as Storm-2372 has been leveraging Microsoft Teams meeting invites to execute “device code phishing” attacks. This campaign, observed since August 2024, targets governments, NGOs, IT services, defense, telecommunications, health, education, and…
Linux Kernel 6.14 rc3 Released – What’s New!
Linus Torvalds has released Linux Kernel 6.14-rc3, the latest release candidate for the upcoming Linux 6.14 stable version. Paolo Bonzini, the maintainer of the Kernel-based Virtual Machine (KVM), has also submitted a series of fixes for the Linux Kernel 6.14-rc3,…
Google Chrome AI-Powered Security Now Available for All Users – Enable Now!
In a significant update, Google has announced that its AI-powered security feature is now available to every Chrome user globally. This development marks a pivotal step in enhancing online safety through advanced machine learning techniques. The new security enhancement leverages…
Cybersecurity Weekly Recap: Latest on Attacks, Vulnerabilities, & Data Breaches
Welcome to this week’s Cybersecurity Newsletter, where we bring you the latest updates and key insights from the ever-changing world of cybersecurity. In today’s fast-paced digital environment, staying informed is crucial. Our goal is to provide you with relevant information…
SonicWall Firewall Authentication Bypass Vulnerability Exploited in Wild Following PoC Release
A critical authentication bypass vulnerability in SonicWall firewalls, tracked as CVE-2024-53704, is now being actively exploited in the wild, cybersecurity firms warn. The surge in attacks follows the public release of proof-of-concept (PoC) exploit code on February 10, 2025, by…
New Go-Based Malware Exploits Telegram and Use It as C2 Channel
Researchers have identified a new backdoor malware, written in Go programming language, that leverages Telegram as its command-and-control (C2) channel. While the malware appears to still be under development, it is already fully functional and capable of executing various malicious…
Beware of Fake BSOD Delivered by Malicious Python Script
A recently discovered Python script has been flagged as a potential cybersecurity threat due to its use of a clever anti-analysis trick. This script, which has a low detection rate on VirusTotal (4/59), uses the tkinter library to create a…
Elon Musk’s DOGE Website Database Vulnerability Let Anyone Make Entries Directly
A website launched by Elon Musk’s Department of Government Efficiency (DOGE) has been found to have a significant security vulnerability, allowing unauthorized users to directly modify its content. The vulnerability discovered by two web development experts arises from the website’s…
Lazarus Group Infostealer Malwares Attacking Developers In New Campaign
The notorious Lazarus Group, a North Korean Advanced Persistent Threat (APT) group, has been linked to a sophisticated campaign targeting software developers. This campaign involves the use of infostealer malware, designed to steal sensitive information from developers’ systems. The attack…
XELERA Ransomware Attacking Job Seekers With Weaponized Word Documents
Job seekers have become the target of a sophisticated ransomware campaign in a recent cybersecurity threat, and this campaign dubbed as “XELERA.” This campaign uses fake job offers from the Food Corporation of India (FCI) to lure victims into opening…
Lazarus Group Using New Malware Tactic To Attack Developers Globally
The notorious Lazarus Group in a recent escalation of cyber threats linked to North Korea, has unveiled a sophisticated new tactic to target developers worldwide. This campaign, dubbed “Operation Marstech Mayhem,” involves the deployment of an advanced malware implant known…
EarthKapre APT Drops Weaponized PDF to Compromise Windows Systems
A highly sophisticated cyber espionage group known as EarthKapre, also referred to as RedCurl, has been identified targeting private-sector organizations, particularly those in the Law Firms & Legal Services industry. The eSentire Threat Response Unit (TRU) uncovered the group’s recent…
North Korean IT Workers Infiltrate International Companies To Plant Backdoors on Systems
North Korean IT workers have been infiltrating international companies by securing remote positions under false identities. This tactic not only violates international sanctions but also poses significant cybersecurity risks, including data theft and the installation of backdoors on compromised systems.…