Palo Alto Networks has issued urgent warnings as cybersecurity researchers observe threat actors exploiting a combination of vulnerabilities in PAN-OS, the operating system powering its next-generation firewalls. Coordinated attacks, which bypass chain authentication and privilege escalation flaws, enable unauthorized access…
Tag: Cyber Security News
Threat Actors Using $10 Infostealer Malware To Breach Critical US Security
A new class of cyber threats leveraging $10 infostealer malware kits has compromised critical U.S. military, defense contractor, and federal agency systems, exposing vulnerabilities in national security infrastructure. According to Hudson Rock’s cybercrime intelligence data, over 30,000 infected devices across…
Hackers Turning Stolen Payment Card Data into Apple & Google Wallets
Recent advances in cybercrime strategies are reviving the carding sector, with threat actors leveraging stolen credit card data to create fraudulent Apple Pay and Google Wallet accounts. Dubbed “Ghost Tap,” this new attack methodology uses Near Field Communication (NFC) relay…
Lee Enterprises Ransomware Attack Compromises ‘Critical’ Systems
Lee Enterprises, one of the largest newspaper publishers in the U.S., has confirmed a cybersecurity attack involving adversarial encryption of critical business applications and data exfiltration through double-extortion ransomware tactics. The incident has disrupted print distribution, billing systems, and digital…
Russian Hackers Attacking Signal Messenger Users To Gain Access To Sensitive Data
Google Threat Intelligence Group (GTIG) reveal an escalating campaign by multiple Russia-aligned threat actors targeting Signal Messenger users through sophisticated exploitation of the app’s “linked devices” feature. These attacks, primarily focused on Ukrainian military personnel, government officials, journalists, and activists,…
Raymond IT Systems Hit by Cyber Attack – Investigation In progress
Raymond Limited, a textile and clothing company, reported a cybersecurity attack that affected some of its IT infrastructure. In a regulatory filing to the Bombay Stock Exchange (BSE) and National Stock Exchange (NSE), the company confirmed that threat actors breached…
South Korea Confirm DeepSeek Sending Data Chinese ByteDance Servers
South Korea’s Personal Information Protection Commission (PIPC) announced today that the Chinese AI chatbot DeepSeek transmitted sensitive user data to servers controlled by ByteDance, TikTok’s Beijing-based parent company. The findings follow a technical audit revealing critical security flaws, including unencrypted…
New IRS and Tax-Themed Cyber Attacks Fueled With New Domain Registrations
As the 2025 U.S. tax season reaches its peak, cybersecurity analysts report a dramatic escalation in phishing campaigns exploiting IRS and federal tax themes. Between January 1 and February 18, threat actors registered 158 unique domains mimicking official IRS subdomains…
New Wave of ‘Scam-Yourself’ Attacks Utilizing AI-Generated Videos With DeepFake
A new wave of “Scam-Yourself” attacks leveraging AI-generated deepfake videos and malicious scripts is targeting cryptocurrency enthusiasts and financial traders, marking a dangerous evolution in social engineering tactics. Discovered by cybersecurity researchers at Gen Digital, this campaign exploits verified YouTube…
Most Popular Passwords Cracked Within a Second
Passwords are the first line of defense for protecting sensitive data, yet millions of users worldwide continue to rely on weak and predictable combinations. A recent study by KnownHost reveals alarming trends in password security. It shows that many commonly…
90,000 WordPress Sites Vulnerable to Local File Inclusion Attacks
A severe security flaw in the Jupiter X Core plugin for WordPress exposed over 90,000 websites to Local File Inclusion (LFI) and Remote Code Execution (RCE) attacks. The vulnerability tracked as CVE-2025-0366 with a CVSS score of 8.8 (High), enables authenticated attackers…
Firefox 135.0.1 Released with Fix for High-Severity Memory Safety Vulnerabilities
Mozilla has released Firefox 135.0.1, a stability and security update addressing a high-severity memory safety vulnerability (CVE-2025-1414) that exposed users to potential remote code execution (RCE) attacks. The patch resolves critical flaws in Firefox 135.0, which could have allowed attackers…
Yahoo Data Leak – Hackers Allegedly Advertised 602,000 Email Accounts
A hacker operating under the alias “exelo” has allegedly advertised a database containing 602,800 Yahoo email accounts on an underground forum. The post claims the dataset is “private and non-Russian. ” The full list costs $100. A free sample of…
Critical Apache Ignite Vulnerability Let Attackers Execute Remote Code
A critical vulnerability in Apache Ignite tracked as CVE-2024-52577, exposes systems to remote code execution (RCE) attacks due to improper enforcement of class serialization filters. Rated CVSS 9.8, this flaw affects Ignite versions 2.6.0 through 2.16.x, enabling attackers to execute…
CISA Releases Two New ICS Advisories Exploits Following Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) released two Industrial Control Systems (ICS) advisories, addressing critical vulnerabilities in Delta Electronics CNCSoft-G2 and Rockwell Automation GuardLogix controllers. These advisories highlight exploitable flaws in systems widely used in manufacturing, energy, and critical…
Weaponized Signal, Line, and Gmail Apps Delivers Malware That Changes System Defenses
A sophisticated cyberattack campaign targeting Chinese-speaking users, malicious actors have weaponized fake versions of popular applications such as Signal, Line, and Gmail. These fake and weaponized apps are distributed via deceptive download pages that deliver malware capable of altering system…
GPT-4o Copilot Trained in Over 30 Popular Programming Languages
Microsoft has unveiled GPT-4o Copilot, a cutting-edge code completion model now available for Visual Studio Code (VS Code) users. Built on the GPT-4o mini architecture and trained on over 275,000 high-quality public repositories spanning more than 30 popular programming languages,…
Russian Government Proposed New Penalties to Combat Cybercrime
The Russian government announced a comprehensive legislative package on February 10, 2025, introducing severe penalties for cybercrimes. The reforms, which amend over 30 existing laws, aim to modernize Russia’s cybersecurity framework by escalating prison terms, expanding asset confiscation protocols, and…
Does AI Detection Remover Really Work? How to Fix Text Like a Pro!
Artificial intelligence (AI) is transforming everything! It influences how we communicate and how we write. Click-click — your text is ready. ChatGPT and other language models are helping people generate content. But, just like every superhero has a weakness, AI-generated…
CISA Warns of Palo Alto PAN-OS Vulnerability Actively Exploited in the Wild
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding actively exploiting a high-severity authentication bypass vulnerability (CVE-2025-0108) in Palo Alto Networks PAN-OS, the operating system powering the company’s firewall devices. With over 25 malicious IPs targeting…
Chrome Buffer Overflow Vulnerabilities Allow Arbitrary Code Execution & Gain System Access
Google has urgently patched two high-severity heap buffer overflow vulnerabilities in its Chrome browser, CVE-2025-0999, and CVE-2025-1426, that could allow attackers to execute arbitrary code and seize control of affected systems. The vulnerabilities, fixed in Chrome 133.0.6943.126/.127 for Windows/Mac and…
CISA Warns of SonicWall SonicOS RCE Vulnerability Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has escalated warnings about a critical zero-day vulnerability in SonicWall’s SonicOS, designating CVE-2024-53704 for immediate remediation in its Known Exploited Vulnerabilities (KEV) catalog. This improper authentication flaw, which enables remote attackers to…
Threat Actors Trojanize Popular Versions of Games To Infect Systems Bypassing Evasion Techniques
In a sophisticated cyberattack campaign dubbed “StaryDobry,” threat actors have exploited popular games to distribute malicious software, targeting users worldwide. The campaign, first detected on December 31, 2024, leveraged trojanized versions of games such as BeamNG.drive, Garry’s Mod, and Dyson…
New Research Proposed To Enhance MITRE ATT&CK In Dynamic Cybersecurity Environments
Cybersecurity researchers have proposed groundbreaking enhancements to the MITRE ATT&CK framework, aiming to strengthen its adaptability in dynamic and evolving threat landscapes. As cyber adversaries increasingly exploit emerging technologies like generative AI and industrial control systems (ICS), the need for…
How Cyber Threat Intelligence Helps with Alert Triage
Between threat detection and response, there is a vitally important operation known as alert triage. If not staged properly, it can render the whole SOC’s performance inefficient. This operation is alert triage — assessing and prioritizing security alerts. SIEM tools,…
OpenSSH Client & Server Vulnerabilities Enables MiTM & DoS Attacks
The Qualys Threat Research Unit (TRU) has uncovered two high-severity vulnerabilities in OpenSSH, the widely used suite for secure network communication. Tracked as CVE-2025-26465 and CVE-2025-26466, these flaws enable machine-in-the-middle (MitM) attacks against clients and pre-authentication denial-of-service (DoS) exploits targeting…
Weaponized PDF Documents Deliver Lumma InfoStealer Attacking Educational Institutions
The Lumma InfoStealer malware has been observed leveraging weaponized PDF documents to target educational institutions. This sophisticated campaign exploits malicious LNK (shortcut) files disguised as legitimate PDFs, initiating multi-stage infection processes that compromise sensitive data. Educational infrastructures, often less fortified…
4 Million Stolen Credit Cards to Be Released for Free by B1ack’s Stash Marketplace
The cybersecurity community is on high alert as B1ack’s Stash, a known marketplace on the dark web, has announced a massive leak of 4 million stolen credit card details. The Dark Web Informer threat intelligence researchers posted on X state…
New LLM Vulnerability Let Attackers Exploit The ChatGPT Like AI Models
A newly uncovered vulnerability in large language models (LLMs) has raised significant concerns about the security and ethical use of AI systems like OpenAI’s ChatGPT. Dubbed “Time Bandit,” this exploit manipulates the temporal reasoning capabilities of LLMs. This enables the…
Intruder Added Free Vulnerability Intelligence Platform ‘Intel’ with AI-Generated CVE Descriptions
Intel by Intruder now uses AI to contextualize NVD descriptions, helping security teams assess risk faster. Intruder, a leader in attack surface management, has launched AI-generated descriptions for Common Vulnerabilities and Exposures (CVEs) within its free vulnerability intelligence platform, Intel.…
Hackers Hiding Credit Card Stealer Script Within ![]()
Tag
Cybercriminals have developed a sophisticated method to steal credit card information by embedding malicious scripts within <img> tags on e-commerce websites. This technique, often associated with MageCart attacks, exploits the trustworthiness of image tags to evade detection while targeting platforms…
EagerBee Malware Attacking Government Entities & ISPs To Deploy Backdoor
A sophisticated malware framework dubbed EagerBee is actively targeting government agencies and Internet Service Providers (ISPs). EagerBee is actively targeting these organizations across the Middle East. While the EagerBee was found deploying advanced backdoor capabilities through novel technical implementations. The…
Earth Preta Abuse Microsoft Application Virtualization Injector To Inject Malicious Payloads
Advanced Persistent Threat (APT) group Earth Preta (a.k.a. Mustang Panda) has been observed weaponizing the Microsoft Application Virtualization Injector (MAVInject.exe) to bypass security software and implant backdoors in government systems across Asia-Pacific regions. The campaign, analyzed by Trend Micro’s Threat…
Free Security Incident Response Toolkit Released to Detect Cyber Intrusions
In a significant development for cybersecurity professionals and organizations worldwide, SecTemplates has announced the release of its Incident Response Program Pack 1.5, a free, open-source toolkit designed to streamline the implementation of robust security incident response protocols. This release provides…
Juniper Warns of Critical Authentication Bypass Vulnerability Affecting Multiple Products
Juniper Networks has issued an urgent security advisory addressing a critical API authentication bypass vulnerability (CVE-2025-21589) affecting its Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router product lines. The flaw, carrying a maximum CVSS base score of…
Indian Authorities Seize Loot From Collapsed BitConnect Crypto Scam
In a significant crackdown on one of India’s largest cryptocurrency frauds, the Enforcement Directorate (ED) has seized digital assets valued at ₹1,646 crore linked to the now-defunct BitConnect lending program. The operation, conducted under the Prevention of Money Laundering Act (PMLA),…
DarkMind A Novel Backdoor Attack Exploits Reasoning Capabilities of Customized LLMs
A groundbreaking study by researchers Zhen Guo and Reza Tourani at Saint Louis University has exposed a novel vulnerability in customized large language models (LLMs) like GPT-4o and LLaMA-3. Dubbed DarkMind, this backdoor attack exploits the reasoning capabilities of LLMs…
Unauthorized Access to Grok-3 AI Achieved via Client-Side Code Exploitation – Researcher Claim
A researcher with the handle “single mode” has demonstrated how client-side code manipulation can bypass access controls and gain unauthorized access to Grok-3, an AI model integrated into Elon Musk’s X platform. The exploit involves running a custom JavaScript snippet…
Vgod RANSOMWARE Encrypt Your Entire System and Set A Ransom Notes As Wallpaper
A new ransomware strain dubbed Vgod has emerged recently as a critical cybersecurity threat. This new ransomware employs advanced encryption techniques and psychological pressure tactics. While the ransomware do so by altering the desktop wallpapers of the targeted victims. First…
LibreOffice Vulnerabilities Let Attackers Write to Arbitrary File & Extract Values
Critical vulnerabilities in LibreOffice (CVE-2024-12425 and CVE-2024-12426) allow attackers to overwrite arbitrary files and retrieve sensitive system data via malicious documents. These flaws affect both desktop users and server-side implementations, posing significant risks to enterprises and individual users relying on…
WinRAR 7.10 Latest Version Released For 500 Million Users – What’s New
The latest version of the widely-used file compression tool, WinRAR 7.10, introduces a suite of significant updates aimed at enhancing user experience, performance, and security. Released on February 18, 2025, this iteration marks a major overhaul of the software’s interface,…
Beware of Fake Timesheet Report Email Leading to the Tycoon 2FA Phishing Kit
A new wave of phishing attacks is exploiting fake timesheet report emails to lure victims into the sophisticated Tycoon 2FA phishing kit. This campaign leverages Pinterest Visual Bookmarks as intermediaries, adding a deceptive layer of legitimacy to its tactics. Spider…
ChatGPT Operator Prompt Injection Exploit Leaking Private Data
OpenAI’s ChatGPT Operator, a cutting-edge research preview tool designed for ChatGPT Pro users, has recently come under scrutiny for vulnerabilities that could expose sensitive personal data through prompt injection exploits. ChatGPT Operator is an advanced AI agent equipped with web…
Ransomware Gangs Encrypt Systems After 17hrs From Initial Infection
New research reveals ransomware gangs are accelerating encryption timelines while adopting advanced evasion techniques and data extortion strategies. A 2025 threat report by cybersecurity firm Huntress reveals ransomware gangs now take just 17 hours on average to encrypt systems after…
Xerox Printers Vulnerability Let Attackers Capture Authentication Data From LDAP & SMB
Multiple vulnerabilities in enterprise-grade Xerox Versalink C7025 multifunction printers (MFPs) enable attackers to intercept authentication credentials from Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) services. Designated as CVE-2024-12510 and CVE-2024-12511, these flaws allow malicious actors to execute…
CISA Warns of Apple iOS Vulnerability Exploited in Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, tracked as CVE-2025-24200, being actively exploited in targeted attacks. The flaw, an authorization bypass in Apple’s USB…
RansomHub Evolves To Attack Windows, ESXi, Linux and FreeBSD Operating Systems
The RansomHub ransomware group has rapidly emerged as one of the most prolific cybercrime syndicates of 2024–2025. As this ransomware group done by expanding its arsenal to target Windows, VMware ESXi, Linux, and FreeBSD systems in global attacks. RansomHub ransomware…
New XCSSET Malware Attacking macOS Users by Infecting Xcode Projects
Microsoft Threat Intelligence has identified an evolved iteration of the XCSSET malware family actively exploiting macOS developers via weaponized Xcode projects. This modular backdoor, first documented in 2020, now employs advanced obfuscation techniques, refined persistence mechanisms, and novel infection vectors…
Hidden Malware in WordPress Websites Allows Attackers to Execute Malicious Code Remotely
A sophisticated malware campaign has recently been uncovered by security researchers at Sucuri, targeting WordPress websites through hidden malware and backdoors in the mu-plugins directory. This attack chain allows remote execution of malicious code, enabling full server compromise, data theft,…
IDOR Vulnerability in ExHub Let Attacker Modify Web Hosting Configuration
A critical Insecure Direct Object Reference (IDOR) vulnerability was recently discovered in ExHub, a cloud-based platform for hulia-based development. This flaw allowed attackers to modify web hosting configurations of any project without proper authorization, posing significant risks to affected systems. …
New Android Security Feature that Blocks Changing Sensitive Setting During Calls
Google has unveiled a groundbreaking security feature in Android 16 Beta 2 aimed at combating phone scams by blocking users from altering sensitive settings during active phone calls. This feature, currently live in the beta version, prevents enabling permissions like…
Indian Post Office Portal Exposed Thousands of KYC Records With Username & Mobile Number
The Indian Post Office portal was found vulnerable to an Insecure Direct Object Reference (IDOR) attack, exposing sensitive Know Your Customer (KYC) data of thousands of users. This breach highlights the critical need for robust security measures in government-operated digital…
Multiple Russian Actors Attacking Orgs To Hack Microsoft 365 Accounts via Device Code Authentication
Security researchers at Volexity have uncovered multiple Russian threat actors conducting sophisticated social engineering and spear-phishing campaigns targeting Microsoft 365 accounts through Device Code Authentication exploitation. The attacks, observed since mid-January 2025, involve three distinct groups: “CozyLarch (APT29),” “UTA0304,” and…
Beware of Fake Outlook Troubleshooting Calls that Ends Up In Ransomware Deployment
A sophisticated cyber threat has emerged in recent weeks, targeting unsuspecting users with fake Outlook troubleshooting calls. These calls, designed to appear legitimate, ultimately lead to the deployment of ransomware on the victim’s system. The scam involves a malicious binary…
Threat Actors Leveraging Modified Version of SharpHide Tool To Create Hidden Registry
Threat actors have been utilizing a modified version of the SharpHide tool to create hidden registry values, significantly complicating detection and deletion efforts. This technique exploits Windows registry redirection, making it challenging for standard tools to identify and remove these…
Meta Paid Out $2.3 Million to Researchers via Bug Bounty Program
In 2024, Meta, the parent company of Facebook, Instagram, and WhatsApp, continued its commitment to cybersecurity by awarding over $2.3 million through its bug bounty program. This initiative, which began in 2011, has now surpassed $20 million in total payouts,…
PurpleLab – A Free Cybersecurity Lab for Security Teams to Detect, Analyze & Simulate Threats
In a significant step forward for cybersecurity professionals, PurpleLab offers an innovative open-source cybersecurity lab for creating and testing detection rules, simulating logs, and running malware tests. Designed as an all-in-one lab environment, PurpleLab equips analysts with tools to enhance…
Hackers Abusing Microsoft Teams Meeting Invites to Trick Victims for Gaining Access
In a sophisticated cyberattack campaign, a threat actor identified as Storm-2372 has been leveraging Microsoft Teams meeting invites to execute “device code phishing” attacks. This campaign, observed since August 2024, targets governments, NGOs, IT services, defense, telecommunications, health, education, and…
Linux Kernel 6.14 rc3 Released – What’s New!
Linus Torvalds has released Linux Kernel 6.14-rc3, the latest release candidate for the upcoming Linux 6.14 stable version. Paolo Bonzini, the maintainer of the Kernel-based Virtual Machine (KVM), has also submitted a series of fixes for the Linux Kernel 6.14-rc3,…
Google Chrome AI-Powered Security Now Available for All Users – Enable Now!
In a significant update, Google has announced that its AI-powered security feature is now available to every Chrome user globally. This development marks a pivotal step in enhancing online safety through advanced machine learning techniques. The new security enhancement leverages…
Cybersecurity Weekly Recap: Latest on Attacks, Vulnerabilities, & Data Breaches
Welcome to this week’s Cybersecurity Newsletter, where we bring you the latest updates and key insights from the ever-changing world of cybersecurity. In today’s fast-paced digital environment, staying informed is crucial. Our goal is to provide you with relevant information…
SonicWall Firewall Authentication Bypass Vulnerability Exploited in Wild Following PoC Release
A critical authentication bypass vulnerability in SonicWall firewalls, tracked as CVE-2024-53704, is now being actively exploited in the wild, cybersecurity firms warn. The surge in attacks follows the public release of proof-of-concept (PoC) exploit code on February 10, 2025, by…
New Go-Based Malware Exploits Telegram and Use It as C2 Channel
Researchers have identified a new backdoor malware, written in Go programming language, that leverages Telegram as its command-and-control (C2) channel. While the malware appears to still be under development, it is already fully functional and capable of executing various malicious…
Beware of Fake BSOD Delivered by Malicious Python Script
A recently discovered Python script has been flagged as a potential cybersecurity threat due to its use of a clever anti-analysis trick. This script, which has a low detection rate on VirusTotal (4/59), uses the tkinter library to create a…
Elon Musk’s DOGE Website Database Vulnerability Let Anyone Make Entries Directly
A website launched by Elon Musk’s Department of Government Efficiency (DOGE) has been found to have a significant security vulnerability, allowing unauthorized users to directly modify its content. The vulnerability discovered by two web development experts arises from the website’s…
Lazarus Group Infostealer Malwares Attacking Developers In New Campaign
The notorious Lazarus Group, a North Korean Advanced Persistent Threat (APT) group, has been linked to a sophisticated campaign targeting software developers. This campaign involves the use of infostealer malware, designed to steal sensitive information from developers’ systems. The attack…
XELERA Ransomware Attacking Job Seekers With Weaponized Word Documents
Job seekers have become the target of a sophisticated ransomware campaign in a recent cybersecurity threat, and this campaign dubbed as “XELERA.” This campaign uses fake job offers from the Food Corporation of India (FCI) to lure victims into opening…
Lazarus Group Using New Malware Tactic To Attack Developers Globally
The notorious Lazarus Group in a recent escalation of cyber threats linked to North Korea, has unveiled a sophisticated new tactic to target developers worldwide. This campaign, dubbed “Operation Marstech Mayhem,” involves the deployment of an advanced malware implant known…
EarthKapre APT Drops Weaponized PDF to Compromise Windows Systems
A highly sophisticated cyber espionage group known as EarthKapre, also referred to as RedCurl, has been identified targeting private-sector organizations, particularly those in the Law Firms & Legal Services industry. The eSentire Threat Response Unit (TRU) uncovered the group’s recent…
North Korean IT Workers Infiltrate International Companies To Plant Backdoors on Systems
North Korean IT workers have been infiltrating international companies by securing remote positions under false identities. This tactic not only violates international sanctions but also poses significant cybersecurity risks, including data theft and the installation of backdoors on compromised systems.…
Apache Fineract SQL Injection Vulnerability Let Inject Malicious Data
A critical SQL injection vulnerability has been identified in Apache Fineract, an open-source core banking software widely used for financial services. This flaw, tracked as CVE-2024-32838, affects versions 1.4 through 1.9 and has been classified as important, with a CVSS…
NVIDIA Container Toolkit Vulnerability Let Attackers Execute Code
NVIDIA has released a security update to address a critical vulnerability in its NVIDIA Container Toolkit and NVIDIA GPU Operator, which could allow attackers to execute arbitrary code, escalate privileges, and gain access to the host file system. This vulnerability…
CISA Releases 20 ICS Advisories Detailing Vulnerabilities & Exploits
The Cybersecurity and Infrastructure Security Agency (CISA) has released twenty new Industrial Control Systems (ICS) advisories, aimed at addressing critical vulnerabilities in industrial systems. The advisories cover a wide range of ICS products from prominent vendors such as Siemens, ORing,…
Beware of Malicious Browser Updates That Installs SocGholish Malware
Cyber threats have evolved significantly in recent years, with malicious actors employing sophisticated tactics to compromise user systems. One such threat is the SocGholish malware, which has been actively distributed through fake browser updates since 2017. This malware campaign exploits…
New Astaroth 2FA Phishing Kit Targeting Gmail, Yahoo, Office 365, and 3rd-Party Logins
A sophisticated phishing kit, known as the Astaroth 2FA phishing kit, has been identified targeting major email services such as Gmail, Yahoo, and Office 365, along with third-party login platforms. This kit is designed to bypass two-factor authentication (2FA) security…
REF7707 Hackers Attacking Windows & Linux Machines Using FINALDRAFT Malware
A sophisticated hacking campaign has been unveiled recently by Elastic Security Labs, dubbed “REF7707,” which has been targeting both Windows and Linux systems using novel malware families, including FINALDRAFT, GUIDLOADER, and PATHLOADER. This campaign has been notable for its advanced…
New Device Code Phishing Attack Exploit Device Code Authentication To Capture Authentication Tokens
A sophisticated phishing campaign, identified by Microsoft Threat Intelligence, has been exploiting a technique known as “device code phishing” to capture authentication tokens. This attack, attributed to a group called Storm-2372, has been active since August 2024 and targets a…
RedMike Hackers Exploited 1000+ Cisco Devices to Gain Admin Access
Researchers observed a sophisticated cyber-espionage campaign led by the Chinese state-sponsored group known as “Salt Typhoon,” also referred to as “RedMike.” Between December 2024 and January 2025, the group exploited over 1,000 unpatched Cisco network devices globally, targeting telecommunications providers…
PostgreSQL Terminal Tool Injection Vulnerability Allows Remote Code Execution
Researchers have uncovered a high-severity SQL injection vulnerability, CVE-2025-1094, affecting PostgreSQL’s interactive terminal tool, psql. This flaw was identified during research into the exploitation of CVE-2024-12356, a remote code execution (RCE) vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote…
AMD Ryzen DLL Hijacking Vulnerability Let Attackers Execute Arbitrary Code
A high-severity security vulnerability, identified as CVE-2024-21966, has been discovered in the AMD Ryzen™ Master Utility, a software tool designed to optimize the performance of AMD Ryzen™ processors. The vulnerability, classified as DLL hijacking, could allow attackers to execute arbitrary…
WinZip Vulnerability Let Remote Attackers Execute Arbitrary Code
A newly disclosed high-severity vulnerability in WinZip, tracked as CVE-2025-1240, enables remote attackers to execute arbitrary code on affected systems by exploiting malformed 7Z archive files. The flaw, rated 7.8 on the CVSS scale, impacts WinZip 28.0 (Build 16022) and…
Hackers Actively Exploiting New PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks has released a patch for a high-severity authentication bypass vulnerability, identified as CVE-2025-0108, affecting their PAN-OS software. GreyNoise has observed active exploitation attempts targeting this vulnerability. The flaw allows unauthenticated attackers to bypass the authentication required by the…
New Windows UI 0-Day Vulnerability Actively Exploited in the Wild by Chinese APT Group
ClearSky Cyber Security has uncovered a user interface (UI) vulnerability in Microsoft Windows that is currently being exploited by a sophisticated threat actor known as Mustang Panda, a group believed to be affiliated with Chinese state interests. The exploitation involves…
Threat Actors In Russia, China, and Iran Targeting Local Communities In The U.S – New Report
A groundbreaking report from the Alliance for Securing Democracy (ASD) at the German Marshall Fund has revealed a disturbing trend: foreign threat actors from Russia, China, and Iran are increasingly targeting local communities across the United States. These operations aim…
Burp AI – Burp Suite Now Integrate AI Powered Extension for Web Pentesting with 10,000 Free AI Credits
Burp AI, PortSwigger unveils AI-driven extensibility in Burp Suite Professional, revolutionizing the way security professionals approach application testing. In its latest stride toward innovation, PortSwigger, the creator of the widely acclaimed Burp Suite, has announced the integration of artificial intelligence…
APT43 Hackers Attacking Academic Institutions With Exposed Credentials
APT43, a notorious North Korean state-sponsored hacking group, has been actively targeting academic institutions worldwide, exploiting exposed credentials to gain unauthorized access. Linked to the Reconnaissance General Bureau (RGB), APT43 is known for its strategic intelligence gathering and financially motivated…
Security Researchers Now Analyse Any URL With ANY.RUN Safebrowsing Tool Extension for Free
ANY.RUN, a global leader in Interactive Malware sandboxes, has upgraded its browser extension to include the Safebrowsing feature, which is now available for free to all users. This tool is designed to help businesses and individuals combat phishing attempts, malicious…
New Phishing Attacks Abuses Webflow CDN & CAPTCHAs To Steal Credit Card Details
A recent phishing campaign has been uncovered by Netskope Threat Labs, highlighting a sophisticated technique where attackers exploit Webflow’s Content Delivery Network (CDN) and fake CAPTCHAs to steal sensitive financial information. This campaign, ongoing since the second half of 2024,…
Hackers Exploited Palo Alto’s Firewall Vulnerability to Deploy RA World Ransomware
In a significant cybersecurity breach, attackers exploited a critical vulnerability in Palo Alto Networks’ PAN-OS firewall software (CVE-2024-0012) to deploy the RA World ransomware. The attack, which occurred in late 2024, targeted a medium-sized software and services company in South…
Hackers Exploiting ThinkPHP & ownCloud Vulnerabilities at Large Scale
A recent surge in exploitation activity has been observed targeting two critical vulnerabilities, CVE-2022-47945 in ThinkPHP and CVE-2023-49103 in ownCloud. These attacks highlight the persistent threat posed by unpatched systems and the challenges organizations face in prioritizing vulnerability management. CVE-2022-47945…
Winnti Hackers Attacking Japanese Organizations With New Malware
The China-based Winnti Group has targeted Japanese organizations in a recent cyberattack campaign known as “RevivalStone,” in the manufacturing, materials, and energy sectors. This campaign, confirmed in March 2024, utilizes a new version of the Winnti malware with enhanced capabilities.…
Threat Actors Exploiting DeepSeek’s Popularity To Deploy Malware
The Chinese AI startup DeepSeek has gained significant attention in the global AI market with its open-source inference model, DeepSeek-R1. This model has been touted as a more cost-effective alternative to existing AI solutions, outperforming OpenAI’s GPT-o1. However, this newfound…
Russian Hackers Leverages Weaponized Microsoft Key Management Service (KMS) To Hack Windows Systems
Russian-backed hackers, specifically the Sandworm APT group (also known as APT44 or UAC-0145), have been using weaponized Microsoft Key Management Service (KMS) activators to infiltrate Windows systems in Ukraine. This campaign, which has been active since late 2023, exploits pirated…
RedNote App Vulnerability Allows Access to User Files on iOS & Android Devices
Critical vulnerabilities were uncovered in the popular Chinese social media app RedNote (also known as XiaoHongShu), which boasts over 300 million active users globally. These security flaws, present in both Android and iOS versions, expose users’ browsing activity, device metadata,…
Windows 11’s New Compression Formats Pose Security Risks with libarchive
Microsoft introduced a major update to Windows 11 (KB5031455), adding native support for 11 new compression formats, including RAR and 7z. This update aimed to enhance user convenience by enabling file management directly within File Explorer. However, the integration of…
New Malware Exploiting Outlook As a Communication Channel via The Microsoft Graph API
A new family of malware has been discovered that leverages Microsoft Outlook as a communication channel via the Microsoft Graph API. This sophisticated malware includes a custom loader and backdoor, known as PATHLOADER and FINALDRAFT, respectively. The malware is part…
KASLR Exploited: Breaking macOS Apple Silicon Kernel Hardening Techniques
Security researchers from Korea University have unveiled a new vulnerability in macOS systems running on Apple Silicon processors. Dubbed “SysBumps,” this attack successfully circumvents Kernel Address Space Layout Randomization (KASLR), a critical security mechanism designed to protect kernel memory from…
Amazon Machine Image Name Confusion Attack Let Attackers Publish Resource
Researchers uncovered a critical vulnerability in Amazon Web Services (AWS) involving Amazon Machine Images (AMIs). Dubbed the “whoAMI” attack, this exploit leverages a name confusion attack, a subset of supply chain attacks, to gain unauthorized code execution within AWS accounts. …
Path Confusion in Nginx/Apache Leads to Critical Auth Bypass in PAN-OS
Palo Alto Networks has recently disclosed a critical vulnerability in its PAN-OS network security operating system, tracked as CVE-2025-0108, which allows attackers to bypass authentication on the management web interface. This vulnerability, with a CVSSv3.1 score of 7.8, exposes affected…
Have I Been Pwned Likely to Ban Resellers Subscriptions
Have I Been Pwned (HIBP), a popular data breach notification service, has expressed a strong inclination to ban resellers from obtaining platform memberships. Troy Hunt made this decision after thoroughly examining the excessive support burden these resellers impose on the…