HACKRead
New HP report reveals cybercriminals are increasingly leveraging "cat-phishing" techniques, exploiting open redirects in legitimate websites to deceive users and deliver malware.
SecurityWeek
Google releases Chrome 125 to the stable channel with patches for nine vulnerabilities, including a zero-day.
Cyber Security News
The Wireshark team has announced the release of Wireshark 4.2.5, a maintenance update to the popular network protocol analyzer.
Cyber Security News
Google has released update for its Chrome to patch a high-severity vulnerability that is being actively exploited by attackers in the wild.
SC Magazine
Security pros say the uptick in Chrome zero-days this week demonstrates an increased focus by threat actors on attacking browsers.
Bleeping Computer
Google has released a new emergency Chrome security update to address the third zero-day vulnerability exploited in attacks within a week.
Bleeping Computer
Google has released a new emergency Chrome security update to address the third zero-day vulnerability exploited in attacks within a week.
DarkReading
CVE-2024-30051 is the most concerning out of this month's Patch Tuesday offerings, and is already under active exploit by several QakBot actors.
DarkReading
Exploit code is circulating for CVE-2024-4761, disclosed less than a week after a similar security vulnerability was disclosed as being used in the wild.
Bleeping Computer
Google has released emergency security updates for the Chrome browser to address a high-severity zero-day vulnerability tagged as exploited in attacks.
SC Magazine
Security pros say the industry can expect to see this bug exploited soon, so patch, monitor and conduct other measures, like browser isolation and sandboxing.
Bleeping Computer
Google has released a security update for the Chrome browser to fix the fifth zero-day vulnerability exploited in the wild since the start of the year.
Bleeping Computer
Google has rolled back a recent release of its reCaptcha captcha script after a bug caused the service to no longer work on Firefox for Windows.
DarkReading
The purported metadata for each these containers had embedded links to malicious files.
Cyber Security News
Reviewing the “getJspFromRequest” method details we can see that it pulls the HTTP parameter “jsp” from the web request.
Infosecurity News
The top malicious domains attracted over 100,000 hits each, according to Akamai Security
Cyber Security News
Welcome to this week's edition of the Cyber Security News Weekly Round-Up. This issue covers the latest vulnerabilities, cyber attacks, and emerging threats that have been making headlines. Stay informed and stay secure!
Security Affairs
A hacking campaign targeted Ukraine exploiting a seven-year-old vulnerability in Microsoft Office to deliver Cobalt Strike.
The Hacker News
Cybersecurity researchers have uncovered a targeted cyber attack against Ukraine that leveraged a 7-year-old Microsoft Office flaw to deploy Cobalt St
The Hacker News
North Korean hackers used fake job offers to deliver a new Trojan called Kaolin RAT. It can change file timestamps and load malware.
Cyber Security News
A significant vulnerability was detected in IBM QRadar Suite Software and Cloud Pak for Security that allows attackers to execute arbitrary
Cyber Security News
Hackers abuse Electron Framework's cross-platform desktop app capabilities based on web tech like HTML, JS, CSS.
The Hacker News
A suspected Vietnamese hacking group is leveraging CDN cache to distribute malware undetected.
SC Magazine
A new CryptBot variant targets password managers and authentication apps in the new campaign.
Bleeping Computer
A threat actor has been using a content delivery network cache to store information-stealing malware in an ongoing campaign targeting systems U.S., the U.K., Germany, and Japan.
%20(1).webp)
Cyber Security News
Cybersecurity revelation, over 50k websites using the popular WordPress plugin Forminator are at risk due to multiple vulnerabilities.
.webp)
Cyber Security News
A vulnerability was identified in the WordPress theme, "Responsive," allowing attackers to inject arbitrary HTML content into websites.
DarkReading
An open direct vulnerability in the Nespresso Web domain lets attackers bypass detection as they attempt to steal victims' Microsoft credentials.
Bleeping Computer
The Forminator WordPress plugin used in over 500,000 sites is vulnerable to a flaw that allows malicious actors to perform unrestricted file uploads to the server.
Cyber Security News
Sandbox Tools for Phishing Analysis 2024: 1. Interactivity 2. RSPAMD Integration 3. Suricata Rule Engine 4. MITRE ATT&CK 5.Matrix 6. Phishing Tag.
Cyber Security News
Oracle has released its Critical Patch Update (CPU) for April 2024, addressing 372 vulnerabilities across multiple products.
Cyber Security News
The Juniper networks owned Junos OS has been discovered with multiple vulnerabilities that are associated with Denial of Service (DoS),
Bleeping Computer
There are things that you can do to make your web apps more resistant to social engineering. Learn more from Outpost24 on securing your web applications.
Cyber Security News
we’ll dissect a timely example of credential theft—StrelaStealer—to identify the malware’s characteristics and capabilities.
Bleeping Computer
Learning is a constant of an IT career. This StackSkills lifetime subscription keeps you on the cutting edge for $39.99, $560 off the $600 MSRP with code ENJOY20 at checkout, now through 11:59 pm PST on April 16th.
The Hacker News
TA547 hacker group adopts new tactics, possibly harnessing the power of generative AI, to deploy the Rhadamanthys info stealer in attacks on German or
DarkReading
With a complex attack chain and a Telegram C2, CoralRaider targets victims in Asian countries — and appears to have accidentally infected itself.
Cyber Security News
A recent phishing campaign targeting Latin America utilized emails with ZIP attachments containing an HTML file disguised as an invoice using
The Hacker News
Latin America targeted in new phishing attack. Emails contain malicious HTML files disguised as invoices.
Cyber Security News
Google fixed three vulnerabilities in the Chrome browser on Tuesday, along with another zero-day exploit that was exploited during the Pwn2Own
The Hacker News
CoralRaider, a suspected Vietnamese threat actor, has been on the prowl since May 2023, targeting Asia and Southeast Asia with malware aimed at steali
Security Affairs
Google fixed another Chrome zero-day vulnerability exploited during the Pwn2Own hacking competition in March.
Bleeping Computer
Google has fixed another zero-day vulnerability in the Chrome browser, which was exploited by security researchers during the Pwn2Own hacking contest last month.
.webp)
Cyber Security News
McAfee Labs' findings reveal how Pikabot leverages a variety of file types, including HTML, Javascript, and Excel, to breach security defenses.
Ars Technica
Malicious updates made to a ubiquitous tool were a few weeks away from going mainstream.
Bleeping Computer
Security researchers found a new version of the Vultur banking trojan for Android that includes more advanced remote control capabilities and an improved evasion mechanism.
Cyber Security News
Google patched seven vulnerabilities in the Chrome browser on Tuesday, including two zero-day exploits that were exploited at the Pwn2Own
Bleeping Computer
Google fixed seven security vulnerabilities in the Chrome web browser on Tuesday, including two zero-days exploited during the Pwn2Own Vancouver 2024 hacking competition.
DarkReading
Threat actors are widely adopting the fast-growing, low-cost phishing-as-a-service (PhaaS) platform, which is sold via Telegram.
Cyber Security News
The persistent search for money and the threat actors becoming more sophisticated are driving the alarming rate of malware change.
The Cyber Express
A Rank Math plugin vulnerability affects over 2 million WordPress websites. The flaw, identified as a Stored Cross-Site Scripting (XSS)
Infosecurity News
Discovered by Sekoia in 2023, the kit is associated with Adversary-in-The-Middle (AiTM) attacks
Bleeping Computer
Cybercriminals have been increasingly using a new phishing-as-a-service (PhaaS) platform named 'Tycoon 2FA' to target Microsoft 365 and Gmail accounts and bypass two-factor authentication (2FA) protection.
SecurityWeek
More than 100 organizations in the US and EU have been targeted in recent StrelaStealer infostealer campaigns.
Bleeping Computer
Google's new AI-powered 'Search Generative Experience' algorithms recommend scam sites that redirect visitors to unwanted Chrome extensions, fake iPhone giveaways, browser spam subscriptions, and tech support scams.
Bleeping Computer
A new large-scale StrelaStealer malware campaign has impacted over a hundred organizations across the United States and Europe, attempting to steal email account credentials.
The Hacker News
Kimsuky shifts tactics, now using CHM files to deliver malware, targeting sensitive data globally.
.png)
Cyber Security News
cybersecurity news will keep you posted on the latest developments, exposures, advances, occurrences, threats, and narratives in this field.
Security Affairs
A large-scale malware campaign, tracked as Sign1, has already compromised 39,000 WordPress sites in the last six months.
The Hacker News
ybersecurity firm Mandiant links recent cyber attacks on diplomatic entities to Midnight Blizzard, a group with ties to Russia's SVR.
SecurityWeek
Over 39,000 websites have been infected in the past months with the Sign1 malware that redirects visitors to scam domains.
The Hacker News
Over 39,000 WordPress sites have fallen victim to the Sign1 malware campaign in just 6 months, redirecting unsuspecting users to scam sites through ma
Bleeping Computer
A previously unknown malware campaign called Sign1 has infected over 39,000 websites over the past six months, causing visitors to see unwanted redirects and popup ads.
SecurityWeek
AWS patches vulnerability that could have been used to hijack Managed Workflows Apache Airflow (MWAA) sessions via FlowFixation attack.
HACKRead
Tax season is underway in the United States, bringing with it the notorious tax returns phishing campaigns targeting taxpayers and businesses.
CyberNews
North Korea’s nuclear threats are now being exploited by North Korean hackers known as Kimsuky as a lure for victims to open malicious payloads.
.webp)
Cyber Security News
Microsoft Threat Intelligence's latest study highlights attackers' cleverness and urges taxpayers to be vigilant.
SC Magazine
Jasmin ransomware, SparkRAT and XMRig cryptominers were dropped post-exploitation of CVE-2024-27198.
Cyber Security News
Threat actors use SVG files in cyber-attacks because SVGs (Scalable Vector Graphic files) can contain embedded scripts, making them a vector
The Hacker News
Researchers uncover a sophisticated malware campaign using fake Google Sites pages and HTML smuggling to distribute AZORult, a notorious info stealer.
SC Magazine
Azorult infostealer aims to steal user credentials and credit card information via HTML smuggling.
.webp)
Cyber Security News
With our weekly cybersecurity news summary, explore and learn about the most recent developments in the cybersecurity field.
SC Magazine
RedLine was used to steal over 170 million passwords in the last six months, or nearly half of all stolen passwords.
Krebs on Security
The data privacy company Onerep.com bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and…
Cyber Security News
As part of a Chrome security update, Google upgraded the Stable channels to 122.0.6261.128/.129 for Windows and Mac, and 122.0.6261.128 for
The Cyber Express
Dark web rumors indicate Banregio, a leading financial institution in Mexico, may have suffered a data breach. Allegedly, unauthorized access
%20(1).webp)
Cyber Security News
Financially motivated threat who impersonates both US government institutions & private businesses across a wide range of industries.
Infosecurity News
Proofpoint said TA4903 adopted new tactics, including lure themes referencing confidential docs and ACH payments
Bleeping Computer
The hacking group known as TA577 has recently shifted tactics by using phishing emails to steal NT LAN Manager (NTLM) authentication hashes to perform account hijacks.
Infosecurity News
Proofpoint warned the method could be used for data gathering and further malicious activities
Cyber Security News
ZIP files are used by threat actors to weaponize them since they can easily convey malicious payloads within compressed archives, making it
The Hacker News
SPIKEDWINE cyber group targets European officials with sophisticated WINELOADER backdoor.
Security Affairs
Analyzing the Email Security Landscape and exploring Emerging Threats and Trends................................
Security Affairs
Researchers warn of an XSS vulnerability, tracked as CVE-2023-40000, in the LiteSpeed Cache plugin for WordPress
Bleeping Computer
Threat actors are exploiting a CMS editor discontinued 14 years ago to compromise education and government entities worldwide to poison search results with malicious sites or scams.
HACKRead
Front-end development or client-side development, creates CSS, HTML, and JavaScript for online apps and sites so users can interact and view.
Cyber Security News
This RSPAMD integration with ANY.RUN marks a pivotal step in enhancing the detection and analysis of suspicious emails.
SC Magazine
WordPress site takeover is possible without authentication via the actively exploited vulnerability.
Bleeping Computer
Google is testing a new feature to prevent malicious public websites from pivoting through a user's browser to attack devices and services on internal, private networks.
The Cyber Express
A newly discovered ransomware dubbed JKwerlo has emerged in European markets, aiming at unsuspecting victims in France and Spain. Cyble
DarkReading
Cyberattacks targeting thousands of US organizations wields a new attack vector to deliver the versatile initial-access loader — and is a harbinger of a surge in threat activity.
SecurityWeek
SAP patches a critical code-injection vulnerability in the SAP ABA (Application Basis) cross-application component.
Bleeping Computer
The Bumblebee malware has returned after a four-month vacation, targeting thousands of organizations in the United States in phishing campaigns.
Trend Micro
The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.
Bleeping Computer
CISA warns that a Roundcube email server vulnerability patched in September is now actively exploited in cross-site scripting (XSS) attacks.
DarkReading
A tangled web of attackers use various social media tactics to propagate the novel threat, which has several execution methods and exfiltrates data to Telegram.
Bleeping Computer
A new password-stealing malware named Ov3r_Stealer is spreading through fake job advertisements on Facebook, aiming to steal account credentials and cryptocurrency.
Security Affairs
U.S. CISA adds Google Chromium V8 Type Confusion vulnerability to its Known Exploited Vulnerabilities catalog.
HACKRead
So far, the gang has mostly targeted job seekers in the APAC (Asia Pacific) region.
Cyber Security News
Like GambleForce, ResumeLooters primarily targets the Asia-Pacific – over 70% of known victims are located in the region.
Loading more articles....