Postal Service moves to finalize mail ballot regs before SCOTUS ruling
The rules have already been rejected by multiple state courts, but the Trump administration said it’s preparing in case of a favorable Supreme Court decision. The post Postal Service moves to finalize mail ballot regs before SCOTUS ruling appeared first on CyberScoop.
Read the brief →
Latest News
view all →
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions […]
If you're not using AI to attack your own systems, your adversaries will
Agents are also the new attack surface - cue defenders' existential angst
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
TikTok has agreed to a $400 million settlement with the U.S. Department of Justice to resolve a lawsuit alleging violations of child privacy laws. The lawsuit, filed in 2024, accused the company of improperly collecting data from users under 13 and failing to comply with parental requests to delete accounts. The settlement includes an immediate payment of $300 million and an additional $100 million contingent on the dissolution of a prior consent decree related to Musical.ly.
Hackers infect Android car head units with proxy botnet malware
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]
Named Pipes Under Attack: Securing Windows Interprocess Communication
Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication. [...]
Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments
Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Malware Hijacks Android Car Head Units
Researchers have identified new Android malware that hijacks car head units by exploiting their official update mechanisms. The malware installs proxy software, turning vehicles into nodes for the BADBOX botnet, primarily for ad fraud and to provide anonymized internet connections. This marks the first documented instance of malware specifically targeting car head units through their native update channels.
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware. The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek.
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
A critical vulnerability has been discovered in NASA/JPL's open-source AIT-GUI software, which is used to control spacecraft instruments. The flaw allows unauthenticated attackers to execute arbitrary commands, run server-side scripts, and manipulate command sequences by exploiting a lack of authentication, session checks, and CSRF protection. Researchers confirmed the issue, which has a CVSS score of 9.4, and a fix is available in version 2.5.2.
The Briefs
view all →
Top Stories
CVE tracker →
More Coverage
Your Shredded Visa Card May Still Work at the Checkout
New SynkLoader malware pushed in Microsoft Teams phishing campaign
OWASP Flags Top AI Skill Risks in New Security Blueprint
AI Is Learning to Write Genetic Code
Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it
Former NSA Director Paul Nakasone Launches National Security Advisory Firm
U.S. Bank says breach claims related to fourth-party incident
Hundreds of leaked AWS keys give full control over corporate accounts
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug
Lawmakers seek watchdog review of federal hacking of Americans
Canada’s Hospital for Sick Children attacked by cybercriminals again as employee data stolen
Malware injected into popular Rust packages to steal developer credentials
Microsoft blames Windows gaming issues on RGB lighting devices
Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini
New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
Zombie Card: An expired Visa credit card can be used for purchases
Is Online Privacy Possible? How Digital Identities Can Help
