News Archive
2287 stories · page 88 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
Researchers have identified a sophisticated phishing campaign that bypasses traditional URL-checking defenses by exploiting a legitimate Microsoft authentication feature. The attack leverages the Microsoft Identity Platform's Device Authorization Grant, a protocol designed for devices with limited input capabilities, such as smart TVs or IoT devices, to authenticate users.
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions
Researchers have developed a novel method, dubbed TrojPix, capable of exfiltrating data from air-gapped systems by manipulating on-screen pixels. This technique exploits the electromagnetic emissions generated by video cables to transmit sensitive information.
New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS
Security researchers have identified a new Java-based remote access trojan (RAT) named QuimaRAT, which is designed to operate across Windows, Linux, and macOS operating systems. This cross-platform capability makes it a versatile tool for attackers targeting a wide range of user environments.
Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages
A security vulnerability discovered in the Opera GX browser could allow malicious websites to silently install add-ons and exfiltrate data from visited pages. The flaw, demonstrated by researchers, specifically targets the gaming-oriented version of the Opera browser.
SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing
Researchers have developed a technique called SkillCloak that allows malicious AI agent skills to evade static analysis scanners. This method utilizes self-extracting packing to disguise the malicious code, rendering it undetectable by current security tools. The findings come from a study conducted by researchers at the Hong Kong University of Science and Technology.
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A U.S. government entity reportedly paid approximately $1 million to a cybercriminal group named Kairos to prevent the leak of stolen data. This information comes from a case study published by Ransom-ISAC, which analyzed a leaked negotiation transcript and the blockchain records associated with the payment.
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
North Korean state-sponsored hackers have released 108 malicious packages and browser extensions across multiple platforms as part of a campaign identified as PolinRider. This operation, linked to previous activities by the same group known as Contagious Interview, targeted developers and users through repositories like npm, Packagist, and the Go ecosystem, as well as the Google Chrome Web Store.
Weekly Metasploit Update: Modules for SMB-to-Meterpreter, Peyara Remote Mouse RCE exploit, and more
Metasploit Framework has received an update, version 6.4.142, introducing new modules and enhancements. Among the additions is a module that allows for the upgrade of existing SMB sessions to Meterpreter sessions, a capability that can be initiated via the command `sessions -u session_id` or by loading the `windows/manage/smb_to_meterpreter` module. This feature, developed by Dean Welch,…
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
A cybersecurity firm has revealed seven security weaknesses in FatFs, a widely deployed filesystem library. FatFs is used by millions of embedded devices to read and write data on FAT and exFAT formatted storage media, such as USB drives and SD cards. The vulnerabilities were disclosed by the security firm runZero.
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A critical vulnerability, dubbed "Bad Epoll" and identified as CVE-2026-46242, has been discovered in the Linux kernel. This flaw allows an unprivileged user to gain complete root-level control over a compromised system. The vulnerability impacts a wide range of Linux-based systems, including desktop and server distributions, as well as the Android mobile operating system. Fortunately, a patch…
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
A newly identified modular malware framework, dubbed Avalon, has been observed incorporating the capabilities of the CrownX ransomware. This sophisticated framework is being distributed through a multi-stage phishing campaign designed to circumvent standard security measures.
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Security researchers have uncovered a new campaign involving malicious npm packages designed to steal sensitive information from developers. These packages, attributed to threat actors associated with North Korea, are disguised as legitimate Rollup polyfill tools.
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
A newly identified threat actor, dubbed Armored Likho, has been linked to cyberattacks impacting government entities and the electric power sector in Russia, Brazil, and Kazakhstan. This group appears to combine financially motivated tactics with espionage objectives, according to cybersecurity researchers.
Chinese LLMs Broaden the Gap Between Attackers & Defenders
Large language models developed in China are reportedly widening the disparity between cyberattackers and defenders. The exact nature and scope of this development are not detailed, but the implication is that these AI tools are providing an advantage to malicious actors.
SMBs urged to focus on cyber basics amid AI-driven threats
Small and medium-sized businesses (SMBs) are increasingly concerned about AI-driven cyber threats, but cybersecurity experts advise that foundational security practices remain the most critical defense against the most common attack vectors. While AI is enhancing attackers' capabilities, truly AI-powered malware is still rare, and the majority of incidents stem from familiar vulnerabilities.
Flock Cameras Can Surveil Cars Without License Plates
Law enforcement agencies using Flock Safety's automated license plate reader (ALPR) cameras can identify vehicles even without a visible license plate, according to a company presentation from 2024. The system, which Flock refers to as "Vehicle Fingerprint," collects and analyzes various visual characteristics of a vehicle to aid investigations.
European Parliament Member Investigating Spyware Was Hacked With Pegasus
A former Member of the European Parliament who was part of a committee investigating spyware was himself targeted with the Pegasus surveillance tool, according to a report by Citizen Lab. Stelios Kouloglou's mobile device was reportedly compromised multiple times.
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
A newly identified threat actor, dubbed Armored Likho, has been observed conducting targeted phishing campaigns against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. This group, also referred to as Eagle Werewolf based on circumstantial evidence, employs a sophisticated toolkit that includes a previously undocumented information stealer named BusySnake…
PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
A newly identified macOS malware, dubbed PamStealer, has been observed by cybersecurity researchers to be actively targeting Mac users by impersonating legitimate applications and exploiting system authentication mechanisms to steal login credentials. The threat, detailed by Jamf Threat Labs, utilizes a distribution method that involves tricking users into downloading malicious versions of…
Swimming Pools, Pee, and Trying to Delete Your Data From the Internet
The concept of completely erasing one's digital footprint is often likened to an impossible task, akin to trying to swim in a pool of urine. This analogy highlights the pervasive and persistent nature of personal data online, making true deletion an elusive goal.
Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs
Australian businesses are now shouldering a greater responsibility for cybersecurity as institutional safeguards and regulatory measures have tightened. This shift means that companies, particularly small and medium-sized businesses (SMBs), are increasingly the primary targets and are expected to implement more robust defenses against cybercrime.
WebAuthn Added to Browser-Based RDP Client
A cybersecurity firm has successfully implemented WebAuthn redirection in its browser-based Remote Desktop Protocol (RDP) client, allowing users to leverage security keys and other FIDO2 authenticators within remote sessions. This development marks the first RDP client outside of Windows to support WebAuthn redirection, preceding Microsoft's own macOS, iOS, and Linux clients, though the…
Apple Reverses Age-Old Patch Policy to Keep Up With AI
Apple is signaling a shift in its long-standing patching strategy, indicating a move towards more frequent and compressed software updates. This change is a direct response to the evolving threat landscape, particularly the growing use of artificial intelligence by malicious actors to accelerate the process of discovering and exploiting vulnerabilities.
FBI Seizes NetNut Proxy Platform, Popa Botnet
The Federal Bureau of Investigation, in collaboration with industry partners, has seized hundreds of domains associated with NetNut, a large residential proxy service operated by the Israeli company Alarum Technologies. This action follows recent reports from security firms that linked NetNut to the Popa botnet, a network of at least two million compromised devices.