Infected versions of the text editors VNote and Notepad‐‐ for Linux and macOS, apparently loading a backdoor, are being distributed through a Chinese search engine.
Identities are the latest sweet spot for cybercriminals, now heavily targeting SaaS applications that are especially vulnerable in this attack vector.
The use of SaaS applications involves a wide range of identities, including human and non-human, such as service accounts, API keys, and OAuth authorizations. Consequently, any identity in a SaaS app…
Google’s Gemini large language model (LLM) is susceptible to security threats that could cause it to divulge system prompts, generate harmful content, and carry out indirect injection attacks.
The findings come from HiddenLayer, which said the issues impact consumers using Gemini Advanced with Google Workspace as well as companies using the LLM API.
The first…
A multitooled Trojan cuts apart Brazil’s premier wire transfer app. Could similar malware do the same to Venmo, Zelle, or PayPal?…
CPU makers Intel, AMD, Arm and IBM, as well as software vendors, are impacted by a new speculative race condition (SRC) attack named GhostRace.
The post Major CPU, Software Vendors Impacted by New GhostRace Attack appeared first on SecurityWeek….
A new phishing campaign has been observed delivering remote access trojans (RAT) such as VCURMS and STRRAT by means of a malicious Java-based downloader.
“The attackers stored malware on public services like Amazon Web Services (AWS) and GitHub, employing a commercial protector to avoid detection of the malware,” Fortinet FortiGuard Labs researcher…
Fortinet has released patches for critical code execution vulnerabilities in FortiOS, FortiProxy, and FortiClientEMS.
The post Fortinet Patches Critical Vulnerabilities Leading to Code Execution appeared first on SecurityWeek….
Huntress observed threat actors using the legitimate backup tool restic (renamed dns.exe in one instance) to attempt data exfiltration to cloud storage endpoints. The attack involved RDP access with compromised credentials, tooling download and execution, envi…
Evolving Phishing AttacksWhile email has long been the vector of choice for carrying out phishing attacks, threat actors, and their tactics, techniques, and procedures (TTPs), are continually adapting and evolving to keep pace with the emergence of new technologies that represent new avenues to expl…
Talos IR has responded to several recent incidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks….
Change Ransomware Incident: Details so farThe change Ransomware attackLast week, an Oregon medical practice suffered a serious Ransomware attack called Change Ransomware.Due to the attack, the medical practice was left with an empty bank account.The only way out was to sell the practice to United He…
Threat actors behind the ransomware attacks that hit Stanford University in 2023 gained access to 27,000 people. Stanford University confirmed that threat actors behind the September 2023 ransomware attack had access to 27,000 people. The prestigious US university was the victim of a ransomware attack carried out by the Akira ransomware…
Iranian hacktivist group known as Lord Nemesis and Nemesis Kitten targeted an academic sector software firm in Israel to gain access to its customers….
Microsoft on Tuesday released its monthly security update, addressing 61 different security flaws spanning its software, including two critical issues impacting Windows Hyper-V that could lead to denial-of-service (DoS) and remote code execution.
Of the 61 vulnerabilities, two are rated Critical, 58 are rated Important, and one is rated Low in severity. None of…
Kroll observed an undocumented Golang loader (referred to as LESLIELOADER) that decodes a Base64-encoded, AES-192 encrypted payload and injects SPARKRAT into a suspended notepad.exe process. The loader uses the inline AES key “LeslieCheungKwok” and has been se…