A Nigerian national has pleaded guilty in a US court to his role in a business email compromise (BEC) fraud scheme that caused roughly $200,000 in losses. Henry Echefu, 32, a resident of South Africa at the time the nefarious operation was conducted, was extradited from Canada on November 30. Accord…
Threat actors are conducting brute-force attacks against WordPress sites by leveraging malicious JavaScript injections, new findings from Sucuri reveal.
The attacks, which take the form of distributed brute-force attacks, “target WordPress websites from the browsers of completely innocent and unsuspecting site visitors,” security researcher Denis Sinegubko said.
The activity is part of a&
Cisco on Wednesday announced patches for two high-severity vulnerabilities in Secure Client, the enterprise VPN application that also incorporates security and monitoring capabilities. The first issue, tracked as CVE-2024-20337, impacts the Linux, macOS, and Windows versions of Secure Client and cou…
Organizations in the US have been targeted since at least 2021 in various phishing and business email compromise (BEC) campaigns spoofing government and private businesses, Proofpoint reports. The attacks, attributed to a threat actor tracked as TA4903, were focused on harvesting corporate credentia…
The China-linked threat actor known as Evasive Panda orchestrated both watering hole and supply chain attacks targeting Tibetan users at least since September 2023.
The end of the attacks is to deliver malicious downloaders for Windows and macOS that deploy a known backdoor called MgBot and a previously undocumented Windows implant known as Nightdoor.
The findings come from ESET, which
Apple is opening small cracks in the iPhone’s digital fortress as part of a regulatory clampdown in Europe that is striving to give consumers more choices — at the risk of creating new avenues for hackers to steal personal and financial information stored on the devices. The overhaul rolling out Thu…
In a recent development, American Express has issued a warning to its customers regarding a potential data breach originating from a third-party merchant processor. Although the breach did not directly involve American Express systems, the credit card data of several Card Members may have been compr…
Several internet forums are bombarded with headlines claiming that a “Mr Green Gaming user database has been leaked” as a serious security breach threatens the online gaming community. Significant concerns about online security and privacy have been raised due to the incident, which resulted in the…
FBI’s Internet Crime Complaint Center (IC3) has released its 2023 Internet Crime Report, which recorded a 22% increase in reported losses compared to 2022, amounting to a record of $12.5 billion. […]
In today’s rapidly evolving SaaS environment, the focus is on human users. This is one of the most compromised areas in SaaS security management and requires strict governance of user roles and permissions, monitoring of privileged users, their level of activity (dormant, active, hyperactive), their type (internal/ external), whether they are joiners, movers, or leavers, and more.
Not
Fakext is a malicious Edge extension (distributed as “SATiD”) that injects scripts into banking websites to perform form-grabbing and screen-overlay attacks, primarily targeting Latin American banks. The extension fetches loader code from C2 servers (including…
Threat actors started targeting a critical TeamCity vulnerability almost immediately after patches were announced and its details were made public due to what appears to be poor communication during the responsible disclosure process. On March 4, JetBrains announced patches for two authentication by…
Fidelity Investments Life Insurance Company is informing roughly 28,000 individuals that their personal information was compromised in a data breach at third-party services provider Infosys McCamish System (IMS). The data breach, Fidelity says, was the result of a cyberattack on IMS’ systems, which…
ESET researchers uncover strategic web compromise and supply-chain attacks targeting Tibetans
The nation-state group compromised the website of a Tibetan festival and a software application to target user systems in Asia.