Global Cyber Security News
Keep up to date with some of the latest news articles in the cyber security landscape, worldwide.
- How to Investigate ChatGPT activity in Google Workspaceby [email protected] (The Hacker News) on September 17, 2024 at 11:00 am
Since launching ChatGPT in 2022, OpenAI has defied expectations with a steady stream of product announcements and enhancements. One such announcement came on May 16, 2024, and for most consumers, it probably felt innocuous. Titled “Improvements to data analysis in ChatGPT,” the post outlines how users can add files directly from Google Drive and Microsoft OneDrive. It’s worth mentioning
- Binance Warns of Rising Clipper Malware Attacks Targeting Cryptocurrency Usersby [email protected] (The Hacker News) on September 17, 2024 at 7:18 am
Cryptocurrency exchange Binance is warning of an "ongoing" global threat that's targeting cryptocurrency users with clipper malware with the goal of facilitating financial fraud. Clipper malware, also called ClipBankers, is a type of malware that Microsoft calls cryware, which comes with capabilities to monitor a victim's clipboard activity and steal sensitive data a user copies, including
- SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacksby [email protected] (The Hacker News) on September 17, 2024 at 4:34 am
SolarWinds has released fixes to address two security flaws in its Access Rights Manager (ARM) software, including a critical vulnerability that could result in remote code execution. The vulnerability, tracked as CVE-2024-28991, is rated 9.0 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an instance of deserialization of untrusted data. "SolarWinds Access Rights
- Google Fixes GCP Composer Flaw That Could've Led to Remote Code Executionby [email protected] (The Hacker News) on September 16, 2024 at 1:07 pm
A now-patched critical security flaw impacting Google Cloud Platform (GCP) Composer could have been exploited to achieve remote code execution on cloud servers by means of a supply chain attack technique called dependency confusion. The vulnerability has been codenamed CloudImposer by Tenable Research. "The vulnerability could have allowed an attacker to hijack an internal software dependency
- North Korean Hackers Target Cryptocurrency Users on LinkedIn with RustDoor Malwareby [email protected] (The Hacker News) on September 16, 2024 at 12:00 pm
Cybersecurity researchers are continuing to warn about North Korean threat actors' attempts to target prospective victims on LinkedIn to deliver malware called RustDoor. The latest advisory comes from Jamf Threat Labs, which said it spotted an attack attempt in which a user was contacted on the professional social network by claiming to be a recruiter for a legitimate decentralized
- From Breach to Recovery: Designing an Identity-Focused Incident Response Playbookby [email protected] (The Hacker News) on September 16, 2024 at 11:33 am
Imagine this... You arrive at work to a chaotic scene. Systems are down, panic is in the air. The culprit? Not a rogue virus, but a compromised identity. The attacker is inside your walls, masquerading as a trusted user. This isn't a horror movie, it's the new reality of cybercrime. The question is, are you prepared? Traditional incident response plans are like old maps in a new world. They
- Master Your PCI DSS v4 Compliance with Innovative Smart Approvalsby [email protected] (The Hacker News) on September 16, 2024 at 11:05 am
The PCI DSS landscape is evolving rapidly. With the Q1 2025 deadline looming ever larger, businesses are scrambling to meet the stringent new requirements of PCI DSS v4.0. Two sections in particular, 6.4.3 and 11.6.1, are troublesome as they demand that organizations rigorously monitor and manage payment page scripts and use a robust change detection mechanism. With the deadline fast approaching
- Apple Drops Spyware Case Against NSO Group, Citing Risk of Threat Intelligence Exposureby [email protected] (The Hacker News) on September 16, 2024 at 7:12 am
Apple has filed a motion to "voluntarily" dismiss its lawsuit against commercial spyware vendor NSO Group, citing a shifting risk landscape that could lead to exposure of critical "threat intelligence" information. The development was first reported by The Washington Post on Friday. The iPhone maker said its efforts, coupled with those of others in the industry and national governments to tackle
- Cybercriminals Exploit HTTP Headers for Credential Theft via Large-Scale Phishing Attacksby [email protected] (The Hacker News) on September 16, 2024 at 4:23 am
Cybersecurity researchers have warned of ongoing phishing campaigns that abuse refresh entries in HTTP headers to deliver spoofed email login pages that are designed to harvest users' credentials. "Unlike other phishing webpage distribution behavior through HTML content, these attacks use the response header sent by a server, which occurs before the processing of the HTML content," Palo Alto
- Ivanti Warns of Active Exploitation of Newly Patched Cloud Appliance Vulnerabilityby [email protected] (The Hacker News) on September 14, 2024 at 4:12 am
Ivanti has revealed that a newly patched security flaw in its Cloud Service Appliance (CSA) has come under active exploitation in the wild. The high-severity vulnerability in question is CVE-2024-8190 (CVSS score: 7.2), which allows remote code execution under certain circumstances. "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows
- Apple Vision Pro Vulnerability Exposed Virtual Keyboard Inputs to Attackersby [email protected] (The Hacker News) on September 13, 2024 at 1:51 pm
Details have emerged about a now-patched security flaw impacting Apple's Vision Pro mixed reality headset that, if successfully exploited, could allow malicious attackers to infer data entered on the device's virtual keyboard. The attack, dubbed GAZEploit, has been assigned the CVE identifier CVE-2024-40865. "A novel attack that can infer eye-related biometrics from the avatar image to
- 17-Year-Old Arrested in Connection with Cyber Attack Affecting Transport for Londonby [email protected] (The Hacker News) on September 13, 2024 at 1:29 pm
British authorities on Thursday announced the arrest of a 17-year-old male in connection with a cyber attack affecting Transport for London (TfL). "The 17-year-old male was detained on suspicion of Computer Misuse Act offenses in relation to the attack, which was launched on TfL on 1 September," the U.K. National Crime Agency (NCA) said. The teenager, who's from Walsall, is said to have been
- TrickMo Android Trojan Exploits Accessibility Services for On-Device Banking Fraudby [email protected] (The Hacker News) on September 13, 2024 at 11:17 am
Cybersecurity researchers have uncovered a new variant of an Android banking trojan called TrickMo that comes packed with new capabilities to evade analysis and display fake login screens to capture victims' banking credentials. "The mechanisms include using malformed ZIP files in combination with JSONPacker," Cleafy security researchers Michele Roviello and Alessandro Strino said. "In addition,
- Say Goodbye to Phishing: Must-Haves to Eliminate Credential Theftby [email protected] (The Hacker News) on September 13, 2024 at 11:17 am
Even as cyber threats become increasingly sophisticated, the number one attack vector for unauthorized access remains phished credentials (Verizon DBIR, 2024). Solving this problem resolves over 80% of your corporate risk, and a solution is possible. However, most tools available on the market today cannot offer a complete defense against this attack vector because they were architected to
- Progress WhatsUp Gold Exploited Just Hours After PoC Release for Critical Flawby [email protected] (The Hacker News) on September 13, 2024 at 11:04 am
Malicious actors are likely leveraging publicly available proof-of-concept (PoC) exploits for recently disclosed security flaws in Progress Software WhatsUp Gold to conduct opportunistic attacks. The activity is said to have commenced on August 30, 2024, a mere five hours after a PoC was released for CVE-2024-6670 (CVSS score: 9.8) by security researcher Sina Kheirkhah of the Summoning Team, who
- New Linux Malware Campaign Exploits Oracle Weblogic to Mine Cryptocurrencyby [email protected] (The Hacker News) on September 13, 2024 at 5:39 am
Cybersecurity researchers have uncovered a new malware campaign targeting Linux environments to conduct illicit cryptocurrency mining and deliver botnet malware. The activity, which specifically singles out the Oracle Weblogic server, is designed to deliver a malware strain dubbed Hadooken, according to cloud security firm Aqua. "When Hadooken is executed, it drops a Tsunami malware and deploys
- New Android Malware 'Ajina.Banker' Steals Financial Data and Bypasses 2FA via Telegramby [email protected] (The Hacker News) on September 12, 2024 at 4:12 pm
Bank customers in the Central Asia region have been targeted by a new strain of Android malware codenamed Ajina.Banker since at least November 2023 with the goal of harvesting financial information and intercepting two-factor authentication (2FA) messages. Singapore-headquartered Group-IB, which discovered the threat in May 2024, said the malware is propagated via a network of Telegram channels
- Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Executionby [email protected] (The Hacker News) on September 12, 2024 at 3:55 pm
GitLab on Wednesday released security updates to address 17 security vulnerabilities, including a critical flaw that allows an attacker to run pipeline jobs as an arbitrary user. The issue, tracked as CVE-2024-6678, carries a CVSS score of 9.9 out of a maximum of 10.0 "An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to
- Beware: New Vo1d Malware Infects 1.3 Million Android-based TV Boxes Worldwideby [email protected] (The Hacker News) on September 12, 2024 at 1:46 pm
Nearly 1.3 million Android-based TV boxes running outdated versions of the operating system and belonging to users spanning 197 countries have been infected by a new malware dubbed Vo1d (aka Void). "It is a backdoor that puts its components in the system storage area and, when commanded by attackers, is capable of secretly downloading and installing third-party software," Russian antivirus
- Exposed Selenium Grid Servers Targeted for Crypto Mining and Proxyjackingby [email protected] (The Hacker News) on September 12, 2024 at 12:56 pm
Internet-exposed Selenium Grid instances are being targeted by bad actors for illicit cryptocurrency mining and proxyjacking campaigns. "Selenium Grid is a server that facilitates running test cases in parallel across different browsers and versions," Cado Security researchers Tara Gould and Nate Bill said in an analysis published today. "However, Selenium Grid's default configuration lacks