Collaborate Disseminate
Lazarus Group, the advanced persistent threat (APT) group attributed to the North Korean government, has been observed waging two separate supply chain attack campaigns as a means to gain a foothold into corporate networks and target a wide range of do… Continue reading Latest Report Uncovers Supply Chain Attacks by North Korean Hackers
A global fraud campaign has been found leveraging 151 malicious Android apps with 10.5 million downloads to rope users into premium subscription services without their consent and knowledge.
The premium SMS scam campaign — dubbed “UltimaSMS” — is belie… Continue reading Over 10 Million Android Users Targeted With Premium SMS Scam Apps
Mozilla on Monday disclosed it blocked two malicious Firefox add-ons installed by 455,000 users that were found misusing the Proxy API to impede downloading updates to the browser.
The two extensions in question, named Bypass and Bypass XM, “interfered… Continue reading Malicious Firefox Add-ons Block Browser From Downloading Security Updates
A “potentially devastating and hard-to-detect threat” could be abused by attackers to collect users’ browser fingerprinting information with the goal of spoofing the victims without their knowledge, thus effectively compromising their privacy.
Academic… Continue reading New Attack Lets Hackers Collect and Spoof Browser’s Digital Fingerprints
Nobelium, the threat actor behind the SolarWinds compromise in December 2020, has been behind an ongoing wave of attacks that compromised 14 downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT s… Continue reading Microsoft Warns of Continued Supply-Chain Attacks by the Nobelium Hacker Group
Cybersecurity researchers on Friday disclosed a now-patched critical vulnerability in multiple versions of a time and billing system called BillQuick that’s being actively exploited by threat actors to deploy ransomware on vulnerable systems.
CVE-2021-… Continue reading Hackers Exploited Popular BillQuick Billing Software to Deploy Ransomware
The iPhone of New York Times journalist Ben Hubbard was repeatedly hacked with NSO Group’s Pegasus spyware tool over a three-year period stretching between June 2018 to June 2021, resulting in infections twice in July 2020 and June 2021.
The University… Continue reading NYT Journalist Repeatedly Hacked with Pegasus after Reporting on Saudi Arabia
Microsoft on Thursday disclosed an “extensive series of credential phishing campaigns” that takes advantage of a custom phishing kit that stitched together components from at least five different widely circulated ones with the goal of siphoning user l… Continue reading Microsoft Warns of TodayZoo Phishing Kit Used in Extensive Credential Stealing Attacks
The U.S. Cybersecurity and Infrastructure Security Agency on Friday warned of crypto-mining and password-stealing malware embedded in “UAParser.js,” a popular JavaScript NPM library with over 6 million weekly downloads, days after the NPM repository mo… Continue reading Popular NPM Package Hijacked to Publish Crypto-mining Malware
The Russian-led REvil ransomware gang was felled by an active multi-country law enforcement operation that resulted in its infrastructure being hacked and taken offline for a second time earlier this week, in what’s the latest action taken by governmen… Continue reading Feds Reportedly Hacked REvil Ransomware Group and Forced it Offline