Collaborate Disseminate
A threat actor tracked as Polonium has been linked to over a dozen highly targeted attacks aimed at Israelian entities with seven different custom backdoors since at least September 2021.
The intrusions were aimed at organizations in various verticals… Continue reading Researchers Uncover Custom Backdoors and Spying Tools Used by Polonium Hackers
Malicious actors are resorting to voice phishing (vishing) tactics to dupe victims into installing Android malware on their devices, new research from ThreatFabric reveals.
The Dutch mobile security company said it identified a network of phishing web… Continue reading Hackers Using Vishing to Trick Victims into Installing Android Banking Malware
Google on Wednesday officially rolled out support for passkeys, the next-generation authentication standard, to both Android and Chrome.
“Passkeys are a significantly safer replacement for passwords and other phishable authentication factors,” the tec… Continue reading Google Rolling Out Passkey Passwordless Login Support to Android and Chrome
A vulnerability in Siemens Simatic programmable logic controller (PLC) can be exploited to retrieve the hard-coded, global private cryptographic keys and seize control of the devices.
“An attacker can use these keys to perform multiple advanced attack… Continue reading Critical Bug in Siemens SIMATIC PLCs Could Let Attackers Steal Cryptographic Keys
Microsoft’s Patch Tuesday update for the month of October has addressed a total of 85 security vulnerabilities, including fixes for an actively exploited zero-day flaw in the wild.
Of the 85 bugs, 15 are rated Critical, 69 are rated Important, and one… Continue reading Microsoft Patch Tuesday Fixes New Windows Zero-Day; No Patch for Exchange Server Bugs
The operators behind the BazaCall call back phishing method have continued to evolve with updated social engineering tactics to deploy malware on targeted networks.
The scheme eventually acts as an entry point to conduct financial fraud or the deliver… Continue reading BazarCall Callback Phishing Attacks Constantly Evolving Its Social Engineering Tactics
A now-patched security flaw in the vm2 JavaScript sandbox module could be abused by a remote adversary to break out of security barriers and perform arbitrary operations on the underlying machine.
“A threat actor can bypass the sandbox protections to … Continue reading Researchers Detail Critical RCE Flaw Reported in Popular vm2 JavaScript Sandbox
Cyber criminals are using a previously undocumented phishing-as-a-service (PhaaS) toolkit called Caffeine to effectively scale up their attacks and distribute nefarious payloads.
“This platform has an intuitive interface and comes at a relatively low … Continue reading Researchers Warn of New Phishing-as-a-Service Being Used by Cyber Criminals
Fortinet on Monday revealed that the newly patched critical security vulnerability impacting its firewall and proxy products is being actively exploited in the wild.
Tracked as CVE-2022-40684 (CVSS score: 9.6), the flaw relates to an authentication by… Continue reading Fortinet Warns of Active Exploitation of Newly Discovered Critical Auth Bypass Bug
A new piece of research has detailed the increasingly sophisticated nature of the malware toolset employed by an advanced persistent threat (APT) group named Earth Aughisky.
“Over the last decade, the group has continued to make adjustments in the too… Continue reading Researchers Detail Malicious Tools Used by Cyberespionage Group Earth Aughisky