Blahalla

Phishing campaign targets customers of major Italian web hosting provider

therecord.media · 8 months ago

Researchers uncovered a large scale phishing campaign targeting customers of one of Italy's largest web hosting and IT service providers that impersonated Aruba S dot p dot A and serves more than five million customers. The operation used a sophisticated phishing kit sold as a service that imitates login and payment pages, preloads user data, filters CAPTCHAs to evade security scanners, and instantly exfiltrates credentials and credit card details via Telegram bots. Victims received emails claiming service expiration or failed payments that redirected them to fake login or payment pages where credentials, payment card information, and one time passwords were captured, often after prompting a small payment of around five dollars. Researchers said Telegram was central to the campaign's coordination and promotion and have not attributed the operation to a specific threat actor.
CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks

www.securityweek.com · 8 months ago

CISA has issued updated guidance after China linked ArcaneDoor actors exploited two Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense vulnerabilities that permit attackers to send crafted requests to the VPN web server to execute arbitrary code as root or access restricted URLs without authentication. The flaws are tracked as CVE-2025-20333 and CVE-2025-20362, were discovered in May, and Cisco released patches on September 25 while warning on November 6 of a new variant that can trigger device reloads and cause denial of service. CISA issued Emergency Directive 25-03 directing federal agencies to identify all affected ASA and Firepower devices, collect forensics, report inventories to CISA by October 2, disconnect end of support devices, and upgrade or apply the minimum fixed software versions published by CISA after finding some agencies had marked appliances as patched despite remaining vulnerable. CISA also published fresh mitigation guidance and recommends additional actions for devices not updated to the necessary versions by September 26, 2025 to mitigate ongoing and new threat activity.
Kerberoasting in 2025: How to protect your service accounts

www.bleepingcomputer.com · 8 months ago

Kerberoasting remains a major Active Directory threat because attackers can request service tickets for accounts with Service Principal Names and then crack the ticket offline to recover the account password, using tools such as GetUserSPNs.py and Rubeus. These attacks are hard to detect because cracking happens offline, they do not require malware, and they start from legitimate user accounts, allowing attackers to evade many standard defenses. Effective defenses include regularly auditing AD accounts and passwords, enforcing long unique nonreusable credentials for SPN accounts of at least 25 characters with regular rotation, using group managed service accounts that have automatically generated 120 character passwords, preferring AES encryption over RC4, removing unnecessary SPNs, and deploying multifactor authentication and user awareness to reduce initial compromise.
Two key cyber laws are back as president signs bill to end shutdown

therecord.media · 8 months ago

President Donald Trump signed a government funding bill that ended a 43 day shutdown and temporarily reinstated the 2015 Cybersecurity and Infrastructure Security Act and the State and Local Cybersecurity Grant Program. The measure restores the information sharing statute and the grant program through January 30, preserves antitrust and liability safeguards for private sector cyberthreat sharing, and continues roughly one billion dollars in funding awarded to state and local governments since 2022. Officials warned the renewal is a short term fix and urged Congress to move quickly to pass longer term reauthorizations to avoid future lapses.
Google Sues to Disrupt Chinese SMS Phishing Triad

krebsonsecurity.com · 8 months ago

There is a lawsuit filed November 12, 2025 in the Southern District of New York in which Google sued 25 unnamed defendants to unmask and disrupt Lighthouse, a China based mobile phishing service that Google says has harmed more than one million victims across 120 countries. Lighthouse is part of a Smishing Triad that supplies phishing templates and infrastructure used to spoof hundreds of trusted brands, send millions of fraudulent text messages, and automatically attempt to enroll stolen payment card data into Apple and Google mobile wallets by tricking victims into providing one time bank codes. Researchers report the operation offers more than 600 phishing templates for over 400 entities, rotates domains rapidly with about 25,000 phishing domains active during any eight day period, and is organized into developer, data broker, spammer, theft, and administrative groups. Google alleges trademark infringement and RICO violations and is seeking court relief intended to disrupt the enterprise and potentially pressure Chinese hosting providers to take down domains and enable further enforcement.
Phishing Emails Alert: How Spam Filters Can Steal Your Email Logins in an Instant

gbhackers.com · 8 months ago

Cybercriminals are spoofing internal email delivery and spam filter notifications to trick employees into clicking a Move to Inbox button that redirects through legitimate looking domains to phishing pages designed to steal login credentials that can expose email, cloud storage, and other accounts. The attack uses redirects through domains including cbssports to land victims on mdbgo.io pages that accept a base64 encoded target address, serve a fake login screen with the victim domain prefilled, and harvest credentials in real time via a websocket which can also capture or prompt for two factor authentication codes. Indicators of compromise include multiple mdbgo.io subdomains and several disposable or compromised redirect domains, and recommended defenses are to verify sender addresses and destination URLs before signing in, avoid unsolicited attachments and links, enable multi factor authentication, and change passwords immediately if credentials were entered.
Malicious npm Package with 206K Downloads Targeting GitHub Repositories to Steal Tokens

gbhackers.com · 8 months ago

There was a typosquatting campaign discovered on November 7, 2025 by Veracode Threat Research that deployed a malicious npm package named atacitons slash artifact which mimicked the legitimate atactions slash artifact and accumulated over 206,000 downloads before being removed. Six malicious versions contained a post install hook that downloaded an obfuscated binary called harness which executed a verify dot js script to check for GITHUB underscore environment variables, exfiltrate encrypted repository tokens, and included a time based kill switch that stopped execution after November 6, 2025, indicating the campaign specifically targeted GitHub owned repositories. Veracode said it notified npm and protected its customers with Veracode Package Firewall while reporting shows the suspect versions were removed and some outlets later described the activity as linked to a GitHub Red Team exercise.
Rogue MCP servers can take over Cursor’s built-in browser

www.csoonline.com · 8 months ago

Security researchers have demonstrated that a malicious Model Context Protocol server can inject JavaScript into Cursor s built in browser, replacing pages with attacker controlled content to harvest credentials and steal session cookies. Because Cursor is a Visual Studio Code fork built on Electron and does not perform the same file integrity checks as VS Code, MCP servers inherit IDE privileges and can be expanded to execute arbitrary actions that could fully compromise a developer workstation. Recommended defenses include vetting and restricting IDE extensions and MCP servers, reviewing server code and repositories before installing, avoiding auto run agent modes, using API keys with restricted permissions, and enforcing organizational policies and access controls.
Coyote, Maverick Banking Trojans Run Rampant in Brazil

www.darkreading.com · 8 months ago

Multiple banking Trojans have been claiming victims in Brazil by targeting desktop WhatsApp users, seizing banking and cryptocurrency credentials, and self replicating through infected users' contact lists. Security researchers analyzed two related strains named Coyote and Maverick and found both are written in dot NET, use similar banking application monitoring routines, and spread when a zip attachment containing a Windows LNK shortcut executes PowerShell to launch a multistage attack. Maverick uniquely checks whether a victim is based in Brazil and self terminates if not, and telemetry from multiple vendors shows hundreds to several thousand infections concentrated in Brazil across public sector and other industries. Researchers recommend employee training on phishing, stronger access controls, and advanced real time monitoring to mitigate these localized banking malware campaigns.
SmartApeSG Uses ClickFix to Deploy NetSupport RAT

gbhackers.com · 8 months ago

A campaign known as SmartApeSG, tracked as ZPHP and HANEYMANEY, has shifted from fake browser update pages to ClickFix style fake CAPTCHA landing pages that instruct victims to paste and run clipboard PowerShell commands, leading to the installation of NetSupport RAT. Infections typically begin on compromised websites that redirect users to loader domains masquerading as services such as DocuSign or Okta, where a PowerShell command downloads a passworded ZIP containing a legitimate Java executable used to sideload a malicious DLL loader that retrieves encrypted payloads and launches the NetSupport client in memory. NetSupport RAT provides full remote access capabilities including screen and input control, file transfer and data exfiltration, and researchers have observed follow-on payloads such as StealC, Latrodectus and Lumma Stealer in these campaigns.
Case Study: University of West England uses Sophos solutions to protect thousands of students across multiple campuses

news.sophos.com · 8 months ago

There is heavy investment in cybersecurity at the University of the West of England to protect 38,000 students across multiple campuses after facing limited visibility and alert fatigue. In 2023 the university replaced legacy antivirus with Sophos Managed Detection and Response which provides 24 hour seven day a week expert monitoring, threat hunting, daily alert triage, real time containment, and integration across the technology stack, and now protects over ten thousand devices. The shift from reactive to resilient operations has produced a quantified reduction in cyber risk and greater confidence, while a 2025 study found that forty nine percent of higher education ransomware attacks stem from unknown vulnerabilities.
Threat Actors Use JSON Storage for Hosting and Delivering Malware via Trojanized Code

gbhackers.com · 8 months ago

There is a sophisticated campaign attributed to North Korean aligned threat actors that weaponizes legitimate JSON storage services to host and deliver trojanized code to software developers worldwide. The operation known as Contagious Interview leverages fake job interviews and trojanized packages to evade security controls, abuse trusted infrastructure, and establish persistent system access. This tactic broadens attackers ability to compromise development environments and supply chain components, increasing the risk of data theft and persistent backdoors.
Hackers Infiltrate npm Registry with 43,000 Spam Packages, Linger for Nearly Two Years

gbhackers.com · 8 months ago

There are over 43,000 malicious npm packages published across at least 11 accounts in a coordinated spam campaign called IndonesianFoods that lingered in the registry for nearly two years. The packages use a distinctive naming scheme that combines Indonesian personal names and food terms and embed a single JavaScript file such as auto.js that, if run manually, publishes new packages in an endless loop at a cadence of roughly one package every seven to ten seconds. The operation aims to pollute the registry and create worm like dependency chains that can pull large trees of junk packages when a single package is installed, rather than to immediately steal credentials or data.
Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm

www.securityweek.com · 8 months ago

There are more than 43,900 malicious npm packages linked to 11 accounts using Indonesian names and foods, while JFrog observed over 80,000 similar self replicating packages across 18 accounts. The malware generates random package names, alters package json to make packages public, assigns random version numbers, and uses stolen npm credentials to publish a new package about every seven seconds in a continuous loop, with the code disguised as a legitimate Next JS application and focused on spamming rather than data theft. The campaign floods the npm registry, wastes infrastructure and pollutes search results, creating supply chain risks and possibly serving as a dry run for future campaigns that could deliver real malicious payloads.
OpenAI Sora 2 Vulnerability Allows Exposure of Hidden System Prompts from Audio Data

gbhackers.com · 8 months ago

Security researchers extracted the hidden system prompt from OpenAI's Sora 2 video generation model by chaining cross modal prompts and found that audio transcription was the most effective extraction method. They reconstructed the prompt by iteratively generating short ten to fifteen second clips, transcribing and stitching fragments together, and warned that system prompts act as confidential security boundaries that can leak through multimodal outputs.
Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain

thehackernews.com · 8 months ago

Researchers uncovered a malicious Chrome extension named Safery Ethereum Wallet that posed as a legitimate Ethereum wallet. It was uploaded to the Chrome Web Store on September 29, 2025 and updated on November 12, 2025. The extension exfiltrates wallet mnemonic seed phrases by encoding them as fake Sui addresses and sending microtransactions of 0.000001 SUI from a hard coded attacker controlled wallet, allowing the attacker to monitor the blockchain, decode the addresses back to seed phrases, and drain victims funds. Users are advised to use trusted wallet extensions and defenders are advised to scan for mnemonic encoders, synthetic address generators, hard coded seed phrases and to block extensions that write to the chain during wallet import or creation.
Popular Android-based photo frames download malware on boot

www.bleepingcomputer.com · 8 months ago

Uhale Android based digital picture frames contain multiple critical security vulnerabilities and some models download and execute malware at boot by updating to a malicious Uhale app version that installs a JAR or DEX payload which is executed on every subsequent boot. Tested devices were shipped rooted with SELinux disabled and signed with public AOSP test keys, and researchers found an unauthenticated file server on TCP port 17802, WebViews that ignore SSL errors, an insecure TrustManager, and an update process that allows command injection and remote installation of arbitrary APKs. Eleven of seventeen disclosed issues have CVE identifiers, including CVE-2025-58392, CVE-2025-58397, CVE-2025-58388, CVE-2025-58394, CVE-2025-58396, and CVE-2025-58390, and hardcoded keys and outdated libraries further increase supply chain and remote compromise risk.
NHS Investigating Oracle EBS Hack Claims as Hackers Name Over 40 Alleged Victims

www.securityweek.com · 8 months ago

The United Kingdom National Health Service is investigating after being listed by the Cl0p ransomware group as a victim of a data theft and extortion campaign targeting Oracle E Business Suite, and NHS officials say no data has been published and they are working with the National Cyber Security Centre. The campaign surfaced in early October and now lists more than 40 alleged victims, with data allegedly published from 25 targets including Harvard University, Envoy Air, Schneider Electric, Emerson, and The Washington Post. Hitachi subsidiary GlobalLogic confirmed that HR information for more than 10,000 current and former employees was accessed, including names, contact details, dates of birth, passport information, Social Security numbers, salary information and bank account details, while many other named organizations have not yet confirmed breaches and the threat actors may be exaggerating the scope to pressure victims.
Operation Endgame: Police reveal takedowns of three key cybercrime tools

therecord.media · 8 months ago

An international law enforcement coalition coordinated from Europol disrupted the Rhadamanthys infostealer, the VenomRAT remote access trojan, and the Elysium botnet in the latest phase of Operation Endgame that began on November 10, 2025. Authorities arrested the main suspect linked to VenomRAT in Greece, raided 11 locations across Germany, Greece, and the Netherlands, seized 20 domains, and took down or disrupted more than 1,025 servers worldwide. Investigators reported the dismantled infrastructure had infected hundreds of thousands of computers and contained several million stolen credentials, with the infostealer operator having access to over 100,000 crypto wallets potentially worth millions of euros; approximately 2 million email addresses and 7.4 million passwords are available for victims to check. Law enforcement uploaded a video about the Rhadamanthys takedown, seized the VenomRAT clearweb site, and urged anyone with information or concerns to contact authorities and consult national police and breach notification services.
Critical WatchGuard Firebox Vulnerability Exploited in Attacks

www.securityweek.com · 8 months ago

A critical vulnerability in WatchGuard Firebox firewalls tracked as CVE 2025 9242 with a CVSS score of 9.3 allows unauthenticated remote code execution in the Fireware OS iked process and has been exploited in the wild. CISA added the flaw to its Known Exploited Vulnerabilities list and urged federal agencies to patch within three weeks, while WatchGuard released fixes in Fireware OS versions 2025.1.1, 12.11.4, 12.5.13, and 12.3.1 Update 3, warned that Fireware OS 11.x will not receive fixes, reported indicators of compromise, and advised administrators to rotate locally stored secrets after noting Shadowserver scans found over 73,000 unpatched appliances. The defect was added to the KEV list alongside CVE 2025 12480 and CVE 2025 62215.
CISA Warns of Active Exploitation of Windows Kernel 0-Day Enabling Privilege Escalation

gbhackers.com · 8 months ago

There is an actively exploited Windows Kernel zero day tracked as CVE-2025-62215 that can allow a local, low privilege user to escalate to SYSTEM by exploiting a race condition and an associated double free in kernel memory handling. Successful exploitation requires winning a timing sensitive race and thus has high attack complexity, but Microsoft confirmed active exploitation and released patches in the November 2025 updates. Affected systems include Windows 11, supported Windows Server versions, and Windows 10 editions covered by Extended Security Updates, and administrators are urged to apply the available security updates immediately.
Operation Endgame schaltet Schadsoftware ab

www.csoonline.com · 8 months ago

A coordinated international law enforcement operation disrupted the infrastructure of the Rhadamanthys stealer and took measures against the VenomRAT trojan, neutralizing more than 1,000 servers worldwide including over 180 in Germany. Authorities secured compromised data from more than 650,000 victims and made the information available on public platforms for individual verification. The operation involved investigators from the Netherlands, France, Denmark, Belgium and the United States with support from Australia, Canada, the United Kingdom, Europol and Eurojust, and resulted in one arrest in Greece, 11 searches including one in Germany, and the freezing of cryptocurrencies valued at over 200 million US dollars. German prosecutors are pursuing investigations for suspected aggravated extortion and membership in an international criminal organization.
BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration

gbhackers.com · 8 months ago

BreachLock announced an integration with Vanta on November 13, 2025 that lets organizations push security validation evidence directly into compliance workflows with a single click. The integration automatically transfers penetration testing reports, adversarial exposure validation results, and attack surface management findings into the appropriate Vanta control folders, aligning evidence with frameworks such as SOC 2 and ISO 27001 while reducing manual uploads and audit preparation time. Customers connect from the BreachLock Unified Platform to Vanta, authorize the integration through a simple setup process, and gain continuous compliance support and fewer errors to support CTEM programs that unify PTaaS, AEV, and ASM.
Zero-day exploits hit Cisco ISE and Citrix systems in an advanced campaign

www.csoonline.com · 8 months ago

Amazon Threat Intelligence disclosed an advanced persistent threat campaign that exploited vulnerabilities in Citrix NetScaler ADC and Gateway and in Cisco Identity Services Engine to breach core identity infrastructure before the flaws were publicly known. The campaign weaponized an input validation memory overread in Citrix Bleed 2 tracked as CVE-2025-5777 and a preauthentication deserialization remote-code-execution in Cisco ISE tracked as CVE-2025-20337. After exploitation the actor injected a custom in-memory web shell masquerading as the IdentityAuditAction component in Cisco ISE, registering an HTTP listener in Tomcat, using DES with nonstandard Base-64 encoding and requiring specific HTTP headers for access. Organizations are advised to adopt layered defenses by restricting access to privileged appliance endpoints, monitoring for unusual in-memory activity, and treating identity systems as high-risk zones with the same scrutiny as public-facing servers.
CISA warns feds to fully patch actively exploited Cisco flaws

www.bleepingcomputer.com · 8 months ago

CISA warned U S federal agencies to fully patch two actively exploited vulnerabilities in Cisco Adaptive Security Appliances and Firepower devices, CVE-2025-20362 and CVE-2025-20333, which allow remote actors to access restricted URL endpoints without authentication and to achieve code execution on vulnerable firewalls. If chained, the flaws can enable unauthenticated attackers to gain complete control of unpatched devices, and Cisco said it patched the issues in September and linked the intrusions to the ArcaneDoor campaign that also abused CVE-2024-20353 and CVE-2024-20359 in attacks since November 2023. CISA issued Emergency Directive 25-03 requiring agencies to secure affected devices within 24 hours, warned that some agencies reported devices as patched to vulnerable software versions, and monitoring shows over 30,000 Cisco devices remain exposed online.
When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security

thehackernews.com · 8 months ago

There are multiple 2025 industry reports finding roughly 50 to 61 percent of newly disclosed vulnerabilities saw exploit code weaponized within 48 hours, and hundreds of software flaws are confirmed as actively targeted within days of public disclosure according to CISA Known Exploited Vulnerabilities data. Major threat actors have industrialized automated pipelines that scrape vulnerability feeds, assess CVEs, and weaponize exploits at machine speed while many IT and security teams remain constrained by manual triage and slower patch cycles, creating a critical exposure window. The recommended shift is from human speed, ticket based patching to policy driven automation including continuous patching, automated hardening, orchestration, and controlled rollback to shorten exposure windows and maintain operational resilience. Recent warnings mention CVE-2025-20333 and CVE-2025-20362 as examples of vulnerabilities being actively exploited.
Synnovis Confirms Patient Information Stolen in Disruptive Ransomware Attack

www.securityweek.com · 8 months ago

Pathology services provider Synnovis confirmed that a ransomware attack on June 3, 2024 disrupted IT systems at several London hospitals, forcing operations to be canceled and patients diverted. The Qilin ransomware gang claimed responsibility on June 20, 2024 and published roughly 400 gigabytes of data allegedly stolen, which Synnovis said had been taken in haste from working drives and not from primary lab databases. Compromised information includes names, dates of birth, NHS numbers and in some cases test results, and Synnovis said it did not pay a ransom, rebuilt affected IT infrastructure and restored services by late 2024. Synnovis obtained an injunction to limit publication, reported no evidence of misuse or ongoing criminal interest, and began notifying affected organizations with an expected notification completion date of November 21, 2025, leaving patient notification decisions to the impacted organizations.
Operation Endgame Dismantles Rhadamanthys, Venom RAT, and Elysium Botnet in Global Crackdown

thehackernews.com · 8 months ago

Malware families like Rhadamanthys Stealer, Venom RAT, and the Elysium botnet were disrupted in a coordinated law enforcement operation led by Europol and Eurojust between November 10 and 13, 2025. Authorities arrested the main suspect behind Venom RAT in Greece on November 3, took down more than 1,025 servers, seized 20 domains, and said the dismantled infrastructure included hundreds of thousands of infected computers containing several million stolen credentials. Europol reported the infostealer suspect had access to at least 100,000 cryptocurrency wallets potentially worth millions of euros, and analysis found the latest Rhadamanthys added browser fingerprinting and stealth features.
Police disrupts Rhadamanthys, VenomRAT, and Elysium malware operations

www.bleepingcomputer.com · 8 months ago

Law enforcement authorities from nine countries dismantled 1,025 servers used by the Rhadamanthys infostealer, VenomRAT remote access trojan, and the Elysium botnet as part of the latest phase of Operation Endgame. Between November 10 and 14, 2025, searches were carried out at 11 locations in Germany, Greece, and the Netherlands, 20 domains were seized, and a key suspect linked to VenomRAT was arrested in Greece on November 3, 2025. Authorities reported the dismantled infrastructure comprised hundreds of thousands of infected computers holding several million stolen credentials, and that the infostealer operator had access to over 100,000 crypto wallets potentially worth millions of euros. The action was coordinated by Europol and Eurojust with support from multiple private partners and continues prior Operation Endgame disruptions of major malware and ransomware infrastructures.
Operation Endgame: Authorities Takedown 1,025 Servers Linked to Rhadamanthys, VenomRAT, and Elysium

gbhackers.com · 8 months ago

There are coordinated law enforcement actions between November 10 and November 14, 2025, run from Europol's headquarters in The Hague that dismantled infrastructure linked to the Rhadamanthys infostealer, the VenomRAT remote access trojan, and the Elysium botnet and resulted in the takedown of 1,025 servers. Authorities disrupted Rhadamanthys control panels and Tor endpoints, leaving customers unable to access their panels and prompting operators to advise reinstalling or replacing servers. The action is part of Operation Endgame's wider international effort to disrupt malware as a service and botnet ecosystems, a campaign that has previously driven server seizures, domain neutralizations, arrest warrants, and cryptocurrency confiscations.
Dehashed alternative for pentesters/red teamers

www.reddit.com · 8 months ago

There is a new data leak service called SysLeaks for Attackers launched after SysReptor and offered in a beta that will remain open in November. The service lets users search domain names to retrieve associated usernames and email addresses, plaintext passwords, and in some cases the platform the account was used for. Access requires sign up with a company email and approval limited to offensive security firms to prevent abuse, leaks from the previous 14 days are withheld as a grace period, and beta users receive fifty free credits allowing up to two thousand five hundred leaked accounts per week.
ThreatsDay Bulletin: Cisco 0-Days, AI Bug Bounties, Crypto Heists, State-Linked Leaks and 20 More Stories

thehackernews.com · 8 months ago

There are multiple high priority threats this week, including two Cisco vulnerabilities that some devices were incorrectly marked as patched and remain exploitable, associated with CVE-2025-20333 and CVE-2025-20362, with CISA urging organizations to verify they applied the proper updates because a suspected China linked group known as UAT4356 also called Storm-1849 has been actively exploiting them. There are also reports of a patched Citrix NetScaler reflected cross site scripting flaw tracked as CVE-2025-12101, widespread leaks of sensitive credentials and secrets from leading AI firms on public code repositories, and large scale phishing campaigns abusing Meta Business Suite and a Microsoft 365 credential theft kit. Security teams and governments are responding with new defenses and regulations, including updated browser anti fingerprinting measures, expanded passkey support in Windows, and proposed laws to tighten cyber rules for critical sectors.
Kibana Vulnerabilities Expose Systems to SSRF and XSS Attacks

gbhackers.com · 8 months ago

There are two vulnerabilities in Kibana that can expose systems: an origin validation error in the Observability AI Assistant that permits server side request forgery via a forged Origin header, and a DOM based cross site scripting flaw in the Vega visualization engine. Affected versions include Kibana 8.12.0 through 8.19.6, 9.1.0 through 9.1.6, and 9.2.0, and fixes have been released in versions 8.19.7, 9.1.7, and 9.2.1, with Elastic Cloud Serverless patched prior to public disclosure. The tracked identifiers are CVE-2025-37734 for the SSRF issue and CVE-2025-59840 for the XSS issue, and administrators are urged to upgrade immediately or apply mitigations such as disabling Vega and restricting network access.
CISA warns of WatchGuard firewall flaw exploited in attacks

www.bleepingcomputer.com · 8 months ago

CISA has ordered federal agencies to patch an actively exploited critical remote code execution vulnerability in WatchGuard Firebox firewalls caused by an out of bounds write in Fireware OS versions 11.x, 12.x, and 2025.1, tracked as CVE-2025-9242. The flaw was added to CISA's Known Exploited Vulnerabilities catalog and agencies were given until December 3 to secure systems; WatchGuard released patches on September 17 and later acknowledged exploitation on October 21 while Shadowserver reported tens of thousands of vulnerable appliances worldwide. The report also highlights other exploited vulnerabilities mentioned by CISA including CVE-2024-40766 used by the Akira ransomware group against SonicWall and CVE-2025-62215, a Windows kernel zero day that CISA ordered patched.
Cisco ISE, CitrixBleed 2 Vulnerabilities Exploited as Zero-Days: Amazon

www.securityweek.com · 8 months ago

There are active zero day exploits targeting two critical flaws, CVE-2025-20337 in Cisco Identity Services Engine and CVE-2025-5777 in Citrix, the latter tied to CitrixBleed 2. Amazon observed a threat actor exploiting these vulnerabilities in the wild.
Malicious Chrome Extension Grants Full Control Over Ethereum Wallet

gbhackers.com · 8 months ago

A malicious Chrome extension named Safery: Ethereum Wallet was published on the Chrome Web Store and posed as a legitimate Ethereum wallet. When users create or import a wallet the extension encodes their BIP-39 seed phrase into synthetic Sui addresses and silently sends microtransactions signed with a hardcoded attacker mnemonic so the threat actor can decode the recipient addresses and reconstruct the seed to take over wallets. Because the exfiltration uses normal looking on chain transactions instead of direct network calls to a central server it can evade domain and URL based detection and defenders are advised to install only trusted wallet extensions and alert on unexpected RPC or cross chain activity.
GitLab Vulnerabilities Expose Users to Prompt Injection Attacks and Data Theft

gbhackers.com · 8 months ago

GitLab released patch versions 18.5.2, 18.4.4, and 18.3.6 to address nine vulnerabilities in Community Edition and Enterprise Edition and is urging all self managed installations to upgrade immediately. One notable issue is a prompt injection flaw in GitLab Duo that could allow an authenticated user to exfiltrate sensitive content from confidential issues, tracked as CVE-2025-6945. Other fixes include an information disclosure in access control tracked as CVE-2025-7000 and a client side path traversal in branch names tracked as CVE-2025-11990, and the release notes warn that upgrades may include database migrations that can cause downtime for single node instances.
New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware

gbhackers.com · 8 months ago

A sophisticated campaign uses the ClickFix social engineering technique to push information stealing malware to both Windows and macOS users. Attackers lure victims via search results for cracked software and fake verification pages that instruct users to copy and run obfuscated PowerShell or terminal commands, which fetch staged scripts such as gverify.js and then download the final payload into the user downloads folder. The payloads are infostealers that exfiltrate browser credentials, cryptocurrency wallet data, screenshots and other sensitive files, and security telemetry shows ClickFix based delivery has surged and expanded across platforms.
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks

thehackernews.com · 8 months ago

CISA added a critical out of bounds write vulnerability in WatchGuard Fireware to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The flaw tracked as CVE-2025-9242 has a CVSS score of 9.3 and affects Fireware OS versions 11.10.2 through 11.12.4Update1, 12.0 through 12.11.3, and 2025.1, and may allow a remote unauthenticated attacker to execute arbitrary code in the iked process during the IKE handshake. More than 54,300 Firebox instances remained vulnerable as of November 12, 2025 with roughly 18,500 located in the United States, and CISA also added CVE-2025-62215 and CVE-2025-12480 to the KEV catalog. Federal Civilian Executive Branch agencies were advised to apply WatchGuard patches by December 3, 2025.
Critical Dell Data Lakehouse Flaw Allows Remote Attackers to Escalate Privileges

gbhackers.com · 8 months ago

A critical improper access control vulnerability in Dell Data Lakehouse allows a high privileged remote user to escalate privileges and could lead to full system compromise. The flaw is tracked as CVE-2025-46608, carries a CVSS v3.1 base score of 9.1, and affects Data Lakehouse versions prior to 1.6.0.0. Dell has published security updates and recommends upgrading to version 1.6.0.0 or later while restricting high privilege accounts and monitoring for unauthorized privilege escalation.
What CISOs need to know about new tools for securing MCP servers

www.csoonline.com · 8 months ago

Model Context Protocol lets AI agents connect to data sources, and early iterations lacked serious security but recent updates added OAuth and third-party authentication support and an official MCP registry. Significant vulnerabilities remain because authentication is optional and systems are prone to prompt injection, tool poisoning, token theft, cross-server attacks, and message tampering, putting high-risk uses such as financial transactions at particular risk. Organizations need fine-grained authorizations, least-privilege controls, comprehensive logging, and runtime protections, and vendors are offering MCP discovery, runtime monitoring, authentication and zero trust frameworks, and observability tools. Hyperscalers including AWS, Microsoft, and Google and vendors such as Cloudflare, Palo Alto Networks, SentinelOne, and startups including Akto and Invariant Labs are rolling out MCP security solutions to help enterprises harden deployments.
Beware of Fake Bitcoin Tools Concealing DarkComet RAT Malware

gbhackers.com · 8 months ago

A malware campaign is leveraging cryptocurrency lures to distribute the DarkComet remote access trojan via executables disguised as Bitcoin wallet applications. Samples were delivered inside RAR archives and UPX packed executables that spawn cmd and conhost processes, inject into notepad, establish persistence, and perform keylogging and credential theft. The unpacked samples were observed attempting TCP connections to kvejo991.ddns.net on port 1604 for command and control. Users are advised to obtain wallet and trading software only from verified sources and to avoid opening unsolicited compressed attachments or executables.
CISA Warns of Active Exploitation of WatchGuard Firebox Out-of-Bounds Write Flaw

gbhackers.com · 8 months ago

There is a critical out of bounds write vulnerability affecting WatchGuard Firebox firewalls that has been added to the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog. The vulnerability is tracked as CVE-2025-9242 and is reported to be under active exploitation in the wild, posing severe risk to organizations that rely on these devices for network security. Agencies and enterprises using WatchGuard Firebox devices are urged to prioritize vendor patches and apply available mitigations immediately.
Citrix NetScaler ADC and Gateway Flaw Allows Cross-Site Scripting (XSS) Attacks

gbhackers.com · 8 months ago

Cloud Software Group disclosed a cross-site scripting vulnerability in NetScaler ADC and NetScaler Gateway platforms. The flaw is tracked as CVE-2025-12101 and is classified under CWE-79, posing a moderate security risk to organizations that use these appliances for authentication and secure access. Administrators of affected systems should assess exposure and apply vendor guidance to mitigate potential XSS exploitation.
Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software

gbhackers.com · 8 months ago

There is a campaign that abuses legitimate RMM tools LogMeIn Resolve and PDQ Connect by delivering them through fake download pages or malicious installers to install a Delphi backdoor called PatoRAT. Once installed attackers use the RMM tools to execute PowerShell and deploy PatoRAT, which supports remote control, data exfiltration, keylogging, screen capture, hidden VNC, plugin support, and other commands, and installs with attacker-controlled CompanyId values. Defenders are advised to restrict unauthorized RMM installations, block suspicious EXE and MSI downloads, monitor remote-access sessions, and take down malicious sites and domains.
Active Exploitation of Cisco and Citrix 0-Day Vulnerabilities Allows Webshell Deployment

gbhackers.com · 8 months ago

A sophisticated campaign is actively exploiting zero day vulnerabilities in Cisco Identity Services Engine and Citrix NetScaler, enabling pre authentication remote code execution and unauthorized administrative access. Attackers deployed custom in memory webshells that inject into Tomcat threads using Java reflection, monitor HTTP requests, use DES with non standard Base64 encoding, and require specific HTTP headers to operate, minimizing forensic traces. Observed affected vulnerabilities include CVE 2025 20337 for Cisco ISE and CVE 2025 5777 for Citrix NetScaler, and defenders are urged to apply vendor patches, restrict access to management endpoints, and hunt for indicators of compromise.
Firefox 145 and Chrome 142 Patch High-Severity Flaws in Latest Releases

www.securityweek.com · 8 months ago

Google and Mozilla released Chrome 142 and Firefox 145 updates that fix multiple high severity security defects. Chrome 142 fixes a high severity inappropriate implementation issue in the V8 JavaScript engine tracked as CVE 2025 13042 and is rolling out as version 142.0.7444.162 for Linux and macOS and as 142.0.7444.162 and 142.0.7444.163 for Windows. Firefox 145 addresses 16 vulnerabilities, including nine high severity flaws impacting graphics and WebGPU boundary conditions, a WebAssembly boundary issue, a JIT miscompilation and a race condition, and includes a memory safety flaw tracked as CVE 2025 13027 that affects Firefox 144 and Thunderbird 144. Neither vendor has reported exploitation in the wild and Mozilla also released updated ESR builds with additional fixes.
Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

thehackernews.com · 8 months ago

Researchers warn a worm like spam campaign named IndonesianFoods has flooded the npm registry since early 2024 with as many as 46,484 fake packages that masquerade as Next.js projects and use Indonesian names and food terms. The packages contain a dormant JavaScript worm in a single file such as auto.js that only runs if executed manually and when run it removes the private flag, generates random package names and versions, and publishes new packages in an infinite loop every seven to ten seconds, creating exponential dependency chains that strain the registry. Evidence indicates the campaign is financially motivated by inflating TEA protocol reward accounts, was operated from a small set of npm accounts, and GitHub has removed the malicious packages while researchers urge improved scanner detection for manually executed scripts.
Google Sues “Lighthouse” Over Massive Phishing Attacks

gbhackers.com · 8 months ago

Google has filed a lawsuit in the U S District Court for the Southern District of New York seeking to dismantle Lighthouse, an alleged Phishing as a Service operation that sells subscription phishing kits and templates used to impersonate organizations such as Google, the U S Postal Service and E ZPass. Google says Lighthouse users created about 200,000 fraudulent websites in a 20 day span and targeted more than one million potential victims across over 120 countries, with the company estimating the operation may have exposed between 12.7 million and 115 million U S credit card numbers. The complaint alleges the phishing pages logged keystrokes and misused more than a hundred templates showing Google branding, and Google is seeking monetary damages and court orders under racketeering, trademark and computer fraud laws while also supporting federal legislation to curb similar scams.
Google asks US court to shut down Lighthouse phishing-as-a-service operation

www.csoonline.com · 8 months ago

Google is asking a US court to dismantle the infrastructure behind Lighthouse, a phishing as a service operation that the company found using at least 107 website templates featuring Google branding on sign-in screens to trick users. Operators sell access to Lighthouse so threat actors can send text messages that appear to come from legitimate providers and lure victims into giving email credentials, banking information and other sensitive data. Google is also urging US lawmakers to adopt the GUARD Act, the Foreign Robocall Elimination Act and the SCAM Act to provide funding, create task forces and develop a national strategy against scam compounds and related fraud. Security experts say court orders and legislation could have only minimal impact because services can operate outside US jurisdiction, but any reduction in scams would ease the burden on IT teams, especially by curbing paid ads and malicious sites that direct victims to fraud.