Blahalla

SVD-2025-1103: Third-Party Package Updates in Splunk Enterprise - November 2025

advisory.splunk.com · 8 months ago

There are third party package updates for Splunk Enterprise that remediate vulnerabilities and customers should upgrade to Splunk Enterprise version 10.0.1, 9.4.5, 9.3.7, 9.2.9 or higher. The jackson core package was upgraded to version 2.15.0 to remediate CVE-2025-52999, which is rated high. Affected base versions include Splunk Enterprise 10.0.0 fixed in 10.0.1, 9.4.0 to 9.4.4 fixed in 9.4.5, 9.3.0 to 9.3.6 fixed in 9.3.7, and 9.2.0 to 9.2.8 fixed in 9.2.9.
SVD-2025-1102: Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise

advisory.splunk.com · 8 months ago

There is a vulnerability in Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7 and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1 that allows a low privileged user to run a saved search containing risky commands with the permissions of a higher privileged user, bypassing SPL safeguards for risky commands. The bypass occurs on the streams search endpoint via its q parameter by circumventing endpoint restrictions using character encoding in the REST path. Successful exploitation requires the attacker to phish and trick an authenticated user into initiating a request from their browser, and the vulnerability cannot be exploited by an authenticated user at will.
SVD-2025-1101: Open Redirect on Web Login endpoint in Splunk Enterprise

advisory.splunk.com · 8 months ago

An open redirect in the Splunk Web login endpoint allows an unauthenticated attacker to craft a malicious returnto URL that can cause an authenticated user who follows the URL to be redirected to an external malicious site. The flaw is tracked as CVE-2025-20378 and is rated CVSS v3.1 score 3.1 Low. Splunk fixed the issue in Enterprise versions 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and in corresponding Cloud Platform releases, and recommends upgrading or disabling Splunk Web as a workaround.
Synology fixes BeeStation zero-days demoed at Pwn2Own Ireland

www.bleepingcomputer.com · 8 months ago

Synology has fixed a critical remote code execution vulnerability in BeeStation OS that is caused by a buffer copy without checking input size and is tracked as CVE-2025-12686. The flaw affects multiple BeeStation OS versions on Synology personal cloud NAS devices and has no available mitigations, so users are urged to update to BeeStation OS version 1.3.2-65648 or later. Researchers from Synacktiv demonstrated the exploit at Pwn2Own Ireland on October 21, 2025 and received a forty thousand dollar reward for the successful exploit.
Adobe Patches 29 Vulnerabilities

www.securityweek.com · 8 months ago

There are 29 vulnerabilities patched in Adobe InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins. Critical arbitrary code execution flaws were fixed in InDesign, InCopy, Photoshop, Illustrator, Substance 3D Stager, and Format Plugins, and a critical security bypass in Pass was resolved. Adobe says there is no evidence these vulnerabilities have been exploited in the wild and assigned a priority rating of 3 to all issues, indicating malicious exploitation is not expected.
Microsoft Patches Actively Exploited Windows Kernel Zero-Day

www.securityweek.com · 8 months ago

There are more than 60 vulnerabilities addressed in the latest Patch Tuesday updates, including an actively exploited Windows kernel zero day tracked as CVE-2025-62215 which is described as an important severity privilege escalation that can grant System privileges by exploiting a race condition. Four vulnerabilities were rated critical affecting Windows, Office, Visual Studio, and Nuance PowerScribe 360, while over 30 fixes close privilege escalation flaws and 22 address remote code execution weaknesses. Microsoft's Threat Intelligence Center and Security Response Center discovered CVE-2025-62215 and have not disclosed details of the attacks.
Tenzai Raises $75 Million in Seed Funding to Build AI-Powered Pentesting Platform

www.securityweek.com · 8 months ago

Cybersecurity startup Tenzai has emerged from stealth with 75 million dollars in seed funding to build an AI driven penetration testing platform that continuously identifies and addresses software vulnerabilities. The company was founded by cybersecurity veterans Pavel Gurvich, Ariel Zeitlin, Ofri Ziv, Itamar Tal and Aner Mazur, with Gurvich and Zeitlin previously cofounding Guardicore and Mazur having served as chief product officer at Snyk. The round was led by Greylock Partners, Battery Ventures and Lux Capital, and the company says it is piloting the platform with large organizations in financial services, healthcare and technology while using the funds to expand research and security teams and to grow in North America and Europe.
Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click Bugs

www.darkreading.com · 8 months ago

Microsoft's November security update addresses 63 unique CVEs, including one actively exploited Windows Kernel zero-day CVE-2025-62215 and a single critical GDI plus remote code execution flaw CVE-2025-60724 rated CVSS 9.8. Other high priority flaws include a Kerberos elevation of privilege CVE-2025-60704 dubbed CheckSum that can enable lateral movement, a Windows Subsystem for Linux GUI remote code execution CVE-2025-62220, and three WinSock Ancillary Function Driver privilege escalation issues CVE-2025-60719 CVE-2025-62213 and CVE-2025-62217. Security teams are urged to prioritize patches for these vulnerabilities immediately because the zero-day is being used for post compromise privilege escalation and the critical GDI plus RCE can be triggered without user interaction.
Hackers abuse Triofox antivirus feature to deploy remote access tools

www.bleepingcomputer.com · 8 months ago

Threat actors exploited a critical authentication bypass in Gladinet Triofox that allows an attacker to spoof the HTTP Host or Referer header and pass a localhost check, tracked as CVE-2025-12480. Attackers used the flaw to access the AdminDatabase setup page, create a Cluster Admin account, upload a malicious script, configure it as the Triofox antivirus scanner and thereby execute code as the SYSTEM account via a PowerShell downloader. The downloader retrieved a Zoho UEMS installer used to deploy Zoho Assist and AnyDesk for remote access, and the intruders also used Plink and PuTTY to create an SSH tunnel and forward the host RDP port for lateral movement. A patch for CVE-2025-12480 appeared in Triofox version 16.7.10368.56560 and administrators are urged to install the later 16.10.10408.56683 release, audit admin accounts and ensure the antivirus scanner is not set to run unauthorized scripts, and a separate zero day CVE-2025-11371 affecting CentreStack and Triofox was previously reported and fixed.
Microsoft: Windows 11 23H2 Home and Pro reach end of support

www.bleepingcomputer.com · 8 months ago

Windows 11 version 23H2 Home and Pro editions reached end of servicing on November 11, 2025 and will no longer receive monthly security or preview updates. Enterprise, Education, and IoT Enterprise editions of Windows 11 version 23H2 remain under mainstream support until November 2026. Users are advised to upgrade to Windows 11 version 25H2, which became generally available as an enablement package in September 2025 and has consumer end of support in October 2027. The 25H2 update is available via Windows Update to eligible devices and will be installed automatically on unmanaged Home and Pro devices while still allowing users to postpone installation.
Microsoft Patch Tuesday for November 2025 – Fix for 0-day and Other 62 Vulnerabilities

gbhackers.com · 8 months ago

Microsoft released its November 2025 Patch Tuesday update addressing 63 security vulnerabilities across its software lineup. A critical fix patches an actively exploited zero day in the Windows Kernel identified as CVE-2025-62215, an elevation of privilege vulnerability. The remaining 62 vulnerabilities across Microsoft products were also fixed and users are advised to apply the updates promptly.
Microsoft November 2025 Patch Tuesday fixes 1 zero-day, 63 flaws

www.bleepingcomputer.com · 8 months ago

There are 63 security fixes in Microsofts November 11, 2025 Patch Tuesday, including one actively exploited zero day and four Critical vulnerabilities. The actively exploited zero day is CVE-2025-62215, a Windows Kernel elevation of privilege race condition that was used to gain SYSTEM privileges. The updates address a range of issues including 16 remote code execution and 29 elevation of privilege flaws across products such as Microsoft Office, Visual Studio, and Azure Monitor, with notable CVEs including CVE-2025-62199, CVE-2025-62214, and CVE-2025-59504 also fixed.
WhatsApp Malware 'Maverick' Hijacks Browser Sessions to Target Brazil's Biggest Banks

thehackernews.com · 8 months ago

There are similarities between a prior banking trojan called Coyote and a new banking malware named Maverick, with both written in dot NET, targeting Brazilian users and banks, and sharing routines to decrypt and monitor banking URLs and applications. Maverick is being propagated via WhatsApp Web by a worm component that delivers ZIP files containing malicious LNK shortcuts which execute VBScript and PowerShell to hijack WhatsApp Web sessions using ChromeDriver and Selenium and then send the malicious archive to contacts. The attack chain uses LNK to launch PowerShell that can disable Microsoft Defender and UAC, loads a.NET loader that performs anti analysis checks and verifies the victim is in Brazil before installing modules, and provides remote control capabilities including screenshots, command execution, file operations, and staged delivery of a credential stealing banking payload.
Windows 11 KB5068861 & KB5068865 cumulative updates released

www.bleepingcomputer.com · 8 months ago

Microsoft released cumulative updates KB5068861 and KB5068865 for Windows 11 versions 25H2, 24H2 and 23H2 to fix security vulnerabilities, address bugs and add new features as part of the November 2025 Patch Tuesday. Highlights include a new Start menu UI that can remove the Recommended feed, lock screen battery icons with percentage and color indicators, updated taskbar battery indicators, a Microsoft 365 Copilot Get Started page for commercial devices, the Settings section renamed to Your accounts, and an Administrator Protection preview that enables just in time administrative privileges. The update also adds Post Quantum Cryptography API support for NIST ML KEM and ML DSA via SymCrypt, delivers numerous fixes for File Explorer, display and input issues, changes build numbers for affected releases and marks this as the final update for Windows 11 23H2 as support ends on November 11 2025.
Microsoft: Emergency Windows 10 update fixes ESU enrollment bug

www.bleepingcomputer.com · 8 months ago

Microsoft released an emergency out of band update that fixes a Windows 10 Consumer Extended Security Update enrollment issue where the ESU enrollment wizard may fail during enrollment. Installing the KB5071959 cumulative update and rebooting allows affected users to run the ESU enrollment wizard and, once enrolled, receive Extended Security Updates through Windows Update, and Microsoft also pushed KB5068781 as the first extended security update to ESU enrolled devices. Windows 10 reached end of support on October 14, 2025, and the ESU program lets customers delay upgrading to Windows 11 with per device pricing for home and enterprise customers and free enrollment options for some individual users.
“Bitcoin Queen” gets 11 years in prison for $7.3 billion Bitcoin scam

www.bleepingcomputer.com · 8 months ago

There are reports that a Chinese woman known as the Bitcoin Queen, Zhimin Qian also known as Yadi Zhang, was sentenced in London to eleven years and eight months for laundering Bitcoin from a five point five billion pound cryptocurrency investment scheme that defrauded more than 128,000 victims between 2014 and 2017. Authorities seized sixty one thousand Bitcoin in what is now the largest cryptocurrency seizure in Britain and globally, and investigators also recovered wallets, encrypted devices, cash and gold. Two associates received prison terms, with Seng Hok Ling sentenced to four years and eleven months and Jian Wen sentenced in May of 2024 to six years and eight months.
Ivanti Endpoint Manager Vulnerabilities Let Attackers Write Files Anywhere on Target Systems

gbhackers.com · 8 months ago

Ivanti released critical updates for Endpoint Manager to remediate three high severity vulnerabilities that could allow authenticated attackers to write arbitrary files to any location on affected systems. The flaws stem from insufficient filename validation and path traversal weaknesses that can be chained to achieve remote code execution, tracked as CVE-2025-9712, CVE-2025-9713, and CVE-2025-10986. Administrators are urged to apply the vendor patches immediately or follow the provided mitigations to prevent arbitrary file writes and potential remote code execution.
GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites

thehackernews.com · 8 months ago

Security researchers observed three GootLoader infections since October 27, 2025, two of which resulted in hands on keyboard intrusions and a domain controller compromise within 17 hours. The loader, attributed to a group tracked as Hive0127 also known as UNC2565, now uses custom WOFF2 web fonts with glyph substitution embedded via Z85 encoding in JavaScript to obfuscate filenames and exploits WordPress comment endpoints to deliver XOR encrypted ZIP payloads with unique keys per file. Attackers modify archives so automated analysis tools unpack harmless looking files while Windows Explorer extracts a JavaScript payload that deploys the Supper backdoor for SOCKS5 proxying and remote shell access, with access often handed off to other actors to drop remote access tools and ransomware.
SAP fixes hardcoded credentials flaw in SQL Anywhere Monitor

www.bleepingcomputer.com · 8 months ago

SAP released November security updates addressing multiple vulnerabilities, including a maximum severity hardcoded credentials flaw in the non GUI variant of SQL Anywhere Monitor tracked as CVE-2025-42890 with a CVSS score of 10.0. A second critical code injection vulnerability in SAP Solution Manager, tracked as CVE-2025-42887 with a severity of 9.9, can allow an authenticated attacker to insert malicious code and gain full control of the system. The update also includes a high severity fix CVE-2025-42940, a NetWeaver fix CVE-2025-42944, and references earlier active exploitation of CVE-2025-42957, and administrators are urged to apply the available updates and follow vendor mitigation guidance.
Grandparents to C-Suite: Elder Fraud Reveals Gaps in Human-Centered Cybersecurity

www.darkreading.com · 8 months ago

Cybercriminals are using AI voice cloning and publicly available personal data to craft emotionally convincing social engineering scams that impersonate family members and trusted contacts. These scams specifically target older adults by portraying urgent emergencies to pressure immediate payments or transfers, contributing to billions of dollars lost to elder fraud in recent years. The trend reveals gaps in human centered cybersecurity across generations and organizational levels, indicating that technical defenses alone are insufficient and must be paired with usable verification practices and intergenerational education. Officials advise vigilance for urgent money requests, independent identity verification before sending funds, and combining technical controls with regular training and awareness efforts for both vulnerable seniors and enterprise leaders.
Critical Triofox Vulnerability Exploited in the Wild

www.securityweek.com · 8 months ago

A threat actor tracked as UNC6485 exploited a critical improper access control flaw in Triofox, tracked as CVE-2025-12480, by manipulating the HTTP Host header to reach initial setup pages after installation and create a new administrator account. After gaining admin, the attacker abused Triofox antivirus settings to execute a malicious batch that fetched a Zoho UEMS installer and used Zoho Assist and AnyDesk to enumerate SMB sessions, change passwords, add accounts to local and domain administrator groups, and set up encrypted SSH tunnels to a command and control server. Organizations are advised to update Triofox to version 16.7.10368.56560 or later, audit administrator accounts, and prevent the Triofox antivirus engine from executing unauthorized scripts or binaries.
GlobalLogic warns 10,000 employees of data theft after Oracle breach

www.bleepingcomputer.com · 8 months ago

There are 10,471 current and former GlobalLogic employees who were notified that their personal data was stolen after attackers exploited an Oracle E Business Suite zero day. The stolen information included names, addresses, phone numbers, email addresses, dates of birth, passport and national identifiers, salary data, and bank account details. The breach involved a zero day tracked as CVE-2025-61882, with access and exfiltration observed on October 9, 2025 and threat actor activity traced from July 10, 2025 to August 20, 2025. The activity aligns with an extortion campaign attributed to the Clop ransomware group that has been exploiting the same Oracle E Business Suite flaw against multiple organizations.
How a CPU spike led to uncovering a RansomHub ransomware attack

www.bleepingcomputer.com · 8 months ago

A sudden CPU spike on a server led investigators to uncover an active RansomHub intrusion that began when a user executed a malicious JavaScript disguised as a browser update. The attackers installed a recurring scheduled task and a legitimate Python distribution along with an encrypted multi stage Python script that functioned as a SOCKS proxy to pivot into the corporate network while embedding malicious references into email signatures to enable credential harvesting. Within hours the threat actor extracted credentials using DPAPI, escalated to Domain Admin by exploiting misconfigured Active Directory Certificate Services, enabled remote access to targeted machines, and exfiltrated large volumes of files using AzCopy which caused the CPU spike. A rapid joint response severed malicious access and eradicated the intrusion before ransomware deployment, and the activity was attributed to RansomHub affiliates using SocGholish for initial access.
Lost Your iPhone? Beware Fake ‘Find My’ Messages Aiming to Steal Your Apple ID

www.techrepublic.com · 8 months ago

Switzerland's National Cyber Security Centre warns of a phishing scam that exploits the Find My feature to steal Apple ID credentials from lost or stolen iPhones. Scammers send convincing emails or SMS messages impersonating Apple Support with links to fake Find My login pages and may use accurate device details or the phone number from an active SIM to increase credibility. After credentials are captured attackers can deactivate Activation Lock, unlock and wipe the device, access financial apps, and resell the phone. Users are advised to set Lost Mode immediately via iCloud, ignore unsolicited messages claiming to show a device location, and limit contact details shown on the lock screen by using a dedicated recovery email.
New Firefox Protections Halve the Number of Trackable Users

www.securityweek.com · 8 months ago

Mozilla has implemented improved fingerprinting protections in Firefox 145 that reduce the percentage of users seen as unique by almost half. The protections block collection of system and hardware details used for fingerprinting, including processor core count, taskbar size, and touchscreen finger support, and build on Enhanced Tracking Protection and Total Cookie Protection first introduced in 2020. The defenses are layered to preserve web functionality, apply in private browsing and ETP strict mode, and work without additional extensions or configuration.
Zoom Workplace for Windows Flaw Allows Local Privilege Escalation

gbhackers.com · 8 months ago

There is a security vulnerability in Zoom Workplace VDI Client for Windows that can allow local privilege escalation on affected systems. The flaw is tracked as CVE-2025-64740 and listed in bulletin ZSB-25042 with a High severity rating and a CVSS score of 7.5.
SAP Patches Critical Flaws in SQL Anywhere Monitor, Solution Manager

www.securityweek.com · 8 months ago

SAP released 18 new and one updated security note as part of its November 2025 security patches. The most critical issue is CVE-2025-42890, rated 10 out of 10, an insecure key and secret management vulnerability in SQL Anywhere Monitor caused by hardcoded credentials that can lead to arbitrary code execution, and SAP removed SQL Anywhere Monitor and recommends stopping its use and deleting any instances as a temporary workaround. Additional critical and high severity fixes include CVE-2025-42887, a 9.9 severity code injection in Solution Manager; CVE-2025-42944, a 10.0 insecure deserialization flaw in NetWeaver AS Java; CVE-2025-42940, a 7.5 memory corruption in CommonCryptoLib; and CVE-2025-42910, a 9.0 unrestricted file upload in Supplier Relationship Management, and users are urged to apply the security notes promptly.
WinRAR Vulnerability Exploited by APT-C-08 to Target Government Agencies

gbhackers.com · 8 months ago

There are reports that APT-C-08, also known as BITTER, is weaponizing a critical WinRAR directory traversal vulnerability to target government organizations across South Asia. The flaw is tracked as CVE-2025-6218 and allows crafted archive file paths to traverse outside the intended extraction directory, enabling attackers to place executables into startup or system locations and achieve remote code execution when a user opens a malicious archive. Exploitation is low in complexity but requires user interaction, and researchers have observed the vulnerability being actively used in targeted spearphishing campaigns that deliver malicious RAR files.
CMMC Live: Pentagon Demands Verified Cybersecurity From Contractors

www.securityweek.com · 8 months ago

Enforcement of the Department of Defense Cybersecurity Maturity Model Certification began on November 10, 2025, and the Department can now require verified CMMC compliance as a condition for new defense industrial base contracts. Contractors must meet one of three maturity levels: Level 1 requires annual self assessment and 15 basic safeguarding requirements; Level 2 covers controlled unclassified information and maps to 110 requirements from NIST SP 800 171 and may require assessment by a certified third party assessor organization; Level 3 adds protection against advanced persistent threats and requires a Defense Industrial Base Cybersecurity Assessment Center assessment every three years plus the 110 requirements and 24 additional requirements from NIST SP 800 172. Implementation is phased with Level 1 and Level 2 self assessments required starting November 10, 2025, third party Level 2 assessments for new contracts from November 10, 2026, Level 3 requirements from November 10, 2027, and full implementation on November 10, 2028, and industry reports indicate most contractors are not prepared which could lock many out of billions in DoD contracts.
Phishing Scam Uses Big-Name Brands to Steal Logins

gbhackers.com · 8 months ago

Researchers uncovered a widespread phishing campaign that uses self contained HTML email attachments disguised as procurement documents or invoices to entice recipients to sign in. The embedded JavaScript in those HTML files displays fake login prompts and sends harvested credentials directly to attacker controlled Telegram bots via the Telegram Bot API, allowing credential theft without hosting malicious pages on external servers. Attackers impersonate global and regional brands such as Adobe, Microsoft, WeTransfer, DocuSign, FedEx, DHL, and Telekom Deutschland to maximize legitimacy and target European businesses with localized lures. Telemetry shows dozens of unique HTML samples, reuse of identical bot tokens across templates, and an automated phishing toolkit that rapidly generates new brand themed variants.
SAP Releases Security Update to Fix Critical Code Execution and Injection Flaws

gbhackers.com · 8 months ago

SAP released a security update addressing 18 vulnerabilities across its enterprise software portfolio, including critical remote code execution and injection flaws that require immediate attention. The most severe issues include CVE-2025-42890 in SQL Anywhere Monitor and CVE-2025-42944 in NetWeaver AS Java, both rated CVSS 10.0, and a critical code injection flaw CVE-2025-42887 in Solution Manager with a 9.9 rating. Other notable fixes cover memory corruption CVE-2025-42940, OS command injection CVE-2025-42892, JNDI injection CVE-2025-42884 and SQL injection CVE-2025-42889, along with path traversal, open redirect and authentication issues across multiple SAP components. Organizations are urged to prioritize these patches, apply updates through the SAP Support Portal, run vulnerability scans, and test patches in staging environments to reduce the risk of active exploitation.
New “KomeX” Android RAT Hits Hacker Forums with Tiered Subscriptions

gbhackers.com · 8 months ago

A sophisticated Android remote access trojan named KomeX RAT has appeared on underground hacking forums and is being actively marketed by a threat actor called Gendirector through tiered subscription plans. KomeX is built on the foundation of the previously documented BTMOB malware and inherits extensive remote access and data theft capabilities that put Android device owners at risk. Aggressive advertising and a subscription based business model are increasing the likelihood of wider distribution and easier access for criminals.
‘Whisper Leak’ LLM Side-Channel Attack Infers User Prompt Topics

www.securityweek.com · 8 months ago

Microsoft researchers demonstrated a side channel attack called Whisper Leak that allows an observer of encrypted network traffic to infer the topic of a user conversation with a language model by analyzing packet sizes and timing produced by token by token streaming. Experimental results showed the technique is highly effective, with 17 of 28 tested models achieving over ninety eight percent accuracy and some exceeding ninety nine point nine percent, allowing attackers to identify one in ten thousand target conversations with near zero false positives. Suggested mitigations include random padding, token batching, and packet injection, and several providers have implemented measures that add random length text or parameters to mask token lengths; users are advised to avoid sensitive topics on untrusted networks, use VPNs, choose providers that have implemented mitigations, or use non streaming models.
Prompt Injection in AI Browsers

www.schneier.com · 8 months ago

A prompt injection attack called CometJacking exploits URL query parameters in the Perplexity Comet AI browser by embedding hidden instructions in the collection parameter that cause the agent to consult connected services instead of searching the web. Researchers demonstrated that CometJacking can access Google Calendar invites and Gmail messages and that the malicious prompt can instruct the agent to encode sensitive data in base64 and send it to an external endpoint without requiring credentials or user interaction. Perplexity did not treat the report as an issue and security commentary warns that current large language model agents cannot reliably distinguish trusted commands from untrusted data, making prompt injection a fundamental unresolved risk.
North Korean hackers exploit Google’s safety tools for remote wipe

www.csoonline.com · 8 months ago

Researchers at Genians Security Center found that North Korea linked KONNI APT actors abused Google’s Find Hub device tracing and management service to remotely track and wipe Android phones and tablets after compromising legitimate Google accounts. The attackers gained initial access through spear phishing that impersonated South Korea’s National Tax Service and by distributing malicious apps via KakaoTalk disguised as stress relief programs, then confirmed victims were outside via Find Hub location checks before issuing remote factory resets that silenced notifications and delayed detection. The campaign illustrates how trusted platform features can be weaponized to erase data and recommends real time verification, additional authentication for remote management features, and strict validation of files received through messaging apps.
CISO's Expert Guide To AI Supply Chain Attacks

thehackernews.com · 8 months ago

AI enabled supply chain attacks surged one hundred fifty six percent year over year, with attackers weaponizing open source repositories and incidents including NullBulge compromises of Hugging Face and GitHub, malicious versions of the Solana web3.js npm library, and hardcoded cloud credentials in Wondershare RepairIt enabling model replacement. AI generated malware is described as polymorphic, context aware, semantically camouflaged, and temporally evasive, which undermines static signature detection and contributes to longer breach discovery times averaging two hundred seventy six days. CISOs are urged to audit dependencies, enable commit signing, deploy behavioral and AI aware detection and runtime defenses, and prepare for regulatory requirements such as the EU AI Act, and the report also notes Cisco warnings of firewall exploits tracked as CVE-2025-20333 and CVE-2025-20362.
New Phishing Campaign Targets Meta Business Suite Users

gbhackers.com · 8 months ago

A large scale phishing campaign is abusing Facebook Business Suite and the facebookmail.com delivery feature to send highly convincing fake notifications that appear to come directly from Meta. Attackers create fake Facebook Business pages and use the Business invitation feature to distribute malicious links that redirect victims to phishing sites hosted on platforms like vercel.app, enabling credential and data theft. Over 40,000 phishing emails were sent to more than 5,000 customers across the United States, Europe, Canada, and Australia, primarily targeting small and medium sized businesses in industries such as automotive, education, real estate, hospitality, and finance.
Npm Package Targeting GitHub-Owned Repositories Flagged as Red Team Exercise

thehackernews.com · 8 months ago

Cybersecurity researchers discovered a malicious npm package named acitons artifact that typosquatted the legitimate actions artifact package and was uploaded on October 29, 2025; six malicious versions from 4.0.12 to 4.0.17 included a postinstall hook while the npm registry currently lists version 4.0.10, indicating the offending releases were removed. Analysis shows the package was designed to run during builds, exfiltrate tokens from the build environment, and use those tokens to publish malicious artifacts, with the postinstall script downloading an obfuscated shell binary called harness that contained a time check preventing execution after November 6, 2025, and invoking a JavaScript verifier that looked for GitHub Actions environment variables and wrote encrypted exfiltrated data to a file on a GitHub subdomain. The package accrued about 47,405 total downloads and roughly 31,398 weekly downloads, and investigators also identified another similarly functioning package that was downloaded about 1,016 times, consistent with a targeted campaign against repositories owned by GitHub and a likely test account.
Android Trojan 'Fantasy Hub' Malware Service Turns Telegram Into a Hub for Hackers

thehackernews.com · 8 months ago

A new Android remote access trojan called Fantasy Hub is being sold on Russian-speaking Telegram channels as a Malware-as-a-Service, offering buyers the ability to control infected devices and steal SMS messages, contacts, call logs, images, videos, and to intercept, reply to, and delete incoming notifications. The service includes a bot-driven subscription and builder that trojanizes uploaded APKs, creates fake Google Play update landing pages and overlays to steal banking credentials, and provides a command and control panel that lists compromised devices and issues data collection commands. Fantasy Hub abuses the default SMS handler by prompting victims to set it as the default SMS app to obtain multiple powerful permissions at once, and it integrates WebRTC-based live streaming of camera and microphone and native droppers to enable real-time espionage. Subscriptions are offered for two hundred dollars weekly, five hundred dollars per month, or four thousand five hundred dollars per year, and researchers warn this MaaS model poses a direct threat to bring your own device environments and mobile banking users.
Kimsuky APT Takes Over South Korean Androids, Abuses KakaoTalk

www.darkreading.com · 8 months ago

There is a campaign by the KONNI subset of DPRK-linked threat actors that uses compromised Google accounts to abuse Google Find Hub and remotely track and factory reset South Korean Android devices. Attackers time the wipes after confirming victims are away to block notifications, repeatedly issue resets to prolong disruption, then hijack the victim s logged-in KakaoTalk PC session to propagate a malicious installer named Stress Clear.msi that installs persistence and remote access tooling. The campaign relies on credential theft and PC malware coupled with social engineering against targeted humanitarian and activist personnel rather than exploiting a vulnerability in Android or Find Hub.
Senate moves to restore lapsed cybersecurity laws after shutdown

www.csoonline.com · 8 months ago

Two cybersecurity laws that lapsed during the government shutdown moved closer to restoration after the Senate voted 60 to 40 to advance a continuing resolution that temporarily extends the Cybersecurity Information Sharing Act of 2015 and the Federal Cybersecurity Enhancement Act through January 2026. The measure reinstates liability shields, antitrust exemptions, and Freedom of Information Act protections that enable voluntary sharing of cyber threat indicators and renews statutory authority for CISA to provide network security services such as the EINSTEIN intrusion detection system. The lapse that began on October 1 removed those legal protections, slowed threat intelligence exchanges, increased legal exposure for companies, and coincided with a nearly one third reduction in CISA staffing, while the short term extension creates another expiration in two months and leaves open whether Congress will pursue a full reauthorization.
Ferocious Kitten APT Uses MarkiRAT for Keystroke and Clipboard Surveillance

gbhackers.com · 8 months ago

Ferocious Kitten is a covert cyber espionage group active since at least 2015 that persistently targets Persian speaking dissidents and activists inside Iran. The group deploys a custom implant called MarkiRAT that records keystrokes and clipboard contents, captures screenshots, searches file systems and credential stores, steals credentials, executes remote commands, and stages exfiltration, typically delivered via spearphishing Microsoft Office documents with malicious macros or crafted MSHTML content. Operators have adopted known exploits including MSHTML remote code execution tracked as CVE-2021-40444 and have used persistence techniques that hijack Telegram or Chrome installations, modify shortcuts, abuse Windows utilities such as BITS, employ Right to Left Override tricks, and probe for installed security products to evade detection. Open source reporting and vendor analyses align on a collection focused objective rather than disruptive actions and provide indicators of compromise and mitigation recommendations for defenders.
AI startups leak sensitive credentials on GitHub, exposing models and training data

www.csoonline.com · 8 months ago

New research from cloud security firm Wiz found verified secret leaks in 65 percent of the Forbes AI 50 companies, representing a combined valuation of more than 400 billion dollars, with API keys and access tokens exposed on GitHub. Some leaked credentials belonged to platforms including Hugging Face, Weights and Biases, and LangChain and were often buried in deleted forks, gists, and developer repositories that many scanners do not reach. Nearly half of disclosure attempts failed to reach affected companies or received no response, and experts warn that exposed credentials could grant access to private models and training data, enable model manipulation or theft of sensitive customer data, and underscore an urgent need for stronger secret management and DevSecOps practices.
Öffentliche Verwaltung im Visier von Cyberspionen

www.csoonline.com · 8 months ago

The Bundesamt für Sicherheit in der Informationstechnik reports that cyberspies are currently concentrating on public administration in Germany, with notable victims also in defense, the judiciary and public safety, based on incidents between July 1, 2024 and June 30, 2025. International law enforcement disrupted ransomware as a service operations by LockBit and Alphv, but the BSI warns of a large dark field of unreported attacks and that many small and medium enterprises and politically related institutions still neglect basic preventive measures. Phishing has risen sharply, including fake retailer websites, manipulated QR codes at public payment points that redirect victims to fraudulent payment pages, and increasing vishing where attackers impersonate IT support to gain network access. Nearly 10,500 consumer inquiries reached the BSI service center in one year with almost half reporting concrete incidents, most often phishing, account misuse and identity theft, while experts warn Germany is poorly prepared for a widespread cyberattack and call for greater investment and more independent open source based infrastructure.
Attackers Use Quantum Route Redirect to Launch Instant Phishing on M365

gbhackers.com · 8 months ago

There is a new phishing automation platform called Quantum Route Redirect that streamlines Microsoft 365 credential theft by automatically routing bots and scanners to benign pages while directing human victims to credential harvesting sites. The platform includes bot detection, browser fingerprinting, VPN and proxy checks, an admin dashboard with analytics, and comes as a preconfigured kit deployed across roughly one thousand domains first observed in attacks since August. Campaigns use diverse lures such as DocuSign and payroll impersonation, payment notifications, missed voicemail messages and QR code phishing to funnel victims to the same harvest sites. Organizations are advised to combine robust URL filtering, domain and impersonation detection, natural language based content analysis, and modern cloud email security to detect and block these automated phishing operations.
Devolutions Server Flaw Allows Attackers to Impersonate Users via Pre-MFA Cookie

gbhackers.com · 8 months ago

A critical vulnerability was found in Devolutions Server that allows low privileged authenticated users to impersonate other accounts by replaying pre MFA cookies. Designated CVE 2025 12485, the flaw carries a CVSS score of 9.4 and affects all versions up to 2025.3.5. Devolutions has released patches addressing this issue and a second vulnerability. Administrators are urged to apply the updates promptly.
New VanHelsing Ransomware-as-a-Service Hits Windows, Linux, BSD, ARM and ESXi

gbhackers.com · 8 months ago

A sophisticated Ransomware as a Service operation named VanHelsing launched on March 7, 2025 and within weeks infected at least three victims with ransom demands reported as high as five hundred thousand dollars in Bitcoin. It targets multiple architectures including Windows, Linux, BSD, ARM and ESXi, is written in C plus plus, and uses ChaCha20 for file encryption with per file keys wrapped by Curve25519, appending the vanhelsing extension, changing desktop wallpaper and dropping a README text ransom note. The operation is offered to affiliates through a revenue sharing model that requires new affiliates to post a five thousand dollar deposit while established affiliates can join for free and affiliates receive eighty percent of ransom payments versus twenty percent for the operators. Operators practice double extortion by stealing data before encryption and storing stolen files on operator servers, and the malware includes stealth and command line options to tailor encryption targets and to spread via SMB, increasing its risk to enterprise environments.
WatchGuard Firebox Flaw Allows Attackers to Gain Unauthorized SSH Access

gbhackers.com · 8 months ago

A default configuration in WatchGuard Firebox devices through September 10, 2025 allows administrative SSH access on port 4118 using the built in admin readwrite password, enabling unauthenticated attackers with network access to gain full administrative control and is tracked as CVE-2025-59396. Exploitation can expose ARP tables, network configurations, user accounts, feature keys, and device location data, and can allow attackers to modify or disable firewall rules, perform lateral movement, exfiltrate data, or disrupt services. Immediate mitigations include changing the default admin password, disabling or restricting SSH on port 4118 to trusted management IP addresses, enabling multi factor authentication where available, and auditing devices configured before September 10, 2025. Organizations should monitor for unauthorized SSH connections on port 4118, follow vendor advisories, and apply configuration changes or firmware updates as they become available.
Researchers Expose Deep Connections Between Maverick and Coyote Banking Malware

gbhackers.com · 8 months ago

There are critical connections between two Brazilian focused banking trojans, Maverick and Coyote, with researchers identifying overlapping code, infrastructure, and victimology that suggest code reuse or an evolutionary relationship. There are WhatsApp based campaigns that deliver ZIP attachments containing malicious LNK files which spawn PowerShell to load a multi stage, largely in memory.NET trojan that monitors dozens of Brazilian banks and several cryptocurrency exchanges, captures credentials via overlays and keylogging, and leverages browser automation to hijack WhatsApp Web and self propagate. There are recommendations to block suspicious file downloads and PowerShell executions and to educate users about malicious messaging attachments, while vendor telemetry reports tens of thousands of blocked infection attempts in Brazil during the campaign.
65% of Top AI Firms Found Exposing Verified API Keys and Tokens on GitHub

gbhackers.com · 8 months ago

There are verified findings that 65 percent of Forbes AI 50 companies leaked secrets on GitHub after deeper scans of commit history, deleted forks, gists, workflow logs and contributors' repositories. The exposed items included API keys, authentication tokens and credentials such as WeightsAndBiases, ElevenLabs and HuggingFace keys that could expose private training data, private models or organizational information. Disclosure efforts were uneven, with nearly half of reports failing to reach or be answered by target organizations, although some firms including LangChain and ElevenLabs remediated leaked keys promptly. Researchers urge mandatory public VCS secret scanning, clear external disclosure channels and custom scanners for AI-specific secret types to reduce systemic risk across AI startups.