Blahalla

Cybercriminals turn on each other: the story of Lumma Stealer’s collapse

www.fortra.com · 9 months ago

There has been a collapse of Lumma Stealer after rival cyber criminals publicly doxxed its developers, publishing names, passport scans, bank account details and social media profiles and compromising its Telegram channels. Known since 2022 as a malware as a service and also called Water Kurita and Storm 2477, Lumma was widely sold on forums and Telegram and used to harvest browser stored passwords, cryptocurrency wallet data and other sensitive information and was observed being deployed by ransomware groups. Activity and customer trust fell sharply, with infections dropping and displaced users moving to competing malware services that are advertising comparisons and flaws. Security analysts warn the broader threat remains and recommend multi factor authentication, password managers and layered defenses to protect against stolen credentials.
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files

thehackernews.com · 9 months ago

There is a coordinated spear phishing campaign called PhantomCaptcha that on October 8, 2025 targeted individuals at Ukraine war relief organizations and regional administrations, including members of the International Red Cross, the Norwegian Refugee Council, the UNICEF Ukraine office, the Council of Europe Register of Damage for Ukraine, and regional governments in Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk. Attackers used booby trapped PDF attachments that redirected victims to a fake videoconferencing site and a counterfeit browser check page to trick targets into pasting and executing a malicious PowerShell command. The PowerShell downloader retrieved a second stage payload that deployed a WebSocket based remote access trojan hosted on foreign infrastructure, enabling arbitrary command execution, data exfiltration, and further malware deployment, with preparatory infrastructure first registered on March 27, 2025 and some user facing domains active only briefly on October 8. The campaign also included fake Android applications designed to harvest device data, showed overlaps with ClickFix techniques, and has not been conclusively attributed to a known threat actor.
Top security researcher shares their bug bounty process

github.blog · 9 months ago

There is a GitHub Bug Bounty researcher spotlight published October 22, 2025, highlighting researcher @dev-bio and GitHub’s emphasis on securing its platform and emerging AI features through collaboration with the security research community. GitHub’s Bug Bounty Program is described as a cornerstone of platform security and the post describes a VIP bounty program that gives selected researchers early previews of beta products, direct engagement with bounty staff and engineers, and exclusive swag. The featured researcher, who works professionally in software supply chain security, favors hunting injection-related vulnerabilities, subtle logical flaws, and novel content security policy bypass techniques, and prefers building custom tooling and offline graphs to find misconfigurations and hidden attack paths. The researcher advises digging deeper into findings to map potential attack paths and submitting thorough, well-documented reports to help accelerate impact assessment and remediation.
FinWise data breach shows why encryption is your last defense

www.bleepingcomputer.com · 9 months ago

There was a 2024 FinWise data breach in which a former employee using retained credentials accessed systems on May 31, 2024 and leaked personal information for 689,000 customers of American First Finance, with the unauthorized access going undetected until June 18, 2025. Investigations and lawsuits allege the stolen data may not have been adequately encrypted and secured, and the incident reflects failures in security governance and detection of abnormal access. Security experts say encryption is a last line of defense and that robust key management, granular access control, centralized logging, and proactive detection are required to mitigate insider threats. Penta Security positions its D.AMO platform as a comprehensive solution combining encryption, independent key management, and centralized control to render exposed data unusable even if databases are accessed.
TARmageddon Flaw in Popular Rust Library Leads to RCE

www.securityweek.com · 9 months ago

A high severity vulnerability in the Rust library Async-tar, tracked as CVE-2025-62518 with a CVSS score of 8.1 and dubbed TARmageddon, is a desynchronization bug when parsing nested TAR files caused by a mismatch between PAX and ustar headers that can allow attackers to smuggle archive entries and achieve remote code execution. Successful exploitation can overwrite files, replace configuration files, enable remote code execution and be leveraged in supply chain attacks, and the upstream libraries Async-tar and its popular fork Tokio-tar are abandoned, complicating patch deployment despite Tokio-tar having more than five million downloads and use in many downstream projects. Fixes have been rolled out for some forks such as Astral tokio tar and Krata tokio tar and users are advised to switch to patched libraries or modify TAR parsers to prioritize PAX headers for size determination, validate header consistency and add strict boundary checking to prevent header confusion.
Ransomware gang steals meeting videos, financial secrets from fence wholesaler

therecord.media · 9 months ago

Jewett-Cameron Trading reported to the Securities and Exchange Commission that hackers breached its IT systems on October 15, encrypted parts of internal systems, installed monitoring software, and exfiltrated images of video meetings and nonpublic financial documents. The attackers threatened to publicly release the meeting images unless paid, and the company said the stolen financial data included information being prepared for its annual 10 K report due in mid November. Law enforcement and cybersecurity experts were engaged, the company says the incident has been contained while recovery proceeds, most recovery costs will be covered by cyber insurance, and the breach is expected to materially impact results for the first quarter of fiscal 2026.
Russia Pivots, Cracks Down on Resident Hackers

www.darkreading.com · 9 months ago

Russia is partially cracking down on its cybercriminal underground, reversing a long standing practice of tolerating hackers who avoid domestic targets. Western law enforcement actions, notably Operation Endgame launched in May 2024, and improving cybersecurity have raised the diplomatic cost of safe harbor and preceded raids and arrests, including nearly 100 suspects tied to Cryptex and UAPS in October 2024 and executives linked to the Aeza Group in April 2025. Authorities appear to be pursuing a dual track that penalizes lower level actors involved in money laundering and similar services while protecting higher value groups useful to state intelligence, a shift that is changing underground market behavior and increasing attacks against Russian organizations.
From Path Traversal to Supply Chain Compromise: Breaking MCP Server Hosting

www.reddit.com · 9 months ago

There was a path traversal vulnerability in Smithery.ai’s Docker build configuration that allowed a build context outside the repository to be included, enabling attacker controlled Dockerfiles to read and exfiltrate files from the build host. Attackers recovered a fly.io authentication token from the exposed Docker configuration which was overprivileged and granted access to an organization with more than three thousand apps, allowing arbitrary code execution on hosted MCP servers. Thousands of API keys and secrets across hosted MCP servers were exposed, creating risks including prompt injection into LLMs and wide supply chain compromise. The issue was responsibly disclosed and patched and no evidence of exploitation was found.
Critical Vulnerabilities Patched in TP-Link’s Omada Gateways

www.securityweek.com · 9 months ago

TP-Link warns that more than a dozen Omada gateway models in its ER, G and FR series are affected by four vulnerabilities and has released firmware patches. The most severe flaw is CVE-2025-6542 with a CVSS score of 9.3 and it permits remote unauthenticated OS command execution that can allow full device takeover. Another critical issue is CVE-2025-7850, a command injection exploitable by an attacker with admin access to the web portal, while the remaining high severity flaws are CVE-2025-7851 which can yield root access and CVE-2025-6541 which allows OS command execution by an authenticated user. Customers are advised to update device firmware and change passwords.
PhantomCaptcha ClickFix attack targets Ukraine war relief orgs

www.bleepingcomputer.com · 9 months ago

A one day spearphishing campaign on October 8, 2025, called PhantomCaptcha targeted members of the Ukrainian regional government and organizations supporting the war relief effort, including the International Committee of the Red Cross and UNICEF. Attackers sent emails with malicious PDF attachments linking to fake Zoom pages that displayed a Cloudflare style CAPTCHA instructing victims in Ukrainian to copy a token into the Windows Command Prompt, which executed a PowerShell command to download a reconnaissance script and then a lightweight WebSocket remote access trojan capable of remote command execution and data exfiltration. Researchers at SentinelLabs reported the campaign began and ended on October 8, that some infrastructure had been registered months earlier, and that the operation was linked to a subsequent Lviv targeted campaign distributing adult themed Android spyware while Google Threat Intelligence highlighted similar CAPTCHA techniques tied to the ColdRiver group.
Threat Actors Advancing Email Phishing Attacks to Bypass Security Filters

gbhackers.com · 9 months ago

There are tried and true phishing methods such as password protected attachments and unsolicited calendar invites being revived while attackers layer on advanced evasions. Adversaries are embedding QR codes in images and PDFs, chaining multi stage verification flows and live API redirects, and using adversary in the middle techniques to harvest credentials, bypass multifactor authentication, and steal session tokens. These refinements are enabling campaigns to slip past automated filters and human scrutiny, prompting defenders to improve QR code extraction, image processing, and multi layer detection.
MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor

www.darkreading.com · 9 months ago

There are more than 100 government related organizations across the Middle East and North Africa being targeted by the Iran backed group MuddyWater in a campaign that began on August 19, 2025. Attackers used a compromised mailbox accessed through NordVPN to send phishing Microsoft Word documents that prompt recipients to enable macros, which execute VBA droppers. The campaign uses a FakeUpdate injector that AES decrypts and injects a second stage, ultimately deploying version 4 of the Phoenix backdoor which creates a mutex named sysprocupdate.exe, copies itself into ProgramData, modifies the Windows Registry for persistence, and communicates with command and control over WinHTTP. Recommended mitigations include subscribing to threat intelligence, continuous threat hunting, sandboxing and scanning Office attachments, disabling macros by default or allowing only signed macros, deploying and tuning EDR and XDR to detect process injection and registry changes, and enforcing multi factor authentication.
Fileless Remcos Attacks: Injecting Malicious Code into RMClient to Evade EDR

gbhackers.com · 9 months ago

There was a significant surge in Remcos remote control and surveillance campaigns in September and October 2025 that used sophisticated fileless techniques to evade endpoint detection and response solutions. Attackers employed highly obfuscated PowerShell scripts and process hollowing into the Microsoft RMClient executable to inject malicious code and achieve stealthy persistence. The campaigns targeted browser credentials and relied on RMClient injection to maintain a covert foothold on compromised systems.
'PhantomCaptcha' hackers impersonate Ukrainian president’s office in attack on war relief workers

therecord.media · 9 months ago

A spearphishing campaign tracked as PhantomCaptcha targeted members of the International Committee of the Red Cross, the Norwegian Refugee Council, UNICEF, other NGOs, and Ukrainian regional administrations on October 8, 2025. Attackers sent convincing eight page weaponized PDFs that redirected victims to a domain posing as a Cloudflare DDoS protection gateway and either to a genuine password protected Zoom meeting or into a clipboard paste and run PowerShell token trick that executes malicious code when users paste it into the Windows run dialog. Researchers found six months of preparation before the single day of public activity, backend command and control infrastructure that remained active afterward, and the registration of a similar domain the following day indicating potential follow on operations. Analysis also linked related activity to a separate cluster using adult oriented social lures and noted potential ties to Russia or Belarus while stopping short of definitive attribution.
Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch

thehackernews.com · 9 months ago

There are reports that threat actors tied to China exploited the ToolShell vulnerability in on premise Microsoft SharePoint to breach a telecommunications company in the Middle East and to target government departments in Africa, government agencies in South America, a university in the United States, a state technology agency in Africa, a government department in the Middle East, and a finance company in Europe. The activity involved exploitation of CVE-2025-53770, a now patched SharePoint flaw that can bypass authentication and enable remote code execution, with CVE-2025-53770 assessed as a patch bypass for CVE-2025-49704 and CVE-2025-49706, and some incidents also used CVE-2021-36942 for privilege escalation. Multiple China linked groups including Linen Typhoon also known as Budworm, Violet Typhoon also known as Sheathminer, Storm 2603, and Salt Typhoon also known as Glowworm weaponized the flaw to deploy tools such as Zingdoor, ShadowPad, and KrustyLoader, and to deliver ransomware families including Warlock, LockBit, and Babuk while seeking credentials and persistent access, with exploitation observed weeks after Microsoft patched the vulnerability in July 2025.
Jaguar Land Rover cyberattack cost $2.5 billion, says monitoring group

therecord.media · 9 months ago

A cyberattack on Jaguar Land Rover in late August 2025 halted production for more than a month and is estimated to have cost the British economy about 1.9 billion pounds or 2.5 billion US dollars, affecting over five thousand organizations. The nonprofit Cyber Monitoring Centre described the incident as the most economically damaging cyber event to hit the United Kingdom, saying most losses came from lost manufacturing output across JLR and its multi tier supply chain and classifying it as a category three systemic event. The disruption prompted government intervention including a 1.5 billion pound loan guarantee and a JLR financing scheme to provide upfront cash to suppliers, with phased production restarts and recovery extending into early 2026.
Threat Actors Exploiting Azure Blob Storage to Breach Organizational Repositories

gbhackers.com · 9 months ago

Threat actors are increasingly exploiting Azure Blob Storage to breach organizational repositories and disrupt critical workloads by enumerating exposed containers, harvesting storage account keys, SAS tokens, and Entra ID credentials, and leveraging public or misconfigured endpoints for initial access. Attackers host phishing pages and malicious payloads in containers, abuse blob-triggered services and automation such as Azure Functions and Logic Apps to execute code, and establish persistence by creating broadly scoped SAS tokens, assigning elevated roles, or provisioning SFTP accounts while evading detection by altering networking and logging configurations. Once inside, they exfiltrate or manipulate data at scale using tools like AzCopy and Azure Storage Explorer, expose blobs via static website hosting, use metadata and replication for covert command and control and distribution, and can delete, overwrite, or re-encrypt data to achieve destructive or extortionate impact.
Cryptographic Issues in Cloudflare's Circl FourQ Implementation (CVE-2025-8556)

www.reddit.com · 9 months ago

There are multiple cryptographic flaws in Cloudflare's CIRCL implementation of the FourQ elliptic curve that enable invalid point and degenerate curve attacks capable of leaking secret scalars. The implementation exhibited incorrect point validation in Point.Unmarshal where conjugated x values were not revalidated, a faulty point equality check that can return true when a projected coordinate is zero, failure to verify results after cofactor clearing, and scalar multiplication code that assumes projected coordinates are valid. These issues were reported in March 2025, were acknowledged and fixed after Cloudflare intervened, and are tracked as CVE-2025-8556.
Smart beds flipped out during the AWS outage, and so did their sleepy owners

www.washingtonpost.com · 9 months ago

There was an Amazon Web Services outage that caused internet enabled mattresses from Eight Sleep to malfunction, with users reporting beds locked upright, runaway temperatures, flashing lights, and unexpected wake up alarms. Eight Sleep's chief executive apologized and said engineers are racing to build an outage proof mode while most devices returned to function but some still experienced data processing delays. Amazon said the outage was caused by a DNS issue, underscoring risks of relying on cloud servers for device controls that manage temperatures between fifty five and one hundred ten degrees, adjust bed incline, and require a paid subscription for temperature controls.
Google ‘Careers’ scam lands job seekers in credential traps

www.csoonline.com · 9 months ago

Scammers are impersonating the Google Careers team to target job seekers with messages asking if they are open to talk and directing them through a fake booking flow that ends on a spoofed Google login page to harvest account credentials and gain access to email, files, and cloud data. The campaign uses multilingual messages, varied sender addresses that mimic recruiting services, newly registered domains, and HTML evasion techniques that break up the words Google Careers to slip past text scanners. Attackers have abused legitimate delivery services and insert a spoofed human verification step using a real or impersonated Cloudflare Turnstile before redirecting victims to dynamic phishing pages that communicate with backend scripts, command and control servers, and many landing domains and WebSocket endpoints. Recommended defenses include enforcing strong multi factor authentication, adopting identity first defenses, monitoring for unusual login patterns and geographies, and training people to treat unsolicited recruiter invitations with skepticism.
SharkStealer Adopts EtherHiding Technique for C2 Communication Evasion

gbhackers.com · 9 months ago

SharkStealer is a Golang based information stealer that leverages the Binance Smart Chain Testnet as a covert dead drop for command and control communications. Using an EtherHiding pattern, the malware retrieves encrypted C2 details from smart contracts via Ethereum RPC calls, then decrypts the payload in memory. The decrypted data is used to initiate contact with operators while the activity blends in with legitimate blockchain traffic.
‘I am not a robot’: Russian hackers use fake CAPTCHA lures to deploy espionage tools

www.csoonline.com · 9 months ago

There are Russian state backed hackers using fake I am not a robot CAPTCHA pages to deliver new espionage malware against Western governments, think tanks, media organizations, NGOs, dissidents, policy advisors, and academic targets. The ColdRiver group, also known as Star Blizzard, UNC4057, or Callisto, has replaced the exposed LostKeys toolkit with modular families named NOROBOT, YESROBOT, and MAYBEROBOT that use multi stage delivery chains, encrypted payloads, and split cryptographic keys to evade detection. YESROBOT is described as a minimal Python backdoor that requires valid Python commands, while NOROBOT variants have ranged from complex key recombination schemes to simplified fetchers that install persistent logon scripts, with development activity observed from May through September 2025. Defenders are advised to adopt behavior and context aware monitoring, endpoint and network detection, zero trust and least privilege controls, continuous patching, and simulated interactive phishing exercises to detect and contain these user assisted intrusions.
Russian APT Switches to New Backdoor After Malware Exposed by Researchers

www.securityweek.com · 9 months ago

After public reporting in June on the LostKeys malware, the Russian state sponsored APT known as Star Blizzard, also tracked as Callisto, ColdRiver, Seaborgium and UNC4057, abandoned LostKeys and moved to a rundll32 deployed DLL backdoor named NoRobot, also known as BaitSwitch, to retrieve follow on payloads. NoRobot initially fetched a Python backdoor called YesRobot but was replaced by a minimally featured PowerShell backdoor named MaybeRobot, also tracked as SimpleFix, which supports three operator supplied commands to execute files, run commands and execute PowerShell blocks. Between May and September 2025 the group simplified its infection chain, shifted from a PowerShell first stage to victim executed rundll32 commands delivered via ClickFix style pages impersonating civil society and think tank resources, and applied basic evasion techniques including rotating infrastructure, changing file and path naming, and altering DLL export and file names.
Hackers Exploit Microsoft 365 Direct Send to Evade Filters and Steal Data

gbhackers.com · 9 months ago

There is a phishing campaign abusing Microsoft 365 Exchange Online Direct Send to deliver unauthenticated emails that appear to originate from inside a tenant, allowing attackers to bypass SPF, DKIM and DMARC and deliver convincing voicemail and fax styled messages with PDF QR codes that harvest credentials. The technique requires only the target domain and valid recipient addresses and has been observed against more than seventy organizations, with attackers using PowerShell and external IPs to relay mail through tenant smart hosts. Recommended defenses include enabling the Reject Direct Send control or disabling Direct Send if unused, enforcing strict SPF DKIM and DMARC policies, restricting partner inbound connectors by IP or certificate, hardening Exchange Online Protection and Defender for Office 365, and training users to treat QR code attachments with suspicion.
Bridging the Remediation Gap: Introducing Pentera Resolve

thehackernews.com · 9 months ago

There is a persistent remediation gap where vulnerability scanners, XDR, CSPM, SIEM, and CMDB tools surface the same issues with different severity, metadata, and context, leaving security teams to manually consolidate, prioritize, and assign fixes. Pentera is introducing Pentera Resolve to operationalize validated risk by turning security validation findings into automated remediation workflows, using AI to triage, prioritize, assign ownership, enrich issues with business and asset context, push tickets into ServiceNow, Jira, and Slack, and maintain audit ready proof of fix. The platform will trigger re tests to verify remediation and aims to make remediation continuous, measurable, and accountable across security, IT, and compliance teams.
Fake Nethereum NuGet Package Used Homoglyph Trick to Steal Crypto Wallet Keys

thehackernews.com · 9 months ago

Security researchers uncovered a supply chain attack on the NuGet package manager using malicious typosquats impersonating Nethereum to steal cryptocurrency wallet keys. A package named Netherеum.All substituted the final letter e with a Cyrillic homoglyph and contained code that decodes an XOR encoded string to extract a command and control endpoint and exfiltrate mnemonic phrases, private keys, and keystore data. The fake package was uploaded on October 16, 2025, artificially inflated download counts to appear popular, and was removed four days later, and a similar package named NethereumNet with the same behavior was uploaded earlier in the month. Users are advised to verify publisher identity, watch for sudden download surges, and monitor for anomalous network traffic to mitigate such attacks.
Hackers Use ASP.NET Machine Keys to Break Into IIS, Push Malicious Extensions

gbhackers.com · 9 months ago

A large scale campaign tracked as REF3927 is exploiting misconfigured IIS servers that reuse publicly exposed ASP.NET machine keys to forge ViewState payloads and achieve remote code execution. After initial access the actors deployed Godzilla derived webshells, used the GotoHTTP remote monitoring tool, loaded a modified Hidden rootkit, and installed a malicious IIS module named TOLLBOOTH that provides SEO cloaking, traffic hijacking, and a built in webshell. The intrusion was investigated in partnership with Texas A M University System Cybersecurity and Elastic Security Labs, impacted organizations worldwide, and defenders are advised to regenerate and securely manage machine keys and monitor for forged ViewState activity.
Fencing and Pet Company Jewett-Cameron Hit by Ransomware

www.securityweek.com · 9 months ago

Jewett Cameron Company, an Oregon based maker of kennels, crates and fencing, detected an intrusion into its IT environment on October 15, 2025 and disclosed the incident in a Securities and Exchange Commission filing. Investigators say attackers deployed encryption and monitoring software, disrupted access to some business applications, and exfiltrated images of video meetings and computer screens plus IT and financial data the company had been preparing for its annual Form 10 K. Threat actors are demanding a ransom and threatening to publish the stolen information unless paid, and the company reports no evidence so far that personal data of employees, customers, vendors or suppliers was compromised, believes the intrusion has been contained, and expects incident response costs to be covered by its cyber insurance while it works to restore impacted systems.
Ransomware-Attacke auf Nickelhütte Aue

www.csoonline.com · 9 months ago

Cybercriminals attacked the office IT of Nickelhütte Aue and encrypted data, causing disruptions to IT systems and affecting records in human resources, accounting, finance, procurement and sales. The attack was discovered on Saturday, October 18, 2025, and company leadership immediately set up a crisis organization while reporting that production was not impacted. The attackers left a ransom note threatening to publish stolen data, investigators and IT forensics teams are still working, and the company cannot rule out that customer data was exfiltrated. Nickelhütte Aue employs about 500 people, specializes in recycling nonferrous metals, and is currently cleaning infected devices while the timeline for full recovery remains unclear.
Sharepoint ToolShell attacks targeted orgs across four continents

www.bleepingcomputer.com · 9 months ago

There are attacks leveraging the ToolShell vulnerability in on premise Microsoft SharePoint tracked as CVE 2025 53770 that have targeted government agencies, universities, telecommunications providers, and finance organizations across four continents. ToolShell acts as a bypass for CVE 2025 49706 and CVE 2025 49704 and was disclosed as an actively exploited zero day, prompting Microsoft to issue emergency updates. Attack chains began with webshell deployment via CVE 2025 53770, followed by DLL side loading of a Go based backdoor named Zingdoor, deployment of ShadowPad and a Rust based KrustyLoader, and eventual use of the Sliver post exploitation framework, with side loading using legitimate Trend Micro and BitDefender executables. Operators performed credential dumping with ProcDump Minidump and LsassDumper and leveraged PetitPotam tracked as CVE 2021 36942 for domain compromise while relying on living off the land tools for reconnaissance and exfiltration.
Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive Data

gbhackers.com · 9 months ago

There is a campaign by the Bitter APT, tracked as APT Q 37, that uses malicious Office macros and a WinRAR path traversal exploit to deliver a C sharp backdoor and siphon sensitive information. One method uses VBA macros in xlam files to write, compile and install C sharp source code with the system dot NET compiler and InstallUtil, while another packs a Document docx and Normal dotm inside a crafted RAR that leverages alternate data streams and path traversal to overwrite a user template so Word loads macros that fetch and execute a remote backdoor. Although CVE 2025 8088 was initially considered, testing showed the archive achieved traversal on WinRAR 7.11 but not 7.12, indicating an earlier WinRAR flaw, and defenders are urged to avoid opening unsolicited attachments, update WinRAR and other software, scan for unexpected files in temporary and startup locations, and investigate file hashes and network indicators provided by threat intelligence.
We uploaded a fake video to 8 social apps. Only one told users it wasn’t real.

www.washingtonpost.com · 9 months ago

Tests using an OpenAI Sora generated video found that eight major social platforms stripped tamperproof Content Credentials metadata that would disclose whether a clip was AI generated. Only one platform added any user facing note and that was YouTube which placed a label reading altered or synthetic content in the video description where it is not immediately visible. The voluntary Content Credentials standard was created by a coalition including major tech companies and news organizations to embed provenance metadata, but it is not being broadly implemented for video by platforms such as Meta, TikTok and LinkedIn. OpenAI says Sora adds Content Credentials metadata, watermarks and internal authenticity markers, but watermarks can be removed or omitted in some distribution options and the detection tools are not publicly available.
Oracle Releases October 2025 Patches

www.securityweek.com · 9 months ago

Oracle released a Critical Patch Update on October 21, 2025 that contains 374 security patches addressing 170 unique CVEs across 29 product families, including 40 critical patches. The fixes are concentrated in products such as Oracle TimesTen In Memory Database and Oracle Spatial Studio, and the update also closes multiple E Business Suite zero day flaws that were being actively exploited, including CVE-2025-61882 and CVE-2025-61884. Security vendors and government agencies warned that many patched vulnerabilities can be exploited remotely without authentication and urged organizations to apply the updates and monitor internet facing E Business Suite deployments immediately.
Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign

unit42.paloaltonetworks.com · 9 months ago

There is a cloud based gift card fraud campaign called Jingle Thief attributed to financially motivated Morocco based actors tracked as cluster CL CRI 1032 and assessed to overlap with Atlas Lion and STORM 0539. The actors use tailored phishing and SMS based smishing delivered often via self hosted PHP mailer scripts and deceptive URLs to harvest Microsoft 365 credentials and then mine SharePoint, OneDrive, Exchange and Entra ID for gift card issuance workflows. After initial access they expand via internal phishing, create inbox forwarding rules, move messages to deleted items, and register rogue authenticator apps and devices to bypass multifactor authentication, maintaining persistent access that has lasted up to about a year and compromised dozens of accounts. The campaign aligns with holiday seasons, peaked in a coordinated wave in April and May 2025, and issues high value gift cards that are resold on gray market forums for rapid monetization.
Verizon: Mobile Blindspot Leads to Needless Data Breaches

www.darkreading.com · 9 months ago

Verizon Business data from its 2025 Mobile Security Index shows that mobile cybersecurity is widely neglected by employees and organizations, making smishing more effective than email phishing. Eighty percent of organizations reported attempted smishing attacks, and smishing test failure rates are high, with two in five companies seeing between one quarter and one half of employees fail and nine percent reporting more than half failing. Seventy percent of reported mobile cyberattacks affected personal phones, reflecting that employers issue far fewer work phones and that work devices are exposed outside controlled environments. Organizations that adopt a set of eight mobile security best practices, including risk analysis, zero trust, and mobile device management, are about half as likely to experience breach related downtime and less than one fifth as likely to suffer major repercussions compared with those without all eight.
Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware

thehackernews.com · 9 months ago

There is a cyber espionage campaign called PassiveNeuron targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. Kaspersky first flagged activity in November 2024 and observed fresh infections from December 2024 through August 2025 that used two bespoke malware families named Neursite and NeuralExecutor and leveraged already compromised internal servers as intermediate command and control infrastructure. Attackers gained initial remote command execution on Windows servers via Microsoft SQL possibly through brute force, SQL injection, or an unknown vulnerability, attempted to deploy an ASPX web shell, and then delivered DLL loaders in the System32 directory to install Neursite, NeuralExecutor, and Cobalt Strike. Neursite is a modular C plus plus backdoor that gathers system information, manages processes, proxies traffic and fetches plugins, while NeuralExecutor is a dot NET implant that retrieves and executes additional payloads over TCP, HTTP, named pipes or WebSockets and has been observed using a GitHub based dead drop resolver to obtain C2 addresses.
Vidar Stealer Exploits: Direct Memory Attacks Used to Capture Browser Credentials

gbhackers.com · 9 months ago

On October 6, 2025, a cybercriminal developer known as Loadbaks released Vidar Stealer version 2.0 on underground forums. The new stealer employs direct memory injection techniques to capture browser credentials and bypass modern browser security protections. Version 2.0 is a complete architectural overhaul, rewritten from C++ into a pure C implementation that the developer claims enhances stealth and effectiveness. The redesigned malware combines in memory attacks with updated code to more effectively harvest sensitive information.
Hackers Earn Over $520,000 on First Day of Pwn2Own Ireland 2025

www.securityweek.com · 9 months ago

There are 34 previously unknown vulnerabilities exploited on the first day of Pwn2Own Ireland 2025, allowing researchers to hack printers, network attached storage devices, routers, and smart home products and earning participants a total of five hundred twenty two thousand five hundred dollars. The largest payout of one hundred thousand dollars was awarded for a chained exploit against a QNAP Qhora 322 router and a QNAP TS 453E NAS, while fifty thousand dollar awards included an exploit of a Synology ActiveProtect Appliance DP320 and a Sonos Era 300 smart speaker. Other awards included forty thousand dollar prizes for additional Synology and QNAP NAS exploits, multiple rewards for Home Assistant Green and Philips Hue Bridge vulnerabilities, and smaller payouts for Canon and HP printer hacks. The event will continue with a scheduled attempt at a zero click remote code execution exploit against WhatsApp for a one million dollar prize.
Salesforce’s glaring Dreamforce omission: Vital security lessons from Salesloft Drift

www.csoonline.com · 9 months ago

At Dreamforce Salesforce emphasized shared responsibility for securing Salesforce environments and AI agents and announced two new agents aimed at CISOs for security and privacy. Recent incidents show attackers obtained Salesforce OAuth tokens from third party AI chat tools and malicious connected apps to systematically export data from hundreds of instances, reportedly affecting around 700 to 760 organizations and up to 1.5 billion records and prompting more than 70 lawsuits. Security experts say OAuth integrations create a systemic supply chain blind spot because stolen tokens can bypass multifactor protections, and they recommend controls such as inbound IP restrictions, proof of possession or mutual TLS, tighter vendor management, and supply chain breach exercises as AI integrations increase risk.
TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution

thehackernews.com · 9 months ago

A high severity vulnerability codenamed TARmageddon affects the async-tar Rust library and its forks including tokio-tar and can enable remote code execution under certain conditions. The flaw is tracked as CVE-2025-62518 with a CVSS score of 8.1 and was discovered by Edera in late August 2025, impacting projects such as testcontainers and wasmCloud. The root cause is inconsistent handling of PAX extended headers and ustar headers that lets an attacker smuggle nested archives and overwrite files during extraction, enabling attacks such as hijacking build backends. Because tokio-tar appears unmaintained, users are advised to migrate to astral-tokio-tar and upgrade to version 0.5.6 which includes a fix.
CAASM and EASM: Top 12 attack surface discovery and management tools

www.csoonline.com · 9 months ago

Cyber asset attack surface management and external attack surface management solutions are designed to quantify and continuously monitor internet facing and shadow assets so organizations can minimize exposed information and harden configurations against attackers. Assets are defined as IP addresses or domains plus their technology stacks, and vulnerabilities result from misconfigurations or unpatched software that these tools detect, prioritize, and help remediate. The market offers a range of commercial products that provide automated asset inventories, contextual prioritization, continuous monitoring, validation and integration with existing security stacks, including Axonius, Bugcrowd with its Informer acquisition, CrowdStrike Falcon Exposure Management, CyCognito, JupiterOne, Microsoft Defender External Attack Surface Management, Outpost24, Palo Alto Networks Cortex Xpanse, Rapid7 Surface Command, RiskProfiler, SOCRadar AttackMapper, and Tenable ASM. Buyers should evaluate whether they need internal or external ASM, the level of automation and continuous monitoring, remediation workflows, integration and reporting, and beware that pricing is often usage based and can be substantial.
Millions of Credentials Stolen Each Day by Stealer Malware

gbhackers.com · 9 months ago

The cybercrime ecosystem surrounding stealer malware has reached industrial scale, with threat operators processing millions of stolen credentials each day and trading harvested data via Telegram channels, cybercrime forums, and social media platforms. Security researchers monitoring these operations for nearly a year found robust distribution networks and marketplaces that aggregate credentials, cookies, authentication tokens, and payment data for resale or automated abuse, creating a high-volume supply chain that fuels credential stuffing and account takeover campaigns.
New Rust Malware “ChaosBot” Hides Command-and-Control Inside Discord

gbhackers.com · 9 months ago

There is a new Rust based backdoor called ChaosBot that uses Discord channels and actor accounts chaos00019 and lovebb0024 for command and control, allowing operators to run arbitrary shell commands, take screenshots, and upload or download files on infected Windows hosts. Operators gained access in late September 2025 by abusing compromised Cisco VPN credentials and an over privileged Active Directory account then deployed the malware via phishing with malicious LNK files that execute PowerShell while displaying a decoy PDF. The payload msedgeelf.dll is sideloaded through the legitimate Microsoft Edge helper identityhelper.exe, performs system reconnaissance, downloads a fast reverse proxy for persistent access, includes evasion against Windows Event Tracing and virtual machines, and operators also attempted to configure a Visual Studio Code Tunnel as an additional backdoor.
Why nested deserialization is STILL harmful – Magento RCE (CVE-2025-54236)

www.reddit.com · 9 months ago

There is a critical Magento Adobe Commerce vulnerability called SessionReaper, CVE-2025-54236, that permits unauthenticated remote code execution on instances using file based session storage and may also affect other session backends. The issue stems from nested deserialization in the Web API input processor that can instantiate complex object types from nested arrays, and the vendor patch narrows allowed constructor types to simple scalars and API data object interfaces. Researchers mapped exploitable types and demonstrated a chain into the session manager that triggers session initialization and code execution, so affected deployments should apply the patch and review session storage configurations.
New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading

gbhackers.com · 9 months ago

There are reports that Salt Typhoon is conducting sophisticated campaigns against telecommunications and other critical infrastructure that leverage zero day exploits and DLL sideloading for stealth and long term persistence. There are indications the observed intrusion in July 2025 began with exploitation of a Citrix NetScaler Gateway and pivoted to Citrix Virtual Delivery Agent hosts while using SoftEther VPN infrastructure to obscure origins. There are findings that the actor delivered the SNAPPYBEE backdoor, also known as Deed RAT, via DLL side loading alongside legitimate antivirus executables and used LightNode VPS endpoints with dual channel command and control to evade detection.
Unlocking free WiFi on British Airways

www.reddit.com · 9 months ago

Passengers can sign up for British Airways free in flight messaging via the captive portal without email verification, and the airline enforces that plan by inspecting TLS Server Name Indication and resetting handshakes that do not match whitelisted messaging names or that omit SNI. A researcher ran an HTTPS proxy on a remote server, forced the client to send a permitted messaging SNI using host resolution tricks while ignoring certificate warnings, and successfully tunneled arbitrary web traffic through the connection. In-flight tests allowed basic web browsing but heavier assets and images were throttled or failed, and the researcher noted Encrypted Client Hello as a potential mitigation for SNI based filtering.
How ZeroPath's AI Code Scanner Won Over the curl Project with 170 Valid Bug Reports

www.reddit.com · 9 months ago

There are one hundred seventy verified issues found in curl by an AI based static analyzer, spanning C footguns, logic bugs, and RFC compliance errors across HTTP/3, SMTP, IMAP, TFTP, Telnet, and SSH SFTP. The scanner independently verifies findings to reduce false positives and surfaced developer intent and RFC violations that other tools missed, producing fixes and around twenty initial pull requests plus about one hundred thirty additional patches contributed by maintainers. Examples include a crash when a file size is a multiple of two hundred fifty six in the rustls integration, an incorrect SASL bit manipulation that failed to remove a mechanism, an HTTP/3 idle timeout miscalculation, TFTP accepting packets from the wrong UDP port enabling transfer hijacking, and Telnet failing to escape I A C bytes. The curl maintainer praised the quality of the findings, the project removed broken Kerberos FTP code, and fixes for memory leaks and RFC parsing issues were applied to reduce attack surface.
Hackers Exploit OAuth Apps to Keep Cloud Access Even After Password Resets

gbhackers.com · 9 months ago

There are attacks that create and register internal OAuth applications inside compromised cloud tenants that retain authorized tokens and continue to access mailboxes and files even after a user changes their password or multifactor authentication is enforced. Researchers demonstrated an automated toolkit that registers apps, generates client secrets and harvests access and refresh tokens to maintain long lived programmatic access to resources such as email, OneDrive, SharePoint and Teams. Access persists until administrators manually revoke application credentials, delete the application or explicitly remove granted permissions, since token revocation alone may not terminate the app's ability to request new tokens. Recommended defenses include auditing and constraining who can register or consent to apps, continuous monitoring of app registrations, immediate revocation of suspicious client secrets and automated remediation to remove malicious OAuth applications.
TP-Link Patches Four Omada Gateway Flaws, Two Allow Remote Code Execution

thehackernews.com · 9 months ago

TP-Link released security updates for Omada gateway devices to fix four vulnerabilities, including two critical flaws that allow arbitrary code execution. The flaws are tracked as CVE-2025-6541 CVSS 8.6 an operating system command injection exploitable by an attacker who can log in to the web management interface, CVE-2025-6542 CVSS 9.3 an operating system command injection exploitable by a remote unauthenticated attacker, CVE-2025-7850 CVSS 9.3 an operating system command injection exploitable by an attacker in possession of an administrator password, and CVE-2025-7851 CVSS 8.7 an improper privilege management issue that can allow obtaining a root shell under restricted conditions. Multiple Omada models are affected and users are urged to update firmware promptly, verify device configurations after upgrading, and note that no active exploitation has been reported so far.
Self-propagating worm found in marketplaces for Visual Studio Code extensions

www.csoonline.com · 9 months ago

GlassWorm is a self-propagating worm found in Visual Studio Code and OpenVSX extensions that has infected multiple extensions and been downloaded tens of thousands of times. It hides malicious JavaScript using unprintable Unicode variation selectors so the code looks like blank lines during review but executes in interpreters, and it harvests NPM, GitHub, Git, and OpenVSX credentials. The malware drains funds from 49 cryptocurrency wallets, uses the Solana blockchain and a Google Calendar event for command and control, deploys SOCKS proxy services and hidden remote access servers to enable lateral movement and package compromise, and uses stolen credentials to infect additional extensions. Organizations are advised to treat this as an active supply chain incident, inventory and monitor developer environments and extensions, disable auto updates from untrusted registries, and revoke and rotate any spilled credentials.