Skip to main content
Customer Support Customer Support

Security Industry News

We'll post what we hear. You post what you hear!

  • 36,040 Topics
  • 25,896 Replies
10000 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft blocks ActiveX by default in Microsoft 365, Office 2024

April 15, 2025 By Sergiu Gatlan Microsoft announced it will begin disabling all ActiveX controls in Windows versions of Microsoft 365 and Office 2024 applications later this month. Introduced almost three decades ago, in 1996, ActiveX is a legacy software framework enabling developers to create interactive objects embedded in Office documents. After this change rolls out, ActiveX will be blocked entirely and without notification in Word, Excel, PowerPoint, and Visio to reduce the risk of malware or unauthorized code execution. When opening documents with ActiveX controls, a notification will appear at the top with a "Learn More" button saying, "BLOCKED CONTENT: The ActiveX content in this file is blocked." Microsoft also warned Office users in a separate support document not to open unexpected file attachments or change ActiveX settings when prompted by random pop-ups and unknown people. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hertz data breach: Customers in US, EU, UK, Australia and Canada affected

April 15, 2025 By Zeljka Zorz American car rental company Hertz has suffered a data breach linked to last year’s exploitation of Cleo zero-day vulnerabilities by a ransomware gang. The breach resulted in information of an unknown number of customers of Hertz and Hertz’s subsidiaries Dollar and Thrifty to be compromised. Hertz data breach notifications “Cleo is a vendor that provides a file transfer platform used by Hertz for limited purposes,” the company shared – though it did not specify what those limited purposes were. “On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day vulnerabilities within Cleo’s platform in October 2024 and December 2024.” Hertz, which operates in 160+ countries around the world under various brands, has published notices aimed at customers in the US, EU, Canada, UK and Australia. According to those notices, the following type of information was compromised: US individuals: name,

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Landmark Admin data breach impact now reaches 1.6 million people

April 15, 2025 By Bill Toulas Landmark Admin has issued an update to its investigation of a cyberattack it suffered in May 2024, increasing the number of impacted individuals to 1.6 million. Landmark is a Texas-based third-party administrator (TPA) handling policy accounting, regulatory reporting, reinsurance support, and IT systems for major insurers nationwide like Liberty Bankers Life and American Benefit Life. In October 2024, the company warned that it detected suspicious activity on its networks on May 13th, 2024. The unauthorized access was believed to have exposed the personal information of 806,519 people, including their: Full name Home address Social Security number Tax identification number Driver's license number State-issued identification card Passport number Financial account number Medical information Date of birth Health insurance policy number Life and annuity policy information The exact data types exposed vary per individual, and Landmark promised to notify each wi

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Govtech giant Conduent confirms client data stolen in January cyberattack

April 14, 2025 By Lawrence Abrams American business services giant and government contractor Conduent disclosed today that client data was stolen in a January 2025 cyberattack. Conduent is a business services company that provides digital platforms and solutions for government and commercial clients in transportation, healthcare, customer experience, and human resources. The company has over 33,000 employees and provides services to half of Fortune 100 companies and over 600 government and transportation agencies. In January, the company suffered a cyberattack that impacted customers' operations across the U.S., including local government agencies. In a new FORM-8K filing with the SEC today, Conduent has now confirmed that threat actors had stolen files containing information about the company's customers. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
UnitedHealth is now asking doctors to repay the loans it gave out following major hack

UnitedHealth is now “aggressively” chasing borrowers April 14, 2025 By Ellen Jennings-Trace (Image credit: Rawpixel / Pixabay) Change Healthcare suffered a huge cyberattack in 2024 Disruptions from that attack cost organizations millions The firm is now chasing repayment of loans to cover losses from these disruptions UnitedHealth Group is “aggressively” going after small healthcare organizations that borrowed money following a huge cyberattack on its subsidy Change Healthcare. The attack is said to have affected almost 190 million Americans, and was the largest US healthcare data breach ever, and was incredibly disruptive, with systems only fully restored 9 months later, costing over $2 billion to recover from. After the attack, interest-free loans were offered by Change to help medical practices with short-term cash flow needs. The firm is now demanding these funds be “immediately” repaid, with some organizations asked to repay hundreds of thousands of dollars in just a few days. >>F

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese APTs Exploit EDR 'Visibility Gap' for Cyber Espionage

Blind spots in network visibility, including in firewalls, IoT devices, and the cloud, are being exploited by Chinese state-backed threat actors with increasing success, according to new threat intelligence. Here's how experts say you can get eyes on it all. April 14, 2025 By Becky Bracken Beijing-backed hacker groups are known by a variety of benign-sounding monikers, like FishMonger and MirrorFace, and notably, Volt Typhoon and Salt Typhoon — but a handful of these groups, some of them operating as arms of the military, are running ruthless cyber-espionage campaigns against the US's most sensitive critical infrastructure, including utilities and telecommunications networks. While these groups' attribution to China by the US government and cybersecurity researchers hasn't really been in question, China itself isn't even trying to hide the nefarious cyber activity anymore. According to an April 10 Wall Street Journal report about a meeting with US representatives last December, Chinese

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Slow Pisces Hackers Attacking Developers With Coding Challenges & Python Malware

April 14, 2025 By Tushar Subhra Dutta A sophisticated threat actor group dubbed “Slow Pisces” has emerged as a significant threat to software developers, employing deceptive coding challenges as an initial attack vector to distribute Python-based malware. The campaign specifically targets developers through professional networking sites, coding forums, and development platforms with seemingly innocuous programming puzzles that conceal malicious payloads. Security researchers have observed these attacks increasing in frequency since January 2025, with victims primarily located in technology hubs across North America and Europe. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Tycoon2FA phishing kit rolled out significant updates

April 14, 2025 By Pierluigi Paganini The operators of the Phishing-as-a-Service (PhaaS) platform Tycoon2FA have rolled out significant updates to enhance its evasion capabilities. Tycoon2FA, a phishing kit discovered in 2023 by cybersecurity firm Sekoia, was recently updated to improve its evasion capabilities. The phishing kit now uses advanced evasion tactics such as a custom CAPTCHA via HTML5 canvas, invisible Unicode in obfuscated JavaScript, and anti-debugging scripts to bypass detection and hinder analysis. “Lately, the Tycoon 2FA landing pages have incorporated a clever obfuscation technique using invisible Unicode characters. This technique, when paired with JavaScript Proxy objects, is designed to complicate static analysis and defer script execution until runtime.” reported Trustwave. “This behavior is demonstrated in a real-world Tycoon 2FA phishing landing page, as shown in this Urlscan.io session: https://urlscan.io/result/0195c73f-bfd0-7000-8386-94b11ace6088/dom/“ Source:

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Possible Russian Hackers Targeted UK Ministry of Defense

Spear-Phishing Campaign Used RomCom Malware Variant April 14, 2025 By Akshaya Asokan Image: Shutterstock A phishing campaign wielding malware previously associated with Russian-speaking hackers targeted the U.K. Ministry of Defense in late 2024, the British government said Friday. Hackers spear-phished civil servants with emails purporting to originate from a news organization, later also deploying financially themed bait that directed users to a commercial file sharing site. The ministry and the National Cyber Security Centre disclosed the campaign on Friday. Anyone who clicked on the links in the phishing emails ultimately ended up with a malicious downloader known as Damascened Peacock on their computer, they said. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New malware ‘ResolverRAT’ targets healthcare, pharmaceutical firms

April 14, 2025 By Pierluigi Paganini New malware ‘ResolverRAT’ is targeting healthcare and pharmaceutical firms, using advanced capabilities to steal sensitive data. Morphisec researchers discovered a new malware dubbed ‘ResolverRAT’ that is targeting healthcare and pharmaceutical firms, using advanced capabilities to steal sensitive data. ResolverRAT spreads via phishing emails using localized languages and legal lures. Victims download a malicious file triggering the malware. The multi-language tactic suggests a global, targeted campaign aimed at boosting infection success across regions. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Cybersecurity firm buying hacker forum accounts to spy on cybercriminals

April 14, 2025 By Bill Toulas Swiss cybersecurity firm Prodaft has launched a new initiative called 'Sell your Source' where the company purchases verified and aged accounts on hacking forums to to spy on cybercriminals. The goal is to use these accounts to infiltrate cybercrime spaces and communities, collecting valuable intelligence that could lead to the exposure of malicious operations and platforms. "As a threat intelligence company, we specialize in obtaining visibility into the infrastructures of cybercriminals, searching for patterns, tactics, techniques, and procedures that help us understand adversarial networks and detect and mitigate potential cyberattacks," explains Prodaft. "As these activities are routinely associated with places such as the deep and dark web, underground forums, or illicit marketplaces, we want to ensure our coverage does not hit any limitations." >>Full Article<<

40
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Release notes for Microsoft Edge Security Updates April 11, 2025

Microsoft Edge (Stable) 135.0.3179.73 Release date: April 11, 2025 Release notes for Microsoft Edge Stable Channel: N/A https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

191
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
That groan you hear is users’ reaction to Recall going back into Windows

Snapshotting and AI processing a screen every 3 seconds. What could possibly go wrong? Dan Goodin – 11 Apr 2025 Security and privacy advocates are girding themselves for another uphill battle against Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds. When Recall was first introduced in May 2024, security practitioners roundly castigated it for creating a gold mine for malicious insiders, criminals, or nation-state spies if they managed to gain even brief administrative access to a Windows device. Privacy advocates warned that Recall was ripe for abuse in intimate partner violence settings. They also noted that there was nothing stopping Recall from preserving sensitive disappearing content sent through privacy-protecting messengers such as Signal. Enshittification at a new scale Following months of backlash, Microsoft later suspended Recall. On Thursday, the company said it was reintroducing Recall. It curren

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs

Even weirder: Why would Google give so many the "Featured" stamp for trustworthiness? Dan Goodin – 11 Apr 2025 Google is hosting dozens of extensions in its Chrome Web Store that perform suspicious actions on the more than 4 million devices that have installed them and that their developers have taken pains to carefully conceal. The extensions, which so far number at least 35, use the same code patterns, connect to some of the same servers, and require the same list of sensitive systems permissions, including the ability to interact with web traffic on all URLs visited, access cookies, manage browser tabs, and execute scripts. In more detail, the permissions are: Tabs: manage and interact with browser windows Cookies: set and access stored browser cookies based on cookie or domain names (ex., "Authorization" or "all cookies for GitHub.com") WebRequest: intercept and modify web requests the browser makes Storage: ability to store small amounts of information persistently in the browser

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ransomware attack cost IKEA operator in Eastern Europe $23 million

April 11, 2025 By Bill Toulas Fourlis Group, the operator of IKEA stores in Greece, Cyprus, Romania, and Bulgaria, has informed that the ransomware attack it suffered just before Black Friday on November 27, 2024, caused losses estimated to €20 million ($22.8 million). The security incident became public on December 3, 2024, when the group admitted that the technical problems IKEA online shops were facing were due to “malicious external action.” Although the company also operates Intersport, Foot Locker, and Holland & Barrett shops in the said countries, the impact of the attack affected mainly IKEA business operations. “The incident caused temporary disruptions in a store replenishment, primarily impacting the Home Furnishings segment (IKEA stores) and e-commerce operations during December 2024 through February 2025,” reads a press release published earlier this week. In a statement to local media, the Fourlis Group CEO, Dimitris Valachis, clarified that the impact the security incide

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
1.6 Million People Impacted by Data Breach at Laboratory Services Cooperative

Laboratory Services Cooperative says the personal and medical information of 1.6 million was stolen in an October 2024 data breach. April 11, 2025 By Ionut Arghire Medical testing services provider Laboratory Services Cooperative (LSC) is notifying 1.6 million individuals that their personal information was stolen in an October 2024 data breach. As part of the cyberattack, which was identified on October 27, a threat actor accessed LSC’s network and accessed and exfiltrated certain files containing patient and employee information. The potentially compromised information includes names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, driver’s license numbers, government ID or passport numbers, demographic information, and health insurance information such as plan name and type, insurance provider, and member/group ID number. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Paper Werewolf Threat Actor Targets Flash Drives With New Malware

The threat actor, also known as Goffee, has been active since at least 2022 and has changed its tactics and techniques over the years while targeting Russian organizations. April 11, 2025 By Kristina Beek A threat actor known as Paper Werewolf is using new malware to target Russian entities and steal sensitive files from flash drives. The actor, also known as Goffee, was observed deploying the malware by researchers at Kaspersky Lab. The malware includes components that are designed to target removable media. Kaspersky said the previously undocumented implant, which it calls "PowerModul," is a PowerShell script downloader that can covertly download other components from command and control servers. One of the components — FlashFileGrabber — steals files from flash drives or scans USB drives for documents before copying them to a local disk. USB Worm is another of these such components and operates by spreading PowerModul malware and infecting any flash drives that are connected to the

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
The Pall Mall Pact and why it matters

April 11, 2025 By Pieter Arntz The US State Department reportedly plans to sign an international agreement designed to govern the use of commercial spyware known as the Pall Mall Pact. The Pall Mall Pact, formally known as the Pall Mall Process, was initiated by France and the United Kingdom in February 2024. The goal of the Pall Mall Pact is to regulate Commercial Cyber Intrusion Capabilities (CCICs), or what we usually refer to as spyware and surveillance tools. Signed by France, the UK, Japan, and 18 other EU member states, the Code of Practice is a voluntary non-binding agreement establishing “best practices” among governments in relation to the development, facilitation, purchase, transfer, and use of commercial cyber intrusion tools and services. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Palo Alto warns of brute-force login attempts on PAN-OS GlobalProtect gateways indicating possible upcoming attacks

April 11, 2025 By Pierluigi Paganini Experts warn of brute-force login attempts on PAN-OS GlobalProtect gateways following increased scanning activity on its devices. Palo Alto Networks reports brute-force login attempts on PAN-OS GlobalProtect gateways. The security firm pointed out that no known vulnerability has been exploited, but monitoring and analysis continue. “Our teams are observing evidence of activity consistent with password-related attacks, such as brute-force login attempts, which does not indicate exploitation of a vulnerability,” a company spokesperson told The Hacker News. “We continue to actively monitor this situation and analyze the reported activity to determine its potential impact and identify if mitigations are necessary.” Recently, the threat intelligence firm GreyNoise reported a spike in login scanning targeting PAN-OS GlobalProtect portals starting March 17, 2025, peaking at 23,958 unique IPs. The activity, likely coordinated, focused on systems in the U.S.

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Western Sydney University discloses security breaches, data leak

April 11, 2025 By Bill Toulas Western Sydney University (WSU) announced two security incidents that exposed personal information belonging to members of its community. WSU is a prominent Australian institution offering various undergraduate, postgraduate, and research programs across multiple disciplines. It serves a student body of 47,000 and employs over 4,500 permanent and seasonal staff, operating with an annual budget of approximately $600 million. One of the incidents disclosed concerns the compromise of one of the University’s single sign-on (SSO) systems between January and February 2025. This breach has reportedly led to the unauthorized access of demographic, enrollment, and progression information for approximately 10,000 current and former students. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Malicious NPM Packages Targeting PayPal Users

By Jenna Wang | April 11, 2025 FortiGuard Labs’ AI-driven OSS malware detection system has recently discovered a series of malicious NPM packages designed to steal sensitive information from compromised systems. These packages are believed to have been created between March 5 and March 14 by a threat actor known as tommyboy_h1 and tommyboy_h2 to target PayPal users. PayPal is a widely used platform holding sensitive financial information. Using PayPal-related names helps these malicious packages avoid detection, making it easier for attackers to steal sensitive information. By including "PayPal" in the name of the malicious packages, such as oauth2-paypal and buttonfactoryserv-paypal, the attackers also create a false sense of legitimacy, tricking developers into installing them. The code collects and exfiltrates system data, such as usernames and directory paths, which can then be used to target PayPal accounts or be sold for fraudulent purposes. The code has very similar characterist

40
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Release notes for Microsoft Edge Security Updates April 9, 2025

Microsoft Edge (Stable) 135.0.3179.66 Release date: April 9, 2025 Release notes for Microsoft Edge Stable Channel: N/A https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

171
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
SpyNote Android malware resurfaces in campaign using spoofed app install pages

April 10, 2025 By Duncan Riley A new report out today from internet intelligence company DomainTools LLC warns that threat actors are using newly registered domains to deliver the SpyNote Android remote access trojan via sites that mimic Google Play app installation pages. In trying to imitate legitimate Google Play app listings, the cloned pages often feature image carousels and familiar visual elements to create the illusion of legitimacy, prompting unsuspecting users to download malicious APK files. One example mimicked the TikTok installation page, using remnants of older app references such as “com.zhiliaoapp.musically” in the site code. The downloaded files include variants of SpyNote, an Android RAT capable of conducting surveillance, harvesting sensitive data and executing remote commands on compromised devices. Spynote first appeared in 2016 and has popped up in various campaigns over the years, including one targeting Netflix Inc. users in 2017. The SpyNote malware is deliver

70
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Study Identifies 20 Most Vulnerable Connected Devices of 2025

Routers are the riskiest devices in enterprise networks as they contain the most critical vulnerabilities, a new Forescout report shows. April 10, 2025 By Ionut Arghire Routers represent the riskiest devices in enterprise networks, containing the largest number of critical vulnerabilities, Forescout notes in a new report. According to the company’s ‘Riskiest Connected Devices of 2025’ report, device risk has increased 15% compared to the previous year, with routers accounting for more than half of the devices plagued by the most dangerous vulnerabilities. The report, which analyzes millions of devices in Forescout’s Device Cloud to identify the riskiest types across IT, IoT, OT, and Internet of Medical Things (IoMT), shows that computers have the largest number of bugs, but not the most dangerous ones. The list of top 20 riskiest devices has changed significantly since last year, with 12 new device types added: ADCs, firewalls, intelligent platform management interfaces (IPMIs), domain

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Threat Actors Use 'Spam Bombing' Technique to Hide Malicious Motives

Darktrace researchers detailed "spam bombing," a technique in which threat actors bombard targets with spam emails as a pretense for activity like social engineering campaigns. April 10, 2025 By Alexander Culafi Threat actors are using a technique known as "spam bombing" to overload victims' email inboxes and provide cover for more harmful activity. In research published today by security vendor Darktrace, analysts Maria Geronikolou and Cameron Boyd detailed an example of the technique where the threat actor used a legitimate email campaign product to swarm a victim with spam emails and then attempted to phish them under the guise of a "helpful" IT staffer. The attack is both an example of how threat actors use legitimate products for malicious activities and of how attackers are innovating in the social engineering space. >>Full Article<<

60
Jasper_The_Rasper
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions