Skip to main content
Customer Support Customer Support

Security Industry News

We'll post what we hear. You post what you hear!

  • 36,098 Topics
  • 25,915 Replies
10000 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chrome extensions with 6 million installs have hidden tracking code

April 17, 2025 By Bill Toulas A set of 57 Chrome extensions with 6,000,000 users have been discovered with very risky capabilities, such as monitoring browsing behavior, accessing cookies for domains, and potentially executing remote scripts. These extensions are 'hidden,' meaning they don't show up on Chrome Web Store searches, nor do search engines index them, and can only be installed if the user has the direct URL. Typically, such extensions are private software like internal company tools or add-ons still under development. Still, threat actors might be using them to evade detection while aggressively pushing them through ads and malicious sites. Risky Chrome extensions The extensions were discovered by Secure Annex researcher John Tuckner, who uncovered the first 35 after examining what he claims is a suspicious extension named 'Fire Shield Extension Protection.' The extension is heavily obfuscated and contains callbacks to an API for sending information collected from the browse

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
“I sent you an email from your email account,” sextortion scam claims

April 16, 2025 By Pieter Arntz In a new version of the old “Hello pervert” emails, scammers are relying on classic email spoofing techniques to try and convince victims that they have lost control of their email account and computer systems. Email spoofing basically comes down to sending emails with a false sender address, a method in use in various ways by scammers. Obviously, pretending to be someone else can have its advantages, especially if that someone else holds a position of power or trust with regards to the receiver. But sending a message to the victim’s from their own email address might convince the victim that they have lost access over their own account. The text of the email roughly looks like this: “As you may have noticed, I sent you an email from your email account This means I have full access to your account I’ve been watching you for a few months The thing is, you got infected with a njrat through an adult site you visited If you don’t know about this, let me expla

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Over 16,000 Fortinet devices compromised with symlink backdoor

April 16, 2025 By Lawrence Abrams Over 16,000 internet-exposed Fortinet devices have been detected as compromised with a new symlink backdoor that allows read-only access to sensitive files on previously compromised devices. This exposure is being reported by threat monitoring platform The Shadowserver Foundation, which initially reported 14,000 devices were exposed. Today, Shadowserver's Piotr Kijewski told BleepingComputer that the cybersecurity organization now detects 16,620 devices impacted by the recently revealed persistence mechanism. >>Full Article<<

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Enhanced Version of ‘BPFDoor’ Linux Backdoor Seen in the Wild

April 16, 2025 By Tushar Subhra Dutta Cybercriminals have launched a sophisticated malware campaign leveraging fake PDF-to-DOCX converter websites that mimic the popular legitimate service PDFCandy. The malicious websites, including domains such as candyxpdf[.]com and candyconverterpdf[.]com, deploy an elaborate social engineering tactic designed to harvest sensitive information from unsuspecting users seeking to convert document formats. When users attempt to convert documents on these fraudulent platforms, they’re presented with a seemingly legitimate interface complete with animated loading sequences and familiar conversion options. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese Android phones shipped with malware-laced WhatsApp, Telegram apps

April 16, 2025 By Pierluigi Paganini Cheap Chinese Android phones ship with trojanized WhatsApp and Telegram clones hiding crypto clippers, active since June 2024. Since June 2024, Doctor Web researchers found cheap Android phones preloaded with fake WhatsApp and Telegram apps designed to steal crypto via clipping. These clippers swap copied wallet addresses with the attackers’ own. The campaign targeted low-end phones mimicking famous models, using altered system info to trick users. Attackers infiltrated the supply chain, embedding malware in pre-installed apps. Doctor Web warns that the attackers gained access to the supply chain of a number of Chinese manufacturers of Android-based smartphones. The experts found malware-laced applications pre-installed on the phone. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Google blocked over 5 billion ads in 2024 amid rise in AI-powered scams

April 16, 2025 By Lawrence Abrams Google blocked 5.1 billion ads and suspended more than 39.2 million advertiser accounts in 2024, according to its 2024 Ads Safety Report released this week. The company says the increasing enforcement activity is caused by the growing threat of AI-generated content, impersonation scams, and abuse of its ad platform. In particular, Google highlighted the use of generative AI tools to create deepfake video impersonations of celebrities and public figures to promote scams, which in the BleepingComputer experience are commonly investment and cryptocurrency scams. As a result, Google says it permanently suspended over 700,000 advertiser accounts for policy violations related to AI-driven impersonation scams. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Infamous message board 4chan taken down following major hack

April 15, 2025 By Sergiu Gatlan 4chan, an infamous online forum, was taken offline earlier today after what appears to be a significant hack and has since been loading intermittently. Members of the Soyjak.party imageboard (also known as The Party) have since claimed to be behind the attack. They also leaked screenshots of admin panels and a list of emails allegedly belonging to 4chan admins, moderators, and janitors (less privileged mods who help moderate the forums)." "Tonight has been a very special night for many of us at the soyjak party. Today, April 14, 2025, a hacker, who has been in 4cuck's system for over a year, executed the true operation soyclipse, reopening /qa/, exposing personal information of various 4cuck staff, and leaking code from the site," one of them (using the handle Chud) said in a thread posted after 4chan was taken down. >>Full Article<<

121
TylerM
Administrator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese Hackers Deploy Stealthy Fileless VShell RAT

Malware Hides in Memory, Evades Detection by Endpoint Tools April 15, 2025 By Prajeet Nair A Chinese state-backed hacking group relaunched its operations with a campaign after a year of silence using memory-only remote access Trojan that evades traditional detection mechanisms. The threat actor, tracked as UNC5174, adopted a new tactic that involves deploying VShell, a powerful open-source remote access Trojan, through a modified version of its custom Snowlight malware, according to a report by Sysdig researchers. This approach avoids writing files to disk, which makes detection difficult for endpoint security tools that rely on file-based scanning. "VShell's completely fileless execution is a game changer for Chinese threat actors," Sysdig researchers said. "The binary never touches disk, it's downloaded directly into memory and executed in a way that disguises it as a legitimate kernel process." >>Full Article<<

60
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft blocks ActiveX by default in Microsoft 365, Office 2024

April 15, 2025 By Sergiu Gatlan Microsoft announced it will begin disabling all ActiveX controls in Windows versions of Microsoft 365 and Office 2024 applications later this month. Introduced almost three decades ago, in 1996, ActiveX is a legacy software framework enabling developers to create interactive objects embedded in Office documents. After this change rolls out, ActiveX will be blocked entirely and without notification in Word, Excel, PowerPoint, and Visio to reduce the risk of malware or unauthorized code execution. When opening documents with ActiveX controls, a notification will appear at the top with a "Learn More" button saying, "BLOCKED CONTENT: The ActiveX content in this file is blocked." Microsoft also warned Office users in a separate support document not to open unexpected file attachments or change ActiveX settings when prompted by random pop-ups and unknown people. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hertz data breach: Customers in US, EU, UK, Australia and Canada affected

April 15, 2025 By Zeljka Zorz American car rental company Hertz has suffered a data breach linked to last year’s exploitation of Cleo zero-day vulnerabilities by a ransomware gang. The breach resulted in information of an unknown number of customers of Hertz and Hertz’s subsidiaries Dollar and Thrifty to be compromised. Hertz data breach notifications “Cleo is a vendor that provides a file transfer platform used by Hertz for limited purposes,” the company shared – though it did not specify what those limited purposes were. “On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day vulnerabilities within Cleo’s platform in October 2024 and December 2024.” Hertz, which operates in 160+ countries around the world under various brands, has published notices aimed at customers in the US, EU, Canada, UK and Australia. According to those notices, the following type of information was compromised: US individuals: name,

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Landmark Admin data breach impact now reaches 1.6 million people

April 15, 2025 By Bill Toulas Landmark Admin has issued an update to its investigation of a cyberattack it suffered in May 2024, increasing the number of impacted individuals to 1.6 million. Landmark is a Texas-based third-party administrator (TPA) handling policy accounting, regulatory reporting, reinsurance support, and IT systems for major insurers nationwide like Liberty Bankers Life and American Benefit Life. In October 2024, the company warned that it detected suspicious activity on its networks on May 13th, 2024. The unauthorized access was believed to have exposed the personal information of 806,519 people, including their: Full name Home address Social Security number Tax identification number Driver's license number State-issued identification card Passport number Financial account number Medical information Date of birth Health insurance policy number Life and annuity policy information The exact data types exposed vary per individual, and Landmark promised to notify each wi

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Govtech giant Conduent confirms client data stolen in January cyberattack

April 14, 2025 By Lawrence Abrams American business services giant and government contractor Conduent disclosed today that client data was stolen in a January 2025 cyberattack. Conduent is a business services company that provides digital platforms and solutions for government and commercial clients in transportation, healthcare, customer experience, and human resources. The company has over 33,000 employees and provides services to half of Fortune 100 companies and over 600 government and transportation agencies. In January, the company suffered a cyberattack that impacted customers' operations across the U.S., including local government agencies. In a new FORM-8K filing with the SEC today, Conduent has now confirmed that threat actors had stolen files containing information about the company's customers. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
UnitedHealth is now asking doctors to repay the loans it gave out following major hack

UnitedHealth is now “aggressively” chasing borrowers April 14, 2025 By Ellen Jennings-Trace (Image credit: Rawpixel / Pixabay) Change Healthcare suffered a huge cyberattack in 2024 Disruptions from that attack cost organizations millions The firm is now chasing repayment of loans to cover losses from these disruptions UnitedHealth Group is “aggressively” going after small healthcare organizations that borrowed money following a huge cyberattack on its subsidy Change Healthcare. The attack is said to have affected almost 190 million Americans, and was the largest US healthcare data breach ever, and was incredibly disruptive, with systems only fully restored 9 months later, costing over $2 billion to recover from. After the attack, interest-free loans were offered by Change to help medical practices with short-term cash flow needs. The firm is now demanding these funds be “immediately” repaid, with some organizations asked to repay hundreds of thousands of dollars in just a few days. >>F

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese APTs Exploit EDR 'Visibility Gap' for Cyber Espionage

Blind spots in network visibility, including in firewalls, IoT devices, and the cloud, are being exploited by Chinese state-backed threat actors with increasing success, according to new threat intelligence. Here's how experts say you can get eyes on it all. April 14, 2025 By Becky Bracken Beijing-backed hacker groups are known by a variety of benign-sounding monikers, like FishMonger and MirrorFace, and notably, Volt Typhoon and Salt Typhoon — but a handful of these groups, some of them operating as arms of the military, are running ruthless cyber-espionage campaigns against the US's most sensitive critical infrastructure, including utilities and telecommunications networks. While these groups' attribution to China by the US government and cybersecurity researchers hasn't really been in question, China itself isn't even trying to hide the nefarious cyber activity anymore. According to an April 10 Wall Street Journal report about a meeting with US representatives last December, Chinese

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Slow Pisces Hackers Attacking Developers With Coding Challenges & Python Malware

April 14, 2025 By Tushar Subhra Dutta A sophisticated threat actor group dubbed “Slow Pisces” has emerged as a significant threat to software developers, employing deceptive coding challenges as an initial attack vector to distribute Python-based malware. The campaign specifically targets developers through professional networking sites, coding forums, and development platforms with seemingly innocuous programming puzzles that conceal malicious payloads. Security researchers have observed these attacks increasing in frequency since January 2025, with victims primarily located in technology hubs across North America and Europe. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Tycoon2FA phishing kit rolled out significant updates

April 14, 2025 By Pierluigi Paganini The operators of the Phishing-as-a-Service (PhaaS) platform Tycoon2FA have rolled out significant updates to enhance its evasion capabilities. Tycoon2FA, a phishing kit discovered in 2023 by cybersecurity firm Sekoia, was recently updated to improve its evasion capabilities. The phishing kit now uses advanced evasion tactics such as a custom CAPTCHA via HTML5 canvas, invisible Unicode in obfuscated JavaScript, and anti-debugging scripts to bypass detection and hinder analysis. “Lately, the Tycoon 2FA landing pages have incorporated a clever obfuscation technique using invisible Unicode characters. This technique, when paired with JavaScript Proxy objects, is designed to complicate static analysis and defer script execution until runtime.” reported Trustwave. “This behavior is demonstrated in a real-world Tycoon 2FA phishing landing page, as shown in this Urlscan.io session: https://urlscan.io/result/0195c73f-bfd0-7000-8386-94b11ace6088/dom/“ Source:

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Possible Russian Hackers Targeted UK Ministry of Defense

Spear-Phishing Campaign Used RomCom Malware Variant April 14, 2025 By Akshaya Asokan Image: Shutterstock A phishing campaign wielding malware previously associated with Russian-speaking hackers targeted the U.K. Ministry of Defense in late 2024, the British government said Friday. Hackers spear-phished civil servants with emails purporting to originate from a news organization, later also deploying financially themed bait that directed users to a commercial file sharing site. The ministry and the National Cyber Security Centre disclosed the campaign on Friday. Anyone who clicked on the links in the phishing emails ultimately ended up with a malicious downloader known as Damascened Peacock on their computer, they said. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New malware ‘ResolverRAT’ targets healthcare, pharmaceutical firms

April 14, 2025 By Pierluigi Paganini New malware ‘ResolverRAT’ is targeting healthcare and pharmaceutical firms, using advanced capabilities to steal sensitive data. Morphisec researchers discovered a new malware dubbed ‘ResolverRAT’ that is targeting healthcare and pharmaceutical firms, using advanced capabilities to steal sensitive data. ResolverRAT spreads via phishing emails using localized languages and legal lures. Victims download a malicious file triggering the malware. The multi-language tactic suggests a global, targeted campaign aimed at boosting infection success across regions. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Cybersecurity firm buying hacker forum accounts to spy on cybercriminals

April 14, 2025 By Bill Toulas Swiss cybersecurity firm Prodaft has launched a new initiative called 'Sell your Source' where the company purchases verified and aged accounts on hacking forums to to spy on cybercriminals. The goal is to use these accounts to infiltrate cybercrime spaces and communities, collecting valuable intelligence that could lead to the exposure of malicious operations and platforms. "As a threat intelligence company, we specialize in obtaining visibility into the infrastructures of cybercriminals, searching for patterns, tactics, techniques, and procedures that help us understand adversarial networks and detect and mitigate potential cyberattacks," explains Prodaft. "As these activities are routinely associated with places such as the deep and dark web, underground forums, or illicit marketplaces, we want to ensure our coverage does not hit any limitations." >>Full Article<<

40
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Release notes for Microsoft Edge Security Updates April 11, 2025

Microsoft Edge (Stable) 135.0.3179.73 Release date: April 11, 2025 Release notes for Microsoft Edge Stable Channel: N/A https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

201
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
That groan you hear is users’ reaction to Recall going back into Windows

Snapshotting and AI processing a screen every 3 seconds. What could possibly go wrong? Dan Goodin – 11 Apr 2025 Security and privacy advocates are girding themselves for another uphill battle against Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds. When Recall was first introduced in May 2024, security practitioners roundly castigated it for creating a gold mine for malicious insiders, criminals, or nation-state spies if they managed to gain even brief administrative access to a Windows device. Privacy advocates warned that Recall was ripe for abuse in intimate partner violence settings. They also noted that there was nothing stopping Recall from preserving sensitive disappearing content sent through privacy-protecting messengers such as Signal. Enshittification at a new scale Following months of backlash, Microsoft later suspended Recall. On Thursday, the company said it was reintroducing Recall. It curren

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs

Even weirder: Why would Google give so many the "Featured" stamp for trustworthiness? Dan Goodin – 11 Apr 2025 Google is hosting dozens of extensions in its Chrome Web Store that perform suspicious actions on the more than 4 million devices that have installed them and that their developers have taken pains to carefully conceal. The extensions, which so far number at least 35, use the same code patterns, connect to some of the same servers, and require the same list of sensitive systems permissions, including the ability to interact with web traffic on all URLs visited, access cookies, manage browser tabs, and execute scripts. In more detail, the permissions are: Tabs: manage and interact with browser windows Cookies: set and access stored browser cookies based on cookie or domain names (ex., "Authorization" or "all cookies for GitHub.com") WebRequest: intercept and modify web requests the browser makes Storage: ability to store small amounts of information persistently in the browser

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ransomware attack cost IKEA operator in Eastern Europe $23 million

April 11, 2025 By Bill Toulas Fourlis Group, the operator of IKEA stores in Greece, Cyprus, Romania, and Bulgaria, has informed that the ransomware attack it suffered just before Black Friday on November 27, 2024, caused losses estimated to €20 million ($22.8 million). The security incident became public on December 3, 2024, when the group admitted that the technical problems IKEA online shops were facing were due to “malicious external action.” Although the company also operates Intersport, Foot Locker, and Holland & Barrett shops in the said countries, the impact of the attack affected mainly IKEA business operations. “The incident caused temporary disruptions in a store replenishment, primarily impacting the Home Furnishings segment (IKEA stores) and e-commerce operations during December 2024 through February 2025,” reads a press release published earlier this week. In a statement to local media, the Fourlis Group CEO, Dimitris Valachis, clarified that the impact the security incide

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
1.6 Million People Impacted by Data Breach at Laboratory Services Cooperative

Laboratory Services Cooperative says the personal and medical information of 1.6 million was stolen in an October 2024 data breach. April 11, 2025 By Ionut Arghire Medical testing services provider Laboratory Services Cooperative (LSC) is notifying 1.6 million individuals that their personal information was stolen in an October 2024 data breach. As part of the cyberattack, which was identified on October 27, a threat actor accessed LSC’s network and accessed and exfiltrated certain files containing patient and employee information. The potentially compromised information includes names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, driver’s license numbers, government ID or passport numbers, demographic information, and health insurance information such as plan name and type, insurance provider, and member/group ID number. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Paper Werewolf Threat Actor Targets Flash Drives With New Malware

The threat actor, also known as Goffee, has been active since at least 2022 and has changed its tactics and techniques over the years while targeting Russian organizations. April 11, 2025 By Kristina Beek A threat actor known as Paper Werewolf is using new malware to target Russian entities and steal sensitive files from flash drives. The actor, also known as Goffee, was observed deploying the malware by researchers at Kaspersky Lab. The malware includes components that are designed to target removable media. Kaspersky said the previously undocumented implant, which it calls "PowerModul," is a PowerShell script downloader that can covertly download other components from command and control servers. One of the components — FlashFileGrabber — steals files from flash drives or scans USB drives for documents before copying them to a local disk. USB Worm is another of these such components and operates by spreading PowerModul malware and infecting any flash drives that are connected to the

60
Jasper_The_Rasper
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions