Threat Intel Hub

May 1, 2020 By Tara Seals   Two separate attacks have targeted as many as 50,000 different Teams users, with the goal of phishing Office 365 logins. A convincing cyberattack that impersonates notifications from Microsoft Teams in order to steal the Office 365 credentials of employees is making the rounds, according to researchers. Two separate attacks have targeted as many as 50,000 different Teams users, according to findings from Abnormal Security. The news comes as the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about Office 365 remote-work deployments. “CISA continues to see instances where entities are not implementing best security practices in regard to their O365 implementation, resulting in increased vulnerability to adversary attacks,” the agency sai

May 3, 2020 By Geoff White   The man behind the world's first major computer virus outbreak has admitted his guilt, 20 years after his software infected millions of machines worldwide. Filipino Onel de Guzman, now 44, says he unleashed the Love Bug computer worm to steal passwords so he could access the internet without paying. He claims he never intended it to spread globally. And he says he regrets the damage his code caused. "I didn't expect it would get to the US and Europe. I was surprised," he said in an interview for Crime Dot Com, a forthcoming book on cyber-crime.   Full Article.

Dreambot backend servers have gone down and no new samples have been spotted for weeks.   May 1, 2020 By Catalin Cimpanu   The Dreambot malware botnet appears to have gone silent and possibly shut down, according to a report published today by the CSIS Security Group, a cyber-security firm based in Copenhagen, Denmark. The company is reporting that the Dreambot's backend servers have gone down in March; about the same time when the cybersecurity community also stopped seeing new Dreambot samples distributed in the wild.   Full Article.

May 1, 2020 By Tara Seals   No longer a simple Android banker, Cerberus is now a full-fledged RAT that can take complete control of devices and automatically spread via mobile device management servers. A newly discovered variant of the Cerberus Android trojan has been spotted, with vastly expanded and more sophisticated info-harvesting capabilities, and the ability to run TeamViewer. It was spotted by researchers being used in a targeted campaign on a multinational conglomerate. Unusually, the sample propagated through the employee pool via the infected company’s mobile device management (MDM) server.   Full Article.

May 1, 2020 By Sergiu Gatlan     Attackers infected more than 75% of a multinational conglomerate's managed Android devices with the Cerberus banking trojan using the company’s compromised Mobile Device Manager (MDM) server. MDM (also known as Enterprise Mobility Management - EMM) is a mechanism used by companies of all sizes to enroll enterprise-owned devices with the same management server to make it easier to perform tasks such as delivering company-wide device configurations, deploying applications, and more. The Cerberus banking trojan was first spotted in June 2019 and it uses a Malware-as-a-Service

The Tokopedia data has been published on a well-known hacking forum.   May 2, 2020 By Catalin Cimpanu   A hacker has leaked on Friday the details of 15 million users registered on Tokopedia, Indonesia's largest online store. The hacker claims the data was obtained in an intrusion that took place in March 2020 and is just a small part of the site's entire user database that was obtained in the hack. The leaker said he was sharing the 15 million users sample in the hopes someone could help crack the user passwords, so they could be used to access user accounts. ZDNet has obtained a copy of the leaked file with the help of data breach monitoring service Under the Breach.  

By Ionut Arghire on May 04, 2020   High-severity vulnerabilities patched in the Ninja Forms and LearnPress WordPress plugins could be exploited to take over vulnerable sites, WordPress security company Defiant reports. The developers of highly popular Ninja Forms last week addressed Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities that attackers could chain to trick an admin into importing a contact form containing malicious JavaScript code that would then get executed when certain pages are visited.   Full Article.

LineageOS source code, OS builds, and signing keys were unaffected, developers said.   May 3, 2020 By Catalin Cimpanu     Hackers have gained access to the core infrastructure of LineageOS, a mobile operating system based on Android, used for smartphones, tablets, and set-top boxes. The intrusion took place last night, on Saturday, at around 8 pm (US Pacific coast), and was detected before the attackers could do any harm, the LineageOS team said in a statement published less than three hours after the incident. The LineageOS team said the operati

May 4, 2020 By Zeljka Zorz   Two vulnerabilities in SaltStack Salt, an open-source remote task and configuration management framework, are being actively exploited by attackers, CISA warns.   About SaltStack Salt   Salt is used for configuring, managing and monitoring servers in datacenters and cloud environments. The Salt installation is the “master” and each server it monitors runs an API agent called a “minion”. The minions send state reports to the master and the master publishes update messages containing instructions/commands to the minions. The communication between the master and its minions is secured (encrypted

By Eduard Kovacs on May 01, 2020   Oracle warned customers on Thursday that threat actors have been spotted attempting to exploit multiple recently patched vulnerabilities, including a critical WebLogic Server flaw tracked as CVE-2020-2883. Eric Maurice, director of security assurance at Oracle, said the company had received “reports of attempts to maliciously exploit a number of recently-patched vulnerabilities.” He only mentioned CVE-2020-2883, but advised customers to install the latest patches as soon as possible.   Full Article.

May 2, 2020  By Pierluigi Paganini   French daily Le Figaro database accidentally exposed online, the archive included roughly 7.4 billion records containing personal information of employees and users.   French daily newspaper Le Figaro exposed roughly 7.4 billion records containing personally identifiable information (PII) of employees, reporters, and at least 42,000 users. The database was discovered by the Safety Detectives team of experts lead by the researcher Anurag Sen, it was over 8TB, the archive also included data of accounts registered between February and April 2020, as well as logs of accesses in the same period.  

May 2, 2020 By Mayank Parmar   New research claims that China-based Xiaomi is tracking sensitive information and sending it to their servers if you use the Mi browser, which is bundled with all Redmi and Mi phones. In a report by Forbes, security research Gabi Cirlig states that Xiaomi's Mi Browser app sends your internet searches, including incognito mode sessions, to Xiaomi servers in Singapore and Russia. Even more concerning is that Cirlig states that the data being set can easily be associated with a particular user allowing the company to single out users they wish to track.  

By Eduard Kovacs on May 01, 2020   Several vulnerabilities, most of which have been described as cross-site scripting (XSS) flaws, have been patched in WordPress this week with the release of version 5.4.1. WordPress 5.4.1, described as a short-cycle security and maintenance release, fixes 17 bugs and 7 vulnerabilities affecting version 5.4 and earlier. WordPress developers pointed out that all versions newer than 3.7 have been updated as well. WordPress security firm Defiant has published a blog post describing each of the patched vulnerab

CVEs have been published or revised in the Security Update GuideOctober 3, 2025These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:CVE-2025-59489 Title: MITRE: CVE-2025-59489 Unity Gaming Engine Editor vulnerability Version:

Following @'s recent remark in the thread AVG changes privacy policy to harvest users' personal data and sell it to advertisers on Webroot's recent change of privacy policy as follows: In some cases, we may choose to share your personal information with third parties who have not explicitly agreed to provide the same level of protection to your information as we do. What's that all about?!?   And what's this all about: We may also share your personal information with ... selected ... advertisers, marketers, and advertising and marketing networks that use the information to select and serve relevant ads to you and others on our site, on other sites, and in apps, as permitted under applicable law and

1st June 2017  By Dell Cameron                                                 Although storing passwords in plaintext anywhere online is fundamentally the opposite of security, routine data breaches at some of the world’s biggest companies haven’t dissuaded some users from engaging in this obviously terrible practice.   Case in p

See Also - Exploits Swirling for Major Security Defect in Apache Log4j This Tech Tip outlines how enterprise defenders can mitigate the risks of the Log4j vulnerabilities for the short-term while waiting for updates. December 11, 2021  By Fahmida Y. Rashid  Researchers are warning that attackers are actively exploiting the newly publicized unauthenticated remote code execution vulnerability in Log4j, the Java-based logging tool from Apache. While the bulk of the work to mitigate CVE-2021-44228 falls on application owners and software developers, enterprise security teams also have to do their part to keep their organ

HTTPS error has been active for weeks, but few seem to have noticed.by Dan Goodin - Apr 17, 2015   http://cdn.arstechnica.net/wp-content/uploads/2015/04/match-password-exposure-640x357.png  Tens of millions of Match.com subscribers risk having their site password exposed each time they sign in because the dating site doesn't use HTTPS encryption to protect its login page.   The screenshot above was taken Thursday afternoon. Showing a session from the Wireshark packet sniffing program, you can see that this reporter entered "dan.goodin@arstechnica.com" and "secretpassword" into