CyberNews As a sophisticated threat actor, PEEP has managed to turn Chrome and Edge browsers into post-compromise backdoors for executing malicious commands on compromised systems. The technique exploits vulnerabilities in these popular web browsers, allowing hackers to secretly maintain access to infected machines even after they’ve been cleaned or reinstalled. At the heart of this exploit … Read more
A major cryptocurrency hardware wallet maker has revealed that a recent data breach at its shipping and logistics provider has affected an additional 67,000 U.S. customers, bringing the total number of impacted individuals to 81,000. The incident highlights the need for companies to prioritize data protection and vigilance in their supply chains. The breach occurred … Read more
A Sophisticated Phishing Service Bypasses MFA at Hundreds of Organizations A recent cybersecurity investigation has uncovered a highly sophisticated phishing-as-a-service (PhaaS) framework called BigBear 2.0, which has been used to compromise Microsoft 365 accounts at an astonishing 258 organizations worldwide. Researchers at CloudSEK discovered that the service exploited a vulnerability in multi-factor authentication (MFA), allowing … Read more
Magento E-commerce Platform Hit with Zero-Day Vulnerability, Linux Backdoor Deployed In a worrying development for e-commerce security, a zero-day vulnerability dubbed “StyleSmuggler” has been exploited to deploy a Linux backdoor on websites running Magento and Adobe Commerce. The vulnerability affects all versions of the popular open-source e-commerce platform, which is installed on over 160,000 websites … Read more
A string of recent security incidents has highlighted a disturbing trend in cyberattacks, where attackers exploit identity exposure to unlock active attack paths and wreak havoc on unsuspecting organizations. The alarming rate at which this is happening underscores the need for businesses and individuals alike to take immediate action to shore up their defenses. One … Read more
**Phantom IT Calls Pose Serious Threat to Executives in Microsoft 365 Data Theft and Extortion Attacks** In a disturbing trend, cyberattackers have started targeting high-ranking executives with fake IT support calls, compromising their sensitive data and extorting them for ransom. This insidious tactic has been observed in attacks on Microsoft 365 users, where attackers exploit … Read more
**Critical Vulnerability in Telerik UI Components Exposes Millions to Remote Code Execution** A devastating security flaw has been discovered in the widely-used Telerik UI components, leaving millions of websites and applications vulnerable to remote code execution (RCE). The bug, known as a “padding oracle” vulnerability, allows attackers to chain it with other vulnerabilities to gain … Read more
A sophisticated malware campaign is making headlines, as a four-stage VBScript chain has been discovered spreading through ScreenConnect clients. The malicious code exploits vulnerabilities in previously unknown areas of the software, leaving many organizations vulnerable to potential breaches. At its core, the attack relies on the use of ScreenConnect, a popular remote desktop management tool … Read more
Cyber attackers have found a sneaky way to exploit cloud security checklists, turning them into effective gateways for data breaches. A new analysis has revealed that identity exposure can be used as a stepping stone to launch active attack paths, rendering even the most robust security protocols useless. According to an investigation by experts in … Read more
A new wave of sophisticated cyber attacks is exploiting a critical vulnerability in the way online identities are managed, leaving millions of users vulnerable to active attack paths. The threat, which has been dubbed “Identity Exposure,” leverages cross-domain privilege escalation to bypass traditional security measures and gain access to sensitive systems. At its core, Identity … Read more