CyberNews Sweden’s Data Privacy Regulator Hits IT Firm with $183,000 Fine Over Breach Affecting 2.2 Million The Swedish data privacy regulator, IMY, has issued a stern warning to IT systems provider Miljödata by slapping it with a hefty fine of $183,000 for its lax security measures that led to a massive breach last year. The attack … Read more
Cybersecurity researchers have uncovered a sophisticated attack method that exploits external multifactor authentication (MFA) providers to steal users’ passwords during legitimate login attempts. Dubbed TrustSink by Varonis Threat Labs, this technique can compromise any organization using external MFA providers with Microsoft Entra. The attack works as follows: an attacker with highly privileged access to an … Read more
**Zero-Day PoC Exploits Microsoft Defender, Blocks Updates** A cybersecurity researcher has published a proof-of-concept exploit that takes advantage of a previously unknown vulnerability in Microsoft’s Defender antivirus software. The exploit, dubbed “BigDiskBuster,” allows attackers to block critical updates and potentially gain unauthorized access to compromised systems. The affected parties include anyone running Microsoft Defender on … Read more
A major US government agency, the Federal Bureau of Investigation (FBI), is embroiled in a high-profile cybersecurity incident. According to claims made by the ShinyHunters extortion gang, their cyberattack on the FBI exploited an unpatched zero-day vulnerability in Oracle’s PeopleSoft software, granting them access to sensitive data and internal services. The alleged breach, which took … Read more
Chinese hackers have been exploiting vulnerabilities in popular technologies such as WordPress and ZyXEL switches to steal sensitive government data from thousands of devices worldwide. The hacking campaign, attributed to a threat actor linked to the Red Heron group, has compromised at least 49 organizations across 29 countries, with many more potentially affected. The attackers … Read more
Sweden Fines IT Firm $183,000 Over Massive Data Breach Affecting 2.2 Million People A Swedish software company that provides work environment and HR management systems to municipal authorities has been slapped with a hefty fine of $183,000 for inadequate security measures that led to a massive data breach last year. The incident exposed sensitive information … Read more
A Rogue External MFA Provider Can Steal Passwords During Legitimate Logins Security researchers have developed an attack that allows hackers with privileged access to steal passwords from users during legitimate login attempts. The technique, dubbed TrustSink by Varonis Threat Labs, works by registering a rogue external Multi-Factor Authentication (MFA) provider as a trusted third-party authentication … Read more
A Zero-Day Vulnerability in Microsoft Defender Exposes Millions to Malware Attacks A researcher has publicly released a proof-of-concept (PoC) exploit for a zero-day vulnerability in Microsoft’s Defender antivirus software, which could allow attackers to block critical security updates. The exploit, called BigDiskBuster, targets the Windows operating system and affects millions of users worldwide who rely … Read more
A Critical Flaw in Bifrost AI Gateway Software Allows Unauthenticated Attackers to Execute Commands, Putting Organizations at Risk of Breach A severe vulnerability has been discovered in the Bifrost AI Gateway software, allowing attackers to execute arbitrary commands on vulnerable systems without the need for credentials. The flaw, which affects multiple versions of the software, … Read more
Microsoft has taken down a notorious device-code phishing service called EvilTokens, which was linked to a staggering 12,000 compromised inboxes. This marks a significant victory for the tech giant and its efforts to combat cyber threats. But what exactly is EvilTokens, and why does it matter? EvilTokens was a sophisticated phishing operation that exploited a … Read more