OAuth Grants Pile Up Faster Than You Can Review Them. Here’s Why It Matters. Imagine a scenario where thousands of employees, each making quick decisions to connect their work accounts with various apps, create standing trust relationships that can last indefinitely. This is what happens every day in countless organizations, thanks to the OAuth protocol, … Read more
A Critical Flaw in Nexus Switches Puts Data Centers at Risk Cybersecurity experts are sounding the alarm after Cisco released five critical vulnerability advisories for its NX-OS data center network operating system. The flaws, which allow attackers to run arbitrary code with root privileges on Nexus switches, could have far-reaching consequences if left unpatched. The … Read more
South Korean financial firms are reeling after a sophisticated cyberattack used a cutting-edge AI-powered pentesting tool, ARTEX, to steal sensitive data. The attack highlights the evolving threat landscape and the need for organizations to stay ahead of emerging security risks. The attackers exploited vulnerabilities in identity management systems, allowing them to gain privileged access to … Read more
Ukrainian Government Personnel Hit by Sophisticated Malware Campaign A recent cybersecurity campaign has targeted Ukrainian government personnel with a highly advanced malware strain, dubbed ASHVEIN RAT. What’s striking about this attack is its unique method of command execution, where malicious code is concealed within HTML files. This clever trick allows the attackers to evade traditional … Read more
UK Fashion Retailer ASOS Hit by Social Engineering Attack, Exposing Customer Data ASOS, a leading online fashion retailer based in the UK, has fallen victim to a sophisticated social engineering attack that has resulted in customer data being compromised. The attackers, who claim to be part of a group called “Xuanye Group,” stole an employee’s … Read more
Microsoft Teams Takes a Stand Against Deepfakes and Impersonation Attacks In a major move to bolster meeting security, Microsoft is set to introduce support for third-party deepfake detection tools in its popular collaboration platform, Teams. The new feature, which will become available in November following a global rollout, aims to protect users from sophisticated social … Read more
A Maryland man has been found guilty of stealing over $53 million from a decentralized cryptocurrency exchange, forcing it to shut down due to lack of funds. Jonathan Spalletta, also known online as “Jspalletta” and “Cthulhon,” was convicted of computer fraud and money laundering after hacking Uranium Finance twice in April 2021. Spalletta’s heists were … Read more
A group of malicious Firefox extensions, masquerading as legitimate wallet apps from Rabby and OKX, has been discovered to be stealing users’ recovery phrases. This heinous practice allows attackers to gain unfettered access to victims’ cryptocurrency wallets, leaving their digital assets vulnerable to theft. The malicious extensions, which have been secretly infiltrating browsers for an … Read more
A sophisticated phishing campaign, dubbed “Wazza Phishkit,” has been targeting high-value organizations across the US, EU, and Australia. The attack involves exploiting exposed identities to create active attack paths, which can lead to devastating breaches if not addressed promptly. The Wazza Phishkit campaign appears to be a carefully crafted operation, leveraging identity exposure as its … Read more
Raheim Hamilton, the mastermind behind the notorious Empire Market dark web marketplace, has been handed a 40-year prison sentence for his role in facilitating over $430 million in illicit transactions between 2018 and 2020. The sprawling cybercrime operation, which operated under the radar of law enforcement until its abrupt shutdown in 2020, was a haven … Read more