Malware & Threats
Patch Tuesday: Microsoft ships urgent cover for another WIndows CLFS vulnerability already exploited in the wild.
Hi, what are you looking for?
SecurityWeek
Malware & Threats
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Malware & Threats
The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.
Malware & Threats
Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms.
Malware & Threats
The Adobe Patch Tuesday rollout covers 54 vulnerabilities, including code execution issues in the oft-targeted Adobe ColdFusion software.
Artificial Intelligence
San Francisco smart contract security startup closes a $6.75 million seed funding round led by Archetype and Winklevoss Capital.
Malware & Threats
Huntress has shared details on the post-exploitation activities of threat actors targeting the recent CrushFTP vulnerability.
Malware & Threats
US and allied countries warn of threat actors using the “fast flux” technique to change DNS records and hide malicious servers’ locations.
Malware & Threats
Ivanti misdiagnoses a remote code execution vulnerability and Mandiant reports that Chinese hackers are launching in-the-wild exploits.
Malware & Threats
An undocumented remote access backdoor in the Unitree Go1 Robot Dog allows remote control over the tunnel network and use of the vision cameras...
Malware & Threats
Sucuri has discovered multiple malware families deployed in the WordPress mu-plugins directory to evade routine security checks.
Malware & Threats
The newly identified Android banking trojan Crocodilus takes over devices, enabling overlay attacks, remote control, and keylogging.
Malware & Threats
CISA has published its analysis of Resurge, a SpawnChimera malware variant used in attacks targeting a recent Ivanti Connect Secure zero-day.
Malware & Threats
Nearly a dozen crypto packages on NPM, including one published 9 years ago, have been hijacked to deliver infostealers.
Malware & Threats
The Grandoreiro banking trojan has reemerged in new campaigns targeting users in Latin America and Europe.
Malware & Threats
Exploitation of Windows MMC zero-day is being pinned on a ransomware gang known as EncryptHub (an affiliate of RansomHub)
Malware & Threats
AMTSO has developed a Sandbox Evaluation Framework to standardize the testing of malware analysis solutions.
Malware & Threats
macOS users are targeted with multiple versions of the ReaderUpdate malware written in Crystal, Nim, Rust, and Go programming languages.
Malware & Threats
Weaver Ant, a cyberespionage-focused APT operating out of China, is targeting telecom providers for persistent access.
Malware & Threats
The Medusa ransomware relies on a malicious Windows driver to disable the security tools running on the infected systems.
Malware & Threats
Over 300 malicious applications displaying intrusive full-screen interstitial video ads amassed more than 60 million downloads on Google Play.
Malware & Threats
Chinese hacking group MirrorFace has targeted a Central European diplomatic institute with the Anel backdoor and AsyncRAT.
Malware & Threats
Microsoft has shared details on StilachiRAT, an evasive and persistent piece of malware that facilitates sensitive data theft.
Join this live webinar for a practical framework for evolving your AI security program from a single application to an enterprise AI ecosystem and autonomous agents.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)