Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
Ameaças Cibernéticas
2119 notícias'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a [...]
PSA: Patch your Plex media server before someone hacks it
A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes.
ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
Drupal corrige falhas críticas de RCE e alerta para exploits
O Drupal publicou correções para duas vulnerabilidades críticas que permitem a execução remota de código em sites que rodam qualquer versão suportada do sistema de gerenciamento de conteúdo. As falhas afetam o módulo Field UI do núcleo do software e o módulo contribuído Entity Li…
Bullhorn takes staffing platform offline to contain cyberattack
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]
F5 corrige falhas críticas no NGINX com patches emergenciais
A F5 publicou correções de segurança fora do ciclo regular para tratar múltiplas falhas no servidor web NGINX, incluindo três vulnerabilidades de severidade crítica que permitem a execução de código em sistemas afetados. Os patches foram divulgados nesta segunda-feira (19) e abra…
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitat…
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]
US Ransomware Negotiator Suspected of Helping ShinyHunters Extort Victims
Federal investigators suspect a US ransomware negotiator helped ShinyHunters operate an extortion site used to pressure nearly 100 organisations.
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on Octo…
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams…
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted co…
F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed …
Fake Calendar Invites Target 40,000 Firms in Microsoft Credential Theft
More than 40,000 organisations have received fake calendar invitations designed to steal Microsoft account credentials, according to new…
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and securit…
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gatew…
Credencial comprometida do ConnectWise foi usada em 173 ambientes Microsoft
Uma credencial comprometida do ConnectWise Cloud Backup, antes chamado SkyKick Backup, foi usada para entrar em ao menos 173 ambientes de parceiros e clientes no Microsoft 365. A Microsoft Threat Intelligence classificou o caso como ataque ativo à cadeia de fornecimento. O acesso…