Windows Hello Bypass Fools Biometrics Safeguards in PCs
A Windows security bug would allow an attacker to fool a USB camera used in the biometric facial-recognition aspect of the system. [...]
Showing only posts in Threatpost. Show all posts.
Microsoft Crushes 116 Bugs, Three Actively Exploited
Microsoft tackles 12 critical bugs, part of its July 2021 Patch Tuesday roundup, capping a ‘PrintNightmare’ month of headaches for system admins. [...]
Ransomware Giant REvil’s Sites Disappear
Just days after President Biden demanded that Russian President Putin shut down ransomware groups, the servers of one of the biggest groups mysteriously went dark. [...]
Guess Fashion Brand Deals With Data Loss After Ransomware Attack
An attack on Guess compromised the personal and banking data of 1,300 victims. [...]
Unpatched Critical RCE Bug Allows Industrial, Utility Takeovers
The 'ModiPwn' bug lays open production lines, sensors, conveyor belts, elevators, HVACs and more that use Schneider Electric PLCs. [...]
Adobe Patches 11 Critical Bugs in Popular Acrobat PDF Reader
Adobe July patch roundup includes fixes for its ubiquitous and free PDF reader Acrobat 2020 and other software such as Illustrator and Bridge. [...]
‘Charming Kitten’ APT Siphons Intel From Mid-East Scholars
Professors, journalists and think-tank personnel, beware strangers bearing webinars: It’s the focus of a particularly sophisticated, and chatty, phishing campaign. [...]
Is Remote Desktop Protocol Secure? It Can Be
Matt Dunn, associate managing director in Kroll's Cyber Risk practice, discusses options for securing RDP, which differ significantly in terms of effectiveness. [...]
New CISA Director Confirmed, White House Gains Cyber-Director
Jen Easterly, former NSA official and Morgan Stanley vet, will take up the lead at CISA as the ransomware scourge rages on. [...]
SolarWinds Issues Hotfix for Zero-Day Flaw Under Active Attack
Microsoft alerted the company to a security vulnerability in its Serv-U Managed File Transfer and Secure FTP products that a cyberattacker is using to target a “limited” amount of customers. [...]
BIOPASS RAT Uses Live Streaming Steal Victims’ Data
The malware has targeted Chinese gambling sites with fake app installers. [...]
WordPress File Management Plugin Riddled with Critical Bugs
The bugs allow a range of attacks on websites, including deleting blog pages and remote code execution. [...]
Critical RCE Vulnerability in ForgeRock OpenAM Under Active Attack
The attacks are enabled by a now-patched vulnerability in ForgeRock's Access Management, a popular platform that front-ends web apps and remote-access setups. [...]
Kaseya Patches Zero-Days Used in REvil Attacks
The security update addresses three VSA vulnerabilities used by the ransomware gang to launch a worldwide supply-chain attack on MSPs and their customers. [...]
Cyber Polygon 2021: Towards Secure Development of Digital Ecosystems
Cybersecurity is one of the most important topics on the global agenda, boosted by the pandemic. As the global digitalisation is further accelerating, the world is becoming ever more interconnected. Digital ecosystems are being created all around us: countries, corporations and individuals are taking advantage of the rapid spread …
Microsoft Office Users Warned on New Malware-Protection Bypass
Word and Excel documents are enlisted to disable Office macro warnings, so the Zloader banking malware can be downloaded onto systems without security tools flagging it. [...]
Cisco BPA, WSA Bugs Allow Remote Cyberattacks
The high-severity security vulnerabilities allow elevation of privileges, leading to data theft and more. [...]
Lazarus Targets Job-Seeking Engineers with Malicious Documents
Notorious North Korean APT impersonates Airbus, General Motors and Rheinmetall to lure potential victims into downloading malware. [...]
Oil & Gas Targeted in Year-Long Cyber-Espionage Campaign
A global effort to steal information from energy companies is using sophisticated social engineering to deliver Agent Tesla and other RATs. [...]
Coursera Flunks API Security Test in Researchers’ Exam
The problem APIs included numero uno on the OWASP API Security Top 10: a Broken Object Level Authorization (BOLA) issue that could have exposed personal data. [...]
How Fake Accounts and Sneaker-Bots Took Over the Internet
Jason Kent, hacker-in-residence at Cequence Security, discusses fake online accounts, and the fraud they carry out on a daily basis. [...]
Critical Sage X3 RCE Bug Allows Full System Takeovers
Security vulnerabilities in the ERP platform could allow attackers to tamper with or sabotage victims' business-critical processes and to intercept data. [...]
MacOS Targeted in WildPressure APT Malware Campaign
Threat actors enlist compromised WordPress websites in campaign targeting macOS users. [...]
Suspected ‘Dr HeX’ Hacker Busted for 9 Years of Phishing
The unnamed suspect allegedly helped to develop carding and phishing kits with the aim of stealing customers' bank-card data. [...]
Fake Kaseya VSA Security Update Drops Cobalt Strike
Threat actors are planting Cobalt Strike backdoors by malspamming a bogus Microsoft update along with a SecurityUpdates.exe. [...]
« newer articles | page 40 | older articles »