Chrome Store Scammers Game Search Results with Hidden Translation Spam
Developers are exploiting Chrome Web Store's translation feature to promote questionable extensions through deceptive keyword stuffing in foreign language descriptions. Over 900 extensions were found using these tactics to manipulate search rankings, raising security concerns.
Fickle Stealer: New Rust-Based Malware Emerges with Advanced Data Theft Capabilities
A sophisticated new malware called Fickle Stealer has emerged, utilizing multiple distribution methods and advanced evasion techniques to steal sensitive data. Written in Rust, this evolving threat can dynamically adjust its targeting while employing self-protection mechanisms to avoid detection.
Chinese Hackers Target Japan in Long-Running Cyber Espionage Campaign
Japanese authorities reveal MirrorFace, a China-linked threat actor, has conducted sophisticated cyberattacks against critical sectors since 2019. The campaign deployed advanced malware and evasion techniques to target government agencies, think tanks, and technology sectors, highlighting persistent threats to national security.
Critical Vulnerability in KerioControl Firewalls Puts Thousands of Systems at Risk
A dangerous security flaw in GFI KerioControl firewalls allows attackers to remotely execute code and potentially take control of affected systems. Over 23,800 exposed instances are at risk across multiple countries, with active exploitation attempts already detected from Asia.
Critical SonicWall Firewall Vulnerability Requires Immediate Patching
SonicWall has disclosed a high-severity authentication bypass flaw in SonicOS that threatens SSL VPN and SSH management functions. The company has released urgent patches and mitigation guidance for affected firewall models to prevent potential exploitation.
Malicious PhishWP Plugin Targets WordPress E-commerce Payment Data Through Fake Checkouts
A sophisticated WordPress plugin called PhishWP has emerged on Russian cybercrime forums, creating deceptive payment gateways to steal customer payment data through fake checkout pages. The malware includes advanced features like OTP functionality and real-time data transmission via Telegram, highlighting growing e-commerce security threats.
Critical Security Flaw in Popular WordPress Backup Plugin Threatens Millions of Sites
A severe vulnerability discovered in UpdraftPlus WordPress plugin puts over 3 million websites at risk of code execution attacks. The high-severity flaw affects all versions up to 1.24.11 and requires immediate updating to the patched version.
New Android Malware 'FireScam' Masquerades as Telegram Premium to Steal User Data
A sophisticated Android malware dubbed FireScam is targeting users by impersonating Telegram Premium through a fake Russian app store. The malware steals sensitive data, monitors device activity, and maintains persistent remote control while employing advanced evasion techniques.
Cryptocurrency Mining Malware Infiltrates Home Server Through Exposed Docker Container
A cybersecurity researcher's personal server was hijacked by Kinsing malware after briefly exposing a Docker database container online. The incident highlights critical security lessons for home server administrators and the growing sophistication of threats targeting personal networks.
Critical Windows Domain Controller Exploit Revealed: LDAPNightmare PoC Triggers System Crashes
A new proof-of-concept exploit called LDAPNightmare demonstrates how attackers can crash Windows domain controllers through LDAP vulnerability CVE-2024-49113. The exploit forces system reboots by crashing LSASS, with potential for remote code execution if systems remain unpatched.