The Chinese-nexus advanced persistent threat group Silver Fox, also tracked as Void Arachne and SwimSnake, is actively targeting Chinese-speaking users and professionals with a sophisticated AtlasCross RAT campaign. Security researcher …
Synology DiskStation Manager Vulnerability Allow Remote Attackers to Execute Arbitrary Commands
A critical security advisory has been issued for a severe vulnerability in DiskStation Manager (DSM) that allows unauthenticated remote attackers to execute arbitrary commands. Given the widespread use of Synology …
Cisco Secure Firewall Vulnerability Allows Remote Code Execution as Root User
Cisco has released an urgent security advisory addressing a critical vulnerability in its Secure Firewall Management Center (FMC) software. This severe flaw allows unauthenticated remote attackers to execute arbitrary code …
Microsoft Entra ID New Feature Removes MFA Limitations for Users
Multifactor authentication operates as a critical defense mechanism for securing user identities against targeted cyber attacks. Microsoft reports that implementing MFA effectively reduces the risk of account compromise by more …
OpenAI Launches AI Safety Bug Bounty to Detect AI-Specific Vulnerabilities
OpenAI has announced the launch of a public Safety Bug Bounty program to identify AI abuse and safety risks across its products. Hosted on Bugcrowd, the new initiative marks a …
New Kiss Loader Malware Uses Early Bird APC Injection in Emerging Attack Campaign
A newly discovered malware loader called Kiss Loader has emerged as a serious threat, using advanced code injection techniques to quietly infiltrate Windows systems without raising alarms. First spotted in …
Fake npm Install Messages Hide RAT Malware in New Open Source Supply Chain Campaign
A new and carefully crafted software supply chain campaign is targeting developers through the npm package registry, using fake installation messages to hide malicious activity. The campaign, which security researchers …
Fake VS Code Security Alerts on GitHub Used to Push Malware in Widespread Phishing Campaign
A large-scale phishing campaign is targeting software developers on GitHub, using fake Visual Studio Code security alerts posted in GitHub Discussions to trick users into downloading malicious software. The attacks …
Ghost SPN Attack Lets Hackers Conduct Stealthy Kerberoasting Under the Radar
A sophisticated evolution of Kerberoasting dubbed the “Ghost SPN” attack that allows adversaries to extract Active Directory credentials while erasing all traces of their activity, rendering traditional detection models effectively …
China-Linked Hackers Breach Southeast Asian Military Systems in Long-Running Spy Campaign
A sophisticated and long-running cyber espionage campaign, tracked as CL-STA-1087, has been quietly targeting military organizations across Southeast Asia since at least 2020. The operation, assessed with moderate confidence to be …