"Newly Patched Critical Microsoft WSUS Flaw Comes Under Attack - Microsoft released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability that has since come under active exploitation in the wild. The vulnerability in question is CVE-2025-59287 (CVSS score: 9.8), a remote code execution flaw in WSUS that was originally fixed by the tech giant as part of its Patch Tuesday update published last week."
"YouTube Ghost Network Delivers Stealer Malware - A malicious network of YouTube accounts has been observed publishing and promoting videos that lead to malware downloads. Active since 2021, the network has published more than 3,000 malicious videos to date, with the volume of such videos tripling since the start of the year. The campaign leverages hacked accounts and replaces their content with "malicious" videos that are centred around pirated software and Roblox game cheats to infect unsuspecting users searching for them with stealer malware."
"Security, trust, and stability - once the pillars of our digital world - are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior. Each new breach proves a harsh truth: in cybersecurity, feeling safe can be far more dangerous than being alert. Here's how that false sense of security was broken again this week."
A critical Windows Server Update Service vulnerability, CVE-2025-59287 (CVSS 9.8), was patched but is being actively exploited to execute arbitrary code on infected hosts. Exploits drop a .NET executable and a Base64-encoded PowerShell payload to run commands. A persistent YouTube ghost network has published over 3,000 malicious videos since 2021, using hacked accounts and content about pirated software and Roblox cheats to distribute stealer malware and attract large audiences. Threat actors tied to North Korea have launched Operation Dream Job targeting European defense-sector companies with tailored job-lure attacks. The overall posture shows attackers leveraging both technical flaws and social engineering.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]