#Malware
#Malware
[ follow ]
#cybersecurity #phishing #npm #supply-chain-attack #social-engineering #cybercrime #cyber-espionage #ransomware
fromThe Hacker News
1 week agonpm, PyPI, and RubyGems Packages Found Sending Developer Data to Discord Channels
Webhooks on Discord are a way to post messages to channels in the platform without requiring a bot user or authentication, making them an attractive mechanism for attackers to exfiltrate data to a channel under their control. "Importantly, webhook URLs are effectively write-only," Socket researcher Olivia Brown said in an analysis. "They do not expose channel history, and defenders cannot read back prior posts just by knowing the URL."
Information security
fromZDNET
2 weeks agoAI is making cybercriminal workflows more efficient too, OpenAI finds
OpenAI has published research revealing how state-sponsored and cybercriminal groups are abusing artificial intelligence (AI) to spread malware and perform widespread surveillance. (Disclosure: Ziff Davis, ZDNET's parent company, filed an April 2025 lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.) AI has benefits in the cybersecurity space; it can automate tedious and time-consuming tasks, freeing up human specialists to focus on complex projects and research, for example.
Information security
Information security
fromIT Pro
4 weeks agoHackers are disguising malware as ChatGPT, Microsoft Office, and Google Drive to dupe workers
SMBs in Europe and parts of Africa face malware and PUAs disguised as trusted tools, necessitating stronger employee training, authentication, patching, and secure software sourcing.
Information security
fromIT Pro
1 month agoMobile app security is a huge blind spot for developer teams - 93% are confident their applications are secure, but 62% reported breaches last year
Organizations overestimate mobile app security readiness despite widespread breaches, accelerated release pressures, and frequent malware, data loss, and credential-theft incidents.
fromThe Hacker News
2 months agoNoodlophile Malware Campaign Expands Global Reach with Copyright Phishing Lures
The Noodlophile campaign, active for over a year, now leverages advanced spear-phishing emails posing as copyright infringement notices, tailored with reconnaissance-derived details like specific Facebook Page IDs and company ownership information.
Information security
Privacy technologies
fromThe Hacker News
2 months agoSocGholish Malware Spread via Ad Tools; Delivers Access to LockBit, Evil Corp, and Others
SocGholish malware utilizes Traffic Distribution Systems to redirect users to malicious content and has a Malware-as-a-Service model for cybercriminal operations.
fromThe Hacker News
2 months agoClickFix Malware Campaign Exploits CAPTCHAs to Spread Cross-Platform Infections
"Like a real-world virus variant, this new 'ClickFix' strain quickly outpaced and ultimately wiped out the infamous fake browser update scam that plagued the web just last year."
Privacy professionals
fromThe Hacker News
3 months agoCritical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Global Organizations
A critical security vulnerability in Microsoft SharePoint Server, tracked as CVE-2025-53770 with a CVSS score of 9.8, has been weaponized in a large-scale exploitation campaign.
Information security
fromThe Hacker News
3 months agoGoogle Sues 25 Chinese Entities Over BADBOX 2.0 Botnet Affecting 10M Android Devices
"The BADBOX 2.0 botnet compromised over 10 million uncertified devices running Android's open-source software (Android Open Source Project), which lacks Google's security protections."
Privacy professionals
[ Load more ]