#hijack-loader
#hijack-loader
[ follow ]
#cybersecurity #malware #supply-chain-attack #data-breach #axios #ransomware #north-korea #vulnerabilities #phishing
fromTheregister
4 days agoTop npm package backdoored to drop dirty RAT on dev machines
The attackers swapped the account's email address for an anonymous ProtonMail inbox and pushed the infected packages manually via the npm CLI, completely bypassing the project's GitHub Actions CI/CD pipeline and the safeguards developers tend to assume are in place.
Node JS
Artificial intelligence
fromFuturism
1 month agoAI Tools Are Supercharging Hackers
AI systems are increasingly weaponized for cybercrime, enabling hackers to exploit vulnerabilities at scale with minimal technical expertise, as demonstrated by recent attacks on Mexican government networks and global firewall systems.
fromComputerworld
1 day agoA core infrastructure engineer pleads guilty to federal charges in insider attack
Rhyne's attack involved unauthorized remote desktop sessions, deletion of network administrator accounts, and changing of passwords, showcasing significant security vulnerabilities.
Information security
fromThe Hacker News
3 days agoNew Chrome Zero-Day CVE-2026-5281 Under Active Exploitation - Patch Released
"Use-after-free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page."
Information security
fromArs Technica
1 week agoSelf-propagating malware poisons open source software and wipes Iran-based machines
CanisterWorm, as Aikido has named the malware, targets organizations' CI/CD pipelines used for rapid development and deployment of software. Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector.
Information security
fromWIRED
2 weeks agoUS Takes Down Botnets Used in Record-Breaking Cyberattacks
The US Department of Justice, working with the cybercrime-fighting agency within the US Department of Defense known as the Defense Criminal Investigative Service, announced that it had dismantled four massive botnets in a single operation, removing the command-and-control servers used to commandeer the hacker-run armies of compromised devices known by the names JackSkid, Mossad, Aisuru, and Kimwolf.
Information security
fromThe Hacker News
2 weeks ago54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security
Ransomware gangs, especially those with ransomware-as-a-service (RaaS) programs, frequently produce new builds of their encryptors, and ensuring that each new build is reliably undetected can be time-consuming. More importantly, encryptors are inherently very noisy (as they inherently need to modify a large number of files in a short period); making such malware undetected is rather challenging.
Information security
Information security
fromThe Hacker News
2 weeks agoLeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader
LeakNet ransomware group uses ClickFix social engineering via compromised websites for initial access, employing a Deno-based C2 loader to execute payloads in memory, followed by consistent post-exploitation sequences detectable before ransomware deployment.
#phishing-attack
Information security
fromSecuritymagazine
2 weeks agoTargeted Phishing Attack Breaches Biotech Company Data
Intuitive Surgical suffered a phishing attack compromising employee credentials, exposing customer and corporate data, though operational systems and customer networks remained unaffected due to network segmentation.
Information security
fromSecurityWeek
2 weeks agoSecurity Firm Executive Targeted in Sophisticated Phishing Attack
A C-level executive at Outpost24 was targeted by a sophisticated phishing attack using the Kratos phishing-as-a-service kit that exploited legitimate services like Cisco and Nylas to bypass security defenses.
Information security
fromThe Hacker News
1 month agoScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks
North Korean threat actor ScarCruft deployed the Ruby Jumper campaign using malware families that abuse Zoho WorkDrive for C2 communications and removable media to compromise air-gapped networks.
fromZDNET
1 month agoThis new 'sleeperware' doesn't set off alarms or crash your system - it sneaks in and waits
In its annual Red Report, a body of research that analyzes real-world attacker techniques using large-scale attack simulation data, Picus Labs warns cybersecurity professionals that threat actors are rapidly shifting away from ransomware encryption to parasitic "sleeperware" extortion as their means to loot organizations for millions of dollars per attack. Released today and now in its sixth year, the 278-page Red Report gets its name from Picus-organized cybersecurity exercises that take the perspective of the attacker's team, otherwise known as the "red team."
Information security
[ Load more ]