The Ukrainian cyber threat group UAC-0226 has deployed a sophisticated attack chain dubbed GIFTEDCROOK that exploits WinRAR’s Alternate Data Streams (ADS) handling to deliver a multi-stage malware infection. The campaign leverages reflective DLL loading techniques to deploy an information stealer ta
A critical privilege escalation vulnerability dubbed “DirtyClone” (CVE-2024-43503) has been discovered in the Linux kernel’s packet cloning mechanism. The flaw allows unprivileged local users to gain root access by manipulating cloned network packets, affecting multiple kernel versions. With a CVSS
A massive data breach at a third-party identity verification provider has exposed over one million passport scans and associated personal information online. The compromised data includes full passport images, selfie photos, government-issued ID documents, and personally identifiable information (PI
Miasma, a newly discovered malware strain, has infiltrated the npm ecosystem and GitHub Actions workflows, creating a sophisticated supply chain attack vector. The malware exfiltrates sensitive credentials, manipulates CI/CD pipelines, and establishes persistent backdoors across development environm
Microsoft has identified a sophisticated phishing campaign specifically targeting the hospitality industry. Attackers impersonate guests requesting hotel reservations, delivering malicious ZIP files disguised as photo attachments. These archives contain a Node.js-based implant capable of establishin
A critical authentication bypass vulnerability in Python.org’s API infrastructure allowed attackers to forge admin-level API requests without proper credentials. The flaw exploited weak authentication token validation, enabling potential unauthorized access to administrative functions, user data man
Polymarket, a popular cryptocurrency-based prediction market platform, suffered a security breach resulting in $2.94 million in stolen funds. The incident stemmed from malicious code injected through a compromised third-party vendor, affecting multiple user wallets. This supply chain attack highligh
The Russia-linked Turla APT group has deployed a previously unknown backdoor called STOCKSTAY in targeted espionage operations against Ukrainian entities. Google’s Threat Analysis Group (TAG) identified this sophisticated malware framework featuring modular architecture, encrypted command-and-contro
North Korean threat actors have deployed macOS.Gaslight, a sophisticated malware strain designed to deceive security analysts by manipulating AI-powered analysis tools. The malware employs anti-analysis techniques that specifically target machine learning detection systems, generating false benign i
A newly identified advanced persistent threat actor, tracked as CL-STA-1062, has been conducting a prolonged espionage campaign against government entities and critical infrastructure across Southeast Asia since at least Q3 2023. The threat actor employs custom malware toolsets, sophisticated living