A malicious browser extension masquerading as “Google Notes” has been discovered intercepting cryptocurrency transactions by automatically replacing wallet addresses copied to the clipboard. The fake extension, distributed through unofficial channels and potentially compromised websites, monitors cl
A lone threat actor successfully published 14 malicious npm packages designed to impersonate legitimate OpenSearch and Elasticsearch libraries. These typosquatting packages contained credential-harvesting code that targeted developers’ authentication tokens and environment variables. The malicious l
CISA has added CVE-2024-48558, a critical path traversal vulnerability in SimpleHelp remote desktop software, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw allows unauthenticated attackers to achieve remote code execution on affected servers. With active exploitation confirmed in th
The FBI has successfully dismantled a sophisticated AI-powered phishing-as-a-service operation that leveraged over one million malicious URLs to target victims globally. This groundbreaking takedown marks one of the first major law enforcement actions against cybercriminal infrastructure enhanced by
Cybercriminals have developed a sophisticated malware distribution campaign embedding the newly discovered Argamal malware within fully functional adult-themed video games. Unlike typical trojanized software that fails to deliver promised functionality, these games work as advertised while silently
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Nobitex, Iran’s largest cryptocurrency exchange, for processing ransomware payments and facilitating malicious cyber operations. The platform allegedly enabled Iranian threat actors to launder proceeds from
Security researchers have disclosed a critical zero-click exploit chain targeting Google Pixel 10 devices that leverages a vulnerability in the Visual Processing Unit (VPU) driver to achieve full root access without user interaction. The attack chain, discovered during internal security testing, com
YARA-X version 1.17.0 has been released with significant performance improvements and important bug fixes. This update to the next-generation YARA rule engine enhances scanning efficiency, resolves several critical bugs affecting rule compilation and execution, and introduces optimizations that bene
Microsoft has released RAMPART and Clarity, two open-source security tools designed to help developers build safer AI agents. RAMPART provides a security testing framework for AI agents, while Clarity offers risk assessment and monitoring capabilities. These tools address growing concerns about AI a
Apple has released a firmware update addressing a critical vulnerability in Beats Studio Buds and Beats Studio Buds+ that allowed nearby attackers to hijack the microphone and eavesdrop on users. The flaw (CVE-2024-54537) affected the Bluetooth pairing process, enabling unauthorized access within Bl