September 16, 2024 at 01:21AM Cybersecurity researchers have identified ongoing phishing campaigns using HTTP header refresh entries to deliver fake email login pages, targeting large corporations in South Korea, U.S. government agencies, and schools. These attacks encompass various sectors and are part of a growing trend of sophisticated tactics to trick recipients and steal sensitive … Read more
February 26, 2024 at 03:05PM Threat actors are exploiting an outdated CMS editor to compromise education and government entities worldwide. Attackers abuse open redirects for phishing, distributing malware, or scamming users while appearing to originate from legitimate domains. The campaign targets educational institutions, government, and corporate sites, using the outdated FCKeditor plugin. The compromised instances … Read more
January 9, 2024 at 10:41AM Attackers are distributing Lumma Stealer through YouTube channels featuring cracked application tutorials, using open source platforms to bypass web filters. The malware targets sensitive user information and is spread through malicious URLs in YouTube descriptions. Fortinet researchers outlined the attack process and advised caution regarding application downloads to avoid malware … Read more
December 5, 2023 at 05:51PM Cornell researchers will demonstrate at Black Hat Europe 2023 that malicious instructions hidden within images and audio clips can be used to manipulate AI chatbot responses, leading to indirect prompt injection attacks. This can result in harmful actions like redirecting to malicious URLs or extracting personal information without users realizing, … Read more
November 16, 2023 at 11:45AM Google’s Threat Analysis Group (TAG) has disclosed that a zero-day exploit in Zimbra Collaboration Suite was used to steal email data from government organizations worldwide. The vulnerability (CVE-2023-37580) was made public in July, and it allows attackers to execute malicious code through specially crafted URLs sent via email. Google observed … Read more