1+ week, 3+ day ago   (405+ words) A phishing-as-a-service (PaaS) operation has continued generating new campaigns despite a coordinated takedown effort, with more than 700 new phishing pages identified within a month of the disruption. Group-IB said its researchers had tracked the Outsider Phishing Kit, operated by a…...

2+ week, 5+ day ago   (371+ words) A phishing platform dubbed ZeroTokens allows attackers live visibility into victim sessions and the ability to change subsequent prompts in real time, allowing attacks to adapt in real time while targeting credentials and financial information. The platform allowed an operator…...

2+ week, 6+ day ago   (698+ words) The US government has warned organizations of the unique cybersecurity and compliance challenges presented by multi-cloud environments. The National Institute of Standards and Technology (NIST) highlighted how using multiple cloud service providers (CSPs) makes it more difficult for organizations to…...

2+ week, 6+ day ago   (296+ words) Security researchers have claimed that over 9300 leaked AWS keys which surfaced between August 2022 and August 2026 are still active, including hundreds with full admin rights. Truffle Security said its scanners found 64,024 unique AWS key pairs across 431,875 public findings: git history, Hugging…...

3+ week, 2+ day ago   (537+ words) A new version of the notorious Agent Telsa malware contains new features designed to evade detection and steal credentials, KnowBe4 research has identified. The cybersecurity firm provided a detailed analysis of the Agent Tesla version 4 infostealer, which was observed being dropped…...

3+ week, 3+ day ago   (316+ words) Two vulnerabilities in JFrog Artifactory have been found which allow anonymous or low-privileged users to manipulate package metadata without modifying the underlying artifacts, creating a potential route to software supply chain compromise. Oligo Security reported the flaws to JFrog on…...

3+ week, 3+ day ago   (330+ words) Security researchers have warned of a new variant of a prolific Android banking Trojan which substantially expands its potential victim count. ToxicPanda 2.0 was discovered by Zimperium’s zLabs team, the mobile security vendor wrote in a post on August 19. Most notable…...

3+ week, 4+ day ago   (335+ words) A malware-as-a-service (MaaS) campaign has combined ClickFix social engineering with the ErrTraffic delivery service and Cruciferra loader, giving attackers a way to distribute malware while disabling endpoint security processes. In a new advisory published earlier today, eSentire’s Threat Response Unit…...

3+ week, 6+ day ago   (197+ words) Read more on WordPress plugin flaws: Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sites The issue stems from a type confusion error in the plugin’s registration and automatic-login flow. Wordfence, a security plugin for WordPress, found that…...