Unit 42 researchers have observed a threat actor group known as JavaGhost exploiting misconfigurations in Amazon Web Services (AWS) environments to conduct sophisticated phishing campaigns. Active for over five years, JavaGhost has pivoted from website defacement to leveraging compromised cloud infrastructure for financial gain. The group’s attacks stem from exposed long-term AWS access keys, which […]
The post JavaGhost: Exploiting Amazon IAM Permissions for Phishing Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
MediaTek has issued urgent security advisories warning of multiple high-severity vulnerabilities in its system-on-chip (SoC) architectures, including flaws that enable local privilege escalation (LPE) and remote code execution (RCE). The March 2025 Product Security Bulletin highlights three high severity vulnerabilities CVE-2025-20644, CVE-2025-20645, and CVE-2025-20646—affecting modem firmware, cryptographic key management, and Wi-Fi subsystems. These vulnerabilities impact […]
The post MediaTek Warns of Multiple Vulnerabilities that let Attackers Escalate Privileges appeared first on Cyber Security News.
A newly disclosed edge case in Substack’s custom domain implementation allows threat actors to hijack inactive subdomains, potentially enabling content spoofing, phishing campaigns, and brand impersonation. The researcher identified 1,426 vulnerable domains – representing 8% of all Substack-associated custom domains – that remain exposed due to misconfigured DNS records, including 11 wildcard domains that exponentially […]
The post New Vulnerability in Substack let Attackers Take Over Subdomains appeared first on Cyber Security News.
If a company has effective insurance, prevention becomes even less cost-effective. By failing to “value” privacy alone, the system skews in favor of not protecting privacy.
The post DOGE Access to Personal Information and The Difficulty of Showing Harm in Privacy Litigation appeared first on Security Boulevard.