Cyber Security News

A new tool named GhostLocker has been released, demonstrating a novel technique to neutralize Endpoint Detection and Response (EDR) systems by weaponizing the native Windows AppLocker feature. Developed by security researcher zero2504, the tool highlights a fundamental architectural vulnerability in modern EDR solutions: their reliance on userland components for analysis and reporting.​ Unlike traditional EDR […]

The post New GhostLocker Tool that Uses Windows AppLocker to Neutralize and Control EDR appeared first on Cyber Security News.

Two fake Chrome extensions named “Phantom Shuttle” are deceiving thousands of users by posing as legitimate VPN services while secretly intercepting their web traffic and stealing sensitive login information. These malicious extensions, active since 2017, have been distributed to over 2,180 users through the Chrome Web Store, where they continue to operate undetected. The threat […]

The post Malicious Chrome Extensions as VPN Intercept User Traffic to Steal Credentials appeared first on Cyber Security News.

BlindEagle, a South American threat group, has launched a sophisticated campaign against Colombian government agencies, demonstrating an alarming evolution in attack techniques. In early September 2025, the group targeted a government agency under the Ministry of Commerce, Industry and Tourism (MCIT) using coordinated phishing emails and multi-stage malware delivery. This attack represents a significant escalation […]

The post BlindEagle Hackers Attacking Government Agencies with Powershell Scripts appeared first on Cyber Security News.

A proof-of-concept (PoC) exploit has been publicly released for CVE-2025-38352, a race condition vulnerability affecting the Linux kernel’s POSIX CPU timer implementation. The flaw enables attackers to trigger use-after-free conditions in kernel memory, potentially leading to privilege escalation and system compromise. CVE-2025-38352 is a race condition that occurs in the kernel’s handle_posix_cpu_timers() function, which processes timer signals […]

The post PoC Exploit Released for Use-After-Free Vulnerability in Linux Kernel’s POSIX CPU Timers Implementation appeared first on Cyber Security News.

Microsoft has patched a significant use-after-free vulnerability in its Brokering File System (BFS) driver, tracked as CVE-2025-29970. The flaw enables local attackers to escalate privileges on Windows systems running isolated or sandboxed applications, making it a notable concern for enterprise security. The vulnerability exists in bfs.sys, a minifilter driver developed alongside Windows AppContainer and AppSilo, […]

The post Microsoft Brokering File System Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

Nissan Motor Corporation has publicly confirmed a significant data breach stemming from unauthorized access to Red Hat servers. Managed by a third-party contractor responsible for developing a customer management system. The incident exposed personal information for approximately 21,000 Nissan Fukuoka Sales Co., Ltd. customers. Red Hat, the contracted service provider, detected the unauthorized server access […]

The post Nissan Confirms Data Breach Following Unauthorized Access to Red Hat Servers appeared first on Cyber Security News.

The campaign is run by the SideWinder advanced persistent threat group and aims to plant a silent Windows backdoor on victim machines. Once active, the malware can steal files, capture data and give remote control to the attacker. Each attack starts with a tax-themed email that urges the victim to review an inspection document. The […]

The post SideWinder APT Hackers Attacking Indian Entities by Masquerading as the Income Tax Department of India appeared first on Cyber Security News.

A significant security vulnerability has emerged affecting motherboards from Gigabyte, MSI, ASRock, and ASUS. Riot Games analysts and researchers identified a critical flaw during their ongoing investigation into gaming system security. The vulnerability, termed “Sleeping Bouncer,” exploits a weakness in the pre-boot protection mechanisms that are supposed to safeguard computer hardware during system initialization. The […]

The post Sleeping Bouncer Vulnerability Impacts Motherboards from Gigabyte, MSI, ASRock and ASUS appeared first on Cyber Security News.

Docker has announced a significant shift in its container security strategy, making its Docker Hardened Images (DHI) freely available to all developers. Previously a commercial-only offering, DHI provides a set of secure, minimal, and production-ready container images. By releasing these under an Apache 2.0 license, Docker aims to combat the rising tide of software supply chain attacks, which […]

The post Docker Open Sources Production-Ready Hardened Images for Free appeared first on Cyber Security News.

The threat actor group known as Arcane Werewolf, also tracked as Mythic Likho, has refreshed its attack capabilities by deploying a new version of its custom malware called Loki 2.1. During October and November 2025, researchers observed this group launching campaigns specifically targeting Russian manufacturing companies. The group continues to refine its tactics, showing a […]

The post Arcane Werewolf Hacker Group Added Loki 2.1 Malware Toolkit to their Arsenal appeared first on Cyber Security News.

A sophisticated new Android malware family called Wonderland has emerged as a significant threat to users in Uzbekistan and the broader Central Asia region. The malware, which specializes in stealing SMS messages and intercepting one-time passwords, represents a major escalation in mobile threats targeting financial systems. First discovered in October 2025, this advanced stealer demonstrates […]

The post New Wonderland Android Malware with Bidirectional SMS-Stealing Capabilities Stealing OTPs appeared first on Cyber Security News.

Cybercriminals are increasingly weaponizing legitimate Microsoft infrastructure to bypass security filters and trick users into falling for Telephone-Oriented Attack Delivery (TOAD) scams. By abusing the default .onmicrosoft.com When domains are assigned to Azure tenants, attackers send malicious invites that appear to originate from trusted Microsoft addresses. The attack vector is deceptively simple yet highly effective. […]

The post Hackers Exploiting .onmicrosoft.com Domains to Launch TOAD Scam Attack appeared first on Cyber Security News.

A newly discovered attack technique has exposed a critical weakness in artificial intelligence code assistants by weaponizing their built-in safety features. The attack, known as Lies-in-the-Loop, manipulates the trust users place in approval dialogs that are designed to prevent harmful operations from running without explicit permission. The vulnerability targets Human-in-the-Loop controls, which act as a […]

The post Lies-in-the-Loop Attack Turns AI Safety Dialogs into Remote Code Execution Attack appeared first on Cyber Security News.

Security researchers at the National Institute of Standards and Technology (NIST) have uncovered critical security flaws in the Exim mail server. That could allow remote attackers to take complete control of vulnerable systems. The vulnerabilities affect Exim version 4.99 when configured with SQLite hints database support, exposing thousands of mail servers to potential compromise. Two […]

The post Multiple Exim Server Vulnerabilities Let Attackers Seize Control of the Server appeared first on Cyber Security News.

Threat actors are now targeting Microsoft 365 accounts using a growing attack method known as OAuth device code phishing. This technique takes advantage of the OAuth 2.0 device authorization flow, a legitimate Microsoft feature designed for devices with limited input options. Attackers trick users into entering codes on authentic Microsoft login pages, which grants them […]

The post Hackers Using Phishing Tools to Access M365 Accounts via OAuth Device Code appeared first on Cyber Security News.

The Shadowserver Foundation identified approximately 125,000 WatchGuard Firebox firewall devices worldwide at risk due to a critical vulnerability actively exploited. The flaw, tracked as CVE-2025-14733, enables unauthenticated remote attackers to execute arbitrary code on unpatched devices with minimal effort.​ The vulnerability stems from an out-of-bounds write flaw in the WatchGuard Fireware OS IKEv2 VPN key […]

The post 125,000 IPs WatchGuard Firebox Devices Exposed to Internet Vulnerable to 0-day RCE Attacks appeared first on Cyber Security News.

Microsoft is set to enhance the security integration between Microsoft Teams and Microsoft Defender for Office 365 with a new feature rolling out next month. According to a new notification in the Microsoft 365 Message Center (MC1200058), security administrators will soon be able to manage blocked external users in Teams directly through the Tenant Allow/Block […]

The post Now Admins Can Block External Users in Microsoft Teams From Defender Portal appeared first on Cyber Security News.

Cyber criminals are changing their tactics by recruiting insiders within organizations instead of relying on traditional attack methods like brute force or social engineering. Recent findings show that employees in banks, telecom companies, and technology firms are being approached through darknet forums to sell access to corporate networks, user devices, and cloud systems. The payouts […]

The post Threat Actors are Hiring Insiders in Banks, Telecoms, and Tech from $3,000 to $15,000 for Access or Data appeared first on Cyber Security News.

A new and ominous player has emerged in the rapidly expanding landscape of “Shadow AI.” Researchers at Resecurity have identified DIG AI, an uncensored artificial intelligence tool hosted on the darknet that is empowering threat actors to automate cyberattacks, generate illicit content, and bypass the safety guardrails of traditional AI models. First detected on September […]

The post DIG AI – Darknet AI Tool Enabling Threat Actors to Launch Sophisticated Attacks appeared first on Cyber Security News.

The U.S. Department of Justice (DOJ) has charged 54 individuals in a sweeping crackdown on a transnational cyber-physical attack network. The indictments, announced by U.S. Attorney Lesley A. Woods, allege a massive conspiracy involving “ATM jackpotting” to fund Tren de Aragua (TdA), a designated Foreign Terrorist Organization. The coordinated operation targeted a sophisticated criminal ring […]

The post U.S. DOJ Charged 54 in Connection With ATM Hacking Attack by Deploying Ploutus Malware appeared first on Cyber Security News.