Chrome Stable for iOS Update - Hi everyone! We've just released Chrome Stable 156 (156.0.8078.46) for iOS; it'll become available on App Store in the next few hours.
Hackers hijack AOMEI update servers to secretly spread malware - Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories - The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals...
Irish police force has its Twitter hacked in cryptocurrency scam - There must have been red faces in the social media department of Ireland's police headquarters after two of its accounts were hijacked this week. Read more in my article on the Hot for Security blog.
CrowdStrike Achieves NCSC CIR Enhanced Level Assurance - Some cyber incidents leave no margin for error, whether that's an attack that interrupts energy, water, or financial services, or a breach that triggers reporting obligations in several jurisdictions […]
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware - An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the...
Get a free 30-day browser security assessment from Push Security - See what your other tools miss: phishing that bypasses email security and MFA, ClickFix lures, unsanctioned AI tools, sensitive data shared through uploads and pastes, risky and malicious extensions, breached passwords, accounts with weak or missing MFA, and more.
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software - The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any...
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor - Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves...
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site - U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close...
Krybit ransomware: what you need to know - Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.
You would deprive us of your talents at this time? -Duke Leto Atreides
