Sophisticated Phishing Campaigns Exploit Microsoft 365 Vulnerabilities
PremiumPasskey-themed phishing campaigns have been used to hijack Microsoft cloud accounts and exfiltrate corporate data.
§Source · The Hacker News
The Hacker News
Every dispatch we have aggregated from The Hacker News.
All dispatchesMonday, September 14
Friday, September 11
Cybercriminals Exploit Infostealer Logs to Bypass MFA with AI Tokens
PremiumInfostealer logs reveal replayable AI tokens and API keys that attackers reuse to access model providers, bypassing MFA protections.
DeepSeek Harness Flaw Exposes AI Agents to Security Risks
PremiumDeepSeek Harness flaw allowed sandboxed AI agents to disable their file sandbox, risking arbitrary access to host files.
Critical cPanel Vulnerability Patched: Root Access Risk Mitigated
PremiumcPanel patched a flaw allowing a hosting account with mail privileges to create files and escalate to root code execution.
F5 BIG-IP APM Malware Conceals PHP Web Shell in Memory to Evade Detection
PremiumMalware tied to F5 BIG-IP APM intrusions injects PHP web shell into memory to evade disk-based detection and persistence.
Critical VPN Certificate Vulnerabilities Patched by Check Point
PremiumCheck Point patches two 9.8 CVSS VPN certificate flaws allowing unauthenticated remote code execution under specific conditions.
AI-Driven Cyber Attack Compromises Hundreds of PaperCut Instances
PremiumActor used hundreds of AI agents to craft exploits for PaperCut NG/MF flaws and breached over 440 vulnerable instances.
Microsoft Sets New Record with Patch Tuesday, Fixes Nearly 1000 Vulnerabilities
PremiumMicrosoft released an unprecedented Patch Tuesday fixing 974 CVEs, including two actively exploited Windows zero-days; prioritize critical updates.
Wednesday, September 9
Hidden ChatGPT Prompt Exploits Gmail Data to Another Account
A planted prompt in ChatGPT could cause hidden actions that read Gmail data and exfiltrate it to another ChatGPT account.
WeChat Zero-Click Vulnerability: A Silent Threat Neutralized
Researchers built a WeChat zero-click worm that takes over accounts via incoming calls without user interaction, spreading across phones.
Critical FreeIPA Security Flaws Allow Unauthorized Access to Administrator Credentials
A FreeIPA flaw chain allows anonymous clients to create Kerberos identities and be added to administrators group via 389-ds bug.
Monday, September 7
REVSTEALER Modules Disrupt Windows Security to Exploit Cryptocurrency Mining
PremiumREVSTEALER-linked modules disable Windows Update and Defender then run a cryptocurrency miner, persisting post-stealer.
MikroTik Routers Vulnerable to Unauthenticated SSH Exploits
PremiumAttackers exploit internet-exposed MikroTik SSH to gain unauthenticated full administrative control of routers.
JetBrains Urges Immediate Action After TeamCity Exploit Breach
PremiumUnpatched TeamCity led to a breach exposing AWS credentials; immediate secret rotation and patching urged.
Critical Zero-Day Vulnerability Threatens Magento and Adobe Commerce Stores
PremiumCritical unauthenticated RCE 'StyleSmuggler' is actively exploited, allowing attackers to backdoor e-commerce stores.
Friday, September 4
Cybercriminals Exploit Brazilian Government Servers to Push Gambling Sites
PremiumGambling Goblin installed malicious Apache modules on Brazilian government and education servers to redirect visitors to betting pages.
Pegasus Spyware Targets Serbian Activists in Zero-Click Attack
PremiumNSO Group Pegasus used an iMessage zero-click exploit to infect a Serbian student activist's iPhone enabling remote surveillance.
FalconFlank Exploit Unveils Privilege Escalation Vulnerability in CrowdStrike Falcon
PremiumResearcher released a FalconFlank PoC showing privilege escalation in CrowdStrike Falcon sensor, creating urgent patch/practice risk.
Wednesday, September 2
Iranian Hackers Exploit Coding Tests to Deploy Cross-Platform Malware
Nimbus Manticore lures developers with fake coding tests to deliver cross-platform RATs (Node.js/JavaScript) for espionage.
Breeze Comet Exploits Brazilian Payment Systems for Fraudulent Gains
Breeze Comet (UNC5669) manipulates Brazilian payment systems to execute fraudulent transfers targeting financial services and retail.
Get these articles delivered to your inbox.
Subscribe free