Aggregator

Lumma Stealer（又名LummaC2）是全球最活跃的信息窃取恶意软件之一。

HackerNews 编译，转载请注明出处： 网络安全公司Malwarebytes最新研究显示，近半数（44%）移动用户每日遭遇诈骗威胁，多数用户担忧重要文件丢失及生产力损失。该公司对美国、英国、奥地利、德国和瑞士的1300名成年人开展调查并发布《点击、滑动、诈骗》报告。 尽管报告聚焦个人安全威胁，但鉴于大量企业允许自带设备（BYOD），这些风险正持续向企业领域蔓延。数据显示美国（51%）和英国（49%）用户风险暴露率最高。 核心发现： 识别难度激增 66%受访者承认难以辨别诈骗与合法通讯，超三分之一（36%）曾因此受害，近五分之一（36%）遭遇过恶意软件感染。 攻击渠道分布 主要威胁渠道包括：电子邮件（65%）、电话（53%）、短信（50%）、社交媒体（47%）、即时通讯软件（40%）及交易平台（36%）。 社会工程主导 53%用户遭遇过社交工程攻击，其中19%受害。这与Zimperium研究相印证：2024年9月数据显示82%钓鱼网站针对移动设备，同年8月每日移动钓鱼攻击峰值超1000次。 勒索威胁蔓延 37%用户遭遇勒索类威胁，17%实际受害，具体包括：勒索软件（25%）、性勒索（24%）、深度伪造诈骗（20%）。值得注意的是，18%用户经历过虚拟绑架威胁。 心理创伤加剧： 75%受害者遭受心理伤害，其中心理健康问题占比46%，勒索骚扰达25%。Malwarebytes高级隐私倡导者David Ruiz指出：“移动威胁既是技术问题，更是人身安全问题。随着深度伪造与AI技术被犯罪者利用，我们需超越意识培养，为用户配备防护工具与知识。数字生活不该以诈骗为代价——无需感到羞耻，我们应让民众自信识别、阻断并举报任何隐私性诈骗。”       消息来源： infosecurity-magazine； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文  

锦行科技上榜数世咨询：《新质·中国数字安全百强（2025）》新质百强！

锦行科技成功入选工业和信息化部人工智能标准化技术委员会（以下简称“人工智能标委会”）成员单位。

6月11日，微软发布了2025年6月份的月度例行安全公告，修复了多款产品存在的67个安全漏洞。

HackerNews 编译，转载请注明出处： 美国立法者向国会提交了一项新的《医疗网络安全法案》，旨在扩大联邦政府在预防和应对美国公民医疗数据泄露事件中的职能范围。 众议员杰森·克罗（民主党，科罗拉多州）于6月10日牵头提出这项两党共同支持的法案，旨在应对美国激增的医疗数据泄露事件。2025年1月披露的数据显示，仅2024年因Change Healthcare勒索软件攻击就导致1.9亿美国公民的个人及医疗数据记录遭受影响，该事件还严重扰乱了患者护理服务。 该法案明确规定网络安全和基础设施安全局（CISA）与美国卫生及公众服务部（HHS）需开展协作，共同提升医疗保健和公共卫生部门的网络安全防护能力。具体合作内容包括： 推动机构间网络威胁情报共享，深化对医疗领域网络风险的理解 CISA为医疗机构所有者及运营方提供风险应对培训 HHS与CISA联合制定针对医疗行业的风险管理计划，评估政府在数据泄露事件全周期中对相关技术、服务及公共设施的安全支持方案 建立医疗领域高风险资产的客观评估标准，并通知相关资产所有者及运营方 CISA定期向国会提交其为医疗和公共卫生部门主动防范网络威胁所提供的支持及行动报告 共同提案人布赖恩·菲茨帕特里克（共和党，宾夕法尼亚州）强调：“这项两党法案采取直接战略行动：授权CISA与HHS开展实时威胁信息共享，扩大医疗服务提供者的网络安全培训，设立专职联络官强化响应机制。我们不仅应对攻击，更在构建防御基础设施以保护患者隐私，捍卫国家安全的生命线。” 2025年1月，HHS宣布计划更新《1996年健康保险流通与责法案》（HIPAA）安全规则，要求医疗服务提供方对受保护的健康信息（PHI）实施强化安全措施，包括为受监管实体设定特定级别的系统访问认证标准，并强制要求持续测试安全防护机制。       消息来源： infosecurity-magazine； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability, which was classified as problematic, has been found in WP-Reply Notify Plugin up to 1.1 on WordPress. Affected by this issue is some unknown functionality of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is handled as CVE-2023-7195. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Ultimate Noindex Nofollow Tool Plugin up to 1.1.2 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability was named CVE-2023-7196. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in aBitGone CommentSafe Plugin up to 1.0.0 on WordPress. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2023-7174. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Marketing Twitter Bot Plugin up to 1.11 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is handled as CVE-2023-7197. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in Allow SVG Plugin up to 1.1 on WordPress. This vulnerability affects unknown code of the component SVG Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2023-6541. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in coreActivity Plugin up to 1.8 on WordPress. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2024-0852. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in LogDash Activity Log Plugin up to 1.1.3 on WordPress. Affected is an unknown function. The manipulation of the argument Username leads to sql injection. This vulnerability is traded as CVE-2023-6030. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Easy Digital Downloads Google Sheet Connector Plugin up to 1.6.5/1.6.6 on WordPress. Affected is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2023-2334. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in Zimbra Collaboration Suite up to 10.1. Affected by this vulnerability is an unknown functionality of the file /service/extension/graphql of the component Webmail. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2025-32354. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. This vulnerability is traded as CVE-2025-4215. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in WolfNet IDX for Plugin up to 1.19.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2023-6783. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Synacor Zimbra Collaboration Suite. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-45516. It is possible to launch the attack remotely. There is no exploit available.

HackerNews 编译，转载请注明出处： 威胁情报公司GreyNoise警告称，近期出现针对Apache Tomcat Manager接口的“协同暴力破解活动”。 该公司指出，2025年6月5日观察到暴力破解和登录尝试激增，表明这可能是“大规模识别和访问暴露Tomcat服务”的有组织行动。当日共发现295个独立IP地址参与针对Tomcat Manager的暴力破解尝试，均被归类为恶意地址。过去24小时内记录到188个独立IP，主要位于美国、英国、德国、荷兰和新加坡。 同期还监测到298个独立IP对Tomcat Manager实例发起登录尝试。过去24小时标记的246个IP地址均属恶意，来源地相同。攻击目标同期覆盖美国、英国、西班牙、德国、印度和巴西。GreyNoise强调大部分活动源自DigitalOcean（ASN 14061）托管的基础设施。 “尽管未关联特定漏洞，此行为表明暴露的Tomcat服务持续受到关注”，该公司补充道，“此类广泛的投机活动通常是未来攻击的前兆。” 建议暴露Tomcat Manager接口的组织实施强认证和访问限制，并监控可疑活动迹象。 此披露之际，Bitsight公司发现互联网上暴露超4万台监控摄像头，可能允许任何人通过HTTP或实时流协议（RTSP）访问实时视频。暴露设备集中在美国、日本、奥地利、捷克和韩国。电信行业占暴露摄像头的79%，其次是科技（6%）、媒体（4.1%）、公用事业（2.5%）、教育（2.2%）、商业服务（2.2%）和政府（1.2%）。这些设备分布在住宅、办公室、公共交通系统和工厂等场所，无意中泄露敏感信息，可能被用于间谍活动、跟踪和勒索。 建议用户修改默认账户密码，非必要则禁用远程访问（或通过防火墙和VPN限制访问），并保持固件更新。“这些用于安保或便利的摄像头，无意间成为敏感空间的公开窗口，且所有者往往毫不知情”，安全研究员João Cruz在报告中表示，“无论安装目的为何，设备即插即用的简易性正是威胁持续存在的主因。”       消息来源： thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文  

A vulnerability was found in Microsoft Windows. It has been declared as critical. This vulnerability affects unknown code of the component Recovery Driver. The manipulation leads to link following. This vulnerability was named CVE-2025-32721. Attacking locally is a requirement. There is no exploit available. It is recommended to apply a patch to fix this issue.