Experts at Red Canary have uncovered an unusual campaign leveraging a newly identified strain of malware, DripDropper, specifically targeting cloud-based Linux servers. The attackers gained initial access through CVE-2023-46604 in Apache ActiveMQ, after which...
The post The DripDropper Paradox: Why Attackers Are Patching the Vulnerabilities They Exploit appeared first on Penetration Testing Tools.
Cybersecurity researchers are highlighting a dangerous attack technique that combines rogue IPv6 configuration with NTLM credential relay to achieve complete Active Directory domain compromise, exploiting default Windows configurations that most organizations leave unchanged. Attack Leverages Default Windows IPv6 Behavior The MITM6 + NTLM Relay attack exploits Windows systems’ automatic DHCPv6 requests, even in networks that […]
The post MITM6 + NTLM Relay Attack Enables Full Domain Compromise appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
The legendary hacker journal Phrack has turned forty, marking the occasion with its anniversary 72nd issue, published on August 19, 2025. Founded in the mid-1980s, this iconic publication is regarded as one of the...
The post Phrack at 40: The Legendary Hacker Zine Celebrates Four Decades of Security and Subversion appeared first on Penetration Testing Tools.
Researchers at Push Security have discovered a new phishing campaign that targets Microsoft 365 (M365) systems and uses Active Directory Federation Services (ADFS) to enable credential theft. This attack vector exploits Microsoft’s authentication redirect mechanisms, effectively turning a legitimate service into a conduit for phishing operations. Sophisticated Phishing Infrastructure The campaign begins with malvertising lures […]
The post New Campaign Uses Active Directory Federation Services to Steal M365 Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Cybercriminal groups are building entire infrastructures to propagate infostealers—malicious programs designed to steal passwords, payment card details, and other sensitive information from infected devices. Analysts describe what they call the “Stealer Ecosystem,” where the...
The post Inside the “Stealer Ecosystem”: How the Cybercrime Economy Professionalized Data Theft appeared first on Penetration Testing Tools.