Cyber Security News

XWorm has emerged as one of the most versatile and actively distributed remote access trojans in the current threat landscape, establishing itself as a formidable tool in cybercriminals’ arsenals. This sophisticated malware has evolved far beyond traditional RAT capabilities, incorporating advanced features including keylogging, remote desktop access, data exfiltration, and command execution that make it […]

The post XWorm – The Most Active RAT Uses New Stagers and Loaders to Bypass Defenses appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a concerning development as malicious actors began exploiting SHELLTER, a commercial anti-virus and endpoint detection response (EDR) evasion framework, to deploy sophisticated malware payloads. Originally designed for legitimate penetration testing operations, this framework has been weaponized by cybercriminals since late April 2025, marking a significant escalation in evasion capabilities available to […]

The post Threat Actors Abused AV – EDR Evasion Framework In-The-Wild to Deploy Malware Payloads appeared first on Cyber Security News.

The cybercriminal group known as Scattered Spider has significantly evolved its attack methodologies, demonstrating alarming sophistication in exploiting legitimate administrative tools to maintain persistent access to compromised networks. Also tracked under aliases including UNC3944, Scatter Swine, and Muddled Libra, this financially motivated threat actor has been actively targeting large enterprises since May 2022, with particular […]

The post Scattered Spider Upgraded Their Tactics to Abuse Legitimate Tools to Evade Detection and Maintain Persistence appeared first on Cyber Security News.

Cybercriminals have increasingly turned to legitimate software installation frameworks as vehicles for malware distribution, with Inno Setup emerging as a preferred tool for threat actors seeking to bypass security measures. This legitimate Windows installer framework, originally designed to simplify software deployment, has become a sophisticated delivery mechanism for information-stealing malware campaigns that target browser credentials […]

The post Hackers Exploit Legitimate Inno Setup Installer to Use as a Malware Delivery Vehicle appeared first on Cyber Security News.

A new wave of cyberattacks is targeting organizations that inadvertently expose Java Debug Wire Protocol (JDWP) servers to the internet, with attackers leveraging this overlooked entry point to deploy sophisticated cryptomining malware. JDWP, a standard feature in the Java platform, is designed to facilitate remote debugging by allowing developers to inspect live applications. However, when […]

The post Hackers Exploiting Java Debug Wire Protocol Servers in Wild to Deploy Cryptomining Payload appeared first on Cyber Security News.

Key Takeaways1. Next.js versions 15.1.0-15.1.8 have a cache poisoning bug causing DoS attacks through blank page delivery.2. Needs affected Next.js version + ISR with cache revalidation + SSR with CDN caching 204 responses.3. Race condition allows HTTP 204 responses to be cached for static pages, serving empty content to all users.4. Update to Next.js 15.1.8+ […]

The post Next.js Cache Poisoning Vulnerability Let Attackers Trigger DoS Condition appeared first on Cyber Security News.

A critical security vulnerability has been discovered in HIKVISION’s applyCT component, part of the HikCentral Integrated Security Management Platform, that allows attackers to execute arbitrary code remotely without authentication.  Assigned CVE-2025-34067 with a maximum CVSS score of 10.0, this vulnerability stems from the platform’s use of a vulnerable version of the Fastjson library, exposing millions […]

The post Critical HIKVISION applyCT Vulnerability Exposes Devices to Code Execution Attacks appeared first on Cyber Security News.

Critical security vulnerabilities have been discovered in PHP that could allow attackers to execute SQL injection attacks and cause denial of service (DoS) conditions.  Two distinct vulnerabilities, assigned CVE-2025-1735 and CVE-2025-6491, affect multiple PHP versions and require immediate patching.  Key Takeaways1. CVE-2025-1735 (PostgreSQL) and CVE-2025-6491 (SOAP) affect versions below 8.1.33, 8.2.29, 8.3.23, and 8.4.10.2. PostgreSQL […]

The post Multiple PHP Vulnerabilities Allow SQL Injection & DoS Attacks – Update Now appeared first on Cyber Security News.

A sophisticated mobile ad fraud operation dubbed “IconAds” has infiltrated Android devices worldwide through 352 malicious applications distributed via Google Play Store, generating up to 1.2 billion fraudulent bid requests daily at its peak. The scheme represents a significant evolution in mobile advertising fraud, employing advanced obfuscation techniques to hide malicious apps from users while […]

The post Massive Android Ad Fraud ‘IconAds’ Leverages Google Play to Attack Phone Users appeared first on Cyber Security News.

A sophisticated technique to bypass Content Security Policy (CSP) protections using a combination of HTML injection and browser cache manipulation.  The method exploits the interaction between nonce-based CSP implementations and browser caching mechanisms, specifically targeting the back/forward cache (bfcache) and disk cache systems.  Key Takeaways1. Researchers exploit browser caching to bypass Content Security Policy protections.2. […]

The post New Sophisticated Attack Bypasses Content Security Policy Using HTML-Injection Technique appeared first on Cyber Security News.

Microsoft is currently investigating a significant service disruption affecting Microsoft Forms, leaving numerous users unable to access the popular online survey and quiz platform. The issue, identified as incident FM1109073, began on July 4, 2025, at 12:42 PM GMT+5:30 and has been classified as a service degradation affecting global users. The outage is preventing users […]

The post Microsoft Investigating Forms Service Issue Not Accessible for Users appeared first on Cyber Security News.

A new credential-stealing malware dubbed “123 | Stealer” has surfaced on underground cybercrime forums, being marketed by threat actor “koneko” for $120 per month.  This malware-as-a-service (MaaS) offering represents the latest evolution in information stealer technology, combining sophisticated data exfiltration capabilities with a user-friendly administrative interface. Key Takeaways1. "123 | Stealer" marketed for $120/month by […]

The post New “123 | Stealer” Advertised on Underground Hacking Forums for $120 Per Month appeared first on Cyber Security News.

A sophisticated social engineering campaign has emerged targeting unsuspecting users through fraudulent Cloudflare verification screens, representing a new evolution in malware distribution tactics. This attack method leverages the trusted appearance of legitimate web security services to deceive victims into executing malicious code on their systems, exploiting inherent trust in established security providers. The malware campaign […]

The post Hackers use Fake Cloudflare Verification Screen to Trick Users into Executing Malware appeared first on Cyber Security News.

A dramatic surge in password spray attacks targeting enterprise infrastructure, with Cisco ASA VPN systems experiencing an unprecedented 399% increase in attacks during Q1 2025, while Microsoft 365 authentication services saw a 21% rise in similar attacks. The alarming statistics reveal a fundamental shift in threat actor tactics, as cybercriminals increasingly pivot from cloud service […]

The post Massive Spike in Password Attacks Targeting Cisco ASA VPN Followed by Microsoft 365 appeared first on Cyber Security News.

A sophisticated new botnet family has emerged in the cybersecurity landscape, demonstrating unprecedented innovation in malware design and attack methodologies. The hpingbot malware, first detected in June 2025, represents a significant departure from traditional botnet architectures by leveraging legitimate online services and network testing tools to orchestrate distributed denial-of-service attacks while maintaining operational stealth. Unlike […]

The post New Hpingbot Abusing Pastebin for Payload Delivery and Hping3 Tool to Launch DDoS Attacks appeared first on Cyber Security News.

Microsoft Azure’s role-based access control system has been found to contain critical security vulnerabilities that could expose enterprise networks to unauthorized access. Security researchers have identified a combination of over-privileged built-in roles and API implementation flaws that create dangerous attack vectors for malicious actors seeking to compromise cloud infrastructure and on-premises networks. The vulnerabilities center […]

The post Azure API Vulnerabilities Leak VPN Keys and Built-In Roles Allow Over-Privileged Access appeared first on Cyber Security News.

The .COM top-level domain continues to dominate the cybercriminal landscape as the primary vehicle for hosting credential phishing websites, maintaining its position as the most extensively abused TLD by threat actors worldwide. Recent intelligence indicates that malicious actors leverage the trusted reputation and widespread recognition of .COM domains to deceive victims into surrendering sensitive login […]

The post Threat Actors Widely Abuse .COM TLD to Host Credential Phishing Website appeared first on Cyber Security News.

Citrix has issued an urgent advisory warning customers of widespread authentication failures following recent updates to NetScaler builds 14.1.47.46 and 13.1.59.19. The updates, released as part of the company’s ongoing secure-by-design initiative, have inadvertently caused significant disruption to enterprise authentication systems across multiple organizations worldwide. The authentication failures manifest as broken login pages and complete […]

The post Citrix Warns Authentication Failures Following The Update of NetScaler to Fix Auth Vulnerability appeared first on Cyber Security News.

Critical vulnerabilities in Apache Tomcat and Apache Camel are being actively exploited by cybercriminals worldwide, with security researchers documenting over 125,000 attack attempts across more than 70 countries since their disclosure in March 2025. The three vulnerabilities—CVE-2025-24813 affecting Apache Tomcat and CVE-2025-27636 and CVE-2025-29891 impacting Apache Camel—enable remote code execution and pose significant risks to […]

The post Apache Tomcat and Camel Vulnerabilities Actively Exploited in The Wild appeared first on Cyber Security News.

Microsoft has officially acknowledged a harmless error event appearing in Windows Firewall With Advanced Security logs following the installation of the June 2025 Windows non-security preview update.  The company confirmed on July 2, 2025, that the error event, designated as event 2042, poses no security risks and can be safely disregarded by users.  Key Takeaways1. […]

The post Microsoft Confirms Error Entry in Windows Firewall With Advanced Security appeared first on Cyber Security News.