502 matches found
‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems
Researchers have tracked new spyware – dubbed “PseudoManuscrypt” because it’s similar to “Manuscrypt” malware from the Lazarus advanced persistent threat APT group – that’s attempted to scribble itself across more than 35,000 targeted computers in 195 countries. Kaspersky researchers said in a...
The vulnerability of the installation files of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of installation files of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, and Kaspersky Security Cloud antivirus products is related to errors in processing XML requests. Exploiting this vulnerability can allow attacke...
Malvertising attack distributes malicious Chrome extensions, backdoors
By Waqas Researchers believe that the campaign has been active since 2018, and since then, the malware has been under development constantly. Cisco Talos researchers have identified malvertising campaigns using fake installers of popular games and applications, such as WeChat, Viber, Battlefield,...
Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension
By Tiago Pereira. Talos recently observed a malicious campaign offering fake installers of popular software as bait to get users to execute malware on their systems. This campaign includes a set of malware distribution campaigns that started in late 2018 and have targeted mainly Canada, along...
BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors
We observed BazarLoader adding two new arrival mechanisms to their current roster of malware delivery techniques...
CVE-2021-22038
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed the originally called uninstaller exits, so it does not block the installation directory. This temporary location is not randomized and does not restrict access to Administrators only so a...
CVE-2021-22038
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed the originally called uninstaller exits, so it does not block the installation directory. This temporary location is not randomized and does not restrict access to Administrators only so a...
CVE-2021-22038
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed the originally called uninstaller exits, so it does not block the installation directory. This temporary location is not randomized and does not restrict access to Administrators only so a...
Design/Logic Flaw
The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation...
FinSpy: unseen findings
FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011. Historically, its Windows implant was distributed through a single-stage installer. This version was detected and researched several times up to...
A New Jupyter Malware Version is Being Distributed via MSI Installers
Cybersecurity researchers have charted the evolution of Jupyter, a .NET infostealer known for singling out healthcare and education sectors, which make it exceptional at defeating most endpoint security scanning solutions. The new delivery chain, spotted by Morphisec on September 8, underscores...
Fake Installers Drop Malware and Open Doors for Opportunistic Attackers
We recently spotted fake installers of popular software being used to deliver bundles of malware onto victims’ devices. These installers are widely used lures that trick users into opening malicious documents or installing unwanted applications...
Vulnerability found in Apache OpenOffice
A vulnerability has been found in Apache OpenOffice. The vulnerability allows a remote malicious person to execute arbitrary code. The malicious party must victim to open a rogue document. More information about the vulnerability can be found in a blog post by the researcher who reported the...
The installers of multiple Sony products may insecurely load Dynamic Link Libraries
Overview The installers of multiple Sony products contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Shogo Kumamaru of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...
Metasploit Wrap-Up
Desert heat not the 1999 film This week was more quiet than normal with Black Hat USA and DEF CON, but that didn’t stop the team from delivering some small enhancements and bug fixes! We are also excited to see two new modules 15519 and 15520 from researcher Jacob Baines’ DEF CON talk Bring You...
Fake Windows 11 installers infecting devices with adware, malware
By Deeba Ahmed Originally, Windows 11 will be available for download from October 2021 - It will be a free upgrade for existing Windows 10 users. This is a post from HackRead.com Read the original post: Fake Windows 11 installers infecting devices with adware, malware...
ICS Focused Malware
Updated July 20, 2021: The U.S. Government attributes this activity to Russian nation-state cyber actors and assess that Russian nation-state cyber actors deployed Havex malware against industrial control systems. For more information on Russian malicious cyber activity, refer...
Lexmark Printer Software 代码问题漏洞
Lexmark Printer Software is a printer driver from Lexmark USA. A security vulnerability exists in Lexmark Printer Software that originates from registry entries having unreferenced service paths, and the Lexmark Printer Software G2, G3, and G4 installers have a privileged vulnerable local upgrade...
Metasploit Wrap-Up
Containers that fail to Contain Our own Christophe De La Fuente added a module for CVE-2019-5736 based on the work of Adam Iwaniuk that breaks out of a Docker container by overwriting the runc binary of an image which is run in the user context whenever someone outside the container runs docker...
CVE-2021-33356
Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command execution with root privileges...