Emerging MakeFrame Skimmer from Magecart Sets Sights on SMBs

Researchers have observed a new skimmer from the prolific Magecart Group that has been actively harvesting payment-card data from 19 different victim websites, mainly belonging to small- and medium-sized businesses SMBs, for several months. RiskIQ researchers first discovered the skimmer, dubbed...

Magecart Hackers Inject iFrame Skimmers in 19 Sites to Steal Payment Data

Cybersecurity researchers today uncovered an ongoing new Magecart skimmer campaign that so far has successfully compromised at least 19 different e-commerce websites to steal payment card details of their customers. According to a report published today and shared with The Hacker News, RiskIQ...

Holy water: ongoing targeted water-holing attack in Asia

On December 4, 2019, we discovered watering hole websites that were compromised to selectively trigger a drive-by download attack with fake Adobe Flash update warnings. This campaign has been active since at least May 2019, and targets an Asian religious and ethnic group. The threat actor's...

Samsung Mobile Device Type Obfuscation Vulnerability (CNVD-2020-32875)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. A type confusion vulnerability exists in Samsung mobile devices, which can be exploited by attackers to execute arbitrary code...

PYSEC-2020-101

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

PT-2020-18346

Name of the Vulnerable Software and Affected Versions safety affected versions not specified Description The command-line "safety" package for Python has a potential security issue due to two Python characteristics that allow malicious code to disguise or obfuscate other malicious or non-secure...

Revamped HawkEye Keylogger Swoops in on Coronavirus Fears

There’s a new variant of the HawkEye keylogging malware making the rounds, featuring expanded info-stealing capabilities. Its operators are looking to capture the zeitgeist around the novel coronavirus. It’s being distributed using spam that purports to be an “alert” from the Director-General of...

Revamped HawkEye Keylogger Swoops in on Coronavirus Fears

There’s a new variant of the HawkEye keylogging malware making the rounds, featuring expanded info-stealing capabilities. Its operators are looking to capture the zeitgeist around the novel coronavirus. It’s being distributed using spam that purports to be an “alert” from the Director-General of...

Rocket Loader skimmer impersonates CloudFlare library in clever scheme

Update: The digital certificate issued for https.ps has been revoked by GlobalSign. Fraudsters are known for using social engineering tricks to dupe their victims, often times by impersonating authority figures to instill trust. In a recent blog post, we noted how criminals behind Magecart skimme...

Roaming Mantis, part V

Kaspersky has continued to track the Roaming Mantis campaign. The group's attack methods have improved and new targets continuously added in order to steal more funds. The attackers' focus has also shifted to techniques that avoid tracking and research: whitelist for distribution, analysis...

ABD - Course Materials For Advanced Binary Deobfuscation

Advanced Binary Deobfuscation This repository contains the course materials of Advanced Binary Deobfuscation at the Global Cybersecurity Camp GCC Tokyo in 2020. Course Abstract Reverse engineering is not easy, especially if a binary code is obfuscated. Once obfuscation performed, the binary would...

Building a bypass with MSBuild

By Vanja Svajcer. NEWS SUMMARY Living-off-the-land binaries LoLBins continue to pose a risk to security defenders. We analyze the usage of the Microsoft Build Engine by attackers and red team personnel. These threats demonstrate techniques T1127 Trusted Developer Utilities and T1500 Compile After...

CVE-2013-7286

MobileIron VSP 5.9.1 and Sentry 5.0 has a weak password obfuscation algorithm...

CVE-2013-7286

CVE-2013-7286 affects MobileIron VSP < 5.9.1 and Sentry

CVE-2013-7286

MobileIron VSP 5.9.1 and Sentry 5.0 has a weak password obfuscation algorithm...

PT-2020-7573

Name of the Vulnerable Software and Affected Versions MobileIron VSP versions prior to 5.9.1 MobileIron Sentry versions prior to 5.0 Description The issue is related to a weak password obfuscation algorithm. Recommendations For MobileIron VSP versions prior to 5.9.1, update to version 5.9.1 or...

CVE-2013-7286: Inadequate Encryption Strength

MobileIron VSP 5.9.1 and Sentry 5.0 has a weak password obfuscation algorithm...

AZORult Campaign Adopts Novel Triple-Encryption Technique

A recent wave of AZORult-laced spam caught the attention of researchers who warn that malicious attachments associated with the campaign are using a novel obfuscation technique, in an attempt to slip past spam gateways and avoid client-side antivirus detection. What makes this campaign unique is...

Advanced Obfuscation Marks Widespread Info-Stealing Campaign

A large-scale spam campaign bent on spreading info-stealing malware is applying advanced obfuscation techniques to get around security scanning and maximize infection rates. According to Lastline researchers, a large botnet is distributing malicious rich text format RTF documents that act as...

CVE-2020-8445

In OSSEC-HIDS 2.7 through 3.5.0, the OSCleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines \n are permitted in messages processed by ossec-analysisd, i...